spp_prxy.c

                s->init_num=next_st->init_num=0;
                
                // Receive and forward the certificates for proxies between us and the server
                if ((proxy = spp_get_next_proxy(s, this_proxy, 0)) != NULL) {
                    // Flush our cert in both directions
                    // Need to receive and forward certificates from proxies between this proxy and the client
                    s->state=SPP_ST_SW_AHEAD_FLUSH;
                    s->s3->tmp.next_state=SPP_ST_PR_AHEAD_A;
                } else {
                    // No proxies between us and client, wait for client key exchange
                    s->state=SPP_ST_SW_AHEAD_FLUSH;
                    s->s3->tmp.next_state=SSL3_ST_SR_KEY_EXCH_A;
                }
                break;

            case SPP_ST_PR_BEHIND_A:
            case SPP_ST_PR_BEHIND_B:
                                #ifdef DEBUG
                //printf("Receiving message from behind proxy %d\n", proxy->proxy_id);
				log_time("Waiting for messages from proxies behind\n", &currTime, &prevTime, &originTime); 
				#endif
                while (proxy != NULL) {
                    next_st->state=SPP_ST_PR_BEHIND_A;
                    ret=get_proxy_msg(next_st, SPP_ST_PR_BEHIND_A, SPP_ST_PR_BEHIND_B, -1, 1);
                                #ifdef DEBUG
				log_time("Proxy message received\n", &currTime, &prevTime, &originTime); 
				#endif
                    if (ret <= 0) goto end;
                    s->init_num=next_st->init_num=0;
                    if (next_st->s3->tmp.message_type == SSL3_MT_SERVER_DONE) {
                        if ((proxy = spp_get_next_proxy(s, proxy, 0)) == NULL || proxy->proxy_id == s->proxy_id) {
                            s->state=SPP_ST_SW_AHEAD_FLUSH;
                            s->s3->tmp.next_state=SSL3_ST_SW_CERT_A;
                            break;
                        }
                        //printf("Receiving message from behind proxy %d\n", proxy->proxy_id);
                    }
                }
                
                break;
                
            case SPP_ST_PR_AHEAD_A:
            case SPP_ST_PR_AHEAD_B:
                                #ifdef DEBUG
//printf("Receiving message from ahead proxy %d\n", proxy->proxy_id);
				log_time("Waiting for messages from proxies ahead\n", &currTime, &prevTime, &originTime); 
				#endif
                while (proxy != NULL) {
                    s->state=SPP_ST_PR_AHEAD_A;
                    ret=get_proxy_msg(s, SPP_ST_PR_AHEAD_A, SPP_ST_PR_AHEAD_B, -1, 1);
                                #ifdef DEBUG
				log_time("Proxy message received\n", &currTime, &prevTime, &originTime); 
				#endif
                    if (ret <= 0) goto end;
                    s->init_num=next_st->init_num=0;
                    if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE) {
                        if ((proxy = spp_get_next_proxy(s, proxy, 0)) == NULL) {
                            //s->state=SPP_ST_CW_BEHIND_FLUSH;
                            //s->s3->tmp.next_state=SSL3_ST_SR_KEY_EXCH_A;
                            s->state=SSL3_ST_SR_KEY_EXCH_A;
                            break;
                        } 
                        //printf("Receiving message from ahead proxy %d\n", proxy->proxy_id);
                    }
                }
                
                break;
		
            case SSL3_ST_SW_FLUSH:
                /* This code originally checked to see if
                 * any data was pending using BIO_CTRL_INFO
                 * and then flushed. This caused problems
                 * as documented in PR#1939. The proposed
                 * fix doesn't completely resolve this issue
                 * as buggy implementations of BIO_CTRL_PENDING
                 * still exist. So instead we just flush
                 * unconditionally.
                 */

                s->rwstate=SSL_WRITING;
                if (BIO_flush(s->wbio) <= 0) {
                    ret= -1;
                    goto end;
                }
                s->rwstate=SSL_NOTHING;
                next_st->rwstate=SSL_WRITING;
                if (BIO_flush(next_st->wbio) <= 0) {
                    ret= -1;
                    goto end;
                }
                next_st->rwstate=SSL_NOTHING;

                s->state=s->s3->tmp.next_state;
                break;
                
            case SPP_ST_SW_AHEAD_FLUSH:
                /* Flush between the proxy and the client
                 */

                s->rwstate=SSL_WRITING;
                if (BIO_flush(s->wbio) <= 0) {
                    ret= -1;
                    goto end;
                }
                s->rwstate=SSL_NOTHING;

                s->state=s->s3->tmp.next_state;
                break;
                
            case SPP_ST_CW_BEHIND_FLUSH:
                /* Flush between the proxy and the server
                 */

                next_st->rwstate=SSL_WRITING;
                if (BIO_flush(next_st->wbio) <= 0) {
                    ret= -1;
                    goto end;
                }
                next_st->rwstate=SSL_NOTHING;

                s->state=s->s3->tmp.next_state;
                break;
                
            case SSL3_ST_SR_KEY_EXCH_A:
            case SSL3_ST_SR_KEY_EXCH_B:
                                #ifdef DEBUG
				log_time("Waiting for client key exchange\n", &currTime, &prevTime, &originTime); 
				#endif
                ret=get_proxy_msg(s, SSL3_ST_SR_KEY_EXCH_A, SSL3_ST_SR_KEY_EXCH_B, SSL3_MT_CLIENT_KEY_EXCHANGE,1);
                                #ifdef DEBUG
				log_time("Received client key exchange\n", &currTime, &prevTime, &originTime); 
				#endif
                if (ret <= 0) goto end;
                
                s->state=SPP_ST_CR_PRXY_MAT_A;
                s->init_num=next_st->init_num=0;
                break;
                
            case SPP_ST_CR_PRXY_MAT_A:
            case SPP_ST_CR_PRXY_MAT_B:
                                #ifdef DEBUG
				log_time("Receiving client key material\n", &currTime, &prevTime, &originTime); 
				#endif
                // Receive proxy key material for each proxy and the server
                // Pass all messages on
                for (i = 0; i <= s->proxies_len; i++) {
                    s->state = next_st->state = SPP_ST_CR_PRXY_MAT_A;
                    ret=get_proxy_msg(s, SPP_ST_CR_PRXY_MAT_A, SPP_ST_CR_PRXY_MAT_B, SPP_MT_PROXY_KEY_MATERIAL,1);                    
                    if (ret <= 0) goto end;
                    ret=get_proxy_material(s, 0); // From client
                    if (ret <= 0) goto end;
                    s->init_num=next_st->init_num=0;
                }
                
#if defined(OPENSSL_NO_TLSEXT) || defined(OPENSSL_NO_NEXTPROTONEG)
                s->state=SSL3_ST_SR_FINISHED_A;
#else
                if (s->s3->next_proto_neg_seen)
                    s->state=SSL3_ST_SR_NEXT_PROTO_A;
                else
                    s->state=SSL3_ST_SR_FINISHED_A;
#endif
                //s->s3->tmp.next_state=SPP_ST_SR_PRXY_MAT_A;
                //s->state=SSL3_ST_SW_FLUSH;
                break;
                
            case SPP_ST_SR_PRXY_MAT_A:
            case SPP_ST_SR_PRXY_MAT_B:
                                #ifdef DEBUG
				log_time("Receiving server key material\n", &currTime, &prevTime, &originTime); 
				#endif
                // Receive proxy key material for each proxy and the server
                // Pass all messages on
                for (i = 0; i <= s->proxies_len; i++) {
                    //printf("Waiting for proxy material message\n");
                    s->state = next_st->state = SPP_ST_SR_PRXY_MAT_A;
                    ret=get_proxy_msg(next_st, SPP_ST_SR_PRXY_MAT_A, SPP_ST_SR_PRXY_MAT_B, SPP_MT_PROXY_KEY_MATERIAL, 1);
                    if (ret <= 0) goto end;
                    //printf("Got material message\n");
                    ret=get_proxy_material(next_st, 1); // From server
                    if (ret <= 0) goto end;
                    s->init_num=next_st->init_num=0;
                }
                
#ifndef OPENSSL_NO_TLSEXT
                if (s->tlsext_ticket_expected)
                    s->state=SSL3_ST_CR_FINISHED_A;
                else
#endif
                    s->state=SSL3_ST_CR_FINISHED_A;
                break;

#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
            case SSL3_ST_SR_NEXT_PROTO_A:
            case SSL3_ST_SR_NEXT_PROTO_B:
                                #ifdef DEBUG
				log_time("Receiving next proto\n", &currTime, &prevTime, &originTime); 
				#endif
                ret=get_proxy_msg(s, SSL3_ST_SR_NEXT_PROTO_A, SSL3_ST_SR_NEXT_PROTO_B, SSL3_MT_NEXT_PROTO,1);
                if (ret <= 0) goto end;
                s->init_num=next_st->init_num=0;
                s->state=SSL3_ST_SR_FINISHED_A;
                break;
#endif

            case SSL3_ST_SR_FINISHED_A:
            case SSL3_ST_SR_FINISHED_B:
                                #ifdef DEBUG
				log_time("Waiting for finished from client\n", &currTime, &prevTime, &originTime); 
				#endif
                s->s3->flags |= SSL3_FLAGS_CCS_OK;
                ret=spp_get_finished(s, SSL3_ST_SR_FINISHED_A, SSL3_ST_SR_FINISHED_B);
                if (ret <= 0) goto end;
                s->init_num=next_st->init_num=0;
                
                s->state=SPP_ST_CW_BEHIND_FLUSH;
                if (s->hit)
                    s->s3->tmp.next_state=SSL_ST_OK;
                else
                    s->s3->tmp.next_state=SPP_ST_SR_PRXY_MAT_A;

                
                /* Cipher state should actually be changed before the finished message.
                 * Since proxies do not actually validate the Finished message, however,
                 * it may be done after. */
                /*if (!s->method->ssl3_enc->change_cipher_state(s, SSL3_CHANGE_CIPHER_SERVER_READ)) {
                    ret= -1;
                    goto end;
                }*/ /* Done when receiving the change cipher spec message */
                next_st->session->cipher=s->s3->tmp.new_cipher;
                if (!next_st->method->ssl3_enc->setup_key_block(next_st))
                        { ret= -1; goto end; }
                if (!next_st->method->ssl3_enc->change_cipher_state(next_st, SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
                    ret= -1;
                    goto end;
                }
                break;
                
            case SSL3_ST_SW_SESSION_TICKET_A:
            case SSL3_ST_SW_SESSION_TICKET_B:
                                #ifdef DEBUG
				log_time("Waiting for session ticket\n", &currTime, &prevTime, &originTime); 
				#endif
                ret=get_proxy_msg(next_st, SSL3_ST_SW_SESSION_TICKET_A, SSL3_ST_SW_SESSION_TICKET_B, SSL3_MT_NEWSESSION_TICKET,1);
                if (ret <= 0) goto end;
                s->state=SSL3_ST_CR_FINISHED_A;
                s->init_num=next_st->init_num=0;
                break;
                
            case SSL3_ST_CR_FINISHED_A:
            case SSL3_ST_CR_FINISHED_B:
                                #ifdef DEBUG
				log_time("Waiting for finished from server\n", &currTime, &prevTime, &originTime); 
				#endif
                next_st->s3->flags |= SSL3_FLAGS_CCS_OK;
                ret=spp_get_finished(next_st, SSL3_ST_CR_FINISHED_A, SSL3_ST_CR_FINISHED_B);
                if (ret <= 0) goto end;
                s->init_num=next_st->init_num=0;
                
                s->s3->tmp.next_state=SSL_ST_OK;
                s->state=SPP_ST_SW_AHEAD_FLUSH;
                
                s->session->cipher=s->s3->tmp.new_cipher;
                if (!s->method->ssl3_enc->setup_key_block(s))
                        { ret= -1; goto end; }
                if (!s->method->ssl3_enc->change_cipher_state(s, SSL3_CHANGE_CIPHER_SERVER_WRITE)) {
                    ret= -1;
                    goto end;
                }
                /*if (!next_st->method->ssl3_enc->change_cipher_state(next_st, SSL3_CHANGE_CIPHER_CLIENT_READ)) {
                    ret= -1;
                    goto end;
                }*/ /* Done when receiving the change cipher spec message */
                
                /* Setup the slices now that we have the necessary state. */
                ret = spp_init_slices_st(s, SSL3_CHANGE_CIPHER_SERVER_WRITE);
                if (ret <= 0) goto end;
                ret = spp_init_slices_st(s, SSL3_CHANGE_CIPHER_SERVER_READ);
                if (ret <= 0) goto end;
                ret = spp_init_slices_st(next_st, SSL3_CHANGE_CIPHER_CLIENT_WRITE);
                if (ret <= 0) goto end;
                ret = spp_init_slices_st(next_st, SSL3_CHANGE_CIPHER_CLIENT_READ);
                if (ret <= 0) goto end;
                break;

            case SSL_ST_OK:
                                #ifdef DEBUG
				log_time("Handshake OK\n", &currTime, &prevTime, &originTime); 
				#endif
                next_st->state=SSL_ST_OK;
                /* clean a few things up */
                ssl3_cleanup_key_block(s);
                ssl3_cleanup_key_block(next_st);

                BUF_MEM_free(s->init_buf);
                s->init_buf=NULL;
                BUF_MEM_free(next_st->init_buf);
                next_st->init_buf=NULL;

                /* remove buffering on output */
                ssl_free_wbio_buffer(s);
                if (!(next_st->s3->flags & SSL3_FLAGS_POP_BUFFER))
                ssl_free_wbio_buffer(next_st);

                s->init_num=0;

                /* skipped if we just sent a HelloRequest */
                if (s->renegotiate == 2) {
                    s->renegotiate=0;
                    s->new_session=0;

                    ssl_update_cache(s,SSL_SESS_CACHE_SERVER);

                    s->ctx->stats.sess_accept_good++;
                    /* s->server=1; */
                    s->handshake_func=spp_proxy_accept;

                    if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
                }
                
                next_st->init_num=0;
                next_st->renegotiate=0;
                next_st->new_session=0;

                next_st->handshake_func=spp_proxy_connect;

                ret = 1;
                goto end;
                /* break; */

            default:
                SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_UNKNOWN_STATE);
                ret= -1;
                goto end;
                /* break; */
        }
		
        if (!s->s3->tmp.reuse_message && !skip) {
            if (s->debug) {
                if ((ret=BIO_flush(s->wbio)) <= 0)
                    goto end;
            }

            if ((cb != NULL) && (s->state != state)) {
                new_state=s->state;
                s->state=state;
                cb(s,SSL_CB_ACCEPT_LOOP,1);
                s->state=new_state;
            }
        }
        skip=0;
    }
end:
                    #ifdef DEBUG
                    log_time("Handshake end\n", &currTime, &prevTime, &originTime); 
                    #endif
    /* BIO_flush(s->wbio); */

    s->s3->change_cipher_spec=0;
    s->in_handshake--;
    if (next_st != NULL) {
        next_st->in_handshake--;
        next_st->s3->change_cipher_spec=0;
    }
    if (cb != NULL)
            cb(s,SSL_CB_ACCEPT_EXIT,ret);
    return(ret);
}