Commit 76d0c6d4 authored by Matt Caswell's avatar Matt Caswell
Browse files

Add more error state transitions (DTLS) 



Ensure all fatal errors transition into the new error state for DTLS.

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(cherry picked from commit cefc9391)

Conflicts:
	ssl/d1_srvr.c

Conflicts:
	ssl/d1_srvr.c
parent a329ae22

ssl/d1_clnt.c

+10 −0
Original line number Diff line number Diff line
@@ -212,6 +212,7 @@ int dtls1_connect(SSL *s) 
                (s->version & 0xff00) != (DTLS1_BAD_VER & 0xff00)) {

                SSLerr(SSL_F_DTLS1_CONNECT, ERR_R_INTERNAL_ERROR);

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }
@@ -221,10 +222,12 @@ int dtls1_connect(SSL *s) 
            if (s->init_buf == NULL) {

                if ((buf = BUF_MEM_new()) == NULL) {

                    ret = -1;

                    s->state = SSL_ST_ERR;

                    goto end;

                }

                if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {

                    ret = -1;

                    s->state = SSL_ST_ERR;

                    goto end;

                }

                s->init_buf = buf;
@@ -233,12 +236,14 @@ int dtls1_connect(SSL *s) 


            if (!ssl3_setup_buffers(s)) {

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }



            /* setup buffing BIO */

            if (!ssl_init_wbio_buffer(s, 0)) {

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }
@@ -417,6 +422,7 @@ int dtls1_connect(SSL *s) 
             */

            if (!ssl3_check_cert_and_algorithm(s)) {

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }

            break;
@@ -548,6 +554,7 @@ int dtls1_connect(SSL *s) 
#endif

            if (!s->method->ssl3_enc->setup_key_block(s)) {

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }
@@ -555,6 +562,7 @@ int dtls1_connect(SSL *s) 
                                                          SSL3_CHANGE_CIPHER_CLIENT_WRITE))

            {

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }

#ifndef OPENSSL_NO_SCTP
@@ -735,6 +743,7 @@ int dtls1_connect(SSL *s) 
            goto end;

            /* break; */



        case SSL_ST_ERR:

        default:

            SSLerr(SSL_F_DTLS1_CONNECT, SSL_R_UNKNOWN_STATE);

            ret = -1;
@@ -945,6 +954,7 @@ static int dtls1_get_hello_verify(SSL *s) 


 f_err:

    ssl3_send_alert(s, SSL3_AL_FATAL, al);

    s->state = SSL_ST_ERR;

    return -1;

}

ssl/d1_srvr.c

+8 −0
Original line number Diff line number Diff line
@@ -224,11 +224,13 @@ int dtls1_accept(SSL *s) 
            if (s->init_buf == NULL) {

                if ((buf = BUF_MEM_new()) == NULL) {

                    ret = -1;

                    s->state = SSL_ST_ERR;

                    goto end;

                }

                if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {

                    BUF_MEM_free(buf);

                    ret = -1;

                    s->state = SSL_ST_ERR;

                    goto end;

                }

                s->init_buf = buf;
@@ -236,6 +238,7 @@ int dtls1_accept(SSL *s) 


            if (!ssl3_setup_buffers(s)) {

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }
@@ -257,6 +260,7 @@ int dtls1_accept(SSL *s) 
#endif

                    if (!ssl_init_wbio_buffer(s, 1)) {

                        ret = -1;

                        s->state = SSL_ST_ERR;

                        goto end;

                    }
@@ -744,6 +748,7 @@ int dtls1_accept(SSL *s) 
            s->session->cipher = s->s3->tmp.new_cipher;

            if (!s->method->ssl3_enc->setup_key_block(s)) {

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }
@@ -772,6 +777,7 @@ int dtls1_accept(SSL *s) 
                                                          SSL3_CHANGE_CIPHER_SERVER_WRITE))

            {

                ret = -1;

                s->state = SSL_ST_ERR;

                goto end;

            }
@@ -852,6 +858,7 @@ int dtls1_accept(SSL *s) 
            goto end;

            /* break; */



        case SSL_ST_ERR:

        default:

            SSLerr(SSL_F_DTLS1_ACCEPT, SSL_R_UNKNOWN_STATE);

            ret = -1;
@@ -932,6 +939,7 @@ int dtls1_send_hello_verify_request(SSL *s) 
                                      &(s->d1->cookie_len)) == 0) {

            SSLerr(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST,

                   ERR_R_INTERNAL_ERROR);

            s->state = SSL_ST_ERR;

            return 0;

        }