Commit ef6c191b authored by Matt Caswell's avatar Matt Caswell
Browse files

Update end of early data processing for draft-19 



The end of early data is now indicated by a new handshake message rather
than an alert.

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2895)
parent bc993d30

include/openssl/ssl.h

+5 −2
Original line number Diff line number Diff line
@@ -901,7 +901,9 @@ typedef enum { 
    TLS_ST_SR_KEY_UPDATE,

    TLS_ST_CR_KEY_UPDATE,

    TLS_ST_EARLY_DATA,

    TLS_ST_PENDING_EARLY_DATA_END

    TLS_ST_PENDING_EARLY_DATA_END,

    TLS_ST_CW_END_OF_EARLY_DATA,

    TLS_ST_SR_END_OF_EARLY_DATA

} OSSL_HANDSHAKE_STATE;



/*
@@ -1027,7 +1029,6 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION) 
# define SSL_AD_INTERNAL_ERROR           TLS1_AD_INTERNAL_ERROR

# define SSL_AD_USER_CANCELLED           TLS1_AD_USER_CANCELLED

# define SSL_AD_NO_RENEGOTIATION         TLS1_AD_NO_RENEGOTIATION

# define SSL_AD_END_OF_EARLY_DATA        TLS13_AD_END_OF_EARLY_DATA

# define SSL_AD_MISSING_EXTENSION        TLS13_AD_MISSING_EXTENSION

# define SSL_AD_CERTIFICATE_REQUIRED     TLS13_AD_CERTIFICATE_REQUIRED

# define SSL_AD_UNSUPPORTED_EXTENSION    TLS1_AD_UNSUPPORTED_EXTENSION
@@ -2373,6 +2374,7 @@ int ERR_load_SSL_strings(void); 
# define SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP                482

# define SSL_F_TLS_CONSTRUCT_CTOS_VERIFY                  358

# define SSL_F_TLS_CONSTRUCT_ENCRYPTED_EXTENSIONS         443

# define SSL_F_TLS_CONSTRUCT_END_OF_EARLY_DATA            536

# define SSL_F_TLS_CONSTRUCT_EXTENSIONS                   447

# define SSL_F_TLS_CONSTRUCT_FINISHED                     359

# define SSL_F_TLS_CONSTRUCT_HELLO_REQUEST                373
@@ -2434,6 +2436,7 @@ int ERR_load_SSL_strings(void); 
# define SSL_F_TLS_PROCESS_CLIENT_HELLO                   381

# define SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE            382

# define SSL_F_TLS_PROCESS_ENCRYPTED_EXTENSIONS           444

# define SSL_F_TLS_PROCESS_END_OF_EARLY_DATA              537

# define SSL_F_TLS_PROCESS_FINISHED                       364

# define SSL_F_TLS_PROCESS_HELLO_REQ                      507

# define SSL_F_TLS_PROCESS_HELLO_RETRY_REQUEST            511

include/openssl/ssl3.h

+1 −0
Original line number Diff line number Diff line
@@ -280,6 +280,7 @@ extern "C" { 
# define SSL3_MT_CLIENT_HELLO                    1

# define SSL3_MT_SERVER_HELLO                    2

# define SSL3_MT_NEWSESSION_TICKET               4

# define SSL3_MT_END_OF_EARLY_DATA               5

# define SSL3_MT_HELLO_RETRY_REQUEST             6

# define SSL3_MT_ENCRYPTED_EXTENSIONS            8

# define SSL3_MT_CERTIFICATE                     11

ssl/record/rec_layer_s3.c

+10 −31
Original line number Diff line number Diff line
@@ -904,7 +904,8 @@ int do_ssl3_write(SSL *s, int type, const unsigned char *buf, 
        SSL3_RECORD_set_length(thiswr, len);

    }



    if (s->early_data_state == SSL_EARLY_DATA_WRITING) {

    if (s->early_data_state == SSL_EARLY_DATA_WRITING

            || s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY) {

        /*

         * We haven't actually negotiated the version yet, but we're trying to

         * send early data - so we need to use the the tls13enc function.
@@ -1367,19 +1368,18 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf, 
                n = SSL3_RECORD_get_length(rr); /* available bytes */



            /* now move 'n' bytes: */

            while (n-- > 0) {

                dest[(*dest_len)++] =

                    SSL3_RECORD_get_data(rr)[SSL3_RECORD_get_off(rr)];

                SSL3_RECORD_add_off(rr, 1);

                SSL3_RECORD_add_length(rr, -1);

            }



            if (*dest_len < dest_maxlen) {

            memcpy(dest + *dest_len,

                   SSL3_RECORD_get_data(rr) + SSL3_RECORD_get_off(rr), n);

            SSL3_RECORD_add_off(rr, n);

            SSL3_RECORD_add_length(rr, -n);

            *dest_len += n;

            if (SSL3_RECORD_get_length(rr) == 0)

                SSL3_RECORD_set_read(rr);



            if (*dest_len < dest_maxlen)

                goto start;     /* fragment was too small */

        }

    }

    }



    /*-

     * s->rlayer.handshake_fragment_len == 4  iff  rr->type == SSL3_RT_HANDSHAKE;
@@ -1454,14 +1454,6 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf, 
                al = SSL_AD_HANDSHAKE_FAILURE;

                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_NO_RENEGOTIATION);

                goto f_err;

            } else if (alert_descr == SSL_AD_END_OF_EARLY_DATA) {

                if (!ssl_end_of_early_data_seen(s)) {

                    al = SSL_AD_UNEXPECTED_MESSAGE;

                    SSLerr(SSL_F_SSL3_READ_BYTES,

                           SSL_R_UNEXPECTED_END_OF_EARLY_DATA);

                    goto f_err;

                }

                return 0;

            }

        } else if (alert_level == SSL3_AL_FATAL) {

            char tmp[16];
@@ -1504,19 +1496,6 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf, 
     */

    if ((s->rlayer.handshake_fragment_len >= 4)

            && !ossl_statem_get_in_handshake(s)) {

        /*

         * To get here we must be trying to read app data but found handshake

         * data. But if we're trying to read app data, and we're not in init

         * (which is tested for at the top of this function) then init must be

         * finished

         */

        assert(SSL_is_init_finished(s));

        if (!SSL_is_init_finished(s)) {

            al = SSL_AD_INTERNAL_ERROR;

            SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);

            goto f_err;

        }



        /* We found handshake data, so we're going back into init */

        ossl_statem_set_in_init(s, 1);

ssl/record/ssl3_record_tls13.c

+2 −1
Original line number Diff line number Diff line
@@ -56,7 +56,8 @@ int tls13_enc(SSL *s, SSL3_RECORD *recs, size_t n_recs, int send) 


    ivlen = EVP_CIPHER_CTX_iv_length(ctx);



    if (s->early_data_state == SSL_EARLY_DATA_WRITING) {

    if (s->early_data_state == SSL_EARLY_DATA_WRITING

            || s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY) {

        alg_enc = s->session->cipher->algorithm_enc;

    } else {

        /*

ssl/ssl_err.c

+4 −0
Original line number Diff line number Diff line
@@ -343,6 +343,8 @@ static ERR_STRING_DATA SSL_str_functs[] = { 
    {ERR_FUNC(SSL_F_TLS_CONSTRUCT_CTOS_VERIFY), "TLS_CONSTRUCT_CTOS_VERIFY"},

    {ERR_FUNC(SSL_F_TLS_CONSTRUCT_ENCRYPTED_EXTENSIONS),

     "tls_construct_encrypted_extensions"},

    {ERR_FUNC(SSL_F_TLS_CONSTRUCT_END_OF_EARLY_DATA),

     "tls_construct_end_of_early_data"},

    {ERR_FUNC(SSL_F_TLS_CONSTRUCT_EXTENSIONS), "tls_construct_extensions"},

    {ERR_FUNC(SSL_F_TLS_CONSTRUCT_FINISHED), "tls_construct_finished"},

    {ERR_FUNC(SSL_F_TLS_CONSTRUCT_HELLO_REQUEST),
@@ -438,6 +440,8 @@ static ERR_STRING_DATA SSL_str_functs[] = { 
     "tls_process_client_key_exchange"},

    {ERR_FUNC(SSL_F_TLS_PROCESS_ENCRYPTED_EXTENSIONS),

     "tls_process_encrypted_extensions"},

    {ERR_FUNC(SSL_F_TLS_PROCESS_END_OF_EARLY_DATA),

     "tls_process_end_of_early_data"},

    {ERR_FUNC(SSL_F_TLS_PROCESS_FINISHED), "tls_process_finished"},

    {ERR_FUNC(SSL_F_TLS_PROCESS_HELLO_REQ), "tls_process_hello_req"},

    {ERR_FUNC(SSL_F_TLS_PROCESS_HELLO_RETRY_REQUEST),