3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
6 /* ====================================================================
7 * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in
18 * the documentation and/or other materials provided with the
21 * 3. All advertising materials mentioning features or use of this
22 * software must display the following acknowledgment:
23 * "This product includes software developed by the OpenSSL Project
24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 * endorse or promote products derived from this software without
28 * prior written permission. For written permission, please contact
29 * openssl-core@OpenSSL.org.
31 * 5. Products derived from this software may not be called "OpenSSL"
32 * nor may "OpenSSL" appear in their names without prior written
33 * permission of the OpenSSL Project.
35 * 6. Redistributions of any form whatsoever must retain the following
37 * "This product includes software developed by the OpenSSL Project
38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
54 * This product includes cryptographic software written by Eric Young
55 * (eay@cryptsoft.com). This product includes software written by Tim
56 * Hudson (tjh@cryptsoft.com).
59 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
60 * All rights reserved.
62 * This package is an SSL implementation written
63 * by Eric Young (eay@cryptsoft.com).
64 * The implementation was written so as to conform with Netscapes SSL.
66 * This library is free for commercial and non-commercial use as long as
67 * the following conditions are aheared to. The following conditions
68 * apply to all code found in this distribution, be it the RC4, RSA,
69 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
70 * included with this distribution is covered by the same copyright terms
71 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
73 * Copyright remains Eric Young's, and as such any Copyright notices in
74 * the code are not to be removed.
75 * If this package is used in a product, Eric Young should be given attribution
76 * as the author of the parts of the library used.
77 * This can be in the form of a textual message at program startup or
78 * in documentation (online or textual) provided with the package.
80 * Redistribution and use in source and binary forms, with or without
81 * modification, are permitted provided that the following conditions
83 * 1. Redistributions of source code must retain the copyright
84 * notice, this list of conditions and the following disclaimer.
85 * 2. Redistributions in binary form must reproduce the above copyright
86 * notice, this list of conditions and the following disclaimer in the
87 * documentation and/or other materials provided with the distribution.
88 * 3. All advertising materials mentioning features or use of this software
89 * must display the following acknowledgement:
90 * "This product includes cryptographic software written by
91 * Eric Young (eay@cryptsoft.com)"
92 * The word 'cryptographic' can be left out if the rouines from the library
93 * being used are not cryptographic related :-).
94 * 4. If you include any Windows specific code (or a derivative thereof) from
95 * the apps directory (application code) you must include an acknowledgement:
96 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
98 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
99 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
100 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
101 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
102 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
103 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
104 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
105 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
106 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
107 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
110 * The licence and distribution terms for any publically available version or
111 * derivative of this code cannot be changed. i.e. this code cannot simply be
112 * copied and put under another distribution licence
113 * [including the GNU Public Licence.]
117 #include "ssl_locl.h"
118 #include <openssl/buffer.h>
119 #include <openssl/rand.h>
120 #include <openssl/objects.h>
121 #include <openssl/evp.h>
122 #include <openssl/x509.h>
123 #include <openssl/md5.h>
124 #include <openssl/bn.h>
125 #ifndef OPENSSL_NO_DH
126 # include <openssl/dh.h>
129 static const SSL_METHOD
*dtls1_get_server_method(int ver
);
130 static int dtls1_send_hello_verify_request(SSL
*s
);
132 static const SSL_METHOD
*dtls1_get_server_method(int ver
)
134 if (ver
== DTLS1_VERSION
)
135 return (DTLSv1_server_method());
136 else if (ver
== DTLS1_2_VERSION
)
137 return (DTLSv1_2_server_method());
142 IMPLEMENT_dtls1_meth_func(DTLS1_VERSION
,
143 DTLSv1_server_method
,
145 ssl_undefined_function
,
146 dtls1_get_server_method
, DTLSv1_enc_data
)
148 IMPLEMENT_dtls1_meth_func(DTLS1_2_VERSION
,
149 DTLSv1_2_server_method
,
151 ssl_undefined_function
,
152 dtls1_get_server_method
, DTLSv1_2_enc_data
)
154 IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION
,
157 ssl_undefined_function
,
158 dtls1_get_server_method
, DTLSv1_2_enc_data
)
160 int dtls1_accept(SSL
*s
)
163 unsigned long Time
= (unsigned long)time(NULL
);
164 void (*cb
) (const SSL
*ssl
, int type
, int val
) = NULL
;
167 int new_state
, state
, skip
= 0;
169 #ifndef OPENSSL_NO_SCTP
170 unsigned char sctpauthkey
[64];
171 char labelbuffer
[sizeof(DTLS1_SCTP_AUTH_LABEL
)];
174 RAND_add(&Time
, sizeof(Time
), 0);
178 if (s
->info_callback
!= NULL
)
179 cb
= s
->info_callback
;
180 else if (s
->ctx
->info_callback
!= NULL
)
181 cb
= s
->ctx
->info_callback
;
183 listen
= s
->d1
->listen
;
185 /* init things to blank */
187 if (!SSL_in_init(s
) || SSL_in_before(s
))
190 s
->d1
->listen
= listen
;
191 #ifndef OPENSSL_NO_SCTP
193 * Notify SCTP BIO socket to enter handshake mode and prevent stream
194 * identifier other than 0. Will be ignored if no SCTP is used.
196 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE
,
197 s
->in_handshake
, NULL
);
200 if (s
->cert
== NULL
) {
201 SSLerr(SSL_F_DTLS1_ACCEPT
, SSL_R_NO_CERTIFICATE_SET
);
204 #ifndef OPENSSL_NO_HEARTBEATS
206 * If we're awaiting a HeartbeatResponse, pretend we already got and
207 * don't await it anymore, because Heartbeats don't make sense during
210 if (s
->tlsext_hb_pending
) {
212 s
->tlsext_hb_pending
= 0;
221 case SSL_ST_RENEGOTIATE
:
223 /* s->state=SSL_ST_ACCEPT; */
227 case SSL_ST_BEFORE
| SSL_ST_ACCEPT
:
228 case SSL_ST_OK
| SSL_ST_ACCEPT
:
232 cb(s
, SSL_CB_HANDSHAKE_START
, 1);
234 if ((s
->version
& 0xff00) != (DTLS1_VERSION
& 0xff00)) {
235 SSLerr(SSL_F_DTLS1_ACCEPT
, ERR_R_INTERNAL_ERROR
);
238 s
->type
= SSL_ST_ACCEPT
;
240 if (s
->init_buf
== NULL
) {
241 if ((buf
= BUF_MEM_new()) == NULL
) {
243 s
->state
= SSL_ST_ERR
;
246 if (!BUF_MEM_grow(buf
, SSL3_RT_MAX_PLAIN_LENGTH
)) {
249 s
->state
= SSL_ST_ERR
;
255 if (!ssl3_setup_buffers(s
)) {
257 s
->state
= SSL_ST_ERR
;
262 s
->d1
->change_cipher_spec_ok
= 0;
264 * Should have been reset by ssl3_get_finished, too.
266 s
->s3
->change_cipher_spec
= 0;
268 if (s
->state
!= SSL_ST_RENEGOTIATE
) {
270 * Ok, we now need to push on a buffering BIO so that the
271 * output is sent in a way that TCP likes :-) ...but not with
274 #ifndef OPENSSL_NO_SCTP
275 if (!BIO_dgram_is_sctp(SSL_get_wbio(s
)))
277 if (!ssl_init_wbio_buffer(s
, 1)) {
279 s
->state
= SSL_ST_ERR
;
283 ssl3_init_finished_mac(s
);
284 s
->state
= SSL3_ST_SR_CLNT_HELLO_A
;
285 s
->ctx
->stats
.sess_accept
++;
288 * s->state == SSL_ST_RENEGOTIATE, we will just send a
291 s
->ctx
->stats
.sess_accept_renegotiate
++;
292 s
->state
= SSL3_ST_SW_HELLO_REQ_A
;
297 case SSL3_ST_SW_HELLO_REQ_A
:
298 case SSL3_ST_SW_HELLO_REQ_B
:
301 dtls1_clear_record_buffer(s
);
302 dtls1_start_timer(s
);
303 ret
= ssl3_send_hello_request(s
);
306 s
->s3
->tmp
.next_state
= SSL3_ST_SR_CLNT_HELLO_A
;
307 s
->state
= SSL3_ST_SW_FLUSH
;
310 ssl3_init_finished_mac(s
);
313 case SSL3_ST_SW_HELLO_REQ_C
:
314 s
->state
= SSL_ST_OK
;
317 case SSL3_ST_SR_CLNT_HELLO_A
:
318 case SSL3_ST_SR_CLNT_HELLO_B
:
319 case SSL3_ST_SR_CLNT_HELLO_C
:
322 ret
= ssl3_get_client_hello(s
);
327 if (ret
== 1 && (SSL_get_options(s
) & SSL_OP_COOKIE_EXCHANGE
))
328 s
->state
= DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A
;
330 s
->state
= SSL3_ST_SW_SRVR_HELLO_A
;
335 * Reflect ClientHello sequence to remain stateless while
339 memcpy(s
->s3
->write_sequence
, s
->s3
->read_sequence
,
340 sizeof(s
->s3
->write_sequence
));
343 /* If we're just listening, stop here */
344 if (listen
&& s
->state
== SSL3_ST_SW_SRVR_HELLO_A
) {
348 * Set expected sequence numbers to continue the handshake.
350 s
->d1
->handshake_read_seq
= 2;
351 s
->d1
->handshake_write_seq
= 1;
352 s
->d1
->next_handshake_write_seq
= 1;
358 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A
:
359 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B
:
361 ret
= dtls1_send_hello_verify_request(s
);
364 s
->state
= SSL3_ST_SW_FLUSH
;
365 s
->s3
->tmp
.next_state
= SSL3_ST_SR_CLNT_HELLO_A
;
367 /* HelloVerifyRequest resets Finished MAC */
368 if (s
->version
!= DTLS1_BAD_VER
)
369 ssl3_init_finished_mac(s
);
372 #ifndef OPENSSL_NO_SCTP
373 case DTLS1_SCTP_ST_SR_READ_SOCK
:
375 if (BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s
))) {
376 s
->s3
->in_read_app_data
= 2;
377 s
->rwstate
= SSL_READING
;
378 BIO_clear_retry_flags(SSL_get_rbio(s
));
379 BIO_set_retry_read(SSL_get_rbio(s
));
384 s
->state
= SSL3_ST_SR_FINISHED_A
;
387 case DTLS1_SCTP_ST_SW_WRITE_SOCK
:
388 ret
= BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(s
));
393 if (s
->d1
->next_state
!= SSL_ST_OK
) {
394 s
->s3
->in_read_app_data
= 2;
395 s
->rwstate
= SSL_READING
;
396 BIO_clear_retry_flags(SSL_get_rbio(s
));
397 BIO_set_retry_read(SSL_get_rbio(s
));
403 s
->state
= s
->d1
->next_state
;
407 case SSL3_ST_SW_SRVR_HELLO_A
:
408 case SSL3_ST_SW_SRVR_HELLO_B
:
410 dtls1_start_timer(s
);
411 ret
= ssl3_send_server_hello(s
);
416 #ifndef OPENSSL_NO_SCTP
418 * Add new shared key for SCTP-Auth, will be ignored if no
421 snprintf((char *)labelbuffer
, sizeof(DTLS1_SCTP_AUTH_LABEL
),
422 DTLS1_SCTP_AUTH_LABEL
);
424 SSL_export_keying_material(s
, sctpauthkey
,
425 sizeof(sctpauthkey
), labelbuffer
,
426 sizeof(labelbuffer
), NULL
, 0, 0);
428 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY
,
429 sizeof(sctpauthkey
), sctpauthkey
);
431 #ifndef OPENSSL_NO_TLSEXT
432 if (s
->tlsext_ticket_expected
)
433 s
->state
= SSL3_ST_SW_SESSION_TICKET_A
;
435 s
->state
= SSL3_ST_SW_CHANGE_A
;
437 s
->state
= SSL3_ST_SW_CHANGE_A
;
440 s
->state
= SSL3_ST_SW_CERT_A
;
444 case SSL3_ST_SW_CERT_A
:
445 case SSL3_ST_SW_CERT_B
:
446 /* Check if it is anon DH or normal PSK */
447 if (!(s
->s3
->tmp
.new_cipher
->algorithm_auth
& SSL_aNULL
)
448 && !(s
->s3
->tmp
.new_cipher
->algorithm_mkey
& SSL_kPSK
)) {
449 dtls1_start_timer(s
);
450 ret
= ssl3_send_server_certificate(s
);
453 #ifndef OPENSSL_NO_TLSEXT
454 if (s
->tlsext_status_expected
)
455 s
->state
= SSL3_ST_SW_CERT_STATUS_A
;
457 s
->state
= SSL3_ST_SW_KEY_EXCH_A
;
460 s
->state
= SSL3_ST_SW_KEY_EXCH_A
;
466 s
->state
= SSL3_ST_SW_KEY_EXCH_A
;
471 case SSL3_ST_SW_KEY_EXCH_A
:
472 case SSL3_ST_SW_KEY_EXCH_B
:
473 alg_k
= s
->s3
->tmp
.new_cipher
->algorithm_mkey
;
476 * clear this, it may get reset by
477 * send_server_key_exchange
479 s
->s3
->tmp
.use_rsa_tmp
= 0;
482 * only send if a DH key exchange or RSA but we have a sign only
487 * PSK: send ServerKeyExchange if PSK identity hint if
490 #ifndef OPENSSL_NO_PSK
491 || ((alg_k
& SSL_kPSK
) && s
->ctx
->psk_identity_hint
)
493 || (alg_k
& SSL_kDHE
)
494 || (alg_k
& SSL_kEECDH
)
495 || ((alg_k
& SSL_kRSA
)
496 && (s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
== NULL
497 || (SSL_C_IS_EXPORT(s
->s3
->tmp
.new_cipher
)
498 && EVP_PKEY_size(s
->cert
->pkeys
499 [SSL_PKEY_RSA_ENC
].privatekey
) *
500 8 > SSL_C_EXPORT_PKEYLENGTH(s
->s3
->tmp
.new_cipher
)
505 dtls1_start_timer(s
);
506 ret
= ssl3_send_server_key_exchange(s
);
512 s
->state
= SSL3_ST_SW_CERT_REQ_A
;
516 case SSL3_ST_SW_CERT_REQ_A
:
517 case SSL3_ST_SW_CERT_REQ_B
:
518 if ( /* don't request cert unless asked for it: */
519 !(s
->verify_mode
& SSL_VERIFY_PEER
) ||
521 * if SSL_VERIFY_CLIENT_ONCE is set, don't request cert
522 * during re-negotiation:
524 ((s
->session
->peer
!= NULL
) &&
525 (s
->verify_mode
& SSL_VERIFY_CLIENT_ONCE
)) ||
527 * never request cert in anonymous ciphersuites (see
528 * section "Certificate request" in SSL 3 drafts and in
531 ((s
->s3
->tmp
.new_cipher
->algorithm_auth
& SSL_aNULL
) &&
533 * ... except when the application insists on
534 * verification (against the specs, but s3_clnt.c accepts
537 !(s
->verify_mode
& SSL_VERIFY_FAIL_IF_NO_PEER_CERT
)) ||
539 * never request cert in Kerberos ciphersuites
541 (s
->s3
->tmp
.new_cipher
->algorithm_auth
& SSL_aKRB5
)
543 * With normal PSK Certificates and Certificate Requests
546 || (s
->s3
->tmp
.new_cipher
->algorithm_mkey
& SSL_kPSK
)) {
547 /* no cert request */
549 s
->s3
->tmp
.cert_request
= 0;
550 s
->state
= SSL3_ST_SW_SRVR_DONE_A
;
551 #ifndef OPENSSL_NO_SCTP
552 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
553 s
->d1
->next_state
= SSL3_ST_SW_SRVR_DONE_A
;
554 s
->state
= DTLS1_SCTP_ST_SW_WRITE_SOCK
;
558 s
->s3
->tmp
.cert_request
= 1;
559 dtls1_start_timer(s
);
560 ret
= ssl3_send_certificate_request(s
);
563 #ifndef NETSCAPE_HANG_BUG
564 s
->state
= SSL3_ST_SW_SRVR_DONE_A
;
565 # ifndef OPENSSL_NO_SCTP
566 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
567 s
->d1
->next_state
= SSL3_ST_SW_SRVR_DONE_A
;
568 s
->state
= DTLS1_SCTP_ST_SW_WRITE_SOCK
;
572 s
->state
= SSL3_ST_SW_FLUSH
;
573 s
->s3
->tmp
.next_state
= SSL3_ST_SR_CERT_A
;
574 # ifndef OPENSSL_NO_SCTP
575 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
576 s
->d1
->next_state
= s
->s3
->tmp
.next_state
;
577 s
->s3
->tmp
.next_state
= DTLS1_SCTP_ST_SW_WRITE_SOCK
;
585 case SSL3_ST_SW_SRVR_DONE_A
:
586 case SSL3_ST_SW_SRVR_DONE_B
:
587 dtls1_start_timer(s
);
588 ret
= ssl3_send_server_done(s
);
591 s
->s3
->tmp
.next_state
= SSL3_ST_SR_CERT_A
;
592 s
->state
= SSL3_ST_SW_FLUSH
;
596 case SSL3_ST_SW_FLUSH
:
597 s
->rwstate
= SSL_WRITING
;
598 if (BIO_flush(s
->wbio
) <= 0) {
600 * If the write error was fatal, stop trying
602 if (!BIO_should_retry(s
->wbio
)) {
603 s
->rwstate
= SSL_NOTHING
;
604 s
->state
= s
->s3
->tmp
.next_state
;
610 s
->rwstate
= SSL_NOTHING
;
611 s
->state
= s
->s3
->tmp
.next_state
;
614 case SSL3_ST_SR_CERT_A
:
615 case SSL3_ST_SR_CERT_B
:
616 if (s
->s3
->tmp
.cert_request
) {
617 ret
= ssl3_get_client_certificate(s
);
622 s
->state
= SSL3_ST_SR_KEY_EXCH_A
;
625 case SSL3_ST_SR_KEY_EXCH_A
:
626 case SSL3_ST_SR_KEY_EXCH_B
:
627 ret
= ssl3_get_client_key_exchange(s
);
630 #ifndef OPENSSL_NO_SCTP
632 * Add new shared key for SCTP-Auth, will be ignored if no SCTP
635 snprintf((char *)labelbuffer
, sizeof(DTLS1_SCTP_AUTH_LABEL
),
636 DTLS1_SCTP_AUTH_LABEL
);
638 SSL_export_keying_material(s
, sctpauthkey
,
639 sizeof(sctpauthkey
), labelbuffer
,
640 sizeof(labelbuffer
), NULL
, 0, 0);
642 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY
,
643 sizeof(sctpauthkey
), sctpauthkey
);
646 s
->state
= SSL3_ST_SR_CERT_VRFY_A
;
651 * For the ECDH ciphersuites when the client sends its ECDH
652 * pub key in a certificate, the CertificateVerify message is
655 s
->state
= SSL3_ST_SR_FINISHED_A
;
657 } else if (SSL_USE_SIGALGS(s
)) {
658 s
->state
= SSL3_ST_SR_CERT_VRFY_A
;
660 if (!s
->session
->peer
)
663 * For sigalgs freeze the handshake buffer at this point and
664 * digest cached records.
666 if (!s
->s3
->handshake_buffer
) {
667 SSLerr(SSL_F_DTLS1_ACCEPT
, ERR_R_INTERNAL_ERROR
);
668 s
->state
= SSL_ST_ERR
;
671 s
->s3
->flags
|= TLS1_FLAGS_KEEP_HANDSHAKE
;
672 if (!ssl3_digest_cached_records(s
)) {
673 s
->state
= SSL_ST_ERR
;
677 s
->state
= SSL3_ST_SR_CERT_VRFY_A
;
681 * We need to get hashes here so if there is a client cert,
684 s
->method
->ssl3_enc
->cert_verify_mac(s
,
689 s
->method
->ssl3_enc
->cert_verify_mac(s
, NID_sha1
,
692 [MD5_DIGEST_LENGTH
]));
696 case SSL3_ST_SR_CERT_VRFY_A
:
697 case SSL3_ST_SR_CERT_VRFY_B
:
698 ret
= ssl3_get_cert_verify(s
);
701 #ifndef OPENSSL_NO_SCTP
702 if (BIO_dgram_is_sctp(SSL_get_wbio(s
)) &&
703 state
== SSL_ST_RENEGOTIATE
)
704 s
->state
= DTLS1_SCTP_ST_SR_READ_SOCK
;
707 s
->state
= SSL3_ST_SR_FINISHED_A
;
711 case SSL3_ST_SR_FINISHED_A
:
712 case SSL3_ST_SR_FINISHED_B
:
714 * Enable CCS. Receiving a CCS clears the flag, so make
715 * sure not to re-enable it to ban duplicates. This *should* be the
716 * first time we have received one - but we check anyway to be
718 * s->s3->change_cipher_spec is set when a CCS is
719 * processed in d1_pkt.c, and remains set until
720 * the client's Finished message is read.
722 if (!s
->s3
->change_cipher_spec
)
723 s
->d1
->change_cipher_spec_ok
= 1;
724 ret
= ssl3_get_finished(s
, SSL3_ST_SR_FINISHED_A
,
725 SSL3_ST_SR_FINISHED_B
);
730 s
->state
= SSL_ST_OK
;
731 #ifndef OPENSSL_NO_TLSEXT
732 else if (s
->tlsext_ticket_expected
)
733 s
->state
= SSL3_ST_SW_SESSION_TICKET_A
;
736 s
->state
= SSL3_ST_SW_CHANGE_A
;
740 #ifndef OPENSSL_NO_TLSEXT
741 case SSL3_ST_SW_SESSION_TICKET_A
:
742 case SSL3_ST_SW_SESSION_TICKET_B
:
743 ret
= ssl3_send_newsession_ticket(s
);
746 s
->state
= SSL3_ST_SW_CHANGE_A
;
750 case SSL3_ST_SW_CERT_STATUS_A
:
751 case SSL3_ST_SW_CERT_STATUS_B
:
752 ret
= ssl3_send_cert_status(s
);
755 s
->state
= SSL3_ST_SW_KEY_EXCH_A
;
761 case SSL3_ST_SW_CHANGE_A
:
762 case SSL3_ST_SW_CHANGE_B
:
764 s
->session
->cipher
= s
->s3
->tmp
.new_cipher
;
765 if (!s
->method
->ssl3_enc
->setup_key_block(s
)) {
767 s
->state
= SSL_ST_ERR
;
771 ret
= dtls1_send_change_cipher_spec(s
,
773 SSL3_ST_SW_CHANGE_B
);
778 #ifndef OPENSSL_NO_SCTP
781 * Change to new shared key of SCTP-Auth, will be ignored if
784 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY
,
789 s
->state
= SSL3_ST_SW_FINISHED_A
;
792 if (!s
->method
->ssl3_enc
->change_cipher_state(s
,
793 SSL3_CHANGE_CIPHER_SERVER_WRITE
))
796 s
->state
= SSL_ST_ERR
;
800 dtls1_reset_seq_numbers(s
, SSL3_CC_WRITE
);
803 case SSL3_ST_SW_FINISHED_A
:
804 case SSL3_ST_SW_FINISHED_B
:
805 ret
= ssl3_send_finished(s
,
806 SSL3_ST_SW_FINISHED_A
,
807 SSL3_ST_SW_FINISHED_B
,
809 ssl3_enc
->server_finished_label
,
811 ssl3_enc
->server_finished_label_len
);
814 s
->state
= SSL3_ST_SW_FLUSH
;
816 s
->s3
->tmp
.next_state
= SSL3_ST_SR_FINISHED_A
;
818 #ifndef OPENSSL_NO_SCTP
820 * Change to new shared key of SCTP-Auth, will be ignored if
823 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY
,
827 s
->s3
->tmp
.next_state
= SSL_ST_OK
;
828 #ifndef OPENSSL_NO_SCTP
829 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
830 s
->d1
->next_state
= s
->s3
->tmp
.next_state
;
831 s
->s3
->tmp
.next_state
= DTLS1_SCTP_ST_SW_WRITE_SOCK
;
839 /* clean a few things up */
840 ssl3_cleanup_key_block(s
);
843 BUF_MEM_free(s
->init_buf
);
847 /* remove buffering on output */
848 ssl_free_wbio_buffer(s
);
852 if (s
->renegotiate
== 2) { /* skipped if we just sent a
857 ssl_update_cache(s
, SSL_SESS_CACHE_SERVER
);
859 s
->ctx
->stats
.sess_accept_good
++;
861 s
->handshake_func
= dtls1_accept
;
864 cb(s
, SSL_CB_HANDSHAKE_DONE
, 1);
869 /* done handshaking, next message is client hello */
870 s
->d1
->handshake_read_seq
= 0;
871 /* next message is server hello */
872 s
->d1
->handshake_write_seq
= 0;
873 s
->d1
->next_handshake_write_seq
= 0;
879 SSLerr(SSL_F_DTLS1_ACCEPT
, SSL_R_UNKNOWN_STATE
);
885 if (!s
->s3
->tmp
.reuse_message
&& !skip
) {
887 if ((ret
= BIO_flush(s
->wbio
)) <= 0)
891 if ((cb
!= NULL
) && (s
->state
!= state
)) {
892 new_state
= s
->state
;
894 cb(s
, SSL_CB_ACCEPT_LOOP
, 1);
895 s
->state
= new_state
;
901 /* BIO_flush(s->wbio); */
904 #ifndef OPENSSL_NO_SCTP
906 * Notify SCTP BIO socket to leave handshake mode and prevent stream
907 * identifier other than 0. Will be ignored if no SCTP is used.
909 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE
,
910 s
->in_handshake
, NULL
);
914 cb(s
, SSL_CB_ACCEPT_EXIT
, ret
);
918 int dtls1_send_hello_verify_request(SSL
*s
)
920 unsigned int msg_len
;
921 unsigned char *msg
, *buf
, *p
;
923 if (s
->state
== DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A
) {
924 buf
= (unsigned char *)s
->init_buf
->data
;
926 msg
= p
= &(buf
[DTLS1_HM_HEADER_LENGTH
]);
927 /* Always use DTLS 1.0 version: see RFC 6347 */
928 *(p
++) = DTLS1_VERSION
>> 8;
929 *(p
++) = DTLS1_VERSION
& 0xFF;
931 if (s
->ctx
->app_gen_cookie_cb
== NULL
||
932 s
->ctx
->app_gen_cookie_cb(s
, s
->d1
->cookie
,
933 &(s
->d1
->cookie_len
)) == 0) {
934 SSLerr(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST
,
935 ERR_R_INTERNAL_ERROR
);
936 s
->state
= SSL_ST_ERR
;
940 *(p
++) = (unsigned char)s
->d1
->cookie_len
;
941 memcpy(p
, s
->d1
->cookie
, s
->d1
->cookie_len
);
942 p
+= s
->d1
->cookie_len
;
945 dtls1_set_message_header(s
, buf
,
946 DTLS1_MT_HELLO_VERIFY_REQUEST
, msg_len
, 0,
949 s
->state
= DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B
;
950 /* number of bytes to write */
951 s
->init_num
= p
- buf
;
955 /* s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B */
956 return (dtls1_do_write(s
, SSL3_RT_HANDSHAKE
));