1 /* $OpenBSD: d1_lib.c,v 1.50 2020/09/26 14:43:17 jsing Exp $ */ 2 /* 3 * DTLS implementation written by Nagendra Modadugu 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 5 */ 6 /* ==================================================================== 7 * Copyright (c) 1999-2005 The OpenSSL Project. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in 18 * the documentation and/or other materials provided with the 19 * distribution. 20 * 21 * 3. All advertising materials mentioning features or use of this 22 * software must display the following acknowledgment: 23 * "This product includes software developed by the OpenSSL Project 24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 25 * 26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 27 * endorse or promote products derived from this software without 28 * prior written permission. For written permission, please contact 29 * openssl-core@OpenSSL.org. 30 * 31 * 5. Products derived from this software may not be called "OpenSSL" 32 * nor may "OpenSSL" appear in their names without prior written 33 * permission of the OpenSSL Project. 34 * 35 * 6. Redistributions of any form whatsoever must retain the following 36 * acknowledgment: 37 * "This product includes software developed by the OpenSSL Project 38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 39 * 40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 51 * OF THE POSSIBILITY OF SUCH DAMAGE. 52 * ==================================================================== 53 * 54 * This product includes cryptographic software written by Eric Young 55 * (eay@cryptsoft.com). This product includes software written by Tim 56 * Hudson (tjh@cryptsoft.com). 57 * 58 */ 59 60 #include <sys/types.h> 61 #include <sys/socket.h> 62 #include <sys/time.h> 63 64 #include <netinet/in.h> 65 66 #include <stdio.h> 67 68 #include <openssl/objects.h> 69 70 #include "pqueue.h" 71 #include "ssl_locl.h" 72 73 void dtls1_hm_fragment_free(hm_fragment *frag); 74 75 static int dtls1_listen(SSL *s, struct sockaddr *client); 76 77 SSL3_ENC_METHOD DTLSv1_enc_data = { 78 .enc_flags = SSL_ENC_FLAG_EXPLICIT_IV, 79 }; 80 81 int 82 dtls1_new(SSL *s) 83 { 84 if (!ssl3_new(s)) 85 goto err; 86 87 if ((s->d1 = calloc(1, sizeof(*s->d1))) == NULL) 88 goto err; 89 if ((s->d1->internal = calloc(1, sizeof(*s->d1->internal))) == NULL) 90 goto err; 91 92 if ((s->d1->internal->unprocessed_rcds.q = pqueue_new()) == NULL) 93 goto err; 94 if ((s->d1->internal->processed_rcds.q = pqueue_new()) == NULL) 95 goto err; 96 if ((s->d1->internal->buffered_messages = pqueue_new()) == NULL) 97 goto err; 98 if ((s->d1->sent_messages = pqueue_new()) == NULL) 99 goto err; 100 if ((s->d1->internal->buffered_app_data.q = pqueue_new()) == NULL) 101 goto err; 102 103 if (s->server) 104 s->d1->internal->cookie_len = sizeof(D1I(s)->cookie); 105 106 s->method->internal->ssl_clear(s); 107 return (1); 108 109 err: 110 dtls1_free(s); 111 return (0); 112 } 113 114 static void 115 dtls1_drain_records(pqueue queue) 116 { 117 pitem *item; 118 DTLS1_RECORD_DATA_INTERNAL *rdata; 119 120 if (queue == NULL) 121 return; 122 123 while ((item = pqueue_pop(queue)) != NULL) { 124 rdata = (DTLS1_RECORD_DATA_INTERNAL *)item->data; 125 ssl3_release_buffer(&rdata->rbuf); 126 free(item->data); 127 pitem_free(item); 128 } 129 } 130 131 static void 132 dtls1_drain_fragments(pqueue queue) 133 { 134 pitem *item; 135 136 if (queue == NULL) 137 return; 138 139 while ((item = pqueue_pop(queue)) != NULL) { 140 dtls1_hm_fragment_free(item->data); 141 pitem_free(item); 142 } 143 } 144 145 static void 146 dtls1_clear_queues(SSL *s) 147 { 148 dtls1_drain_records(D1I(s)->unprocessed_rcds.q); 149 dtls1_drain_records(D1I(s)->processed_rcds.q); 150 dtls1_drain_fragments(D1I(s)->buffered_messages); 151 dtls1_drain_fragments(s->d1->sent_messages); 152 dtls1_drain_records(D1I(s)->buffered_app_data.q); 153 } 154 155 void 156 dtls1_free(SSL *s) 157 { 158 if (s == NULL) 159 return; 160 161 ssl3_free(s); 162 163 dtls1_clear_queues(s); 164 165 pqueue_free(D1I(s)->unprocessed_rcds.q); 166 pqueue_free(D1I(s)->processed_rcds.q); 167 pqueue_free(D1I(s)->buffered_messages); 168 pqueue_free(s->d1->sent_messages); 169 pqueue_free(D1I(s)->buffered_app_data.q); 170 171 freezero(s->d1->internal, sizeof(*s->d1->internal)); 172 freezero(s->d1, sizeof(*s->d1)); 173 174 s->d1 = NULL; 175 } 176 177 void 178 dtls1_clear(SSL *s) 179 { 180 struct dtls1_state_internal_st *internal; 181 pqueue unprocessed_rcds; 182 pqueue processed_rcds; 183 pqueue buffered_messages; 184 pqueue sent_messages; 185 pqueue buffered_app_data; 186 unsigned int mtu; 187 188 if (s->d1) { 189 unprocessed_rcds = D1I(s)->unprocessed_rcds.q; 190 processed_rcds = D1I(s)->processed_rcds.q; 191 buffered_messages = D1I(s)->buffered_messages; 192 sent_messages = s->d1->sent_messages; 193 buffered_app_data = D1I(s)->buffered_app_data.q; 194 mtu = D1I(s)->mtu; 195 196 dtls1_clear_queues(s); 197 198 memset(s->d1->internal, 0, sizeof(*s->d1->internal)); 199 internal = s->d1->internal; 200 memset(s->d1, 0, sizeof(*s->d1)); 201 s->d1->internal = internal; 202 203 if (s->server) { 204 D1I(s)->cookie_len = sizeof(D1I(s)->cookie); 205 } 206 207 if (SSL_get_options(s) & SSL_OP_NO_QUERY_MTU) { 208 D1I(s)->mtu = mtu; 209 } 210 211 D1I(s)->unprocessed_rcds.q = unprocessed_rcds; 212 D1I(s)->processed_rcds.q = processed_rcds; 213 D1I(s)->buffered_messages = buffered_messages; 214 s->d1->sent_messages = sent_messages; 215 D1I(s)->buffered_app_data.q = buffered_app_data; 216 } 217 218 ssl3_clear(s); 219 220 s->version = DTLS1_VERSION; 221 } 222 223 long 224 dtls1_ctrl(SSL *s, int cmd, long larg, void *parg) 225 { 226 int ret = 0; 227 228 switch (cmd) { 229 case DTLS_CTRL_GET_TIMEOUT: 230 if (dtls1_get_timeout(s, (struct timeval*) parg) != NULL) { 231 ret = 1; 232 } 233 break; 234 case DTLS_CTRL_HANDLE_TIMEOUT: 235 ret = dtls1_handle_timeout(s); 236 break; 237 case DTLS_CTRL_LISTEN: 238 ret = dtls1_listen(s, parg); 239 break; 240 241 default: 242 ret = ssl3_ctrl(s, cmd, larg, parg); 243 break; 244 } 245 return (ret); 246 } 247 248 /* 249 * As it's impossible to use stream ciphers in "datagram" mode, this 250 * simple filter is designed to disengage them in DTLS. Unfortunately 251 * there is no universal way to identify stream SSL_CIPHER, so we have 252 * to explicitly list their SSL_* codes. Currently RC4 is the only one 253 * available, but if new ones emerge, they will have to be added... 254 */ 255 const SSL_CIPHER * 256 dtls1_get_cipher(unsigned int u) 257 { 258 const SSL_CIPHER *ciph = ssl3_get_cipher(u); 259 260 if (ciph != NULL) { 261 if (ciph->algorithm_enc == SSL_RC4) 262 return NULL; 263 } 264 265 return ciph; 266 } 267 268 void 269 dtls1_start_timer(SSL *s) 270 { 271 272 /* If timer is not set, initialize duration with 1 second */ 273 if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) { 274 s->d1->timeout_duration = 1; 275 } 276 277 /* Set timeout to current time */ 278 gettimeofday(&(s->d1->next_timeout), NULL); 279 280 /* Add duration to current time */ 281 s->d1->next_timeout.tv_sec += s->d1->timeout_duration; 282 BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0, 283 &s->d1->next_timeout); 284 } 285 286 struct timeval* 287 dtls1_get_timeout(SSL *s, struct timeval* timeleft) 288 { 289 struct timeval timenow; 290 291 /* If no timeout is set, just return NULL */ 292 if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) { 293 return NULL; 294 } 295 296 /* Get current time */ 297 gettimeofday(&timenow, NULL); 298 299 /* If timer already expired, set remaining time to 0 */ 300 if (s->d1->next_timeout.tv_sec < timenow.tv_sec || 301 (s->d1->next_timeout.tv_sec == timenow.tv_sec && 302 s->d1->next_timeout.tv_usec <= timenow.tv_usec)) { 303 memset(timeleft, 0, sizeof(struct timeval)); 304 return timeleft; 305 } 306 307 /* Calculate time left until timer expires */ 308 memcpy(timeleft, &(s->d1->next_timeout), sizeof(struct timeval)); 309 timeleft->tv_sec -= timenow.tv_sec; 310 timeleft->tv_usec -= timenow.tv_usec; 311 if (timeleft->tv_usec < 0) { 312 timeleft->tv_sec--; 313 timeleft->tv_usec += 1000000; 314 } 315 316 /* If remaining time is less than 15 ms, set it to 0 317 * to prevent issues because of small devergences with 318 * socket timeouts. 319 */ 320 if (timeleft->tv_sec == 0 && timeleft->tv_usec < 15000) { 321 memset(timeleft, 0, sizeof(struct timeval)); 322 } 323 324 325 return timeleft; 326 } 327 328 int 329 dtls1_is_timer_expired(SSL *s) 330 { 331 struct timeval timeleft; 332 333 /* Get time left until timeout, return false if no timer running */ 334 if (dtls1_get_timeout(s, &timeleft) == NULL) { 335 return 0; 336 } 337 338 /* Return false if timer is not expired yet */ 339 if (timeleft.tv_sec > 0 || timeleft.tv_usec > 0) { 340 return 0; 341 } 342 343 /* Timer expired, so return true */ 344 return 1; 345 } 346 347 void 348 dtls1_double_timeout(SSL *s) 349 { 350 s->d1->timeout_duration *= 2; 351 if (s->d1->timeout_duration > 60) 352 s->d1->timeout_duration = 60; 353 dtls1_start_timer(s); 354 } 355 356 void 357 dtls1_stop_timer(SSL *s) 358 { 359 /* Reset everything */ 360 memset(&(D1I(s)->timeout), 0, sizeof(struct dtls1_timeout_st)); 361 memset(&(s->d1->next_timeout), 0, sizeof(struct timeval)); 362 s->d1->timeout_duration = 1; 363 BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0, 364 &(s->d1->next_timeout)); 365 /* Clear retransmission buffer */ 366 dtls1_clear_record_buffer(s); 367 } 368 369 int 370 dtls1_check_timeout_num(SSL *s) 371 { 372 D1I(s)->timeout.num_alerts++; 373 374 /* Reduce MTU after 2 unsuccessful retransmissions */ 375 if (D1I(s)->timeout.num_alerts > 2) { 376 D1I(s)->mtu = BIO_ctrl(SSL_get_wbio(s), 377 BIO_CTRL_DGRAM_GET_FALLBACK_MTU, 0, NULL); 378 379 } 380 381 if (D1I(s)->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT) { 382 /* fail the connection, enough alerts have been sent */ 383 SSLerror(s, SSL_R_READ_TIMEOUT_EXPIRED); 384 return -1; 385 } 386 387 return 0; 388 } 389 390 int 391 dtls1_handle_timeout(SSL *s) 392 { 393 /* if no timer is expired, don't do anything */ 394 if (!dtls1_is_timer_expired(s)) { 395 return 0; 396 } 397 398 dtls1_double_timeout(s); 399 400 if (dtls1_check_timeout_num(s) < 0) 401 return -1; 402 403 D1I(s)->timeout.read_timeouts++; 404 if (D1I(s)->timeout.read_timeouts > DTLS1_TMO_READ_COUNT) { 405 D1I(s)->timeout.read_timeouts = 1; 406 } 407 408 dtls1_start_timer(s); 409 return dtls1_retransmit_buffered_messages(s); 410 } 411 412 int 413 dtls1_listen(SSL *s, struct sockaddr *client) 414 { 415 int ret; 416 417 /* Ensure there is no state left over from a previous invocation */ 418 SSL_clear(s); 419 420 SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE); 421 D1I(s)->listen = 1; 422 423 ret = SSL_accept(s); 424 if (ret <= 0) 425 return ret; 426 427 (void)BIO_dgram_get_peer(SSL_get_rbio(s), client); 428 return 1; 429 } 430 431 void 432 dtls1_build_sequence_number(unsigned char *dst, unsigned char *seq, 433 unsigned short epoch) 434 { 435 CBB cbb; 436 437 if (!CBB_init_fixed(&cbb, dst, SSL3_SEQUENCE_SIZE)) 438 goto err; 439 if (!CBB_add_u16(&cbb, epoch)) 440 goto err; 441 if (!CBB_add_bytes(&cbb, &seq[2], SSL3_SEQUENCE_SIZE - 2)) 442 goto err; 443 if (!CBB_finish(&cbb, NULL, NULL)) 444 goto err; 445 446 return; 447 448 err: 449 CBB_cleanup(&cbb); 450 } 451