1 /* $OpenBSD: d1_lib.c,v 1.45 2020/03/12 17:01:53 jsing Exp $ */ 2 /* 3 * DTLS implementation written by Nagendra Modadugu 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 5 */ 6 /* ==================================================================== 7 * Copyright (c) 1999-2005 The OpenSSL Project. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in 18 * the documentation and/or other materials provided with the 19 * distribution. 20 * 21 * 3. All advertising materials mentioning features or use of this 22 * software must display the following acknowledgment: 23 * "This product includes software developed by the OpenSSL Project 24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 25 * 26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 27 * endorse or promote products derived from this software without 28 * prior written permission. For written permission, please contact 29 * openssl-core@OpenSSL.org. 30 * 31 * 5. Products derived from this software may not be called "OpenSSL" 32 * nor may "OpenSSL" appear in their names without prior written 33 * permission of the OpenSSL Project. 34 * 35 * 6. Redistributions of any form whatsoever must retain the following 36 * acknowledgment: 37 * "This product includes software developed by the OpenSSL Project 38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 39 * 40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 51 * OF THE POSSIBILITY OF SUCH DAMAGE. 52 * ==================================================================== 53 * 54 * This product includes cryptographic software written by Eric Young 55 * (eay@cryptsoft.com). This product includes software written by Tim 56 * Hudson (tjh@cryptsoft.com). 57 * 58 */ 59 60 #include <sys/types.h> 61 #include <sys/socket.h> 62 #include <sys/time.h> 63 64 #include <netinet/in.h> 65 66 #include <stdio.h> 67 68 #include <openssl/objects.h> 69 70 #include "pqueue.h" 71 #include "ssl_locl.h" 72 73 static int dtls1_listen(SSL *s, struct sockaddr *client); 74 75 SSL3_ENC_METHOD DTLSv1_enc_data = { 76 .enc_flags = SSL_ENC_FLAG_EXPLICIT_IV, 77 }; 78 79 long 80 dtls1_default_timeout(void) 81 { 82 /* 2 hours, the 24 hours mentioned in the DTLSv1 spec 83 * is way too long for http, the cache would over fill */ 84 return (60*60*2); 85 } 86 87 int 88 dtls1_new(SSL *s) 89 { 90 DTLS1_STATE *d1; 91 92 if (!ssl3_new(s)) 93 return (0); 94 if ((d1 = calloc(1, sizeof(*d1))) == NULL) { 95 ssl3_free(s); 96 return (0); 97 } 98 if ((d1->internal = calloc(1, sizeof(*d1->internal))) == NULL) { 99 free(d1); 100 ssl3_free(s); 101 return (0); 102 } 103 104 /* d1->handshake_epoch=0; */ 105 106 d1->internal->unprocessed_rcds.q = pqueue_new(); 107 d1->internal->processed_rcds.q = pqueue_new(); 108 d1->internal->buffered_messages = pqueue_new(); 109 d1->sent_messages = pqueue_new(); 110 d1->internal->buffered_app_data.q = pqueue_new(); 111 112 if (s->server) { 113 d1->internal->cookie_len = sizeof(D1I(s)->cookie); 114 } 115 116 if (!d1->internal->unprocessed_rcds.q || !d1->internal->processed_rcds.q || 117 !d1->internal->buffered_messages || !d1->sent_messages || 118 !d1->internal->buffered_app_data.q) { 119 pqueue_free(d1->internal->unprocessed_rcds.q); 120 pqueue_free(d1->internal->processed_rcds.q); 121 pqueue_free(d1->internal->buffered_messages); 122 pqueue_free(d1->sent_messages); 123 pqueue_free(d1->internal->buffered_app_data.q); 124 free(d1); 125 ssl3_free(s); 126 return (0); 127 } 128 129 s->d1 = d1; 130 s->method->internal->ssl_clear(s); 131 return (1); 132 } 133 134 static void 135 dtls1_clear_queues(SSL *s) 136 { 137 pitem *item = NULL; 138 hm_fragment *frag = NULL; 139 DTLS1_RECORD_DATA_INTERNAL *rdata; 140 141 while ((item = pqueue_pop(D1I(s)->unprocessed_rcds.q)) != NULL) { 142 rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data; 143 free(rdata->rbuf.buf); 144 free(item->data); 145 pitem_free(item); 146 } 147 148 while ((item = pqueue_pop(D1I(s)->processed_rcds.q)) != NULL) { 149 rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data; 150 free(rdata->rbuf.buf); 151 free(item->data); 152 pitem_free(item); 153 } 154 155 while ((item = pqueue_pop(D1I(s)->buffered_messages)) != NULL) { 156 frag = (hm_fragment *)item->data; 157 free(frag->fragment); 158 free(frag); 159 pitem_free(item); 160 } 161 162 while ((item = pqueue_pop(s->d1->sent_messages)) != NULL) { 163 frag = (hm_fragment *)item->data; 164 free(frag->fragment); 165 free(frag); 166 pitem_free(item); 167 } 168 169 while ((item = pqueue_pop(D1I(s)->buffered_app_data.q)) != NULL) { 170 rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data; 171 free(rdata->rbuf.buf); 172 free(item->data); 173 pitem_free(item); 174 } 175 } 176 177 void 178 dtls1_free(SSL *s) 179 { 180 if (s == NULL) 181 return; 182 183 ssl3_free(s); 184 185 dtls1_clear_queues(s); 186 187 pqueue_free(D1I(s)->unprocessed_rcds.q); 188 pqueue_free(D1I(s)->processed_rcds.q); 189 pqueue_free(D1I(s)->buffered_messages); 190 pqueue_free(s->d1->sent_messages); 191 pqueue_free(D1I(s)->buffered_app_data.q); 192 193 freezero(s->d1->internal, sizeof(*s->d1->internal)); 194 freezero(s->d1, sizeof(*s->d1)); 195 196 s->d1 = NULL; 197 } 198 199 void 200 dtls1_clear(SSL *s) 201 { 202 struct dtls1_state_internal_st *internal; 203 pqueue unprocessed_rcds; 204 pqueue processed_rcds; 205 pqueue buffered_messages; 206 pqueue sent_messages; 207 pqueue buffered_app_data; 208 unsigned int mtu; 209 210 if (s->d1) { 211 unprocessed_rcds = D1I(s)->unprocessed_rcds.q; 212 processed_rcds = D1I(s)->processed_rcds.q; 213 buffered_messages = D1I(s)->buffered_messages; 214 sent_messages = s->d1->sent_messages; 215 buffered_app_data = D1I(s)->buffered_app_data.q; 216 mtu = D1I(s)->mtu; 217 218 dtls1_clear_queues(s); 219 220 memset(s->d1->internal, 0, sizeof(*s->d1->internal)); 221 internal = s->d1->internal; 222 memset(s->d1, 0, sizeof(*s->d1)); 223 s->d1->internal = internal; 224 225 if (s->server) { 226 D1I(s)->cookie_len = sizeof(D1I(s)->cookie); 227 } 228 229 if (SSL_get_options(s) & SSL_OP_NO_QUERY_MTU) { 230 D1I(s)->mtu = mtu; 231 } 232 233 D1I(s)->unprocessed_rcds.q = unprocessed_rcds; 234 D1I(s)->processed_rcds.q = processed_rcds; 235 D1I(s)->buffered_messages = buffered_messages; 236 s->d1->sent_messages = sent_messages; 237 D1I(s)->buffered_app_data.q = buffered_app_data; 238 } 239 240 ssl3_clear(s); 241 242 s->version = DTLS1_VERSION; 243 } 244 245 long 246 dtls1_ctrl(SSL *s, int cmd, long larg, void *parg) 247 { 248 int ret = 0; 249 250 switch (cmd) { 251 case DTLS_CTRL_GET_TIMEOUT: 252 if (dtls1_get_timeout(s, (struct timeval*) parg) != NULL) { 253 ret = 1; 254 } 255 break; 256 case DTLS_CTRL_HANDLE_TIMEOUT: 257 ret = dtls1_handle_timeout(s); 258 break; 259 case DTLS_CTRL_LISTEN: 260 ret = dtls1_listen(s, parg); 261 break; 262 263 default: 264 ret = ssl3_ctrl(s, cmd, larg, parg); 265 break; 266 } 267 return (ret); 268 } 269 270 /* 271 * As it's impossible to use stream ciphers in "datagram" mode, this 272 * simple filter is designed to disengage them in DTLS. Unfortunately 273 * there is no universal way to identify stream SSL_CIPHER, so we have 274 * to explicitly list their SSL_* codes. Currently RC4 is the only one 275 * available, but if new ones emerge, they will have to be added... 276 */ 277 const SSL_CIPHER * 278 dtls1_get_cipher(unsigned int u) 279 { 280 const SSL_CIPHER *ciph = ssl3_get_cipher(u); 281 282 if (ciph != NULL) { 283 if (ciph->algorithm_enc == SSL_RC4) 284 return NULL; 285 } 286 287 return ciph; 288 } 289 290 void 291 dtls1_start_timer(SSL *s) 292 { 293 294 /* If timer is not set, initialize duration with 1 second */ 295 if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) { 296 s->d1->timeout_duration = 1; 297 } 298 299 /* Set timeout to current time */ 300 gettimeofday(&(s->d1->next_timeout), NULL); 301 302 /* Add duration to current time */ 303 s->d1->next_timeout.tv_sec += s->d1->timeout_duration; 304 BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0, 305 &s->d1->next_timeout); 306 } 307 308 struct timeval* 309 dtls1_get_timeout(SSL *s, struct timeval* timeleft) 310 { 311 struct timeval timenow; 312 313 /* If no timeout is set, just return NULL */ 314 if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) { 315 return NULL; 316 } 317 318 /* Get current time */ 319 gettimeofday(&timenow, NULL); 320 321 /* If timer already expired, set remaining time to 0 */ 322 if (s->d1->next_timeout.tv_sec < timenow.tv_sec || 323 (s->d1->next_timeout.tv_sec == timenow.tv_sec && 324 s->d1->next_timeout.tv_usec <= timenow.tv_usec)) { 325 memset(timeleft, 0, sizeof(struct timeval)); 326 return timeleft; 327 } 328 329 /* Calculate time left until timer expires */ 330 memcpy(timeleft, &(s->d1->next_timeout), sizeof(struct timeval)); 331 timeleft->tv_sec -= timenow.tv_sec; 332 timeleft->tv_usec -= timenow.tv_usec; 333 if (timeleft->tv_usec < 0) { 334 timeleft->tv_sec--; 335 timeleft->tv_usec += 1000000; 336 } 337 338 /* If remaining time is less than 15 ms, set it to 0 339 * to prevent issues because of small devergences with 340 * socket timeouts. 341 */ 342 if (timeleft->tv_sec == 0 && timeleft->tv_usec < 15000) { 343 memset(timeleft, 0, sizeof(struct timeval)); 344 } 345 346 347 return timeleft; 348 } 349 350 int 351 dtls1_is_timer_expired(SSL *s) 352 { 353 struct timeval timeleft; 354 355 /* Get time left until timeout, return false if no timer running */ 356 if (dtls1_get_timeout(s, &timeleft) == NULL) { 357 return 0; 358 } 359 360 /* Return false if timer is not expired yet */ 361 if (timeleft.tv_sec > 0 || timeleft.tv_usec > 0) { 362 return 0; 363 } 364 365 /* Timer expired, so return true */ 366 return 1; 367 } 368 369 void 370 dtls1_double_timeout(SSL *s) 371 { 372 s->d1->timeout_duration *= 2; 373 if (s->d1->timeout_duration > 60) 374 s->d1->timeout_duration = 60; 375 dtls1_start_timer(s); 376 } 377 378 void 379 dtls1_stop_timer(SSL *s) 380 { 381 /* Reset everything */ 382 memset(&(D1I(s)->timeout), 0, sizeof(struct dtls1_timeout_st)); 383 memset(&(s->d1->next_timeout), 0, sizeof(struct timeval)); 384 s->d1->timeout_duration = 1; 385 BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0, 386 &(s->d1->next_timeout)); 387 /* Clear retransmission buffer */ 388 dtls1_clear_record_buffer(s); 389 } 390 391 int 392 dtls1_check_timeout_num(SSL *s) 393 { 394 D1I(s)->timeout.num_alerts++; 395 396 /* Reduce MTU after 2 unsuccessful retransmissions */ 397 if (D1I(s)->timeout.num_alerts > 2) { 398 D1I(s)->mtu = BIO_ctrl(SSL_get_wbio(s), 399 BIO_CTRL_DGRAM_GET_FALLBACK_MTU, 0, NULL); 400 401 } 402 403 if (D1I(s)->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT) { 404 /* fail the connection, enough alerts have been sent */ 405 SSLerror(s, SSL_R_READ_TIMEOUT_EXPIRED); 406 return -1; 407 } 408 409 return 0; 410 } 411 412 int 413 dtls1_handle_timeout(SSL *s) 414 { 415 /* if no timer is expired, don't do anything */ 416 if (!dtls1_is_timer_expired(s)) { 417 return 0; 418 } 419 420 dtls1_double_timeout(s); 421 422 if (dtls1_check_timeout_num(s) < 0) 423 return -1; 424 425 D1I(s)->timeout.read_timeouts++; 426 if (D1I(s)->timeout.read_timeouts > DTLS1_TMO_READ_COUNT) { 427 D1I(s)->timeout.read_timeouts = 1; 428 } 429 430 dtls1_start_timer(s); 431 return dtls1_retransmit_buffered_messages(s); 432 } 433 434 int 435 dtls1_listen(SSL *s, struct sockaddr *client) 436 { 437 int ret; 438 439 /* Ensure there is no state left over from a previous invocation */ 440 SSL_clear(s); 441 442 SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE); 443 D1I(s)->listen = 1; 444 445 ret = SSL_accept(s); 446 if (ret <= 0) 447 return ret; 448 449 (void)BIO_dgram_get_peer(SSL_get_rbio(s), client); 450 return 1; 451 } 452 453 void 454 dtls1_build_sequence_number(unsigned char *dst, unsigned char *seq, 455 unsigned short epoch) 456 { 457 CBB cbb; 458 459 if (!CBB_init_fixed(&cbb, dst, SSL3_SEQUENCE_SIZE)) 460 goto err; 461 if (!CBB_add_u16(&cbb, epoch)) 462 goto err; 463 if (!CBB_add_bytes(&cbb, &seq[2], SSL3_SEQUENCE_SIZE - 2)) 464 goto err; 465 if (!CBB_finish(&cbb, NULL, NULL)) 466 goto err; 467 468 return; 469 470 err: 471 CBB_cleanup(&cbb); 472 } 473