1 /* $OpenBSD: d1_lib.c,v 1.59 2021/08/30 19:12:25 jsing Exp $ */ 2 /* 3 * DTLS implementation written by Nagendra Modadugu 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 5 */ 6 /* ==================================================================== 7 * Copyright (c) 1999-2005 The OpenSSL Project. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in 18 * the documentation and/or other materials provided with the 19 * distribution. 20 * 21 * 3. All advertising materials mentioning features or use of this 22 * software must display the following acknowledgment: 23 * "This product includes software developed by the OpenSSL Project 24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 25 * 26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 27 * endorse or promote products derived from this software without 28 * prior written permission. For written permission, please contact 29 * openssl-core@OpenSSL.org. 30 * 31 * 5. Products derived from this software may not be called "OpenSSL" 32 * nor may "OpenSSL" appear in their names without prior written 33 * permission of the OpenSSL Project. 34 * 35 * 6. Redistributions of any form whatsoever must retain the following 36 * acknowledgment: 37 * "This product includes software developed by the OpenSSL Project 38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 39 * 40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 51 * OF THE POSSIBILITY OF SUCH DAMAGE. 52 * ==================================================================== 53 * 54 * This product includes cryptographic software written by Eric Young 55 * (eay@cryptsoft.com). This product includes software written by Tim 56 * Hudson (tjh@cryptsoft.com). 57 * 58 */ 59 60 #include <sys/types.h> 61 #include <sys/socket.h> 62 #include <sys/time.h> 63 64 #include <netinet/in.h> 65 66 #include <stdio.h> 67 68 #include <openssl/objects.h> 69 70 #include "dtls_locl.h" 71 #include "pqueue.h" 72 #include "ssl_locl.h" 73 74 void dtls1_hm_fragment_free(hm_fragment *frag); 75 76 static int dtls1_listen(SSL *s, struct sockaddr *client); 77 78 int 79 dtls1_new(SSL *s) 80 { 81 if (!ssl3_new(s)) 82 goto err; 83 84 if ((s->d1 = calloc(1, sizeof(*s->d1))) == NULL) 85 goto err; 86 if ((s->d1->internal = calloc(1, sizeof(*s->d1->internal))) == NULL) 87 goto err; 88 89 if ((s->d1->internal->unprocessed_rcds.q = pqueue_new()) == NULL) 90 goto err; 91 if ((s->d1->internal->buffered_messages = pqueue_new()) == NULL) 92 goto err; 93 if ((s->d1->sent_messages = pqueue_new()) == NULL) 94 goto err; 95 if ((s->d1->internal->buffered_app_data.q = pqueue_new()) == NULL) 96 goto err; 97 98 if (s->server) 99 s->d1->internal->cookie_len = sizeof(D1I(s)->cookie); 100 101 s->method->ssl_clear(s); 102 return (1); 103 104 err: 105 dtls1_free(s); 106 return (0); 107 } 108 109 static void 110 dtls1_drain_records(pqueue queue) 111 { 112 pitem *item; 113 DTLS1_RECORD_DATA_INTERNAL *rdata; 114 115 if (queue == NULL) 116 return; 117 118 while ((item = pqueue_pop(queue)) != NULL) { 119 rdata = (DTLS1_RECORD_DATA_INTERNAL *)item->data; 120 ssl3_release_buffer(&rdata->rbuf); 121 free(item->data); 122 pitem_free(item); 123 } 124 } 125 126 static void 127 dtls1_drain_fragments(pqueue queue) 128 { 129 pitem *item; 130 131 if (queue == NULL) 132 return; 133 134 while ((item = pqueue_pop(queue)) != NULL) { 135 dtls1_hm_fragment_free(item->data); 136 pitem_free(item); 137 } 138 } 139 140 static void 141 dtls1_clear_queues(SSL *s) 142 { 143 dtls1_drain_records(D1I(s)->unprocessed_rcds.q); 144 dtls1_drain_fragments(D1I(s)->buffered_messages); 145 dtls1_drain_fragments(s->d1->sent_messages); 146 dtls1_drain_records(D1I(s)->buffered_app_data.q); 147 } 148 149 void 150 dtls1_free(SSL *s) 151 { 152 if (s == NULL) 153 return; 154 155 ssl3_free(s); 156 157 dtls1_clear_queues(s); 158 159 pqueue_free(D1I(s)->unprocessed_rcds.q); 160 pqueue_free(D1I(s)->buffered_messages); 161 pqueue_free(s->d1->sent_messages); 162 pqueue_free(D1I(s)->buffered_app_data.q); 163 164 freezero(s->d1->internal, sizeof(*s->d1->internal)); 165 freezero(s->d1, sizeof(*s->d1)); 166 167 s->d1 = NULL; 168 } 169 170 void 171 dtls1_clear(SSL *s) 172 { 173 struct dtls1_state_internal_st *internal; 174 pqueue unprocessed_rcds; 175 pqueue buffered_messages; 176 pqueue sent_messages; 177 pqueue buffered_app_data; 178 unsigned int mtu; 179 180 if (s->d1) { 181 unprocessed_rcds = D1I(s)->unprocessed_rcds.q; 182 buffered_messages = D1I(s)->buffered_messages; 183 sent_messages = s->d1->sent_messages; 184 buffered_app_data = D1I(s)->buffered_app_data.q; 185 mtu = D1I(s)->mtu; 186 187 dtls1_clear_queues(s); 188 189 memset(s->d1->internal, 0, sizeof(*s->d1->internal)); 190 internal = s->d1->internal; 191 memset(s->d1, 0, sizeof(*s->d1)); 192 s->d1->internal = internal; 193 194 D1I(s)->unprocessed_rcds.epoch = 195 tls12_record_layer_read_epoch(s->internal->rl) + 1; 196 197 if (s->server) { 198 D1I(s)->cookie_len = sizeof(D1I(s)->cookie); 199 } 200 201 if (SSL_get_options(s) & SSL_OP_NO_QUERY_MTU) { 202 D1I(s)->mtu = mtu; 203 } 204 205 D1I(s)->unprocessed_rcds.q = unprocessed_rcds; 206 D1I(s)->buffered_messages = buffered_messages; 207 s->d1->sent_messages = sent_messages; 208 D1I(s)->buffered_app_data.q = buffered_app_data; 209 } 210 211 ssl3_clear(s); 212 213 s->version = DTLS1_VERSION; 214 } 215 216 long 217 dtls1_ctrl(SSL *s, int cmd, long larg, void *parg) 218 { 219 int ret = 0; 220 221 switch (cmd) { 222 case DTLS_CTRL_GET_TIMEOUT: 223 if (dtls1_get_timeout(s, (struct timeval*) parg) != NULL) { 224 ret = 1; 225 } 226 break; 227 case DTLS_CTRL_HANDLE_TIMEOUT: 228 ret = dtls1_handle_timeout(s); 229 break; 230 case DTLS_CTRL_LISTEN: 231 ret = dtls1_listen(s, parg); 232 break; 233 234 default: 235 ret = ssl3_ctrl(s, cmd, larg, parg); 236 break; 237 } 238 return (ret); 239 } 240 241 /* 242 * As it's impossible to use stream ciphers in "datagram" mode, this 243 * simple filter is designed to disengage them in DTLS. Unfortunately 244 * there is no universal way to identify stream SSL_CIPHER, so we have 245 * to explicitly list their SSL_* codes. Currently RC4 is the only one 246 * available, but if new ones emerge, they will have to be added... 247 */ 248 const SSL_CIPHER * 249 dtls1_get_cipher(unsigned int u) 250 { 251 const SSL_CIPHER *cipher; 252 253 if ((cipher = ssl3_get_cipher(u)) == NULL) 254 return NULL; 255 256 if (cipher->algorithm_enc == SSL_RC4) 257 return NULL; 258 259 return cipher; 260 } 261 262 void 263 dtls1_start_timer(SSL *s) 264 { 265 266 /* If timer is not set, initialize duration with 1 second */ 267 if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) { 268 s->d1->timeout_duration = 1; 269 } 270 271 /* Set timeout to current time */ 272 gettimeofday(&(s->d1->next_timeout), NULL); 273 274 /* Add duration to current time */ 275 s->d1->next_timeout.tv_sec += s->d1->timeout_duration; 276 BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0, 277 &s->d1->next_timeout); 278 } 279 280 struct timeval* 281 dtls1_get_timeout(SSL *s, struct timeval* timeleft) 282 { 283 struct timeval timenow; 284 285 /* If no timeout is set, just return NULL */ 286 if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) { 287 return NULL; 288 } 289 290 /* Get current time */ 291 gettimeofday(&timenow, NULL); 292 293 /* If timer already expired, set remaining time to 0 */ 294 if (s->d1->next_timeout.tv_sec < timenow.tv_sec || 295 (s->d1->next_timeout.tv_sec == timenow.tv_sec && 296 s->d1->next_timeout.tv_usec <= timenow.tv_usec)) { 297 memset(timeleft, 0, sizeof(struct timeval)); 298 return timeleft; 299 } 300 301 /* Calculate time left until timer expires */ 302 memcpy(timeleft, &(s->d1->next_timeout), sizeof(struct timeval)); 303 timeleft->tv_sec -= timenow.tv_sec; 304 timeleft->tv_usec -= timenow.tv_usec; 305 if (timeleft->tv_usec < 0) { 306 timeleft->tv_sec--; 307 timeleft->tv_usec += 1000000; 308 } 309 310 /* If remaining time is less than 15 ms, set it to 0 311 * to prevent issues because of small devergences with 312 * socket timeouts. 313 */ 314 if (timeleft->tv_sec == 0 && timeleft->tv_usec < 15000) { 315 memset(timeleft, 0, sizeof(struct timeval)); 316 } 317 318 319 return timeleft; 320 } 321 322 int 323 dtls1_is_timer_expired(SSL *s) 324 { 325 struct timeval timeleft; 326 327 /* Get time left until timeout, return false if no timer running */ 328 if (dtls1_get_timeout(s, &timeleft) == NULL) { 329 return 0; 330 } 331 332 /* Return false if timer is not expired yet */ 333 if (timeleft.tv_sec > 0 || timeleft.tv_usec > 0) { 334 return 0; 335 } 336 337 /* Timer expired, so return true */ 338 return 1; 339 } 340 341 void 342 dtls1_double_timeout(SSL *s) 343 { 344 s->d1->timeout_duration *= 2; 345 if (s->d1->timeout_duration > 60) 346 s->d1->timeout_duration = 60; 347 dtls1_start_timer(s); 348 } 349 350 void 351 dtls1_stop_timer(SSL *s) 352 { 353 /* Reset everything */ 354 memset(&(D1I(s)->timeout), 0, sizeof(struct dtls1_timeout_st)); 355 memset(&(s->d1->next_timeout), 0, sizeof(struct timeval)); 356 s->d1->timeout_duration = 1; 357 BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0, 358 &(s->d1->next_timeout)); 359 /* Clear retransmission buffer */ 360 dtls1_clear_record_buffer(s); 361 } 362 363 int 364 dtls1_check_timeout_num(SSL *s) 365 { 366 D1I(s)->timeout.num_alerts++; 367 368 /* Reduce MTU after 2 unsuccessful retransmissions */ 369 if (D1I(s)->timeout.num_alerts > 2) { 370 D1I(s)->mtu = BIO_ctrl(SSL_get_wbio(s), 371 BIO_CTRL_DGRAM_GET_FALLBACK_MTU, 0, NULL); 372 373 } 374 375 if (D1I(s)->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT) { 376 /* fail the connection, enough alerts have been sent */ 377 SSLerror(s, SSL_R_READ_TIMEOUT_EXPIRED); 378 return -1; 379 } 380 381 return 0; 382 } 383 384 int 385 dtls1_handle_timeout(SSL *s) 386 { 387 /* if no timer is expired, don't do anything */ 388 if (!dtls1_is_timer_expired(s)) { 389 return 0; 390 } 391 392 dtls1_double_timeout(s); 393 394 if (dtls1_check_timeout_num(s) < 0) 395 return -1; 396 397 D1I(s)->timeout.read_timeouts++; 398 if (D1I(s)->timeout.read_timeouts > DTLS1_TMO_READ_COUNT) { 399 D1I(s)->timeout.read_timeouts = 1; 400 } 401 402 dtls1_start_timer(s); 403 return dtls1_retransmit_buffered_messages(s); 404 } 405 406 int 407 dtls1_listen(SSL *s, struct sockaddr *client) 408 { 409 int ret; 410 411 /* Ensure there is no state left over from a previous invocation */ 412 SSL_clear(s); 413 414 SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE); 415 D1I(s)->listen = 1; 416 417 ret = SSL_accept(s); 418 if (ret <= 0) 419 return ret; 420 421 (void)BIO_dgram_get_peer(SSL_get_rbio(s), client); 422 return 1; 423 } 424