Check for buffered handshake messages on cipher change in DTLS.
This is the equivalent of FragmentAcrossChangeCipherSuite for DTLS. It
is possible for us to, while receiving pre-CCS handshake messages, to
buffer up a message with sequence number meant for a post-CCS Finished.
When we then get to the new epoch and attempt to read the Finished, we
will process the buffered Finished although it was sent with the wrong
encryption.
Move ssl_set_{read,write}_state to SSL_PROTOCOL_METHOD hooks as this is
a property of the transport. Notably, read_state may fail. In DTLS
check the handshake buffer size. We could place this check in
read_change_cipher_spec, but TLS 1.3 has no ChangeCipherSpec message, so
we will need to implement this at the cipher change point anyway. (For
now, there is only an assert on the TLS side. This will be replaced with
a proper check in TLS 1.3.)
Change-Id: Ia52b0b81e7db53e9ed2d4f6d334a1cce13e93297
Reviewed-on: https://boringssl-review.googlesource.com/8790
Reviewed-by: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 2248f8c..331703a 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -256,7 +256,7 @@
/* dtls1_is_current_message_complete returns one if the current handshake
* message is complete and zero otherwise. */
-static int dtls1_is_current_message_complete(SSL *ssl) {
+static int dtls1_is_current_message_complete(const SSL *ssl) {
hm_fragment *frag = ssl->d1->incoming_messages[ssl->d1->handshake_read_seq %
SSL_MAX_HANDSHAKE_FLIGHT];
return frag != NULL && frag->reassembly == NULL;
@@ -457,13 +457,26 @@
}
void dtls_clear_incoming_messages(SSL *ssl) {
- size_t i;
- for (i = 0; i < SSL_MAX_HANDSHAKE_FLIGHT; i++) {
+ for (size_t i = 0; i < SSL_MAX_HANDSHAKE_FLIGHT; i++) {
dtls1_hm_fragment_free(ssl->d1->incoming_messages[i]);
ssl->d1->incoming_messages[i] = NULL;
}
}
+int dtls_has_incoming_messages(const SSL *ssl) {
+ /* This function may not be called if there is a pending |dtls1_get_message|
+ * operation. */
+ assert(dtls1_is_current_message_complete(ssl));
+
+ size_t current = ssl->d1->handshake_read_seq % SSL_MAX_HANDSHAKE_FLIGHT;
+ for (size_t i = 0; i < SSL_MAX_HANDSHAKE_FLIGHT; i++) {
+ if (i != current && ssl->d1->incoming_messages[i] != NULL) {
+ return 1;
+ }
+ }
+ return 0;
+}
+
int dtls1_parse_fragment(CBS *cbs, struct hm_header_st *out_hdr,
CBS *out_body) {
memset(out_hdr, 0x00, sizeof(struct hm_header_st));
