src/third_party/boringssl/src/ssl/d1_clnt.c

   1 /*
   2  * DTLS implementation written by Nagendra Modadugu
   3  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    openssl-core@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  *
  53  * This product includes cryptographic software written by Eric Young
  54  * (eay@cryptsoft.com).  This product includes software written by Tim
  55  * Hudson (tjh@cryptsoft.com).
  56  *
  57  */
  58 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  59  * All rights reserved.
  60  *
  61  * This package is an SSL implementation written
  62  * by Eric Young (eay@cryptsoft.com).
  63  * The implementation was written so as to conform with Netscapes SSL.
  64  *
  65  * This library is free for commercial and non-commercial use as long as
  66  * the following conditions are aheared to.  The following conditions
  67  * apply to all code found in this distribution, be it the RC4, RSA,
  68  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  69  * included with this distribution is covered by the same copyright terms
  70  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  71  *
  72  * Copyright remains Eric Young's, and as such any Copyright notices in
  73  * the code are not to be removed.
  74  * If this package is used in a product, Eric Young should be given attribution
  75  * as the author of the parts of the library used.
  76  * This can be in the form of a textual message at program startup or
  77  * in documentation (online or textual) provided with the package.
  78  *
  79  * Redistribution and use in source and binary forms, with or without
  80  * modification, are permitted provided that the following conditions
  81  * are met:
  82  * 1. Redistributions of source code must retain the copyright
  83  *    notice, this list of conditions and the following disclaimer.
  84  * 2. Redistributions in binary form must reproduce the above copyright
  85  *    notice, this list of conditions and the following disclaimer in the
  86  *    documentation and/or other materials provided with the distribution.
  87  * 3. All advertising materials mentioning features or use of this software
  88  *    must display the following acknowledgement:
  89  *    "This product includes cryptographic software written by
  90  *     Eric Young (eay@cryptsoft.com)"
  91  *    The word 'cryptographic' can be left out if the rouines from the library
  92  *    being used are not cryptographic related :-).
  93  * 4. If you include any Windows specific code (or a derivative thereof) from
  94  *    the apps directory (application code) you must include an acknowledgement:
  95  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  96  *
  97  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  98  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  99  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 100  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 101  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 102  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 103  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 104  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 105  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 106  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 107  * SUCH DAMAGE.
 108  *
 109  * The licence and distribution terms for any publically available version or
 110  * derivative of this code cannot be changed.  i.e. this code cannot simply be
 111  * copied and put under another distribution licence
 112  * [including the GNU Public Licence.]
 113  */
 114
 115 #include <stdio.h>
 116
 117 #include <openssl/bn.h>
 118 #include <openssl/buf.h>
 119 #include <openssl/dh.h>
 120 #include <openssl/evp.h>
 121 #include <openssl/md5.h>
 122 #include <openssl/mem.h>
 123 #include <openssl/obj.h>
 124 #include <openssl/rand.h>
 125
 126 #include "ssl_locl.h"
 127
 128 static const SSL_METHOD *dtls1_get_client_method(int ver);
 129 static int dtls1_get_hello_verify(SSL *s);
 130
 131 static const SSL_METHOD *dtls1_get_client_method(int ver)
 132         {
 133         if (ver == DTLS1_VERSION)
 134                 return(DTLSv1_client_method());
 135         else if (ver == DTLS1_2_VERSION)
 136                 return(DTLSv1_2_client_method());
 137         else
 138                 return(NULL);
 139         }
 140
 141 IMPLEMENT_dtls1_meth_func(DTLS1_VERSION,
 142                         DTLSv1_client_method,
 143                         ssl_undefined_function,
 144                         dtls1_connect,
 145                         dtls1_get_client_method,
 146                         DTLSv1_enc_data)
 147
 148 IMPLEMENT_dtls1_meth_func(DTLS1_2_VERSION,
 149                         DTLSv1_2_client_method,
 150                         ssl_undefined_function,
 151                         dtls1_connect,
 152                         dtls1_get_client_method,
 153                         DTLSv1_2_enc_data)
 154
 155 IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION,
 156                         DTLS_client_method,
 157                         ssl_undefined_function,
 158                         dtls1_connect,
 159                         dtls1_get_client_method,
 160                         DTLSv1_2_enc_data)
 161
 162 int dtls1_connect(SSL *s)
 163         {
 164         BUF_MEM *buf=NULL;
 165         void (*cb)(const SSL *ssl,int type,int val)=NULL;
 166         int ret= -1;
 167         int new_state,state,skip=0;
 168
 169         ERR_clear_error();
 170         ERR_clear_system_error();
 171
 172         if (s->info_callback != NULL)
 173                 cb=s->info_callback;
 174         else if (s->ctx->info_callback != NULL)
 175                 cb=s->ctx->info_callback;
 176
 177         s->in_handshake++;
 178         if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
 179
 180         for (;;)
 181                 {
 182                 state=s->state;
 183
 184                 switch(s->state)
 185                         {
 186                 case SSL_ST_RENEGOTIATE:
 187                         s->renegotiate=1;
 188                         s->state=SSL_ST_CONNECT;
 189                         s->ctx->stats.sess_connect_renegotiate++;
 190                         /* break */
 191                 case SSL_ST_BEFORE:
 192                 case SSL_ST_CONNECT:
 193                 case SSL_ST_BEFORE|SSL_ST_CONNECT:
 194                 case SSL_ST_OK|SSL_ST_CONNECT:
 195
 196                         s->server=0;
 197                         if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
 198
 199                         if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00))
 200                                 {
 201                                 OPENSSL_PUT_ERROR(SSL, dtls1_connect, ERR_R_INTERNAL_ERROR);
 202                                 ret = -1;
 203                                 goto end;
 204                                 }
 205
 206                         /* s->version=SSL3_VERSION; */
 207                         s->type=SSL_ST_CONNECT;
 208
 209                         if (s->init_buf == NULL)
 210                                 {
 211                                 if ((buf=BUF_MEM_new()) == NULL)
 212                                         {
 213                                         ret= -1;
 214                                         goto end;
 215                                         }
 216                                 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
 217                                         {
 218                                         ret= -1;
 219                                         goto end;
 220                                         }
 221                                 s->init_buf=buf;
 222                                 buf=NULL;
 223                                 }
 224
 225                         if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
 226
 227                         /* setup buffing BIO */
 228                         if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; }
 229
 230                         /* don't push the buffering BIO quite yet */
 231
 232                         s->state=SSL3_ST_CW_CLNT_HELLO_A;
 233                         s->ctx->stats.sess_connect++;
 234                         s->init_num=0;
 235                         s->d1->send_cookie = 0;
 236                         s->hit = 0;
 237                         break;
 238
 239                 case SSL3_ST_CW_CLNT_HELLO_A:
 240                 case SSL3_ST_CW_CLNT_HELLO_B:
 241
 242                         s->shutdown=0;
 243
 244                         /* every DTLS ClientHello resets Finished MAC */
 245                         ssl3_init_finished_mac(s);
 246
 247                         dtls1_start_timer(s);
 248                         ret=ssl3_send_client_hello(s);
 249                         if (ret <= 0) goto end;
 250
 251                         if ( s->d1->send_cookie)
 252                                 {
 253                                 s->state=SSL3_ST_CW_FLUSH;
 254                                 s->s3->tmp.next_state=SSL3_ST_CR_SRVR_HELLO_A;
 255                                 }
 256                         else
 257                                 s->state=DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A;
 258
 259                         s->init_num=0;
 260                                 /* turn on buffering for the next lot of output */
 261                                 if (s->bbio != s->wbio)
 262                                         s->wbio=BIO_push(s->bbio,s->wbio);
 263
 264                         break;
 265
 266                 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
 267                 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B:
 268
 269                         ret = dtls1_get_hello_verify(s);
 270                         if ( ret <= 0)
 271                                 goto end;
 272                         if ( s->d1->send_cookie)
 273                                 {
 274                                 /* start again, with a cookie */
 275                                 dtls1_stop_timer(s);
 276                                 s->state = SSL3_ST_CW_CLNT_HELLO_A;
 277                                 }
 278                         else
 279                                 {
 280                                 s->state = SSL3_ST_CR_SRVR_HELLO_A;
 281                                 }
 282                         s->init_num = 0;
 283                         break;
 284
 285                 case SSL3_ST_CR_SRVR_HELLO_A:
 286                 case SSL3_ST_CR_SRVR_HELLO_B:
 287                         ret=ssl3_get_server_hello(s);
 288                         if (ret <= 0) goto end;
 289
 290                         if (s->hit)
 291                                 {
 292                                 s->state=SSL3_ST_CR_FINISHED_A;
 293                                 if (s->tlsext_ticket_expected)
 294                                         {
 295                                         /* receive renewed session ticket */
 296                                         s->state=SSL3_ST_CR_SESSION_TICKET_A;
 297                                         }
 298                                 }
 299                         else
 300                                 {
 301                                 s->state=SSL3_ST_CR_CERT_A;
 302                                 }
 303                         s->init_num=0;
 304                         break;
 305
 306                 case SSL3_ST_CR_CERT_A:
 307                 case SSL3_ST_CR_CERT_B:
 308                         if (ssl_cipher_has_server_public_key(s->s3->tmp.new_cipher))
 309                                 {
 310                                 ret=ssl3_get_server_certificate(s);
 311                                 if (ret <= 0) goto end;
 312                                 if (s->s3->tmp.certificate_status_expected)
 313                                         s->state=SSL3_ST_CR_CERT_STATUS_A;
 314                                 else
 315                                         s->state=SSL3_ST_CR_KEY_EXCH_A;
 316                                 }
 317                         else
 318                                 {
 319                                 skip = 1;
 320                                 s->state=SSL3_ST_CR_KEY_EXCH_A;
 321                                 }
 322                         s->init_num=0;
 323                         break;
 324
 325                 case SSL3_ST_CR_KEY_EXCH_A:
 326                 case SSL3_ST_CR_KEY_EXCH_B:
 327                         ret=ssl3_get_server_key_exchange(s);
 328                         if (ret <= 0) goto end;
 329                         s->state=SSL3_ST_CR_CERT_REQ_A;
 330                         s->init_num=0;
 331
 332                         /* at this point we check that we have the
 333                          * required stuff from the server */
 334                         if (!ssl3_check_cert_and_algorithm(s))
 335                                 {
 336                                 ret= -1;
 337                                 goto end;
 338                                 }
 339                         break;
 340
 341                 case SSL3_ST_CR_CERT_REQ_A:
 342                 case SSL3_ST_CR_CERT_REQ_B:
 343                         ret=ssl3_get_certificate_request(s);
 344                         if (ret <= 0) goto end;
 345                         s->state=SSL3_ST_CR_SRVR_DONE_A;
 346                         s->init_num=0;
 347                         break;
 348
 349                 case SSL3_ST_CR_SRVR_DONE_A:
 350                 case SSL3_ST_CR_SRVR_DONE_B:
 351                         ret=ssl3_get_server_done(s);
 352                         if (ret <= 0) goto end;
 353                         dtls1_stop_timer(s);
 354                         if (s->s3->tmp.cert_req)
 355                                 s->s3->tmp.next_state=SSL3_ST_CW_CERT_A;
 356                         else
 357                                 s->s3->tmp.next_state=SSL3_ST_CW_KEY_EXCH_A;
 358                         s->init_num=0;
 359                         s->state=s->s3->tmp.next_state;
 360                         break;
 361
 362                 case SSL3_ST_CW_CERT_A:
 363                 case SSL3_ST_CW_CERT_B:
 364                 case SSL3_ST_CW_CERT_C:
 365                 case SSL3_ST_CW_CERT_D:
 366                         dtls1_start_timer(s);
 367                         ret=ssl3_send_client_certificate(s);
 368                         if (ret <= 0) goto end;
 369                         s->state=SSL3_ST_CW_KEY_EXCH_A;
 370                         s->init_num=0;
 371                         break;
 372
 373                 case SSL3_ST_CW_KEY_EXCH_A:
 374                 case SSL3_ST_CW_KEY_EXCH_B:
 375                         dtls1_start_timer(s);
 376                         ret=ssl3_send_client_key_exchange(s);
 377                         if (ret <= 0) goto end;
 378                         /* For TLS, cert_req is set to 2, so a cert chain
 379                          * of nothing is sent, but no verify packet is sent */
 380                         if (s->s3->tmp.cert_req == 1)
 381                                 {
 382                                 s->state=SSL3_ST_CW_CERT_VRFY_A;
 383                                 }
 384                         else
 385                                 {
 386                                 s->state=SSL3_ST_CW_CHANGE_A;
 387                                 s->s3->change_cipher_spec=0;
 388                                 }
 389
 390                         s->init_num=0;
 391                         break;
 392
 393                 case SSL3_ST_CW_CERT_VRFY_A:
 394                 case SSL3_ST_CW_CERT_VRFY_B:
 395                         dtls1_start_timer(s);
 396                         ret=ssl3_send_cert_verify(s);
 397                         if (ret <= 0) goto end;
 398                         s->state=SSL3_ST_CW_CHANGE_A;
 399                         s->init_num=0;
 400                         s->s3->change_cipher_spec=0;
 401                         break;
 402
 403                 case SSL3_ST_CW_CHANGE_A:
 404                 case SSL3_ST_CW_CHANGE_B:
 405                         if (!s->hit)
 406                                 dtls1_start_timer(s);
 407                         ret=dtls1_send_change_cipher_spec(s,
 408                                 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
 409                         if (ret <= 0) goto end;
 410
 411                         s->state=SSL3_ST_CW_FINISHED_A;
 412                         s->init_num=0;
 413
 414                         s->session->cipher=s->s3->tmp.new_cipher;
 415                         if (!s->method->ssl3_enc->setup_key_block(s))
 416                                 {
 417                                 ret= -1;
 418                                 goto end;
 419                                 }
 420
 421                         if (!s->method->ssl3_enc->change_cipher_state(s,
 422                                 SSL3_CHANGE_CIPHER_CLIENT_WRITE))
 423                                 {
 424                                 ret= -1;
 425                                 goto end;
 426                                 }
 427
 428                         dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
 429                         break;
 430
 431                 case SSL3_ST_CW_FINISHED_A:
 432                 case SSL3_ST_CW_FINISHED_B:
 433                         if (!s->hit)
 434                                 dtls1_start_timer(s);
 435                         ret=ssl3_send_finished(s,
 436                                 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
 437                                 s->method->ssl3_enc->client_finished_label,
 438                                 s->method->ssl3_enc->client_finished_label_len);
 439                         if (ret <= 0) goto end;
 440                         s->state=SSL3_ST_CW_FLUSH;
 441
 442                         /* clear flags */
 443                         s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
 444                         if (s->hit)
 445                                 {
 446                                 s->s3->tmp.next_state=SSL_ST_OK;
 447                                 }
 448                         else
 449                                 {
 450
 451                                 /* Allow NewSessionTicket if ticket expected */
 452                                 if (s->tlsext_ticket_expected)
 453                                         s->s3->tmp.next_state=SSL3_ST_CR_SESSION_TICKET_A;
 454                                 else
 455
 456                                 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
 457                                 }
 458                         s->init_num=0;
 459                         break;
 460
 461                 case SSL3_ST_CR_SESSION_TICKET_A:
 462                 case SSL3_ST_CR_SESSION_TICKET_B:
 463                         ret=ssl3_get_new_session_ticket(s);
 464                         if (ret <= 0) goto end;
 465                         s->state=SSL3_ST_CR_FINISHED_A;
 466                         s->init_num=0;
 467                 break;
 468
 469                 case SSL3_ST_CR_CERT_STATUS_A:
 470                 case SSL3_ST_CR_CERT_STATUS_B:
 471                         ret=ssl3_get_cert_status(s);
 472                         if (ret <= 0) goto end;
 473                         s->state=SSL3_ST_CR_KEY_EXCH_A;
 474                         s->init_num=0;
 475                 break;
 476
 477                 case SSL3_ST_CR_FINISHED_A:
 478                 case SSL3_ST_CR_FINISHED_B:
 479                         s->d1->change_cipher_spec_ok = 1;
 480                         ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
 481                                 SSL3_ST_CR_FINISHED_B);
 482                         if (ret <= 0) goto end;
 483                         dtls1_stop_timer(s);
 484
 485                         if (s->hit)
 486                                 s->state=SSL3_ST_CW_CHANGE_A;
 487                         else
 488                                 s->state=SSL_ST_OK;
 489
 490                         s->init_num=0;
 491                         break;
 492
 493                 case SSL3_ST_CW_FLUSH:
 494                         s->rwstate=SSL_WRITING;
 495                         if (BIO_flush(s->wbio) <= 0)
 496                                 {
 497                                 /* If the write error was fatal, stop trying */
 498                                 if (!BIO_should_retry(s->wbio))
 499                                         {
 500                                         s->rwstate=SSL_NOTHING;
 501                                         s->state=s->s3->tmp.next_state;
 502                                         }
 503
 504                                 ret= -1;
 505                                 goto end;
 506                                 }
 507                         s->rwstate=SSL_NOTHING;
 508                         s->state=s->s3->tmp.next_state;
 509                         break;
 510
 511                 case SSL_ST_OK:
 512                         /* clean a few things up */
 513                         ssl3_cleanup_key_block(s);
 514
 515 #if 0
 516                         if (s->init_buf != NULL)
 517                                 {
 518                                 BUF_MEM_free(s->init_buf);
 519                                 s->init_buf=NULL;
 520                                 }
 521 #endif
 522
 523                         /* If we are not 'joining' the last two packets,
 524                          * remove the buffering now */
 525                         if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER))
 526                                 ssl_free_wbio_buffer(s);
 527                         /* else do it later in ssl3_write */
 528
 529                         s->init_num=0;
 530                         s->renegotiate=0;
 531                         s->new_session=0;
 532
 533                         ssl_update_cache(s,SSL_SESS_CACHE_CLIENT);
 534                         if (s->hit) s->ctx->stats.sess_hit++;
 535
 536                         ret=1;
 537                         /* s->server=0; */
 538                         s->handshake_func=dtls1_connect;
 539                         s->ctx->stats.sess_connect_good++;
 540
 541                         if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
 542
 543                         /* done with handshaking */
 544                         s->d1->handshake_read_seq  = 0;
 545                         s->d1->next_handshake_write_seq = 0;
 546                         goto end;
 547                         /* break; */
 548
 549                 default:
 550                         OPENSSL_PUT_ERROR(SSL, dtls1_connect, SSL_R_UNKNOWN_STATE);
 551                         ret= -1;
 552                         goto end;
 553                         /* break; */
 554                         }
 555
 556                 /* did we do anything */
 557                 if (!s->s3->tmp.reuse_message && !skip)
 558                         {
 559                         if (s->debug)
 560                                 {
 561                                 if ((ret=BIO_flush(s->wbio)) <= 0)
 562                                         goto end;
 563                                 }
 564
 565                         if ((cb != NULL) && (s->state != state))
 566                                 {
 567                                 new_state=s->state;
 568                                 s->state=state;
 569                                 cb(s,SSL_CB_CONNECT_LOOP,1);
 570                                 s->state=new_state;
 571                                 }
 572                         }
 573                 skip=0;
 574                 }
 575 end:
 576         s->in_handshake--;
 577
 578         if (buf != NULL)
 579                 BUF_MEM_free(buf);
 580         if (cb != NULL)
 581                 cb(s,SSL_CB_CONNECT_EXIT,ret);
 582         return(ret);
 583         }
 584
 585 static int dtls1_get_hello_verify(SSL *s)
 586         {
 587         long n;
 588         int al, ok = 0;
 589         CBS hello_verify_request, cookie;
 590         uint16_t server_version;
 591
 592         s->first_packet = 1;
 593         n=s->method->ssl_get_message(s,
 594                 DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
 595                 DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B,
 596                 -1,
 597                 /* Use the same maximum size as ssl3_get_server_hello. */
 598                 20000,
 599                 SSL_GET_MESSAGE_HASH_MESSAGE,
 600                 &ok);
 601         s->first_packet = 0;
 602
 603         if (!ok) return((int)n);
 604
 605         if (s->s3->tmp.message_type != DTLS1_MT_HELLO_VERIFY_REQUEST)
 606                 {
 607                 s->d1->send_cookie = 0;
 608                 s->s3->tmp.reuse_message = 1;
 609                 return(1);
 610                 }
 611
 612         CBS_init(&hello_verify_request, s->init_msg, n);
 613
 614         if (!CBS_get_u16(&hello_verify_request, &server_version) ||
 615                 !CBS_get_u8_length_prefixed(&hello_verify_request, &cookie) ||
 616                 CBS_len(&hello_verify_request) != 0)
 617                 {
 618                 al = SSL_AD_DECODE_ERROR;
 619                 OPENSSL_PUT_ERROR(SSL, ssl3_get_cert_status, SSL_R_DECODE_ERROR);
 620                 goto f_err;
 621                 }
 622
 623         if (CBS_len(&cookie) > sizeof(s->d1->cookie))
 624                 {
 625                 al=SSL_AD_ILLEGAL_PARAMETER;
 626                 goto f_err;
 627                 }
 628
 629         memcpy(s->d1->cookie, CBS_data(&cookie), CBS_len(&cookie));
 630         s->d1->cookie_len = CBS_len(&cookie);
 631
 632         s->d1->send_cookie = 1;
 633         return 1;
 634
 635 f_err:
 636         ssl3_send_alert(s, SSL3_AL_FATAL, al);
 637         return -1;
 638         }
 639