int
tls_handshake_retransmit_timer_expired(tls_handshake_t filter)
{
assert(filter->isDTLS);
return DTLSRetransmit(filter);
}
int
tls_handshake_process(tls_handshake_t filter, const tls_buffer message, uint8_t contentType)
{
int err;
switch (contentType)
{
case tls_record_type_Handshake:
sslLogRxProtocolDebug("Handshake");
err = SSLProcessHandshakeRecord(message, filter);
break;
case tls_record_type_Alert:
sslLogRxProtocolDebug("Alert");
err = SSLProcessAlert(message, filter);
break;
case tls_record_type_ChangeCipher:
sslLogRxProtocolDebug("ChangeCipher");
err = SSLProcessChangeCipherSpec(message, filter);
break;
case tls_record_type_SSL2:
sslLogRxProtocolDebug("SSL2");
err = SSLProcessSSL2Message(message, filter);
break;
default:
sslLogRxProtocolDebug("Not a supported protocol message");
return errSSLProtocol;
}
if(err==errSSLUnexpectedRecord)
err=DTLSRetransmit(filter);
if(err)
sslErrorLog("Error processing a message (ct=%d, err=%d)", contentType, err);
return err;
}
/* SSLReadRecord
* Attempt to read & decrypt an SSL record.
* Record content should be freed using SSLFreeRecord
*/
OSStatus
SSLReadRecord(SSLRecord *rec, SSLContext *ctx)
{ OSStatus err;
err=errorTranslate(ctx->recFuncs->read(ctx->recCtx, rec));
switch(err) {
case errSecSuccess:
case errSSLWouldBlock:
break;
case errSSLUnexpectedRecord:
DTLSRetransmit(ctx);
break;
case errSSLDecryptionFail:
case errSSLBadRecordMac:
/* We never send a Decryption Failed alert, instead we send the BadRecordMac alert */
/* This is TLS 1.1 compliant - Do it for all protocols versions. */
/* Except for DTLS where we do not send any alert. */
if(ctx->isDTLS) {
/* This will ensure we try to read again before returning to the caller
We do NOT want to use errSSLWouldBlock here, as this should only indicate
the IO read callback status */
err=errSSLUnexpectedRecord;
} else {
SSLFatalSessionAlert(SSL_AlertBadRecordMac, ctx);
}
break;
case errSSLInternal:
SSLFatalSessionAlert(SSL_AlertInternalError, ctx);
break;
case errSSLRecordOverflow:
SSLFatalSessionAlert(SSL_AlertRecordOverflow, ctx);
break;
case errSSLClosedAbort:
case errSSLConnectionRefused:
SSLFatalSessionAlert(SSL_AlertCloseNotify, ctx);
break;
default:
sslErrorLog("unknown error code returned in SSLReadRecord: %d\n", (int)err);
SSLFatalSessionAlert(SSL_AlertCloseNotify, ctx);
break;
}
return err;
}
