Skip to content

Commit a816479

Browse files
IngelaAndinIngelaAndin
committed
Merge branch 'maint'
2 parents 03d8e0f + f53eb89 commit a816479

7 files changed

Lines changed: 119 additions & 32 deletions

‎lib/ssl/src/dtls_client_connection.erl‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@
121121

122122
-include("dtls_connection.hrl").
123123
-include("dtls_handshake.hrl").
124+
-include("dtls_record.hrl").
124125
-include("ssl_alert.hrl").
125126
-include("ssl_cipher.hrl").
126127
-include("ssl_internal.hrl").
@@ -330,6 +331,10 @@ hello(internal, #change_cipher_spec{type = <<1>>}, State0) ->
330331
end;
331332
hello(state_timeout, Event, State) ->
332333
dtls_gen_connection:handle_state_timeout(Event, ?STATE(hello), State);
334+
hello(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
335+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
336+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
337+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(hello), State);
333338
hello(info, Event, State) ->
334339
dtls_gen_connection:gen_info(Event, ?STATE(hello), State);
335340
hello(Type, Event, State) ->
@@ -363,6 +368,10 @@ abbreviated(internal = Type, #change_cipher_spec{} = Event,
363368
ConnectionStates = dtls_record:next_epoch(ConnectionStates1, read),
364369
gen_state(?STATE(abbreviated), Type, Event,
365370
State#state{connection_states = ConnectionStates});
371+
abbreviated(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
372+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
373+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
374+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(abbreviated), State);
366375
abbreviated(Type, Event, State) ->
367376
gen_state(?STATE(abbreviated), Type, Event, State).
368377

@@ -375,6 +384,10 @@ wait_stapling(enter, _Event, State0) ->
375384
{keep_state, State, Actions};
376385
wait_stapling(state_timeout, Event, State) ->
377386
dtls_gen_connection:handle_state_timeout(Event, ?STATE(wait_stapling), State);
387+
wait_stapling(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
388+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
389+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
390+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(wait_stapling), State);
378391
wait_stapling(info, Event, State) ->
379392
dtls_gen_connection:gen_info(Event, ?STATE(wait_stapling), State);
380393
wait_stapling(Type, Event, State) ->
@@ -406,6 +419,10 @@ certify(internal, #change_cipher_spec{type = <<1>>}, State0) ->
406419
end;
407420
certify(state_timeout, Event, State) ->
408421
dtls_gen_connection:handle_state_timeout(Event, ?STATE(certify), State);
422+
certify(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
423+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
424+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
425+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(certify), State);
409426
certify(info, Event, State) ->
410427
dtls_gen_connection:gen_info(Event, ?STATE(certify), State);
411428
certify(Type, Event, State) ->
@@ -443,6 +460,10 @@ cipher(internal = Type, #finished{} = Event, #state{connection_states = Connecti
443460
catch throw:#alert{} = Alert ->
444461
ssl_gen_statem:handle_own_alert(Alert, cipher, State)
445462
end;
463+
cipher(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
464+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
465+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
466+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(cipher), State);
446467
cipher(Type, Event, State) ->
447468
gen_state(?STATE(cipher), Type, Event, State).
448469

‎lib/ssl/src/dtls_server_connection.erl‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@
121121

122122
-include("dtls_connection.hrl").
123123
-include("dtls_handshake.hrl").
124+
-include("dtls_record.hrl").
124125
-include("ssl_alert.hrl").
125126
-include("ssl_cipher.hrl").
126127
-include("ssl_internal.hrl").
@@ -206,6 +207,10 @@ initial_hello({call, From}, {start, {Opts, EmOpts}, Timeout},
206207
catch throw:Error ->
207208
{stop_and_reply, {shutdown, normal}, {reply, From, {error, Error}}, State0}
208209
end;
210+
initial_hello(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
211+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
212+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
213+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(initial_hello), State);
209214
initial_hello(Type, Event, State) ->
210215
tls_dtls_server_connection:initial_hello(Type, Event, State).
211216

@@ -302,7 +307,10 @@ hello(internal, #change_cipher_spec{type = <<1>>}, State0) ->
302307
{stop, _, _} = Stop ->
303308
Stop
304309
end;
305-
310+
hello(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
311+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
312+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
313+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(hello), State);
306314
hello(info, Event, State) ->
307315
dtls_gen_connection:gen_info(Event, ?STATE(hello), State);
308316
hello(state_timeout, Event, State) ->
@@ -338,6 +346,10 @@ abbreviated(internal = Type, #change_cipher_spec{} = Event,
338346
ConnectionStates = dtls_record:next_epoch(ConnectionStates1, read),
339347
gen_state(?STATE(abbreviated), Type, Event,
340348
State#state{connection_states = ConnectionStates});
349+
abbreviated(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
350+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
351+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
352+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(abbreviated), State);
341353
abbreviated(Type, Event, State) ->
342354
gen_state(?STATE(abbreviated), Type, Event, State).
343355

@@ -362,6 +374,10 @@ certify(internal, #change_cipher_spec{type = <<1>>}, State0) ->
362374
end;
363375
certify(state_timeout, Event, State) ->
364376
dtls_gen_connection:handle_state_timeout(Event, ?STATE(certify), State);
377+
certify(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
378+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
379+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
380+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(certify), State);
365381
certify(info, Event, State) ->
366382
dtls_gen_connection:gen_info(Event, ?STATE(certify), State);
367383
certify(Type, Event, State) ->
@@ -378,6 +394,10 @@ wait_cert_verify(state_timeout, Event, State) ->
378394
dtls_gen_connection:handle_state_timeout(Event, ?STATE(wait_cert_verify), State);
379395
wait_cert_verify(info, Event, State) ->
380396
dtls_gen_connection:gen_info(Event, ?STATE(wait_cert_verify), State);
397+
wait_cert_verify(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
398+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
399+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
400+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(wait_cert_verify), State);
381401
wait_cert_verify(Type, Event, State) ->
382402
gen_state(?STATE(wait_cert_verify), Type, Event, State).
383403

@@ -404,6 +424,10 @@ cipher(internal = Type, #finished{} = Event, #state{connection_states = Connecti
404424
State#state{connection_states = ConnectionStates,
405425
protocol_specific =
406426
PS#{flight_state => connection}}));
427+
cipher(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
428+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
429+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
430+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(cipher), State);
407431
cipher(Type, Event, State) ->
408432
gen_state(?STATE(cipher), Type, Event, State).
409433

‎lib/ssl/src/tls_client_connection.erl‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,10 @@ hello(internal, #server_hello{} = Hello,
331331
catch throw:#alert{} = Alert ->
332332
ssl_gen_statem:handle_own_alert(Alert, ?STATE(hello), State)
333333
end;
334+
hello(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
335+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
336+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
337+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(hello), State);
334338
hello(info, Event, State) ->
335339
tls_gen_connection:gen_info(Event, ?STATE(hello), State);
336340
hello(Type, Event, State) ->
@@ -347,6 +351,10 @@ user_hello(Type, Event, State) ->
347351
-spec abbreviated(gen_statem:event_type(), term(), #state{}) ->
348352
gen_statem:state_function_result().
349353
%%--------------------------------------------------------------------
354+
abbreviated(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
355+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
356+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
357+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(abbreviated), State);
350358
abbreviated(info, Event, State) ->
351359
tls_gen_connection:gen_info(Event, ?STATE(abbreviated), State);
352360
abbreviated(Type, Event, State) ->
@@ -356,6 +364,10 @@ abbreviated(Type, Event, State) ->
356364
-spec wait_stapling(gen_statem:event_type(), term(), #state{}) ->
357365
gen_statem:state_function_result().
358366
%%--------------------------------------------------------------------
367+
wait_stapling(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
368+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
369+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
370+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(wait_stapling), State);
359371
wait_stapling(info, Event, State) ->
360372
tls_gen_connection:gen_info(Event, ?STATE(wait_stapling), State);
361373
wait_stapling(Type, Event, State) ->
@@ -365,6 +377,10 @@ wait_stapling(Type, Event, State) ->
365377
-spec certify(gen_statem:event_type(), term(), #state{}) ->
366378
gen_statem:state_function_result().
367379
%%--------------------------------------------------------------------
380+
certify(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
381+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
382+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
383+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(certify), State);
368384
certify(info, Event, State) ->
369385
tls_gen_connection:gen_info(Event, ?STATE(certify), State);
370386
certify(Type, Event, State) ->
@@ -374,6 +390,10 @@ certify(Type, Event, State) ->
374390
-spec cipher(gen_statem:event_type(), term(), #state{}) ->
375391
gen_statem:state_function_result().
376392
%%--------------------------------------------------------------------
393+
cipher(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
394+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
395+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
396+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(cipher), State);
377397
cipher(info, Event, State) ->
378398
tls_gen_connection:gen_info(Event, ?STATE(cipher), State);
379399
cipher(Type, Event, State) ->

‎lib/ssl/src/tls_client_connection_1_3.erl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,9 @@ start(internal, #server_hello{}, State0) ->
252252
%%so it is a previous version hello.
253253
ssl_gen_statem:handle_own_alert(
254254
?ALERT_REC(?FATAL, ?PROTOCOL_VERSION), ?STATE(start), State0);
255+
start(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}}, State) ->
256+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
257+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(start), State);
255258
start(info, Msg, State) ->
256259
tls_gen_connection:gen_info(Msg, ?STATE(start), State);
257260
start(Type, Msg, State) ->
@@ -304,6 +307,9 @@ wait_sh(internal, #server_hello{} = Hello,
304307
tls_gen_connection:next_event(hello_middlebox_assert,
305308
no_record, State1)
306309
end;
310+
wait_sh(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}}, State) ->
311+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
312+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(wait_sh), State);
307313
wait_sh(info, Msg, State) ->
308314
tls_gen_connection:gen_info(Msg, ?STATE(wait_sh), State);
309315
wait_sh(Type, Msg, State) ->

‎lib/ssl/src/tls_gen_connection.erl‎

Lines changed: 1 addition & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -401,37 +401,7 @@ next_event(StateName, #ssl_tls{} = Record, State, Actions) ->
401401
next_event(StateName, #alert{} = Alert, State, Actions) ->
402402
{next_state, StateName, State, [{next_event, internal, Alert} | Actions]}.
403403

404-
%%% TLS record protocol level application data messages
405-
handle_protocol_record(#ssl_tls{type = ?APPLICATION_DATA}, StateName,
406-
#state{static_env = #static_env{role = server},
407-
handshake_env = #handshake_env{renegotiation = {false, first}}
408-
} = State) when StateName == initial_hello;
409-
StateName == hello;
410-
StateName == certify;
411-
StateName == wait_cert_verify;
412-
StateName == wait_stapling;
413-
StateName == abbreviated;
414-
StateName == cipher
415-
->
416-
%% Application data can not be sent before initial handshake pre TLS-1.3.
417-
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
418-
ssl_gen_statem:handle_own_alert(Alert, StateName, State);
419-
handle_protocol_record(#ssl_tls{type = ?APPLICATION_DATA, early_data = false}, StateName,
420-
#state{static_env = #static_env{role = server}
421-
} = State) when StateName == start;
422-
StateName == recvd_ch;
423-
StateName == negotiated;
424-
StateName == wait_eoed ->
425-
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, none_early_application_data_before_handshake),
426-
ssl_gen_statem:handle_own_alert(Alert, StateName, State);
427-
handle_protocol_record(#ssl_tls{type = ?APPLICATION_DATA}, StateName,
428-
#state{static_env = #static_env{role = server}
429-
} = State) when StateName == wait_cert;
430-
StateName == wait_cv;
431-
StateName == wait_finished->
432-
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE,
433-
application_data_before_handshake_or_intervened_in_post_handshake_auth),
434-
ssl_gen_statem:handle_own_alert(Alert, StateName, State);
404+
%%% TLS record protocol level application data messages
435405
handle_protocol_record(#ssl_tls{type = ?APPLICATION_DATA, fragment = Data}, StateName,
436406
#state{recv = #recv{from = From},
437407
socket_options = #socket_options{active = false}} = State0)

‎lib/ssl/src/tls_server_connection.erl‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,10 @@ initial_hello({call, From}, {start, {Opts, EmOpts}, Timeout},
198198
catch throw:Error ->
199199
{stop_and_reply, {shutdown, normal}, {reply, From, {error, Error}}, State0}
200200
end;
201+
initial_hello(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
202+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
203+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
204+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(initial_hello), State);
201205
initial_hello(Type, Event, State) ->
202206
tls_dtls_server_connection:initial_hello(Type, Event, State).
203207

@@ -241,6 +245,10 @@ hello(internal, #client_hello{client_version = ClientVersion} = Hello,
241245
State0#state{connection_env = NewCenv},
242246
ssl_gen_statem:handle_own_alert(Alert, ?STATE(hello), AlertState)
243247
end;
248+
hello(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
249+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
250+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
251+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(hello), State);
244252
hello(info, Event, State) ->
245253
tls_gen_connection:gen_info(Event, ?STATE(hello), State);
246254
hello(Type, Event, State) ->
@@ -259,6 +267,10 @@ user_hello(Type, Event, State) ->
259267
%%--------------------------------------------------------------------
260268
abbreviated(info, Event, State) ->
261269
tls_gen_connection:gen_info(Event, ?STATE(abbreviated), State);
270+
abbreviated(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
271+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
272+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
273+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(abbreviated), State);
262274
abbreviated(Type, Event, State) ->
263275
gen_state(?STATE(abbreviated), Type, Event, State).
264276

@@ -268,6 +280,10 @@ abbreviated(Type, Event, State) ->
268280
%%--------------------------------------------------------------------
269281
certify(info, Event, State) ->
270282
tls_gen_connection:gen_info(Event, ?STATE(certify), State);
283+
certify(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
284+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
285+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
286+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(certify), State);
271287
certify(Type, Event, State) ->
272288
gen_state(?STATE(certify), Type, Event, State).
273289

@@ -302,6 +318,10 @@ wait_cert_verify(internal, #certificate_verify{signature = Signature,
302318
#alert{} = Alert ->
303319
ssl_gen_statem:handle_own_alert(Alert, ?STATE(wait_cert_verify), State)
304320
end;
321+
wait_cert_verify(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
322+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
323+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
324+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(wait_cert_verify), State);
305325
wait_cert_verify(Type, Event, State) ->
306326
ssl_gen_statem:handle_common_event(Type, Event, ?STATE(wait_cert_verify), State).
307327

@@ -311,6 +331,10 @@ wait_cert_verify(Type, Event, State) ->
311331
%%--------------------------------------------------------------------
312332
cipher(info, Event, State) ->
313333
tls_gen_connection:gen_info(Event, ?STATE(cipher), State);
334+
cipher(internal, {protocol_record, #ssl_tls{type = ?APPLICATION_DATA}},
335+
#state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) ->
336+
Alert = ?ALERT_REC(?FATAL, ?UNEXPECTED_MESSAGE, application_data_before_initial_handshake),
337+
ssl_gen_statem:handle_own_alert(Alert, ?STATE(cipher), State);
314338
cipher(Type, Event, State) ->
315339
gen_state(?STATE(cipher), Type, Event, State).
316340

0 commit comments

Comments
 (0)