FreeRTOS-Plus/ThirdParty/WolfSSL-FIPS-Ready/src/sniffer.c
/* Check Status before record processing */
/* returns 0 on success (continue), -1 on error, 1 on success (end) */
Check Status before record processing
returns 0 on success (continue), -1 on error, 1 on success (end)
Check Status before record processing returns 0 on success ( continue ) - 1 on error 1 on success ( end )
static int CheckPreRecord(IpInfo* ipInfo, TcpInfo* tcpInfo,
                          const byte** sslFrame, SnifferSession** session,
                          int* sslBytes, const byte** end,
                          void* vChain, word32 chainSz, char* error)
{
    word32 length;
    WOLFSSL* ssl = ((*session)->flags.side == WOLFSSL_SERVER_END) ?
                                  (*session)->sslServer : (*session)->sslClient;
    byte  skipPartial = ((*session)->flags.side == WOLFSSL_SERVER_END) ?
                        (*session)->flags.srvSkipPartial :
                        (*session)->flags.cliSkipPartial;
    if (tcpInfo->fin || tcpInfo->rst) {
        if (tcpInfo->fin)
            (*session)->flags.finCount += 1;
        else if (tcpInfo->rst)
            (*session)->flags.finCount += 2;
        if ((*session)->flags.finCount >= 2) {
            RemoveSession(*session, ipInfo, tcpInfo, 0);
            *session = NULL;
            return 1;
        }
    }
    if ((*session)->flags.fatalError == FATAL_ERROR_STATE) {
        SetError(FATAL_ERROR_STR, error, NULL, 0);
        return -1;
    }
    if (skipPartial) {
        if (FindNextRecordInAssembly(*session,
                                     sslFrame, sslBytes, end, error) < 0) {
            return -1;
        }
    }
    if (*sslBytes == 0) {
        Trace(NO_DATA_STR);
        return 1;
    }
    if ( !skipPartial && (length = ssl->buffers.inputBuffer.length) ) {
        Trace(PARTIAL_ADD_STR);
        if ( (*sslBytes + length) > ssl->buffers.inputBuffer.bufferSize) {
            if (GrowInputBuffer(ssl, *sslBytes, length) < 0) {
                SetError(MEMORY_STR, error, *session, FATAL_ERROR_STATE);
                return -1;
            }
        }
        if (vChain == NULL) {
            XMEMCPY(&ssl->buffers.inputBuffer.buffer[length],
                    *sslFrame, *sslBytes);
            *sslBytes += length;
            ssl->buffers.inputBuffer.length = *sslBytes;
            *sslFrame = ssl->buffers.inputBuffer.buffer;
            *end = *sslFrame + *sslBytes;
        }
    }
    if (vChain != NULL) {
#ifdef WOLFSSL_SNIFFER_CHAIN_INPUT
        struct iovec* chain = (struct iovec*)vChain;
        word32 i, offset, headerSz, qty, remainder;
        Trace(CHAIN_INPUT_STR);
        headerSz = (word32)*sslFrame - (word32)chain[0].iov_base;
        remainder = *sslBytes;
        if ( (*sslBytes + length) > ssl->buffers.inputBuffer.bufferSize) {
            if (GrowInputBuffer(ssl, *sslBytes, length) < 0) {
                SetError(MEMORY_STR, error, *session, FATAL_ERROR_STATE);
                return -1;
            }
        }
        qty = min(*sslBytes, (word32)chain[0].iov_len - headerSz);
        XMEMCPY(&ssl->buffers.inputBuffer.buffer[length],
               (byte*)chain[0].iov_base + headerSz, qty);
        offset = length;
        for (i = 1; i < chainSz; i++) {
            offset += qty;
            remainder -= qty;
            if (chain[i].iov_len > remainder)
                qty = remainder;
            else
                qty = (word32)chain[i].iov_len;
            XMEMCPY(ssl->buffers.inputBuffer.buffer + offset,
                    chain[i].iov_base, qty);
        }
        *sslBytes += length;
        ssl->buffers.inputBuffer.length = *sslBytes;
        *sslFrame = ssl->buffers.inputBuffer.buffer;
        *end = *sslFrame + *sslBytes;
#endif
        (void)chainSz;
    }
    if ((*session)->flags.clientHello == 0 && **sslFrame != handshake) {
        int rhSize = (((*sslFrame)[0] & 0x7f) << 8) | ((*sslFrame)[1]);
        if ((rhSize <= (*sslBytes - 2)) &&
            (*sslFrame)[2] == OLD_HELLO_ID && (*sslFrame)[3] == SSLv3_MAJOR) {
#ifdef OLD_HELLO_ALLOWED
        int ret = DoOldHello(*session, *sslFrame, &rhSize, sslBytes, error);
        if (ret < 0)
            return -1;  
        if (*sslBytes <= 0)
            return 1;
#endif
        }
        else {
#ifdef STARTTLS_ALLOWED
            if (ssl->buffers.inputBuffer.dynamicFlag) {
                ssl->buffers.inputBuffer.length = 0;
                ShrinkInputBuffer(ssl, NO_FORCED_FREE);
            }
            return 1;
#endif
        }
    }
    return 0;
}
static int CheckPreRecord ( IpInfo * ipInfo , TcpInfo * tcpInfo , const byte * * sslFrame , SnifferSession * * session , int * sslBytes , const byte * * end , void * vChain , word32 chainSz , char * error ) { word32 length ; WOLFSSL * ssl = ( ( * session ) -> flags . side == WOLFSSL_SERVER_END ) ? ( * session ) -> sslServer : ( * session ) -> sslClient ; byte skipPartial = ( ( * session ) -> flags . side == WOLFSSL_SERVER_END ) ? ( * session ) -> flags . srvSkipPartial : ( * session ) -> flags . cliSkipPartial ; if ( tcpInfo -> fin || tcpInfo -> rst ) { if ( tcpInfo -> fin ) ( * session ) -> flags . finCount += 1 ; else if ( tcpInfo -> rst ) ( * session ) -> flags . finCount += 2 ; if ( ( * session ) -> flags . finCount >= 2 ) { RemoveSession ( * session , ipInfo , tcpInfo , 0 ) ; * session = NULL ; return 1 ; } } if ( ( * session ) -> flags . fatalError == FATAL_ERROR_STATE ) { SetError ( FATAL_ERROR_STR , error , NULL , 0 ) ; return -1 ; } if ( skipPartial ) { if ( FindNextRecordInAssembly ( * session , sslFrame , sslBytes , end , error ) < 0 ) { return -1 ; } } if ( * sslBytes == 0 ) { Trace ( NO_DATA_STR ) ; return 1 ; } if ( ! skipPartial && ( length = ssl -> buffers . inputBuffer . length ) ) { Trace ( PARTIAL_ADD_STR ) ; if ( ( * sslBytes + length ) > ssl -> buffers . inputBuffer . bufferSize ) { if ( GrowInputBuffer ( ssl , * sslBytes , length ) < 0 ) { SetError ( MEMORY_STR , error , * session , FATAL_ERROR_STATE ) ; return -1 ; } } if ( vChain == NULL ) { XMEMCPY ( & ssl -> buffers . inputBuffer . buffer [ length ] , * sslFrame , * sslBytes ) ; * sslBytes += length ; ssl -> buffers . inputBuffer . length = * sslBytes ; * sslFrame = ssl -> buffers . inputBuffer . buffer ; * end = * sslFrame + * sslBytes ; } } if ( vChain != NULL ) { #ifdef WOLFSSL_SNIFFER_CHAIN_INPUT struct iovec * chain = ( struct iovec * ) vChain ; word32 i , offset , headerSz , qty , remainder ; Trace ( CHAIN_INPUT_STR ) ; headerSz = ( word32 ) * sslFrame - ( word32 ) chain [ 0 ] . iov_base ; remainder = * sslBytes ; if ( ( * sslBytes + length ) > ssl -> buffers . inputBuffer . bufferSize ) { if ( GrowInputBuffer ( ssl , * sslBytes , length ) < 0 ) { SetError ( MEMORY_STR , error , * session , FATAL_ERROR_STATE ) ; return -1 ; } } qty = min ( * sslBytes , ( word32 ) chain [ 0 ] . iov_len - headerSz ) ; XMEMCPY ( & ssl -> buffers . inputBuffer . buffer [ length ] , ( byte * ) chain [ 0 ] . iov_base + headerSz , qty ) ; offset = length ; for ( i = 1 ; i < chainSz ; i ++ ) { offset += qty ; remainder -= qty ; if ( chain [ i ] . iov_len > remainder ) qty = remainder ; else qty = ( word32 ) chain [ i ] . iov_len ; XMEMCPY ( ssl -> buffers . inputBuffer . buffer + offset , chain [ i ] . iov_base , qty ) ; } * sslBytes += length ; ssl -> buffers . inputBuffer . length = * sslBytes ; * sslFrame = ssl -> buffers . inputBuffer . buffer ; * end = * sslFrame + * sslBytes ; #endif ( void ) chainSz ; } if ( ( * session ) -> flags . clientHello == 0 && * * sslFrame != handshake ) { int rhSize = ( ( ( * sslFrame ) [ 0 ] & 0x7f ) << 8 ) | ( ( * sslFrame ) [ 1 ] ) ; if ( ( rhSize <= ( * sslBytes - 2 ) ) && ( * sslFrame ) [ 2 ] == OLD_HELLO_ID && ( * sslFrame ) [ 3 ] == SSLv3_MAJOR ) { #ifdef OLD_HELLO_ALLOWED int ret = DoOldHello ( * session , * sslFrame , & rhSize , sslBytes , error ) ; if ( ret < 0 ) return -1 ; if ( * sslBytes <= 0 ) return 1 ; #endif } else { #ifdef STARTTLS_ALLOWED if ( ssl -> buffers . inputBuffer . dynamicFlag ) { ssl -> buffers . inputBuffer . length = 0 ; ShrinkInputBuffer ( ssl , NO_FORCED_FREE ) ; } return 1 ; #endif } } return 0 ; }
Check Status before record processing
returns 0 on success (continue), -1 on error, 1 on success (end)
Check Status before record processing returns 0 on success ( continue ) - 1 on error 1 on success ( end )
/* remove SnifferSession on 2nd FIN or RST */ /* flag FIN and RST */ /* if current partial data, add to end of partial */ /* if skipping, the data is already at the end of partial */ /* Sanity check the packet for an old style client hello. */ /* error already set */