/*

 * Copyright (C) 2000-2018 Free Software Foundation, Inc.

 * Copyright (C) 2012-2018 Nikos Mavrogiannopoulos

 * Copyright (C) 2018 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

/* Functions that are record layer specific, are included in this file.

 */

/* allocate this many bytes more when encrypting or decrypting, to

 * compensate for broken backends such as cryptodev.

 */

#define CIPHER_SLACK_SIZE 32

#include "gnutls_int.h"

#include "errors.h"

#include "debug.h"

#include "cipher.h"

#include "buffers.h"

#include "mbuffers.h"

#include "handshake.h"

#include "hash_int.h"

#include "cipher_int.h"

#include "algorithms.h"

#include "db.h"

#include "auth.h"

#include "num.h"

#include "record.h"

#include "datum.h"

#include "constate.h"

#include "tls13/key_update.h"

#include <ext/heartbeat.h>

#include <state.h>

#include <dtls.h>

#include <dh.h>

#include <random.h>

#include <xsize.h>

#include "locks.h"

struct tls_record_st {

	uint16_t header_size;

	uint8_t version[2];

	uint64_t sequence;	/* DTLS */

	uint16_t length;

	uint16_t packet_size;	/* header_size + length */

	content_type_t type;

	uint16_t epoch;		/* valid in DTLS only */

#ifdef ENABLE_SSL2

	unsigned v2:1;		/* whether an SSLv2 client hello */

#endif

	/* the data */

};

/**

 * gnutls_record_disable_padding:

 * @session: is a #gnutls_session_t type.

 *

 * Used to disabled padding in TLS 1.0 and above.  Normally you do not

 * need to use this function, but there are buggy clients that

 * complain if a server pads the encrypted data.  This of course will

 * disable protection against statistical attacks on the data.

 *

 * This function is defunct since 3.1.7. Random padding is disabled

 * by default unless requested using gnutls_record_send_range().

 *

 **/

void gnutls_record_disable_padding(gnutls_session_t session)

{

	return;

}

/**

 * gnutls_transport_set_ptr:

 * @session: is a #gnutls_session_t type.

 * @ptr: is the value.

 *

 * Used to set the first argument of the transport function (for push

 * and pull callbacks). In berkeley style sockets this function will set the

 * connection descriptor.

 *

 **/

void

gnutls_transport_set_ptr(gnutls_session_t session,

			 gnutls_transport_ptr_t ptr)

{

	session->internals.transport_recv_ptr = ptr;

	session->internals.transport_send_ptr = ptr;

}

/**

 * gnutls_transport_set_ptr2:

 * @session: is a #gnutls_session_t type.

 * @recv_ptr: is the value for the pull function

 * @send_ptr: is the value for the push function

 *

 * Used to set the first argument of the transport function (for push

 * and pull callbacks). In berkeley style sockets this function will set the

 * connection descriptor.  With this function you can use two different

 * pointers for receiving and sending.

 **/

void

gnutls_transport_set_ptr2(gnutls_session_t session,

			  gnutls_transport_ptr_t recv_ptr,

			  gnutls_transport_ptr_t send_ptr)

{

	session->internals.transport_send_ptr = send_ptr;

	session->internals.transport_recv_ptr = recv_ptr;

}

/**

 * gnutls_transport_set_int2:

 * @session: is a #gnutls_session_t type.

 * @recv_fd: is socket descriptor for the pull function

 * @send_fd: is socket descriptor for the push function

 *

 * This function sets the first argument of the transport functions,

 * such as send() and recv() for the default callbacks using the

 * system's socket API. With this function you can set two different

 * descriptors for receiving and sending.

 *

 * This function is equivalent to calling gnutls_transport_set_ptr2()

 * with the descriptors, but requires no casts.

 *

 * Since: 3.1.9

 **/

void

gnutls_transport_set_int2(gnutls_session_t session,

			  int recv_fd, int send_fd)

{

	session->internals.transport_send_ptr =

	    (gnutls_transport_ptr_t) (long) send_fd;

	session->internals.transport_recv_ptr =

	    (gnutls_transport_ptr_t) (long) recv_fd;

}

#if 0

/* this will be a macro */

/**

 * gnutls_transport_set_int:

 * @session: is a #gnutls_session_t type.

 * @fd: is the socket descriptor for the connection.

 *

 * This function sets the first argument of the transport function, such

 * as send() and recv() for the default callbacks using the

 * system's socket API.

 *

 * This function is equivalent to calling gnutls_transport_set_ptr()

 * with the descriptor, but requires no casts.

 *

 * Since: 3.1.9

 *

 **/

void gnutls_transport_set_int(gnutls_session_t session, int fd)

{

	session->internals.transport_recv_ptr =

	    (gnutls_transport_ptr_t) (long) fd;

	session->internals.transport_send_ptr =

	    (gnutls_transport_ptr_t) (long) fd;

}

#endif

/**

 * gnutls_transport_get_ptr:

 * @session: is a #gnutls_session_t type.

 *

 * Used to get the first argument of the transport function (like

 * PUSH and PULL).  This must have been set using

 * gnutls_transport_set_ptr().

 *

 * Returns: The first argument of the transport function.

 **/

gnutls_transport_ptr_t gnutls_transport_get_ptr(gnutls_session_t session)

{

	return session->internals.transport_recv_ptr;

}

/**

 * gnutls_transport_get_ptr2:

 * @session: is a #gnutls_session_t type.

 * @recv_ptr: will hold the value for the pull function

 * @send_ptr: will hold the value for the push function

 *

 * Used to get the arguments of the transport functions (like PUSH

 * and PULL).  These should have been set using

 * gnutls_transport_set_ptr2().

 **/

void

gnutls_transport_get_ptr2(gnutls_session_t session,

			  gnutls_transport_ptr_t * recv_ptr,

			  gnutls_transport_ptr_t * send_ptr)

{

	*recv_ptr = session->internals.transport_recv_ptr;

	*send_ptr = session->internals.transport_send_ptr;

}

/**

 * gnutls_transport_get_int2:

 * @session: is a #gnutls_session_t type.

 * @recv_int: will hold the value for the pull function

 * @send_int: will hold the value for the push function

 *

 * Used to get the arguments of the transport functions (like PUSH

 * and PULL).  These should have been set using

 * gnutls_transport_set_int2().

 *

 * Since: 3.1.9

 **/

void

gnutls_transport_get_int2(gnutls_session_t session,

			  int *recv_int, int *send_int)

{

	*recv_int = (long) session->internals.transport_recv_ptr;

	*send_int = (long) session->internals.transport_send_ptr;

}

/**

 * gnutls_transport_get_int:

 * @session: is a #gnutls_session_t type.

 *

 * Used to get the first argument of the transport function (like

 * PUSH and PULL).  This must have been set using

 * gnutls_transport_set_int().

 *

 * Returns: The first argument of the transport function.

 *

 * Since: 3.1.9

 **/

int gnutls_transport_get_int(gnutls_session_t session)

{

	return (long) session->internals.transport_recv_ptr;

}

/**

 * gnutls_bye:

 * @session: is a #gnutls_session_t type.

 * @how: is an integer

 *

 * Terminates the current TLS/SSL connection. The connection should

 * have been initiated using gnutls_handshake().  @how should be one

 * of %GNUTLS_SHUT_RDWR, %GNUTLS_SHUT_WR.

 *

 * In case of %GNUTLS_SHUT_RDWR the TLS session gets

 * terminated and further receives and sends will be disallowed.  If

 * the return value is zero you may continue using the underlying

 * transport layer. %GNUTLS_SHUT_RDWR sends an alert containing a close

 * request and waits for the peer to reply with the same message.

 *

 * In case of %GNUTLS_SHUT_WR the TLS session gets terminated

 * and further sends will be disallowed. In order to reuse the

 * connection you should wait for an EOF from the peer.

 * %GNUTLS_SHUT_WR sends an alert containing a close request.

 *

 * Note that not all implementations will properly terminate a TLS

 * connection.  Some of them, usually for performance reasons, will

 * terminate only the underlying transport layer, and thus not

 * distinguishing between a malicious party prematurely terminating

 * the connection and normal termination.

 *

 * This function may also return %GNUTLS_E_AGAIN or

 * %GNUTLS_E_INTERRUPTED; cf.  gnutls_record_get_direction().

 *

 * Returns: %GNUTLS_E_SUCCESS on success, or an error code, see

 *   function documentation for entire semantics.

 **/

int gnutls_bye(gnutls_session_t session, gnutls_close_request_t how)

{

	int ret = 0;

	switch (BYE_STATE) {

	case BYE_STATE0:

		ret = _gnutls_io_write_flush(session);

		BYE_STATE = BYE_STATE0;

		if (ret < 0) {

			gnutls_assert();

			return ret;

		}

		FALLTHROUGH;

	case BYE_STATE1:

		ret =

		    gnutls_alert_send(session, GNUTLS_AL_WARNING,

				      GNUTLS_A_CLOSE_NOTIFY);

		BYE_STATE = BYE_STATE1;

		if (ret < 0) {

			gnutls_assert();

			return ret;

		}

		FALLTHROUGH;

	case BYE_STATE2:

		BYE_STATE = BYE_STATE2;

		if (how == GNUTLS_SHUT_RDWR) {

			do {

				ret =

				    _gnutls_recv_int(session, GNUTLS_ALERT,

						     NULL, 0, NULL,

						     session->internals.

						     record_timeout_ms);

			}

			while (ret == GNUTLS_E_GOT_APPLICATION_DATA);

			if (ret >= 0)

				session->internals.may_not_read = 1;

			if (ret < 0) {

				gnutls_assert();

				return ret;

			}

		}

		BYE_STATE = BYE_STATE2;

		break;

	default:

		gnutls_assert();

		return GNUTLS_E_INTERNAL_ERROR;

	}

	BYE_STATE = BYE_STATE0;

	session->internals.may_not_write = 1;

	return 0;

}

inline static void session_unresumable(gnutls_session_t session)

{

	session->internals.resumable = RESUME_FALSE;

}

/* returns 0 if session is valid

 */

inline static int session_is_valid(gnutls_session_t session)

{

	if (session->internals.invalid_connection != 0)

		return GNUTLS_E_INVALID_SESSION;

	return 0;

}

/* Copies the record version into the headers. The

 * version must have 2 bytes at least.

 */

inline static int

copy_record_version(gnutls_session_t session,

		    gnutls_handshake_description_t htype,

		    uint8_t version[2])

{

	const version_entry_st *lver;

	lver = get_version(session);

	if (session->internals.initial_negotiation_completed ||

	    htype != GNUTLS_HANDSHAKE_CLIENT_HELLO ||

	    session->internals.default_record_version[0] == 0) {

		if (unlikely(lver == NULL))

			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		if (lver->tls13_sem) {

			version[0] = 0x03;

			version[1] = 0x03;

		} else {

			version[0] = lver->major;

			version[1] = lver->minor;

		}

	} else {

		version[0] = session->internals.default_record_version[0];

		version[1] = session->internals.default_record_version[1];

	}

	return 0;

}

/* Increments the sequence value

 */

inline static int

sequence_increment(gnutls_session_t session, uint64_t * value)

{

	uint64_t snmax = UINT64_C(0xffffffffffffffff);

	if (IS_DTLS(session)) {

		uint64_t mask;

		snmax = UINT64_C(0xffffffffffff);

		mask = snmax;

		if ((*value & mask) == snmax)

			return -1;

		*value = ((*value & mask) + 1) | (*value & ~mask);

	} else {

		if (*value == snmax)

			return -1;

		(*value)++;

	}

	return 0;

}

/* This function behaves exactly like write(). The only difference is

 * that it accepts, the gnutls_session_t and the content_type_t of data to

 * send (if called by the user the Content is specific)

 * It is intended to transfer data, under the current session.

 *

 * @type: The content type to send

 * @htype: If this is a handshake message then the handshake type

 * @epoch_rel: %EPOCH_READ_* or %EPOCH_WRITE_*

 * @data: the data to be sent

 * @data_size: the size of the @data

 * @min_pad: the minimum required padding

 * @mflags: zero or %MBUFFER_FLUSH

 *

 * Oct 30 2001: Removed capability to send data more than MAX_RECORD_SIZE.

 * This makes the function much easier to read, and more error resistant

 * (there were cases were the old function could mess everything up).

 * --nmav

 *

 * This function may accept a NULL pointer for data, and 0 for size, if

 * and only if the previous send was interrupted for some reason.

 *

 */

ssize_t

_gnutls_send_tlen_int(gnutls_session_t session, content_type_t type,

		      gnutls_handshake_description_t htype,

		      unsigned int epoch_rel, const void *_data,

		      size_t data_size, size_t min_pad,

		      unsigned int mflags)

{

	mbuffer_st *bufel;

	ssize_t cipher_size;

	int retval, ret;

	int send_data_size;

	uint8_t *headers;

	int header_size;

	const uint8_t *data = _data;

	record_parameters_st *record_params;

	size_t max_send_size;

	record_state_st *record_state;

	const version_entry_st *vers = get_version(session);

	ret = _gnutls_epoch_get(session, epoch_rel, &record_params);

	if (ret < 0)

		return gnutls_assert_val(ret);

	/* Safeguard against processing data with an incomplete cipher state. */

	if (!record_params->initialized)

		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	record_state = &record_params->write;

	/* Do not allow null pointer if the send buffer is empty.

	 * If the previous send was interrupted then a null pointer is

	 * ok, and means to resume.

	 */

	if (session->internals.record_send_buffer.byte_length == 0 &&

	    (data_size == 0 && _data == NULL)) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	if (type != GNUTLS_ALERT)	/* alert messages are sent anyway */

		if (session_is_valid(session)

		    || session->internals.may_not_write != 0) {

			gnutls_assert();

			return GNUTLS_E_INVALID_SESSION;

		}

	max_send_size = max_record_send_size(session, record_params);

	if (data_size > max_send_size) {

		if (IS_DTLS(session))

			return gnutls_assert_val(GNUTLS_E_LARGE_PACKET);

		send_data_size = max_send_size;

	} else

		send_data_size = data_size;

	/* Only encrypt if we don't have data to send

	 * from the previous run. - probably interrupted.

	 */

	if (mflags != 0

	    && session->internals.record_send_buffer.byte_length > 0) {

		ret = _gnutls_io_write_flush(session);

		if (ret > 0)

			cipher_size = ret;

		else

			cipher_size = 0;

		retval = session->internals.record_send_buffer_user_size;

	} else {

		if (unlikely((send_data_size == 0 && min_pad == 0)))

			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

		/* now proceed to packet encryption

		 */

		cipher_size = MAX_RECORD_SEND_SIZE(session);

		bufel = _mbuffer_alloc_align16(cipher_size + CIPHER_SLACK_SIZE,

			get_total_headers2(session, record_params));

		if (bufel == NULL)

			return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);

		headers = _mbuffer_get_uhead_ptr(bufel);

		if (vers->tls13_sem && record_params->cipher->id != GNUTLS_CIPHER_NULL)

			headers[0] = GNUTLS_APPLICATION_DATA;

		else

			headers[0] = type;

		/* Use the default record version, if it is

		 * set. */

		ret = copy_record_version(session, htype, &headers[1]);

		if (ret < 0)

			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		/* Adjust header length and add sequence for DTLS */

		if (IS_DTLS(session))

			_gnutls_write_uint64(record_state->sequence_number, &headers[3]);

		_gnutls_record_log

		    ("REC[%p]: Preparing Packet %s(%d) with length: %d and min pad: %d\n",

		     session, _gnutls_packet2str(type), type,

		     (int) data_size, (int) min_pad);

		header_size = RECORD_HEADER_SIZE(session);

		_mbuffer_set_udata_size(bufel, cipher_size);

		_mbuffer_set_uhead_size(bufel, header_size);

		ret =

		    _gnutls_encrypt(session,

				    data, send_data_size, min_pad,

				    bufel, type, record_params);

		if (ret <= 0) {

			gnutls_assert();

			if (ret == 0)

				ret = GNUTLS_E_ENCRYPTION_FAILED;

			gnutls_free(bufel);

			return ret;	/* error */

		}

		cipher_size = _mbuffer_get_udata_size(bufel);

		retval = send_data_size;

		session->internals.record_send_buffer_user_size =

		    send_data_size;

		/* increase sequence number

		 */

		if (sequence_increment

		    (session, &record_state->sequence_number) != 0) {

			session_invalidate(session);

			gnutls_free(bufel);

			return

			    gnutls_assert_val

			    (GNUTLS_E_RECORD_LIMIT_REACHED);

		}

		ret = _gnutls_io_write_buffered(session, bufel, mflags);

	}

	if (ret != cipher_size) {

		/* If we have sent any data then just return

		 * the error value. Do not invalidate the session.

		 */

		if (ret < 0 && gnutls_error_is_fatal(ret) == 0)

			return gnutls_assert_val(ret);

		if (ret > 0)

			ret = gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		session_unresumable(session);

		session->internals.may_not_write = 1;

		return gnutls_assert_val(ret);

	}

	session->internals.record_send_buffer_user_size = 0;

	_gnutls_record_log

	    ("REC[%p]: Sent Packet[%ld] %s(%d) in epoch %d and length: %d\n",

	     session, (unsigned long)(record_state->sequence_number),

	     _gnutls_packet2str(type), type, (int) record_params->epoch,

	     (int) cipher_size);

	if (vers->tls13_sem && !(session->internals.flags & GNUTLS_NO_AUTO_REKEY) &&

	    !(record_params->cipher->flags & GNUTLS_CIPHER_FLAG_NO_REKEY)) {

		if (unlikely((record_state->sequence_number & UINT64_C(0xffffff)) == UINT64_C(0xfffffd))) {

			/* After we have sent 2^24 messages, mark the session

			 * as needing a key update. */

			session->internals.rsend_state = RECORD_SEND_KEY_UPDATE_1;

		}

	}

	return retval;

}

inline static int

check_recv_type(gnutls_session_t session, content_type_t recv_type)

{

	switch (recv_type) {

	case GNUTLS_CHANGE_CIPHER_SPEC:

	case GNUTLS_ALERT:

	case GNUTLS_HANDSHAKE:

	case GNUTLS_HEARTBEAT:

	case GNUTLS_APPLICATION_DATA:

		return 0;

	default:

		gnutls_assert();

		_gnutls_audit_log(session,

				  "Received record packet of unknown type %u\n",

				  (unsigned int) recv_type);

		return GNUTLS_E_UNEXPECTED_PACKET;

	}

}

/* Checks if there are pending data in the record buffers. If there are

 * then it copies the data.

 */

static int

get_data_from_buffers(gnutls_session_t session, content_type_t type,

	      uint8_t * data, int data_size, void *seq)

{

	if ((type == GNUTLS_APPLICATION_DATA ||

	     type == GNUTLS_HANDSHAKE || type == GNUTLS_CHANGE_CIPHER_SPEC)

	    && _gnutls_record_buffer_get_size(session) > 0) {

		int ret;

		ret =

		    _gnutls_record_buffer_get(type, session, data,

					      data_size, seq);

		if (ret < 0) {

			if (IS_DTLS(session)) {

				if (ret == GNUTLS_E_UNEXPECTED_PACKET) {

					ret = GNUTLS_E_AGAIN;

				}

			}

			gnutls_assert();

			return ret;

		}

		return ret;

	}

	return 0;

}

/* Checks and retrieves any pending data in the application data record buffers.

 */

static int

get_packet_from_buffers(gnutls_session_t session, content_type_t type,

		     gnutls_packet_t *packet)

{

	if (_gnutls_record_buffer_get_size(session) > 0) {

		int ret;

		ret =

			_gnutls_record_buffer_get_packet(type, session, packet);

		if (ret < 0) {

			if (IS_DTLS(session)) {

				if (ret == GNUTLS_E_UNEXPECTED_PACKET) {

					ret = GNUTLS_E_AGAIN;

				}

			}

			gnutls_assert();

			return ret;

		}

		return ret;

	}

	*packet = NULL;

	return 0;

}

/* Here we check if the advertized version is the one we

 * negotiated in the handshake.

 */

inline static int

record_check_version(gnutls_session_t session,

		     gnutls_handshake_description_t htype,

		     uint8_t version[2])

{

	const version_entry_st *vers = get_version(session);

	int diff = 0;

	if (vers->tls13_sem) {

		/* TLS 1.3 requires version to be 0x0303 */

		if (version[0] != 0x03 || version[1] != 0x03)

			diff = 1;

	} else {

		if (vers->major != version[0] || vers->minor != version[1])

			diff = 1;

	}

	if (!IS_DTLS(session)) {

		if (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO ||

		    htype == GNUTLS_HANDSHAKE_HELLO_RETRY_REQUEST ||

		    htype == GNUTLS_HANDSHAKE_SERVER_HELLO) {

			if (version[0] != 3) {

				gnutls_assert();

				_gnutls_record_log

				    ("REC[%p]: INVALID VERSION PACKET: (%d) %d.%d\n",

				     session, htype, version[0],

				     version[1]);

				return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;

			}

		} else if (diff != 0) {

			/* Reject record packets that have a different version than the

			 * one negotiated. Note that this version is not protected by any

			 * mac. I don't really think that this check serves any purpose.

			 */

			gnutls_assert();

			_gnutls_record_log

			    ("REC[%p]: INVALID VERSION PACKET: (%d) %d.%d\n",

			     session, htype, version[0], version[1]);

			return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;

		}

	} else {		/* DTLS */

		/* In DTLS the only information we have here is whether we

		 * expect a handshake message or not.

		 */

		if (htype == (gnutls_handshake_description_t) - 1) {

			if (diff) {

				/* Reject record packets that have a different version than the

				 * one negotiated. Note that this version is not protected by any

				 * mac. I don't really think that this check serves any purpose.

				 */

				gnutls_assert();

				_gnutls_record_log

				    ("REC[%p]: INVALID VERSION PACKET: (%d) %d.%d\n",

				     session, htype, version[0],

				     version[1]);

				return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;

			}

		} else if (vers->id > GNUTLS_DTLS1_0 && version[0] > 254) {

			gnutls_assert();

			_gnutls_record_log

			    ("REC[%p]: INVALID DTLS VERSION PACKET: (%d) %d.%d\n",

			     session, htype, version[0], version[1]);

			return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;

		} else if (vers->id == GNUTLS_DTLS0_9 && version[0] > 1) {

			gnutls_assert();

			_gnutls_record_log

			    ("REC[%p]: INVALID DTLS VERSION PACKET: (%d) %d.%d\n",

			     session, htype, version[0], version[1]);

			return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;

		}

	}

	return 0;

}

static int

recv_hello_request(gnutls_session_t session, void *data,

		   uint32_t data_size)

{

	uint8_t type;

	if (session->security_parameters.entity == GNUTLS_SERVER)

		return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET);

	if (data_size < 1)

		return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

	if (session->internals.handshake_in_progress)

		return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET);

	type = ((uint8_t *) data)[0];

	if (type == GNUTLS_HANDSHAKE_HELLO_REQUEST) {

		if (IS_DTLS(session))

			session->internals.dtls.hsk_read_seq++;

		if (session->internals.flags & GNUTLS_AUTO_REAUTH) {

			session->internals.recv_state = RECV_STATE_REHANDSHAKE;

			return GNUTLS_E_AGAIN;

		} else {

			return GNUTLS_E_REHANDSHAKE;

		}

	} else {

		gnutls_assert();

		return GNUTLS_E_UNEXPECTED_PACKET;

	}

}

/* This function will check if the received record type is

 * the one we actually expect and adds it to the proper

 * buffer. The bufel will be deinitialized after calling

 * this function, even if it fails.

 */

static int

record_add_to_buffers(gnutls_session_t session,

		      struct tls_record_st *recv, content_type_t type,

		      gnutls_handshake_description_t htype,

		      uint64_t seq, mbuffer_st * bufel)

{

	int ret;

	const version_entry_st *ver = get_version(session);

	if ((recv->type == type)

	    && (type == GNUTLS_APPLICATION_DATA ||

		type == GNUTLS_CHANGE_CIPHER_SPEC ||

		type == GNUTLS_HANDSHAKE)) {

		if (bufel->msg.size == 0) {

			if (type == GNUTLS_APPLICATION_DATA) {

				/* this is needed to distinguish an empty

				 * message and EOF */

				ret = GNUTLS_E_AGAIN;

				goto cleanup;

			} else {

				ret =

				    gnutls_assert_val

				    (GNUTLS_E_UNEXPECTED_PACKET);

				goto unexpected_packet;

			}

		}

		/* application data cannot be inserted between (async) handshake

		 * messages */

		if (type == GNUTLS_APPLICATION_DATA &&

		    (session->internals.handshake_recv_buffer_size != 0 ||

		     session->internals.handshake_header_recv_buffer.length != 0)) {

			ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET);

			goto unexpected_packet;

		}

		_gnutls_record_buffer_put(session, type, seq, bufel);

		/* if we received application data as expected then we

		 * deactivate the async timer */

		_dtls_async_timer_delete(session);

	} else {

		/* if the expected type is different than the received

		 */

		switch (recv->type) {

		case GNUTLS_ALERT:

			if (bufel->msg.size < 2) {

				ret =

				    gnutls_assert_val

				    (GNUTLS_E_UNEXPECTED_PACKET);

				goto unexpected_packet;

			}

			_gnutls_record_log

			    ("REC[%p]: Alert[%d|%d] - %s - was received\n",

			     session, bufel->msg.data[0],

			     bufel->msg.data[1],

			     gnutls_alert_get_name((int) bufel->msg.

						   data[1]));

			if (!session->internals.initial_negotiation_completed &&

			    session->internals.handshake_in_progress && STATE == STATE0) { /* handshake hasn't started */

				ret = gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET);

				goto unexpected_packet;

			}

			session->internals.last_alert = bufel->msg.data[1];

			/* if close notify is received and

			 * the alert is not fatal

			 */

			if (bufel->msg.data[1] == GNUTLS_A_CLOSE_NOTIFY