/*

 * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.

 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved

 * Copyright 2005 Nokia. All rights reserved.

 *

 * Licensed under the OpenSSL license (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

#include <stdio.h>

#include <time.h>

#include <assert.h>

#include "../ssl_local.h"

#include "statem_local.h"

#include <openssl/buffer.h>

#include <openssl/rand.h>

#include <openssl/objects.h>

#include <openssl/evp.h>

#include <openssl/md5.h>

#include <openssl/dh.h>

#include <openssl/bn.h>

#include <openssl/engine.h>

#include <internal/cryptlib.h>

static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *pkt);

static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt);

static ossl_inline int cert_req_allowed(SSL *s);

static int key_exchange_expected(SSL *s);

static int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk,

                                    WPACKET *pkt);

/*

 * Is a CertificateRequest message allowed at the moment or not?

 *

 *  Return values are:

 *  1: Yes

 *  0: No

 */

static ossl_inline int cert_req_allowed(SSL *s)

{

    /* TLS does not like anon-DH with client cert */

    if ((s->version > SSL3_VERSION

         && (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL))

        || (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aSRP | SSL_aPSK)))

        return 0;

    return 1;

}

/*

 * Should we expect the ServerKeyExchange message or not?

 *

 *  Return values are:

 *  1: Yes

 *  0: No

 */

static int key_exchange_expected(SSL *s)

{

    long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

    /*

     * Can't skip server key exchange if this is an ephemeral

     * ciphersuite or for SRP

     */

    if (alg_k & (SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK

                 | SSL_kSRP)) {

        return 1;

    }

    return 0;

}

/*

 * ossl_statem_client_read_transition() encapsulates the logic for the allowed

 * handshake state transitions when a TLS1.3 client is reading messages from the

 * server. The message type that the server has sent is provided in |mt|. The

 * current state is in |s->statem.hand_state|.

 *

 * Return values are 1 for success (transition allowed) and  0 on error

 * (transition not allowed)

 */

static int ossl_statem_client13_read_transition(SSL *s, int mt)

{

    OSSL_STATEM *st = &s->statem;

    /*

     * Note: There is no case for TLS_ST_CW_CLNT_HELLO, because we haven't

     * yet negotiated TLSv1.3 at that point so that is handled by

     * ossl_statem_client_read_transition()

     */

    switch (st->hand_state) {

    default:

        break;

    case TLS_ST_CW_CLNT_HELLO:

        /*

         * This must a ClientHello following a HelloRetryRequest, so the only

         * thing we can get now is a ServerHello.

         */

        if (mt == SSL3_MT_SERVER_HELLO) {

            st->hand_state = TLS_ST_CR_SRVR_HELLO;

            return 1;

        }

        break;

    case TLS_ST_CR_SRVR_HELLO:

        if (mt == SSL3_MT_ENCRYPTED_EXTENSIONS) {

            st->hand_state = TLS_ST_CR_ENCRYPTED_EXTENSIONS;

            return 1;

        }

        break;

    case TLS_ST_CR_ENCRYPTED_EXTENSIONS:

        if (s->hit) {

            if (mt == SSL3_MT_FINISHED) {

                st->hand_state = TLS_ST_CR_FINISHED;

                return 1;

            }

        } else {

            if (mt == SSL3_MT_CERTIFICATE_REQUEST) {

                st->hand_state = TLS_ST_CR_CERT_REQ;

                return 1;

            }

            if (mt == SSL3_MT_CERTIFICATE) {

                st->hand_state = TLS_ST_CR_CERT;

                return 1;

            }

        }

        break;

    case TLS_ST_CR_CERT_REQ:

        if (mt == SSL3_MT_CERTIFICATE) {

            st->hand_state = TLS_ST_CR_CERT;

            return 1;

        }

        break;

    case TLS_ST_CR_CERT:

        if (mt == SSL3_MT_CERTIFICATE_VERIFY) {

            st->hand_state = TLS_ST_CR_CERT_VRFY;

            return 1;

        }

        break;

    case TLS_ST_CR_CERT_VRFY:

        if (mt == SSL3_MT_FINISHED) {

            st->hand_state = TLS_ST_CR_FINISHED;

            return 1;

        }

        break;

    case TLS_ST_OK:

        if (mt == SSL3_MT_NEWSESSION_TICKET) {

            st->hand_state = TLS_ST_CR_SESSION_TICKET;

            return 1;

        }

        if (mt == SSL3_MT_KEY_UPDATE) {

            st->hand_state = TLS_ST_CR_KEY_UPDATE;

            return 1;

        }

        if (mt == SSL3_MT_CERTIFICATE_REQUEST) {

#if DTLS_MAX_VERSION != DTLS1_2_VERSION

# error TODO(DTLS1.3): Restore digest for PHA before adding message.

#endif

            if (!SSL_IS_DTLS(s) && s->post_handshake_auth == SSL_PHA_EXT_SENT) {

                s->post_handshake_auth = SSL_PHA_REQUESTED;

                /*

                 * In TLS, this is called before the message is added to the

                 * digest. In DTLS, this is expected to be called after adding

                 * to the digest. Either move the digest restore, or add the

                 * message here after the swap, or do it after the clientFinished?

                 */

                if (!tls13_restore_handshake_digest_for_pha(s)) {

                    /* SSLfatal() already called */

                    return 0;

                }

                st->hand_state = TLS_ST_CR_CERT_REQ;

                return 1;

            }

        }

        break;

    }

    /* No valid transition found */

    return 0;

}

/*

 * ossl_statem_client_read_transition() encapsulates the logic for the allowed

 * handshake state transitions when the client is reading messages from the

 * server. The message type that the server has sent is provided in |mt|. The

 * current state is in |s->statem.hand_state|.

 *

 * Return values are 1 for success (transition allowed) and  0 on error

 * (transition not allowed)

 */

int ossl_statem_client_read_transition(SSL *s, int mt)

{

    OSSL_STATEM *st = &s->statem;

    int ske_expected;

    /*

     * Note that after writing the first ClientHello we don't know what version

     * we are going to negotiate yet, so we don't take this branch until later.

     */

    if (SSL_IS_TLS13(s)) {

        if (!ossl_statem_client13_read_transition(s, mt))

            goto err;

        return 1;

    }

    switch (st->hand_state) {

    default:

        break;

    case TLS_ST_CW_CLNT_HELLO:

        if (mt == SSL3_MT_SERVER_HELLO) {

            st->hand_state = TLS_ST_CR_SRVR_HELLO;

            return 1;

        }

        if (SSL_IS_DTLS(s)) {

            if (mt == DTLS1_MT_HELLO_VERIFY_REQUEST) {

                st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST;

                return 1;

            }

        }

        break;

    case TLS_ST_EARLY_DATA:

        /*

         * We've not actually selected TLSv1.3 yet, but we have sent early

         * data. The only thing allowed now is a ServerHello or a

         * HelloRetryRequest.

         */

        if (mt == SSL3_MT_SERVER_HELLO) {

            st->hand_state = TLS_ST_CR_SRVR_HELLO;

            return 1;

        }

        break;

    case TLS_ST_CR_SRVR_HELLO:

        if (s->hit) {

            if (s->ext.ticket_expected) {

                if (mt == SSL3_MT_NEWSESSION_TICKET) {

                    st->hand_state = TLS_ST_CR_SESSION_TICKET;

                    return 1;

                }

            } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

                st->hand_state = TLS_ST_CR_CHANGE;

                return 1;

            }

        } else {

            if (SSL_IS_DTLS(s) && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) {

                st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST;

                return 1;

            } else if (s->version >= TLS1_VERSION

                       && s->ext.session_secret_cb != NULL

                       && s->session->ext.tick != NULL

                       && mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

                /*

                 * Normally, we can tell if the server is resuming the session

                 * from the session ID. EAP-FAST (RFC 4851), however, relies on

                 * the next server message after the ServerHello to determine if

                 * the server is resuming.

                 */

                s->hit = 1;

                st->hand_state = TLS_ST_CR_CHANGE;

                return 1;

            } else if (!(s->s3->tmp.new_cipher->algorithm_auth

                         & (SSL_aNULL | SSL_aSRP | SSL_aPSK))) {

                if (mt == SSL3_MT_CERTIFICATE) {

                    st->hand_state = TLS_ST_CR_CERT;

                    return 1;

                }

            } else {

                ske_expected = key_exchange_expected(s);

                /* SKE is optional for some PSK ciphersuites */

                if (ske_expected

                    || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)

                        && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) {

                    if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) {

                        st->hand_state = TLS_ST_CR_KEY_EXCH;

                        return 1;

                    }

                } else if (mt == SSL3_MT_CERTIFICATE_REQUEST

                           && cert_req_allowed(s)) {

                    st->hand_state = TLS_ST_CR_CERT_REQ;

                    return 1;

                } else if (mt == SSL3_MT_SERVER_DONE) {

                    st->hand_state = TLS_ST_CR_SRVR_DONE;

                    return 1;

                }

            }

        }

        break;

    case TLS_ST_CR_CERT:

        /*

         * The CertificateStatus message is optional even if

         * |ext.status_expected| is set

         */

        if (s->ext.status_expected && mt == SSL3_MT_CERTIFICATE_STATUS) {

            st->hand_state = TLS_ST_CR_CERT_STATUS;

            return 1;

        }

        /* Fall through */

    case TLS_ST_CR_CERT_STATUS:

        ske_expected = key_exchange_expected(s);

        /* SKE is optional for some PSK ciphersuites */

        if (ske_expected || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)

                             && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) {

            if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) {

                st->hand_state = TLS_ST_CR_KEY_EXCH;

                return 1;

            }

            goto err;

        }

        /* Fall through */

    case TLS_ST_CR_KEY_EXCH:

        if (mt == SSL3_MT_CERTIFICATE_REQUEST) {

            if (cert_req_allowed(s)) {

                st->hand_state = TLS_ST_CR_CERT_REQ;

                return 1;

            }

            goto err;

        }

        /* Fall through */

    case TLS_ST_CR_CERT_REQ:

        if (mt == SSL3_MT_SERVER_DONE) {

            st->hand_state = TLS_ST_CR_SRVR_DONE;

            return 1;

        }

        break;

    case TLS_ST_CW_FINISHED:

        if (s->ext.ticket_expected) {

            if (mt == SSL3_MT_NEWSESSION_TICKET) {

                st->hand_state = TLS_ST_CR_SESSION_TICKET;

                return 1;

            }

        } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

            st->hand_state = TLS_ST_CR_CHANGE;

            return 1;

        }

        break;

    case TLS_ST_CR_SESSION_TICKET:

        if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

            st->hand_state = TLS_ST_CR_CHANGE;

            return 1;

        }

        break;

    case TLS_ST_CR_CHANGE:

        if (mt == SSL3_MT_FINISHED) {

            st->hand_state = TLS_ST_CR_FINISHED;

            return 1;

        }

        break;

    case TLS_ST_OK:

        if (mt == SSL3_MT_HELLO_REQUEST) {

            st->hand_state = TLS_ST_CR_HELLO_REQ;

            return 1;

        }

        break;

    }

 err:

    /* No valid transition found */

    if (SSL_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

        BIO *rbio;

        /*

         * CCS messages don't have a message sequence number so this is probably

         * because of an out-of-order CCS. We'll just drop it.

         */

        s->init_num = 0;

        s->rwstate = SSL_READING;

        rbio = SSL_get_rbio(s);

        BIO_clear_retry_flags(rbio);

        BIO_set_retry_read(rbio);

        return 0;

    }

    SSLfatal(s, SSL3_AD_UNEXPECTED_MESSAGE,

             SSL_F_OSSL_STATEM_CLIENT_READ_TRANSITION,

             SSL_R_UNEXPECTED_MESSAGE);

    return 0;

}

/*

 * ossl_statem_client13_write_transition() works out what handshake state to

 * move to next when the TLSv1.3 client is writing messages to be sent to the

 * server.

 */

static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s)

{

    OSSL_STATEM *st = &s->statem;

    /*

     * Note: There are no cases for TLS_ST_BEFORE because we haven't negotiated

     * TLSv1.3 yet at that point. They are handled by

     * ossl_statem_client_write_transition().

     */

    switch (st->hand_state) {

    default:

        /* Shouldn't happen */

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_OSSL_STATEM_CLIENT13_WRITE_TRANSITION,

                 ERR_R_INTERNAL_ERROR);

        return WRITE_TRAN_ERROR;

    case TLS_ST_CR_CERT_REQ:

        if (s->post_handshake_auth == SSL_PHA_REQUESTED) {

            st->hand_state = TLS_ST_CW_CERT;

            return WRITE_TRAN_CONTINUE;

        }

        /*

         * We should only get here if we received a CertificateRequest after

         * we already sent close_notify

         */

        if (!ossl_assert((s->shutdown & SSL_SENT_SHUTDOWN) != 0)) {

            /* Shouldn't happen - same as default case */

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_OSSL_STATEM_CLIENT13_WRITE_TRANSITION,

                     ERR_R_INTERNAL_ERROR);

            return WRITE_TRAN_ERROR;

        }

        st->hand_state = TLS_ST_OK;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CR_FINISHED:

        if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY

                || s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING)

            st->hand_state = TLS_ST_PENDING_EARLY_DATA_END;

        else if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0

                 && s->hello_retry_request == SSL_HRR_NONE)

            st->hand_state = TLS_ST_CW_CHANGE;

        else

            st->hand_state = (s->s3->tmp.cert_req != 0) ? TLS_ST_CW_CERT

                                                        : TLS_ST_CW_FINISHED;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_PENDING_EARLY_DATA_END:

        if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {

            st->hand_state = TLS_ST_CW_END_OF_EARLY_DATA;

            return WRITE_TRAN_CONTINUE;

        }

        /* Fall through */

    case TLS_ST_CW_END_OF_EARLY_DATA:

    case TLS_ST_CW_CHANGE:

        st->hand_state = (s->s3->tmp.cert_req != 0) ? TLS_ST_CW_CERT

                                                    : TLS_ST_CW_FINISHED;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CERT:

        /* If a non-empty Certificate we also send CertificateVerify */

        st->hand_state = (s->s3->tmp.cert_req == 1) ? TLS_ST_CW_CERT_VRFY

                                                    : TLS_ST_CW_FINISHED;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CERT_VRFY:

        st->hand_state = TLS_ST_CW_FINISHED;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CR_KEY_UPDATE:

    case TLS_ST_CW_KEY_UPDATE:

    case TLS_ST_CR_SESSION_TICKET:

    case TLS_ST_CW_FINISHED:

        st->hand_state = TLS_ST_OK;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_OK:

        if (s->key_update != SSL_KEY_UPDATE_NONE) {

            st->hand_state = TLS_ST_CW_KEY_UPDATE;

            return WRITE_TRAN_CONTINUE;

        }

        /* Try to read from the server instead */

        return WRITE_TRAN_FINISHED;

    }

}

/*

 * ossl_statem_client_write_transition() works out what handshake state to

 * move to next when the client is writing messages to be sent to the server.

 */

WRITE_TRAN ossl_statem_client_write_transition(SSL *s)

{

    OSSL_STATEM *st = &s->statem;

    /*

     * Note that immediately before/after a ClientHello we don't know what

     * version we are going to negotiate yet, so we don't take this branch until

     * later

     */

    if (SSL_IS_TLS13(s))

        return ossl_statem_client13_write_transition(s);

    switch (st->hand_state) {

    default:

        /* Shouldn't happen */

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_OSSL_STATEM_CLIENT_WRITE_TRANSITION,

                 ERR_R_INTERNAL_ERROR);

        return WRITE_TRAN_ERROR;

    case TLS_ST_OK:

        if (!s->renegotiate) {

            /*

             * We haven't requested a renegotiation ourselves so we must have

             * received a message from the server. Better read it.

             */

            return WRITE_TRAN_FINISHED;

        }

        /* Renegotiation */

        /* fall thru */

    case TLS_ST_BEFORE:

        st->hand_state = TLS_ST_CW_CLNT_HELLO;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CLNT_HELLO:

        if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) {

            /*

             * We are assuming this is a TLSv1.3 connection, although we haven't

             * actually selected a version yet.

             */

            if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0)

                st->hand_state = TLS_ST_CW_CHANGE;

            else

                st->hand_state = TLS_ST_EARLY_DATA;

            return WRITE_TRAN_CONTINUE;

        }

        /*

         * No transition at the end of writing because we don't know what

         * we will be sent

         */

        return WRITE_TRAN_FINISHED;

    case TLS_ST_CR_SRVR_HELLO:

        /*

         * We only get here in TLSv1.3. We just received an HRR, so issue a

         * CCS unless middlebox compat mode is off, or we already issued one

         * because we did early data.

         */

        if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0

                && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING)

            st->hand_state = TLS_ST_CW_CHANGE;

        else

            st->hand_state = TLS_ST_CW_CLNT_HELLO;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_EARLY_DATA:

        return WRITE_TRAN_FINISHED;

    case DTLS_ST_CR_HELLO_VERIFY_REQUEST:

        st->hand_state = TLS_ST_CW_CLNT_HELLO;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CR_SRVR_DONE:

        if (s->s3->tmp.cert_req)

            st->hand_state = TLS_ST_CW_CERT;

        else

            st->hand_state = TLS_ST_CW_KEY_EXCH;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CERT:

        st->hand_state = TLS_ST_CW_KEY_EXCH;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_KEY_EXCH:

        /*

         * For TLS, cert_req is set to 2, so a cert chain of nothing is

         * sent, but no verify packet is sent

         */

        /*

         * XXX: For now, we do not support client authentication in ECDH

         * cipher suites with ECDH (rather than ECDSA) certificates. We

         * need to skip the certificate verify message when client's

         * ECDH public key is sent inside the client certificate.

         */

        if (s->s3->tmp.cert_req == 1) {

            st->hand_state = TLS_ST_CW_CERT_VRFY;

        } else {

            st->hand_state = TLS_ST_CW_CHANGE;

        }

        if (s->s3->flags & TLS1_FLAGS_SKIP_CERT_VERIFY) {

            st->hand_state = TLS_ST_CW_CHANGE;

        }

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CERT_VRFY:

        st->hand_state = TLS_ST_CW_CHANGE;

        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CHANGE:

        if (s->hello_retry_request == SSL_HRR_PENDING) {

            st->hand_state = TLS_ST_CW_CLNT_HELLO;

        } else if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) {

            st->hand_state = TLS_ST_EARLY_DATA;

        } else {

#if defined(OPENSSL_NO_NEXTPROTONEG)

            st->hand_state = TLS_ST_CW_FINISHED;

#else

            if (!SSL_IS_DTLS(s) && s->s3->npn_seen)

                st->hand_state = TLS_ST_CW_NEXT_PROTO;

            else

                st->hand_state = TLS_ST_CW_FINISHED;

#endif

        }

        return WRITE_TRAN_CONTINUE;

#if !defined(OPENSSL_NO_NEXTPROTONEG)

    case TLS_ST_CW_NEXT_PROTO:

        st->hand_state = TLS_ST_CW_FINISHED;

        return WRITE_TRAN_CONTINUE;

#endif

    case TLS_ST_CW_FINISHED:

        if (s->hit) {

            st->hand_state = TLS_ST_OK;

            return WRITE_TRAN_CONTINUE;

        } else {

            return WRITE_TRAN_FINISHED;

        }

    case TLS_ST_CR_FINISHED:

        if (s->hit) {

            st->hand_state = TLS_ST_CW_CHANGE;

            return WRITE_TRAN_CONTINUE;

        } else {

            st->hand_state = TLS_ST_OK;

            return WRITE_TRAN_CONTINUE;

        }

    case TLS_ST_CR_HELLO_REQ:

        /*

         * If we can renegotiate now then do so, otherwise wait for a more

         * convenient time.

         */

        if (ssl3_renegotiate_check(s, 1)) {

            if (!tls_setup_handshake(s)) {

                /* SSLfatal() already called */

                return WRITE_TRAN_ERROR;

            }

            st->hand_state = TLS_ST_CW_CLNT_HELLO;

            return WRITE_TRAN_CONTINUE;

        }

        st->hand_state = TLS_ST_OK;

        return WRITE_TRAN_CONTINUE;

    }

}

/*

 * Perform any pre work that needs to be done prior to sending a message from

 * the client to the server.

 */

WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst)

{

    OSSL_STATEM *st = &s->statem;

    switch (st->hand_state) {

    default:

        /* No pre work to be done */

        break;

    case TLS_ST_CW_CLNT_HELLO:

        s->shutdown = 0;

        if (SSL_IS_DTLS(s)) {

            /* every DTLS ClientHello resets Finished MAC */

            if (!ssl3_init_finished_mac(s)) {

                /* SSLfatal() already called */

                return WORK_ERROR;

            }

        }

        break;

    case TLS_ST_CW_CHANGE:

        if (SSL_IS_DTLS(s)) {

            if (s->hit) {

                /*

                 * We're into the last flight so we don't retransmit these

                 * messages unless we need to.

                 */

                st->use_timer = 0;

            }

#ifndef OPENSSL_NO_SCTP

            if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {

                /* Calls SSLfatal() as required */

                return dtls_wait_for_dry(s);

            }

#endif

        }

        break;

    case TLS_ST_PENDING_EARLY_DATA_END:

        /*

         * If we've been called by SSL_do_handshake()/SSL_write(), or we did not

         * attempt to write early data before calling SSL_read() then we press

         * on with the handshake. Otherwise we pause here.

         */

        if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING

                || s->early_data_state == SSL_EARLY_DATA_NONE)

            return WORK_FINISHED_CONTINUE;

        /* Fall through */

    case TLS_ST_EARLY_DATA:

        return tls_finish_handshake(s, wst, 0, 1);

    case TLS_ST_OK:

        /* Calls SSLfatal() as required */

        return tls_finish_handshake(s, wst, 1, 1);

    }

    return WORK_FINISHED_CONTINUE;

}

/*

 * Perform any work that needs to be done after sending a message from the

 * client to the server.

 */

WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst)

{

    OSSL_STATEM *st = &s->statem;

    s->init_num = 0;

    switch (st->hand_state) {

    default:

        /* No post work to be done */

        break;

    case TLS_ST_CW_CLNT_HELLO:

        if (s->early_data_state == SSL_EARLY_DATA_CONNECTING

                && s->max_early_data > 0) {

            /*

             * We haven't selected TLSv1.3 yet so we don't call the change

             * cipher state function associated with the SSL_METHOD. Instead

             * we call tls13_change_cipher_state() directly.

             */

            if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0) {

                if (!tls13_change_cipher_state(s,

                            SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {

                    /* SSLfatal() already called */

                    return WORK_ERROR;

                }

            }

            /* else we're in compat mode so we delay flushing until after CCS */

        } else if (!statem_flush(s)) {

            return WORK_MORE_A;

        }

        if (SSL_IS_DTLS(s)) {

            /* Treat the next message as the first packet */

            s->first_packet = 1;

        }

        break;

    case TLS_ST_CW_END_OF_EARLY_DATA:

        /*

         * We set the enc_write_ctx back to NULL because we may end up writing

         * in cleartext again if we get a HelloRetryRequest from the server.

         */

        EVP_CIPHER_CTX_free(s->enc_write_ctx);

        s->enc_write_ctx = NULL;

        break;

    case TLS_ST_CW_KEY_EXCH:

        if (tls_client_key_exchange_post_work(s) == 0) {

            /* SSLfatal() already called */

            return WORK_ERROR;

        }

        break;

    case TLS_ST_CW_CHANGE:

        if (SSL_IS_TLS13(s) || s->hello_retry_request == SSL_HRR_PENDING)

            break;

        if (s->early_data_state == SSL_EARLY_DATA_CONNECTING

                    && s->max_early_data > 0) {

            /*

             * We haven't selected TLSv1.3 yet so we don't call the change

             * cipher state function associated with the SSL_METHOD. Instead

             * we call tls13_change_cipher_state() directly.

             */

            if (!tls13_change_cipher_state(s,

                        SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE))

                return WORK_ERROR;

            break;

        }

        s->session->cipher = s->s3->tmp.new_cipher;

#ifdef OPENSSL_NO_COMP

        s->session->compress_meth = 0;

#else

        if (s->s3->tmp.new_compression == NULL)

            s->session->compress_meth = 0;

        else

            s->session->compress_meth = s->s3->tmp.new_compression->id;

#endif

        if (!s->method->ssl3_enc->setup_key_block(s)) {

            /* SSLfatal() already called */

            return WORK_ERROR;

        }

        if (!s->method->ssl3_enc->change_cipher_state(s,

                                          SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {

            /* SSLfatal() already called */

            return WORK_ERROR;

        }

        if (SSL_IS_DTLS(s)) {

#ifndef OPENSSL_NO_SCTP

            if (s->hit) {

                /*

                 * Change to new shared key of SCTP-Auth, will be ignored if

                 * no SCTP used.

                 */

                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,

                         0, NULL);

            }

#endif

            dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);

        }

        break;

    case TLS_ST_CW_FINISHED:

#ifndef OPENSSL_NO_SCTP

        if (wst == WORK_MORE_A && SSL_IS_DTLS(s) && s->hit == 0) {

            /*

             * Change to new shared key of SCTP-Auth, will be ignored if

             * no SCTP used.

             */

            BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,

                     0, NULL);

        }

#endif

        if (statem_flush(s) != 1)

            return WORK_MORE_B;

        if (SSL_IS_TLS13(s)) {

            if (!tls13_save_handshake_digest_for_pha(s)) {

                /* SSLfatal() already called */

                return WORK_ERROR;

            }

            if (s->post_handshake_auth != SSL_PHA_REQUESTED) {

                if (!s->method->ssl3_enc->change_cipher_state(s,

                        SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {

                    /* SSLfatal() already called */

                    return WORK_ERROR;

                }

            }

        }

        break;

    case TLS_ST_CW_KEY_UPDATE:

        if (statem_flush(s) != 1)

            return WORK_MORE_A;

        if (!tls13_update_key(s, 1)) {

            /* SSLfatal() already called */

            return WORK_ERROR;

        }

        break;

    }

    return WORK_FINISHED_CONTINUE;

}

/*

 * Get the message construction function and message type for sending from the

 * client

 *