1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to. The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 * notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 * notice, this list of conditions and the following disclaimer in the
29 * documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 * must display the following acknowledgement:
32 * "This product includes cryptographic software written by
33 * Eric Young (eay@cryptsoft.com)"
34 * The word 'cryptographic' can be left out if the rouines from the library
35 * being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 * the apps directory (application code) you must include an acknowledgement:
38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed. i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.]
56 */
57 /* ====================================================================
58 * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
59 *
60 * Redistribution and use in source and binary forms, with or without
61 * modification, are permitted provided that the following conditions
62 * are met:
63 *
64 * 1. Redistributions of source code must retain the above copyright
65 * notice, this list of conditions and the following disclaimer.
66 *
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in
69 * the documentation and/or other materials provided with the
70 * distribution.
71 *
72 * 3. All advertising materials mentioning features or use of this
73 * software must display the following acknowledgment:
74 * "This product includes software developed by the OpenSSL Project
75 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76 *
77 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78 * endorse or promote products derived from this software without
79 * prior written permission. For written permission, please contact
80 * openssl-core@openssl.org.
81 *
82 * 5. Products derived from this software may not be called "OpenSSL"
83 * nor may "OpenSSL" appear in their names without prior written
84 * permission of the OpenSSL Project.
85 *
86 * 6. Redistributions of any form whatsoever must retain the following
87 * acknowledgment:
88 * "This product includes software developed by the OpenSSL Project
89 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90 *
91 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102 * OF THE POSSIBILITY OF SUCH DAMAGE.
103 * ====================================================================
104 *
105 * This product includes cryptographic software written by Eric Young
106 * (eay@cryptsoft.com). This product includes software written by Tim
107 * Hudson (tjh@cryptsoft.com). */
108
109 #include <openssl/ssl.h>
110
111 #include <assert.h>
112 #include <string.h>
113
114 #include <openssl/bytestring.h>
115 #include <openssl/err.h>
116 #include <openssl/mem.h>
117
118 #include "internal.h"
119 #include "../crypto/internal.h"
120
121
122 /* kMaxEmptyRecords is the number of consecutive, empty records that will be
123 * processed. Without this limit an attacker could send empty records at a
124 * faster rate than we can process and cause record processing to loop
125 * forever. */
126 static const uint8_t kMaxEmptyRecords = 32;
127
128 /* kMaxEarlyDataSkipped is the maximum number of rejected early data bytes that
129 * will be skipped. Without this limit an attacker could send records at a
130 * faster rate than we can process and cause trial decryption to loop forever.
131 * This value should be slightly above kMaxEarlyDataAccepted in tls13_server.c,
132 * which is measured in plaintext. */
133 static const size_t kMaxEarlyDataSkipped = 16384;
134
135 /* kMaxWarningAlerts is the number of consecutive warning alerts that will be
136 * processed. */
137 static const uint8_t kMaxWarningAlerts = 4;
138
139 /* ssl_needs_record_splitting returns one if |ssl|'s current outgoing cipher
140 * state needs record-splitting and zero otherwise. */
ssl_needs_record_splitting(const SSL * ssl)141 static int ssl_needs_record_splitting(const SSL *ssl) {
142 return ssl->s3->aead_write_ctx != NULL &&
143 ssl->s3->aead_write_ctx->version < TLS1_1_VERSION &&
144 (ssl->mode & SSL_MODE_CBC_RECORD_SPLITTING) != 0 &&
145 SSL_CIPHER_is_block_cipher(ssl->s3->aead_write_ctx->cipher);
146 }
147
ssl_record_sequence_update(uint8_t * seq,size_t seq_len)148 int ssl_record_sequence_update(uint8_t *seq, size_t seq_len) {
149 for (size_t i = seq_len - 1; i < seq_len; i--) {
150 ++seq[i];
151 if (seq[i] != 0) {
152 return 1;
153 }
154 }
155 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
156 return 0;
157 }
158
ssl_record_prefix_len(const SSL * ssl)159 size_t ssl_record_prefix_len(const SSL *ssl) {
160 size_t header_len;
161 if (SSL_is_dtls(ssl)) {
162 header_len = DTLS1_RT_HEADER_LENGTH;
163 } else {
164 header_len = SSL3_RT_HEADER_LENGTH;
165 }
166
167 return header_len + SSL_AEAD_CTX_explicit_nonce_len(ssl->s3->aead_read_ctx);
168 }
169
ssl_seal_align_prefix_len(const SSL * ssl)170 size_t ssl_seal_align_prefix_len(const SSL *ssl) {
171 if (SSL_is_dtls(ssl)) {
172 return DTLS1_RT_HEADER_LENGTH +
173 SSL_AEAD_CTX_explicit_nonce_len(ssl->s3->aead_write_ctx);
174 }
175
176 size_t ret = SSL3_RT_HEADER_LENGTH +
177 SSL_AEAD_CTX_explicit_nonce_len(ssl->s3->aead_write_ctx);
178 if (ssl_needs_record_splitting(ssl)) {
179 ret += SSL3_RT_HEADER_LENGTH;
180 ret += ssl_cipher_get_record_split_len(ssl->s3->aead_write_ctx->cipher);
181 }
182 return ret;
183 }
184
SSL_max_seal_overhead(const SSL * ssl)185 size_t SSL_max_seal_overhead(const SSL *ssl) {
186 if (SSL_is_dtls(ssl)) {
187 return dtls_max_seal_overhead(ssl, dtls1_use_current_epoch);
188 }
189
190 size_t ret = SSL3_RT_HEADER_LENGTH;
191 ret += SSL_AEAD_CTX_max_overhead(ssl->s3->aead_write_ctx);
192 /* TLS 1.3 needs an extra byte for the encrypted record type. */
193 if (ssl->s3->aead_write_ctx != NULL &&
194 ssl->s3->aead_write_ctx->version >= TLS1_3_VERSION) {
195 ret += 1;
196 }
197 if (ssl_needs_record_splitting(ssl)) {
198 ret *= 2;
199 }
200 return ret;
201 }
202
tls_open_record(SSL * ssl,uint8_t * out_type,CBS * out,size_t * out_consumed,uint8_t * out_alert,uint8_t * in,size_t in_len)203 enum ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type, CBS *out,
204 size_t *out_consumed, uint8_t *out_alert,
205 uint8_t *in, size_t in_len) {
206 *out_consumed = 0;
207
208 CBS cbs;
209 CBS_init(&cbs, in, in_len);
210
211 /* Decode the record header. */
212 uint8_t type;
213 uint16_t version, ciphertext_len;
214 if (!CBS_get_u8(&cbs, &type) ||
215 !CBS_get_u16(&cbs, &version) ||
216 !CBS_get_u16(&cbs, &ciphertext_len)) {
217 *out_consumed = SSL3_RT_HEADER_LENGTH;
218 return ssl_open_record_partial;
219 }
220
221 int version_ok;
222 if (ssl->s3->aead_read_ctx == NULL) {
223 /* Only check the first byte. Enforcing beyond that can prevent decoding
224 * version negotiation failure alerts. */
225 version_ok = (version >> 8) == SSL3_VERSION_MAJOR;
226 } else if (ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
227 /* Earlier versions of TLS switch the record version. */
228 version_ok = version == ssl->version;
229 } else {
230 /* Starting TLS 1.3, the version field is frozen at {3, 1}. */
231 version_ok = version == TLS1_VERSION;
232 }
233
234 if (!version_ok) {
235 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_VERSION_NUMBER);
236 *out_alert = SSL_AD_PROTOCOL_VERSION;
237 return ssl_open_record_error;
238 }
239
240 /* Check the ciphertext length. */
241 if (ciphertext_len > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
242 OPENSSL_PUT_ERROR(SSL, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
243 *out_alert = SSL_AD_RECORD_OVERFLOW;
244 return ssl_open_record_error;
245 }
246
247 /* Extract the body. */
248 CBS body;
249 if (!CBS_get_bytes(&cbs, &body, ciphertext_len)) {
250 *out_consumed = SSL3_RT_HEADER_LENGTH + (size_t)ciphertext_len;
251 return ssl_open_record_partial;
252 }
253
254 ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HEADER, in,
255 SSL3_RT_HEADER_LENGTH);
256
257 *out_consumed = in_len - CBS_len(&cbs);
258
259 /* Skip early data received when expecting a second ClientHello if we rejected
260 * 0RTT. */
261 if (ssl->s3->skip_early_data &&
262 ssl->s3->aead_read_ctx == NULL &&
263 type == SSL3_RT_APPLICATION_DATA) {
264 goto skipped_data;
265 }
266
267 /* Decrypt the body in-place. */
268 if (!SSL_AEAD_CTX_open(ssl->s3->aead_read_ctx, out, type, version,
269 ssl->s3->read_sequence, (uint8_t *)CBS_data(&body),
270 CBS_len(&body))) {
271 if (ssl->s3->skip_early_data &&
272 ssl->s3->aead_read_ctx != NULL) {
273 ERR_clear_error();
274 goto skipped_data;
275 }
276
277 OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
278 *out_alert = SSL_AD_BAD_RECORD_MAC;
279 return ssl_open_record_error;
280 }
281
282 ssl->s3->skip_early_data = 0;
283
284 if (!ssl_record_sequence_update(ssl->s3->read_sequence, 8)) {
285 *out_alert = SSL_AD_INTERNAL_ERROR;
286 return ssl_open_record_error;
287 }
288
289 /* TLS 1.3 hides the record type inside the encrypted data. */
290 if (ssl->s3->aead_read_ctx != NULL &&
291 ssl->s3->aead_read_ctx->version >= TLS1_3_VERSION) {
292 /* The outer record type is always application_data. */
293 if (type != SSL3_RT_APPLICATION_DATA) {
294 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_OUTER_RECORD_TYPE);
295 *out_alert = SSL_AD_DECODE_ERROR;
296 return ssl_open_record_error;
297 }
298
299 do {
300 if (!CBS_get_last_u8(out, &type)) {
301 OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
302 *out_alert = SSL_AD_DECRYPT_ERROR;
303 return ssl_open_record_error;
304 }
305 } while (type == 0);
306 }
307
308 /* Check the plaintext length. */
309 if (CBS_len(out) > SSL3_RT_MAX_PLAIN_LENGTH) {
310 OPENSSL_PUT_ERROR(SSL, SSL_R_DATA_LENGTH_TOO_LONG);
311 *out_alert = SSL_AD_RECORD_OVERFLOW;
312 return ssl_open_record_error;
313 }
314
315 /* Limit the number of consecutive empty records. */
316 if (CBS_len(out) == 0) {
317 ssl->s3->empty_record_count++;
318 if (ssl->s3->empty_record_count > kMaxEmptyRecords) {
319 OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_EMPTY_FRAGMENTS);
320 *out_alert = SSL_AD_UNEXPECTED_MESSAGE;
321 return ssl_open_record_error;
322 }
323 /* Apart from the limit, empty records are returned up to the caller. This
324 * allows the caller to reject records of the wrong type. */
325 } else {
326 ssl->s3->empty_record_count = 0;
327 }
328
329 if (type == SSL3_RT_ALERT) {
330 /* Return end_of_early_data alerts as-is for the caller to process. */
331 if (CBS_len(out) == 2 &&
332 CBS_data(out)[0] == SSL3_AL_WARNING &&
333 CBS_data(out)[1] == TLS1_AD_END_OF_EARLY_DATA) {
334 *out_type = type;
335 return ssl_open_record_success;
336 }
337
338 return ssl_process_alert(ssl, out_alert, CBS_data(out), CBS_len(out));
339 }
340
341 ssl->s3->warning_alert_count = 0;
342
343 *out_type = type;
344 return ssl_open_record_success;
345
346 skipped_data:
347 ssl->s3->early_data_skipped += *out_consumed;
348 if (ssl->s3->early_data_skipped < *out_consumed) {
349 ssl->s3->early_data_skipped = kMaxEarlyDataSkipped + 1;
350 }
351
352 if (ssl->s3->early_data_skipped > kMaxEarlyDataSkipped) {
353 OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MUCH_SKIPPED_EARLY_DATA);
354 *out_alert = SSL_AD_UNEXPECTED_MESSAGE;
355 return ssl_open_record_error;
356 }
357
358 return ssl_open_record_discard;
359 }
360
do_seal_record(SSL * ssl,uint8_t * out,size_t * out_len,size_t max_out,uint8_t type,const uint8_t * in,size_t in_len)361 static int do_seal_record(SSL *ssl, uint8_t *out, size_t *out_len,
362 size_t max_out, uint8_t type, const uint8_t *in,
363 size_t in_len) {
364 assert(!buffers_alias(in, in_len, out, max_out));
365
366 /* TLS 1.3 hides the actual record type inside the encrypted data. */
367 if (ssl->s3->aead_write_ctx != NULL &&
368 ssl->s3->aead_write_ctx->version >= TLS1_3_VERSION) {
369 if (in_len > in_len + SSL3_RT_HEADER_LENGTH + 1 ||
370 max_out < in_len + SSL3_RT_HEADER_LENGTH + 1) {
371 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
372 return 0;
373 }
374
375 OPENSSL_memcpy(out + SSL3_RT_HEADER_LENGTH, in, in_len);
376 out[SSL3_RT_HEADER_LENGTH + in_len] = type;
377 in = out + SSL3_RT_HEADER_LENGTH;
378 type = SSL3_RT_APPLICATION_DATA;
379 in_len++;
380 }
381
382 if (max_out < SSL3_RT_HEADER_LENGTH) {
383 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
384 return 0;
385 }
386
387 /* The TLS record-layer version number is meaningless and, starting in
388 * TLS 1.3, is frozen at TLS 1.0. But for historical reasons, SSL 3.0
389 * ClientHellos should use SSL 3.0 and pre-TLS-1.3 expects the version
390 * to change after version negotiation. */
391 uint16_t wire_version = TLS1_VERSION;
392 if (ssl->version == SSL3_VERSION ||
393 (ssl->s3->have_version && ssl3_protocol_version(ssl) < TLS1_3_VERSION)) {
394 wire_version = ssl->version;
395 }
396
397 /* Write the non-length portions of the header. */
398 out[0] = type;
399 out[1] = wire_version >> 8;
400 out[2] = wire_version & 0xff;
401 out += 3;
402 max_out -= 3;
403
404 /* Write the ciphertext, leaving two bytes for the length. */
405 size_t ciphertext_len;
406 if (!SSL_AEAD_CTX_seal(ssl->s3->aead_write_ctx, out + 2, &ciphertext_len,
407 max_out - 2, type, wire_version,
408 ssl->s3->write_sequence, in, in_len) ||
409 !ssl_record_sequence_update(ssl->s3->write_sequence, 8)) {
410 return 0;
411 }
412
413 /* Fill in the length. */
414 if (ciphertext_len >= 1 << 15) {
415 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
416 return 0;
417 }
418 out[0] = ciphertext_len >> 8;
419 out[1] = ciphertext_len & 0xff;
420
421 *out_len = SSL3_RT_HEADER_LENGTH + ciphertext_len;
422
423 ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_HEADER, out,
424 SSL3_RT_HEADER_LENGTH);
425 return 1;
426 }
427
tls_seal_record(SSL * ssl,uint8_t * out,size_t * out_len,size_t max_out,uint8_t type,const uint8_t * in,size_t in_len)428 int tls_seal_record(SSL *ssl, uint8_t *out, size_t *out_len, size_t max_out,
429 uint8_t type, const uint8_t *in, size_t in_len) {
430 if (buffers_alias(in, in_len, out, max_out)) {
431 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
432 return 0;
433 }
434
435 size_t frag_len = 0;
436 if (type == SSL3_RT_APPLICATION_DATA && in_len > 1 &&
437 ssl_needs_record_splitting(ssl)) {
438 if (!do_seal_record(ssl, out, &frag_len, max_out, type, in, 1)) {
439 return 0;
440 }
441 in++;
442 in_len--;
443 out += frag_len;
444 max_out -= frag_len;
445
446 #if !defined(BORINGSSL_UNSAFE_FUZZER_MODE)
447 assert(SSL3_RT_HEADER_LENGTH + ssl_cipher_get_record_split_len(
448 ssl->s3->aead_write_ctx->cipher) ==
449 frag_len);
450 #endif
451 }
452
453 if (!do_seal_record(ssl, out, out_len, max_out, type, in, in_len)) {
454 return 0;
455 }
456 *out_len += frag_len;
457 return 1;
458 }
459
ssl_process_alert(SSL * ssl,uint8_t * out_alert,const uint8_t * in,size_t in_len)460 enum ssl_open_record_t ssl_process_alert(SSL *ssl, uint8_t *out_alert,
461 const uint8_t *in, size_t in_len) {
462 /* Alerts records may not contain fragmented or multiple alerts. */
463 if (in_len != 2) {
464 *out_alert = SSL_AD_DECODE_ERROR;
465 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ALERT);
466 return ssl_open_record_error;
467 }
468
469 ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_ALERT, in, in_len);
470
471 const uint8_t alert_level = in[0];
472 const uint8_t alert_descr = in[1];
473
474 uint16_t alert = (alert_level << 8) | alert_descr;
475 ssl_do_info_callback(ssl, SSL_CB_READ_ALERT, alert);
476
477 if (alert_level == SSL3_AL_WARNING) {
478 if (alert_descr == SSL_AD_CLOSE_NOTIFY) {
479 ssl->s3->recv_shutdown = ssl_shutdown_close_notify;
480 return ssl_open_record_close_notify;
481 }
482
483 /* Warning alerts do not exist in TLS 1.3. */
484 if (ssl->s3->have_version &&
485 ssl3_protocol_version(ssl) >= TLS1_3_VERSION) {
486 *out_alert = SSL_AD_DECODE_ERROR;
487 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ALERT);
488 return ssl_open_record_error;
489 }
490
491 ssl->s3->warning_alert_count++;
492 if (ssl->s3->warning_alert_count > kMaxWarningAlerts) {
493 *out_alert = SSL_AD_UNEXPECTED_MESSAGE;
494 OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_WARNING_ALERTS);
495 return ssl_open_record_error;
496 }
497 return ssl_open_record_discard;
498 }
499
500 if (alert_level == SSL3_AL_FATAL) {
501 ssl->s3->recv_shutdown = ssl_shutdown_fatal_alert;
502
503 char tmp[16];
504 OPENSSL_PUT_ERROR(SSL, SSL_AD_REASON_OFFSET + alert_descr);
505 BIO_snprintf(tmp, sizeof(tmp), "%d", alert_descr);
506 ERR_add_error_data(2, "SSL alert number ", tmp);
507 return ssl_open_record_fatal_alert;
508 }
509
510 *out_alert = SSL_AD_ILLEGAL_PARAMETER;
511 OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_ALERT_TYPE);
512 return ssl_open_record_error;
513 }
514