Lines Matching full:if
14 #if defined(MBEDTLS_SSL_TLS_C)
31 #if defined(MBEDTLS_USE_PSA_CRYPTO)
37 #if defined(MBEDTLS_X509_CRT_PARSE_C)
41 #if defined(MBEDTLS_USE_PSA_CRYPTO)
53 #if defined(MBEDTLS_TEST_HOOKS)
77 #if defined(MBEDTLS_SSL_PROTO_DTLS)
79 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
86 if (len > MBEDTLS_SSL_CID_IN_LEN_MAX) { in mbedtls_ssl_conf_cid()
90 if (ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL && in mbedtls_ssl_conf_cid()
105 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_set_cid()
110 if (enable == MBEDTLS_SSL_CID_DISABLED) { in mbedtls_ssl_set_cid()
117 if (own_cid_len != ssl->conf->cid_len) { in mbedtls_ssl_set_cid()
139 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_get_own_cid()
146 if (ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) { in mbedtls_ssl_get_own_cid()
150 if (own_cid_len != NULL) { in mbedtls_ssl_get_own_cid()
152 if (own_cid != NULL) { in mbedtls_ssl_get_own_cid()
169 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM || in mbedtls_ssl_get_peer_cid()
178 if (ssl->transform_in->in_cid_len == 0 && in mbedtls_ssl_get_peer_cid()
183 if (peer_cid_len != NULL) { in mbedtls_ssl_get_peer_cid()
185 if (peer_cid != NULL) { in mbedtls_ssl_get_peer_cid()
199 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
232 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_session_copy()
234 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ in mbedtls_ssl_session_copy()
240 #if defined(MBEDTLS_X509_CRT_PARSE_C) in mbedtls_ssl_session_copy()
242 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in mbedtls_ssl_session_copy()
243 if (src->peer_cert != NULL) { in mbedtls_ssl_session_copy()
247 if (dst->peer_cert == NULL) { in mbedtls_ssl_session_copy()
253 if ((ret = mbedtls_x509_crt_parse_der(dst->peer_cert, src->peer_cert->raw.p, in mbedtls_ssl_session_copy()
261 if (src->peer_cert_digest != NULL) { in mbedtls_ssl_session_copy()
264 if (dst->peer_cert_digest == NULL) { in mbedtls_ssl_session_copy()
277 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_session_copy()
278 if (src->ticket != NULL) { in mbedtls_ssl_session_copy()
280 if (dst->ticket == NULL) { in mbedtls_ssl_session_copy()
287 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ in mbedtls_ssl_session_copy()
289 if (src->endpoint == MBEDTLS_SSL_IS_CLIENT) { in mbedtls_ssl_session_copy()
292 if (ret != 0) { in mbedtls_ssl_session_copy()
303 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
308 if (resized_buffer == NULL) { in resize_buffer()
333 if (ssl->in_buf != NULL) { in handle_buffer_resizing()
337 if (downsizing ? in handle_buffer_resizing()
340 if (resize_buffer(&ssl->in_buf, in_buf_new_len, &ssl->in_buf_len) != 0) { in handle_buffer_resizing()
350 if (ssl->out_buf != NULL) { in handle_buffer_resizing()
354 if (downsizing ? in handle_buffer_resizing()
357 if (resize_buffer(&ssl->out_buf, out_buf_new_len, &ssl->out_buf_len) != 0) { in handle_buffer_resizing()
366 if (modified) { in handle_buffer_resizing()
382 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
384 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
403 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
412 #if defined(MBEDTLS_MD_CAN_SHA256)
423 #if defined(MBEDTLS_MD_CAN_SHA384)
446 #if defined(MBEDTLS_MD_CAN_SHA256)
450 #if defined(MBEDTLS_MD_CAN_SHA384)
463 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_tls_prf()
464 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_tls_prf()
469 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_tls_prf()
482 #if defined(MBEDTLS_X509_CRT_PARSE_C)
485 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in ssl_clear_peer_cert()
486 if (session->peer_cert != NULL) { in ssl_clear_peer_cert()
492 if (session->peer_cert_digest != NULL) { in ssl_clear_peer_cert()
600 #if defined(MBEDTLS_DEBUG_C)
698 if (extra_msg0 && extra_msg1) { in mbedtls_ssl_print_extension()
710 if (extra_msg) { in mbedtls_ssl_print_extension()
740 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
760 if ((flags & (1 << i))) { in mbedtls_ssl_print_ticket_flags()
775 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_optimize_checksum()
776 if (ciphersuite_info->mac == MBEDTLS_MD_SHA384) { in mbedtls_ssl_optimize_checksum()
780 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_optimize_checksum()
781 if (ciphersuite_info->mac != MBEDTLS_MD_SHA384) { in mbedtls_ssl_optimize_checksum()
813 if (ret != 0) { in mbedtls_ssl_add_hs_msg_to_checksum()
821 #if defined(MBEDTLS_MD_CAN_SHA256) || \ in mbedtls_ssl_reset_checksum()
823 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_reset_checksum()
831 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_reset_checksum()
832 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_reset_checksum()
834 if (status != PSA_SUCCESS) { in mbedtls_ssl_reset_checksum()
838 if (status != PSA_SUCCESS) { in mbedtls_ssl_reset_checksum()
847 if (ret != 0) { in mbedtls_ssl_reset_checksum()
851 if (ret != 0) { in mbedtls_ssl_reset_checksum()
856 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_reset_checksum()
857 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_reset_checksum()
859 if (status != PSA_SUCCESS) { in mbedtls_ssl_reset_checksum()
863 if (status != PSA_SUCCESS) { in mbedtls_ssl_reset_checksum()
871 if (ret != 0) { in mbedtls_ssl_reset_checksum()
875 if (ret != 0) { in mbedtls_ssl_reset_checksum()
886 #if defined(MBEDTLS_MD_CAN_SHA256) || \ in ssl_update_checksum_start()
888 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_update_checksum_start()
898 #if defined(MBEDTLS_MD_CAN_SHA256) in ssl_update_checksum_start()
899 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_update_checksum_start()
901 if (status != PSA_SUCCESS) { in ssl_update_checksum_start()
906 if (ret != 0) { in ssl_update_checksum_start()
911 #if defined(MBEDTLS_MD_CAN_SHA384) in ssl_update_checksum_start()
912 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_update_checksum_start()
914 if (status != PSA_SUCCESS) { in ssl_update_checksum_start()
919 if (ret != 0) { in ssl_update_checksum_start()
927 #if defined(MBEDTLS_MD_CAN_SHA256)
931 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_update_checksum_sha256()
940 #if defined(MBEDTLS_MD_CAN_SHA384)
944 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_update_checksum_sha384()
957 #if defined(MBEDTLS_MD_CAN_SHA256) in ssl_handshake_params_init()
958 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_handshake_params_init()
964 #if defined(MBEDTLS_MD_CAN_SHA384) in ssl_handshake_params_init()
965 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_handshake_params_init()
974 #if defined(MBEDTLS_DHM_C) in ssl_handshake_params_init()
977 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ in ssl_handshake_params_init()
981 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) in ssl_handshake_params_init()
982 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_handshake_params_init()
988 #if defined(MBEDTLS_SSL_CLI_C) in ssl_handshake_params_init()
994 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) in ssl_handshake_params_init()
998 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) in ssl_handshake_params_init()
1002 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ in ssl_handshake_params_init()
1012 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_transform_init()
1020 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) in mbedtls_ssl_transform_init()
1021 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_transform_init()
1041 /* Clear old handshake information if present */ in ssl_handshake_init()
1042 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_handshake_init()
1043 if (ssl->transform_negotiate) { in ssl_handshake_init()
1047 if (ssl->session_negotiate) { in ssl_handshake_init()
1050 if (ssl->handshake) { in ssl_handshake_init()
1054 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_handshake_init()
1059 if (ssl->transform_negotiate == NULL) { in ssl_handshake_init()
1064 if (ssl->session_negotiate == NULL) { in ssl_handshake_init()
1068 if (ssl->handshake == NULL) { in ssl_handshake_init()
1071 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) in ssl_handshake_init()
1072 /* If the buffers are too small - reallocate */ in ssl_handshake_init()
1079 if (ssl->handshake == NULL || in ssl_handshake_init()
1080 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_handshake_init()
1089 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_handshake_init()
1104 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_handshake_init()
1110 if (ret != 0) { in ssl_handshake_init()
1115 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ in ssl_handshake_init()
1122 #if defined(MBEDTLS_SSL_PROTO_DTLS) in ssl_handshake_init()
1123 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_handshake_init()
1126 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { in ssl_handshake_init()
1141 #if defined(MBEDTLS_ECP_C) in ssl_handshake_init()
1142 #if !defined(MBEDTLS_DEPRECATED_REMOVED) in ssl_handshake_init()
1144 if (ssl->conf->curve_list != NULL) { in ssl_handshake_init()
1153 if (group_list == NULL) { in ssl_handshake_init()
1160 if (tls_id == 0) { in ssl_handshake_init()
1178 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) in ssl_handshake_init()
1179 #if !defined(MBEDTLS_DEPRECATED_REMOVED) in ssl_handshake_init()
1180 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_handshake_init()
1183 if (mbedtls_ssl_conf_is_tls12_only(ssl->conf) && in ssl_handshake_init()
1195 if (mbedtls_ssl_hash_from_md_alg(*md) == MBEDTLS_SSL_HASH_NONE) { in ssl_handshake_init()
1198 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) in ssl_handshake_init()
1202 #if defined(MBEDTLS_RSA_C) in ssl_handshake_init()
1205 if (sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN) { in ssl_handshake_init()
1210 if (sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN) { in ssl_handshake_init()
1216 if (ssl->handshake->sig_algs == NULL) { in ssl_handshake_init()
1223 if (hash == MBEDTLS_SSL_HASH_NONE) { in ssl_handshake_init()
1226 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) in ssl_handshake_init()
1230 #if defined(MBEDTLS_RSA_C) in ssl_handshake_init()
1247 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
1291 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in ssl_conf_version_check()
1292 if (mbedtls_ssl_conf_is_tls13_only(conf)) { in ssl_conf_version_check()
1293 if (conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_conf_version_check()
1303 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_conf_version_check()
1304 if (mbedtls_ssl_conf_is_tls12_only(conf)) { in ssl_conf_version_check()
1310 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3) in ssl_conf_version_check()
1311 if (mbedtls_ssl_conf_is_hybrid_tls12_tls13(conf)) { in ssl_conf_version_check()
1312 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_conf_version_check()
1331 if (ret != 0) { in ssl_conf_check()
1335 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in ssl_conf_check()
1338 * If the verification fails, the receiver MUST terminate the handshake with in ssl_conf_check()
1341 * If the client is configured as TLS 1.3 only with optional verify, return in ssl_conf_check()
1345 if (mbedtls_ssl_conf_tls13_ephemeral_enabled( in ssl_conf_check()
1376 if ((ret = ssl_conf_check(ssl)) != 0) { in mbedtls_ssl_setup()
1388 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) in mbedtls_ssl_setup()
1392 if (ssl->in_buf == NULL) { in mbedtls_ssl_setup()
1398 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) in mbedtls_ssl_setup()
1402 if (ssl->out_buf == NULL) { in mbedtls_ssl_setup()
1410 #if defined(MBEDTLS_SSL_DTLS_SRTP) in mbedtls_ssl_setup()
1414 if ((ret = ssl_handshake_init(ssl)) != 0) { in mbedtls_ssl_setup()
1426 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) in mbedtls_ssl_setup()
1452 * If partial is non-zero, keep data in the input buffer and client ID.
1458 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) in mbedtls_ssl_session_reset_msg_layer()
1466 #if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_session_reset_msg_layer()
1484 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_session_reset_msg_layer()
1489 /* Keep current datagram if partial == 1 */ in mbedtls_ssl_session_reset_msg_layer()
1490 if (partial == 0) { in mbedtls_ssl_session_reset_msg_layer()
1505 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) in mbedtls_ssl_session_reset_msg_layer()
1509 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_session_reset_msg_layer()
1510 if (ssl->transform) { in mbedtls_ssl_session_reset_msg_layer()
1517 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_session_reset_msg_layer()
1522 if (ssl->handshake != NULL) { in mbedtls_ssl_session_reset_msg_layer()
1523 #if defined(MBEDTLS_SSL_EARLY_DATA) in mbedtls_ssl_session_reset_msg_layer()
1546 #if defined(MBEDTLS_SSL_RENEGOTIATION) in mbedtls_ssl_session_reset_int()
1558 if (ssl->session) { in mbedtls_ssl_session_reset_int()
1564 #if defined(MBEDTLS_SSL_ALPN) in mbedtls_ssl_session_reset_int()
1568 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_session_reset_int()
1570 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) in mbedtls_ssl_session_reset_int()
1573 if (free_cli_id) { in mbedtls_ssl_session_reset_int()
1580 if ((ret = ssl_handshake_init(ssl)) != 0) { in mbedtls_ssl_session_reset_int()
1609 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1621 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1642 #if defined(MBEDTLS_X509_CRT_PARSE_C)
1680 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1705 #if defined(MBEDTLS_SSL_SRV_C)
1717 #if defined(MBEDTLS_SSL_CLI_C)
1722 if (ssl == NULL || in mbedtls_ssl_set_session()
1729 if (ssl->handshake->resume == 1) { in mbedtls_ssl_set_session()
1733 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_set_session()
1734 if (session->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in mbedtls_ssl_set_session()
1738 if (mbedtls_ssl_validate_ciphersuite( in mbedtls_ssl_set_session()
1748 if ((ret = mbedtls_ssl_session_copy(ssl->session_negotiate, in mbedtls_ssl_set_session()
1765 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1772 #if defined(MBEDTLS_SSL_EARLY_DATA)
1779 #if defined(MBEDTLS_SSL_SRV_C)
1790 #if defined(MBEDTLS_X509_CRT_PARSE_C)
1816 if (cert == NULL) { in ssl_append_key_cert()
1817 /* Free list if cert is null */ in ssl_append_key_cert()
1824 if (new_cert == NULL) { in ssl_append_key_cert()
1832 /* Update head if the list was null, else add to the end */ in ssl_append_key_cert()
1833 if (*head == NULL) { in ssl_append_key_cert()
1860 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) in mbedtls_ssl_conf_ca_chain()
1868 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1884 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1908 #if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
1923 #if defined(MBEDTLS_X509_CRT_PARSE_C)
1933 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1935 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1957 if (status != PSA_SUCCESS) { in mbedtls_ssl_set_hs_ecjpake_password_common()
1961 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_set_hs_ecjpake_password_common()
1974 if (status != PSA_SUCCESS) { in mbedtls_ssl_set_hs_ecjpake_password_common()
1979 if (status != PSA_SUCCESS) { in mbedtls_ssl_set_hs_ecjpake_password_common()
1984 if (status != PSA_SUCCESS) { in mbedtls_ssl_set_hs_ecjpake_password_common()
2000 if (ssl->handshake == NULL || ssl->conf == NULL) { in mbedtls_ssl_set_hs_ecjpake_password()
2005 if ((pw == NULL) || (pw_len == 0)) { in mbedtls_ssl_set_hs_ecjpake_password()
2015 if (status != PSA_SUCCESS) { in mbedtls_ssl_set_hs_ecjpake_password()
2021 if (status != PSA_SUCCESS) { in mbedtls_ssl_set_hs_ecjpake_password()
2035 if (ssl->handshake == NULL || ssl->conf == NULL) { in mbedtls_ssl_set_hs_ecjpake_password_opaque()
2039 if (mbedtls_svc_key_id_is_null(pwd)) { in mbedtls_ssl_set_hs_ecjpake_password_opaque()
2044 if (status != PSA_SUCCESS) { in mbedtls_ssl_set_hs_ecjpake_password_opaque()
2058 if (ssl->handshake == NULL || ssl->conf == NULL) { in mbedtls_ssl_set_hs_ecjpake_password()
2063 if ((pw == NULL) || (pw_len == 0)) { in mbedtls_ssl_set_hs_ecjpake_password()
2067 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_set_hs_ecjpake_password()
2082 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
2085 if (conf->psk_identity == NULL || in mbedtls_ssl_conf_has_static_psk()
2090 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_conf_has_static_psk()
2091 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) { in mbedtls_ssl_conf_has_static_psk()
2096 if (conf->psk != NULL && conf->psk_len != 0) { in mbedtls_ssl_conf_has_static_psk()
2105 /* Remove reference to existing PSK, if any. */ in ssl_conf_remove_psk()
2106 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_conf_remove_psk()
2107 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) { in ssl_conf_remove_psk()
2113 if (conf->psk != NULL) { in ssl_conf_remove_psk()
2119 /* Remove reference to PSK identity, if any. */ in ssl_conf_remove_psk()
2120 if (conf->psk_identity != NULL) { in ssl_conf_remove_psk()
2137 if (psk_identity == NULL || in ssl_conf_set_psk_identity()
2145 if (conf->psk_identity == NULL) { in ssl_conf_set_psk_identity()
2162 if (mbedtls_ssl_conf_has_static_psk(conf)) { in mbedtls_ssl_conf_psk()
2167 if (psk == NULL) { in mbedtls_ssl_conf_psk()
2170 if (psk_len == 0) { in mbedtls_ssl_conf_psk()
2173 if (psk_len > MBEDTLS_PSK_MAX_LEN) { in mbedtls_ssl_conf_psk()
2177 if ((conf->psk = mbedtls_calloc(1, psk_len)) == NULL) { in mbedtls_ssl_conf_psk()
2185 if (ret != 0) { in mbedtls_ssl_conf_psk()
2194 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_remove_psk()
2195 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) { in ssl_remove_psk()
2198 if (ssl->handshake->psk_opaque_is_internal) { in ssl_remove_psk()
2205 if (ssl->handshake->psk != NULL) { in ssl_remove_psk()
2216 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_set_hs_psk()
2223 if (psk == NULL || ssl->handshake == NULL) { in mbedtls_ssl_set_hs_psk()
2227 if (psk_len > MBEDTLS_PSK_MAX_LEN) { in mbedtls_ssl_set_hs_psk()
2233 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_set_hs_psk()
2234 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_set_hs_psk()
2235 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) { in mbedtls_ssl_set_hs_psk()
2236 if (ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384) { in mbedtls_ssl_set_hs_psk()
2245 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_set_hs_psk()
2246 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in mbedtls_ssl_set_hs_psk()
2257 if (status != PSA_SUCCESS) { in mbedtls_ssl_set_hs_psk()
2265 if ((ssl->handshake->psk = mbedtls_calloc(1, psk_len)) == NULL) { in mbedtls_ssl_set_hs_psk()
2276 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2285 if (mbedtls_ssl_conf_has_static_psk(conf)) { in mbedtls_ssl_conf_psk_opaque()
2290 if (mbedtls_svc_key_id_is_null(psk)) { in mbedtls_ssl_conf_psk_opaque()
2298 if (ret != 0) { in mbedtls_ssl_conf_psk_opaque()
2308 if ((mbedtls_svc_key_id_is_null(psk)) || in mbedtls_ssl_set_hs_psk_opaque()
2319 #if defined(MBEDTLS_SSL_SRV_C)
2332 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2336 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) in mbedtls_ssl_get_base_mode()
2337 if (alg == PSA_ALG_CBC_NO_PADDING) { in mbedtls_ssl_get_base_mode()
2341 if (PSA_ALG_IS_AEAD(alg)) { in mbedtls_ssl_get_base_mode()
2352 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) in mbedtls_ssl_get_base_mode()
2353 if (mode == MBEDTLS_MODE_CBC) { in mbedtls_ssl_get_base_mode()
2358 #if defined(MBEDTLS_GCM_C) || \ in mbedtls_ssl_get_base_mode()
2361 if (mode == MBEDTLS_MODE_GCM || in mbedtls_ssl_get_base_mode()
2376 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in mbedtls_ssl_get_actual_mode()
2377 if (encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED && in mbedtls_ssl_get_actual_mode()
2391 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_get_mode_from_transform()
2399 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in mbedtls_ssl_get_mode_from_transform()
2406 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in mbedtls_ssl_get_mode_from_ciphersuite()
2413 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_get_mode_from_ciphersuite()
2419 if (status == PSA_SUCCESS) { in mbedtls_ssl_get_mode_from_ciphersuite()
2425 if (cipher != NULL) { in mbedtls_ssl_get_mode_from_ciphersuite()
2432 #if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in mbedtls_ssl_get_mode_from_ciphersuite()
2438 #if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
2440 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
2463 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
2471 #if defined(MBEDTLS_SSL_CLI_C) && \ in ssl_tls13_session_save()
2483 if (session->resumption_key_len > MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN) { in ssl_tls13_session_save()
2488 #if defined(MBEDTLS_HAVE_TIME) in ssl_tls13_session_save()
2492 #if defined(MBEDTLS_SSL_CLI_C) in ssl_tls13_session_save()
2493 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) { in ssl_tls13_session_save()
2494 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) in ssl_tls13_session_save()
2503 if (session->ticket_len > SIZE_MAX - needed) { in ssl_tls13_session_save()
2512 if (needed > buf_len) { in ssl_tls13_session_save()
2527 #if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C) in ssl_tls13_session_save()
2528 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) { in ssl_tls13_session_save()
2534 #if defined(MBEDTLS_SSL_CLI_C) in ssl_tls13_session_save()
2535 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) { in ssl_tls13_session_save()
2536 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) in ssl_tls13_session_save()
2539 if (hostname_len > 0) { in ssl_tls13_session_save()
2546 #if defined(MBEDTLS_HAVE_TIME) in ssl_tls13_session_save()
2556 if (session->ticket != NULL && session->ticket_len > 0) { in ssl_tls13_session_save()
2573 if (end - p < 9) { in ssl_tls13_session_load()
2585 if (end - p < session->resumption_key_len) { in ssl_tls13_session_load()
2589 if (sizeof(session->resumption_key) < session->resumption_key_len) { in ssl_tls13_session_load()
2595 #if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C) in ssl_tls13_session_load()
2596 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) { in ssl_tls13_session_load()
2597 if (end - p < 8) { in ssl_tls13_session_load()
2605 #if defined(MBEDTLS_SSL_CLI_C) in ssl_tls13_session_load()
2606 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) { in ssl_tls13_session_load()
2607 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \ in ssl_tls13_session_load()
2611 if (end - p < 2) { in ssl_tls13_session_load()
2617 if (end - p < (long int) hostname_len) { in ssl_tls13_session_load()
2620 if (hostname_len > 0) { in ssl_tls13_session_load()
2622 if (session->hostname == NULL) { in ssl_tls13_session_load()
2631 #if defined(MBEDTLS_HAVE_TIME) in ssl_tls13_session_load()
2632 if (end - p < 8) { in ssl_tls13_session_load()
2638 if (end - p < 4) { in ssl_tls13_session_load()
2644 if (end - p < 2) { in ssl_tls13_session_load()
2650 if (end - p < (long int) session->ticket_len) { in ssl_tls13_session_load()
2653 if (session->ticket_len > 0) { in ssl_tls13_session_load()
2655 if (session->ticket == NULL) { in ssl_tls13_session_load()
2838 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
2848 if ((ret = mbedtls_mpi_read_binary(&conf->dhm_P, dhm_P, P_len)) != 0 || in mbedtls_ssl_conf_dh_param_bin()
2865 if ((ret = mbedtls_dhm_get_value(dhm_ctx, MBEDTLS_DHM_PARAM_P, in mbedtls_ssl_conf_dh_param_ctx()
2878 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
2889 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
2890 #if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
2905 #if !defined(MBEDTLS_DEPRECATED_REMOVED) in mbedtls_ssl_conf_sig_algs()
2912 #if defined(MBEDTLS_ECP_C)
2913 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
2937 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED) in mbedtls_ssl_conf_groups()
2943 #if defined(MBEDTLS_X509_CRT_PARSE_C)
2949 /* Check if new hostname is valid before in mbedtls_ssl_set_hostname()
2951 if (hostname != NULL) { in mbedtls_ssl_set_hostname()
2954 if (hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN) { in mbedtls_ssl_set_hostname()
2962 if (ssl->hostname != NULL) { in mbedtls_ssl_set_hostname()
2968 if (hostname == NULL) { in mbedtls_ssl_set_hostname()
2972 if (ssl->hostname == NULL) { in mbedtls_ssl_set_hostname()
2985 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2996 #if defined(MBEDTLS_SSL_ALPN)
3012 if ((cur_len == 0) || in mbedtls_ssl_conf_alpn_protocols()
3030 #if defined(MBEDTLS_SSL_DTLS_SRTP)
3041 if (mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH) { in mbedtls_ssl_dtls_srtp_set_mki_value()
3045 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED) { in mbedtls_ssl_dtls_srtp_set_mki_value()
3065 if (mbedtls_ssl_check_srtp_profile_value(*p) != MBEDTLS_TLS_SRTP_UNSET) { in mbedtls_ssl_conf_dtls_srtp_protection_profiles()
3073 if (list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH) { in mbedtls_ssl_conf_dtls_srtp_protection_profiles()
3089 /* do not copy the mki value if there is no chosen profile */ in mbedtls_ssl_get_dtls_srtp_negotiation_result()
3090 if (dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET) { in mbedtls_ssl_get_dtls_srtp_negotiation_result()
3100 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
3112 #if defined(MBEDTLS_SSL_SRV_C)
3120 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
3127 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
3134 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3137 if (mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID || in mbedtls_ssl_conf_max_frag_len()
3153 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3171 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
3172 #if defined(MBEDTLS_SSL_CLI_C)
3179 #if defined(MBEDTLS_SSL_SRV_C)
3181 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
3209 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3232 if (ssl->handshake == NULL) { in mbedtls_ssl_get_async_operation_data()
3242 if (ssl->handshake != NULL) { in mbedtls_ssl_set_async_operation_data()
3253 if (ssl->session != NULL) { in mbedtls_ssl_get_verify_result()
3257 if (ssl->session_negotiate != NULL) { in mbedtls_ssl_get_verify_result()
3266 if (ssl == NULL || ssl->session == NULL) { in mbedtls_ssl_get_ciphersuite_id_from_ssl()
3275 if (ssl == NULL || ssl->session == NULL) { in mbedtls_ssl_get_ciphersuite()
3284 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_get_version()
3285 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_get_version()
3305 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3311 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_get_input_max_frag_len()
3312 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */ in mbedtls_ssl_get_input_max_frag_len()
3313 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && in mbedtls_ssl_get_input_max_frag_len()
3319 /* Check if a smaller max length was negotiated */ in mbedtls_ssl_get_input_max_frag_len()
3320 if (ssl->session_out != NULL) { in mbedtls_ssl_get_input_max_frag_len()
3322 if (read_mfl < max_len) { in mbedtls_ssl_get_input_max_frag_len()
3328 if (ssl->session_negotiate != NULL) { in mbedtls_ssl_get_input_max_frag_len()
3330 if (read_mfl < max_len) { in mbedtls_ssl_get_input_max_frag_len()
3347 /* Check if a smaller max length was negotiated */ in mbedtls_ssl_get_output_max_frag_len()
3348 if (ssl->session_out != NULL && in mbedtls_ssl_get_output_max_frag_len()
3354 if (ssl->session_negotiate != NULL && in mbedtls_ssl_get_output_max_frag_len()
3363 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3367 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && in mbedtls_ssl_get_current_mtu()
3373 if (ssl->handshake == NULL || ssl->handshake->mtu == 0) { in mbedtls_ssl_get_current_mtu()
3377 if (ssl->mtu == 0) { in mbedtls_ssl_get_current_mtu()
3390 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \ in mbedtls_ssl_get_max_out_record_payload()
3395 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) in mbedtls_ssl_get_max_out_record_payload()
3398 if (max_len > mfl) { in mbedtls_ssl_get_max_out_record_payload()
3403 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_get_max_out_record_payload()
3404 if (mbedtls_ssl_get_current_mtu(ssl) != 0) { in mbedtls_ssl_get_max_out_record_payload()
3409 if (ret < 0) { in mbedtls_ssl_get_max_out_record_payload()
3413 if (mtu <= overhead) { in mbedtls_ssl_get_max_out_record_payload()
3418 if (max_len > mtu - overhead) { in mbedtls_ssl_get_max_out_record_payload()
3424 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \ in mbedtls_ssl_get_max_out_record_payload()
3436 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) in mbedtls_ssl_get_max_in_record_payload()
3440 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) in mbedtls_ssl_get_max_in_record_payload()
3443 if (max_len > mfl) { in mbedtls_ssl_get_max_in_record_payload()
3451 #if defined(MBEDTLS_X509_CRT_PARSE_C)
3454 if (ssl == NULL || ssl->session == NULL) { in mbedtls_ssl_get_peer_cert()
3458 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in mbedtls_ssl_get_peer_cert()
3466 #if defined(MBEDTLS_SSL_CLI_C)
3472 if (ssl == NULL || in mbedtls_ssl_get_session()
3488 * and fail if so. in mbedtls_ssl_get_session()
3490 if (ssl->session->exported == 1) { in mbedtls_ssl_get_session()
3495 if (ret != 0) { in mbedtls_ssl_get_session()
3515 #if defined(MBEDTLS_HAVE_TIME)
3521 #if defined(MBEDTLS_X509_CRT_PARSE_C)
3527 #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
3533 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3539 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
3545 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
3622 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in ssl_session_save()
3626 if (session == NULL) { in ssl_session_save()
3630 if (!omit_header) { in ssl_session_save()
3636 if (used <= buf_len) { in ssl_session_save()
3647 if (used <= buf_len) { in ssl_session_save()
3654 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_session_save()
3660 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in ssl_session_save()
3663 if (ret != 0 && ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) { in ssl_session_save()
3675 if (used > buf_len) { in ssl_session_save()
3710 if (session == NULL) { in ssl_session_load()
3714 if (!omit_header) { in ssl_session_load()
3719 if ((size_t) (end - p) < sizeof(ssl_serialized_session_header)) { in ssl_session_load()
3723 if (memcmp(p, ssl_serialized_session_header, in ssl_session_load()
3733 if (1 > (size_t) (end - p)) { in ssl_session_load()
3741 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_session_load()
3746 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in ssl_session_load()
3765 if (ret != 0) { in mbedtls_ssl_session_load()
3783 * if the write to the network callback returned with the in ssl_prepare_handshake_step()
3795 if ((ret = mbedtls_ssl_flush_output(ssl)) != 0) { in ssl_prepare_handshake_step()
3799 #if defined(MBEDTLS_SSL_PROTO_DTLS) in ssl_prepare_handshake_step()
3800 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in ssl_prepare_handshake_step()
3802 if ((ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { in ssl_prepare_handshake_step()
3815 if (ssl == NULL || in mbedtls_ssl_handshake_step()
3823 if (ret != 0) { in mbedtls_ssl_handshake_step()
3828 if (ret != 0) { in mbedtls_ssl_handshake_step()
3832 /* If ssl->conf->endpoint is not one of MBEDTLS_SSL_IS_CLIENT or in mbedtls_ssl_handshake_step()
3836 #if defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_handshake_step()
3837 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { in mbedtls_ssl_handshake_step()
3852 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_handshake_step()
3853 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in mbedtls_ssl_handshake_step()
3867 #if defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_handshake_step()
3868 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_handshake_step()
3869 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_handshake_step()
3870 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in mbedtls_ssl_handshake_step()
3883 if (ret != 0) { in mbedtls_ssl_handshake_step()
3887 if (ssl->send_alert) { in mbedtls_ssl_handshake_step()
3906 if (ssl == NULL || ssl->conf == NULL) { in mbedtls_ssl_handshake()
3910 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_handshake()
3911 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_handshake()
3925 if (ret != 0) { in mbedtls_ssl_handshake()
3935 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3936 #if defined(MBEDTLS_SSL_SRV_C)
3951 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { in ssl_write_hello_request()
3968 * If the handshake doesn't complete due to waiting for I/O, it will continue
3977 if ((ret = ssl_handshake_init(ssl)) != 0) { in mbedtls_ssl_start_renegotiation()
3983 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_start_renegotiation()
3984 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_start_renegotiation()
3986 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_start_renegotiation()
3997 if ((ret = mbedtls_ssl_handshake(ssl)) != 0) { in mbedtls_ssl_start_renegotiation()
4015 if (ssl == NULL || ssl->conf == NULL) { in mbedtls_ssl_renegotiate()
4019 #if defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_renegotiate()
4021 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_renegotiate()
4022 if (mbedtls_ssl_is_handshake_over(ssl) == 0) { in mbedtls_ssl_renegotiate()
4029 if (ssl->out_left != 0) { in mbedtls_ssl_renegotiate()
4037 #if defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_renegotiate()
4040 * if already in progress, continue the handshake in mbedtls_ssl_renegotiate()
4042 if (ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { in mbedtls_ssl_renegotiate()
4043 if (mbedtls_ssl_is_handshake_over(ssl) == 0) { in mbedtls_ssl_renegotiate()
4047 if ((ret = mbedtls_ssl_start_renegotiation(ssl)) != 0) { in mbedtls_ssl_renegotiate()
4052 if ((ret = mbedtls_ssl_handshake(ssl)) != 0) { in mbedtls_ssl_renegotiate()
4067 if (handshake == NULL) { in mbedtls_ssl_handshake_free()
4071 #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) in mbedtls_ssl_handshake_free()
4072 #if !defined(MBEDTLS_DEPRECATED_REMOVED) in mbedtls_ssl_handshake_free()
4073 if (ssl->handshake->group_list_heap_allocated) { in mbedtls_ssl_handshake_free()
4080 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) in mbedtls_ssl_handshake_free()
4081 #if !defined(MBEDTLS_DEPRECATED_REMOVED) in mbedtls_ssl_handshake_free()
4082 if (ssl->handshake->sig_algs_heap_allocated) { in mbedtls_ssl_handshake_free()
4087 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_handshake_free()
4088 if (ssl->handshake->certificate_request_context) { in mbedtls_ssl_handshake_free()
4094 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) in mbedtls_ssl_handshake_free()
4095 if (ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0) { in mbedtls_ssl_handshake_free()
4101 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_handshake_free()
4102 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_handshake_free()
4108 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_handshake_free()
4109 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_handshake_free()
4116 #if defined(MBEDTLS_DHM_C) in mbedtls_ssl_handshake_free()
4119 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ in mbedtls_ssl_handshake_free()
4124 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) in mbedtls_ssl_handshake_free()
4125 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_handshake_free()
4132 if (!mbedtls_svc_key_id_is_null(handshake->psa_pake_password)) { in mbedtls_ssl_handshake_free()
4139 #if defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_handshake_free()
4146 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) || \ in mbedtls_ssl_handshake_free()
4153 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) in mbedtls_ssl_handshake_free()
4154 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_handshake_free()
4155 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) { in mbedtls_ssl_handshake_free()
4158 if (ssl->handshake->psk_opaque_is_internal) { in mbedtls_ssl_handshake_free()
4165 if (handshake->psk != NULL) { in mbedtls_ssl_handshake_free()
4171 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ in mbedtls_ssl_handshake_free()
4180 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) in mbedtls_ssl_handshake_free()
4182 if (handshake->ecrs_peer_cert != NULL) { in mbedtls_ssl_handshake_free()
4188 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ in mbedtls_ssl_handshake_free()
4193 #if defined(MBEDTLS_SSL_CLI_C) && \ in mbedtls_ssl_handshake_free()
4199 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_handshake_free()
4204 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED) in mbedtls_ssl_handshake_free()
4205 if (handshake->xxdh_psa_privkey_is_external == 0) { in mbedtls_ssl_handshake_free()
4210 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_handshake_free()
4213 #if defined(MBEDTLS_SSL_EARLY_DATA) in mbedtls_ssl_handshake_free()
4220 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) in mbedtls_ssl_handshake_free()
4221 /* If the buffers are too big - reallocate. Because of the way Mbed TLS in mbedtls_ssl_handshake_free()
4236 if (session == NULL) { in mbedtls_ssl_session_free()
4240 #if defined(MBEDTLS_X509_CRT_PARSE_C) in mbedtls_ssl_session_free()
4244 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_session_free()
4245 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ in mbedtls_ssl_session_free()
4255 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
4257 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4265 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4271 #if defined(MBEDTLS_SSL_ALPN)
4361 if (mbedtls_ssl_is_handshake_over(ssl) == 0) { in mbedtls_ssl_context_save()
4365 if (ssl->handshake != NULL) { in mbedtls_ssl_context_save()
4370 if (ssl->transform == NULL || ssl->session == NULL) { in mbedtls_ssl_context_save()
4375 if (mbedtls_ssl_check_pending(ssl) != 0) { in mbedtls_ssl_context_save()
4379 if (ssl->out_left != 0) { in mbedtls_ssl_context_save()
4384 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_context_save()
4389 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2) { in mbedtls_ssl_context_save()
4394 if (mbedtls_ssl_transform_uses_aead(ssl->transform) != 1) { in mbedtls_ssl_context_save()
4399 #if defined(MBEDTLS_SSL_RENEGOTIATION) in mbedtls_ssl_context_save()
4400 if (ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED) { in mbedtls_ssl_context_save()
4411 if (used <= buf_len) { in mbedtls_ssl_context_save()
4421 if (ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) { in mbedtls_ssl_context_save()
4426 if (used <= buf_len) { in mbedtls_ssl_context_save()
4432 if (ret != 0) { in mbedtls_ssl_context_save()
4443 if (used <= buf_len) { in mbedtls_ssl_context_save()
4449 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) in mbedtls_ssl_context_save()
4451 if (used <= buf_len) { in mbedtls_ssl_context_save()
4466 if (used <= buf_len) { in mbedtls_ssl_context_save()
4471 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) in mbedtls_ssl_context_save()
4473 if (used <= buf_len) { in mbedtls_ssl_context_save()
4482 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_context_save()
4484 if (used <= buf_len) { in mbedtls_ssl_context_save()
4490 if (used <= buf_len) { in mbedtls_ssl_context_save()
4495 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_context_save()
4497 if (used <= buf_len) { in mbedtls_ssl_context_save()
4503 #if defined(MBEDTLS_SSL_ALPN) in mbedtls_ssl_context_save()
4510 if (used <= buf_len) { in mbedtls_ssl_context_save()
4513 if (ssl->alpn_chosen != NULL) { in mbedtls_ssl_context_save()
4526 if (used > buf_len) { in mbedtls_ssl_context_save()
4550 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_context_load()
4557 * (Checking session is useful because it won't be NULL if we're in ssl_context_load()
4558 * renegotiating, or if the user mistakenly loaded a session first.) in ssl_context_load()
4560 if (ssl->state != MBEDTLS_SSL_HELLO_REQUEST || in ssl_context_load()
4569 if ( in ssl_context_load()
4570 #if defined(MBEDTLS_SSL_RENEGOTIATION) in ssl_context_load()
4585 if ((size_t) (end - p) < sizeof(ssl_serialized_context_header)) { in ssl_context_load()
4589 if (memcmp(p, ssl_serialized_context_header, in ssl_context_load()
4598 if ((size_t) (end - p) < 4) { in ssl_context_load()
4612 if ((size_t) (end - p) < session_len) { in ssl_context_load()
4617 if (ret != 0) { in ssl_context_load()
4630 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_context_load()
4637 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in ssl_context_load()
4639 if (prf_func == NULL) { in ssl_context_load()
4644 if ((size_t) (end - p) < sizeof(ssl->transform->randbytes)) { in ssl_context_load()
4651 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in ssl_context_load()
4659 if (ret != 0) { in ssl_context_load()
4665 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) in ssl_context_load()
4667 if ((size_t) (end - p) < 1) { in ssl_context_load()
4673 if ((size_t) (end - p) < ssl->transform->in_cid_len + 1u) { in ssl_context_load()
4682 if ((size_t) (end - p) < ssl->transform->out_cid_len) { in ssl_context_load()
4693 if ((size_t) (end - p) < 4) { in ssl_context_load()
4700 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) in ssl_context_load()
4701 if ((size_t) (end - p) < 16) { in ssl_context_load()
4712 #if defined(MBEDTLS_SSL_PROTO_DTLS) in ssl_context_load()
4713 if ((size_t) (end - p) < 1) { in ssl_context_load()
4720 if ((size_t) (end - p) < sizeof(ssl->cur_out_ctr)) { in ssl_context_load()
4726 #if defined(MBEDTLS_SSL_PROTO_DTLS) in ssl_context_load()
4727 if ((size_t) (end - p) < 2) { in ssl_context_load()
4735 #if defined(MBEDTLS_SSL_ALPN) in ssl_context_load()
4740 if ((size_t) (end - p) < 1) { in ssl_context_load()
4746 if (alpn_len != 0 && ssl->conf->alpn_list != NULL) { in ssl_context_load()
4749 if (strlen(*cur) == alpn_len && in ssl_context_load()
4758 if (alpn_len != 0 && ssl->alpn_chosen == NULL) { in ssl_context_load()
4779 #if defined(MBEDTLS_SSL_PROTO_DTLS) in ssl_context_load()
4787 if (ssl->handshake != NULL) { in ssl_context_load()
4796 if (p != end) { in ssl_context_load()
4812 if (ret != 0) { in mbedtls_ssl_context_load()
4825 if (ssl == NULL) { in mbedtls_ssl_free()
4831 if (ssl->out_buf != NULL) { in mbedtls_ssl_free()
4832 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) in mbedtls_ssl_free()
4842 if (ssl->in_buf != NULL) { in mbedtls_ssl_free()
4843 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) in mbedtls_ssl_free()
4853 if (ssl->transform) { in mbedtls_ssl_free()
4858 if (ssl->handshake) { in mbedtls_ssl_free()
4862 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_free()
4871 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_free()
4876 if (ssl->session) { in mbedtls_ssl_free()
4881 #if defined(MBEDTLS_X509_CRT_PARSE_C) in mbedtls_ssl_free()
4882 if (ssl->hostname != NULL) { in mbedtls_ssl_free()
4887 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_free()
4912 #if defined(MBEDTLS_ECP_HAVE_CURVE25519)
4915 #if defined(MBEDTLS_ECP_HAVE_SECP256R1)
4918 #if defined(MBEDTLS_ECP_HAVE_SECP384R1)
4921 #if defined(MBEDTLS_ECP_HAVE_CURVE448)
4924 #if defined(MBEDTLS_ECP_HAVE_SECP521R1)
4927 #if defined(MBEDTLS_ECP_HAVE_BP256R1)
4930 #if defined(MBEDTLS_ECP_HAVE_BP384R1)
4933 #if defined(MBEDTLS_ECP_HAVE_BP512R1)
4936 #if defined(PSA_WANT_ALG_FFDH)
4952 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
4958 * - But if there is a good reason, do not change the order of the algorithms.
4964 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
4971 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
4978 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
4985 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
4991 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
4997 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
5003 #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA512)
5007 #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA384)
5011 #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA256)
5019 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5021 #if defined(MBEDTLS_MD_CAN_SHA512)
5022 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
5025 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5028 #if defined(MBEDTLS_RSA_C)
5032 #if defined(MBEDTLS_MD_CAN_SHA384)
5033 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
5036 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5039 #if defined(MBEDTLS_RSA_C)
5043 #if defined(MBEDTLS_MD_CAN_SHA256)
5044 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
5047 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5050 #if defined(MBEDTLS_RSA_C)
5060 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
5067 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
5074 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
5080 #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA256)
5088 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5090 #if defined(MBEDTLS_MD_CAN_SHA256)
5091 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
5094 #if defined(MBEDTLS_RSA_C)
5098 #if defined(MBEDTLS_MD_CAN_SHA384)
5099 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
5102 #if defined(MBEDTLS_RSA_C)
5113 #if defined(MBEDTLS_ECP_HAVE_SECP256R1)
5116 #if defined(MBEDTLS_ECP_HAVE_SECP384R1)
5122 #if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
5133 if (sig_algs[i] != sig_algs[j]) { in ssl_check_no_sig_alg_duplication()
5153 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_config_defaults()
5157 #if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) in mbedtls_ssl_config_defaults()
5158 if (ssl_check_no_sig_alg_duplication(ssl_preset_suiteb_sig_algs)) { in mbedtls_ssl_config_defaults()
5163 if (ssl_check_no_sig_alg_duplication(ssl_preset_default_sig_algs)) { in mbedtls_ssl_config_defaults()
5168 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_config_defaults()
5169 if (ssl_check_no_sig_alg_duplication(ssl_tls12_preset_suiteb_sig_algs)) { in mbedtls_ssl_config_defaults()
5174 if (ssl_check_no_sig_alg_duplication(ssl_tls12_preset_default_sig_algs)) { in mbedtls_ssl_config_defaults()
5189 #if defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_config_defaults()
5190 if (endpoint == MBEDTLS_SSL_IS_CLIENT) { in mbedtls_ssl_config_defaults()
5192 #if defined(MBEDTLS_SSL_SESSION_TICKETS) in mbedtls_ssl_config_defaults()
5198 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) in mbedtls_ssl_config_defaults()
5202 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) in mbedtls_ssl_config_defaults()
5206 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_config_defaults()
5211 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) in mbedtls_ssl_config_defaults()
5215 #if defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_config_defaults()
5220 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_config_defaults()
5225 #if defined(MBEDTLS_SSL_RENEGOTIATION) in mbedtls_ssl_config_defaults()
5231 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_config_defaults()
5232 if (endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_config_defaults()
5238 if ((ret = mbedtls_ssl_conf_dh_param_bin(conf, in mbedtls_ssl_config_defaults()
5246 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_config_defaults()
5248 #if defined(MBEDTLS_SSL_EARLY_DATA) in mbedtls_ssl_config_defaults()
5250 #if defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_config_defaults()
5256 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SESSION_TICKETS) in mbedtls_ssl_config_defaults()
5266 if (transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_config_defaults()
5267 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_config_defaults()
5274 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_config_defaults()
5299 #if defined(MBEDTLS_X509_CRT_PARSE_C) in mbedtls_ssl_config_defaults()
5303 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) in mbedtls_ssl_config_defaults()
5304 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_config_defaults()
5305 if (mbedtls_ssl_conf_is_tls12_only(conf)) { in mbedtls_ssl_config_defaults()
5312 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED) in mbedtls_ssl_config_defaults()
5325 #if defined(MBEDTLS_X509_CRT_PARSE_C) in mbedtls_ssl_config_defaults()
5329 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) in mbedtls_ssl_config_defaults()
5330 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_config_defaults()
5331 if (mbedtls_ssl_conf_is_tls12_only(conf)) { in mbedtls_ssl_config_defaults()
5338 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED) in mbedtls_ssl_config_defaults()
5343 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_config_defaults()
5356 #if defined(MBEDTLS_DHM_C) in mbedtls_ssl_config_free()
5361 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) in mbedtls_ssl_config_free()
5362 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_config_free()
5363 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) { in mbedtls_ssl_config_free()
5367 if (conf->psk != NULL) { in mbedtls_ssl_config_free()
5373 if (conf->psk_identity != NULL) { in mbedtls_ssl_config_free()
5380 #if defined(MBEDTLS_X509_CRT_PARSE_C) in mbedtls_ssl_config_free()
5387 #if defined(MBEDTLS_PK_C) && \
5394 #if defined(MBEDTLS_RSA_C) in mbedtls_ssl_sig_from_pk()
5395 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_RSA)) { in mbedtls_ssl_sig_from_pk()
5399 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) in mbedtls_ssl_sig_from_pk()
5400 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_ECDSA)) { in mbedtls_ssl_sig_from_pk()
5423 #if defined(MBEDTLS_RSA_C) in mbedtls_ssl_pk_alg_from_sig()
5427 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) in mbedtls_ssl_pk_alg_from_sig()
5444 #if defined(MBEDTLS_MD_CAN_MD5) in mbedtls_ssl_md_alg_from_hash()
5448 #if defined(MBEDTLS_MD_CAN_SHA1) in mbedtls_ssl_md_alg_from_hash()
5452 #if defined(MBEDTLS_MD_CAN_SHA224) in mbedtls_ssl_md_alg_from_hash()
5456 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_md_alg_from_hash()
5460 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_md_alg_from_hash()
5464 #if defined(MBEDTLS_MD_CAN_SHA512) in mbedtls_ssl_md_alg_from_hash()
5479 #if defined(MBEDTLS_MD_CAN_MD5) in mbedtls_ssl_hash_from_md_alg()
5483 #if defined(MBEDTLS_MD_CAN_SHA1) in mbedtls_ssl_hash_from_md_alg()
5487 #if defined(MBEDTLS_MD_CAN_SHA224) in mbedtls_ssl_hash_from_md_alg()
5491 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_hash_from_md_alg()
5495 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_hash_from_md_alg()
5499 #if defined(MBEDTLS_MD_CAN_SHA512) in mbedtls_ssl_hash_from_md_alg()
5509 * Check if a curve proposed by the peer is in our list.
5510 * Return 0 if we're willing to use it, -1 otherwise.
5516 if (group_list == NULL) { in mbedtls_ssl_check_curve_tls_id()
5521 if (*group_list == tls_id) { in mbedtls_ssl_check_curve_tls_id()
5529 #if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
5537 if (tls_id == 0) { in mbedtls_ssl_check_curve()
5552 #if defined(MBEDTLS_ECP_HAVE_SECP521R1)
5555 #if defined(MBEDTLS_ECP_HAVE_BP512R1)
5558 #if defined(MBEDTLS_ECP_HAVE_SECP384R1)
5561 #if defined(MBEDTLS_ECP_HAVE_BP384R1)
5564 #if defined(MBEDTLS_ECP_HAVE_SECP256R1)
5567 #if defined(MBEDTLS_ECP_HAVE_SECP256K1)
5570 #if defined(MBEDTLS_ECP_HAVE_BP256R1)
5573 #if defined(MBEDTLS_ECP_HAVE_SECP224R1)
5576 #if defined(MBEDTLS_ECP_HAVE_SECP224K1)
5579 #if defined(MBEDTLS_ECP_HAVE_SECP192R1)
5582 #if defined(MBEDTLS_ECP_HAVE_SECP192K1)
5585 #if defined(MBEDTLS_ECP_HAVE_CURVE25519)
5588 #if defined(MBEDTLS_ECP_HAVE_CURVE448)
5599 if (tls_id_match_table[i].tls_id == tls_id) { in mbedtls_ssl_get_psa_curve_info_from_tls_id()
5600 if (type != NULL) { in mbedtls_ssl_get_psa_curve_info_from_tls_id()
5603 if (bits != NULL) { in mbedtls_ssl_get_psa_curve_info_from_tls_id()
5616 if (tls_id_match_table[i].tls_id == tls_id) { in mbedtls_ssl_get_ecp_group_id_from_tls_id()
5628 if (tls_id_match_table[i].ecp_group_id == grp_id) { in mbedtls_ssl_get_tls_id_from_ecp_group_id()
5636 #if defined(MBEDTLS_DEBUG_C)
5661 if (tls_id_curve_name_table[i].tls_id == tls_id) { in mbedtls_ssl_get_curve_name_from_tls_id()
5670 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5681 if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_check_cert_usage()
5713 if (mbedtls_x509_crt_check_key_usage(cert, usage) != 0) { in mbedtls_ssl_check_cert_usage()
5718 if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_check_cert_usage()
5726 if (mbedtls_x509_crt_check_extended_key_usage(cert, ext_oid, ext_len) != 0) { in mbedtls_ssl_check_cert_usage()
5735 #if defined(MBEDTLS_USE_PSA_CRYPTO)
5749 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_get_handshake_transcript()
5755 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_get_handshake_transcript()
5766 if (status != PSA_SUCCESS) { in mbedtls_ssl_get_handshake_transcript()
5771 if (status != PSA_SUCCESS) { in mbedtls_ssl_get_handshake_transcript()
5776 #if !defined(MBEDTLS_MD_CAN_SHA384) && \ in mbedtls_ssl_get_handshake_transcript()
5784 #if defined(MBEDTLS_MD_CAN_SHA384)
5794 if (dst_len < 48) { in ssl_get_handshake_transcript_sha384()
5800 if (ret != 0) { in ssl_get_handshake_transcript_sha384()
5804 if (ret != 0) { in ssl_get_handshake_transcript_sha384()
5808 if ((ret = mbedtls_md_finish(&sha384, dst)) != 0) { in ssl_get_handshake_transcript_sha384()
5822 #if defined(MBEDTLS_MD_CAN_SHA256)
5832 if (dst_len < 32) { in ssl_get_handshake_transcript_sha256()
5838 if (ret != 0) { in ssl_get_handshake_transcript_sha256()
5842 if (ret != 0) { in ssl_get_handshake_transcript_sha256()
5846 if ((ret = mbedtls_md_finish(&sha256, dst)) != 0) { in ssl_get_handshake_transcript_sha256()
5868 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_get_handshake_transcript()
5873 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_get_handshake_transcript()
5879 #if !defined(MBEDTLS_MD_CAN_SHA384) && \ in mbedtls_ssl_get_handshake_transcript()
5893 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
5960 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) in mbedtls_ssl_parse_sig_alg_ext()
5961 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 && in mbedtls_ssl_parse_sig_alg_ext()
5971 if (common_idx + 1 < MBEDTLS_RECEIVED_SIG_ALGS_SIZE) { in mbedtls_ssl_parse_sig_alg_ext()
5977 if (p != end) { in mbedtls_ssl_parse_sig_alg_ext()
5985 if (common_idx == 0) { in mbedtls_ssl_parse_sig_alg_ext()
5998 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6000 #if defined(MBEDTLS_USE_PSA_CRYPTO)
6015 if (status != PSA_SUCCESS) { in setup_psa_key_derivation()
6019 if (PSA_ALG_IS_TLS12_PRF(alg) || PSA_ALG_IS_TLS12_PSK_TO_MS(alg)) { in setup_psa_key_derivation()
6023 if (status != PSA_SUCCESS) { in setup_psa_key_derivation()
6027 if (other_secret != NULL) { in setup_psa_key_derivation()
6031 if (status != PSA_SUCCESS) { in setup_psa_key_derivation()
6036 if (mbedtls_svc_key_id_is_null(key)) { in setup_psa_key_derivation()
6044 if (status != PSA_SUCCESS) { in setup_psa_key_derivation()
6051 if (status != PSA_SUCCESS) { in setup_psa_key_derivation()
6059 if (status != PSA_SUCCESS) { in setup_psa_key_derivation()
6066 #if defined(PSA_WANT_ALG_SHA_384) || \
6081 if (md_type == MBEDTLS_MD_SHA384) { in tls_prf_generic()
6094 if (slen != 0) { in tls_prf_generic()
6101 if (status != PSA_SUCCESS) { in tls_prf_generic()
6114 if (status != PSA_SUCCESS) { in tls_prf_generic()
6121 if (status != PSA_SUCCESS) { in tls_prf_generic()
6128 if (status != PSA_SUCCESS) { in tls_prf_generic()
6133 if (!mbedtls_svc_key_id_is_null(master_key)) { in tls_prf_generic()
6136 if (status != PSA_SUCCESS) { in tls_prf_generic()
6145 #if defined(MBEDTLS_MD_C) && \
6166 if ((md_info = mbedtls_md_info_from_type(md_type)) == NULL) { in tls_prf_generic()
6174 if (tmp == NULL) { in tls_prf_generic()
6187 if ((ret = mbedtls_md_setup(&md_ctx, md_info, 1)) != 0) { in tls_prf_generic()
6192 if (ret != 0) { in tls_prf_generic()
6196 if (ret != 0) { in tls_prf_generic()
6200 if (ret != 0) { in tls_prf_generic()
6206 if (ret != 0) { in tls_prf_generic()
6210 if (ret != 0) { in tls_prf_generic()
6214 if (ret != 0) { in tls_prf_generic()
6219 if (ret != 0) { in tls_prf_generic()
6223 if (ret != 0) { in tls_prf_generic()
6227 if (ret != 0) { in tls_prf_generic()
6241 if (tmp != NULL) { in tls_prf_generic()
6254 #if defined(MBEDTLS_MD_CAN_SHA256)
6266 #if defined(MBEDTLS_MD_CAN_SHA384)
6291 #if defined(MBEDTLS_MD_CAN_SHA384) in ssl_set_handshake_prfs()
6292 if (hash == MBEDTLS_MD_SHA384) { in ssl_set_handshake_prfs()
6298 #if defined(MBEDTLS_MD_CAN_SHA256) in ssl_set_handshake_prfs()
6317 * Compute master secret if needed
6341 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) in ssl_compute_master()
6352 * - If the Extended Master Secret extension is not used, in ssl_compute_master()
6355 * - If the Extended Master Secret extension is used, in ssl_compute_master()
6361 #if !defined(MBEDTLS_DEBUG_C) && \ in ssl_compute_master()
6369 if (handshake->resume != 0) { in ssl_compute_master()
6374 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) in ssl_compute_master()
6375 if (handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) { in ssl_compute_master()
6379 if (ret != 0) { in ssl_compute_master()
6388 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \ in ssl_compute_master()
6390 if (mbedtls_ssl_ciphersuite_uses_psk(handshake->ciphersuite_info) == 1) { in ssl_compute_master()
6403 if (hash_alg == MBEDTLS_MD_SHA384) { in ssl_compute_master()
6438 if (status != PSA_SUCCESS) { in ssl_compute_master()
6446 if (status != PSA_SUCCESS) { in ssl_compute_master()
6452 if (status != PSA_SUCCESS) { in ssl_compute_master()
6458 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \ in ssl_compute_master()
6460 if (handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) { in ssl_compute_master()
6471 if (status != PSA_SUCCESS) { in ssl_compute_master()
6477 if (status != PSA_SUCCESS) { in ssl_compute_master()
6484 if (status != PSA_SUCCESS) { in ssl_compute_master()
6492 if (status != PSA_SUCCESS) { in ssl_compute_master()
6498 if (status != PSA_SUCCESS) { in ssl_compute_master()
6507 if (ret != 0) { in ssl_compute_master()
6534 if (ret != 0) { in mbedtls_ssl_derive_keys()
6539 /* Compute master secret if needed */ in mbedtls_ssl_derive_keys()
6543 if (ret != 0) { in mbedtls_ssl_derive_keys()
6563 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in mbedtls_ssl_derive_keys()
6571 if (ret != 0) { in mbedtls_ssl_derive_keys()
6588 #if defined(MBEDTLS_MD_CAN_SHA384) in mbedtls_ssl_set_calc_verify_md()
6593 #if defined(MBEDTLS_MD_CAN_SHA256) in mbedtls_ssl_set_calc_verify_md()
6601 #if !defined(MBEDTLS_MD_CAN_SHA384) && \ in mbedtls_ssl_set_calc_verify_md()
6608 #if defined(MBEDTLS_USE_PSA_CRYPTO)
6618 #if !defined(MBEDTLS_DEBUG_C) in ssl_calc_verify_tls_psa()
6623 if (status != PSA_SUCCESS) { in ssl_calc_verify_tls_psa()
6628 if (status != PSA_SUCCESS) { in ssl_calc_verify_tls_psa()
6650 #if !defined(MBEDTLS_DEBUG_C) in ssl_calc_verify_tls_legacy()
6656 if (ret != 0) { in ssl_calc_verify_tls_legacy()
6660 if (ret != 0) { in ssl_calc_verify_tls_legacy()
6665 if (ret != 0) { in ssl_calc_verify_tls_legacy()
6680 #if defined(MBEDTLS_MD_CAN_SHA256)
6685 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_calc_verify_tls_sha256()
6695 #if defined(MBEDTLS_MD_CAN_SHA384)
6700 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_calc_verify_tls_sha384()
6710 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
6720 if (psk_ret == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED) { in mbedtls_ssl_psk_derive_premaster()
6728 if (key_ex != MBEDTLS_KEY_EXCHANGE_DHE_PSK) { in mbedtls_ssl_psk_derive_premaster()
6741 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) in mbedtls_ssl_psk_derive_premaster()
6742 if (key_ex == MBEDTLS_KEY_EXCHANGE_PSK) { in mbedtls_ssl_psk_derive_premaster()
6743 if (end - p < 2) { in mbedtls_ssl_psk_derive_premaster()
6750 if (end < p || (size_t) (end - p) < psk_len) { in mbedtls_ssl_psk_derive_premaster()
6758 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) in mbedtls_ssl_psk_derive_premaster()
6759 if (key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK) { in mbedtls_ssl_psk_derive_premaster()
6764 if (end - p < 2) { in mbedtls_ssl_psk_derive_premaster()
6773 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) in mbedtls_ssl_psk_derive_premaster()
6774 if (key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK) { in mbedtls_ssl_psk_derive_premaster()
6779 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx, in mbedtls_ssl_psk_derive_premaster()
6791 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) in mbedtls_ssl_psk_derive_premaster()
6792 if (key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) { in mbedtls_ssl_psk_derive_premaster()
6796 if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx, &zlen, in mbedtls_ssl_psk_derive_premaster()
6816 if (end - p < 2) { in mbedtls_ssl_psk_derive_premaster()
6823 if (end < p || (size_t) (end - p) < psk_len) { in mbedtls_ssl_psk_derive_premaster()
6836 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
6840 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6843 /* If renegotiation is not enforced, retransmit until we would reach max in mbedtls_ssl_resend_hello_request()
6844 * timeout if we were using the usual handshake doubling scheme */ in mbedtls_ssl_resend_hello_request()
6845 if (ssl->conf->renego_max_records < 0) { in mbedtls_ssl_resend_hello_request()
6854 if (++ssl->renego_records_seen > doublings) { in mbedtls_ssl_resend_hello_request()
6868 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6877 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) { in mbedtls_ssl_write_certificate()
6894 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) { in mbedtls_ssl_parse_certificate()
6917 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) { in mbedtls_ssl_write_certificate()
6923 #if defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_write_certificate()
6924 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { in mbedtls_ssl_write_certificate()
6925 if (ssl->handshake->client_auth == 0) { in mbedtls_ssl_write_certificate()
6932 #if defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_write_certificate()
6933 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_write_certificate()
6934 if (mbedtls_ssl_own_cert(ssl) == NULL) { in mbedtls_ssl_write_certificate()
6936 * ciphersuite if we don't have a certificate. */ in mbedtls_ssl_write_certificate()
6958 if (n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i) { in mbedtls_ssl_write_certificate()
6983 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { in mbedtls_ssl_write_certificate()
6993 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6995 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7003 if (peer_crt == NULL) { in ssl_check_peer_crt_unchanged()
7007 if (peer_crt->raw.len != crt_buf_len) { in ssl_check_peer_crt_unchanged()
7029 if (peer_cert_digest == NULL || digest_info == NULL) { in ssl_check_peer_crt_unchanged()
7034 if (digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN) { in ssl_check_peer_crt_unchanged()
7039 if (ret != 0) { in ssl_check_peer_crt_unchanged()
7057 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C) in ssl_parse_certificate_chain()
7063 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) { in ssl_parse_certificate_chain()
7070 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE) { in ssl_parse_certificate_chain()
7076 if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 3 + 3) { in ssl_parse_certificate_chain()
7090 if (ssl->in_msg[i] != 0 || in ssl_parse_certificate_chain()
7104 if (i + 3 > ssl->in_hslen) { in ssl_parse_certificate_chain()
7113 if (ssl->in_msg[i] != 0) { in ssl_parse_certificate_chain()
7126 if (n < 128 || i + n > ssl->in_hslen) { in ssl_parse_certificate_chain()
7134 /* Check if we're handling the first CRT in the chain. */ in ssl_parse_certificate_chain()
7135 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C) in ssl_parse_certificate_chain()
7136 if (crt_cnt++ == 0 && in ssl_parse_certificate_chain()
7144 if (ssl_check_peer_crt_unchanged(ssl, in ssl_parse_certificate_chain()
7160 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in ssl_parse_certificate_chain()
7163 /* If we don't need to store the CRT chain permanently, parse in ssl_parse_certificate_chain()
7197 #if defined(MBEDTLS_SSL_SRV_C)
7201 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { in ssl_srv_check_client_no_crt_notification()
7205 if (ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len(ssl) && in ssl_srv_check_client_no_crt_notification()
7216 /* Check if a certificate message is expected.
7231 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) { in ssl_parse_certificate_coordinate()
7235 #if defined(MBEDTLS_SSL_SRV_C) in ssl_parse_certificate_coordinate()
7236 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in ssl_parse_certificate_coordinate()
7237 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) { in ssl_parse_certificate_coordinate()
7241 if (authmode == MBEDTLS_SSL_VERIFY_NONE) { in ssl_parse_certificate_coordinate()
7268 if (authmode == MBEDTLS_SSL_VERIFY_NONE) { in ssl_parse_certificate_verify()
7272 if (ssl->f_vrfy != NULL) { in ssl_parse_certificate_verify()
7285 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) in ssl_parse_certificate_verify()
7286 if (ssl->conf->f_ca_cb != NULL) { in ssl_parse_certificate_verify()
7305 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) in ssl_parse_certificate_verify()
7306 if (ssl->handshake->sni_ca_chain != NULL) { in ssl_parse_certificate_verify()
7316 if (ca_chain != NULL) { in ssl_parse_certificate_verify()
7329 if (ret != 0) { in ssl_parse_certificate_verify()
7333 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) in ssl_parse_certificate_verify()
7334 if (ret == MBEDTLS_ERR_ECP_IN_PROGRESS) { in ssl_parse_certificate_verify()
7340 * Secondary checks: always done, but change 'ret' only if it was 0 in ssl_parse_certificate_verify()
7343 #if defined(MBEDTLS_PK_HAVE_ECC_KEYS) in ssl_parse_certificate_verify()
7347 /* If certificate uses an EC key, make sure the curve is OK. in ssl_parse_certificate_verify()
7350 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_ECKEY)) { in ssl_parse_certificate_verify()
7355 if (grp_id == MBEDTLS_ECP_DP_NONE) { in ssl_parse_certificate_verify()
7359 if (mbedtls_ssl_check_curve(ssl, grp_id) != 0) { in ssl_parse_certificate_verify()
7364 if (ret == 0) { in ssl_parse_certificate_verify()
7372 if (mbedtls_ssl_check_cert_usage(chain, in ssl_parse_certificate_verify()
7377 if (ret == 0) { in ssl_parse_certificate_verify()
7387 * ssl_parse_certificate even if verification was optional. */ in ssl_parse_certificate_verify()
7388 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL && in ssl_parse_certificate_verify()
7394 if (have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED) { in ssl_parse_certificate_verify()
7399 if (ret != 0) { in ssl_parse_certificate_verify()
7405 if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER) { in ssl_parse_certificate_verify()
7407 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH) { in ssl_parse_certificate_verify()
7409 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE) { in ssl_parse_certificate_verify()
7411 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE) { in ssl_parse_certificate_verify()
7413 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE) { in ssl_parse_certificate_verify()
7415 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK) { in ssl_parse_certificate_verify()
7417 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY) { in ssl_parse_certificate_verify()
7419 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED) { in ssl_parse_certificate_verify()
7421 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED) { in ssl_parse_certificate_verify()
7423 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED) { in ssl_parse_certificate_verify()
7432 #if defined(MBEDTLS_DEBUG_C) in ssl_parse_certificate_verify()
7433 if (ssl->session_negotiate->verify_result != 0) { in ssl_parse_certificate_verify()
7444 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7453 if (ssl->session_negotiate->peer_cert_digest == NULL) { in ssl_remember_peer_crt_digest()
7487 if (ret != 0) { in ssl_remember_peer_pubkey()
7500 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) in mbedtls_ssl_parse_certificate()
7513 if (crt_expected == SSL_CERTIFICATE_SKIP) { in mbedtls_ssl_parse_certificate()
7518 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) in mbedtls_ssl_parse_certificate()
7519 if (ssl->handshake->ecrs_enabled && in mbedtls_ssl_parse_certificate()
7527 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) { in mbedtls_ssl_parse_certificate()
7534 #if defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_parse_certificate()
7535 if (ssl_srv_check_client_no_crt_notification(ssl) == 0) { in mbedtls_ssl_parse_certificate()
7538 if (authmode != MBEDTLS_SSL_VERIFY_OPTIONAL) { in mbedtls_ssl_parse_certificate()
7551 if (chain == NULL) { in mbedtls_ssl_parse_certificate()
7564 if (ret != 0) { in mbedtls_ssl_parse_certificate()
7568 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) in mbedtls_ssl_parse_certificate()
7569 if (ssl->handshake->ecrs_enabled) { in mbedtls_ssl_parse_certificate()
7574 if (ssl->handshake->ecrs_enabled) { in mbedtls_ssl_parse_certificate()
7581 if (ret != 0) { in mbedtls_ssl_parse_certificate()
7585 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in mbedtls_ssl_parse_certificate()
7608 if (ret != 0) { in mbedtls_ssl_parse_certificate()
7613 if (ret != 0) { in mbedtls_ssl_parse_certificate()
7627 if (ret == 0) { in mbedtls_ssl_parse_certificate()
7631 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) in mbedtls_ssl_parse_certificate()
7632 if (ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) { in mbedtls_ssl_parse_certificate()
7638 if (chain != NULL) { in mbedtls_ssl_parse_certificate()
7653 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_calc_finished_tls_generic()
7666 if (!session) { in ssl_calc_finished_tls_generic()
7674 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_calc_finished_tls_generic()
7678 if (status != PSA_SUCCESS) { in ssl_calc_finished_tls_generic()
7683 if (status != PSA_SUCCESS) { in ssl_calc_finished_tls_generic()
7691 if (ret != 0) { in ssl_calc_finished_tls_generic()
7695 if (ret != 0) { in ssl_calc_finished_tls_generic()
7700 if (ret != 0) { in ssl_calc_finished_tls_generic()
7722 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_calc_finished_tls_generic()
7731 #if defined(MBEDTLS_MD_CAN_SHA256)
7737 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_calc_finished_tls_sha256()
7748 #if defined(MBEDTLS_MD_CAN_SHA384)
7754 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_calc_finished_tls_sha384()
7778 if (ssl->transform) { in mbedtls_ssl_handshake_wrapup_free_hs_transform()
7794 #if defined(MBEDTLS_SSL_RENEGOTIATION) in mbedtls_ssl_handshake_wrapup()
7795 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { in mbedtls_ssl_handshake_wrapup()
7804 if (ssl->session) { in mbedtls_ssl_handshake_wrapup()
7805 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) in mbedtls_ssl_handshake_wrapup()
7820 if (ssl->conf->f_set_cache != NULL && in mbedtls_ssl_handshake_wrapup()
7823 if (ssl->conf->f_set_cache(ssl->conf->p_cache, in mbedtls_ssl_handshake_wrapup()
7831 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_handshake_wrapup()
7832 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_handshake_wrapup()
7858 if (ret != 0) { in mbedtls_ssl_write_finished()
7870 #if defined(MBEDTLS_SSL_RENEGOTIATION) in mbedtls_ssl_write_finished()
7883 if (ssl->handshake->resume != 0) { in mbedtls_ssl_write_finished()
7884 #if defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_write_finished()
7885 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { in mbedtls_ssl_write_finished()
7889 #if defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_write_finished()
7890 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_write_finished()
7904 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_write_finished()
7905 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_write_finished()
7919 if (++ssl->cur_out_ctr[i - 1] != 0) { in mbedtls_ssl_write_finished()
7925 if (i == 0) { in mbedtls_ssl_write_finished()
7936 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_write_finished()
7937 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_write_finished()
7942 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { in mbedtls_ssl_write_finished()
7947 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_write_finished()
7948 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_write_finished()
7971 if (ret != 0) { in mbedtls_ssl_parse_finished()
7975 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) { in mbedtls_ssl_parse_finished()
7980 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) { in mbedtls_ssl_parse_finished()
7988 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED) { in mbedtls_ssl_parse_finished()
7995 if (ssl->in_hslen != mbedtls_ssl_hs_hdr_len(ssl) + hash_len) { in mbedtls_ssl_parse_finished()
8003 if (mbedtls_ct_memcmp(ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl), in mbedtls_ssl_parse_finished()
8012 #if defined(MBEDTLS_SSL_RENEGOTIATION) in mbedtls_ssl_parse_finished()
8017 if (ssl->handshake->resume != 0) { in mbedtls_ssl_parse_finished()
8018 #if defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_parse_finished()
8019 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { in mbedtls_ssl_parse_finished()
8023 #if defined(MBEDTLS_SSL_SRV_C) in mbedtls_ssl_parse_finished()
8024 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { in mbedtls_ssl_parse_finished()
8032 #if defined(MBEDTLS_SSL_PROTO_DTLS) in mbedtls_ssl_parse_finished()
8033 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_parse_finished()
8045 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
8054 #if defined(MBEDTLS_MD_CAN_SHA384) in ssl_tls12prf_from_cs()
8055 if (ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA384) { in ssl_tls12prf_from_cs()
8059 #if defined(MBEDTLS_MD_CAN_SHA256) in ssl_tls12prf_from_cs()
8061 if (ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA256) { in ssl_tls12prf_from_cs()
8066 #if !defined(MBEDTLS_MD_CAN_SHA384) && \ in ssl_tls12prf_from_cs()
8078 #if defined(MBEDTLS_MD_CAN_SHA384) in tls_prf_get_type()
8079 if (tls_prf == tls_prf_sha384) { in tls_prf_get_type()
8083 #if defined(MBEDTLS_MD_CAN_SHA256) in tls_prf_get_type()
8084 if (tls_prf == tls_prf_sha256) { in tls_prf_get_type()
8115 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in ssl_tls12_populate_transform()
8135 #if !defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8140 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8149 #if !defined(MBEDTLS_DEBUG_C) && \ in ssl_tls12_populate_transform()
8151 if (ssl->f_export_keys == NULL) { in ssl_tls12_populate_transform()
8160 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in ssl_tls12_populate_transform()
8165 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) in ssl_tls12_populate_transform()
8169 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in ssl_tls12_populate_transform()
8170 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in ssl_tls12_populate_transform()
8181 if (ciphersuite_info == NULL) { in ssl_tls12_populate_transform()
8188 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in ssl_tls12_populate_transform()
8193 if (ssl_mode == MBEDTLS_SSL_MODE_AEAD) { in ssl_tls12_populate_transform()
8198 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8199 if ((status = mbedtls_ssl_cipher_to_psa(ciphersuite_info->cipher, in ssl_tls12_populate_transform()
8210 if (cipher_info == NULL) { in ssl_tls12_populate_transform()
8217 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8219 if (mac_alg == 0) { in ssl_tls12_populate_transform()
8226 if (md_info == NULL) { in ssl_tls12_populate_transform()
8233 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) in ssl_tls12_populate_transform()
8234 /* Copy own and peer's CID if the use of the CID in ssl_tls12_populate_transform()
8236 if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED) { in ssl_tls12_populate_transform()
8256 if (ret != 0) { in ssl_tls12_populate_transform()
8271 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8277 #if defined(MBEDTLS_GCM_C) || \ in ssl_tls12_populate_transform()
8280 if (ssl_mode == MBEDTLS_SSL_MODE_AEAD) { in ssl_tls12_populate_transform()
8297 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8304 if (is_chachapoly) { in ssl_tls12_populate_transform()
8315 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) in ssl_tls12_populate_transform()
8316 if (ssl_mode == MBEDTLS_SSL_MODE_STREAM || in ssl_tls12_populate_transform()
8319 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8325 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8330 if ((ret = mbedtls_md_setup(&transform->md_ctx_enc, md_info, 1)) != 0 || in ssl_tls12_populate_transform()
8342 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8349 if (ssl_mode == MBEDTLS_SSL_MODE_STREAM) { in ssl_tls12_populate_transform()
8354 * 1. if EtM is in use: one block plus MAC in ssl_tls12_populate_transform()
8358 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) in ssl_tls12_populate_transform()
8359 if (ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM) { in ssl_tls12_populate_transform()
8370 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_2) { in ssl_tls12_populate_transform()
8394 #if defined(MBEDTLS_SSL_CLI_C) in ssl_tls12_populate_transform()
8395 if (endpoint == MBEDTLS_SSL_IS_CLIENT) { in ssl_tls12_populate_transform()
8409 #if defined(MBEDTLS_SSL_SRV_C) in ssl_tls12_populate_transform()
8410 if (endpoint == MBEDTLS_SSL_IS_SERVER) { in ssl_tls12_populate_transform()
8430 if (ssl != NULL && ssl->f_export_keys != NULL) { in ssl_tls12_populate_transform()
8439 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8442 if (alg != MBEDTLS_SSL_NULL_CIPHER) { in ssl_tls12_populate_transform()
8447 if ((status = psa_import_key(&attributes, in ssl_tls12_populate_transform()
8459 if ((status = psa_import_key(&attributes, in ssl_tls12_populate_transform()
8469 if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_enc, in ssl_tls12_populate_transform()
8475 if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_dec, in ssl_tls12_populate_transform()
8481 if ((ret = mbedtls_cipher_setkey(&transform->cipher_ctx_enc, key1, in ssl_tls12_populate_transform()
8488 if ((ret = mbedtls_cipher_setkey(&transform->cipher_ctx_dec, key2, in ssl_tls12_populate_transform()
8495 #if defined(MBEDTLS_CIPHER_MODE_CBC) in ssl_tls12_populate_transform()
8496 if (mbedtls_cipher_info_get_mode(cipher_info) == MBEDTLS_MODE_CBC) { in ssl_tls12_populate_transform()
8497 if ((ret = mbedtls_cipher_set_padding_mode(&transform->cipher_ctx_enc, in ssl_tls12_populate_transform()
8503 if ((ret = mbedtls_cipher_set_padding_mode(&transform->cipher_ctx_dec, in ssl_tls12_populate_transform()
8512 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) in ssl_tls12_populate_transform()
8515 if (mac_key_len != 0) { in ssl_tls12_populate_transform()
8516 #if defined(MBEDTLS_USE_PSA_CRYPTO) in ssl_tls12_populate_transform()
8523 if ((status = psa_import_key(&attributes, in ssl_tls12_populate_transform()
8531 if ((transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER) || in ssl_tls12_populate_transform()
8533 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) in ssl_tls12_populate_transform()
8544 if ((status = psa_import_key(&attributes, in ssl_tls12_populate_transform()
8553 if (ret != 0) { in ssl_tls12_populate_transform()
8557 if (ret != 0) { in ssl_tls12_populate_transform()
8572 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
8595 if (input_offset + length > len) { in mbedtls_psa_ecjpake_read_round()
8601 if (status != PSA_SUCCESS) { in mbedtls_psa_ecjpake_read_round()
8609 if (input_offset != len) { in mbedtls_psa_ecjpake_read_round()
8643 if (status != PSA_SUCCESS) { in mbedtls_psa_ecjpake_write_round()
8659 #if defined(MBEDTLS_USE_PSA_CRYPTO)
8671 if ((status = psa_hash_setup(&hash_operation, in mbedtls_ssl_get_key_exchange_md_tls1_2()
8677 if ((status = psa_hash_update(&hash_operation, ssl->handshake->randbytes, in mbedtls_ssl_get_key_exchange_md_tls1_2()
8683 if ((status = psa_hash_update(&hash_operation, in mbedtls_ssl_get_key_exchange_md_tls1_2()
8689 if ((status = psa_hash_finish(&hash_operation, hash, PSA_HASH_MAX_SIZE, in mbedtls_ssl_get_key_exchange_md_tls1_2()
8696 if (status != PSA_SUCCESS) { in mbedtls_ssl_get_key_exchange_md_tls1_2()
8737 if ((ret = mbedtls_md_setup(&ctx, md_info, 0)) != 0) { in mbedtls_ssl_get_key_exchange_md_tls1_2()
8741 if ((ret = mbedtls_md_starts(&ctx)) != 0) { in mbedtls_ssl_get_key_exchange_md_tls1_2()
8745 if ((ret = mbedtls_md_update(&ctx, ssl->handshake->randbytes, 64)) != 0) { in mbedtls_ssl_get_key_exchange_md_tls1_2()
8749 if ((ret = mbedtls_md_update(&ctx, data, data_len)) != 0) { in mbedtls_ssl_get_key_exchange_md_tls1_2()
8753 if ((ret = mbedtls_md_finish(&ctx, hash)) != 0) { in mbedtls_ssl_get_key_exchange_md_tls1_2()
8761 if (ret != 0) { in mbedtls_ssl_get_key_exchange_md_tls1_2()
8770 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
8780 if (sig_alg == MBEDTLS_SSL_SIG_ANON) { in mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg()
8794 if (md_alg == MBEDTLS_MD_NONE) { in mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg()
8798 if (sig_alg == sig_alg_received) { in mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg()
8799 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg()
8800 if (ssl->handshake->key_cert && ssl->handshake->key_cert->key) { in mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg()
8804 if (sig_alg_received == MBEDTLS_SSL_SIG_ECDSA && in mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg()
8811 if (sig_alg_received == MBEDTLS_SSL_SIG_RSA && in mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg()
8854 #if defined(MBEDTLS_HAVE_TIME) in ssl_tls12_session_save()
8857 #if defined(MBEDTLS_X509_CRT_PARSE_C) in ssl_tls12_session_save()
8858 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in ssl_tls12_session_save()
8866 #if defined(MBEDTLS_HAVE_TIME) in ssl_tls12_session_save()
8869 if (used <= buf_len) { in ssl_tls12_session_save()
8886 if (used <= buf_len) { in ssl_tls12_session_save()
8904 #if defined(MBEDTLS_X509_CRT_PARSE_C) in ssl_tls12_session_save()
8905 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in ssl_tls12_session_save()
8906 if (session->peer_cert == NULL) { in ssl_tls12_session_save()
8914 if (used <= buf_len) { in ssl_tls12_session_save()
8919 if (session->peer_cert != NULL) { in ssl_tls12_session_save()
8925 if (session->peer_cert_digest != NULL) { in ssl_tls12_session_save()
8927 if (used <= buf_len) { in ssl_tls12_session_save()
8936 if (used <= buf_len) { in ssl_tls12_session_save()
8945 * Session ticket if any, plus associated data in ssl_tls12_session_save()
8947 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) in ssl_tls12_session_save()
8950 if (used <= buf_len) { in ssl_tls12_session_save()
8955 if (session->ticket != NULL) { in ssl_tls12_session_save()
8968 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) in ssl_tls12_session_save()
8971 if (used <= buf_len) { in ssl_tls12_session_save()
8976 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) in ssl_tls12_session_save()
8979 if (used <= buf_len) { in ssl_tls12_session_save()
8992 #if defined(MBEDTLS_HAVE_TIME) in ssl_tls12_session_load()
8995 #if defined(MBEDTLS_X509_CRT_PARSE_C) in ssl_tls12_session_load()
8996 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in ssl_tls12_session_load()
9007 #if defined(MBEDTLS_HAVE_TIME) in ssl_tls12_session_load()
9008 if (8 > (size_t) (end - p)) { in ssl_tls12_session_load()
9021 if (2 + 1 + 32 + 48 + 4 > (size_t) (end - p)) { in ssl_tls12_session_load()
9040 #if defined(MBEDTLS_X509_CRT_PARSE_C) in ssl_tls12_session_load()
9041 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in ssl_tls12_session_load()
9047 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) in ssl_tls12_session_load()
9054 #if defined(MBEDTLS_X509_CRT_PARSE_C) in ssl_tls12_session_load()
9055 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) in ssl_tls12_session_load()
9057 if (3 > (size_t) (end - p)) { in ssl_tls12_session_load()
9064 if (cert_len != 0) { in ssl_tls12_session_load()
9067 if (cert_len > (size_t) (end - p)) { in ssl_tls12_session_load()
9073 if (session->peer_cert == NULL) { in ssl_tls12_session_load()
9079 if ((ret = mbedtls_x509_crt_parse_der(session->peer_cert, in ssl_tls12_session_load()
9091 if (2 > (size_t) (end - p)) { in ssl_tls12_session_load()
9098 if (session->peer_cert_digest_len != 0) { in ssl_tls12_session_load()
9101 if (md_info == NULL) { in ssl_tls12_session_load()
9104 if (session->peer_cert_digest_len != mbedtls_md_get_size(md_info)) { in ssl_tls12_session_load()
9108 if (session->peer_cert_digest_len > (size_t) (end - p)) { in ssl_tls12_session_load()
9114 if (session->peer_cert_digest == NULL) { in ssl_tls12_session_load()
9128 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) in ssl_tls12_session_load()
9129 if (3 > (size_t) (end - p)) { in ssl_tls12_session_load()
9136 if (session->ticket_len != 0) { in ssl_tls12_session_load()
9137 if (session->ticket_len > (size_t) (end - p)) { in ssl_tls12_session_load()
9142 if (session->ticket == NULL) { in ssl_tls12_session_load()
9150 if (4 > (size_t) (end - p)) { in ssl_tls12_session_load()
9161 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) in ssl_tls12_session_load()
9162 if (1 > (size_t) (end - p)) { in ssl_tls12_session_load()
9169 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) in ssl_tls12_session_load()
9170 if (1 > (size_t) (end - p)) { in ssl_tls12_session_load()
9178 if (p != end) { in ssl_tls12_session_load()
9194 if (suite_info == NULL) { in mbedtls_ssl_validate_ciphersuite()
9198 if ((suite_info->min_tls_version > max_tls_version) || in mbedtls_ssl_validate_ciphersuite()
9203 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_CLI_C) in mbedtls_ssl_validate_ciphersuite()
9204 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) in mbedtls_ssl_validate_ciphersuite()
9205 #if defined(MBEDTLS_USE_PSA_CRYPTO) in mbedtls_ssl_validate_ciphersuite()
9206 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && in mbedtls_ssl_validate_ciphersuite()
9209 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && in mbedtls_ssl_validate_ciphersuite()
9217 /* Don't suggest PSK-based ciphersuite if no PSK is available. */ in mbedtls_ssl_validate_ciphersuite()
9218 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) in mbedtls_ssl_validate_ciphersuite()
9219 if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) && in mbedtls_ssl_validate_ciphersuite()
9229 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
9282 /* Check if we have space for header and length field: in mbedtls_ssl_write_sig_alg_ext()
9295 if (sig_alg == NULL) { in mbedtls_ssl_write_sig_alg_ext()
9303 if (!mbedtls_ssl_sig_alg_is_supported(ssl, *sig_alg)) { in mbedtls_ssl_write_sig_alg_ext()
9316 if (supported_sig_alg_len == 0) { in mbedtls_ssl_write_sig_alg_ext()
9327 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_write_sig_alg_ext()
9335 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
9380 if (p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME) { in mbedtls_ssl_parse_server_name_ext()
9388 if (ssl->conf->f_sni == NULL) { in mbedtls_ssl_parse_server_name_ext()
9393 if (ret != 0) { in mbedtls_ssl_parse_server_name_ext()
9409 #if defined(MBEDTLS_SSL_ALPN)
9421 /* If ALPN not configured, just ignore the extension */ in mbedtls_ssl_parse_alpn_ext()
9422 if (ssl->conf->alpn_list == NULL) { in mbedtls_ssl_parse_alpn_ext()
9453 if (protocol_name_len == 0) { in mbedtls_ssl_parse_alpn_ext()
9469 if (protocol_name_len == alpn_len && in mbedtls_ssl_parse_alpn_ext()
9479 /* If we get here, no match was found */ in mbedtls_ssl_parse_alpn_ext()
9495 if (ssl->alpn_chosen == NULL) { in mbedtls_ssl_write_alpn_ext()
9523 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) in mbedtls_ssl_write_alpn_ext()
9531 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
9541 /* Check if new hostname is valid before in mbedtls_ssl_session_set_hostname()
9543 if (hostname != NULL) { in mbedtls_ssl_session_set_hostname()
9546 if (hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN) { in mbedtls_ssl_session_set_hostname()
9553 if (session->hostname != NULL) { in mbedtls_ssl_session_set_hostname()
9559 if (hostname == NULL) { in mbedtls_ssl_session_set_hostname()
9563 if (session->hostname == NULL) { in mbedtls_ssl_session_set_hostname()