1 /*
2 * SSLv3/TLSv1 shared functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19 /*
20 * The SSL 3.0 specification was drafted by Netscape in 1996,
21 * and became an IETF standard in 1999.
22 *
23 * http://wp.netscape.com/eng/ssl3/
24 * http://www.ietf.org/rfc/rfc2246.txt
25 * http://www.ietf.org/rfc/rfc4346.txt
26 */
27
28 #include "common.h"
29
30 #if defined(MBEDTLS_SSL_TLS_C)
31
32 #if defined(MBEDTLS_PLATFORM_C)
33 #include "mbedtls/platform.h"
34 #else
35 #include <stdlib.h>
36 #define mbedtls_calloc calloc
37 #define mbedtls_free free
38 #endif
39
40 #include "mbedtls/ssl.h"
41 #include "mbedtls/ssl_internal.h"
42 #include "mbedtls/debug.h"
43 #include "mbedtls/error.h"
44 #include "mbedtls/platform_util.h"
45 #include "mbedtls/version.h"
46
47 #include <string.h>
48
49 #if defined(MBEDTLS_USE_PSA_CRYPTO)
50 #include "mbedtls/psa_util.h"
51 #include "psa/crypto.h"
52 #endif
53
54 #if defined(MBEDTLS_X509_CRT_PARSE_C)
55 #include "mbedtls/oid.h"
56 #endif
57
58 #if defined(MBEDTLS_SSL_PROTO_DTLS)
59
60 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
61 /* Top-level Connection ID API */
62
mbedtls_ssl_conf_cid(mbedtls_ssl_config * conf,size_t len,int ignore_other_cid)63 int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
64 size_t len,
65 int ignore_other_cid )
66 {
67 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
68 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
69
70 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
71 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
72 {
73 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
74 }
75
76 conf->ignore_unexpected_cid = ignore_other_cid;
77 conf->cid_len = len;
78 return( 0 );
79 }
80
mbedtls_ssl_set_cid(mbedtls_ssl_context * ssl,int enable,unsigned char const * own_cid,size_t own_cid_len)81 int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
82 int enable,
83 unsigned char const *own_cid,
84 size_t own_cid_len )
85 {
86 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
87 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
88
89 ssl->negotiate_cid = enable;
90 if( enable == MBEDTLS_SSL_CID_DISABLED )
91 {
92 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
93 return( 0 );
94 }
95 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
96 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
97
98 if( own_cid_len != ssl->conf->cid_len )
99 {
100 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
101 (unsigned) own_cid_len,
102 (unsigned) ssl->conf->cid_len ) );
103 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
104 }
105
106 memcpy( ssl->own_cid, own_cid, own_cid_len );
107 /* Truncation is not an issue here because
108 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
109 ssl->own_cid_len = (uint8_t) own_cid_len;
110
111 return( 0 );
112 }
113
mbedtls_ssl_get_peer_cid(mbedtls_ssl_context * ssl,int * enabled,unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],size_t * peer_cid_len)114 int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
115 int *enabled,
116 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
117 size_t *peer_cid_len )
118 {
119 *enabled = MBEDTLS_SSL_CID_DISABLED;
120
121 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
122 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
123 {
124 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
125 }
126
127 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
128 * were used, but client and server requested the empty CID.
129 * This is indistinguishable from not using the CID extension
130 * in the first place. */
131 if( ssl->transform_in->in_cid_len == 0 &&
132 ssl->transform_in->out_cid_len == 0 )
133 {
134 return( 0 );
135 }
136
137 if( peer_cid_len != NULL )
138 {
139 *peer_cid_len = ssl->transform_in->out_cid_len;
140 if( peer_cid != NULL )
141 {
142 memcpy( peer_cid, ssl->transform_in->out_cid,
143 ssl->transform_in->out_cid_len );
144 }
145 }
146
147 *enabled = MBEDTLS_SSL_CID_ENABLED;
148
149 return( 0 );
150 }
151 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
152
153 #endif /* MBEDTLS_SSL_PROTO_DTLS */
154
155 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
156 /*
157 * Convert max_fragment_length codes to length.
158 * RFC 6066 says:
159 * enum{
160 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
161 * } MaxFragmentLength;
162 * and we add 0 -> extension unused
163 */
ssl_mfl_code_to_length(int mfl)164 static unsigned int ssl_mfl_code_to_length( int mfl )
165 {
166 switch( mfl )
167 {
168 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
169 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
170 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
171 return 512;
172 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
173 return 1024;
174 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
175 return 2048;
176 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
177 return 4096;
178 default:
179 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
180 }
181 }
182 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
183
mbedtls_ssl_session_copy(mbedtls_ssl_session * dst,const mbedtls_ssl_session * src)184 int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
185 const mbedtls_ssl_session *src )
186 {
187 mbedtls_ssl_session_free( dst );
188 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
189
190 #if defined(MBEDTLS_X509_CRT_PARSE_C)
191
192 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
193 if( src->peer_cert != NULL )
194 {
195 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
196
197 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
198 if( dst->peer_cert == NULL )
199 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
200
201 mbedtls_x509_crt_init( dst->peer_cert );
202
203 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
204 src->peer_cert->raw.len ) ) != 0 )
205 {
206 mbedtls_free( dst->peer_cert );
207 dst->peer_cert = NULL;
208 return( ret );
209 }
210 }
211 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
212 if( src->peer_cert_digest != NULL )
213 {
214 dst->peer_cert_digest =
215 mbedtls_calloc( 1, src->peer_cert_digest_len );
216 if( dst->peer_cert_digest == NULL )
217 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
218
219 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
220 src->peer_cert_digest_len );
221 dst->peer_cert_digest_type = src->peer_cert_digest_type;
222 dst->peer_cert_digest_len = src->peer_cert_digest_len;
223 }
224 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
225
226 #endif /* MBEDTLS_X509_CRT_PARSE_C */
227
228 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
229 if( src->ticket != NULL )
230 {
231 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
232 if( dst->ticket == NULL )
233 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
234
235 memcpy( dst->ticket, src->ticket, src->ticket_len );
236 }
237 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
238
239 return( 0 );
240 }
241
242 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
resize_buffer(unsigned char ** buffer,size_t len_new,size_t * len_old)243 static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
244 {
245 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
246 if( resized_buffer == NULL )
247 return -1;
248
249 /* We want to copy len_new bytes when downsizing the buffer, and
250 * len_old bytes when upsizing, so we choose the smaller of two sizes,
251 * to fit one buffer into another. Size checks, ensuring that no data is
252 * lost, are done outside of this function. */
253 memcpy( resized_buffer, *buffer,
254 ( len_new < *len_old ) ? len_new : *len_old );
255 mbedtls_platform_zeroize( *buffer, *len_old );
256 mbedtls_free( *buffer );
257
258 *buffer = resized_buffer;
259 *len_old = len_new;
260
261 return 0;
262 }
263 #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
264
265 /*
266 * Key material generation
267 */
268 #if defined(MBEDTLS_SSL_PROTO_SSL3)
ssl3_prf(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)269 static int ssl3_prf( const unsigned char *secret, size_t slen,
270 const char *label,
271 const unsigned char *random, size_t rlen,
272 unsigned char *dstbuf, size_t dlen )
273 {
274 int ret = 0;
275 size_t i;
276 mbedtls_md5_context md5;
277 mbedtls_sha1_context sha1;
278 unsigned char padding[16];
279 unsigned char sha1sum[20];
280 ((void)label);
281
282 mbedtls_md5_init( &md5 );
283 mbedtls_sha1_init( &sha1 );
284
285 /*
286 * SSLv3:
287 * block =
288 * MD5( secret + SHA1( 'A' + secret + random ) ) +
289 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
290 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
291 * ...
292 */
293 for( i = 0; i < dlen / 16; i++ )
294 {
295 memset( padding, (unsigned char) ('A' + i), 1 + i );
296
297 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
298 goto exit;
299 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
300 goto exit;
301 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
302 goto exit;
303 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
304 goto exit;
305 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
306 goto exit;
307
308 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
309 goto exit;
310 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
311 goto exit;
312 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
313 goto exit;
314 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
315 goto exit;
316 }
317
318 exit:
319 mbedtls_md5_free( &md5 );
320 mbedtls_sha1_free( &sha1 );
321
322 mbedtls_platform_zeroize( padding, sizeof( padding ) );
323 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
324
325 return( ret );
326 }
327 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
328
329 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
tls1_prf(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)330 static int tls1_prf( const unsigned char *secret, size_t slen,
331 const char *label,
332 const unsigned char *random, size_t rlen,
333 unsigned char *dstbuf, size_t dlen )
334 {
335 size_t nb, hs;
336 size_t i, j, k;
337 const unsigned char *S1, *S2;
338 unsigned char *tmp;
339 size_t tmp_len = 0;
340 unsigned char h_i[20];
341 const mbedtls_md_info_t *md_info;
342 mbedtls_md_context_t md_ctx;
343 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
344
345 mbedtls_md_init( &md_ctx );
346
347 tmp_len = 20 + strlen( label ) + rlen;
348 tmp = mbedtls_calloc( 1, tmp_len );
349 if( tmp == NULL )
350 {
351 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
352 goto exit;
353 }
354
355 hs = ( slen + 1 ) / 2;
356 S1 = secret;
357 S2 = secret + slen - hs;
358
359 nb = strlen( label );
360 memcpy( tmp + 20, label, nb );
361 memcpy( tmp + 20 + nb, random, rlen );
362 nb += rlen;
363
364 /*
365 * First compute P_md5(secret,label+random)[0..dlen]
366 */
367 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) == NULL )
368 {
369 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
370 goto exit;
371 }
372
373 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
374 {
375 goto exit;
376 }
377
378 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
379 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
380 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
381
382 for( i = 0; i < dlen; i += 16 )
383 {
384 mbedtls_md_hmac_reset ( &md_ctx );
385 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
386 mbedtls_md_hmac_finish( &md_ctx, h_i );
387
388 mbedtls_md_hmac_reset ( &md_ctx );
389 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
390 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
391
392 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
393
394 for( j = 0; j < k; j++ )
395 dstbuf[i + j] = h_i[j];
396 }
397
398 mbedtls_md_free( &md_ctx );
399
400 /*
401 * XOR out with P_sha1(secret,label+random)[0..dlen]
402 */
403 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) == NULL )
404 {
405 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
406 goto exit;
407 }
408
409 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
410 {
411 goto exit;
412 }
413
414 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
415 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
416 mbedtls_md_hmac_finish( &md_ctx, tmp );
417
418 for( i = 0; i < dlen; i += 20 )
419 {
420 mbedtls_md_hmac_reset ( &md_ctx );
421 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
422 mbedtls_md_hmac_finish( &md_ctx, h_i );
423
424 mbedtls_md_hmac_reset ( &md_ctx );
425 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
426 mbedtls_md_hmac_finish( &md_ctx, tmp );
427
428 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
429
430 for( j = 0; j < k; j++ )
431 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
432 }
433
434 exit:
435 mbedtls_md_free( &md_ctx );
436
437 mbedtls_platform_zeroize( tmp, tmp_len );
438 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
439
440 mbedtls_free( tmp );
441 return( ret );
442 }
443 #endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
444
445 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
446 #if defined(MBEDTLS_USE_PSA_CRYPTO)
447
setup_psa_key_derivation(psa_key_derivation_operation_t * derivation,psa_key_id_t key,psa_algorithm_t alg,const unsigned char * seed,size_t seed_length,const unsigned char * label,size_t label_length,size_t capacity)448 static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
449 psa_key_id_t key,
450 psa_algorithm_t alg,
451 const unsigned char* seed, size_t seed_length,
452 const unsigned char* label, size_t label_length,
453 size_t capacity )
454 {
455 psa_status_t status;
456
457 status = psa_key_derivation_setup( derivation, alg );
458 if( status != PSA_SUCCESS )
459 return( status );
460
461 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
462 {
463 status = psa_key_derivation_input_bytes( derivation,
464 PSA_KEY_DERIVATION_INPUT_SEED,
465 seed, seed_length );
466 if( status != PSA_SUCCESS )
467 return( status );
468
469 if( mbedtls_svc_key_id_is_null( key ) )
470 {
471 status = psa_key_derivation_input_bytes(
472 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
473 NULL, 0 );
474 }
475 else
476 {
477 status = psa_key_derivation_input_key(
478 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
479 }
480 if( status != PSA_SUCCESS )
481 return( status );
482
483 status = psa_key_derivation_input_bytes( derivation,
484 PSA_KEY_DERIVATION_INPUT_LABEL,
485 label, label_length );
486 if( status != PSA_SUCCESS )
487 return( status );
488 }
489 else
490 {
491 return( PSA_ERROR_NOT_SUPPORTED );
492 }
493
494 status = psa_key_derivation_set_capacity( derivation, capacity );
495 if( status != PSA_SUCCESS )
496 return( status );
497
498 return( PSA_SUCCESS );
499 }
500
tls_prf_generic(mbedtls_md_type_t md_type,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)501 static int tls_prf_generic( mbedtls_md_type_t md_type,
502 const unsigned char *secret, size_t slen,
503 const char *label,
504 const unsigned char *random, size_t rlen,
505 unsigned char *dstbuf, size_t dlen )
506 {
507 psa_status_t status;
508 psa_algorithm_t alg;
509 psa_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
510 psa_key_derivation_operation_t derivation =
511 PSA_KEY_DERIVATION_OPERATION_INIT;
512
513 if( md_type == MBEDTLS_MD_SHA384 )
514 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
515 else
516 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
517
518 /* Normally a "secret" should be long enough to be impossible to
519 * find by brute force, and in particular should not be empty. But
520 * this PRF is also used to derive an IV, in particular in EAP-TLS,
521 * and for this use case it makes sense to have a 0-length "secret".
522 * Since the key API doesn't allow importing a key of length 0,
523 * keep master_key=0, which setup_psa_key_derivation() understands
524 * to mean a 0-length "secret" input. */
525 if( slen != 0 )
526 {
527 psa_key_attributes_t key_attributes = psa_key_attributes_init();
528 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
529 psa_set_key_algorithm( &key_attributes, alg );
530 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
531
532 status = psa_import_key( &key_attributes, secret, slen, &master_key );
533 if( status != PSA_SUCCESS )
534 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
535 }
536
537 status = setup_psa_key_derivation( &derivation,
538 master_key, alg,
539 random, rlen,
540 (unsigned char const *) label,
541 (size_t) strlen( label ),
542 dlen );
543 if( status != PSA_SUCCESS )
544 {
545 psa_key_derivation_abort( &derivation );
546 psa_destroy_key( master_key );
547 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
548 }
549
550 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
551 if( status != PSA_SUCCESS )
552 {
553 psa_key_derivation_abort( &derivation );
554 psa_destroy_key( master_key );
555 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
556 }
557
558 status = psa_key_derivation_abort( &derivation );
559 if( status != PSA_SUCCESS )
560 {
561 psa_destroy_key( master_key );
562 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
563 }
564
565 if( ! mbedtls_svc_key_id_is_null( master_key ) )
566 status = psa_destroy_key( master_key );
567 if( status != PSA_SUCCESS )
568 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
569
570 return( 0 );
571 }
572
573 #else /* MBEDTLS_USE_PSA_CRYPTO */
574
tls_prf_generic(mbedtls_md_type_t md_type,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)575 static int tls_prf_generic( mbedtls_md_type_t md_type,
576 const unsigned char *secret, size_t slen,
577 const char *label,
578 const unsigned char *random, size_t rlen,
579 unsigned char *dstbuf, size_t dlen )
580 {
581 size_t nb;
582 size_t i, j, k, md_len;
583 unsigned char *tmp;
584 size_t tmp_len = 0;
585 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
586 const mbedtls_md_info_t *md_info;
587 mbedtls_md_context_t md_ctx;
588 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
589
590 mbedtls_md_init( &md_ctx );
591
592 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
593 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
594
595 md_len = mbedtls_md_get_size( md_info );
596
597 tmp_len = md_len + strlen( label ) + rlen;
598 tmp = mbedtls_calloc( 1, tmp_len );
599 if( tmp == NULL )
600 {
601 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
602 goto exit;
603 }
604
605 nb = strlen( label );
606 memcpy( tmp + md_len, label, nb );
607 memcpy( tmp + md_len + nb, random, rlen );
608 nb += rlen;
609
610 /*
611 * Compute P_<hash>(secret, label + random)[0..dlen]
612 */
613 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
614 goto exit;
615
616 mbedtls_md_hmac_starts( &md_ctx, secret, slen );
617 mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
618 mbedtls_md_hmac_finish( &md_ctx, tmp );
619
620 for( i = 0; i < dlen; i += md_len )
621 {
622 mbedtls_md_hmac_reset ( &md_ctx );
623 mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
624 mbedtls_md_hmac_finish( &md_ctx, h_i );
625
626 mbedtls_md_hmac_reset ( &md_ctx );
627 mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
628 mbedtls_md_hmac_finish( &md_ctx, tmp );
629
630 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
631
632 for( j = 0; j < k; j++ )
633 dstbuf[i + j] = h_i[j];
634 }
635
636 exit:
637 mbedtls_md_free( &md_ctx );
638
639 mbedtls_platform_zeroize( tmp, tmp_len );
640 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
641
642 mbedtls_free( tmp );
643
644 return( ret );
645 }
646 #endif /* MBEDTLS_USE_PSA_CRYPTO */
647 #if defined(MBEDTLS_SHA256_C)
tls_prf_sha256(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)648 static int tls_prf_sha256( const unsigned char *secret, size_t slen,
649 const char *label,
650 const unsigned char *random, size_t rlen,
651 unsigned char *dstbuf, size_t dlen )
652 {
653 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
654 label, random, rlen, dstbuf, dlen ) );
655 }
656 #endif /* MBEDTLS_SHA256_C */
657
658 #if defined(MBEDTLS_SHA512_C)
tls_prf_sha384(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)659 static int tls_prf_sha384( const unsigned char *secret, size_t slen,
660 const char *label,
661 const unsigned char *random, size_t rlen,
662 unsigned char *dstbuf, size_t dlen )
663 {
664 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
665 label, random, rlen, dstbuf, dlen ) );
666 }
667 #endif /* MBEDTLS_SHA512_C */
668 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
669
670 static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
671
672 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
673 defined(MBEDTLS_SSL_PROTO_TLS1_1)
674 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *, const unsigned char *, size_t );
675 #endif
676
677 #if defined(MBEDTLS_SSL_PROTO_SSL3)
678 static void ssl_calc_verify_ssl( const mbedtls_ssl_context *, unsigned char *, size_t * );
679 static void ssl_calc_finished_ssl( mbedtls_ssl_context *, unsigned char *, int );
680 #endif
681
682 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
683 static void ssl_calc_verify_tls( const mbedtls_ssl_context *, unsigned char*, size_t * );
684 static void ssl_calc_finished_tls( mbedtls_ssl_context *, unsigned char *, int );
685 #endif
686
687 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
688 #if defined(MBEDTLS_SHA256_C)
689 static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
690 static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
691 static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
692 #endif
693
694 #if defined(MBEDTLS_SHA512_C)
695 static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
696 static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
697 static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
698 #endif
699 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
700
701 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \
702 defined(MBEDTLS_USE_PSA_CRYPTO)
ssl_use_opaque_psk(mbedtls_ssl_context const * ssl)703 static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
704 {
705 if( ssl->conf->f_psk != NULL )
706 {
707 /* If we've used a callback to select the PSK,
708 * the static configuration is irrelevant. */
709 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
710 return( 1 );
711
712 return( 0 );
713 }
714
715 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
716 return( 1 );
717
718 return( 0 );
719 }
720 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
721 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
722
723 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
tls_prf_get_type(mbedtls_ssl_tls_prf_cb * tls_prf)724 static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
725 {
726 #if defined(MBEDTLS_SSL_PROTO_SSL3)
727 if( tls_prf == ssl3_prf )
728 {
729 return( MBEDTLS_SSL_TLS_PRF_SSL3 );
730 }
731 else
732 #endif
733 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
734 if( tls_prf == tls1_prf )
735 {
736 return( MBEDTLS_SSL_TLS_PRF_TLS1 );
737 }
738 else
739 #endif
740 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
741 #if defined(MBEDTLS_SHA512_C)
742 if( tls_prf == tls_prf_sha384 )
743 {
744 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
745 }
746 else
747 #endif
748 #if defined(MBEDTLS_SHA256_C)
749 if( tls_prf == tls_prf_sha256 )
750 {
751 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
752 }
753 else
754 #endif
755 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
756 return( MBEDTLS_SSL_TLS_PRF_NONE );
757 }
758 #endif /* MBEDTLS_SSL_EXPORT_KEYS */
759
mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)760 int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
761 const unsigned char *secret, size_t slen,
762 const char *label,
763 const unsigned char *random, size_t rlen,
764 unsigned char *dstbuf, size_t dlen )
765 {
766 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
767
768 switch( prf )
769 {
770 #if defined(MBEDTLS_SSL_PROTO_SSL3)
771 case MBEDTLS_SSL_TLS_PRF_SSL3:
772 tls_prf = ssl3_prf;
773 break;
774 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
775 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
776 case MBEDTLS_SSL_TLS_PRF_TLS1:
777 tls_prf = tls1_prf;
778 break;
779 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
780
781 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
782 #if defined(MBEDTLS_SHA512_C)
783 case MBEDTLS_SSL_TLS_PRF_SHA384:
784 tls_prf = tls_prf_sha384;
785 break;
786 #endif /* MBEDTLS_SHA512_C */
787 #if defined(MBEDTLS_SHA256_C)
788 case MBEDTLS_SSL_TLS_PRF_SHA256:
789 tls_prf = tls_prf_sha256;
790 break;
791 #endif /* MBEDTLS_SHA256_C */
792 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
793 default:
794 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
795 }
796
797 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
798 }
799
800 /* Type for the TLS PRF */
801 typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
802 const unsigned char *, size_t,
803 unsigned char *, size_t);
804
805 /*
806 * Populate a transform structure with session keys and all the other
807 * necessary information.
808 *
809 * Parameters:
810 * - [in/out]: transform: structure to populate
811 * [in] must be just initialised with mbedtls_ssl_transform_init()
812 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
813 * - [in] ciphersuite
814 * - [in] master
815 * - [in] encrypt_then_mac
816 * - [in] trunc_hmac
817 * - [in] compression
818 * - [in] tls_prf: pointer to PRF to use for key derivation
819 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
820 * - [in] minor_ver: SSL/TLS minor version
821 * - [in] endpoint: client or server
822 * - [in] ssl: optionally used for:
823 * - MBEDTLS_SSL_HW_RECORD_ACCEL: whole context (non-const)
824 * - MBEDTLS_SSL_EXPORT_KEYS: ssl->conf->{f,p}_export_keys
825 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
826 */
ssl_populate_transform(mbedtls_ssl_transform * transform,int ciphersuite,const unsigned char master[48],int encrypt_then_mac,int trunc_hmac,int compression,ssl_tls_prf_t tls_prf,const unsigned char randbytes[64],int minor_ver,unsigned endpoint,const mbedtls_ssl_context * ssl)827 static int ssl_populate_transform( mbedtls_ssl_transform *transform,
828 int ciphersuite,
829 const unsigned char master[48],
830 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
831 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
832 int encrypt_then_mac,
833 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
834 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
835 int trunc_hmac,
836 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
837 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
838 #if defined(MBEDTLS_ZLIB_SUPPORT)
839 int compression,
840 #endif
841 ssl_tls_prf_t tls_prf,
842 const unsigned char randbytes[64],
843 int minor_ver,
844 unsigned endpoint,
845 #if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
846 const
847 #endif
848 mbedtls_ssl_context *ssl )
849 {
850 int ret = 0;
851 #if defined(MBEDTLS_USE_PSA_CRYPTO)
852 int psa_fallthrough;
853 #endif /* MBEDTLS_USE_PSA_CRYPTO */
854 unsigned char keyblk[256];
855 unsigned char *key1;
856 unsigned char *key2;
857 unsigned char *mac_enc;
858 unsigned char *mac_dec;
859 size_t mac_key_len = 0;
860 size_t iv_copy_len;
861 unsigned keylen;
862 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
863 const mbedtls_cipher_info_t *cipher_info;
864 const mbedtls_md_info_t *md_info;
865
866 #if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \
867 !defined(MBEDTLS_SSL_EXPORT_KEYS) && \
868 !defined(MBEDTLS_DEBUG_C)
869 ssl = NULL; /* make sure we don't use it except for those cases */
870 (void) ssl;
871 #endif
872
873 /*
874 * Some data just needs copying into the structure
875 */
876 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
877 defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
878 transform->encrypt_then_mac = encrypt_then_mac;
879 #endif
880 transform->minor_ver = minor_ver;
881
882 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
883 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
884 #endif
885
886 /*
887 * Get various info structures
888 */
889 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
890 if( ciphersuite_info == NULL )
891 {
892 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
893 ciphersuite ) );
894 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
895 }
896
897 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
898 if( cipher_info == NULL )
899 {
900 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
901 ciphersuite_info->cipher ) );
902 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
903 }
904
905 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
906 if( md_info == NULL )
907 {
908 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
909 ciphersuite_info->mac ) );
910 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
911 }
912
913 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
914 /* Copy own and peer's CID if the use of the CID
915 * extension has been negotiated. */
916 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
917 {
918 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
919
920 transform->in_cid_len = ssl->own_cid_len;
921 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
922 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
923 transform->in_cid_len );
924
925 transform->out_cid_len = ssl->handshake->peer_cid_len;
926 memcpy( transform->out_cid, ssl->handshake->peer_cid,
927 ssl->handshake->peer_cid_len );
928 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
929 transform->out_cid_len );
930 }
931 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
932
933 /*
934 * Compute key block using the PRF
935 */
936 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
937 if( ret != 0 )
938 {
939 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
940 return( ret );
941 }
942
943 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
944 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
945 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
946 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
947 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
948
949 /*
950 * Determine the appropriate key, IV and MAC length.
951 */
952
953 keylen = cipher_info->key_bitlen / 8;
954
955 #if defined(MBEDTLS_GCM_C) || \
956 defined(MBEDTLS_CCM_C) || \
957 defined(MBEDTLS_CHACHAPOLY_C)
958 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
959 cipher_info->mode == MBEDTLS_MODE_CCM ||
960 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
961 {
962 size_t explicit_ivlen;
963
964 transform->maclen = 0;
965 mac_key_len = 0;
966 transform->taglen =
967 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
968
969 /* All modes haves 96-bit IVs, but the length of the static parts vary
970 * with mode and version:
971 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
972 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
973 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
974 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
975 * sequence number).
976 */
977 transform->ivlen = 12;
978 #if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
979 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
980 {
981 transform->fixed_ivlen = 12;
982 }
983 else
984 #endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
985 {
986 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
987 transform->fixed_ivlen = 12;
988 else
989 transform->fixed_ivlen = 4;
990 }
991
992 /* Minimum length of encrypted record */
993 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
994 transform->minlen = explicit_ivlen + transform->taglen;
995 }
996 else
997 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
998 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
999 if( cipher_info->mode == MBEDTLS_MODE_STREAM ||
1000 cipher_info->mode == MBEDTLS_MODE_CBC )
1001 {
1002 /* Initialize HMAC contexts */
1003 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
1004 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
1005 {
1006 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
1007 goto end;
1008 }
1009
1010 /* Get MAC length */
1011 mac_key_len = mbedtls_md_get_size( md_info );
1012 transform->maclen = mac_key_len;
1013
1014 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1015 /*
1016 * If HMAC is to be truncated, we shall keep the leftmost bytes,
1017 * (rfc 6066 page 13 or rfc 2104 section 4),
1018 * so we only need to adjust the length here.
1019 */
1020 if( trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
1021 {
1022 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
1023
1024 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
1025 /* Fall back to old, non-compliant version of the truncated
1026 * HMAC implementation which also truncates the key
1027 * (Mbed TLS versions from 1.3 to 2.6.0) */
1028 mac_key_len = transform->maclen;
1029 #endif
1030 }
1031 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1032
1033 /* IV length */
1034 transform->ivlen = cipher_info->iv_size;
1035
1036 /* Minimum length */
1037 if( cipher_info->mode == MBEDTLS_MODE_STREAM )
1038 transform->minlen = transform->maclen;
1039 else
1040 {
1041 /*
1042 * GenericBlockCipher:
1043 * 1. if EtM is in use: one block plus MAC
1044 * otherwise: * first multiple of blocklen greater than maclen
1045 * 2. IV except for SSL3 and TLS 1.0
1046 */
1047 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1048 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
1049 {
1050 transform->minlen = transform->maclen
1051 + cipher_info->block_size;
1052 }
1053 else
1054 #endif
1055 {
1056 transform->minlen = transform->maclen
1057 + cipher_info->block_size
1058 - transform->maclen % cipher_info->block_size;
1059 }
1060
1061 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
1062 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
1063 minor_ver == MBEDTLS_SSL_MINOR_VERSION_1 )
1064 ; /* No need to adjust minlen */
1065 else
1066 #endif
1067 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
1068 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_2 ||
1069 minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1070 {
1071 transform->minlen += transform->ivlen;
1072 }
1073 else
1074 #endif
1075 {
1076 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1077 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1078 goto end;
1079 }
1080 }
1081 }
1082 else
1083 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1084 {
1085 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1086 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1087 }
1088
1089 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
1090 (unsigned) keylen,
1091 (unsigned) transform->minlen,
1092 (unsigned) transform->ivlen,
1093 (unsigned) transform->maclen ) );
1094
1095 /*
1096 * Finally setup the cipher contexts, IVs and MAC secrets.
1097 */
1098 #if defined(MBEDTLS_SSL_CLI_C)
1099 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
1100 {
1101 key1 = keyblk + mac_key_len * 2;
1102 key2 = keyblk + mac_key_len * 2 + keylen;
1103
1104 mac_enc = keyblk;
1105 mac_dec = keyblk + mac_key_len;
1106
1107 /*
1108 * This is not used in TLS v1.1.
1109 */
1110 iv_copy_len = ( transform->fixed_ivlen ) ?
1111 transform->fixed_ivlen : transform->ivlen;
1112 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
1113 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
1114 iv_copy_len );
1115 }
1116 else
1117 #endif /* MBEDTLS_SSL_CLI_C */
1118 #if defined(MBEDTLS_SSL_SRV_C)
1119 if( endpoint == MBEDTLS_SSL_IS_SERVER )
1120 {
1121 key1 = keyblk + mac_key_len * 2 + keylen;
1122 key2 = keyblk + mac_key_len * 2;
1123
1124 mac_enc = keyblk + mac_key_len;
1125 mac_dec = keyblk;
1126
1127 /*
1128 * This is not used in TLS v1.1.
1129 */
1130 iv_copy_len = ( transform->fixed_ivlen ) ?
1131 transform->fixed_ivlen : transform->ivlen;
1132 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
1133 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
1134 iv_copy_len );
1135 }
1136 else
1137 #endif /* MBEDTLS_SSL_SRV_C */
1138 {
1139 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1140 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1141 goto end;
1142 }
1143
1144 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1145 #if defined(MBEDTLS_SSL_PROTO_SSL3)
1146 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1147 {
1148 if( mac_key_len > sizeof( transform->mac_enc ) )
1149 {
1150 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1151 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1152 goto end;
1153 }
1154
1155 memcpy( transform->mac_enc, mac_enc, mac_key_len );
1156 memcpy( transform->mac_dec, mac_dec, mac_key_len );
1157 }
1158 else
1159 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
1160 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1161 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1162 if( minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
1163 {
1164 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1165 For AEAD-based ciphersuites, there is nothing to do here. */
1166 if( mac_key_len != 0 )
1167 {
1168 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
1169 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
1170 }
1171 }
1172 else
1173 #endif
1174 {
1175 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1176 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1177 goto end;
1178 }
1179 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1180
1181 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1182 if( mbedtls_ssl_hw_record_init != NULL )
1183 {
1184 ret = 0;
1185
1186 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
1187
1188 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen,
1189 transform->iv_enc, transform->iv_dec,
1190 iv_copy_len,
1191 mac_enc, mac_dec,
1192 mac_key_len ) ) != 0 )
1193 {
1194 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1195 ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
1196 goto end;
1197 }
1198 }
1199 #else
1200 ((void) mac_dec);
1201 ((void) mac_enc);
1202 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
1203
1204 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
1205 if( ssl->conf->f_export_keys != NULL )
1206 {
1207 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
1208 master, keyblk,
1209 mac_key_len, keylen,
1210 iv_copy_len );
1211 }
1212
1213 if( ssl->conf->f_export_keys_ext != NULL )
1214 {
1215 ssl->conf->f_export_keys_ext( ssl->conf->p_export_keys,
1216 master, keyblk,
1217 mac_key_len, keylen,
1218 iv_copy_len,
1219 randbytes + 32,
1220 randbytes,
1221 tls_prf_get_type( tls_prf ) );
1222 }
1223 #endif
1224
1225 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1226
1227 /* Only use PSA-based ciphers for TLS-1.2.
1228 * That's relevant at least for TLS-1.0, where
1229 * we assume that mbedtls_cipher_crypt() updates
1230 * the structure field for the IV, which the PSA-based
1231 * implementation currently doesn't. */
1232 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1233 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1234 {
1235 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_enc,
1236 cipher_info, transform->taglen );
1237 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
1238 {
1239 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1240 goto end;
1241 }
1242
1243 if( ret == 0 )
1244 {
1245 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based encryption cipher context" ) );
1246 psa_fallthrough = 0;
1247 }
1248 else
1249 {
1250 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record encryption - fall through to default setup." ) );
1251 psa_fallthrough = 1;
1252 }
1253 }
1254 else
1255 psa_fallthrough = 1;
1256 #else
1257 psa_fallthrough = 1;
1258 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1259
1260 if( psa_fallthrough == 1 )
1261 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1262 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
1263 cipher_info ) ) != 0 )
1264 {
1265 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1266 goto end;
1267 }
1268
1269 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1270 /* Only use PSA-based ciphers for TLS-1.2.
1271 * That's relevant at least for TLS-1.0, where
1272 * we assume that mbedtls_cipher_crypt() updates
1273 * the structure field for the IV, which the PSA-based
1274 * implementation currently doesn't. */
1275 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1276 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1277 {
1278 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_dec,
1279 cipher_info, transform->taglen );
1280 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
1281 {
1282 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1283 goto end;
1284 }
1285
1286 if( ret == 0 )
1287 {
1288 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based decryption cipher context" ) );
1289 psa_fallthrough = 0;
1290 }
1291 else
1292 {
1293 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record decryption - fall through to default setup." ) );
1294 psa_fallthrough = 1;
1295 }
1296 }
1297 else
1298 psa_fallthrough = 1;
1299 #else
1300 psa_fallthrough = 1;
1301 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1302
1303 if( psa_fallthrough == 1 )
1304 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1305 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
1306 cipher_info ) ) != 0 )
1307 {
1308 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1309 goto end;
1310 }
1311
1312 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
1313 cipher_info->key_bitlen,
1314 MBEDTLS_ENCRYPT ) ) != 0 )
1315 {
1316 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1317 goto end;
1318 }
1319
1320 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
1321 cipher_info->key_bitlen,
1322 MBEDTLS_DECRYPT ) ) != 0 )
1323 {
1324 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1325 goto end;
1326 }
1327
1328 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1329 if( cipher_info->mode == MBEDTLS_MODE_CBC )
1330 {
1331 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1332 MBEDTLS_PADDING_NONE ) ) != 0 )
1333 {
1334 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1335 goto end;
1336 }
1337
1338 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1339 MBEDTLS_PADDING_NONE ) ) != 0 )
1340 {
1341 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1342 goto end;
1343 }
1344 }
1345 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1346
1347
1348 /* Initialize Zlib contexts */
1349 #if defined(MBEDTLS_ZLIB_SUPPORT)
1350 if( compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
1351 {
1352 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
1353
1354 memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1355 memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
1356
1357 if( deflateInit( &transform->ctx_deflate,
1358 Z_DEFAULT_COMPRESSION ) != Z_OK ||
1359 inflateInit( &transform->ctx_inflate ) != Z_OK )
1360 {
1361 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1362 ret = MBEDTLS_ERR_SSL_COMPRESSION_FAILED;
1363 goto end;
1364 }
1365 }
1366 #endif /* MBEDTLS_ZLIB_SUPPORT */
1367
1368 end:
1369 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
1370 return( ret );
1371 }
1372
1373 /*
1374 * Set appropriate PRF function and other SSL / TLS 1.0/1.1 / TLS1.2 functions
1375 *
1376 * Inputs:
1377 * - SSL/TLS minor version
1378 * - hash associated with the ciphersuite (only used by TLS 1.2)
1379 *
1380 * Outputs:
1381 * - the tls_prf, calc_verify and calc_finished members of handshake structure
1382 */
ssl_set_handshake_prfs(mbedtls_ssl_handshake_params * handshake,int minor_ver,mbedtls_md_type_t hash)1383 static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
1384 int minor_ver,
1385 mbedtls_md_type_t hash )
1386 {
1387 #if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1388 (void) hash;
1389 #endif
1390
1391 #if defined(MBEDTLS_SSL_PROTO_SSL3)
1392 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1393 {
1394 handshake->tls_prf = ssl3_prf;
1395 handshake->calc_verify = ssl_calc_verify_ssl;
1396 handshake->calc_finished = ssl_calc_finished_ssl;
1397 }
1398 else
1399 #endif
1400 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1401 if( minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
1402 {
1403 handshake->tls_prf = tls1_prf;
1404 handshake->calc_verify = ssl_calc_verify_tls;
1405 handshake->calc_finished = ssl_calc_finished_tls;
1406 }
1407 else
1408 #endif
1409 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1410 #if defined(MBEDTLS_SHA512_C)
1411 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1412 hash == MBEDTLS_MD_SHA384 )
1413 {
1414 handshake->tls_prf = tls_prf_sha384;
1415 handshake->calc_verify = ssl_calc_verify_tls_sha384;
1416 handshake->calc_finished = ssl_calc_finished_tls_sha384;
1417 }
1418 else
1419 #endif
1420 #if defined(MBEDTLS_SHA256_C)
1421 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1422 {
1423 handshake->tls_prf = tls_prf_sha256;
1424 handshake->calc_verify = ssl_calc_verify_tls_sha256;
1425 handshake->calc_finished = ssl_calc_finished_tls_sha256;
1426 }
1427 else
1428 #endif
1429 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1430 {
1431 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1432 }
1433
1434 return( 0 );
1435 }
1436
1437 /*
1438 * Compute master secret if needed
1439 *
1440 * Parameters:
1441 * [in/out] handshake
1442 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
1443 * (PSA-PSK) ciphersuite_info, psk_opaque
1444 * [out] premaster (cleared)
1445 * [out] master
1446 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
1447 * debug: conf->f_dbg, conf->p_dbg
1448 * EMS: passed to calc_verify (debug + (SSL3) session_negotiate)
1449 * PSA-PSA: minor_ver, conf
1450 */
ssl_compute_master(mbedtls_ssl_handshake_params * handshake,unsigned char * master,const mbedtls_ssl_context * ssl)1451 static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
1452 unsigned char *master,
1453 const mbedtls_ssl_context *ssl )
1454 {
1455 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1456
1457 /* cf. RFC 5246, Section 8.1:
1458 * "The master secret is always exactly 48 bytes in length." */
1459 size_t const master_secret_len = 48;
1460
1461 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1462 unsigned char session_hash[48];
1463 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1464
1465 /* The label for the KDF used for key expansion.
1466 * This is either "master secret" or "extended master secret"
1467 * depending on whether the Extended Master Secret extension
1468 * is used. */
1469 char const *lbl = "master secret";
1470
1471 /* The salt for the KDF used for key expansion.
1472 * - If the Extended Master Secret extension is not used,
1473 * this is ClientHello.Random + ServerHello.Random
1474 * (see Sect. 8.1 in RFC 5246).
1475 * - If the Extended Master Secret extension is used,
1476 * this is the transcript of the handshake so far.
1477 * (see Sect. 4 in RFC 7627). */
1478 unsigned char const *salt = handshake->randbytes;
1479 size_t salt_len = 64;
1480
1481 #if !defined(MBEDTLS_DEBUG_C) && \
1482 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
1483 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
1484 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
1485 ssl = NULL; /* make sure we don't use it except for those cases */
1486 (void) ssl;
1487 #endif
1488
1489 if( handshake->resume != 0 )
1490 {
1491 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
1492 return( 0 );
1493 }
1494
1495 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1496 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
1497 {
1498 lbl = "extended master secret";
1499 salt = session_hash;
1500 handshake->calc_verify( ssl, session_hash, &salt_len );
1501
1502 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
1503 session_hash, salt_len );
1504 }
1505 #endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */
1506
1507 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
1508 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1509 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
1510 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1511 ssl_use_opaque_psk( ssl ) == 1 )
1512 {
1513 /* Perform PSK-to-MS expansion in a single step. */
1514 psa_status_t status;
1515 psa_algorithm_t alg;
1516 psa_key_id_t psk;
1517 psa_key_derivation_operation_t derivation =
1518 PSA_KEY_DERIVATION_OPERATION_INIT;
1519 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
1520
1521 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
1522
1523 psk = mbedtls_ssl_get_opaque_psk( ssl );
1524
1525 if( hash_alg == MBEDTLS_MD_SHA384 )
1526 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
1527 else
1528 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
1529
1530 status = setup_psa_key_derivation( &derivation, psk, alg,
1531 salt, salt_len,
1532 (unsigned char const *) lbl,
1533 (size_t) strlen( lbl ),
1534 master_secret_len );
1535 if( status != PSA_SUCCESS )
1536 {
1537 psa_key_derivation_abort( &derivation );
1538 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1539 }
1540
1541 status = psa_key_derivation_output_bytes( &derivation,
1542 master,
1543 master_secret_len );
1544 if( status != PSA_SUCCESS )
1545 {
1546 psa_key_derivation_abort( &derivation );
1547 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1548 }
1549
1550 status = psa_key_derivation_abort( &derivation );
1551 if( status != PSA_SUCCESS )
1552 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1553 }
1554 else
1555 #endif
1556 {
1557 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
1558 lbl, salt, salt_len,
1559 master,
1560 master_secret_len );
1561 if( ret != 0 )
1562 {
1563 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
1564 return( ret );
1565 }
1566
1567 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
1568 handshake->premaster,
1569 handshake->pmslen );
1570
1571 mbedtls_platform_zeroize( handshake->premaster,
1572 sizeof(handshake->premaster) );
1573 }
1574
1575 return( 0 );
1576 }
1577
mbedtls_ssl_derive_keys(mbedtls_ssl_context * ssl)1578 int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
1579 {
1580 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1581 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
1582 ssl->handshake->ciphersuite_info;
1583
1584 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
1585
1586 /* Set PRF, calc_verify and calc_finished function pointers */
1587 ret = ssl_set_handshake_prfs( ssl->handshake,
1588 ssl->minor_ver,
1589 ciphersuite_info->mac );
1590 if( ret != 0 )
1591 {
1592 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
1593 return( ret );
1594 }
1595
1596 /* Compute master secret if needed */
1597 ret = ssl_compute_master( ssl->handshake,
1598 ssl->session_negotiate->master,
1599 ssl );
1600 if( ret != 0 )
1601 {
1602 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
1603 return( ret );
1604 }
1605
1606 /* Swap the client and server random values:
1607 * - MS derivation wanted client+server (RFC 5246 8.1)
1608 * - key derivation wants server+client (RFC 5246 6.3) */
1609 {
1610 unsigned char tmp[64];
1611 memcpy( tmp, ssl->handshake->randbytes, 64 );
1612 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
1613 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
1614 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
1615 }
1616
1617 /* Populate transform structure */
1618 ret = ssl_populate_transform( ssl->transform_negotiate,
1619 ssl->session_negotiate->ciphersuite,
1620 ssl->session_negotiate->master,
1621 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1622 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1623 ssl->session_negotiate->encrypt_then_mac,
1624 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1625 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1626 ssl->session_negotiate->trunc_hmac,
1627 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1628 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1629 #if defined(MBEDTLS_ZLIB_SUPPORT)
1630 ssl->session_negotiate->compression,
1631 #endif
1632 ssl->handshake->tls_prf,
1633 ssl->handshake->randbytes,
1634 ssl->minor_ver,
1635 ssl->conf->endpoint,
1636 ssl );
1637 if( ret != 0 )
1638 {
1639 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
1640 return( ret );
1641 }
1642
1643 /* We no longer need Server/ClientHello.random values */
1644 mbedtls_platform_zeroize( ssl->handshake->randbytes,
1645 sizeof( ssl->handshake->randbytes ) );
1646
1647 /* Allocate compression buffer */
1648 #if defined(MBEDTLS_ZLIB_SUPPORT)
1649 if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
1650 ssl->compress_buf == NULL )
1651 {
1652 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
1653 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
1654 if( ssl->compress_buf == NULL )
1655 {
1656 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
1657 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
1658 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1659 }
1660 }
1661 #endif
1662
1663 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
1664
1665 return( 0 );
1666 }
1667
1668 #if defined(MBEDTLS_SSL_PROTO_SSL3)
ssl_calc_verify_ssl(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1669 void ssl_calc_verify_ssl( const mbedtls_ssl_context *ssl,
1670 unsigned char *hash,
1671 size_t *hlen )
1672 {
1673 mbedtls_md5_context md5;
1674 mbedtls_sha1_context sha1;
1675 unsigned char pad_1[48];
1676 unsigned char pad_2[48];
1677
1678 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
1679
1680 mbedtls_md5_init( &md5 );
1681 mbedtls_sha1_init( &sha1 );
1682
1683 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1684 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1685
1686 memset( pad_1, 0x36, 48 );
1687 memset( pad_2, 0x5C, 48 );
1688
1689 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1690 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1691 mbedtls_md5_finish_ret( &md5, hash );
1692
1693 mbedtls_md5_starts_ret( &md5 );
1694 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1695 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1696 mbedtls_md5_update_ret( &md5, hash, 16 );
1697 mbedtls_md5_finish_ret( &md5, hash );
1698
1699 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1700 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1701 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1702
1703 mbedtls_sha1_starts_ret( &sha1 );
1704 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1705 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1706 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1707 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1708
1709 *hlen = 36;
1710
1711 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1712 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1713
1714 mbedtls_md5_free( &md5 );
1715 mbedtls_sha1_free( &sha1 );
1716
1717 return;
1718 }
1719 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
1720
1721 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
ssl_calc_verify_tls(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1722 void ssl_calc_verify_tls( const mbedtls_ssl_context *ssl,
1723 unsigned char *hash,
1724 size_t *hlen )
1725 {
1726 mbedtls_md5_context md5;
1727 mbedtls_sha1_context sha1;
1728
1729 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
1730
1731 mbedtls_md5_init( &md5 );
1732 mbedtls_sha1_init( &sha1 );
1733
1734 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1735 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1736
1737 mbedtls_md5_finish_ret( &md5, hash );
1738 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1739
1740 *hlen = 36;
1741
1742 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1743 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1744
1745 mbedtls_md5_free( &md5 );
1746 mbedtls_sha1_free( &sha1 );
1747
1748 return;
1749 }
1750 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1751
1752 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1753 #if defined(MBEDTLS_SHA256_C)
ssl_calc_verify_tls_sha256(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1754 void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1755 unsigned char *hash,
1756 size_t *hlen )
1757 {
1758 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1759 size_t hash_size;
1760 psa_status_t status;
1761 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
1762
1763 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
1764 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
1765 if( status != PSA_SUCCESS )
1766 {
1767 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1768 return;
1769 }
1770
1771 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
1772 if( status != PSA_SUCCESS )
1773 {
1774 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1775 return;
1776 }
1777
1778 *hlen = 32;
1779 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
1780 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1781 #else
1782 mbedtls_sha256_context sha256;
1783
1784 mbedtls_sha256_init( &sha256 );
1785
1786 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1787
1788 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1789 mbedtls_sha256_finish_ret( &sha256, hash );
1790
1791 *hlen = 32;
1792
1793 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1794 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1795
1796 mbedtls_sha256_free( &sha256 );
1797 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1798 return;
1799 }
1800 #endif /* MBEDTLS_SHA256_C */
1801
1802 #if defined(MBEDTLS_SHA512_C)
ssl_calc_verify_tls_sha384(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1803 void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1804 unsigned char *hash,
1805 size_t *hlen )
1806 {
1807 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1808 size_t hash_size;
1809 psa_status_t status;
1810 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
1811
1812 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
1813 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
1814 if( status != PSA_SUCCESS )
1815 {
1816 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1817 return;
1818 }
1819
1820 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
1821 if( status != PSA_SUCCESS )
1822 {
1823 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1824 return;
1825 }
1826
1827 *hlen = 48;
1828 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
1829 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1830 #else
1831 mbedtls_sha512_context sha512;
1832
1833 mbedtls_sha512_init( &sha512 );
1834
1835 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1836
1837 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1838 mbedtls_sha512_finish_ret( &sha512, hash );
1839
1840 *hlen = 48;
1841
1842 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1843 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1844
1845 mbedtls_sha512_free( &sha512 );
1846 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1847 return;
1848 }
1849 #endif /* MBEDTLS_SHA512_C */
1850 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1851
1852 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
mbedtls_ssl_psk_derive_premaster(mbedtls_ssl_context * ssl,mbedtls_key_exchange_type_t key_ex)1853 int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
1854 {
1855 unsigned char *p = ssl->handshake->premaster;
1856 unsigned char *end = p + sizeof( ssl->handshake->premaster );
1857 const unsigned char *psk = NULL;
1858 size_t psk_len = 0;
1859
1860 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
1861 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
1862 {
1863 /*
1864 * This should never happen because the existence of a PSK is always
1865 * checked before calling this function
1866 */
1867 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1868 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1869 }
1870
1871 /*
1872 * PMS = struct {
1873 * opaque other_secret<0..2^16-1>;
1874 * opaque psk<0..2^16-1>;
1875 * };
1876 * with "other_secret" depending on the particular key exchange
1877 */
1878 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1879 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
1880 {
1881 if( end - p < 2 )
1882 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1883
1884 *(p++) = (unsigned char)( psk_len >> 8 );
1885 *(p++) = (unsigned char)( psk_len );
1886
1887 if( end < p || (size_t)( end - p ) < psk_len )
1888 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1889
1890 memset( p, 0, psk_len );
1891 p += psk_len;
1892 }
1893 else
1894 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1895 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1896 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
1897 {
1898 /*
1899 * other_secret already set by the ClientKeyExchange message,
1900 * and is 48 bytes long
1901 */
1902 if( end - p < 2 )
1903 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1904
1905 *p++ = 0;
1906 *p++ = 48;
1907 p += 48;
1908 }
1909 else
1910 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1911 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1912 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
1913 {
1914 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1915 size_t len;
1916
1917 /* Write length only when we know the actual value */
1918 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
1919 p + 2, end - ( p + 2 ), &len,
1920 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
1921 {
1922 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
1923 return( ret );
1924 }
1925 *(p++) = (unsigned char)( len >> 8 );
1926 *(p++) = (unsigned char)( len );
1927 p += len;
1928
1929 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
1930 }
1931 else
1932 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1933 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1934 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
1935 {
1936 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1937 size_t zlen;
1938
1939 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
1940 p + 2, end - ( p + 2 ),
1941 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
1942 {
1943 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
1944 return( ret );
1945 }
1946
1947 *(p++) = (unsigned char)( zlen >> 8 );
1948 *(p++) = (unsigned char)( zlen );
1949 p += zlen;
1950
1951 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
1952 MBEDTLS_DEBUG_ECDH_Z );
1953 }
1954 else
1955 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
1956 {
1957 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1958 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1959 }
1960
1961 /* opaque psk<0..2^16-1>; */
1962 if( end - p < 2 )
1963 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1964
1965 *(p++) = (unsigned char)( psk_len >> 8 );
1966 *(p++) = (unsigned char)( psk_len );
1967
1968 if( end < p || (size_t)( end - p ) < psk_len )
1969 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1970
1971 memcpy( p, psk, psk_len );
1972 p += psk_len;
1973
1974 ssl->handshake->pmslen = p - ssl->handshake->premaster;
1975
1976 return( 0 );
1977 }
1978 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1979
1980 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
1981 static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
1982
1983 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_resend_hello_request(mbedtls_ssl_context * ssl)1984 int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
1985 {
1986 /* If renegotiation is not enforced, retransmit until we would reach max
1987 * timeout if we were using the usual handshake doubling scheme */
1988 if( ssl->conf->renego_max_records < 0 )
1989 {
1990 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
1991 unsigned char doublings = 1;
1992
1993 while( ratio != 0 )
1994 {
1995 ++doublings;
1996 ratio >>= 1;
1997 }
1998
1999 if( ++ssl->renego_records_seen > doublings )
2000 {
2001 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
2002 return( 0 );
2003 }
2004 }
2005
2006 return( ssl_write_hello_request( ssl ) );
2007 }
2008 #endif
2009 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
2010
2011 #if defined(MBEDTLS_X509_CRT_PARSE_C)
ssl_clear_peer_cert(mbedtls_ssl_session * session)2012 static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
2013 {
2014 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2015 if( session->peer_cert != NULL )
2016 {
2017 mbedtls_x509_crt_free( session->peer_cert );
2018 mbedtls_free( session->peer_cert );
2019 session->peer_cert = NULL;
2020 }
2021 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2022 if( session->peer_cert_digest != NULL )
2023 {
2024 /* Zeroization is not necessary. */
2025 mbedtls_free( session->peer_cert_digest );
2026 session->peer_cert_digest = NULL;
2027 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
2028 session->peer_cert_digest_len = 0;
2029 }
2030 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2031 }
2032 #endif /* MBEDTLS_X509_CRT_PARSE_C */
2033
2034 /*
2035 * Handshake functions
2036 */
2037 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
2038 /* No certificate support -> dummy functions */
mbedtls_ssl_write_certificate(mbedtls_ssl_context * ssl)2039 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
2040 {
2041 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2042 ssl->handshake->ciphersuite_info;
2043
2044 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
2045
2046 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2047 {
2048 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
2049 ssl->state++;
2050 return( 0 );
2051 }
2052
2053 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2054 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2055 }
2056
mbedtls_ssl_parse_certificate(mbedtls_ssl_context * ssl)2057 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
2058 {
2059 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2060 ssl->handshake->ciphersuite_info;
2061
2062 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2063
2064 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2065 {
2066 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
2067 ssl->state++;
2068 return( 0 );
2069 }
2070
2071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2072 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2073 }
2074
2075 #else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
2076 /* Some certificate support -> implement write and parse */
2077
mbedtls_ssl_write_certificate(mbedtls_ssl_context * ssl)2078 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
2079 {
2080 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2081 size_t i, n;
2082 const mbedtls_x509_crt *crt;
2083 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2084 ssl->handshake->ciphersuite_info;
2085
2086 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
2087
2088 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2089 {
2090 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
2091 ssl->state++;
2092 return( 0 );
2093 }
2094
2095 #if defined(MBEDTLS_SSL_CLI_C)
2096 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
2097 {
2098 if( ssl->client_auth == 0 )
2099 {
2100 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
2101 ssl->state++;
2102 return( 0 );
2103 }
2104
2105 #if defined(MBEDTLS_SSL_PROTO_SSL3)
2106 /*
2107 * If using SSLv3 and got no cert, send an Alert message
2108 * (otherwise an empty Certificate message will be sent).
2109 */
2110 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
2111 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
2112 {
2113 ssl->out_msglen = 2;
2114 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
2115 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
2116 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
2117
2118 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
2119 goto write_msg;
2120 }
2121 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
2122 }
2123 #endif /* MBEDTLS_SSL_CLI_C */
2124 #if defined(MBEDTLS_SSL_SRV_C)
2125 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2126 {
2127 if( mbedtls_ssl_own_cert( ssl ) == NULL )
2128 {
2129 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
2130 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
2131 }
2132 }
2133 #endif
2134
2135 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
2136
2137 /*
2138 * 0 . 0 handshake type
2139 * 1 . 3 handshake length
2140 * 4 . 6 length of all certs
2141 * 7 . 9 length of cert. 1
2142 * 10 . n-1 peer certificate
2143 * n . n+2 length of cert. 2
2144 * n+3 . ... upper level cert, etc.
2145 */
2146 i = 7;
2147 crt = mbedtls_ssl_own_cert( ssl );
2148
2149 while( crt != NULL )
2150 {
2151 n = crt->raw.len;
2152 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
2153 {
2154 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
2155 i + 3 + n, MBEDTLS_SSL_OUT_CONTENT_LEN ) );
2156 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
2157 }
2158
2159 ssl->out_msg[i ] = (unsigned char)( n >> 16 );
2160 ssl->out_msg[i + 1] = (unsigned char)( n >> 8 );
2161 ssl->out_msg[i + 2] = (unsigned char)( n );
2162
2163 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
2164 i += n; crt = crt->next;
2165 }
2166
2167 ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 );
2168 ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 );
2169 ssl->out_msg[6] = (unsigned char)( ( i - 7 ) );
2170
2171 ssl->out_msglen = i;
2172 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2173 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
2174
2175 #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
2176 write_msg:
2177 #endif
2178
2179 ssl->state++;
2180
2181 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
2182 {
2183 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
2184 return( ret );
2185 }
2186
2187 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
2188
2189 return( ret );
2190 }
2191
2192 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
2193
2194 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ssl_check_peer_crt_unchanged(mbedtls_ssl_context * ssl,unsigned char * crt_buf,size_t crt_buf_len)2195 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
2196 unsigned char *crt_buf,
2197 size_t crt_buf_len )
2198 {
2199 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
2200
2201 if( peer_crt == NULL )
2202 return( -1 );
2203
2204 if( peer_crt->raw.len != crt_buf_len )
2205 return( -1 );
2206
2207 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
2208 }
2209 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
ssl_check_peer_crt_unchanged(mbedtls_ssl_context * ssl,unsigned char * crt_buf,size_t crt_buf_len)2210 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
2211 unsigned char *crt_buf,
2212 size_t crt_buf_len )
2213 {
2214 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2215 unsigned char const * const peer_cert_digest =
2216 ssl->session->peer_cert_digest;
2217 mbedtls_md_type_t const peer_cert_digest_type =
2218 ssl->session->peer_cert_digest_type;
2219 mbedtls_md_info_t const * const digest_info =
2220 mbedtls_md_info_from_type( peer_cert_digest_type );
2221 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
2222 size_t digest_len;
2223
2224 if( peer_cert_digest == NULL || digest_info == NULL )
2225 return( -1 );
2226
2227 digest_len = mbedtls_md_get_size( digest_info );
2228 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
2229 return( -1 );
2230
2231 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
2232 if( ret != 0 )
2233 return( -1 );
2234
2235 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
2236 }
2237 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2238 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
2239
2240 /*
2241 * Once the certificate message is read, parse it into a cert chain and
2242 * perform basic checks, but leave actual verification to the caller
2243 */
ssl_parse_certificate_chain(mbedtls_ssl_context * ssl,mbedtls_x509_crt * chain)2244 static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
2245 mbedtls_x509_crt *chain )
2246 {
2247 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2248 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
2249 int crt_cnt=0;
2250 #endif
2251 size_t i, n;
2252 uint8_t alert;
2253
2254 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2255 {
2256 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2257 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2258 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2259 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2260 }
2261
2262 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
2263 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
2264 {
2265 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2266 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2267 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2268 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2269 }
2270
2271 i = mbedtls_ssl_hs_hdr_len( ssl );
2272
2273 /*
2274 * Same message structure as in mbedtls_ssl_write_certificate()
2275 */
2276 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
2277
2278 if( ssl->in_msg[i] != 0 ||
2279 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
2280 {
2281 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2282 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2283 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2284 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2285 }
2286
2287 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
2288 i += 3;
2289
2290 /* Iterate through and parse the CRTs in the provided chain. */
2291 while( i < ssl->in_hslen )
2292 {
2293 /* Check that there's room for the next CRT's length fields. */
2294 if ( i + 3 > ssl->in_hslen ) {
2295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2296 mbedtls_ssl_send_alert_message( ssl,
2297 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2298 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2299 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2300 }
2301 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
2302 * anything beyond 2**16 ~ 64K. */
2303 if( ssl->in_msg[i] != 0 )
2304 {
2305 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2306 mbedtls_ssl_send_alert_message( ssl,
2307 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2308 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2309 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2310 }
2311
2312 /* Read length of the next CRT in the chain. */
2313 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
2314 | (unsigned int) ssl->in_msg[i + 2];
2315 i += 3;
2316
2317 if( n < 128 || i + n > ssl->in_hslen )
2318 {
2319 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2320 mbedtls_ssl_send_alert_message( ssl,
2321 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2322 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2323 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2324 }
2325
2326 /* Check if we're handling the first CRT in the chain. */
2327 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
2328 if( crt_cnt++ == 0 &&
2329 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2330 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
2331 {
2332 /* During client-side renegotiation, check that the server's
2333 * end-CRTs hasn't changed compared to the initial handshake,
2334 * mitigating the triple handshake attack. On success, reuse
2335 * the original end-CRT instead of parsing it again. */
2336 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
2337 if( ssl_check_peer_crt_unchanged( ssl,
2338 &ssl->in_msg[i],
2339 n ) != 0 )
2340 {
2341 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
2342 mbedtls_ssl_send_alert_message( ssl,
2343 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2344 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
2345 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2346 }
2347
2348 /* Now we can safely free the original chain. */
2349 ssl_clear_peer_cert( ssl->session );
2350 }
2351 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
2352
2353 /* Parse the next certificate in the chain. */
2354 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2355 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
2356 #else
2357 /* If we don't need to store the CRT chain permanently, parse
2358 * it in-place from the input buffer instead of making a copy. */
2359 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
2360 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2361 switch( ret )
2362 {
2363 case 0: /*ok*/
2364 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
2365 /* Ignore certificate with an unknown algorithm: maybe a
2366 prior certificate was already trusted. */
2367 break;
2368
2369 case MBEDTLS_ERR_X509_ALLOC_FAILED:
2370 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
2371 goto crt_parse_der_failed;
2372
2373 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
2374 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2375 goto crt_parse_der_failed;
2376
2377 default:
2378 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
2379 crt_parse_der_failed:
2380 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
2381 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
2382 return( ret );
2383 }
2384
2385 i += n;
2386 }
2387
2388 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
2389 return( 0 );
2390 }
2391
2392 #if defined(MBEDTLS_SSL_SRV_C)
ssl_srv_check_client_no_crt_notification(mbedtls_ssl_context * ssl)2393 static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
2394 {
2395 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
2396 return( -1 );
2397
2398 #if defined(MBEDTLS_SSL_PROTO_SSL3)
2399 /*
2400 * Check if the client sent an empty certificate
2401 */
2402 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
2403 {
2404 if( ssl->in_msglen == 2 &&
2405 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
2406 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
2407 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
2408 {
2409 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
2410 return( 0 );
2411 }
2412
2413 return( -1 );
2414 }
2415 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
2416
2417 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2418 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2419 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
2420 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2421 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
2422 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
2423 {
2424 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
2425 return( 0 );
2426 }
2427
2428 return( -1 );
2429 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2430 MBEDTLS_SSL_PROTO_TLS1_2 */
2431 }
2432 #endif /* MBEDTLS_SSL_SRV_C */
2433
2434 /* Check if a certificate message is expected.
2435 * Return either
2436 * - SSL_CERTIFICATE_EXPECTED, or
2437 * - SSL_CERTIFICATE_SKIP
2438 * indicating whether a Certificate message is expected or not.
2439 */
2440 #define SSL_CERTIFICATE_EXPECTED 0
2441 #define SSL_CERTIFICATE_SKIP 1
ssl_parse_certificate_coordinate(mbedtls_ssl_context * ssl,int authmode)2442 static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
2443 int authmode )
2444 {
2445 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2446 ssl->handshake->ciphersuite_info;
2447
2448 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2449 return( SSL_CERTIFICATE_SKIP );
2450
2451 #if defined(MBEDTLS_SSL_SRV_C)
2452 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2453 {
2454 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2455 return( SSL_CERTIFICATE_SKIP );
2456
2457 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2458 {
2459 ssl->session_negotiate->verify_result =
2460 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
2461 return( SSL_CERTIFICATE_SKIP );
2462 }
2463 }
2464 #else
2465 ((void) authmode);
2466 #endif /* MBEDTLS_SSL_SRV_C */
2467
2468 return( SSL_CERTIFICATE_EXPECTED );
2469 }
2470
ssl_parse_certificate_verify(mbedtls_ssl_context * ssl,int authmode,mbedtls_x509_crt * chain,void * rs_ctx)2471 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
2472 int authmode,
2473 mbedtls_x509_crt *chain,
2474 void *rs_ctx )
2475 {
2476 int ret = 0;
2477 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2478 ssl->handshake->ciphersuite_info;
2479 int have_ca_chain = 0;
2480
2481 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
2482 void *p_vrfy;
2483
2484 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2485 return( 0 );
2486
2487 if( ssl->f_vrfy != NULL )
2488 {
2489 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
2490 f_vrfy = ssl->f_vrfy;
2491 p_vrfy = ssl->p_vrfy;
2492 }
2493 else
2494 {
2495 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
2496 f_vrfy = ssl->conf->f_vrfy;
2497 p_vrfy = ssl->conf->p_vrfy;
2498 }
2499
2500 /*
2501 * Main check: verify certificate
2502 */
2503 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
2504 if( ssl->conf->f_ca_cb != NULL )
2505 {
2506 ((void) rs_ctx);
2507 have_ca_chain = 1;
2508
2509 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
2510 ret = mbedtls_x509_crt_verify_with_ca_cb(
2511 chain,
2512 ssl->conf->f_ca_cb,
2513 ssl->conf->p_ca_cb,
2514 ssl->conf->cert_profile,
2515 ssl->hostname,
2516 &ssl->session_negotiate->verify_result,
2517 f_vrfy, p_vrfy );
2518 }
2519 else
2520 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
2521 {
2522 mbedtls_x509_crt *ca_chain;
2523 mbedtls_x509_crl *ca_crl;
2524
2525 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2526 if( ssl->handshake->sni_ca_chain != NULL )
2527 {
2528 ca_chain = ssl->handshake->sni_ca_chain;
2529 ca_crl = ssl->handshake->sni_ca_crl;
2530 }
2531 else
2532 #endif
2533 {
2534 ca_chain = ssl->conf->ca_chain;
2535 ca_crl = ssl->conf->ca_crl;
2536 }
2537
2538 if( ca_chain != NULL )
2539 have_ca_chain = 1;
2540
2541 ret = mbedtls_x509_crt_verify_restartable(
2542 chain,
2543 ca_chain, ca_crl,
2544 ssl->conf->cert_profile,
2545 ssl->hostname,
2546 &ssl->session_negotiate->verify_result,
2547 f_vrfy, p_vrfy, rs_ctx );
2548 }
2549
2550 if( ret != 0 )
2551 {
2552 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
2553 }
2554
2555 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2556 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2557 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
2558 #endif
2559
2560 /*
2561 * Secondary checks: always done, but change 'ret' only if it was 0
2562 */
2563
2564 #if defined(MBEDTLS_ECP_C)
2565 {
2566 const mbedtls_pk_context *pk = &chain->pk;
2567
2568 /* If certificate uses an EC key, make sure the curve is OK */
2569 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
2570 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
2571 {
2572 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
2573
2574 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
2575 if( ret == 0 )
2576 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
2577 }
2578 }
2579 #endif /* MBEDTLS_ECP_C */
2580
2581 if( mbedtls_ssl_check_cert_usage( chain,
2582 ciphersuite_info,
2583 ! ssl->conf->endpoint,
2584 &ssl->session_negotiate->verify_result ) != 0 )
2585 {
2586 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
2587 if( ret == 0 )
2588 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
2589 }
2590
2591 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
2592 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
2593 * with details encoded in the verification flags. All other kinds
2594 * of error codes, including those from the user provided f_vrfy
2595 * functions, are treated as fatal and lead to a failure of
2596 * ssl_parse_certificate even if verification was optional. */
2597 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
2598 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
2599 ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
2600 {
2601 ret = 0;
2602 }
2603
2604 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
2605 {
2606 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
2607 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
2608 }
2609
2610 if( ret != 0 )
2611 {
2612 uint8_t alert;
2613
2614 /* The certificate may have been rejected for several reasons.
2615 Pick one and send the corresponding alert. Which alert to send
2616 may be a subject of debate in some cases. */
2617 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
2618 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
2619 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
2620 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
2621 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
2622 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2623 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
2624 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2625 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
2626 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2627 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
2628 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2629 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
2630 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2631 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
2632 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
2633 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
2634 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
2635 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
2636 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
2637 else
2638 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
2639 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2640 alert );
2641 }
2642
2643 #if defined(MBEDTLS_DEBUG_C)
2644 if( ssl->session_negotiate->verify_result != 0 )
2645 {
2646 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
2647 ssl->session_negotiate->verify_result ) );
2648 }
2649 else
2650 {
2651 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
2652 }
2653 #endif /* MBEDTLS_DEBUG_C */
2654
2655 return( ret );
2656 }
2657
2658 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ssl_remember_peer_crt_digest(mbedtls_ssl_context * ssl,unsigned char * start,size_t len)2659 static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
2660 unsigned char *start, size_t len )
2661 {
2662 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2663 /* Remember digest of the peer's end-CRT. */
2664 ssl->session_negotiate->peer_cert_digest =
2665 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
2666 if( ssl->session_negotiate->peer_cert_digest == NULL )
2667 {
2668 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
2669 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
2670 mbedtls_ssl_send_alert_message( ssl,
2671 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2672 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2673
2674 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2675 }
2676
2677 ret = mbedtls_md( mbedtls_md_info_from_type(
2678 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
2679 start, len,
2680 ssl->session_negotiate->peer_cert_digest );
2681
2682 ssl->session_negotiate->peer_cert_digest_type =
2683 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
2684 ssl->session_negotiate->peer_cert_digest_len =
2685 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
2686
2687 return( ret );
2688 }
2689
ssl_remember_peer_pubkey(mbedtls_ssl_context * ssl,unsigned char * start,size_t len)2690 static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
2691 unsigned char *start, size_t len )
2692 {
2693 unsigned char *end = start + len;
2694 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2695
2696 /* Make a copy of the peer's raw public key. */
2697 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
2698 ret = mbedtls_pk_parse_subpubkey( &start, end,
2699 &ssl->handshake->peer_pubkey );
2700 if( ret != 0 )
2701 {
2702 /* We should have parsed the public key before. */
2703 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2704 }
2705
2706 return( 0 );
2707 }
2708 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2709
mbedtls_ssl_parse_certificate(mbedtls_ssl_context * ssl)2710 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
2711 {
2712 int ret = 0;
2713 int crt_expected;
2714 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2715 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
2716 ? ssl->handshake->sni_authmode
2717 : ssl->conf->authmode;
2718 #else
2719 const int authmode = ssl->conf->authmode;
2720 #endif
2721 void *rs_ctx = NULL;
2722 mbedtls_x509_crt *chain = NULL;
2723
2724 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2725
2726 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
2727 if( crt_expected == SSL_CERTIFICATE_SKIP )
2728 {
2729 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
2730 goto exit;
2731 }
2732
2733 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2734 if( ssl->handshake->ecrs_enabled &&
2735 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
2736 {
2737 chain = ssl->handshake->ecrs_peer_cert;
2738 ssl->handshake->ecrs_peer_cert = NULL;
2739 goto crt_verify;
2740 }
2741 #endif
2742
2743 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2744 {
2745 /* mbedtls_ssl_read_record may have sent an alert already. We
2746 let it decide whether to alert. */
2747 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2748 goto exit;
2749 }
2750
2751 #if defined(MBEDTLS_SSL_SRV_C)
2752 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
2753 {
2754 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
2755
2756 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
2757 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
2758
2759 goto exit;
2760 }
2761 #endif /* MBEDTLS_SSL_SRV_C */
2762
2763 /* Clear existing peer CRT structure in case we tried to
2764 * reuse a session but it failed, and allocate a new one. */
2765 ssl_clear_peer_cert( ssl->session_negotiate );
2766
2767 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
2768 if( chain == NULL )
2769 {
2770 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
2771 sizeof( mbedtls_x509_crt ) ) );
2772 mbedtls_ssl_send_alert_message( ssl,
2773 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2774 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2775
2776 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
2777 goto exit;
2778 }
2779 mbedtls_x509_crt_init( chain );
2780
2781 ret = ssl_parse_certificate_chain( ssl, chain );
2782 if( ret != 0 )
2783 goto exit;
2784
2785 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2786 if( ssl->handshake->ecrs_enabled)
2787 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
2788
2789 crt_verify:
2790 if( ssl->handshake->ecrs_enabled)
2791 rs_ctx = &ssl->handshake->ecrs_ctx;
2792 #endif
2793
2794 ret = ssl_parse_certificate_verify( ssl, authmode,
2795 chain, rs_ctx );
2796 if( ret != 0 )
2797 goto exit;
2798
2799 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2800 {
2801 unsigned char *crt_start, *pk_start;
2802 size_t crt_len, pk_len;
2803
2804 /* We parse the CRT chain without copying, so
2805 * these pointers point into the input buffer,
2806 * and are hence still valid after freeing the
2807 * CRT chain. */
2808
2809 crt_start = chain->raw.p;
2810 crt_len = chain->raw.len;
2811
2812 pk_start = chain->pk_raw.p;
2813 pk_len = chain->pk_raw.len;
2814
2815 /* Free the CRT structures before computing
2816 * digest and copying the peer's public key. */
2817 mbedtls_x509_crt_free( chain );
2818 mbedtls_free( chain );
2819 chain = NULL;
2820
2821 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
2822 if( ret != 0 )
2823 goto exit;
2824
2825 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
2826 if( ret != 0 )
2827 goto exit;
2828 }
2829 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2830 /* Pass ownership to session structure. */
2831 ssl->session_negotiate->peer_cert = chain;
2832 chain = NULL;
2833 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2834
2835 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
2836
2837 exit:
2838
2839 if( ret == 0 )
2840 ssl->state++;
2841
2842 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2843 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
2844 {
2845 ssl->handshake->ecrs_peer_cert = chain;
2846 chain = NULL;
2847 }
2848 #endif
2849
2850 if( chain != NULL )
2851 {
2852 mbedtls_x509_crt_free( chain );
2853 mbedtls_free( chain );
2854 }
2855
2856 return( ret );
2857 }
2858 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
2859
mbedtls_ssl_optimize_checksum(mbedtls_ssl_context * ssl,const mbedtls_ssl_ciphersuite_t * ciphersuite_info)2860 void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
2861 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
2862 {
2863 ((void) ciphersuite_info);
2864
2865 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2866 defined(MBEDTLS_SSL_PROTO_TLS1_1)
2867 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
2868 ssl->handshake->update_checksum = ssl_update_checksum_md5sha1;
2869 else
2870 #endif
2871 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2872 #if defined(MBEDTLS_SHA512_C)
2873 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
2874 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
2875 else
2876 #endif
2877 #if defined(MBEDTLS_SHA256_C)
2878 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
2879 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
2880 else
2881 #endif
2882 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2883 {
2884 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2885 return;
2886 }
2887 }
2888
mbedtls_ssl_reset_checksum(mbedtls_ssl_context * ssl)2889 void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
2890 {
2891 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2892 defined(MBEDTLS_SSL_PROTO_TLS1_1)
2893 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
2894 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
2895 #endif
2896 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2897 #if defined(MBEDTLS_SHA256_C)
2898 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2899 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
2900 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2901 #else
2902 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
2903 #endif
2904 #endif
2905 #if defined(MBEDTLS_SHA512_C)
2906 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2907 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
2908 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
2909 #else
2910 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
2911 #endif
2912 #endif
2913 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2914 }
2915
ssl_update_checksum_start(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2916 static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
2917 const unsigned char *buf, size_t len )
2918 {
2919 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2920 defined(MBEDTLS_SSL_PROTO_TLS1_1)
2921 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
2922 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
2923 #endif
2924 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2925 #if defined(MBEDTLS_SHA256_C)
2926 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2927 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2928 #else
2929 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
2930 #endif
2931 #endif
2932 #if defined(MBEDTLS_SHA512_C)
2933 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2934 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
2935 #else
2936 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
2937 #endif
2938 #endif
2939 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2940 }
2941
2942 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2943 defined(MBEDTLS_SSL_PROTO_TLS1_1)
ssl_update_checksum_md5sha1(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2944 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *ssl,
2945 const unsigned char *buf, size_t len )
2946 {
2947 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
2948 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
2949 }
2950 #endif
2951
2952 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2953 #if defined(MBEDTLS_SHA256_C)
ssl_update_checksum_sha256(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2954 static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
2955 const unsigned char *buf, size_t len )
2956 {
2957 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2958 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2959 #else
2960 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
2961 #endif
2962 }
2963 #endif
2964
2965 #if defined(MBEDTLS_SHA512_C)
ssl_update_checksum_sha384(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2966 static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
2967 const unsigned char *buf, size_t len )
2968 {
2969 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2970 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
2971 #else
2972 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
2973 #endif
2974 }
2975 #endif
2976 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2977
2978 #if defined(MBEDTLS_SSL_PROTO_SSL3)
ssl_calc_finished_ssl(mbedtls_ssl_context * ssl,unsigned char * buf,int from)2979 static void ssl_calc_finished_ssl(
2980 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
2981 {
2982 const char *sender;
2983 mbedtls_md5_context md5;
2984 mbedtls_sha1_context sha1;
2985
2986 unsigned char padbuf[48];
2987 unsigned char md5sum[16];
2988 unsigned char sha1sum[20];
2989
2990 mbedtls_ssl_session *session = ssl->session_negotiate;
2991 if( !session )
2992 session = ssl->session;
2993
2994 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
2995
2996 mbedtls_md5_init( &md5 );
2997 mbedtls_sha1_init( &sha1 );
2998
2999 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
3000 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
3001
3002 /*
3003 * SSLv3:
3004 * hash =
3005 * MD5( master + pad2 +
3006 * MD5( handshake + sender + master + pad1 ) )
3007 * + SHA1( master + pad2 +
3008 * SHA1( handshake + sender + master + pad1 ) )
3009 */
3010
3011 #if !defined(MBEDTLS_MD5_ALT)
3012 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
3013 md5.state, sizeof( md5.state ) );
3014 #endif
3015
3016 #if !defined(MBEDTLS_SHA1_ALT)
3017 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
3018 sha1.state, sizeof( sha1.state ) );
3019 #endif
3020
3021 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
3022 : "SRVR";
3023
3024 memset( padbuf, 0x36, 48 );
3025
3026 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
3027 mbedtls_md5_update_ret( &md5, session->master, 48 );
3028 mbedtls_md5_update_ret( &md5, padbuf, 48 );
3029 mbedtls_md5_finish_ret( &md5, md5sum );
3030
3031 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
3032 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
3033 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
3034 mbedtls_sha1_finish_ret( &sha1, sha1sum );
3035
3036 memset( padbuf, 0x5C, 48 );
3037
3038 mbedtls_md5_starts_ret( &md5 );
3039 mbedtls_md5_update_ret( &md5, session->master, 48 );
3040 mbedtls_md5_update_ret( &md5, padbuf, 48 );
3041 mbedtls_md5_update_ret( &md5, md5sum, 16 );
3042 mbedtls_md5_finish_ret( &md5, buf );
3043
3044 mbedtls_sha1_starts_ret( &sha1 );
3045 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
3046 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
3047 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
3048 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
3049
3050 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
3051
3052 mbedtls_md5_free( &md5 );
3053 mbedtls_sha1_free( &sha1 );
3054
3055 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
3056 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
3057 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
3058
3059 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
3060 }
3061 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
3062
3063 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
ssl_calc_finished_tls(mbedtls_ssl_context * ssl,unsigned char * buf,int from)3064 static void ssl_calc_finished_tls(
3065 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
3066 {
3067 int len = 12;
3068 const char *sender;
3069 mbedtls_md5_context md5;
3070 mbedtls_sha1_context sha1;
3071 unsigned char padbuf[36];
3072
3073 mbedtls_ssl_session *session = ssl->session_negotiate;
3074 if( !session )
3075 session = ssl->session;
3076
3077 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
3078
3079 mbedtls_md5_init( &md5 );
3080 mbedtls_sha1_init( &sha1 );
3081
3082 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
3083 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
3084
3085 /*
3086 * TLSv1:
3087 * hash = PRF( master, finished_label,
3088 * MD5( handshake ) + SHA1( handshake ) )[0..11]
3089 */
3090
3091 #if !defined(MBEDTLS_MD5_ALT)
3092 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
3093 md5.state, sizeof( md5.state ) );
3094 #endif
3095
3096 #if !defined(MBEDTLS_SHA1_ALT)
3097 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
3098 sha1.state, sizeof( sha1.state ) );
3099 #endif
3100
3101 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
3102 ? "client finished"
3103 : "server finished";
3104
3105 mbedtls_md5_finish_ret( &md5, padbuf );
3106 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
3107
3108 ssl->handshake->tls_prf( session->master, 48, sender,
3109 padbuf, 36, buf, len );
3110
3111 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
3112
3113 mbedtls_md5_free( &md5 );
3114 mbedtls_sha1_free( &sha1 );
3115
3116 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
3117
3118 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
3119 }
3120 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
3121
3122 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3123 #if defined(MBEDTLS_SHA256_C)
ssl_calc_finished_tls_sha256(mbedtls_ssl_context * ssl,unsigned char * buf,int from)3124 static void ssl_calc_finished_tls_sha256(
3125 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
3126 {
3127 int len = 12;
3128 const char *sender;
3129 unsigned char padbuf[32];
3130 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3131 size_t hash_size;
3132 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
3133 psa_status_t status;
3134 #else
3135 mbedtls_sha256_context sha256;
3136 #endif
3137
3138 mbedtls_ssl_session *session = ssl->session_negotiate;
3139 if( !session )
3140 session = ssl->session;
3141
3142 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
3143 ? "client finished"
3144 : "server finished";
3145
3146 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3147 sha256_psa = psa_hash_operation_init();
3148
3149 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
3150
3151 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
3152 if( status != PSA_SUCCESS )
3153 {
3154 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
3155 return;
3156 }
3157
3158 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
3159 if( status != PSA_SUCCESS )
3160 {
3161 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
3162 return;
3163 }
3164 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
3165 #else
3166
3167 mbedtls_sha256_init( &sha256 );
3168
3169 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
3170
3171 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
3172
3173 /*
3174 * TLSv1.2:
3175 * hash = PRF( master, finished_label,
3176 * Hash( handshake ) )[0.11]
3177 */
3178
3179 #if !defined(MBEDTLS_SHA256_ALT)
3180 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
3181 sha256.state, sizeof( sha256.state ) );
3182 #endif
3183
3184 mbedtls_sha256_finish_ret( &sha256, padbuf );
3185 mbedtls_sha256_free( &sha256 );
3186 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3187
3188 ssl->handshake->tls_prf( session->master, 48, sender,
3189 padbuf, 32, buf, len );
3190
3191 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
3192
3193 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
3194
3195 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
3196 }
3197 #endif /* MBEDTLS_SHA256_C */
3198
3199 #if defined(MBEDTLS_SHA512_C)
3200
3201 typedef int (*finish_sha384_t)(mbedtls_sha512_context*, unsigned char*);
3202
ssl_calc_finished_tls_sha384(mbedtls_ssl_context * ssl,unsigned char * buf,int from)3203 static void ssl_calc_finished_tls_sha384(
3204 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
3205 {
3206 int len = 12;
3207 const char *sender;
3208 unsigned char padbuf[48];
3209 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3210 size_t hash_size;
3211 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
3212 psa_status_t status;
3213 #else
3214 mbedtls_sha512_context sha512;
3215 #endif
3216
3217 mbedtls_ssl_session *session = ssl->session_negotiate;
3218 if( !session )
3219 session = ssl->session;
3220
3221 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
3222 ? "client finished"
3223 : "server finished";
3224
3225 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3226 sha384_psa = psa_hash_operation_init();
3227
3228 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
3229
3230 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
3231 if( status != PSA_SUCCESS )
3232 {
3233 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
3234 return;
3235 }
3236
3237 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
3238 if( status != PSA_SUCCESS )
3239 {
3240 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
3241 return;
3242 }
3243 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
3244 #else
3245 mbedtls_sha512_init( &sha512 );
3246
3247 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
3248
3249 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
3250
3251 /*
3252 * TLSv1.2:
3253 * hash = PRF( master, finished_label,
3254 * Hash( handshake ) )[0.11]
3255 */
3256
3257 #if !defined(MBEDTLS_SHA512_ALT)
3258 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
3259 sha512.state, sizeof( sha512.state ) );
3260 #endif
3261 /*
3262 * For SHA-384, we can save 16 bytes by keeping padbuf 48 bytes long.
3263 * However, to avoid stringop-overflow warning in gcc, we have to cast
3264 * mbedtls_sha512_finish_ret().
3265 */
3266 finish_sha384_t finish = (finish_sha384_t)mbedtls_sha512_finish_ret;
3267 finish( &sha512, padbuf );
3268
3269 mbedtls_sha512_free( &sha512 );
3270 #endif
3271
3272 ssl->handshake->tls_prf( session->master, 48, sender,
3273 padbuf, 48, buf, len );
3274
3275 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
3276
3277 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
3278
3279 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
3280 }
3281 #endif /* MBEDTLS_SHA512_C */
3282 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3283
mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context * ssl)3284 void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
3285 {
3286 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
3287
3288 /*
3289 * Free our handshake params
3290 */
3291 mbedtls_ssl_handshake_free( ssl );
3292 mbedtls_free( ssl->handshake );
3293 ssl->handshake = NULL;
3294
3295 /*
3296 * Free the previous transform and swith in the current one
3297 */
3298 if( ssl->transform )
3299 {
3300 mbedtls_ssl_transform_free( ssl->transform );
3301 mbedtls_free( ssl->transform );
3302 }
3303 ssl->transform = ssl->transform_negotiate;
3304 ssl->transform_negotiate = NULL;
3305
3306 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
3307 }
3308
mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context * ssl)3309 void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
3310 {
3311 int resume = ssl->handshake->resume;
3312
3313 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
3314
3315 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3316 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
3317 {
3318 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
3319 ssl->renego_records_seen = 0;
3320 }
3321 #endif
3322
3323 /*
3324 * Free the previous session and switch in the current one
3325 */
3326 if( ssl->session )
3327 {
3328 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
3329 /* RFC 7366 3.1: keep the EtM state */
3330 ssl->session_negotiate->encrypt_then_mac =
3331 ssl->session->encrypt_then_mac;
3332 #endif
3333
3334 mbedtls_ssl_session_free( ssl->session );
3335 mbedtls_free( ssl->session );
3336 }
3337 ssl->session = ssl->session_negotiate;
3338 ssl->session_negotiate = NULL;
3339
3340 /*
3341 * Add cache entry
3342 */
3343 if( ssl->conf->f_set_cache != NULL &&
3344 ssl->session->id_len != 0 &&
3345 resume == 0 )
3346 {
3347 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
3348 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
3349 }
3350
3351 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3352 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3353 ssl->handshake->flight != NULL )
3354 {
3355 /* Cancel handshake timer */
3356 mbedtls_ssl_set_timer( ssl, 0 );
3357
3358 /* Keep last flight around in case we need to resend it:
3359 * we need the handshake and transform structures for that */
3360 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
3361 }
3362 else
3363 #endif
3364 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
3365
3366 ssl->state++;
3367
3368 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
3369 }
3370
mbedtls_ssl_write_finished(mbedtls_ssl_context * ssl)3371 int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
3372 {
3373 int ret, hash_len;
3374
3375 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
3376
3377 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
3378
3379 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
3380
3381 /*
3382 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
3383 * may define some other value. Currently (early 2016), no defined
3384 * ciphersuite does this (and this is unlikely to change as activity has
3385 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
3386 */
3387 hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
3388
3389 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3390 ssl->verify_data_len = hash_len;
3391 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
3392 #endif
3393
3394 ssl->out_msglen = 4 + hash_len;
3395 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3396 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
3397
3398 /*
3399 * In case of session resuming, invert the client and server
3400 * ChangeCipherSpec messages order.
3401 */
3402 if( ssl->handshake->resume != 0 )
3403 {
3404 #if defined(MBEDTLS_SSL_CLI_C)
3405 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3406 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
3407 #endif
3408 #if defined(MBEDTLS_SSL_SRV_C)
3409 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
3410 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
3411 #endif
3412 }
3413 else
3414 ssl->state++;
3415
3416 /*
3417 * Switch to our negotiated transform and session parameters for outbound
3418 * data.
3419 */
3420 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
3421
3422 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3423 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3424 {
3425 unsigned char i;
3426
3427 /* Remember current epoch settings for resending */
3428 ssl->handshake->alt_transform_out = ssl->transform_out;
3429 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
3430
3431 /* Set sequence_number to zero */
3432 memset( ssl->cur_out_ctr + 2, 0, 6 );
3433
3434 /* Increment epoch */
3435 for( i = 2; i > 0; i-- )
3436 if( ++ssl->cur_out_ctr[i - 1] != 0 )
3437 break;
3438
3439 /* The loop goes to its end iff the counter is wrapping */
3440 if( i == 0 )
3441 {
3442 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
3443 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
3444 }
3445 }
3446 else
3447 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3448 memset( ssl->cur_out_ctr, 0, 8 );
3449
3450 ssl->transform_out = ssl->transform_negotiate;
3451 ssl->session_out = ssl->session_negotiate;
3452
3453 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3454 if( mbedtls_ssl_hw_record_activate != NULL )
3455 {
3456 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
3457 {
3458 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
3459 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3460 }
3461 }
3462 #endif
3463
3464 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3465 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3466 mbedtls_ssl_send_flight_completed( ssl );
3467 #endif
3468
3469 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
3470 {
3471 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
3472 return( ret );
3473 }
3474
3475 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3476 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3477 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3478 {
3479 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
3480 return( ret );
3481 }
3482 #endif
3483
3484 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
3485
3486 return( 0 );
3487 }
3488
3489 #if defined(MBEDTLS_SSL_PROTO_SSL3)
3490 #define SSL_MAX_HASH_LEN 36
3491 #else
3492 #define SSL_MAX_HASH_LEN 12
3493 #endif
3494
mbedtls_ssl_parse_finished(mbedtls_ssl_context * ssl)3495 int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
3496 {
3497 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3498 unsigned int hash_len;
3499 unsigned char buf[SSL_MAX_HASH_LEN];
3500
3501 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
3502
3503 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
3504
3505 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
3506 {
3507 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3508 return( ret );
3509 }
3510
3511 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3512 {
3513 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
3514 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3515 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
3516 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3517 }
3518
3519 /* There is currently no ciphersuite using another length with TLS 1.2 */
3520 #if defined(MBEDTLS_SSL_PROTO_SSL3)
3521 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
3522 hash_len = 36;
3523 else
3524 #endif
3525 hash_len = 12;
3526
3527 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
3528 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
3529 {
3530 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
3531 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3532 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3533 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
3534 }
3535
3536 if( mbedtls_ssl_safer_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
3537 buf, hash_len ) != 0 )
3538 {
3539 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
3540 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3541 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3542 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
3543 }
3544
3545 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3546 ssl->verify_data_len = hash_len;
3547 memcpy( ssl->peer_verify_data, buf, hash_len );
3548 #endif
3549
3550 if( ssl->handshake->resume != 0 )
3551 {
3552 #if defined(MBEDTLS_SSL_CLI_C)
3553 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3554 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
3555 #endif
3556 #if defined(MBEDTLS_SSL_SRV_C)
3557 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
3558 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
3559 #endif
3560 }
3561 else
3562 ssl->state++;
3563
3564 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3565 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3566 mbedtls_ssl_recv_flight_completed( ssl );
3567 #endif
3568
3569 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
3570
3571 return( 0 );
3572 }
3573
ssl_handshake_params_init(mbedtls_ssl_handshake_params * handshake)3574 static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
3575 {
3576 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
3577
3578 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3579 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3580 mbedtls_md5_init( &handshake->fin_md5 );
3581 mbedtls_sha1_init( &handshake->fin_sha1 );
3582 mbedtls_md5_starts_ret( &handshake->fin_md5 );
3583 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
3584 #endif
3585 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3586 #if defined(MBEDTLS_SHA256_C)
3587 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3588 handshake->fin_sha256_psa = psa_hash_operation_init();
3589 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
3590 #else
3591 mbedtls_sha256_init( &handshake->fin_sha256 );
3592 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
3593 #endif
3594 #endif
3595 #if defined(MBEDTLS_SHA512_C)
3596 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3597 handshake->fin_sha384_psa = psa_hash_operation_init();
3598 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
3599 #else
3600 mbedtls_sha512_init( &handshake->fin_sha512 );
3601 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
3602 #endif
3603 #endif
3604 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3605
3606 handshake->update_checksum = ssl_update_checksum_start;
3607
3608 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
3609 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3610 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
3611 #endif
3612
3613 #if defined(MBEDTLS_DHM_C)
3614 mbedtls_dhm_init( &handshake->dhm_ctx );
3615 #endif
3616 #if defined(MBEDTLS_ECDH_C)
3617 mbedtls_ecdh_init( &handshake->ecdh_ctx );
3618 #endif
3619 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3620 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
3621 #if defined(MBEDTLS_SSL_CLI_C)
3622 handshake->ecjpake_cache = NULL;
3623 handshake->ecjpake_cache_len = 0;
3624 #endif
3625 #endif
3626
3627 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3628 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
3629 #endif
3630
3631 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3632 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
3633 #endif
3634
3635 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3636 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3637 mbedtls_pk_init( &handshake->peer_pubkey );
3638 #endif
3639 }
3640
mbedtls_ssl_transform_init(mbedtls_ssl_transform * transform)3641 void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
3642 {
3643 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
3644
3645 mbedtls_cipher_init( &transform->cipher_ctx_enc );
3646 mbedtls_cipher_init( &transform->cipher_ctx_dec );
3647
3648 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
3649 mbedtls_md_init( &transform->md_ctx_enc );
3650 mbedtls_md_init( &transform->md_ctx_dec );
3651 #endif
3652 }
3653
mbedtls_ssl_session_init(mbedtls_ssl_session * session)3654 void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
3655 {
3656 memset( session, 0, sizeof(mbedtls_ssl_session) );
3657 }
3658
ssl_handshake_init(mbedtls_ssl_context * ssl)3659 static int ssl_handshake_init( mbedtls_ssl_context *ssl )
3660 {
3661 /* Clear old handshake information if present */
3662 if( ssl->transform_negotiate )
3663 mbedtls_ssl_transform_free( ssl->transform_negotiate );
3664 if( ssl->session_negotiate )
3665 mbedtls_ssl_session_free( ssl->session_negotiate );
3666 if( ssl->handshake )
3667 mbedtls_ssl_handshake_free( ssl );
3668
3669 /*
3670 * Either the pointers are now NULL or cleared properly and can be freed.
3671 * Now allocate missing structures.
3672 */
3673 if( ssl->transform_negotiate == NULL )
3674 {
3675 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
3676 }
3677
3678 if( ssl->session_negotiate == NULL )
3679 {
3680 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
3681 }
3682
3683 if( ssl->handshake == NULL )
3684 {
3685 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
3686 }
3687 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3688 /* If the buffers are too small - reallocate */
3689 {
3690 int modified = 0;
3691 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
3692 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
3693 if( ssl->in_buf != NULL )
3694 {
3695 written_in = ssl->in_msg - ssl->in_buf;
3696 iv_offset_in = ssl->in_iv - ssl->in_buf;
3697 len_offset_in = ssl->in_len - ssl->in_buf;
3698 if( ssl->in_buf_len < MBEDTLS_SSL_IN_BUFFER_LEN )
3699 {
3700 if( resize_buffer( &ssl->in_buf, MBEDTLS_SSL_IN_BUFFER_LEN,
3701 &ssl->in_buf_len ) != 0 )
3702 {
3703 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
3704 }
3705 else
3706 {
3707 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %d", MBEDTLS_SSL_IN_BUFFER_LEN ) );
3708 modified = 1;
3709 }
3710 }
3711 }
3712
3713 if( ssl->out_buf != NULL )
3714 {
3715 written_out = ssl->out_msg - ssl->out_buf;
3716 iv_offset_out = ssl->out_iv - ssl->out_buf;
3717 len_offset_out = ssl->out_len - ssl->out_buf;
3718 if( ssl->out_buf_len < MBEDTLS_SSL_OUT_BUFFER_LEN )
3719 {
3720 if( resize_buffer( &ssl->out_buf, MBEDTLS_SSL_OUT_BUFFER_LEN,
3721 &ssl->out_buf_len ) != 0 )
3722 {
3723 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
3724 }
3725 else
3726 {
3727 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %d", MBEDTLS_SSL_OUT_BUFFER_LEN ) );
3728 modified = 1;
3729 }
3730 }
3731 }
3732 if( modified )
3733 {
3734 /* Update pointers here to avoid doing it twice. */
3735 mbedtls_ssl_reset_in_out_pointers( ssl );
3736 /* Fields below might not be properly updated with record
3737 * splitting or with CID, so they are manually updated here. */
3738 ssl->out_msg = ssl->out_buf + written_out;
3739 ssl->out_len = ssl->out_buf + len_offset_out;
3740 ssl->out_iv = ssl->out_buf + iv_offset_out;
3741
3742 ssl->in_msg = ssl->in_buf + written_in;
3743 ssl->in_len = ssl->in_buf + len_offset_in;
3744 ssl->in_iv = ssl->in_buf + iv_offset_in;
3745 }
3746 }
3747 #endif
3748
3749 /* All pointers should exist and can be directly freed without issue */
3750 if( ssl->handshake == NULL ||
3751 ssl->transform_negotiate == NULL ||
3752 ssl->session_negotiate == NULL )
3753 {
3754 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
3755
3756 mbedtls_free( ssl->handshake );
3757 mbedtls_free( ssl->transform_negotiate );
3758 mbedtls_free( ssl->session_negotiate );
3759
3760 ssl->handshake = NULL;
3761 ssl->transform_negotiate = NULL;
3762 ssl->session_negotiate = NULL;
3763
3764 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3765 }
3766
3767 /* Initialize structures */
3768 mbedtls_ssl_session_init( ssl->session_negotiate );
3769 mbedtls_ssl_transform_init( ssl->transform_negotiate );
3770 ssl_handshake_params_init( ssl->handshake );
3771
3772 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3773 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3774 {
3775 ssl->handshake->alt_transform_out = ssl->transform_out;
3776
3777 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3778 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
3779 else
3780 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
3781
3782 mbedtls_ssl_set_timer( ssl, 0 );
3783 }
3784 #endif
3785
3786 return( 0 );
3787 }
3788
3789 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
3790 /* Dummy cookie callbacks for defaults */
ssl_cookie_write_dummy(void * ctx,unsigned char ** p,unsigned char * end,const unsigned char * cli_id,size_t cli_id_len)3791 static int ssl_cookie_write_dummy( void *ctx,
3792 unsigned char **p, unsigned char *end,
3793 const unsigned char *cli_id, size_t cli_id_len )
3794 {
3795 ((void) ctx);
3796 ((void) p);
3797 ((void) end);
3798 ((void) cli_id);
3799 ((void) cli_id_len);
3800
3801 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3802 }
3803
ssl_cookie_check_dummy(void * ctx,const unsigned char * cookie,size_t cookie_len,const unsigned char * cli_id,size_t cli_id_len)3804 static int ssl_cookie_check_dummy( void *ctx,
3805 const unsigned char *cookie, size_t cookie_len,
3806 const unsigned char *cli_id, size_t cli_id_len )
3807 {
3808 ((void) ctx);
3809 ((void) cookie);
3810 ((void) cookie_len);
3811 ((void) cli_id);
3812 ((void) cli_id_len);
3813
3814 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3815 }
3816 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
3817
3818 /*
3819 * Initialize an SSL context
3820 */
mbedtls_ssl_init(mbedtls_ssl_context * ssl)3821 void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
3822 {
3823 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
3824 }
3825
3826 /*
3827 * Setup an SSL context
3828 */
3829
mbedtls_ssl_setup(mbedtls_ssl_context * ssl,const mbedtls_ssl_config * conf)3830 int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
3831 const mbedtls_ssl_config *conf )
3832 {
3833 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3834 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3835 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3836
3837 ssl->conf = conf;
3838
3839 /*
3840 * Prepare base structures
3841 */
3842
3843 /* Set to NULL in case of an error condition */
3844 ssl->out_buf = NULL;
3845
3846 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3847 ssl->in_buf_len = in_buf_len;
3848 #endif
3849 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
3850 if( ssl->in_buf == NULL )
3851 {
3852 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", in_buf_len ) );
3853 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
3854 goto error;
3855 }
3856
3857 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3858 ssl->out_buf_len = out_buf_len;
3859 #endif
3860 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
3861 if( ssl->out_buf == NULL )
3862 {
3863 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", out_buf_len ) );
3864 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
3865 goto error;
3866 }
3867
3868 mbedtls_ssl_reset_in_out_pointers( ssl );
3869
3870 #if defined(MBEDTLS_SSL_DTLS_SRTP)
3871 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
3872 #endif
3873
3874 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3875 goto error;
3876
3877 return( 0 );
3878
3879 error:
3880 mbedtls_free( ssl->in_buf );
3881 mbedtls_free( ssl->out_buf );
3882
3883 ssl->conf = NULL;
3884
3885 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3886 ssl->in_buf_len = 0;
3887 ssl->out_buf_len = 0;
3888 #endif
3889 ssl->in_buf = NULL;
3890 ssl->out_buf = NULL;
3891
3892 ssl->in_hdr = NULL;
3893 ssl->in_ctr = NULL;
3894 ssl->in_len = NULL;
3895 ssl->in_iv = NULL;
3896 ssl->in_msg = NULL;
3897
3898 ssl->out_hdr = NULL;
3899 ssl->out_ctr = NULL;
3900 ssl->out_len = NULL;
3901 ssl->out_iv = NULL;
3902 ssl->out_msg = NULL;
3903
3904 return( ret );
3905 }
3906
3907 /*
3908 * Reset an initialized and used SSL context for re-use while retaining
3909 * all application-set variables, function pointers and data.
3910 *
3911 * If partial is non-zero, keep data in the input buffer and client ID.
3912 * (Use when a DTLS client reconnects from the same port.)
3913 */
mbedtls_ssl_session_reset_int(mbedtls_ssl_context * ssl,int partial)3914 int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
3915 {
3916 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3917 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3918 size_t in_buf_len = ssl->in_buf_len;
3919 size_t out_buf_len = ssl->out_buf_len;
3920 #else
3921 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3922 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3923 #endif
3924
3925 #if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
3926 !defined(MBEDTLS_SSL_SRV_C)
3927 ((void) partial);
3928 #endif
3929
3930 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3931
3932 /* Cancel any possibly running timer */
3933 mbedtls_ssl_set_timer( ssl, 0 );
3934
3935 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3936 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
3937 ssl->renego_records_seen = 0;
3938
3939 ssl->verify_data_len = 0;
3940 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
3941 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
3942 #endif
3943 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
3944
3945 ssl->in_offt = NULL;
3946 mbedtls_ssl_reset_in_out_pointers( ssl );
3947
3948 ssl->in_msgtype = 0;
3949 ssl->in_msglen = 0;
3950 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3951 ssl->next_record_offset = 0;
3952 ssl->in_epoch = 0;
3953 #endif
3954 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3955 mbedtls_ssl_dtls_replay_reset( ssl );
3956 #endif
3957
3958 ssl->in_hslen = 0;
3959 ssl->nb_zero = 0;
3960
3961 ssl->keep_current_message = 0;
3962
3963 ssl->out_msgtype = 0;
3964 ssl->out_msglen = 0;
3965 ssl->out_left = 0;
3966 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
3967 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
3968 ssl->split_done = 0;
3969 #endif
3970
3971 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
3972
3973 ssl->transform_in = NULL;
3974 ssl->transform_out = NULL;
3975
3976 ssl->session_in = NULL;
3977 ssl->session_out = NULL;
3978
3979 memset( ssl->out_buf, 0, out_buf_len );
3980
3981 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
3982 if( partial == 0 )
3983 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
3984 {
3985 ssl->in_left = 0;
3986 memset( ssl->in_buf, 0, in_buf_len );
3987 }
3988
3989 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3990 if( mbedtls_ssl_hw_record_reset != NULL )
3991 {
3992 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
3993 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
3994 {
3995 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
3996 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3997 }
3998 }
3999 #endif
4000
4001 if( ssl->transform )
4002 {
4003 mbedtls_ssl_transform_free( ssl->transform );
4004 mbedtls_free( ssl->transform );
4005 ssl->transform = NULL;
4006 }
4007
4008 if( ssl->session )
4009 {
4010 mbedtls_ssl_session_free( ssl->session );
4011 mbedtls_free( ssl->session );
4012 ssl->session = NULL;
4013 }
4014
4015 #if defined(MBEDTLS_SSL_ALPN)
4016 ssl->alpn_chosen = NULL;
4017 #endif
4018
4019 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
4020 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
4021 if( partial == 0 )
4022 #endif
4023 {
4024 mbedtls_free( ssl->cli_id );
4025 ssl->cli_id = NULL;
4026 ssl->cli_id_len = 0;
4027 }
4028 #endif
4029
4030 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
4031 return( ret );
4032
4033 return( 0 );
4034 }
4035
4036 /*
4037 * Reset an initialized and used SSL context for re-use while retaining
4038 * all application-set variables, function pointers and data.
4039 */
mbedtls_ssl_session_reset(mbedtls_ssl_context * ssl)4040 int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
4041 {
4042 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
4043 }
4044
4045 /*
4046 * SSL set accessors
4047 */
mbedtls_ssl_conf_endpoint(mbedtls_ssl_config * conf,int endpoint)4048 void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
4049 {
4050 conf->endpoint = endpoint;
4051 }
4052
mbedtls_ssl_conf_transport(mbedtls_ssl_config * conf,int transport)4053 void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
4054 {
4055 conf->transport = transport;
4056 }
4057
4058 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
mbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config * conf,char mode)4059 void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
4060 {
4061 conf->anti_replay = mode;
4062 }
4063 #endif
4064
4065 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
mbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config * conf,unsigned limit)4066 void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
4067 {
4068 conf->badmac_limit = limit;
4069 }
4070 #endif
4071
4072 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4073
mbedtls_ssl_set_datagram_packing(mbedtls_ssl_context * ssl,unsigned allow_packing)4074 void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
4075 unsigned allow_packing )
4076 {
4077 ssl->disable_datagram_packing = !allow_packing;
4078 }
4079
mbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config * conf,uint32_t min,uint32_t max)4080 void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
4081 uint32_t min, uint32_t max )
4082 {
4083 conf->hs_timeout_min = min;
4084 conf->hs_timeout_max = max;
4085 }
4086 #endif
4087
mbedtls_ssl_conf_authmode(mbedtls_ssl_config * conf,int authmode)4088 void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
4089 {
4090 conf->authmode = authmode;
4091 }
4092
4093 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_conf_verify(mbedtls_ssl_config * conf,int (* f_vrfy)(void *,mbedtls_x509_crt *,int,uint32_t *),void * p_vrfy)4094 void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
4095 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
4096 void *p_vrfy )
4097 {
4098 conf->f_vrfy = f_vrfy;
4099 conf->p_vrfy = p_vrfy;
4100 }
4101 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4102
mbedtls_ssl_conf_rng(mbedtls_ssl_config * conf,int (* f_rng)(void *,unsigned char *,size_t),void * p_rng)4103 void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
4104 int (*f_rng)(void *, unsigned char *, size_t),
4105 void *p_rng )
4106 {
4107 conf->f_rng = f_rng;
4108 conf->p_rng = p_rng;
4109 }
4110
mbedtls_ssl_conf_dbg(mbedtls_ssl_config * conf,void (* f_dbg)(void *,int,const char *,int,const char *),void * p_dbg)4111 void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
4112 void (*f_dbg)(void *, int, const char *, int, const char *),
4113 void *p_dbg )
4114 {
4115 conf->f_dbg = f_dbg;
4116 conf->p_dbg = p_dbg;
4117 }
4118
mbedtls_ssl_set_bio(mbedtls_ssl_context * ssl,void * p_bio,mbedtls_ssl_send_t * f_send,mbedtls_ssl_recv_t * f_recv,mbedtls_ssl_recv_timeout_t * f_recv_timeout)4119 void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
4120 void *p_bio,
4121 mbedtls_ssl_send_t *f_send,
4122 mbedtls_ssl_recv_t *f_recv,
4123 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
4124 {
4125 ssl->p_bio = p_bio;
4126 ssl->f_send = f_send;
4127 ssl->f_recv = f_recv;
4128 ssl->f_recv_timeout = f_recv_timeout;
4129 }
4130
4131 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_set_mtu(mbedtls_ssl_context * ssl,uint16_t mtu)4132 void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
4133 {
4134 ssl->mtu = mtu;
4135 }
4136 #endif
4137
mbedtls_ssl_conf_read_timeout(mbedtls_ssl_config * conf,uint32_t timeout)4138 void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
4139 {
4140 conf->read_timeout = timeout;
4141 }
4142
mbedtls_ssl_set_timer_cb(mbedtls_ssl_context * ssl,void * p_timer,mbedtls_ssl_set_timer_t * f_set_timer,mbedtls_ssl_get_timer_t * f_get_timer)4143 void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
4144 void *p_timer,
4145 mbedtls_ssl_set_timer_t *f_set_timer,
4146 mbedtls_ssl_get_timer_t *f_get_timer )
4147 {
4148 ssl->p_timer = p_timer;
4149 ssl->f_set_timer = f_set_timer;
4150 ssl->f_get_timer = f_get_timer;
4151
4152 /* Make sure we start with no timer running */
4153 mbedtls_ssl_set_timer( ssl, 0 );
4154 }
4155
4156 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_session_cache(mbedtls_ssl_config * conf,void * p_cache,int (* f_get_cache)(void *,mbedtls_ssl_session *),int (* f_set_cache)(void *,const mbedtls_ssl_session *))4157 void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
4158 void *p_cache,
4159 int (*f_get_cache)(void *, mbedtls_ssl_session *),
4160 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
4161 {
4162 conf->p_cache = p_cache;
4163 conf->f_get_cache = f_get_cache;
4164 conf->f_set_cache = f_set_cache;
4165 }
4166 #endif /* MBEDTLS_SSL_SRV_C */
4167
4168 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_set_session(mbedtls_ssl_context * ssl,const mbedtls_ssl_session * session)4169 int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
4170 {
4171 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4172
4173 if( ssl == NULL ||
4174 session == NULL ||
4175 ssl->session_negotiate == NULL ||
4176 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
4177 {
4178 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4179 }
4180
4181 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
4182 session ) ) != 0 )
4183 return( ret );
4184
4185 ssl->handshake->resume = 1;
4186
4187 return( 0 );
4188 }
4189 #endif /* MBEDTLS_SSL_CLI_C */
4190
mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config * conf,const int * ciphersuites)4191 void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
4192 const int *ciphersuites )
4193 {
4194 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites;
4195 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites;
4196 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites;
4197 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites;
4198 }
4199
mbedtls_ssl_conf_ciphersuites_for_version(mbedtls_ssl_config * conf,const int * ciphersuites,int major,int minor)4200 void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
4201 const int *ciphersuites,
4202 int major, int minor )
4203 {
4204 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
4205 return;
4206
4207 if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 )
4208 return;
4209
4210 conf->ciphersuite_list[minor] = ciphersuites;
4211 }
4212
4213 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_conf_cert_profile(mbedtls_ssl_config * conf,const mbedtls_x509_crt_profile * profile)4214 void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
4215 const mbedtls_x509_crt_profile *profile )
4216 {
4217 conf->cert_profile = profile;
4218 }
4219
4220 /* Append a new keycert entry to a (possibly empty) list */
ssl_append_key_cert(mbedtls_ssl_key_cert ** head,mbedtls_x509_crt * cert,mbedtls_pk_context * key)4221 static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
4222 mbedtls_x509_crt *cert,
4223 mbedtls_pk_context *key )
4224 {
4225 mbedtls_ssl_key_cert *new_cert;
4226
4227 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
4228 if( new_cert == NULL )
4229 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4230
4231 new_cert->cert = cert;
4232 new_cert->key = key;
4233 new_cert->next = NULL;
4234
4235 /* Update head is the list was null, else add to the end */
4236 if( *head == NULL )
4237 {
4238 *head = new_cert;
4239 }
4240 else
4241 {
4242 mbedtls_ssl_key_cert *cur = *head;
4243 while( cur->next != NULL )
4244 cur = cur->next;
4245 cur->next = new_cert;
4246 }
4247
4248 return( 0 );
4249 }
4250
mbedtls_ssl_conf_own_cert(mbedtls_ssl_config * conf,mbedtls_x509_crt * own_cert,mbedtls_pk_context * pk_key)4251 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
4252 mbedtls_x509_crt *own_cert,
4253 mbedtls_pk_context *pk_key )
4254 {
4255 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
4256 }
4257
mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config * conf,mbedtls_x509_crt * ca_chain,mbedtls_x509_crl * ca_crl)4258 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
4259 mbedtls_x509_crt *ca_chain,
4260 mbedtls_x509_crl *ca_crl )
4261 {
4262 conf->ca_chain = ca_chain;
4263 conf->ca_crl = ca_crl;
4264
4265 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
4266 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
4267 * cannot be used together. */
4268 conf->f_ca_cb = NULL;
4269 conf->p_ca_cb = NULL;
4270 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
4271 }
4272
4273 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
mbedtls_ssl_conf_ca_cb(mbedtls_ssl_config * conf,mbedtls_x509_crt_ca_cb_t f_ca_cb,void * p_ca_cb)4274 void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
4275 mbedtls_x509_crt_ca_cb_t f_ca_cb,
4276 void *p_ca_cb )
4277 {
4278 conf->f_ca_cb = f_ca_cb;
4279 conf->p_ca_cb = p_ca_cb;
4280
4281 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
4282 * cannot be used together. */
4283 conf->ca_chain = NULL;
4284 conf->ca_crl = NULL;
4285 }
4286 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
4287 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4288
4289 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context * ssl,mbedtls_x509_crt * own_cert,mbedtls_pk_context * pk_key)4290 int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
4291 mbedtls_x509_crt *own_cert,
4292 mbedtls_pk_context *pk_key )
4293 {
4294 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
4295 own_cert, pk_key ) );
4296 }
4297
mbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context * ssl,mbedtls_x509_crt * ca_chain,mbedtls_x509_crl * ca_crl)4298 void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
4299 mbedtls_x509_crt *ca_chain,
4300 mbedtls_x509_crl *ca_crl )
4301 {
4302 ssl->handshake->sni_ca_chain = ca_chain;
4303 ssl->handshake->sni_ca_crl = ca_crl;
4304 }
4305
mbedtls_ssl_set_hs_authmode(mbedtls_ssl_context * ssl,int authmode)4306 void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
4307 int authmode )
4308 {
4309 ssl->handshake->sni_authmode = authmode;
4310 }
4311 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
4312
4313 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_set_verify(mbedtls_ssl_context * ssl,int (* f_vrfy)(void *,mbedtls_x509_crt *,int,uint32_t *),void * p_vrfy)4314 void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
4315 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
4316 void *p_vrfy )
4317 {
4318 ssl->f_vrfy = f_vrfy;
4319 ssl->p_vrfy = p_vrfy;
4320 }
4321 #endif
4322
4323 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
4324 /*
4325 * Set EC J-PAKE password for current handshake
4326 */
mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context * ssl,const unsigned char * pw,size_t pw_len)4327 int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
4328 const unsigned char *pw,
4329 size_t pw_len )
4330 {
4331 mbedtls_ecjpake_role role;
4332
4333 if( ssl->handshake == NULL || ssl->conf == NULL )
4334 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4335
4336 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
4337 role = MBEDTLS_ECJPAKE_SERVER;
4338 else
4339 role = MBEDTLS_ECJPAKE_CLIENT;
4340
4341 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
4342 role,
4343 MBEDTLS_MD_SHA256,
4344 MBEDTLS_ECP_DP_SECP256R1,
4345 pw, pw_len ) );
4346 }
4347 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
4348
4349 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
4350
ssl_conf_remove_psk(mbedtls_ssl_config * conf)4351 static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
4352 {
4353 /* Remove reference to existing PSK, if any. */
4354 #if defined(MBEDTLS_USE_PSA_CRYPTO)
4355 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
4356 {
4357 /* The maintenance of the PSK key slot is the
4358 * user's responsibility. */
4359 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4360 }
4361 /* This and the following branch should never
4362 * be taken simultaenously as we maintain the
4363 * invariant that raw and opaque PSKs are never
4364 * configured simultaneously. As a safeguard,
4365 * though, `else` is omitted here. */
4366 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4367 if( conf->psk != NULL )
4368 {
4369 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
4370
4371 mbedtls_free( conf->psk );
4372 conf->psk = NULL;
4373 conf->psk_len = 0;
4374 }
4375
4376 /* Remove reference to PSK identity, if any. */
4377 if( conf->psk_identity != NULL )
4378 {
4379 mbedtls_free( conf->psk_identity );
4380 conf->psk_identity = NULL;
4381 conf->psk_identity_len = 0;
4382 }
4383 }
4384
4385 /* This function assumes that PSK identity in the SSL config is unset.
4386 * It checks that the provided identity is well-formed and attempts
4387 * to make a copy of it in the SSL config.
4388 * On failure, the PSK identity in the config remains unset. */
ssl_conf_set_psk_identity(mbedtls_ssl_config * conf,unsigned char const * psk_identity,size_t psk_identity_len)4389 static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
4390 unsigned char const *psk_identity,
4391 size_t psk_identity_len )
4392 {
4393 /* Identity len will be encoded on two bytes */
4394 if( psk_identity == NULL ||
4395 ( psk_identity_len >> 16 ) != 0 ||
4396 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
4397 {
4398 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4399 }
4400
4401 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
4402 if( conf->psk_identity == NULL )
4403 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4404
4405 conf->psk_identity_len = psk_identity_len;
4406 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
4407
4408 return( 0 );
4409 }
4410
mbedtls_ssl_conf_psk(mbedtls_ssl_config * conf,const unsigned char * psk,size_t psk_len,const unsigned char * psk_identity,size_t psk_identity_len)4411 int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
4412 const unsigned char *psk, size_t psk_len,
4413 const unsigned char *psk_identity, size_t psk_identity_len )
4414 {
4415 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4416 /* Remove opaque/raw PSK + PSK Identity */
4417 ssl_conf_remove_psk( conf );
4418
4419 /* Check and set raw PSK */
4420 if( psk == NULL )
4421 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4422 if( psk_len == 0 )
4423 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4424 if( psk_len > MBEDTLS_PSK_MAX_LEN )
4425 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4426
4427 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
4428 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4429 conf->psk_len = psk_len;
4430 memcpy( conf->psk, psk, conf->psk_len );
4431
4432 /* Check and set PSK Identity */
4433 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
4434 if( ret != 0 )
4435 ssl_conf_remove_psk( conf );
4436
4437 return( ret );
4438 }
4439
ssl_remove_psk(mbedtls_ssl_context * ssl)4440 static void ssl_remove_psk( mbedtls_ssl_context *ssl )
4441 {
4442 #if defined(MBEDTLS_USE_PSA_CRYPTO)
4443 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
4444 {
4445 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4446 }
4447 else
4448 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4449 if( ssl->handshake->psk != NULL )
4450 {
4451 mbedtls_platform_zeroize( ssl->handshake->psk,
4452 ssl->handshake->psk_len );
4453 mbedtls_free( ssl->handshake->psk );
4454 ssl->handshake->psk_len = 0;
4455 }
4456 }
4457
mbedtls_ssl_set_hs_psk(mbedtls_ssl_context * ssl,const unsigned char * psk,size_t psk_len)4458 int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
4459 const unsigned char *psk, size_t psk_len )
4460 {
4461 if( psk == NULL || ssl->handshake == NULL )
4462 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4463
4464 if( psk_len > MBEDTLS_PSK_MAX_LEN )
4465 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4466
4467 ssl_remove_psk( ssl );
4468
4469 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
4470 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4471
4472 ssl->handshake->psk_len = psk_len;
4473 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
4474
4475 return( 0 );
4476 }
4477
4478 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config * conf,psa_key_id_t psk,const unsigned char * psk_identity,size_t psk_identity_len)4479 int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
4480 psa_key_id_t psk,
4481 const unsigned char *psk_identity,
4482 size_t psk_identity_len )
4483 {
4484 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4485 /* Clear opaque/raw PSK + PSK Identity, if present. */
4486 ssl_conf_remove_psk( conf );
4487
4488 /* Check and set opaque PSK */
4489 if( mbedtls_svc_key_id_is_null( psk ) )
4490 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4491 conf->psk_opaque = psk;
4492
4493 /* Check and set PSK Identity */
4494 ret = ssl_conf_set_psk_identity( conf, psk_identity,
4495 psk_identity_len );
4496 if( ret != 0 )
4497 ssl_conf_remove_psk( conf );
4498
4499 return( ret );
4500 }
4501
mbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context * ssl,psa_key_id_t psk)4502 int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
4503 psa_key_id_t psk )
4504 {
4505 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
4506 ( ssl->handshake == NULL ) )
4507 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4508
4509 ssl_remove_psk( ssl );
4510 ssl->handshake->psk_opaque = psk;
4511 return( 0 );
4512 }
4513 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4514
mbedtls_ssl_conf_psk_cb(mbedtls_ssl_config * conf,int (* f_psk)(void *,mbedtls_ssl_context *,const unsigned char *,size_t),void * p_psk)4515 void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
4516 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
4517 size_t),
4518 void *p_psk )
4519 {
4520 conf->f_psk = f_psk;
4521 conf->p_psk = p_psk;
4522 }
4523 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
4524
4525 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
4526
4527 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_ssl_conf_dh_param(mbedtls_ssl_config * conf,const char * dhm_P,const char * dhm_G)4528 int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
4529 {
4530 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4531
4532 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
4533 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
4534 {
4535 mbedtls_mpi_free( &conf->dhm_P );
4536 mbedtls_mpi_free( &conf->dhm_G );
4537 return( ret );
4538 }
4539
4540 return( 0 );
4541 }
4542 #endif /* MBEDTLS_DEPRECATED_REMOVED */
4543
mbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config * conf,const unsigned char * dhm_P,size_t P_len,const unsigned char * dhm_G,size_t G_len)4544 int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
4545 const unsigned char *dhm_P, size_t P_len,
4546 const unsigned char *dhm_G, size_t G_len )
4547 {
4548 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4549
4550 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
4551 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
4552 {
4553 mbedtls_mpi_free( &conf->dhm_P );
4554 mbedtls_mpi_free( &conf->dhm_G );
4555 return( ret );
4556 }
4557
4558 return( 0 );
4559 }
4560
mbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config * conf,mbedtls_dhm_context * dhm_ctx)4561 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
4562 {
4563 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4564
4565 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
4566 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
4567 {
4568 mbedtls_mpi_free( &conf->dhm_P );
4569 mbedtls_mpi_free( &conf->dhm_G );
4570 return( ret );
4571 }
4572
4573 return( 0 );
4574 }
4575 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
4576
4577 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
4578 /*
4579 * Set the minimum length for Diffie-Hellman parameters
4580 */
mbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config * conf,unsigned int bitlen)4581 void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
4582 unsigned int bitlen )
4583 {
4584 conf->dhm_min_bitlen = bitlen;
4585 }
4586 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
4587
4588 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
4589 /*
4590 * Set allowed/preferred hashes for handshake signatures
4591 */
mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config * conf,const int * hashes)4592 void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
4593 const int *hashes )
4594 {
4595 conf->sig_hashes = hashes;
4596 }
4597 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4598
4599 #if defined(MBEDTLS_ECP_C)
4600 /*
4601 * Set the allowed elliptic curves
4602 */
mbedtls_ssl_conf_curves(mbedtls_ssl_config * conf,const mbedtls_ecp_group_id * curve_list)4603 void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
4604 const mbedtls_ecp_group_id *curve_list )
4605 {
4606 conf->curve_list = curve_list;
4607 }
4608 #endif /* MBEDTLS_ECP_C */
4609
4610 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_set_hostname(mbedtls_ssl_context * ssl,const char * hostname)4611 int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
4612 {
4613 /* Initialize to suppress unnecessary compiler warning */
4614 size_t hostname_len = 0;
4615
4616 /* Check if new hostname is valid before
4617 * making any change to current one */
4618 if( hostname != NULL )
4619 {
4620 hostname_len = strlen( hostname );
4621
4622 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
4623 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4624 }
4625
4626 /* Now it's clear that we will overwrite the old hostname,
4627 * so we can free it safely */
4628
4629 if( ssl->hostname != NULL )
4630 {
4631 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
4632 mbedtls_free( ssl->hostname );
4633 }
4634
4635 /* Passing NULL as hostname shall clear the old one */
4636
4637 if( hostname == NULL )
4638 {
4639 ssl->hostname = NULL;
4640 }
4641 else
4642 {
4643 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
4644 if( ssl->hostname == NULL )
4645 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4646
4647 memcpy( ssl->hostname, hostname, hostname_len );
4648
4649 ssl->hostname[hostname_len] = '\0';
4650 }
4651
4652 return( 0 );
4653 }
4654 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4655
4656 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedtls_ssl_conf_sni(mbedtls_ssl_config * conf,int (* f_sni)(void *,mbedtls_ssl_context *,const unsigned char *,size_t),void * p_sni)4657 void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
4658 int (*f_sni)(void *, mbedtls_ssl_context *,
4659 const unsigned char *, size_t),
4660 void *p_sni )
4661 {
4662 conf->f_sni = f_sni;
4663 conf->p_sni = p_sni;
4664 }
4665 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
4666
4667 #if defined(MBEDTLS_SSL_ALPN)
mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config * conf,const char ** protos)4668 int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
4669 {
4670 size_t cur_len, tot_len;
4671 const char **p;
4672
4673 /*
4674 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
4675 * MUST NOT be truncated."
4676 * We check lengths now rather than later.
4677 */
4678 tot_len = 0;
4679 for( p = protos; *p != NULL; p++ )
4680 {
4681 cur_len = strlen( *p );
4682 tot_len += cur_len;
4683
4684 if( ( cur_len == 0 ) ||
4685 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
4686 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
4687 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4688 }
4689
4690 conf->alpn_list = protos;
4691
4692 return( 0 );
4693 }
4694
mbedtls_ssl_get_alpn_protocol(const mbedtls_ssl_context * ssl)4695 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
4696 {
4697 return( ssl->alpn_chosen );
4698 }
4699 #endif /* MBEDTLS_SSL_ALPN */
4700
4701 #if defined(MBEDTLS_SSL_DTLS_SRTP)
mbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config * conf,int support_mki_value)4702 void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
4703 int support_mki_value )
4704 {
4705 conf->dtls_srtp_mki_support = support_mki_value;
4706 }
4707
mbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context * ssl,unsigned char * mki_value,uint16_t mki_len)4708 int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
4709 unsigned char *mki_value,
4710 uint16_t mki_len )
4711 {
4712 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
4713 {
4714 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4715 }
4716
4717 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
4718 {
4719 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4720 }
4721
4722 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
4723 ssl->dtls_srtp_info.mki_len = mki_len;
4724 return( 0 );
4725 }
4726
mbedtls_ssl_conf_dtls_srtp_protection_profiles(mbedtls_ssl_config * conf,const mbedtls_ssl_srtp_profile * profiles)4727 int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
4728 const mbedtls_ssl_srtp_profile *profiles )
4729 {
4730 const mbedtls_ssl_srtp_profile *p;
4731 size_t list_size = 0;
4732
4733 /* check the profiles list: all entry must be valid,
4734 * its size cannot be more than the total number of supported profiles, currently 4 */
4735 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
4736 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
4737 p++ )
4738 {
4739 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
4740 {
4741 list_size++;
4742 }
4743 else
4744 {
4745 /* unsupported value, stop parsing and set the size to an error value */
4746 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
4747 }
4748 }
4749
4750 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
4751 {
4752 conf->dtls_srtp_profile_list = NULL;
4753 conf->dtls_srtp_profile_list_len = 0;
4754 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4755 }
4756
4757 conf->dtls_srtp_profile_list = profiles;
4758 conf->dtls_srtp_profile_list_len = list_size;
4759
4760 return( 0 );
4761 }
4762
mbedtls_ssl_get_dtls_srtp_negotiation_result(const mbedtls_ssl_context * ssl,mbedtls_dtls_srtp_info * dtls_srtp_info)4763 void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
4764 mbedtls_dtls_srtp_info *dtls_srtp_info )
4765 {
4766 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
4767 /* do not copy the mki value if there is no chosen profile */
4768 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
4769 {
4770 dtls_srtp_info->mki_len = 0;
4771 }
4772 else
4773 {
4774 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
4775 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
4776 ssl->dtls_srtp_info.mki_len );
4777 }
4778 }
4779 #endif /* MBEDTLS_SSL_DTLS_SRTP */
4780
mbedtls_ssl_conf_max_version(mbedtls_ssl_config * conf,int major,int minor)4781 void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
4782 {
4783 conf->max_major_ver = major;
4784 conf->max_minor_ver = minor;
4785 }
4786
mbedtls_ssl_conf_min_version(mbedtls_ssl_config * conf,int major,int minor)4787 void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
4788 {
4789 conf->min_major_ver = major;
4790 conf->min_minor_ver = minor;
4791 }
4792
4793 #if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_conf_fallback(mbedtls_ssl_config * conf,char fallback)4794 void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
4795 {
4796 conf->fallback = fallback;
4797 }
4798 #endif
4799
4800 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config * conf,char cert_req_ca_list)4801 void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
4802 char cert_req_ca_list )
4803 {
4804 conf->cert_req_ca_list = cert_req_ca_list;
4805 }
4806 #endif
4807
4808 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
mbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config * conf,char etm)4809 void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
4810 {
4811 conf->encrypt_then_mac = etm;
4812 }
4813 #endif
4814
4815 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
mbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config * conf,char ems)4816 void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
4817 {
4818 conf->extended_ms = ems;
4819 }
4820 #endif
4821
4822 #if defined(MBEDTLS_ARC4_C)
mbedtls_ssl_conf_arc4_support(mbedtls_ssl_config * conf,char arc4)4823 void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
4824 {
4825 conf->arc4_disabled = arc4;
4826 }
4827 #endif
4828
4829 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config * conf,unsigned char mfl_code)4830 int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
4831 {
4832 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
4833 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
4834 {
4835 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4836 }
4837
4838 conf->mfl_code = mfl_code;
4839
4840 return( 0 );
4841 }
4842 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4843
4844 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
mbedtls_ssl_conf_truncated_hmac(mbedtls_ssl_config * conf,int truncate)4845 void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
4846 {
4847 conf->trunc_hmac = truncate;
4848 }
4849 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
4850
4851 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
mbedtls_ssl_conf_cbc_record_splitting(mbedtls_ssl_config * conf,char split)4852 void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
4853 {
4854 conf->cbc_record_splitting = split;
4855 }
4856 #endif
4857
mbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config * conf,int allow_legacy)4858 void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
4859 {
4860 conf->allow_legacy_renegotiation = allow_legacy;
4861 }
4862
4863 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config * conf,int renegotiation)4864 void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
4865 {
4866 conf->disable_renegotiation = renegotiation;
4867 }
4868
mbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config * conf,int max_records)4869 void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
4870 {
4871 conf->renego_max_records = max_records;
4872 }
4873
mbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config * conf,const unsigned char period[8])4874 void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
4875 const unsigned char period[8] )
4876 {
4877 memcpy( conf->renego_period, period, 8 );
4878 }
4879 #endif /* MBEDTLS_SSL_RENEGOTIATION */
4880
4881 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4882 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_conf_session_tickets(mbedtls_ssl_config * conf,int use_tickets)4883 void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
4884 {
4885 conf->session_tickets = use_tickets;
4886 }
4887 #endif
4888
4889 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config * conf,mbedtls_ssl_ticket_write_t * f_ticket_write,mbedtls_ssl_ticket_parse_t * f_ticket_parse,void * p_ticket)4890 void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
4891 mbedtls_ssl_ticket_write_t *f_ticket_write,
4892 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
4893 void *p_ticket )
4894 {
4895 conf->f_ticket_write = f_ticket_write;
4896 conf->f_ticket_parse = f_ticket_parse;
4897 conf->p_ticket = p_ticket;
4898 }
4899 #endif
4900 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4901
4902 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
mbedtls_ssl_conf_export_keys_cb(mbedtls_ssl_config * conf,mbedtls_ssl_export_keys_t * f_export_keys,void * p_export_keys)4903 void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
4904 mbedtls_ssl_export_keys_t *f_export_keys,
4905 void *p_export_keys )
4906 {
4907 conf->f_export_keys = f_export_keys;
4908 conf->p_export_keys = p_export_keys;
4909 }
4910
mbedtls_ssl_conf_export_keys_ext_cb(mbedtls_ssl_config * conf,mbedtls_ssl_export_keys_ext_t * f_export_keys_ext,void * p_export_keys)4911 void mbedtls_ssl_conf_export_keys_ext_cb( mbedtls_ssl_config *conf,
4912 mbedtls_ssl_export_keys_ext_t *f_export_keys_ext,
4913 void *p_export_keys )
4914 {
4915 conf->f_export_keys_ext = f_export_keys_ext;
4916 conf->p_export_keys = p_export_keys;
4917 }
4918 #endif
4919
4920 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
mbedtls_ssl_conf_async_private_cb(mbedtls_ssl_config * conf,mbedtls_ssl_async_sign_t * f_async_sign,mbedtls_ssl_async_decrypt_t * f_async_decrypt,mbedtls_ssl_async_resume_t * f_async_resume,mbedtls_ssl_async_cancel_t * f_async_cancel,void * async_config_data)4921 void mbedtls_ssl_conf_async_private_cb(
4922 mbedtls_ssl_config *conf,
4923 mbedtls_ssl_async_sign_t *f_async_sign,
4924 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
4925 mbedtls_ssl_async_resume_t *f_async_resume,
4926 mbedtls_ssl_async_cancel_t *f_async_cancel,
4927 void *async_config_data )
4928 {
4929 conf->f_async_sign_start = f_async_sign;
4930 conf->f_async_decrypt_start = f_async_decrypt;
4931 conf->f_async_resume = f_async_resume;
4932 conf->f_async_cancel = f_async_cancel;
4933 conf->p_async_config_data = async_config_data;
4934 }
4935
mbedtls_ssl_conf_get_async_config_data(const mbedtls_ssl_config * conf)4936 void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
4937 {
4938 return( conf->p_async_config_data );
4939 }
4940
mbedtls_ssl_get_async_operation_data(const mbedtls_ssl_context * ssl)4941 void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
4942 {
4943 if( ssl->handshake == NULL )
4944 return( NULL );
4945 else
4946 return( ssl->handshake->user_async_ctx );
4947 }
4948
mbedtls_ssl_set_async_operation_data(mbedtls_ssl_context * ssl,void * ctx)4949 void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
4950 void *ctx )
4951 {
4952 if( ssl->handshake != NULL )
4953 ssl->handshake->user_async_ctx = ctx;
4954 }
4955 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
4956
4957 /*
4958 * SSL get accessors
4959 */
mbedtls_ssl_get_verify_result(const mbedtls_ssl_context * ssl)4960 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
4961 {
4962 if( ssl->session != NULL )
4963 return( ssl->session->verify_result );
4964
4965 if( ssl->session_negotiate != NULL )
4966 return( ssl->session_negotiate->verify_result );
4967
4968 return( 0xFFFFFFFF );
4969 }
4970
mbedtls_ssl_get_ciphersuite(const mbedtls_ssl_context * ssl)4971 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
4972 {
4973 if( ssl == NULL || ssl->session == NULL )
4974 return( NULL );
4975
4976 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
4977 }
4978
mbedtls_ssl_get_version(const mbedtls_ssl_context * ssl)4979 const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
4980 {
4981 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4982 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4983 {
4984 switch( ssl->minor_ver )
4985 {
4986 case MBEDTLS_SSL_MINOR_VERSION_2:
4987 return( "DTLSv1.0" );
4988
4989 case MBEDTLS_SSL_MINOR_VERSION_3:
4990 return( "DTLSv1.2" );
4991
4992 default:
4993 return( "unknown (DTLS)" );
4994 }
4995 }
4996 #endif
4997
4998 switch( ssl->minor_ver )
4999 {
5000 case MBEDTLS_SSL_MINOR_VERSION_0:
5001 return( "SSLv3.0" );
5002
5003 case MBEDTLS_SSL_MINOR_VERSION_1:
5004 return( "TLSv1.0" );
5005
5006 case MBEDTLS_SSL_MINOR_VERSION_2:
5007 return( "TLSv1.1" );
5008
5009 case MBEDTLS_SSL_MINOR_VERSION_3:
5010 return( "TLSv1.2" );
5011
5012 default:
5013 return( "unknown" );
5014 }
5015 }
5016
5017 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context * ssl)5018 size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
5019 {
5020 size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
5021 size_t read_mfl;
5022
5023 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
5024 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
5025 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
5026 {
5027 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
5028 }
5029
5030 /* Check if a smaller max length was negotiated */
5031 if( ssl->session_out != NULL )
5032 {
5033 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
5034 if( read_mfl < max_len )
5035 {
5036 max_len = read_mfl;
5037 }
5038 }
5039
5040 // During a handshake, use the value being negotiated
5041 if( ssl->session_negotiate != NULL )
5042 {
5043 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
5044 if( read_mfl < max_len )
5045 {
5046 max_len = read_mfl;
5047 }
5048 }
5049
5050 return( max_len );
5051 }
5052
mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context * ssl)5053 size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
5054 {
5055 size_t max_len;
5056
5057 /*
5058 * Assume mfl_code is correct since it was checked when set
5059 */
5060 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
5061
5062 /* Check if a smaller max length was negotiated */
5063 if( ssl->session_out != NULL &&
5064 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
5065 {
5066 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
5067 }
5068
5069 /* During a handshake, use the value being negotiated */
5070 if( ssl->session_negotiate != NULL &&
5071 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
5072 {
5073 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
5074 }
5075
5076 return( max_len );
5077 }
5078
5079 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_ssl_get_max_frag_len(const mbedtls_ssl_context * ssl)5080 size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
5081 {
5082 return mbedtls_ssl_get_output_max_frag_len( ssl );
5083 }
5084 #endif /* !MBEDTLS_DEPRECATED_REMOVED */
5085 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
5086
5087 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context * ssl)5088 size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
5089 {
5090 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
5091 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
5092 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
5093 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
5094 return ( 0 );
5095
5096 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
5097 return( ssl->mtu );
5098
5099 if( ssl->mtu == 0 )
5100 return( ssl->handshake->mtu );
5101
5102 return( ssl->mtu < ssl->handshake->mtu ?
5103 ssl->mtu : ssl->handshake->mtu );
5104 }
5105 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5106
mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context * ssl)5107 int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
5108 {
5109 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
5110
5111 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
5112 !defined(MBEDTLS_SSL_PROTO_DTLS)
5113 (void) ssl;
5114 #endif
5115
5116 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5117 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
5118
5119 if( max_len > mfl )
5120 max_len = mfl;
5121 #endif
5122
5123 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5124 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
5125 {
5126 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
5127 const int ret = mbedtls_ssl_get_record_expansion( ssl );
5128 const size_t overhead = (size_t) ret;
5129
5130 if( ret < 0 )
5131 return( ret );
5132
5133 if( mtu <= overhead )
5134 {
5135 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
5136 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
5137 }
5138
5139 if( max_len > mtu - overhead )
5140 max_len = mtu - overhead;
5141 }
5142 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5143
5144 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
5145 !defined(MBEDTLS_SSL_PROTO_DTLS)
5146 ((void) ssl);
5147 #endif
5148
5149 return( (int) max_len );
5150 }
5151
5152 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_get_peer_cert(const mbedtls_ssl_context * ssl)5153 const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
5154 {
5155 if( ssl == NULL || ssl->session == NULL )
5156 return( NULL );
5157
5158 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5159 return( ssl->session->peer_cert );
5160 #else
5161 return( NULL );
5162 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5163 }
5164 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5165
5166 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_get_session(const mbedtls_ssl_context * ssl,mbedtls_ssl_session * dst)5167 int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
5168 mbedtls_ssl_session *dst )
5169 {
5170 if( ssl == NULL ||
5171 dst == NULL ||
5172 ssl->session == NULL ||
5173 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
5174 {
5175 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5176 }
5177
5178 return( mbedtls_ssl_session_copy( dst, ssl->session ) );
5179 }
5180 #endif /* MBEDTLS_SSL_CLI_C */
5181
mbedtls_ssl_get_session_pointer(const mbedtls_ssl_context * ssl)5182 const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl )
5183 {
5184 if( ssl == NULL )
5185 return( NULL );
5186
5187 return( ssl->session );
5188 }
5189
5190 /*
5191 * Define ticket header determining Mbed TLS version
5192 * and structure of the ticket.
5193 */
5194
5195 /*
5196 * Define bitflag determining compile-time settings influencing
5197 * structure of serialized SSL sessions.
5198 */
5199
5200 #if defined(MBEDTLS_HAVE_TIME)
5201 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
5202 #else
5203 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
5204 #endif /* MBEDTLS_HAVE_TIME */
5205
5206 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5207 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
5208 #else
5209 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
5210 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5211
5212 #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
5213 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
5214 #else
5215 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
5216 #endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
5217
5218 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5219 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
5220 #else
5221 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
5222 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
5223
5224 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
5225 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 1
5226 #else
5227 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 0
5228 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
5229
5230 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5231 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
5232 #else
5233 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
5234 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
5235
5236 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
5237 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
5238 #else
5239 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
5240 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
5241
5242 #define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
5243 #define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
5244 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
5245 #define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
5246 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT 4
5247 #define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 5
5248 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 6
5249
5250 #define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
5251 ( (uint16_t) ( \
5252 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
5253 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
5254 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
5255 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
5256 ( SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC << SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT ) | \
5257 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
5258 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
5259
5260 static unsigned char ssl_serialized_session_header[] = {
5261 MBEDTLS_VERSION_MAJOR,
5262 MBEDTLS_VERSION_MINOR,
5263 MBEDTLS_VERSION_PATCH,
5264 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
5265 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
5266 };
5267
5268 /*
5269 * Serialize a session in the following format:
5270 * (in the presentation language of TLS, RFC 8446 section 3)
5271 *
5272 * opaque mbedtls_version[3]; // major, minor, patch
5273 * opaque session_format[2]; // version-specific 16-bit field determining
5274 * // the format of the remaining
5275 * // serialized data.
5276 *
5277 * Note: When updating the format, remember to keep
5278 * these version+format bytes.
5279 *
5280 * // In this version, `session_format` determines
5281 * // the setting of those compile-time
5282 * // configuration options which influence
5283 * // the structure of mbedtls_ssl_session.
5284 * uint64 start_time;
5285 * uint8 ciphersuite[2]; // defined by the standard
5286 * uint8 compression; // 0 or 1
5287 * uint8 session_id_len; // at most 32
5288 * opaque session_id[32];
5289 * opaque master[48]; // fixed length in the standard
5290 * uint32 verify_result;
5291 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
5292 * opaque ticket<0..2^24-1>; // length 0 means no ticket
5293 * uint32 ticket_lifetime;
5294 * uint8 mfl_code; // up to 255 according to standard
5295 * uint8 trunc_hmac; // 0 or 1
5296 * uint8 encrypt_then_mac; // 0 or 1
5297 *
5298 * The order is the same as in the definition of the structure, except
5299 * verify_result is put before peer_cert so that all mandatory fields come
5300 * together in one block.
5301 */
ssl_session_save(const mbedtls_ssl_session * session,unsigned char omit_header,unsigned char * buf,size_t buf_len,size_t * olen)5302 static int ssl_session_save( const mbedtls_ssl_session *session,
5303 unsigned char omit_header,
5304 unsigned char *buf,
5305 size_t buf_len,
5306 size_t *olen )
5307 {
5308 unsigned char *p = buf;
5309 size_t used = 0;
5310 #if defined(MBEDTLS_HAVE_TIME)
5311 uint64_t start;
5312 #endif
5313 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5314 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5315 size_t cert_len;
5316 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5317 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5318
5319
5320 if( !omit_header )
5321 {
5322 /*
5323 * Add version identifier
5324 */
5325
5326 used += sizeof( ssl_serialized_session_header );
5327
5328 if( used <= buf_len )
5329 {
5330 memcpy( p, ssl_serialized_session_header,
5331 sizeof( ssl_serialized_session_header ) );
5332 p += sizeof( ssl_serialized_session_header );
5333 }
5334 }
5335
5336 /*
5337 * Time
5338 */
5339 #if defined(MBEDTLS_HAVE_TIME)
5340 used += 8;
5341
5342 if( used <= buf_len )
5343 {
5344 start = (uint64_t) session->start;
5345
5346 *p++ = (unsigned char)( ( start >> 56 ) & 0xFF );
5347 *p++ = (unsigned char)( ( start >> 48 ) & 0xFF );
5348 *p++ = (unsigned char)( ( start >> 40 ) & 0xFF );
5349 *p++ = (unsigned char)( ( start >> 32 ) & 0xFF );
5350 *p++ = (unsigned char)( ( start >> 24 ) & 0xFF );
5351 *p++ = (unsigned char)( ( start >> 16 ) & 0xFF );
5352 *p++ = (unsigned char)( ( start >> 8 ) & 0xFF );
5353 *p++ = (unsigned char)( ( start ) & 0xFF );
5354 }
5355 #endif /* MBEDTLS_HAVE_TIME */
5356
5357 /*
5358 * Basic mandatory fields
5359 */
5360 used += 2 /* ciphersuite */
5361 + 1 /* compression */
5362 + 1 /* id_len */
5363 + sizeof( session->id )
5364 + sizeof( session->master )
5365 + 4; /* verify_result */
5366
5367 if( used <= buf_len )
5368 {
5369 *p++ = (unsigned char)( ( session->ciphersuite >> 8 ) & 0xFF );
5370 *p++ = (unsigned char)( ( session->ciphersuite ) & 0xFF );
5371
5372 *p++ = (unsigned char)( session->compression & 0xFF );
5373
5374 *p++ = (unsigned char)( session->id_len & 0xFF );
5375 memcpy( p, session->id, 32 );
5376 p += 32;
5377
5378 memcpy( p, session->master, 48 );
5379 p += 48;
5380
5381 *p++ = (unsigned char)( ( session->verify_result >> 24 ) & 0xFF );
5382 *p++ = (unsigned char)( ( session->verify_result >> 16 ) & 0xFF );
5383 *p++ = (unsigned char)( ( session->verify_result >> 8 ) & 0xFF );
5384 *p++ = (unsigned char)( ( session->verify_result ) & 0xFF );
5385 }
5386
5387 /*
5388 * Peer's end-entity certificate
5389 */
5390 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5391 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5392 if( session->peer_cert == NULL )
5393 cert_len = 0;
5394 else
5395 cert_len = session->peer_cert->raw.len;
5396
5397 used += 3 + cert_len;
5398
5399 if( used <= buf_len )
5400 {
5401 *p++ = (unsigned char)( ( cert_len >> 16 ) & 0xFF );
5402 *p++ = (unsigned char)( ( cert_len >> 8 ) & 0xFF );
5403 *p++ = (unsigned char)( ( cert_len ) & 0xFF );
5404
5405 if( session->peer_cert != NULL )
5406 {
5407 memcpy( p, session->peer_cert->raw.p, cert_len );
5408 p += cert_len;
5409 }
5410 }
5411 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5412 if( session->peer_cert_digest != NULL )
5413 {
5414 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
5415 if( used <= buf_len )
5416 {
5417 *p++ = (unsigned char) session->peer_cert_digest_type;
5418 *p++ = (unsigned char) session->peer_cert_digest_len;
5419 memcpy( p, session->peer_cert_digest,
5420 session->peer_cert_digest_len );
5421 p += session->peer_cert_digest_len;
5422 }
5423 }
5424 else
5425 {
5426 used += 2;
5427 if( used <= buf_len )
5428 {
5429 *p++ = (unsigned char) MBEDTLS_MD_NONE;
5430 *p++ = 0;
5431 }
5432 }
5433 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5434 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5435
5436 /*
5437 * Session ticket if any, plus associated data
5438 */
5439 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5440 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
5441
5442 if( used <= buf_len )
5443 {
5444 *p++ = (unsigned char)( ( session->ticket_len >> 16 ) & 0xFF );
5445 *p++ = (unsigned char)( ( session->ticket_len >> 8 ) & 0xFF );
5446 *p++ = (unsigned char)( ( session->ticket_len ) & 0xFF );
5447
5448 if( session->ticket != NULL )
5449 {
5450 memcpy( p, session->ticket, session->ticket_len );
5451 p += session->ticket_len;
5452 }
5453
5454 *p++ = (unsigned char)( ( session->ticket_lifetime >> 24 ) & 0xFF );
5455 *p++ = (unsigned char)( ( session->ticket_lifetime >> 16 ) & 0xFF );
5456 *p++ = (unsigned char)( ( session->ticket_lifetime >> 8 ) & 0xFF );
5457 *p++ = (unsigned char)( ( session->ticket_lifetime ) & 0xFF );
5458 }
5459 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5460
5461 /*
5462 * Misc extension-related info
5463 */
5464 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5465 used += 1;
5466
5467 if( used <= buf_len )
5468 *p++ = session->mfl_code;
5469 #endif
5470
5471 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
5472 used += 1;
5473
5474 if( used <= buf_len )
5475 *p++ = (unsigned char)( ( session->trunc_hmac ) & 0xFF );
5476 #endif
5477
5478 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5479 used += 1;
5480
5481 if( used <= buf_len )
5482 *p++ = (unsigned char)( ( session->encrypt_then_mac ) & 0xFF );
5483 #endif
5484
5485 /* Done */
5486 *olen = used;
5487
5488 if( used > buf_len )
5489 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5490
5491 return( 0 );
5492 }
5493
5494 /*
5495 * Public wrapper for ssl_session_save()
5496 */
mbedtls_ssl_session_save(const mbedtls_ssl_session * session,unsigned char * buf,size_t buf_len,size_t * olen)5497 int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
5498 unsigned char *buf,
5499 size_t buf_len,
5500 size_t *olen )
5501 {
5502 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
5503 }
5504
5505 /*
5506 * Deserialize session, see mbedtls_ssl_session_save() for format.
5507 *
5508 * This internal version is wrapped by a public function that cleans up in
5509 * case of error, and has an extra option omit_header.
5510 */
ssl_session_load(mbedtls_ssl_session * session,unsigned char omit_header,const unsigned char * buf,size_t len)5511 static int ssl_session_load( mbedtls_ssl_session *session,
5512 unsigned char omit_header,
5513 const unsigned char *buf,
5514 size_t len )
5515 {
5516 const unsigned char *p = buf;
5517 const unsigned char * const end = buf + len;
5518 #if defined(MBEDTLS_HAVE_TIME)
5519 uint64_t start;
5520 #endif
5521 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5522 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5523 size_t cert_len;
5524 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5525 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5526
5527 if( !omit_header )
5528 {
5529 /*
5530 * Check version identifier
5531 */
5532
5533 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
5534 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5535
5536 if( memcmp( p, ssl_serialized_session_header,
5537 sizeof( ssl_serialized_session_header ) ) != 0 )
5538 {
5539 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
5540 }
5541 p += sizeof( ssl_serialized_session_header );
5542 }
5543
5544 /*
5545 * Time
5546 */
5547 #if defined(MBEDTLS_HAVE_TIME)
5548 if( 8 > (size_t)( end - p ) )
5549 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5550
5551 start = ( (uint64_t) p[0] << 56 ) |
5552 ( (uint64_t) p[1] << 48 ) |
5553 ( (uint64_t) p[2] << 40 ) |
5554 ( (uint64_t) p[3] << 32 ) |
5555 ( (uint64_t) p[4] << 24 ) |
5556 ( (uint64_t) p[5] << 16 ) |
5557 ( (uint64_t) p[6] << 8 ) |
5558 ( (uint64_t) p[7] );
5559 p += 8;
5560
5561 session->start = (time_t) start;
5562 #endif /* MBEDTLS_HAVE_TIME */
5563
5564 /*
5565 * Basic mandatory fields
5566 */
5567 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
5568 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5569
5570 session->ciphersuite = ( p[0] << 8 ) | p[1];
5571 p += 2;
5572
5573 session->compression = *p++;
5574
5575 session->id_len = *p++;
5576 memcpy( session->id, p, 32 );
5577 p += 32;
5578
5579 memcpy( session->master, p, 48 );
5580 p += 48;
5581
5582 session->verify_result = ( (uint32_t) p[0] << 24 ) |
5583 ( (uint32_t) p[1] << 16 ) |
5584 ( (uint32_t) p[2] << 8 ) |
5585 ( (uint32_t) p[3] );
5586 p += 4;
5587
5588 /* Immediately clear invalid pointer values that have been read, in case
5589 * we exit early before we replaced them with valid ones. */
5590 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5591 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5592 session->peer_cert = NULL;
5593 #else
5594 session->peer_cert_digest = NULL;
5595 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5596 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5597 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5598 session->ticket = NULL;
5599 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5600
5601 /*
5602 * Peer certificate
5603 */
5604 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5605 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5606 /* Deserialize CRT from the end of the ticket. */
5607 if( 3 > (size_t)( end - p ) )
5608 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5609
5610 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5611 p += 3;
5612
5613 if( cert_len != 0 )
5614 {
5615 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5616
5617 if( cert_len > (size_t)( end - p ) )
5618 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5619
5620 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
5621
5622 if( session->peer_cert == NULL )
5623 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5624
5625 mbedtls_x509_crt_init( session->peer_cert );
5626
5627 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
5628 p, cert_len ) ) != 0 )
5629 {
5630 mbedtls_x509_crt_free( session->peer_cert );
5631 mbedtls_free( session->peer_cert );
5632 session->peer_cert = NULL;
5633 return( ret );
5634 }
5635
5636 p += cert_len;
5637 }
5638 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5639 /* Deserialize CRT digest from the end of the ticket. */
5640 if( 2 > (size_t)( end - p ) )
5641 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5642
5643 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
5644 session->peer_cert_digest_len = (size_t) *p++;
5645
5646 if( session->peer_cert_digest_len != 0 )
5647 {
5648 const mbedtls_md_info_t *md_info =
5649 mbedtls_md_info_from_type( session->peer_cert_digest_type );
5650 if( md_info == NULL )
5651 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5652 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
5653 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5654
5655 if( session->peer_cert_digest_len > (size_t)( end - p ) )
5656 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5657
5658 session->peer_cert_digest =
5659 mbedtls_calloc( 1, session->peer_cert_digest_len );
5660 if( session->peer_cert_digest == NULL )
5661 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5662
5663 memcpy( session->peer_cert_digest, p,
5664 session->peer_cert_digest_len );
5665 p += session->peer_cert_digest_len;
5666 }
5667 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5668 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5669
5670 /*
5671 * Session ticket and associated data
5672 */
5673 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5674 if( 3 > (size_t)( end - p ) )
5675 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5676
5677 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5678 p += 3;
5679
5680 if( session->ticket_len != 0 )
5681 {
5682 if( session->ticket_len > (size_t)( end - p ) )
5683 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5684
5685 session->ticket = mbedtls_calloc( 1, session->ticket_len );
5686 if( session->ticket == NULL )
5687 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5688
5689 memcpy( session->ticket, p, session->ticket_len );
5690 p += session->ticket_len;
5691 }
5692
5693 if( 4 > (size_t)( end - p ) )
5694 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5695
5696 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
5697 ( (uint32_t) p[1] << 16 ) |
5698 ( (uint32_t) p[2] << 8 ) |
5699 ( (uint32_t) p[3] );
5700 p += 4;
5701 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5702
5703 /*
5704 * Misc extension-related info
5705 */
5706 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5707 if( 1 > (size_t)( end - p ) )
5708 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5709
5710 session->mfl_code = *p++;
5711 #endif
5712
5713 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
5714 if( 1 > (size_t)( end - p ) )
5715 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5716
5717 session->trunc_hmac = *p++;
5718 #endif
5719
5720 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5721 if( 1 > (size_t)( end - p ) )
5722 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5723
5724 session->encrypt_then_mac = *p++;
5725 #endif
5726
5727 /* Done, should have consumed entire buffer */
5728 if( p != end )
5729 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5730
5731 return( 0 );
5732 }
5733
5734 /*
5735 * Deserialize session: public wrapper for error cleaning
5736 */
mbedtls_ssl_session_load(mbedtls_ssl_session * session,const unsigned char * buf,size_t len)5737 int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
5738 const unsigned char *buf,
5739 size_t len )
5740 {
5741 int ret = ssl_session_load( session, 0, buf, len );
5742
5743 if( ret != 0 )
5744 mbedtls_ssl_session_free( session );
5745
5746 return( ret );
5747 }
5748
5749 /*
5750 * Perform a single step of the SSL handshake
5751 */
mbedtls_ssl_handshake_step(mbedtls_ssl_context * ssl)5752 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
5753 {
5754 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5755
5756 if( ssl == NULL || ssl->conf == NULL )
5757 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5758
5759 #if defined(MBEDTLS_SSL_CLI_C)
5760 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5761 ret = mbedtls_ssl_handshake_client_step( ssl );
5762 #endif
5763 #if defined(MBEDTLS_SSL_SRV_C)
5764 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5765 ret = mbedtls_ssl_handshake_server_step( ssl );
5766 #endif
5767
5768 return( ret );
5769 }
5770
5771 /*
5772 * Perform the SSL handshake
5773 */
mbedtls_ssl_handshake(mbedtls_ssl_context * ssl)5774 int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
5775 {
5776 int ret = 0;
5777
5778 /* Sanity checks */
5779
5780 if( ssl == NULL || ssl->conf == NULL )
5781 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5782
5783 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5784 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5785 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
5786 {
5787 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
5788 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
5789 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5790 }
5791 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5792
5793 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
5794
5795 /* Main handshake loop */
5796 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5797 {
5798 ret = mbedtls_ssl_handshake_step( ssl );
5799
5800 if( ret != 0 )
5801 break;
5802 }
5803
5804 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
5805
5806 return( ret );
5807 }
5808
5809 #if defined(MBEDTLS_SSL_RENEGOTIATION)
5810 #if defined(MBEDTLS_SSL_SRV_C)
5811 /*
5812 * Write HelloRequest to request renegotiation on server
5813 */
ssl_write_hello_request(mbedtls_ssl_context * ssl)5814 static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
5815 {
5816 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5817
5818 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
5819
5820 ssl->out_msglen = 4;
5821 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5822 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
5823
5824 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
5825 {
5826 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
5827 return( ret );
5828 }
5829
5830 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
5831
5832 return( 0 );
5833 }
5834 #endif /* MBEDTLS_SSL_SRV_C */
5835
5836 /*
5837 * Actually renegotiate current connection, triggered by either:
5838 * - any side: calling mbedtls_ssl_renegotiate(),
5839 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
5840 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
5841 * the initial handshake is completed.
5842 * If the handshake doesn't complete due to waiting for I/O, it will continue
5843 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
5844 */
mbedtls_ssl_start_renegotiation(mbedtls_ssl_context * ssl)5845 int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
5846 {
5847 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5848
5849 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
5850
5851 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
5852 return( ret );
5853
5854 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
5855 * the ServerHello will have message_seq = 1" */
5856 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5857 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5858 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
5859 {
5860 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5861 ssl->handshake->out_msg_seq = 1;
5862 else
5863 ssl->handshake->in_msg_seq = 1;
5864 }
5865 #endif
5866
5867 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
5868 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
5869
5870 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
5871 {
5872 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
5873 return( ret );
5874 }
5875
5876 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
5877
5878 return( 0 );
5879 }
5880
5881 /*
5882 * Renegotiate current connection on client,
5883 * or request renegotiation on server
5884 */
mbedtls_ssl_renegotiate(mbedtls_ssl_context * ssl)5885 int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
5886 {
5887 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5888
5889 if( ssl == NULL || ssl->conf == NULL )
5890 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5891
5892 #if defined(MBEDTLS_SSL_SRV_C)
5893 /* On server, just send the request */
5894 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5895 {
5896 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5897 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5898
5899 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
5900
5901 /* Did we already try/start sending HelloRequest? */
5902 if( ssl->out_left != 0 )
5903 return( mbedtls_ssl_flush_output( ssl ) );
5904
5905 return( ssl_write_hello_request( ssl ) );
5906 }
5907 #endif /* MBEDTLS_SSL_SRV_C */
5908
5909 #if defined(MBEDTLS_SSL_CLI_C)
5910 /*
5911 * On client, either start the renegotiation process or,
5912 * if already in progress, continue the handshake
5913 */
5914 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
5915 {
5916 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5917 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5918
5919 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
5920 {
5921 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
5922 return( ret );
5923 }
5924 }
5925 else
5926 {
5927 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
5928 {
5929 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
5930 return( ret );
5931 }
5932 }
5933 #endif /* MBEDTLS_SSL_CLI_C */
5934
5935 return( ret );
5936 }
5937 #endif /* MBEDTLS_SSL_RENEGOTIATION */
5938
5939 #if defined(MBEDTLS_X509_CRT_PARSE_C)
ssl_key_cert_free(mbedtls_ssl_key_cert * key_cert)5940 static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
5941 {
5942 mbedtls_ssl_key_cert *cur = key_cert, *next;
5943
5944 while( cur != NULL )
5945 {
5946 next = cur->next;
5947 mbedtls_free( cur );
5948 cur = next;
5949 }
5950 }
5951 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5952
mbedtls_ssl_handshake_free(mbedtls_ssl_context * ssl)5953 void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
5954 {
5955 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
5956
5957 if( handshake == NULL )
5958 return;
5959
5960 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
5961 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
5962 {
5963 ssl->conf->f_async_cancel( ssl );
5964 handshake->async_in_progress = 0;
5965 }
5966 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
5967
5968 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
5969 defined(MBEDTLS_SSL_PROTO_TLS1_1)
5970 mbedtls_md5_free( &handshake->fin_md5 );
5971 mbedtls_sha1_free( &handshake->fin_sha1 );
5972 #endif
5973 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5974 #if defined(MBEDTLS_SHA256_C)
5975 #if defined(MBEDTLS_USE_PSA_CRYPTO)
5976 psa_hash_abort( &handshake->fin_sha256_psa );
5977 #else
5978 mbedtls_sha256_free( &handshake->fin_sha256 );
5979 #endif
5980 #endif
5981 #if defined(MBEDTLS_SHA512_C)
5982 #if defined(MBEDTLS_USE_PSA_CRYPTO)
5983 psa_hash_abort( &handshake->fin_sha384_psa );
5984 #else
5985 mbedtls_sha512_free( &handshake->fin_sha512 );
5986 #endif
5987 #endif
5988 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5989
5990 #if defined(MBEDTLS_DHM_C)
5991 mbedtls_dhm_free( &handshake->dhm_ctx );
5992 #endif
5993 #if defined(MBEDTLS_ECDH_C)
5994 mbedtls_ecdh_free( &handshake->ecdh_ctx );
5995 #endif
5996 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
5997 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
5998 #if defined(MBEDTLS_SSL_CLI_C)
5999 mbedtls_free( handshake->ecjpake_cache );
6000 handshake->ecjpake_cache = NULL;
6001 handshake->ecjpake_cache_len = 0;
6002 #endif
6003 #endif
6004
6005 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
6006 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
6007 /* explicit void pointer cast for buggy MS compiler */
6008 mbedtls_free( (void *) handshake->curves );
6009 #endif
6010
6011 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
6012 if( handshake->psk != NULL )
6013 {
6014 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
6015 mbedtls_free( handshake->psk );
6016 }
6017 #endif
6018
6019 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
6020 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6021 /*
6022 * Free only the linked list wrapper, not the keys themselves
6023 * since the belong to the SNI callback
6024 */
6025 if( handshake->sni_key_cert != NULL )
6026 {
6027 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
6028
6029 while( cur != NULL )
6030 {
6031 next = cur->next;
6032 mbedtls_free( cur );
6033 cur = next;
6034 }
6035 }
6036 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
6037
6038 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6039 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
6040 if( handshake->ecrs_peer_cert != NULL )
6041 {
6042 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
6043 mbedtls_free( handshake->ecrs_peer_cert );
6044 }
6045 #endif
6046
6047 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
6048 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6049 mbedtls_pk_free( &handshake->peer_pubkey );
6050 #endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6051
6052 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6053 mbedtls_free( handshake->verify_cookie );
6054 mbedtls_ssl_flight_free( handshake->flight );
6055 mbedtls_ssl_buffering_free( ssl );
6056 #endif
6057
6058 #if defined(MBEDTLS_ECDH_C) && \
6059 defined(MBEDTLS_USE_PSA_CRYPTO)
6060 psa_destroy_key( handshake->ecdh_psa_privkey );
6061 #endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
6062
6063 mbedtls_platform_zeroize( handshake,
6064 sizeof( mbedtls_ssl_handshake_params ) );
6065
6066 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6067 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
6068 * processes datagrams and the fact that a datagram is allowed to have
6069 * several records in it, it is possible that the I/O buffers are not
6070 * empty at this stage */
6071 {
6072 int modified = 0;
6073 uint32_t buf_len = mbedtls_ssl_get_input_buflen( ssl );
6074 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
6075 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
6076 if( ssl->in_buf != NULL )
6077 {
6078 written_in = ssl->in_msg - ssl->in_buf;
6079 iv_offset_in = ssl->in_iv - ssl->in_buf;
6080 len_offset_in = ssl->in_len - ssl->in_buf;
6081 if( ssl->in_buf_len > buf_len && ssl->in_left < buf_len )
6082 {
6083 if( resize_buffer( &ssl->in_buf, buf_len, &ssl->in_buf_len ) != 0 )
6084 {
6085 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
6086 }
6087 else
6088 {
6089 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %d", buf_len ) );
6090 modified = 1;
6091 }
6092 }
6093 }
6094
6095
6096 buf_len = mbedtls_ssl_get_output_buflen( ssl );
6097 if(ssl->out_buf != NULL )
6098 {
6099 written_out = ssl->out_msg - ssl->out_buf;
6100 iv_offset_out = ssl->out_iv - ssl->out_buf;
6101 len_offset_out = ssl->out_len - ssl->out_buf;
6102 if( ssl->out_buf_len > mbedtls_ssl_get_output_buflen( ssl ) &&
6103 ssl->out_left < buf_len )
6104 {
6105 if( resize_buffer( &ssl->out_buf, buf_len, &ssl->out_buf_len ) != 0 )
6106 {
6107 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
6108 }
6109 else
6110 {
6111 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %d", buf_len ) );
6112 modified = 1;
6113 }
6114 }
6115 }
6116 if( modified )
6117 {
6118 /* Update pointers here to avoid doing it twice. */
6119 mbedtls_ssl_reset_in_out_pointers( ssl );
6120 /* Fields below might not be properly updated with record
6121 * splitting or with CID, so they are manually updated here. */
6122 ssl->out_msg = ssl->out_buf + written_out;
6123 ssl->out_len = ssl->out_buf + len_offset_out;
6124 ssl->out_iv = ssl->out_buf + iv_offset_out;
6125
6126 ssl->in_msg = ssl->in_buf + written_in;
6127 ssl->in_len = ssl->in_buf + len_offset_in;
6128 ssl->in_iv = ssl->in_buf + iv_offset_in;
6129 }
6130 }
6131 #endif
6132 }
6133
mbedtls_ssl_session_free(mbedtls_ssl_session * session)6134 void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
6135 {
6136 if( session == NULL )
6137 return;
6138
6139 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6140 ssl_clear_peer_cert( session );
6141 #endif
6142
6143 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
6144 mbedtls_free( session->ticket );
6145 #endif
6146
6147 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
6148 }
6149
6150 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
6151
6152 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6153 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
6154 #else
6155 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
6156 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6157
6158 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
6159 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
6160 #else
6161 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 0u
6162 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
6163
6164 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6165 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
6166 #else
6167 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
6168 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6169
6170 #if defined(MBEDTLS_SSL_ALPN)
6171 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
6172 #else
6173 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
6174 #endif /* MBEDTLS_SSL_ALPN */
6175
6176 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
6177 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
6178 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
6179 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
6180
6181 #define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
6182 ( (uint32_t) ( \
6183 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
6184 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
6185 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
6186 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
6187 0u ) )
6188
6189 static unsigned char ssl_serialized_context_header[] = {
6190 MBEDTLS_VERSION_MAJOR,
6191 MBEDTLS_VERSION_MINOR,
6192 MBEDTLS_VERSION_PATCH,
6193 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
6194 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
6195 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 16 ) & 0xFF,
6196 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 8 ) & 0xFF,
6197 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 0 ) & 0xFF,
6198 };
6199
6200 /*
6201 * Serialize a full SSL context
6202 *
6203 * The format of the serialized data is:
6204 * (in the presentation language of TLS, RFC 8446 section 3)
6205 *
6206 * // header
6207 * opaque mbedtls_version[3]; // major, minor, patch
6208 * opaque context_format[5]; // version-specific field determining
6209 * // the format of the remaining
6210 * // serialized data.
6211 * Note: When updating the format, remember to keep these
6212 * version+format bytes. (We may make their size part of the API.)
6213 *
6214 * // session sub-structure
6215 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
6216 * // transform sub-structure
6217 * uint8 random[64]; // ServerHello.random+ClientHello.random
6218 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
6219 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
6220 * // fields from ssl_context
6221 * uint32 badmac_seen; // DTLS: number of records with failing MAC
6222 * uint64 in_window_top; // DTLS: last validated record seq_num
6223 * uint64 in_window; // DTLS: bitmask for replay protection
6224 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
6225 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
6226 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
6227 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
6228 *
6229 * Note that many fields of the ssl_context or sub-structures are not
6230 * serialized, as they fall in one of the following categories:
6231 *
6232 * 1. forced value (eg in_left must be 0)
6233 * 2. pointer to dynamically-allocated memory (eg session, transform)
6234 * 3. value can be re-derived from other data (eg session keys from MS)
6235 * 4. value was temporary (eg content of input buffer)
6236 * 5. value will be provided by the user again (eg I/O callbacks and context)
6237 */
mbedtls_ssl_context_save(mbedtls_ssl_context * ssl,unsigned char * buf,size_t buf_len,size_t * olen)6238 int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
6239 unsigned char *buf,
6240 size_t buf_len,
6241 size_t *olen )
6242 {
6243 unsigned char *p = buf;
6244 size_t used = 0;
6245 size_t session_len;
6246 int ret = 0;
6247
6248 /*
6249 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
6250 * this function's documentation.
6251 *
6252 * These are due to assumptions/limitations in the implementation. Some of
6253 * them are likely to stay (no handshake in progress) some might go away
6254 * (only DTLS) but are currently used to simplify the implementation.
6255 */
6256 /* The initial handshake must be over */
6257 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
6258 {
6259 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
6260 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6261 }
6262 if( ssl->handshake != NULL )
6263 {
6264 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
6265 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6266 }
6267 /* Double-check that sub-structures are indeed ready */
6268 if( ssl->transform == NULL || ssl->session == NULL )
6269 {
6270 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
6271 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6272 }
6273 /* There must be no pending incoming or outgoing data */
6274 if( mbedtls_ssl_check_pending( ssl ) != 0 )
6275 {
6276 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
6277 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6278 }
6279 if( ssl->out_left != 0 )
6280 {
6281 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
6282 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6283 }
6284 /* Protocol must be DLTS, not TLS */
6285 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6286 {
6287 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
6288 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6289 }
6290 /* Version must be 1.2 */
6291 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
6292 {
6293 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
6294 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6295 }
6296 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
6297 {
6298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
6299 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6300 }
6301 /* We must be using an AEAD ciphersuite */
6302 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
6303 {
6304 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
6305 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6306 }
6307 /* Renegotiation must not be enabled */
6308 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6309 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
6310 {
6311 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
6312 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6313 }
6314 #endif
6315
6316 /*
6317 * Version and format identifier
6318 */
6319 used += sizeof( ssl_serialized_context_header );
6320
6321 if( used <= buf_len )
6322 {
6323 memcpy( p, ssl_serialized_context_header,
6324 sizeof( ssl_serialized_context_header ) );
6325 p += sizeof( ssl_serialized_context_header );
6326 }
6327
6328 /*
6329 * Session (length + data)
6330 */
6331 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
6332 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
6333 return( ret );
6334
6335 used += 4 + session_len;
6336 if( used <= buf_len )
6337 {
6338 *p++ = (unsigned char)( ( session_len >> 24 ) & 0xFF );
6339 *p++ = (unsigned char)( ( session_len >> 16 ) & 0xFF );
6340 *p++ = (unsigned char)( ( session_len >> 8 ) & 0xFF );
6341 *p++ = (unsigned char)( ( session_len ) & 0xFF );
6342
6343 ret = ssl_session_save( ssl->session, 1,
6344 p, session_len, &session_len );
6345 if( ret != 0 )
6346 return( ret );
6347
6348 p += session_len;
6349 }
6350
6351 /*
6352 * Transform
6353 */
6354 used += sizeof( ssl->transform->randbytes );
6355 if( used <= buf_len )
6356 {
6357 memcpy( p, ssl->transform->randbytes,
6358 sizeof( ssl->transform->randbytes ) );
6359 p += sizeof( ssl->transform->randbytes );
6360 }
6361
6362 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6363 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
6364 if( used <= buf_len )
6365 {
6366 *p++ = ssl->transform->in_cid_len;
6367 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
6368 p += ssl->transform->in_cid_len;
6369
6370 *p++ = ssl->transform->out_cid_len;
6371 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
6372 p += ssl->transform->out_cid_len;
6373 }
6374 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6375
6376 /*
6377 * Saved fields from top-level ssl_context structure
6378 */
6379 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
6380 used += 4;
6381 if( used <= buf_len )
6382 {
6383 *p++ = (unsigned char)( ( ssl->badmac_seen >> 24 ) & 0xFF );
6384 *p++ = (unsigned char)( ( ssl->badmac_seen >> 16 ) & 0xFF );
6385 *p++ = (unsigned char)( ( ssl->badmac_seen >> 8 ) & 0xFF );
6386 *p++ = (unsigned char)( ( ssl->badmac_seen ) & 0xFF );
6387 }
6388 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
6389
6390 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6391 used += 16;
6392 if( used <= buf_len )
6393 {
6394 *p++ = (unsigned char)( ( ssl->in_window_top >> 56 ) & 0xFF );
6395 *p++ = (unsigned char)( ( ssl->in_window_top >> 48 ) & 0xFF );
6396 *p++ = (unsigned char)( ( ssl->in_window_top >> 40 ) & 0xFF );
6397 *p++ = (unsigned char)( ( ssl->in_window_top >> 32 ) & 0xFF );
6398 *p++ = (unsigned char)( ( ssl->in_window_top >> 24 ) & 0xFF );
6399 *p++ = (unsigned char)( ( ssl->in_window_top >> 16 ) & 0xFF );
6400 *p++ = (unsigned char)( ( ssl->in_window_top >> 8 ) & 0xFF );
6401 *p++ = (unsigned char)( ( ssl->in_window_top ) & 0xFF );
6402
6403 *p++ = (unsigned char)( ( ssl->in_window >> 56 ) & 0xFF );
6404 *p++ = (unsigned char)( ( ssl->in_window >> 48 ) & 0xFF );
6405 *p++ = (unsigned char)( ( ssl->in_window >> 40 ) & 0xFF );
6406 *p++ = (unsigned char)( ( ssl->in_window >> 32 ) & 0xFF );
6407 *p++ = (unsigned char)( ( ssl->in_window >> 24 ) & 0xFF );
6408 *p++ = (unsigned char)( ( ssl->in_window >> 16 ) & 0xFF );
6409 *p++ = (unsigned char)( ( ssl->in_window >> 8 ) & 0xFF );
6410 *p++ = (unsigned char)( ( ssl->in_window ) & 0xFF );
6411 }
6412 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6413
6414 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6415 used += 1;
6416 if( used <= buf_len )
6417 {
6418 *p++ = ssl->disable_datagram_packing;
6419 }
6420 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6421
6422 used += 8;
6423 if( used <= buf_len )
6424 {
6425 memcpy( p, ssl->cur_out_ctr, 8 );
6426 p += 8;
6427 }
6428
6429 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6430 used += 2;
6431 if( used <= buf_len )
6432 {
6433 *p++ = (unsigned char)( ( ssl->mtu >> 8 ) & 0xFF );
6434 *p++ = (unsigned char)( ( ssl->mtu ) & 0xFF );
6435 }
6436 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6437
6438 #if defined(MBEDTLS_SSL_ALPN)
6439 {
6440 const uint8_t alpn_len = ssl->alpn_chosen
6441 ? (uint8_t) strlen( ssl->alpn_chosen )
6442 : 0;
6443
6444 used += 1 + alpn_len;
6445 if( used <= buf_len )
6446 {
6447 *p++ = alpn_len;
6448
6449 if( ssl->alpn_chosen != NULL )
6450 {
6451 memcpy( p, ssl->alpn_chosen, alpn_len );
6452 p += alpn_len;
6453 }
6454 }
6455 }
6456 #endif /* MBEDTLS_SSL_ALPN */
6457
6458 /*
6459 * Done
6460 */
6461 *olen = used;
6462
6463 if( used > buf_len )
6464 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
6465
6466 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
6467
6468 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
6469 }
6470
6471 /*
6472 * Helper to get TLS 1.2 PRF from ciphersuite
6473 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
6474 */
6475 typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
6476 const char *label,
6477 const unsigned char *random, size_t rlen,
6478 unsigned char *dstbuf, size_t dlen );
ssl_tls12prf_from_cs(int ciphersuite_id)6479 static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
6480 {
6481 #if defined(MBEDTLS_SHA512_C)
6482 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
6483 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
6484
6485 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
6486 return( tls_prf_sha384 );
6487 #else
6488 (void) ciphersuite_id;
6489 #endif
6490 return( tls_prf_sha256 );
6491 }
6492
6493 /*
6494 * Deserialize context, see mbedtls_ssl_context_save() for format.
6495 *
6496 * This internal version is wrapped by a public function that cleans up in
6497 * case of error.
6498 */
ssl_context_load(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)6499 static int ssl_context_load( mbedtls_ssl_context *ssl,
6500 const unsigned char *buf,
6501 size_t len )
6502 {
6503 const unsigned char *p = buf;
6504 const unsigned char * const end = buf + len;
6505 size_t session_len;
6506 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6507
6508 /*
6509 * The context should have been freshly setup or reset.
6510 * Give the user an error in case of obvious misuse.
6511 * (Checking session is useful because it won't be NULL if we're
6512 * renegotiating, or if the user mistakenly loaded a session first.)
6513 */
6514 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
6515 ssl->session != NULL )
6516 {
6517 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6518 }
6519
6520 /*
6521 * We can't check that the config matches the initial one, but we can at
6522 * least check it matches the requirements for serializing.
6523 */
6524 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
6525 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
6526 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 ||
6527 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ||
6528 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 ||
6529 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6530 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
6531 #endif
6532 0 )
6533 {
6534 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6535 }
6536
6537 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
6538
6539 /*
6540 * Check version identifier
6541 */
6542 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
6543 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6544
6545 if( memcmp( p, ssl_serialized_context_header,
6546 sizeof( ssl_serialized_context_header ) ) != 0 )
6547 {
6548 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
6549 }
6550 p += sizeof( ssl_serialized_context_header );
6551
6552 /*
6553 * Session
6554 */
6555 if( (size_t)( end - p ) < 4 )
6556 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6557
6558 session_len = ( (size_t) p[0] << 24 ) |
6559 ( (size_t) p[1] << 16 ) |
6560 ( (size_t) p[2] << 8 ) |
6561 ( (size_t) p[3] );
6562 p += 4;
6563
6564 /* This has been allocated by ssl_handshake_init(), called by
6565 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
6566 ssl->session = ssl->session_negotiate;
6567 ssl->session_in = ssl->session;
6568 ssl->session_out = ssl->session;
6569 ssl->session_negotiate = NULL;
6570
6571 if( (size_t)( end - p ) < session_len )
6572 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6573
6574 ret = ssl_session_load( ssl->session, 1, p, session_len );
6575 if( ret != 0 )
6576 {
6577 mbedtls_ssl_session_free( ssl->session );
6578 return( ret );
6579 }
6580
6581 p += session_len;
6582
6583 /*
6584 * Transform
6585 */
6586
6587 /* This has been allocated by ssl_handshake_init(), called by
6588 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
6589 ssl->transform = ssl->transform_negotiate;
6590 ssl->transform_in = ssl->transform;
6591 ssl->transform_out = ssl->transform;
6592 ssl->transform_negotiate = NULL;
6593
6594 /* Read random bytes and populate structure */
6595 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
6596 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6597
6598 ret = ssl_populate_transform( ssl->transform,
6599 ssl->session->ciphersuite,
6600 ssl->session->master,
6601 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
6602 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6603 ssl->session->encrypt_then_mac,
6604 #endif
6605 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
6606 ssl->session->trunc_hmac,
6607 #endif
6608 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
6609 #if defined(MBEDTLS_ZLIB_SUPPORT)
6610 ssl->session->compression,
6611 #endif
6612 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
6613 p, /* currently pointing to randbytes */
6614 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
6615 ssl->conf->endpoint,
6616 ssl );
6617 if( ret != 0 )
6618 return( ret );
6619
6620 p += sizeof( ssl->transform->randbytes );
6621
6622 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6623 /* Read connection IDs and store them */
6624 if( (size_t)( end - p ) < 1 )
6625 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6626
6627 ssl->transform->in_cid_len = *p++;
6628
6629 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
6630 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6631
6632 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
6633 p += ssl->transform->in_cid_len;
6634
6635 ssl->transform->out_cid_len = *p++;
6636
6637 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
6638 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6639
6640 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
6641 p += ssl->transform->out_cid_len;
6642 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6643
6644 /*
6645 * Saved fields from top-level ssl_context structure
6646 */
6647 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
6648 if( (size_t)( end - p ) < 4 )
6649 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6650
6651 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
6652 ( (uint32_t) p[1] << 16 ) |
6653 ( (uint32_t) p[2] << 8 ) |
6654 ( (uint32_t) p[3] );
6655 p += 4;
6656 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
6657
6658 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6659 if( (size_t)( end - p ) < 16 )
6660 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6661
6662 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
6663 ( (uint64_t) p[1] << 48 ) |
6664 ( (uint64_t) p[2] << 40 ) |
6665 ( (uint64_t) p[3] << 32 ) |
6666 ( (uint64_t) p[4] << 24 ) |
6667 ( (uint64_t) p[5] << 16 ) |
6668 ( (uint64_t) p[6] << 8 ) |
6669 ( (uint64_t) p[7] );
6670 p += 8;
6671
6672 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
6673 ( (uint64_t) p[1] << 48 ) |
6674 ( (uint64_t) p[2] << 40 ) |
6675 ( (uint64_t) p[3] << 32 ) |
6676 ( (uint64_t) p[4] << 24 ) |
6677 ( (uint64_t) p[5] << 16 ) |
6678 ( (uint64_t) p[6] << 8 ) |
6679 ( (uint64_t) p[7] );
6680 p += 8;
6681 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6682
6683 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6684 if( (size_t)( end - p ) < 1 )
6685 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6686
6687 ssl->disable_datagram_packing = *p++;
6688 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6689
6690 if( (size_t)( end - p ) < 8 )
6691 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6692
6693 memcpy( ssl->cur_out_ctr, p, 8 );
6694 p += 8;
6695
6696 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6697 if( (size_t)( end - p ) < 2 )
6698 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6699
6700 ssl->mtu = ( p[0] << 8 ) | p[1];
6701 p += 2;
6702 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6703
6704 #if defined(MBEDTLS_SSL_ALPN)
6705 {
6706 uint8_t alpn_len;
6707 const char **cur;
6708
6709 if( (size_t)( end - p ) < 1 )
6710 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6711
6712 alpn_len = *p++;
6713
6714 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
6715 {
6716 /* alpn_chosen should point to an item in the configured list */
6717 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
6718 {
6719 if( strlen( *cur ) == alpn_len &&
6720 memcmp( p, cur, alpn_len ) == 0 )
6721 {
6722 ssl->alpn_chosen = *cur;
6723 break;
6724 }
6725 }
6726 }
6727
6728 /* can only happen on conf mismatch */
6729 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
6730 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6731
6732 p += alpn_len;
6733 }
6734 #endif /* MBEDTLS_SSL_ALPN */
6735
6736 /*
6737 * Forced fields from top-level ssl_context structure
6738 *
6739 * Most of them already set to the correct value by mbedtls_ssl_init() and
6740 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
6741 */
6742 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
6743
6744 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6745 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6746
6747 /* Adjust pointers for header fields of outgoing records to
6748 * the given transform, accounting for explicit IV and CID. */
6749 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
6750
6751 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6752 ssl->in_epoch = 1;
6753 #endif
6754
6755 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
6756 * which we don't want - otherwise we'd end up freeing the wrong transform
6757 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
6758 * inappropriately. */
6759 if( ssl->handshake != NULL )
6760 {
6761 mbedtls_ssl_handshake_free( ssl );
6762 mbedtls_free( ssl->handshake );
6763 ssl->handshake = NULL;
6764 }
6765
6766 /*
6767 * Done - should have consumed entire buffer
6768 */
6769 if( p != end )
6770 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6771
6772 return( 0 );
6773 }
6774
6775 /*
6776 * Deserialize context: public wrapper for error cleaning
6777 */
mbedtls_ssl_context_load(mbedtls_ssl_context * context,const unsigned char * buf,size_t len)6778 int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
6779 const unsigned char *buf,
6780 size_t len )
6781 {
6782 int ret = ssl_context_load( context, buf, len );
6783
6784 if( ret != 0 )
6785 mbedtls_ssl_free( context );
6786
6787 return( ret );
6788 }
6789 #endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
6790
6791 /*
6792 * Free an SSL context
6793 */
mbedtls_ssl_free(mbedtls_ssl_context * ssl)6794 void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
6795 {
6796 if( ssl == NULL )
6797 return;
6798
6799 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
6800
6801 if( ssl->out_buf != NULL )
6802 {
6803 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6804 size_t out_buf_len = ssl->out_buf_len;
6805 #else
6806 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
6807 #endif
6808
6809 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
6810 mbedtls_free( ssl->out_buf );
6811 ssl->out_buf = NULL;
6812 }
6813
6814 if( ssl->in_buf != NULL )
6815 {
6816 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6817 size_t in_buf_len = ssl->in_buf_len;
6818 #else
6819 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6820 #endif
6821
6822 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
6823 mbedtls_free( ssl->in_buf );
6824 ssl->in_buf = NULL;
6825 }
6826
6827 #if defined(MBEDTLS_ZLIB_SUPPORT)
6828 if( ssl->compress_buf != NULL )
6829 {
6830 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
6831 mbedtls_free( ssl->compress_buf );
6832 }
6833 #endif
6834
6835 if( ssl->transform )
6836 {
6837 mbedtls_ssl_transform_free( ssl->transform );
6838 mbedtls_free( ssl->transform );
6839 }
6840
6841 if( ssl->handshake )
6842 {
6843 mbedtls_ssl_handshake_free( ssl );
6844 mbedtls_ssl_transform_free( ssl->transform_negotiate );
6845 mbedtls_ssl_session_free( ssl->session_negotiate );
6846
6847 mbedtls_free( ssl->handshake );
6848 mbedtls_free( ssl->transform_negotiate );
6849 mbedtls_free( ssl->session_negotiate );
6850 }
6851
6852 if( ssl->session )
6853 {
6854 mbedtls_ssl_session_free( ssl->session );
6855 mbedtls_free( ssl->session );
6856 }
6857
6858 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6859 if( ssl->hostname != NULL )
6860 {
6861 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
6862 mbedtls_free( ssl->hostname );
6863 }
6864 #endif
6865
6866 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
6867 if( mbedtls_ssl_hw_record_finish != NULL )
6868 {
6869 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
6870 mbedtls_ssl_hw_record_finish( ssl );
6871 }
6872 #endif
6873
6874 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6875 mbedtls_free( ssl->cli_id );
6876 #endif
6877
6878 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
6879
6880 /* Actually clear after last debug message */
6881 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
6882 }
6883
6884 /*
6885 * Initialze mbedtls_ssl_config
6886 */
mbedtls_ssl_config_init(mbedtls_ssl_config * conf)6887 void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
6888 {
6889 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
6890 }
6891
6892 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6893 static int ssl_preset_default_hashes[] = {
6894 #if defined(MBEDTLS_SHA512_C)
6895 MBEDTLS_MD_SHA512,
6896 MBEDTLS_MD_SHA384,
6897 #endif
6898 #if defined(MBEDTLS_SHA256_C)
6899 MBEDTLS_MD_SHA256,
6900 MBEDTLS_MD_SHA224,
6901 #endif
6902 #if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
6903 MBEDTLS_MD_SHA1,
6904 #endif
6905 MBEDTLS_MD_NONE
6906 };
6907 #endif
6908
6909 static int ssl_preset_suiteb_ciphersuites[] = {
6910 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
6911 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
6912 0
6913 };
6914
6915 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6916 static int ssl_preset_suiteb_hashes[] = {
6917 MBEDTLS_MD_SHA256,
6918 MBEDTLS_MD_SHA384,
6919 MBEDTLS_MD_NONE
6920 };
6921 #endif
6922
6923 #if defined(MBEDTLS_ECP_C)
6924 static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
6925 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6926 MBEDTLS_ECP_DP_SECP256R1,
6927 #endif
6928 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6929 MBEDTLS_ECP_DP_SECP384R1,
6930 #endif
6931 MBEDTLS_ECP_DP_NONE
6932 };
6933 #endif
6934
6935 /*
6936 * Load default in mbedtls_ssl_config
6937 */
mbedtls_ssl_config_defaults(mbedtls_ssl_config * conf,int endpoint,int transport,int preset)6938 int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
6939 int endpoint, int transport, int preset )
6940 {
6941 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
6942 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6943 #endif
6944
6945 /* Use the functions here so that they are covered in tests,
6946 * but otherwise access member directly for efficiency */
6947 mbedtls_ssl_conf_endpoint( conf, endpoint );
6948 mbedtls_ssl_conf_transport( conf, transport );
6949
6950 /*
6951 * Things that are common to all presets
6952 */
6953 #if defined(MBEDTLS_SSL_CLI_C)
6954 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
6955 {
6956 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
6957 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
6958 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
6959 #endif
6960 }
6961 #endif
6962
6963 #if defined(MBEDTLS_ARC4_C)
6964 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
6965 #endif
6966
6967 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6968 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
6969 #endif
6970
6971 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6972 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
6973 #endif
6974
6975 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
6976 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
6977 #endif
6978
6979 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6980 conf->f_cookie_write = ssl_cookie_write_dummy;
6981 conf->f_cookie_check = ssl_cookie_check_dummy;
6982 #endif
6983
6984 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6985 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
6986 #endif
6987
6988 #if defined(MBEDTLS_SSL_SRV_C)
6989 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
6990 #endif
6991
6992 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6993 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
6994 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
6995 #endif
6996
6997 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6998 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
6999 memset( conf->renego_period, 0x00, 2 );
7000 memset( conf->renego_period + 2, 0xFF, 6 );
7001 #endif
7002
7003 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
7004 if( endpoint == MBEDTLS_SSL_IS_SERVER )
7005 {
7006 const unsigned char dhm_p[] =
7007 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
7008 const unsigned char dhm_g[] =
7009 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
7010
7011 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
7012 dhm_p, sizeof( dhm_p ),
7013 dhm_g, sizeof( dhm_g ) ) ) != 0 )
7014 {
7015 return( ret );
7016 }
7017 }
7018 #endif
7019
7020 /*
7021 * Preset-specific defaults
7022 */
7023 switch( preset )
7024 {
7025 /*
7026 * NSA Suite B
7027 */
7028 case MBEDTLS_SSL_PRESET_SUITEB:
7029 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
7030 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
7031 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
7032 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
7033
7034 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
7035 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
7036 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
7037 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
7038 ssl_preset_suiteb_ciphersuites;
7039
7040 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7041 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
7042 #endif
7043
7044 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7045 conf->sig_hashes = ssl_preset_suiteb_hashes;
7046 #endif
7047
7048 #if defined(MBEDTLS_ECP_C)
7049 conf->curve_list = ssl_preset_suiteb_curves;
7050 #endif
7051 break;
7052
7053 /*
7054 * Default
7055 */
7056 default:
7057 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
7058 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
7059 MBEDTLS_SSL_MIN_MAJOR_VERSION :
7060 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
7061 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
7062 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
7063 MBEDTLS_SSL_MIN_MINOR_VERSION :
7064 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
7065 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
7066 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
7067
7068 #if defined(MBEDTLS_SSL_PROTO_DTLS)
7069 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7070 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
7071 #endif
7072
7073 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
7074 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
7075 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
7076 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
7077 mbedtls_ssl_list_ciphersuites();
7078
7079 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7080 conf->cert_profile = &mbedtls_x509_crt_profile_default;
7081 #endif
7082
7083 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7084 conf->sig_hashes = ssl_preset_default_hashes;
7085 #endif
7086
7087 #if defined(MBEDTLS_ECP_C)
7088 conf->curve_list = mbedtls_ecp_grp_id_list();
7089 #endif
7090
7091 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
7092 conf->dhm_min_bitlen = 1024;
7093 #endif
7094 }
7095
7096 return( 0 );
7097 }
7098
7099 /*
7100 * Free mbedtls_ssl_config
7101 */
mbedtls_ssl_config_free(mbedtls_ssl_config * conf)7102 void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
7103 {
7104 #if defined(MBEDTLS_DHM_C)
7105 mbedtls_mpi_free( &conf->dhm_P );
7106 mbedtls_mpi_free( &conf->dhm_G );
7107 #endif
7108
7109 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
7110 if( conf->psk != NULL )
7111 {
7112 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
7113 mbedtls_free( conf->psk );
7114 conf->psk = NULL;
7115 conf->psk_len = 0;
7116 }
7117
7118 if( conf->psk_identity != NULL )
7119 {
7120 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
7121 mbedtls_free( conf->psk_identity );
7122 conf->psk_identity = NULL;
7123 conf->psk_identity_len = 0;
7124 }
7125 #endif
7126
7127 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7128 ssl_key_cert_free( conf->key_cert );
7129 #endif
7130
7131 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
7132 }
7133
7134 #if defined(MBEDTLS_PK_C) && \
7135 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
7136 /*
7137 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
7138 */
mbedtls_ssl_sig_from_pk(mbedtls_pk_context * pk)7139 unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
7140 {
7141 #if defined(MBEDTLS_RSA_C)
7142 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
7143 return( MBEDTLS_SSL_SIG_RSA );
7144 #endif
7145 #if defined(MBEDTLS_ECDSA_C)
7146 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
7147 return( MBEDTLS_SSL_SIG_ECDSA );
7148 #endif
7149 return( MBEDTLS_SSL_SIG_ANON );
7150 }
7151
mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type)7152 unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
7153 {
7154 switch( type ) {
7155 case MBEDTLS_PK_RSA:
7156 return( MBEDTLS_SSL_SIG_RSA );
7157 case MBEDTLS_PK_ECDSA:
7158 case MBEDTLS_PK_ECKEY:
7159 return( MBEDTLS_SSL_SIG_ECDSA );
7160 default:
7161 return( MBEDTLS_SSL_SIG_ANON );
7162 }
7163 }
7164
mbedtls_ssl_pk_alg_from_sig(unsigned char sig)7165 mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
7166 {
7167 switch( sig )
7168 {
7169 #if defined(MBEDTLS_RSA_C)
7170 case MBEDTLS_SSL_SIG_RSA:
7171 return( MBEDTLS_PK_RSA );
7172 #endif
7173 #if defined(MBEDTLS_ECDSA_C)
7174 case MBEDTLS_SSL_SIG_ECDSA:
7175 return( MBEDTLS_PK_ECDSA );
7176 #endif
7177 default:
7178 return( MBEDTLS_PK_NONE );
7179 }
7180 }
7181 #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
7182
7183 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
7184 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7185
7186 /* Find an entry in a signature-hash set matching a given hash algorithm. */
mbedtls_ssl_sig_hash_set_find(mbedtls_ssl_sig_hash_set_t * set,mbedtls_pk_type_t sig_alg)7187 mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
7188 mbedtls_pk_type_t sig_alg )
7189 {
7190 switch( sig_alg )
7191 {
7192 case MBEDTLS_PK_RSA:
7193 return( set->rsa );
7194 case MBEDTLS_PK_ECDSA:
7195 return( set->ecdsa );
7196 default:
7197 return( MBEDTLS_MD_NONE );
7198 }
7199 }
7200
7201 /* Add a signature-hash-pair to a signature-hash set */
mbedtls_ssl_sig_hash_set_add(mbedtls_ssl_sig_hash_set_t * set,mbedtls_pk_type_t sig_alg,mbedtls_md_type_t md_alg)7202 void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
7203 mbedtls_pk_type_t sig_alg,
7204 mbedtls_md_type_t md_alg )
7205 {
7206 switch( sig_alg )
7207 {
7208 case MBEDTLS_PK_RSA:
7209 if( set->rsa == MBEDTLS_MD_NONE )
7210 set->rsa = md_alg;
7211 break;
7212
7213 case MBEDTLS_PK_ECDSA:
7214 if( set->ecdsa == MBEDTLS_MD_NONE )
7215 set->ecdsa = md_alg;
7216 break;
7217
7218 default:
7219 break;
7220 }
7221 }
7222
7223 /* Allow exactly one hash algorithm for each signature. */
mbedtls_ssl_sig_hash_set_const_hash(mbedtls_ssl_sig_hash_set_t * set,mbedtls_md_type_t md_alg)7224 void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
7225 mbedtls_md_type_t md_alg )
7226 {
7227 set->rsa = md_alg;
7228 set->ecdsa = md_alg;
7229 }
7230
7231 #endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
7232 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7233
7234 /*
7235 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
7236 */
mbedtls_ssl_md_alg_from_hash(unsigned char hash)7237 mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
7238 {
7239 switch( hash )
7240 {
7241 #if defined(MBEDTLS_MD5_C)
7242 case MBEDTLS_SSL_HASH_MD5:
7243 return( MBEDTLS_MD_MD5 );
7244 #endif
7245 #if defined(MBEDTLS_SHA1_C)
7246 case MBEDTLS_SSL_HASH_SHA1:
7247 return( MBEDTLS_MD_SHA1 );
7248 #endif
7249 #if defined(MBEDTLS_SHA256_C)
7250 case MBEDTLS_SSL_HASH_SHA224:
7251 return( MBEDTLS_MD_SHA224 );
7252 case MBEDTLS_SSL_HASH_SHA256:
7253 return( MBEDTLS_MD_SHA256 );
7254 #endif
7255 #if defined(MBEDTLS_SHA512_C)
7256 case MBEDTLS_SSL_HASH_SHA384:
7257 return( MBEDTLS_MD_SHA384 );
7258 case MBEDTLS_SSL_HASH_SHA512:
7259 return( MBEDTLS_MD_SHA512 );
7260 #endif
7261 default:
7262 return( MBEDTLS_MD_NONE );
7263 }
7264 }
7265
7266 /*
7267 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
7268 */
mbedtls_ssl_hash_from_md_alg(int md)7269 unsigned char mbedtls_ssl_hash_from_md_alg( int md )
7270 {
7271 switch( md )
7272 {
7273 #if defined(MBEDTLS_MD5_C)
7274 case MBEDTLS_MD_MD5:
7275 return( MBEDTLS_SSL_HASH_MD5 );
7276 #endif
7277 #if defined(MBEDTLS_SHA1_C)
7278 case MBEDTLS_MD_SHA1:
7279 return( MBEDTLS_SSL_HASH_SHA1 );
7280 #endif
7281 #if defined(MBEDTLS_SHA256_C)
7282 case MBEDTLS_MD_SHA224:
7283 return( MBEDTLS_SSL_HASH_SHA224 );
7284 case MBEDTLS_MD_SHA256:
7285 return( MBEDTLS_SSL_HASH_SHA256 );
7286 #endif
7287 #if defined(MBEDTLS_SHA512_C)
7288 case MBEDTLS_MD_SHA384:
7289 return( MBEDTLS_SSL_HASH_SHA384 );
7290 case MBEDTLS_MD_SHA512:
7291 return( MBEDTLS_SSL_HASH_SHA512 );
7292 #endif
7293 default:
7294 return( MBEDTLS_SSL_HASH_NONE );
7295 }
7296 }
7297
7298 #if defined(MBEDTLS_ECP_C)
7299 /*
7300 * Check if a curve proposed by the peer is in our list.
7301 * Return 0 if we're willing to use it, -1 otherwise.
7302 */
mbedtls_ssl_check_curve(const mbedtls_ssl_context * ssl,mbedtls_ecp_group_id grp_id)7303 int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
7304 {
7305 const mbedtls_ecp_group_id *gid;
7306
7307 if( ssl->conf->curve_list == NULL )
7308 return( -1 );
7309
7310 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
7311 if( *gid == grp_id )
7312 return( 0 );
7313
7314 return( -1 );
7315 }
7316 #endif /* MBEDTLS_ECP_C */
7317
7318 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7319 /*
7320 * Check if a hash proposed by the peer is in our list.
7321 * Return 0 if we're willing to use it, -1 otherwise.
7322 */
mbedtls_ssl_check_sig_hash(const mbedtls_ssl_context * ssl,mbedtls_md_type_t md)7323 int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
7324 mbedtls_md_type_t md )
7325 {
7326 const int *cur;
7327
7328 if( ssl->conf->sig_hashes == NULL )
7329 return( -1 );
7330
7331 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
7332 if( *cur == (int) md )
7333 return( 0 );
7334
7335 return( -1 );
7336 }
7337 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7338
7339 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt * cert,const mbedtls_ssl_ciphersuite_t * ciphersuite,int cert_endpoint,uint32_t * flags)7340 int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
7341 const mbedtls_ssl_ciphersuite_t *ciphersuite,
7342 int cert_endpoint,
7343 uint32_t *flags )
7344 {
7345 int ret = 0;
7346 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
7347 int usage = 0;
7348 #endif
7349 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
7350 const char *ext_oid;
7351 size_t ext_len;
7352 #endif
7353
7354 #if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
7355 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
7356 ((void) cert);
7357 ((void) cert_endpoint);
7358 ((void) flags);
7359 #endif
7360
7361 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
7362 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
7363 {
7364 /* Server part of the key exchange */
7365 switch( ciphersuite->key_exchange )
7366 {
7367 case MBEDTLS_KEY_EXCHANGE_RSA:
7368 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
7369 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
7370 break;
7371
7372 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
7373 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
7374 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
7375 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
7376 break;
7377
7378 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
7379 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
7380 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
7381 break;
7382
7383 /* Don't use default: we want warnings when adding new values */
7384 case MBEDTLS_KEY_EXCHANGE_NONE:
7385 case MBEDTLS_KEY_EXCHANGE_PSK:
7386 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
7387 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
7388 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
7389 usage = 0;
7390 }
7391 }
7392 else
7393 {
7394 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
7395 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
7396 }
7397
7398 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
7399 {
7400 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
7401 ret = -1;
7402 }
7403 #else
7404 ((void) ciphersuite);
7405 #endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
7406
7407 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
7408 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
7409 {
7410 ext_oid = MBEDTLS_OID_SERVER_AUTH;
7411 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
7412 }
7413 else
7414 {
7415 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
7416 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
7417 }
7418
7419 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
7420 {
7421 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
7422 ret = -1;
7423 }
7424 #endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
7425
7426 return( ret );
7427 }
7428 #endif /* MBEDTLS_X509_CRT_PARSE_C */
7429
mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context * ssl,int md)7430 int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
7431 {
7432 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
7433 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
7434 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
7435
7436 switch( md )
7437 {
7438 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
7439 #if defined(MBEDTLS_MD5_C)
7440 case MBEDTLS_SSL_HASH_MD5:
7441 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
7442 #endif
7443 #if defined(MBEDTLS_SHA1_C)
7444 case MBEDTLS_SSL_HASH_SHA1:
7445 ssl->handshake->calc_verify = ssl_calc_verify_tls;
7446 break;
7447 #endif
7448 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
7449 #if defined(MBEDTLS_SHA512_C)
7450 case MBEDTLS_SSL_HASH_SHA384:
7451 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
7452 break;
7453 #endif
7454 #if defined(MBEDTLS_SHA256_C)
7455 case MBEDTLS_SSL_HASH_SHA256:
7456 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
7457 break;
7458 #endif
7459 default:
7460 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
7461 }
7462
7463 return 0;
7464 #else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
7465 (void) ssl;
7466 (void) md;
7467
7468 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
7469 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7470 }
7471
7472 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
7473 defined(MBEDTLS_SSL_PROTO_TLS1_1)
mbedtls_ssl_get_key_exchange_md_ssl_tls(mbedtls_ssl_context * ssl,unsigned char * output,unsigned char * data,size_t data_len)7474 int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
7475 unsigned char *output,
7476 unsigned char *data, size_t data_len )
7477 {
7478 int ret = 0;
7479 mbedtls_md5_context mbedtls_md5;
7480 mbedtls_sha1_context mbedtls_sha1;
7481
7482 mbedtls_md5_init( &mbedtls_md5 );
7483 mbedtls_sha1_init( &mbedtls_sha1 );
7484
7485 /*
7486 * digitally-signed struct {
7487 * opaque md5_hash[16];
7488 * opaque sha_hash[20];
7489 * };
7490 *
7491 * md5_hash
7492 * MD5(ClientHello.random + ServerHello.random
7493 * + ServerParams);
7494 * sha_hash
7495 * SHA(ClientHello.random + ServerHello.random
7496 * + ServerParams);
7497 */
7498 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
7499 {
7500 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
7501 goto exit;
7502 }
7503 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
7504 ssl->handshake->randbytes, 64 ) ) != 0 )
7505 {
7506 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
7507 goto exit;
7508 }
7509 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
7510 {
7511 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
7512 goto exit;
7513 }
7514 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
7515 {
7516 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
7517 goto exit;
7518 }
7519
7520 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
7521 {
7522 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
7523 goto exit;
7524 }
7525 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
7526 ssl->handshake->randbytes, 64 ) ) != 0 )
7527 {
7528 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
7529 goto exit;
7530 }
7531 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
7532 data_len ) ) != 0 )
7533 {
7534 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
7535 goto exit;
7536 }
7537 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
7538 output + 16 ) ) != 0 )
7539 {
7540 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
7541 goto exit;
7542 }
7543
7544 exit:
7545 mbedtls_md5_free( &mbedtls_md5 );
7546 mbedtls_sha1_free( &mbedtls_sha1 );
7547
7548 if( ret != 0 )
7549 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7550 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7551
7552 return( ret );
7553
7554 }
7555 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
7556 MBEDTLS_SSL_PROTO_TLS1_1 */
7557
7558 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
7559 defined(MBEDTLS_SSL_PROTO_TLS1_2)
7560
7561 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hashlen,unsigned char * data,size_t data_len,mbedtls_md_type_t md_alg)7562 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7563 unsigned char *hash, size_t *hashlen,
7564 unsigned char *data, size_t data_len,
7565 mbedtls_md_type_t md_alg )
7566 {
7567 psa_status_t status;
7568 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
7569 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
7570
7571 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
7572
7573 if( ( status = psa_hash_setup( &hash_operation,
7574 hash_alg ) ) != PSA_SUCCESS )
7575 {
7576 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
7577 goto exit;
7578 }
7579
7580 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
7581 64 ) ) != PSA_SUCCESS )
7582 {
7583 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7584 goto exit;
7585 }
7586
7587 if( ( status = psa_hash_update( &hash_operation,
7588 data, data_len ) ) != PSA_SUCCESS )
7589 {
7590 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7591 goto exit;
7592 }
7593
7594 if( ( status = psa_hash_finish( &hash_operation, hash, MBEDTLS_MD_MAX_SIZE,
7595 hashlen ) ) != PSA_SUCCESS )
7596 {
7597 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
7598 goto exit;
7599 }
7600
7601 exit:
7602 if( status != PSA_SUCCESS )
7603 {
7604 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7605 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7606 switch( status )
7607 {
7608 case PSA_ERROR_NOT_SUPPORTED:
7609 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
7610 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
7611 case PSA_ERROR_BUFFER_TOO_SMALL:
7612 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7613 case PSA_ERROR_INSUFFICIENT_MEMORY:
7614 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7615 default:
7616 return( MBEDTLS_ERR_MD_HW_ACCEL_FAILED );
7617 }
7618 }
7619 return( 0 );
7620 }
7621
7622 #else
7623
mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hashlen,unsigned char * data,size_t data_len,mbedtls_md_type_t md_alg)7624 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7625 unsigned char *hash, size_t *hashlen,
7626 unsigned char *data, size_t data_len,
7627 mbedtls_md_type_t md_alg )
7628 {
7629 int ret = 0;
7630 mbedtls_md_context_t ctx;
7631 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
7632 *hashlen = mbedtls_md_get_size( md_info );
7633
7634 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
7635
7636 mbedtls_md_init( &ctx );
7637
7638 /*
7639 * digitally-signed struct {
7640 * opaque client_random[32];
7641 * opaque server_random[32];
7642 * ServerDHParams params;
7643 * };
7644 */
7645 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7646 {
7647 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7648 goto exit;
7649 }
7650 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7651 {
7652 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7653 goto exit;
7654 }
7655 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7656 {
7657 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7658 goto exit;
7659 }
7660 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7661 {
7662 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7663 goto exit;
7664 }
7665 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
7666 {
7667 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7668 goto exit;
7669 }
7670
7671 exit:
7672 mbedtls_md_free( &ctx );
7673
7674 if( ret != 0 )
7675 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7676 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7677
7678 return( ret );
7679 }
7680 #endif /* MBEDTLS_USE_PSA_CRYPTO */
7681
7682 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
7683 MBEDTLS_SSL_PROTO_TLS1_2 */
7684
7685 #endif /* MBEDTLS_SSL_TLS_C */
7686
