1 /*
2 * SSLv3/TLSv1 shared functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19 /*
20 * The SSL 3.0 specification was drafted by Netscape in 1996,
21 * and became an IETF standard in 1999.
22 *
23 * http://wp.netscape.com/eng/ssl3/
24 * http://www.ietf.org/rfc/rfc2246.txt
25 * http://www.ietf.org/rfc/rfc4346.txt
26 */
27
28 #include "common.h"
29
30 #if defined(MBEDTLS_SSL_TLS_C)
31
32 #if defined(MBEDTLS_PLATFORM_C)
33 #include "mbedtls/platform.h"
34 #else
35 #include <stdlib.h>
36 #define mbedtls_calloc calloc
37 #define mbedtls_free free
38 #endif
39
40 #include "mbedtls/ssl.h"
41 #include "mbedtls/ssl_internal.h"
42 #include "mbedtls/debug.h"
43 #include "mbedtls/error.h"
44 #include "mbedtls/platform_util.h"
45 #include "mbedtls/version.h"
46 #include "mbedtls/constant_time.h"
47
48 #include <string.h>
49
50 #if defined(MBEDTLS_USE_PSA_CRYPTO)
51 #include "mbedtls/psa_util.h"
52 #include "psa/crypto.h"
53 #endif
54
55 #if defined(MBEDTLS_X509_CRT_PARSE_C)
56 #include "mbedtls/oid.h"
57 #endif
58
59 #if defined(MBEDTLS_SSL_PROTO_DTLS)
60
61 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
62 /* Top-level Connection ID API */
63
mbedtls_ssl_conf_cid(mbedtls_ssl_config * conf,size_t len,int ignore_other_cid)64 int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
65 size_t len,
66 int ignore_other_cid )
67 {
68 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
69 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
70
71 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
72 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
73 {
74 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
75 }
76
77 conf->ignore_unexpected_cid = ignore_other_cid;
78 conf->cid_len = len;
79 return( 0 );
80 }
81
mbedtls_ssl_set_cid(mbedtls_ssl_context * ssl,int enable,unsigned char const * own_cid,size_t own_cid_len)82 int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
83 int enable,
84 unsigned char const *own_cid,
85 size_t own_cid_len )
86 {
87 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
88 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
89
90 ssl->negotiate_cid = enable;
91 if( enable == MBEDTLS_SSL_CID_DISABLED )
92 {
93 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
94 return( 0 );
95 }
96 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
97 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
98
99 if( own_cid_len != ssl->conf->cid_len )
100 {
101 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
102 (unsigned) own_cid_len,
103 (unsigned) ssl->conf->cid_len ) );
104 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
105 }
106
107 memcpy( ssl->own_cid, own_cid, own_cid_len );
108 /* Truncation is not an issue here because
109 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
110 ssl->own_cid_len = (uint8_t) own_cid_len;
111
112 return( 0 );
113 }
114
mbedtls_ssl_get_peer_cid(mbedtls_ssl_context * ssl,int * enabled,unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],size_t * peer_cid_len)115 int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
116 int *enabled,
117 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
118 size_t *peer_cid_len )
119 {
120 *enabled = MBEDTLS_SSL_CID_DISABLED;
121
122 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
123 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
124 {
125 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
126 }
127
128 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
129 * were used, but client and server requested the empty CID.
130 * This is indistinguishable from not using the CID extension
131 * in the first place. */
132 if( ssl->transform_in->in_cid_len == 0 &&
133 ssl->transform_in->out_cid_len == 0 )
134 {
135 return( 0 );
136 }
137
138 if( peer_cid_len != NULL )
139 {
140 *peer_cid_len = ssl->transform_in->out_cid_len;
141 if( peer_cid != NULL )
142 {
143 memcpy( peer_cid, ssl->transform_in->out_cid,
144 ssl->transform_in->out_cid_len );
145 }
146 }
147
148 *enabled = MBEDTLS_SSL_CID_ENABLED;
149
150 return( 0 );
151 }
152 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
153
154 #endif /* MBEDTLS_SSL_PROTO_DTLS */
155
156 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
157 /*
158 * Convert max_fragment_length codes to length.
159 * RFC 6066 says:
160 * enum{
161 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
162 * } MaxFragmentLength;
163 * and we add 0 -> extension unused
164 */
ssl_mfl_code_to_length(int mfl)165 static unsigned int ssl_mfl_code_to_length( int mfl )
166 {
167 switch( mfl )
168 {
169 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
170 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
171 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
172 return 512;
173 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
174 return 1024;
175 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
176 return 2048;
177 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
178 return 4096;
179 default:
180 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
181 }
182 }
183 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
184
mbedtls_ssl_session_copy(mbedtls_ssl_session * dst,const mbedtls_ssl_session * src)185 int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
186 const mbedtls_ssl_session *src )
187 {
188 mbedtls_ssl_session_free( dst );
189 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
190
191 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
192 dst->ticket = NULL;
193 #endif
194
195 #if defined(MBEDTLS_X509_CRT_PARSE_C)
196
197 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
198 if( src->peer_cert != NULL )
199 {
200 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
201
202 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
203 if( dst->peer_cert == NULL )
204 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
205
206 mbedtls_x509_crt_init( dst->peer_cert );
207
208 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
209 src->peer_cert->raw.len ) ) != 0 )
210 {
211 mbedtls_free( dst->peer_cert );
212 dst->peer_cert = NULL;
213 return( ret );
214 }
215 }
216 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
217 if( src->peer_cert_digest != NULL )
218 {
219 dst->peer_cert_digest =
220 mbedtls_calloc( 1, src->peer_cert_digest_len );
221 if( dst->peer_cert_digest == NULL )
222 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
223
224 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
225 src->peer_cert_digest_len );
226 dst->peer_cert_digest_type = src->peer_cert_digest_type;
227 dst->peer_cert_digest_len = src->peer_cert_digest_len;
228 }
229 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
230
231 #endif /* MBEDTLS_X509_CRT_PARSE_C */
232
233 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
234 if( src->ticket != NULL )
235 {
236 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
237 if( dst->ticket == NULL )
238 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
239
240 memcpy( dst->ticket, src->ticket, src->ticket_len );
241 }
242 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
243
244 return( 0 );
245 }
246
247 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
resize_buffer(unsigned char ** buffer,size_t len_new,size_t * len_old)248 static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
249 {
250 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
251 if( resized_buffer == NULL )
252 return -1;
253
254 /* We want to copy len_new bytes when downsizing the buffer, and
255 * len_old bytes when upsizing, so we choose the smaller of two sizes,
256 * to fit one buffer into another. Size checks, ensuring that no data is
257 * lost, are done outside of this function. */
258 memcpy( resized_buffer, *buffer,
259 ( len_new < *len_old ) ? len_new : *len_old );
260 mbedtls_platform_zeroize( *buffer, *len_old );
261 mbedtls_free( *buffer );
262
263 *buffer = resized_buffer;
264 *len_old = len_new;
265
266 return 0;
267 }
268
handle_buffer_resizing(mbedtls_ssl_context * ssl,int downsizing,size_t in_buf_new_len,size_t out_buf_new_len)269 static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
270 size_t in_buf_new_len,
271 size_t out_buf_new_len )
272 {
273 int modified = 0;
274 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
275 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
276 if( ssl->in_buf != NULL )
277 {
278 written_in = ssl->in_msg - ssl->in_buf;
279 iv_offset_in = ssl->in_iv - ssl->in_buf;
280 len_offset_in = ssl->in_len - ssl->in_buf;
281 if( downsizing ?
282 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
283 ssl->in_buf_len < in_buf_new_len )
284 {
285 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
286 {
287 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
288 }
289 else
290 {
291 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
292 in_buf_new_len ) );
293 modified = 1;
294 }
295 }
296 }
297
298 if( ssl->out_buf != NULL )
299 {
300 written_out = ssl->out_msg - ssl->out_buf;
301 iv_offset_out = ssl->out_iv - ssl->out_buf;
302 len_offset_out = ssl->out_len - ssl->out_buf;
303 if( downsizing ?
304 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
305 ssl->out_buf_len < out_buf_new_len )
306 {
307 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
308 {
309 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
310 }
311 else
312 {
313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
314 out_buf_new_len ) );
315 modified = 1;
316 }
317 }
318 }
319 if( modified )
320 {
321 /* Update pointers here to avoid doing it twice. */
322 mbedtls_ssl_reset_in_out_pointers( ssl );
323 /* Fields below might not be properly updated with record
324 * splitting or with CID, so they are manually updated here. */
325 ssl->out_msg = ssl->out_buf + written_out;
326 ssl->out_len = ssl->out_buf + len_offset_out;
327 ssl->out_iv = ssl->out_buf + iv_offset_out;
328
329 ssl->in_msg = ssl->in_buf + written_in;
330 ssl->in_len = ssl->in_buf + len_offset_in;
331 ssl->in_iv = ssl->in_buf + iv_offset_in;
332 }
333 }
334 #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
335
336 /*
337 * Key material generation
338 */
339 #if defined(MBEDTLS_SSL_PROTO_SSL3)
ssl3_prf(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)340 static int ssl3_prf( const unsigned char *secret, size_t slen,
341 const char *label,
342 const unsigned char *random, size_t rlen,
343 unsigned char *dstbuf, size_t dlen )
344 {
345 int ret = 0;
346 size_t i;
347 mbedtls_md5_context md5;
348 mbedtls_sha1_context sha1;
349 unsigned char padding[16];
350 unsigned char sha1sum[20];
351 ((void)label);
352
353 mbedtls_md5_init( &md5 );
354 mbedtls_sha1_init( &sha1 );
355
356 /*
357 * SSLv3:
358 * block =
359 * MD5( secret + SHA1( 'A' + secret + random ) ) +
360 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
361 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
362 * ...
363 */
364 for( i = 0; i < dlen / 16; i++ )
365 {
366 memset( padding, (unsigned char) ('A' + i), 1 + i );
367
368 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
369 goto exit;
370 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
371 goto exit;
372 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
373 goto exit;
374 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
375 goto exit;
376 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
377 goto exit;
378
379 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
380 goto exit;
381 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
382 goto exit;
383 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
384 goto exit;
385 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
386 goto exit;
387 }
388
389 exit:
390 mbedtls_md5_free( &md5 );
391 mbedtls_sha1_free( &sha1 );
392
393 mbedtls_platform_zeroize( padding, sizeof( padding ) );
394 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
395
396 return( ret );
397 }
398 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
399
400 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
tls1_prf(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)401 static int tls1_prf( const unsigned char *secret, size_t slen,
402 const char *label,
403 const unsigned char *random, size_t rlen,
404 unsigned char *dstbuf, size_t dlen )
405 {
406 size_t nb, hs;
407 size_t i, j, k;
408 const unsigned char *S1, *S2;
409 unsigned char *tmp;
410 size_t tmp_len = 0;
411 unsigned char h_i[20];
412 const mbedtls_md_info_t *md_info;
413 mbedtls_md_context_t md_ctx;
414 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
415
416 mbedtls_md_init( &md_ctx );
417
418 tmp_len = 20 + strlen( label ) + rlen;
419 tmp = mbedtls_calloc( 1, tmp_len );
420 if( tmp == NULL )
421 {
422 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
423 goto exit;
424 }
425
426 hs = ( slen + 1 ) / 2;
427 S1 = secret;
428 S2 = secret + slen - hs;
429
430 nb = strlen( label );
431 memcpy( tmp + 20, label, nb );
432 memcpy( tmp + 20 + nb, random, rlen );
433 nb += rlen;
434
435 /*
436 * First compute P_md5(secret,label+random)[0..dlen]
437 */
438 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) == NULL )
439 {
440 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
441 goto exit;
442 }
443
444 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
445 {
446 goto exit;
447 }
448
449 ret = mbedtls_md_hmac_starts( &md_ctx, S1, hs );
450 if( ret != 0 )
451 goto exit;
452 ret = mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
453 if( ret != 0 )
454 goto exit;
455 ret = mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
456 if( ret != 0 )
457 goto exit;
458
459 for( i = 0; i < dlen; i += 16 )
460 {
461 ret = mbedtls_md_hmac_reset ( &md_ctx );
462 if( ret != 0 )
463 goto exit;
464 ret = mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
465 if( ret != 0 )
466 goto exit;
467 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
468 if( ret != 0 )
469 goto exit;
470
471 ret = mbedtls_md_hmac_reset ( &md_ctx );
472 if( ret != 0 )
473 goto exit;
474 ret = mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
475 if( ret != 0 )
476 goto exit;
477 ret = mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
478 if( ret != 0 )
479 goto exit;
480
481 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
482
483 for( j = 0; j < k; j++ )
484 dstbuf[i + j] = h_i[j];
485 }
486
487 mbedtls_md_free( &md_ctx );
488
489 /*
490 * XOR out with P_sha1(secret,label+random)[0..dlen]
491 */
492 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) == NULL )
493 {
494 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
495 goto exit;
496 }
497
498 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
499 {
500 goto exit;
501 }
502
503 ret = mbedtls_md_hmac_starts( &md_ctx, S2, hs );
504 if( ret != 0 )
505 goto exit;
506 ret = mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
507 if( ret != 0 )
508 goto exit;
509 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
510 if( ret != 0 )
511 goto exit;
512
513 for( i = 0; i < dlen; i += 20 )
514 {
515 ret = mbedtls_md_hmac_reset ( &md_ctx );
516 if( ret != 0 )
517 goto exit;
518 ret = mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
519 if( ret != 0 )
520 goto exit;
521 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
522 if( ret != 0 )
523 goto exit;
524
525 ret = mbedtls_md_hmac_reset ( &md_ctx );
526 if( ret != 0 )
527 goto exit;
528 ret = mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
529 if( ret != 0 )
530 goto exit;
531 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
532 if( ret != 0 )
533 goto exit;
534
535 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
536
537 for( j = 0; j < k; j++ )
538 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
539 }
540
541 exit:
542 mbedtls_md_free( &md_ctx );
543
544 mbedtls_platform_zeroize( tmp, tmp_len );
545 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
546
547 mbedtls_free( tmp );
548 return( ret );
549 }
550 #endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
551
552 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
553 #if defined(MBEDTLS_USE_PSA_CRYPTO)
554
setup_psa_key_derivation(psa_key_derivation_operation_t * derivation,psa_key_id_t key,psa_algorithm_t alg,const unsigned char * seed,size_t seed_length,const unsigned char * label,size_t label_length,size_t capacity)555 static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
556 psa_key_id_t key,
557 psa_algorithm_t alg,
558 const unsigned char* seed, size_t seed_length,
559 const unsigned char* label, size_t label_length,
560 size_t capacity )
561 {
562 psa_status_t status;
563
564 status = psa_key_derivation_setup( derivation, alg );
565 if( status != PSA_SUCCESS )
566 return( status );
567
568 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
569 {
570 status = psa_key_derivation_input_bytes( derivation,
571 PSA_KEY_DERIVATION_INPUT_SEED,
572 seed, seed_length );
573 if( status != PSA_SUCCESS )
574 return( status );
575
576 if( mbedtls_svc_key_id_is_null( key ) )
577 {
578 status = psa_key_derivation_input_bytes(
579 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
580 NULL, 0 );
581 }
582 else
583 {
584 status = psa_key_derivation_input_key(
585 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
586 }
587 if( status != PSA_SUCCESS )
588 return( status );
589
590 status = psa_key_derivation_input_bytes( derivation,
591 PSA_KEY_DERIVATION_INPUT_LABEL,
592 label, label_length );
593 if( status != PSA_SUCCESS )
594 return( status );
595 }
596 else
597 {
598 return( PSA_ERROR_NOT_SUPPORTED );
599 }
600
601 status = psa_key_derivation_set_capacity( derivation, capacity );
602 if( status != PSA_SUCCESS )
603 return( status );
604
605 return( PSA_SUCCESS );
606 }
607
tls_prf_generic(mbedtls_md_type_t md_type,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)608 static int tls_prf_generic( mbedtls_md_type_t md_type,
609 const unsigned char *secret, size_t slen,
610 const char *label,
611 const unsigned char *random, size_t rlen,
612 unsigned char *dstbuf, size_t dlen )
613 {
614 psa_status_t status;
615 psa_algorithm_t alg;
616 psa_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
617 psa_key_derivation_operation_t derivation =
618 PSA_KEY_DERIVATION_OPERATION_INIT;
619
620 if( md_type == MBEDTLS_MD_SHA384 )
621 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
622 else
623 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
624
625 /* Normally a "secret" should be long enough to be impossible to
626 * find by brute force, and in particular should not be empty. But
627 * this PRF is also used to derive an IV, in particular in EAP-TLS,
628 * and for this use case it makes sense to have a 0-length "secret".
629 * Since the key API doesn't allow importing a key of length 0,
630 * keep master_key=0, which setup_psa_key_derivation() understands
631 * to mean a 0-length "secret" input. */
632 if( slen != 0 )
633 {
634 psa_key_attributes_t key_attributes = psa_key_attributes_init();
635 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
636 psa_set_key_algorithm( &key_attributes, alg );
637 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
638
639 status = psa_import_key( &key_attributes, secret, slen, &master_key );
640 if( status != PSA_SUCCESS )
641 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
642 }
643
644 status = setup_psa_key_derivation( &derivation,
645 master_key, alg,
646 random, rlen,
647 (unsigned char const *) label,
648 (size_t) strlen( label ),
649 dlen );
650 if( status != PSA_SUCCESS )
651 {
652 psa_key_derivation_abort( &derivation );
653 psa_destroy_key( master_key );
654 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
655 }
656
657 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
658 if( status != PSA_SUCCESS )
659 {
660 psa_key_derivation_abort( &derivation );
661 psa_destroy_key( master_key );
662 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
663 }
664
665 status = psa_key_derivation_abort( &derivation );
666 if( status != PSA_SUCCESS )
667 {
668 psa_destroy_key( master_key );
669 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
670 }
671
672 if( ! mbedtls_svc_key_id_is_null( master_key ) )
673 status = psa_destroy_key( master_key );
674 if( status != PSA_SUCCESS )
675 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
676
677 return( 0 );
678 }
679
680 #else /* MBEDTLS_USE_PSA_CRYPTO */
681
tls_prf_generic(mbedtls_md_type_t md_type,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)682 static int tls_prf_generic( mbedtls_md_type_t md_type,
683 const unsigned char *secret, size_t slen,
684 const char *label,
685 const unsigned char *random, size_t rlen,
686 unsigned char *dstbuf, size_t dlen )
687 {
688 size_t nb;
689 size_t i, j, k, md_len;
690 unsigned char *tmp;
691 size_t tmp_len = 0;
692 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
693 const mbedtls_md_info_t *md_info;
694 mbedtls_md_context_t md_ctx;
695 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
696
697 mbedtls_md_init( &md_ctx );
698
699 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
700 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
701
702 md_len = mbedtls_md_get_size( md_info );
703
704 tmp_len = md_len + strlen( label ) + rlen;
705 tmp = mbedtls_calloc( 1, tmp_len );
706 if( tmp == NULL )
707 {
708 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
709 goto exit;
710 }
711
712 nb = strlen( label );
713 memcpy( tmp + md_len, label, nb );
714 memcpy( tmp + md_len + nb, random, rlen );
715 nb += rlen;
716
717 /*
718 * Compute P_<hash>(secret, label + random)[0..dlen]
719 */
720 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
721 goto exit;
722
723 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
724 if( ret != 0 )
725 goto exit;
726 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
727 if( ret != 0 )
728 goto exit;
729 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
730 if( ret != 0 )
731 goto exit;
732
733 for( i = 0; i < dlen; i += md_len )
734 {
735 ret = mbedtls_md_hmac_reset ( &md_ctx );
736 if( ret != 0 )
737 goto exit;
738 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
739 if( ret != 0 )
740 goto exit;
741 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
742 if( ret != 0 )
743 goto exit;
744
745 ret = mbedtls_md_hmac_reset ( &md_ctx );
746 if( ret != 0 )
747 goto exit;
748 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
749 if( ret != 0 )
750 goto exit;
751 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
752 if( ret != 0 )
753 goto exit;
754
755 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
756
757 for( j = 0; j < k; j++ )
758 dstbuf[i + j] = h_i[j];
759 }
760
761 exit:
762 mbedtls_md_free( &md_ctx );
763
764 mbedtls_platform_zeroize( tmp, tmp_len );
765 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
766
767 mbedtls_free( tmp );
768
769 return( ret );
770 }
771 #endif /* MBEDTLS_USE_PSA_CRYPTO */
772 #if defined(MBEDTLS_SHA256_C)
tls_prf_sha256(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)773 static int tls_prf_sha256( const unsigned char *secret, size_t slen,
774 const char *label,
775 const unsigned char *random, size_t rlen,
776 unsigned char *dstbuf, size_t dlen )
777 {
778 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
779 label, random, rlen, dstbuf, dlen ) );
780 }
781 #endif /* MBEDTLS_SHA256_C */
782
783 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
tls_prf_sha384(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)784 static int tls_prf_sha384( const unsigned char *secret, size_t slen,
785 const char *label,
786 const unsigned char *random, size_t rlen,
787 unsigned char *dstbuf, size_t dlen )
788 {
789 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
790 label, random, rlen, dstbuf, dlen ) );
791 }
792 #endif /* MBEDTLS_SHA512_C && !MBEDTLS_SHA512_NO_SHA384 */
793 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
794
795 static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
796
797 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
798 defined(MBEDTLS_SSL_PROTO_TLS1_1)
799 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *, const unsigned char *, size_t );
800 #endif
801
802 #if defined(MBEDTLS_SSL_PROTO_SSL3)
803 static void ssl_calc_verify_ssl( const mbedtls_ssl_context *, unsigned char *, size_t * );
804 static void ssl_calc_finished_ssl( mbedtls_ssl_context *, unsigned char *, int );
805 #endif
806
807 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
808 static void ssl_calc_verify_tls( const mbedtls_ssl_context *, unsigned char*, size_t * );
809 static void ssl_calc_finished_tls( mbedtls_ssl_context *, unsigned char *, int );
810 #endif
811
812 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
813 #if defined(MBEDTLS_SHA256_C)
814 static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
815 static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
816 static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
817 #endif
818
819 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
820 static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
821 static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
822 static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
823 #endif
824 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
825
826 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \
827 defined(MBEDTLS_USE_PSA_CRYPTO)
ssl_use_opaque_psk(mbedtls_ssl_context const * ssl)828 static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
829 {
830 if( ssl->conf->f_psk != NULL )
831 {
832 /* If we've used a callback to select the PSK,
833 * the static configuration is irrelevant. */
834 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
835 return( 1 );
836
837 return( 0 );
838 }
839
840 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
841 return( 1 );
842
843 return( 0 );
844 }
845 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
846 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
847
848 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
tls_prf_get_type(mbedtls_ssl_tls_prf_cb * tls_prf)849 static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
850 {
851 #if defined(MBEDTLS_SSL_PROTO_SSL3)
852 if( tls_prf == ssl3_prf )
853 {
854 return( MBEDTLS_SSL_TLS_PRF_SSL3 );
855 }
856 else
857 #endif
858 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
859 if( tls_prf == tls1_prf )
860 {
861 return( MBEDTLS_SSL_TLS_PRF_TLS1 );
862 }
863 else
864 #endif
865 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
866 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
867 if( tls_prf == tls_prf_sha384 )
868 {
869 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
870 }
871 else
872 #endif
873 #if defined(MBEDTLS_SHA256_C)
874 if( tls_prf == tls_prf_sha256 )
875 {
876 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
877 }
878 else
879 #endif
880 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
881 return( MBEDTLS_SSL_TLS_PRF_NONE );
882 }
883 #endif /* MBEDTLS_SSL_EXPORT_KEYS */
884
mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)885 int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
886 const unsigned char *secret, size_t slen,
887 const char *label,
888 const unsigned char *random, size_t rlen,
889 unsigned char *dstbuf, size_t dlen )
890 {
891 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
892
893 switch( prf )
894 {
895 #if defined(MBEDTLS_SSL_PROTO_SSL3)
896 case MBEDTLS_SSL_TLS_PRF_SSL3:
897 tls_prf = ssl3_prf;
898 break;
899 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
900 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
901 case MBEDTLS_SSL_TLS_PRF_TLS1:
902 tls_prf = tls1_prf;
903 break;
904 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
905
906 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
907 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
908 case MBEDTLS_SSL_TLS_PRF_SHA384:
909 tls_prf = tls_prf_sha384;
910 break;
911 #endif /* MBEDTLS_SHA512_C && !MBEDTLS_SHA512_NO_SHA384 */
912 #if defined(MBEDTLS_SHA256_C)
913 case MBEDTLS_SSL_TLS_PRF_SHA256:
914 tls_prf = tls_prf_sha256;
915 break;
916 #endif /* MBEDTLS_SHA256_C */
917 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
918 default:
919 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
920 }
921
922 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
923 }
924
925 /* Type for the TLS PRF */
926 typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
927 const unsigned char *, size_t,
928 unsigned char *, size_t);
929
930 /*
931 * Populate a transform structure with session keys and all the other
932 * necessary information.
933 *
934 * Parameters:
935 * - [in/out]: transform: structure to populate
936 * [in] must be just initialised with mbedtls_ssl_transform_init()
937 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
938 * - [in] ciphersuite
939 * - [in] master
940 * - [in] encrypt_then_mac
941 * - [in] trunc_hmac
942 * - [in] compression
943 * - [in] tls_prf: pointer to PRF to use for key derivation
944 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
945 * - [in] minor_ver: SSL/TLS minor version
946 * - [in] endpoint: client or server
947 * - [in] ssl: optionally used for:
948 * - MBEDTLS_SSL_HW_RECORD_ACCEL: whole context (non-const)
949 * - MBEDTLS_SSL_EXPORT_KEYS: ssl->conf->{f,p}_export_keys
950 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
951 */
ssl_populate_transform(mbedtls_ssl_transform * transform,int ciphersuite,const unsigned char master[48],int encrypt_then_mac,int trunc_hmac,int compression,ssl_tls_prf_t tls_prf,const unsigned char randbytes[64],int minor_ver,unsigned endpoint,const mbedtls_ssl_context * ssl)952 static int ssl_populate_transform( mbedtls_ssl_transform *transform,
953 int ciphersuite,
954 const unsigned char master[48],
955 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
956 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
957 int encrypt_then_mac,
958 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
959 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
960 int trunc_hmac,
961 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
962 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
963 #if defined(MBEDTLS_ZLIB_SUPPORT)
964 int compression,
965 #endif
966 ssl_tls_prf_t tls_prf,
967 const unsigned char randbytes[64],
968 int minor_ver,
969 unsigned endpoint,
970 #if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
971 const
972 #endif
973 mbedtls_ssl_context *ssl )
974 {
975 int ret = 0;
976 #if defined(MBEDTLS_USE_PSA_CRYPTO)
977 int psa_fallthrough;
978 #endif /* MBEDTLS_USE_PSA_CRYPTO */
979 unsigned char keyblk[256];
980 unsigned char *key1;
981 unsigned char *key2;
982 unsigned char *mac_enc;
983 unsigned char *mac_dec;
984 size_t mac_key_len = 0;
985 size_t iv_copy_len;
986 unsigned keylen;
987 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
988 const mbedtls_cipher_info_t *cipher_info;
989 const mbedtls_md_info_t *md_info;
990
991 #if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \
992 !defined(MBEDTLS_SSL_EXPORT_KEYS) && \
993 !defined(MBEDTLS_DEBUG_C)
994 ssl = NULL; /* make sure we don't use it except for those cases */
995 (void) ssl;
996 #endif
997
998 /*
999 * Some data just needs copying into the structure
1000 */
1001 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
1002 defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1003 transform->encrypt_then_mac = encrypt_then_mac;
1004 #endif
1005 transform->minor_ver = minor_ver;
1006
1007 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
1008 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
1009 #endif
1010
1011 /*
1012 * Get various info structures
1013 */
1014 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
1015 if( ciphersuite_info == NULL )
1016 {
1017 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
1018 ciphersuite ) );
1019 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1020 }
1021
1022 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
1023 if( cipher_info == NULL )
1024 {
1025 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
1026 ciphersuite_info->cipher ) );
1027 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1028 }
1029
1030 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
1031 if( md_info == NULL )
1032 {
1033 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
1034 (unsigned) ciphersuite_info->mac ) );
1035 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1036 }
1037
1038 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
1039 /* Copy own and peer's CID if the use of the CID
1040 * extension has been negotiated. */
1041 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
1042 {
1043 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
1044
1045 transform->in_cid_len = ssl->own_cid_len;
1046 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
1047 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
1048 transform->in_cid_len );
1049
1050 transform->out_cid_len = ssl->handshake->peer_cid_len;
1051 memcpy( transform->out_cid, ssl->handshake->peer_cid,
1052 ssl->handshake->peer_cid_len );
1053 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
1054 transform->out_cid_len );
1055 }
1056 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1057
1058 /*
1059 * Compute key block using the PRF
1060 */
1061 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
1062 if( ret != 0 )
1063 {
1064 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
1065 return( ret );
1066 }
1067
1068 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
1069 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
1070 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
1071 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
1072 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
1073
1074 /*
1075 * Determine the appropriate key, IV and MAC length.
1076 */
1077
1078 keylen = cipher_info->key_bitlen / 8;
1079
1080 #if defined(MBEDTLS_GCM_C) || \
1081 defined(MBEDTLS_CCM_C) || \
1082 defined(MBEDTLS_CHACHAPOLY_C)
1083 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
1084 cipher_info->mode == MBEDTLS_MODE_CCM ||
1085 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
1086 {
1087 size_t explicit_ivlen;
1088
1089 transform->maclen = 0;
1090 mac_key_len = 0;
1091 transform->taglen =
1092 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
1093
1094 /* All modes haves 96-bit IVs, but the length of the static parts vary
1095 * with mode and version:
1096 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
1097 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
1098 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
1099 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
1100 * sequence number).
1101 */
1102 transform->ivlen = 12;
1103 #if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
1104 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
1105 {
1106 transform->fixed_ivlen = 12;
1107 }
1108 else
1109 #endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
1110 {
1111 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
1112 transform->fixed_ivlen = 12;
1113 else
1114 transform->fixed_ivlen = 4;
1115 }
1116
1117 /* Minimum length of encrypted record */
1118 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
1119 transform->minlen = explicit_ivlen + transform->taglen;
1120 }
1121 else
1122 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
1123 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1124 if( cipher_info->mode == MBEDTLS_MODE_STREAM ||
1125 cipher_info->mode == MBEDTLS_MODE_CBC )
1126 {
1127 /* Initialize HMAC contexts */
1128 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
1129 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
1130 {
1131 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
1132 goto end;
1133 }
1134
1135 /* Get MAC length */
1136 mac_key_len = mbedtls_md_get_size( md_info );
1137 transform->maclen = mac_key_len;
1138
1139 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1140 /*
1141 * If HMAC is to be truncated, we shall keep the leftmost bytes,
1142 * (rfc 6066 page 13 or rfc 2104 section 4),
1143 * so we only need to adjust the length here.
1144 */
1145 if( trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
1146 {
1147 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
1148
1149 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
1150 /* Fall back to old, non-compliant version of the truncated
1151 * HMAC implementation which also truncates the key
1152 * (Mbed TLS versions from 1.3 to 2.6.0) */
1153 mac_key_len = transform->maclen;
1154 #endif
1155 }
1156 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1157
1158 /* IV length */
1159 transform->ivlen = cipher_info->iv_size;
1160
1161 /* Minimum length */
1162 if( cipher_info->mode == MBEDTLS_MODE_STREAM )
1163 transform->minlen = transform->maclen;
1164 else
1165 {
1166 /*
1167 * GenericBlockCipher:
1168 * 1. if EtM is in use: one block plus MAC
1169 * otherwise: * first multiple of blocklen greater than maclen
1170 * 2. IV except for SSL3 and TLS 1.0
1171 */
1172 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1173 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
1174 {
1175 transform->minlen = transform->maclen
1176 + cipher_info->block_size;
1177 }
1178 else
1179 #endif
1180 {
1181 transform->minlen = transform->maclen
1182 + cipher_info->block_size
1183 - transform->maclen % cipher_info->block_size;
1184 }
1185
1186 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
1187 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
1188 minor_ver == MBEDTLS_SSL_MINOR_VERSION_1 )
1189 ; /* No need to adjust minlen */
1190 else
1191 #endif
1192 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
1193 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_2 ||
1194 minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1195 {
1196 transform->minlen += transform->ivlen;
1197 }
1198 else
1199 #endif
1200 {
1201 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1202 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1203 goto end;
1204 }
1205 }
1206 }
1207 else
1208 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1209 {
1210 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1211 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1212 }
1213
1214 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
1215 (unsigned) keylen,
1216 (unsigned) transform->minlen,
1217 (unsigned) transform->ivlen,
1218 (unsigned) transform->maclen ) );
1219
1220 /*
1221 * Finally setup the cipher contexts, IVs and MAC secrets.
1222 */
1223 #if defined(MBEDTLS_SSL_CLI_C)
1224 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
1225 {
1226 key1 = keyblk + mac_key_len * 2;
1227 key2 = keyblk + mac_key_len * 2 + keylen;
1228
1229 mac_enc = keyblk;
1230 mac_dec = keyblk + mac_key_len;
1231
1232 /*
1233 * This is not used in TLS v1.1.
1234 */
1235 iv_copy_len = ( transform->fixed_ivlen ) ?
1236 transform->fixed_ivlen : transform->ivlen;
1237 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
1238 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
1239 iv_copy_len );
1240 }
1241 else
1242 #endif /* MBEDTLS_SSL_CLI_C */
1243 #if defined(MBEDTLS_SSL_SRV_C)
1244 if( endpoint == MBEDTLS_SSL_IS_SERVER )
1245 {
1246 key1 = keyblk + mac_key_len * 2 + keylen;
1247 key2 = keyblk + mac_key_len * 2;
1248
1249 mac_enc = keyblk + mac_key_len;
1250 mac_dec = keyblk;
1251
1252 /*
1253 * This is not used in TLS v1.1.
1254 */
1255 iv_copy_len = ( transform->fixed_ivlen ) ?
1256 transform->fixed_ivlen : transform->ivlen;
1257 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
1258 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
1259 iv_copy_len );
1260 }
1261 else
1262 #endif /* MBEDTLS_SSL_SRV_C */
1263 {
1264 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1265 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1266 goto end;
1267 }
1268
1269 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1270 #if defined(MBEDTLS_SSL_PROTO_SSL3)
1271 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1272 {
1273 if( mac_key_len > sizeof( transform->mac_enc ) )
1274 {
1275 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1276 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1277 goto end;
1278 }
1279
1280 memcpy( transform->mac_enc, mac_enc, mac_key_len );
1281 memcpy( transform->mac_dec, mac_dec, mac_key_len );
1282 }
1283 else
1284 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
1285 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1286 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1287 if( minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
1288 {
1289 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1290 For AEAD-based ciphersuites, there is nothing to do here. */
1291 if( mac_key_len != 0 )
1292 {
1293 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc,
1294 mac_enc, mac_key_len );
1295 if( ret != 0 )
1296 goto end;
1297 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec,
1298 mac_dec, mac_key_len );
1299 if( ret != 0 )
1300 goto end;
1301 }
1302 }
1303 else
1304 #endif
1305 {
1306 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1307 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1308 goto end;
1309 }
1310 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1311
1312 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1313 if( mbedtls_ssl_hw_record_init != NULL )
1314 {
1315 ret = 0;
1316
1317 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
1318
1319 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen,
1320 transform->iv_enc, transform->iv_dec,
1321 iv_copy_len,
1322 mac_enc, mac_dec,
1323 mac_key_len ) ) != 0 )
1324 {
1325 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1326 ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
1327 goto end;
1328 }
1329 }
1330 #else
1331 ((void) mac_dec);
1332 ((void) mac_enc);
1333 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
1334
1335 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
1336 if( ssl->conf->f_export_keys != NULL )
1337 {
1338 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
1339 master, keyblk,
1340 mac_key_len, keylen,
1341 iv_copy_len );
1342 }
1343
1344 if( ssl->conf->f_export_keys_ext != NULL )
1345 {
1346 ssl->conf->f_export_keys_ext( ssl->conf->p_export_keys,
1347 master, keyblk,
1348 mac_key_len, keylen,
1349 iv_copy_len,
1350 randbytes + 32,
1351 randbytes,
1352 tls_prf_get_type( tls_prf ) );
1353 }
1354 #endif
1355
1356 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1357
1358 /* Only use PSA-based ciphers for TLS-1.2.
1359 * That's relevant at least for TLS-1.0, where
1360 * we assume that mbedtls_cipher_crypt() updates
1361 * the structure field for the IV, which the PSA-based
1362 * implementation currently doesn't. */
1363 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1364 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1365 {
1366 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_enc,
1367 cipher_info, transform->taglen );
1368 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
1369 {
1370 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1371 goto end;
1372 }
1373
1374 if( ret == 0 )
1375 {
1376 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based encryption cipher context" ) );
1377 psa_fallthrough = 0;
1378 }
1379 else
1380 {
1381 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record encryption - fall through to default setup." ) );
1382 psa_fallthrough = 1;
1383 }
1384 }
1385 else
1386 psa_fallthrough = 1;
1387 #else
1388 psa_fallthrough = 1;
1389 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1390
1391 if( psa_fallthrough == 1 )
1392 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1393 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
1394 cipher_info ) ) != 0 )
1395 {
1396 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1397 goto end;
1398 }
1399
1400 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1401 /* Only use PSA-based ciphers for TLS-1.2.
1402 * That's relevant at least for TLS-1.0, where
1403 * we assume that mbedtls_cipher_crypt() updates
1404 * the structure field for the IV, which the PSA-based
1405 * implementation currently doesn't. */
1406 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1407 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1408 {
1409 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_dec,
1410 cipher_info, transform->taglen );
1411 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
1412 {
1413 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1414 goto end;
1415 }
1416
1417 if( ret == 0 )
1418 {
1419 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based decryption cipher context" ) );
1420 psa_fallthrough = 0;
1421 }
1422 else
1423 {
1424 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record decryption - fall through to default setup." ) );
1425 psa_fallthrough = 1;
1426 }
1427 }
1428 else
1429 psa_fallthrough = 1;
1430 #else
1431 psa_fallthrough = 1;
1432 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1433
1434 if( psa_fallthrough == 1 )
1435 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1436 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
1437 cipher_info ) ) != 0 )
1438 {
1439 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1440 goto end;
1441 }
1442
1443 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
1444 cipher_info->key_bitlen,
1445 MBEDTLS_ENCRYPT ) ) != 0 )
1446 {
1447 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1448 goto end;
1449 }
1450
1451 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
1452 cipher_info->key_bitlen,
1453 MBEDTLS_DECRYPT ) ) != 0 )
1454 {
1455 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1456 goto end;
1457 }
1458
1459 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1460 if( cipher_info->mode == MBEDTLS_MODE_CBC )
1461 {
1462 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1463 MBEDTLS_PADDING_NONE ) ) != 0 )
1464 {
1465 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1466 goto end;
1467 }
1468
1469 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1470 MBEDTLS_PADDING_NONE ) ) != 0 )
1471 {
1472 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1473 goto end;
1474 }
1475 }
1476 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1477
1478
1479 /* Initialize Zlib contexts */
1480 #if defined(MBEDTLS_ZLIB_SUPPORT)
1481 if( compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
1482 {
1483 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
1484
1485 memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1486 memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
1487
1488 if( deflateInit( &transform->ctx_deflate,
1489 Z_DEFAULT_COMPRESSION ) != Z_OK ||
1490 inflateInit( &transform->ctx_inflate ) != Z_OK )
1491 {
1492 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1493 ret = MBEDTLS_ERR_SSL_COMPRESSION_FAILED;
1494 goto end;
1495 }
1496 }
1497 #endif /* MBEDTLS_ZLIB_SUPPORT */
1498
1499 end:
1500 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
1501 return( ret );
1502 }
1503
1504 /*
1505 * Set appropriate PRF function and other SSL / TLS 1.0/1.1 / TLS1.2 functions
1506 *
1507 * Inputs:
1508 * - SSL/TLS minor version
1509 * - hash associated with the ciphersuite (only used by TLS 1.2)
1510 *
1511 * Outputs:
1512 * - the tls_prf, calc_verify and calc_finished members of handshake structure
1513 */
ssl_set_handshake_prfs(mbedtls_ssl_handshake_params * handshake,int minor_ver,mbedtls_md_type_t hash)1514 static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
1515 int minor_ver,
1516 mbedtls_md_type_t hash )
1517 {
1518 #if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || \
1519 !( defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) )
1520 (void) hash;
1521 #endif
1522
1523 #if defined(MBEDTLS_SSL_PROTO_SSL3)
1524 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1525 {
1526 handshake->tls_prf = ssl3_prf;
1527 handshake->calc_verify = ssl_calc_verify_ssl;
1528 handshake->calc_finished = ssl_calc_finished_ssl;
1529 }
1530 else
1531 #endif
1532 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1533 if( minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
1534 {
1535 handshake->tls_prf = tls1_prf;
1536 handshake->calc_verify = ssl_calc_verify_tls;
1537 handshake->calc_finished = ssl_calc_finished_tls;
1538 }
1539 else
1540 #endif
1541 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1542 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
1543 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1544 hash == MBEDTLS_MD_SHA384 )
1545 {
1546 handshake->tls_prf = tls_prf_sha384;
1547 handshake->calc_verify = ssl_calc_verify_tls_sha384;
1548 handshake->calc_finished = ssl_calc_finished_tls_sha384;
1549 }
1550 else
1551 #endif
1552 #if defined(MBEDTLS_SHA256_C)
1553 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1554 {
1555 handshake->tls_prf = tls_prf_sha256;
1556 handshake->calc_verify = ssl_calc_verify_tls_sha256;
1557 handshake->calc_finished = ssl_calc_finished_tls_sha256;
1558 }
1559 else
1560 #endif
1561 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1562 {
1563 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1564 }
1565
1566 return( 0 );
1567 }
1568
1569 /*
1570 * Compute master secret if needed
1571 *
1572 * Parameters:
1573 * [in/out] handshake
1574 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
1575 * (PSA-PSK) ciphersuite_info, psk_opaque
1576 * [out] premaster (cleared)
1577 * [out] master
1578 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
1579 * debug: conf->f_dbg, conf->p_dbg
1580 * EMS: passed to calc_verify (debug + (SSL3) session_negotiate)
1581 * PSA-PSA: minor_ver, conf
1582 */
ssl_compute_master(mbedtls_ssl_handshake_params * handshake,unsigned char * master,const mbedtls_ssl_context * ssl)1583 static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
1584 unsigned char *master,
1585 const mbedtls_ssl_context *ssl )
1586 {
1587 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1588
1589 /* cf. RFC 5246, Section 8.1:
1590 * "The master secret is always exactly 48 bytes in length." */
1591 size_t const master_secret_len = 48;
1592
1593 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1594 unsigned char session_hash[48];
1595 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1596
1597 /* The label for the KDF used for key expansion.
1598 * This is either "master secret" or "extended master secret"
1599 * depending on whether the Extended Master Secret extension
1600 * is used. */
1601 char const *lbl = "master secret";
1602
1603 /* The salt for the KDF used for key expansion.
1604 * - If the Extended Master Secret extension is not used,
1605 * this is ClientHello.Random + ServerHello.Random
1606 * (see Sect. 8.1 in RFC 5246).
1607 * - If the Extended Master Secret extension is used,
1608 * this is the transcript of the handshake so far.
1609 * (see Sect. 4 in RFC 7627). */
1610 unsigned char const *salt = handshake->randbytes;
1611 size_t salt_len = 64;
1612
1613 #if !defined(MBEDTLS_DEBUG_C) && \
1614 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
1615 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
1616 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
1617 ssl = NULL; /* make sure we don't use it except for those cases */
1618 (void) ssl;
1619 #endif
1620
1621 if( handshake->resume != 0 )
1622 {
1623 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
1624 return( 0 );
1625 }
1626
1627 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1628 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
1629 {
1630 lbl = "extended master secret";
1631 salt = session_hash;
1632 handshake->calc_verify( ssl, session_hash, &salt_len );
1633
1634 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
1635 session_hash, salt_len );
1636 }
1637 #endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */
1638
1639 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
1640 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1641 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
1642 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1643 ssl_use_opaque_psk( ssl ) == 1 )
1644 {
1645 /* Perform PSK-to-MS expansion in a single step. */
1646 psa_status_t status;
1647 psa_algorithm_t alg;
1648 psa_key_id_t psk;
1649 psa_key_derivation_operation_t derivation =
1650 PSA_KEY_DERIVATION_OPERATION_INIT;
1651 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
1652
1653 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
1654
1655 psk = mbedtls_ssl_get_opaque_psk( ssl );
1656
1657 if( hash_alg == MBEDTLS_MD_SHA384 )
1658 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
1659 else
1660 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
1661
1662 status = setup_psa_key_derivation( &derivation, psk, alg,
1663 salt, salt_len,
1664 (unsigned char const *) lbl,
1665 (size_t) strlen( lbl ),
1666 master_secret_len );
1667 if( status != PSA_SUCCESS )
1668 {
1669 psa_key_derivation_abort( &derivation );
1670 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1671 }
1672
1673 status = psa_key_derivation_output_bytes( &derivation,
1674 master,
1675 master_secret_len );
1676 if( status != PSA_SUCCESS )
1677 {
1678 psa_key_derivation_abort( &derivation );
1679 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1680 }
1681
1682 status = psa_key_derivation_abort( &derivation );
1683 if( status != PSA_SUCCESS )
1684 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1685 }
1686 else
1687 #endif
1688 {
1689 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
1690 lbl, salt, salt_len,
1691 master,
1692 master_secret_len );
1693 if( ret != 0 )
1694 {
1695 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
1696 return( ret );
1697 }
1698
1699 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
1700 handshake->premaster,
1701 handshake->pmslen );
1702
1703 mbedtls_platform_zeroize( handshake->premaster,
1704 sizeof(handshake->premaster) );
1705 }
1706
1707 return( 0 );
1708 }
1709
mbedtls_ssl_derive_keys(mbedtls_ssl_context * ssl)1710 int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
1711 {
1712 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1713 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
1714 ssl->handshake->ciphersuite_info;
1715
1716 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
1717
1718 /* Set PRF, calc_verify and calc_finished function pointers */
1719 ret = ssl_set_handshake_prfs( ssl->handshake,
1720 ssl->minor_ver,
1721 ciphersuite_info->mac );
1722 if( ret != 0 )
1723 {
1724 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
1725 return( ret );
1726 }
1727
1728 /* Compute master secret if needed */
1729 ret = ssl_compute_master( ssl->handshake,
1730 ssl->session_negotiate->master,
1731 ssl );
1732 if( ret != 0 )
1733 {
1734 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
1735 return( ret );
1736 }
1737
1738 /* Swap the client and server random values:
1739 * - MS derivation wanted client+server (RFC 5246 8.1)
1740 * - key derivation wants server+client (RFC 5246 6.3) */
1741 {
1742 unsigned char tmp[64];
1743 memcpy( tmp, ssl->handshake->randbytes, 64 );
1744 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
1745 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
1746 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
1747 }
1748
1749 /* Populate transform structure */
1750 ret = ssl_populate_transform( ssl->transform_negotiate,
1751 ssl->session_negotiate->ciphersuite,
1752 ssl->session_negotiate->master,
1753 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1754 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1755 ssl->session_negotiate->encrypt_then_mac,
1756 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1757 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1758 ssl->session_negotiate->trunc_hmac,
1759 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1760 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1761 #if defined(MBEDTLS_ZLIB_SUPPORT)
1762 ssl->session_negotiate->compression,
1763 #endif
1764 ssl->handshake->tls_prf,
1765 ssl->handshake->randbytes,
1766 ssl->minor_ver,
1767 ssl->conf->endpoint,
1768 ssl );
1769 if( ret != 0 )
1770 {
1771 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
1772 return( ret );
1773 }
1774
1775 /* We no longer need Server/ClientHello.random values */
1776 mbedtls_platform_zeroize( ssl->handshake->randbytes,
1777 sizeof( ssl->handshake->randbytes ) );
1778
1779 /* Allocate compression buffer */
1780 #if defined(MBEDTLS_ZLIB_SUPPORT)
1781 if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
1782 ssl->compress_buf == NULL )
1783 {
1784 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
1785 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
1786 if( ssl->compress_buf == NULL )
1787 {
1788 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
1789 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
1790 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1791 }
1792 }
1793 #endif
1794
1795 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
1796
1797 return( 0 );
1798 }
1799
1800 #if defined(MBEDTLS_SSL_PROTO_SSL3)
ssl_calc_verify_ssl(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1801 void ssl_calc_verify_ssl( const mbedtls_ssl_context *ssl,
1802 unsigned char *hash,
1803 size_t *hlen )
1804 {
1805 mbedtls_md5_context md5;
1806 mbedtls_sha1_context sha1;
1807 unsigned char pad_1[48];
1808 unsigned char pad_2[48];
1809
1810 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
1811
1812 mbedtls_md5_init( &md5 );
1813 mbedtls_sha1_init( &sha1 );
1814
1815 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1816 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1817
1818 memset( pad_1, 0x36, 48 );
1819 memset( pad_2, 0x5C, 48 );
1820
1821 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1822 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1823 mbedtls_md5_finish_ret( &md5, hash );
1824
1825 mbedtls_md5_starts_ret( &md5 );
1826 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1827 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1828 mbedtls_md5_update_ret( &md5, hash, 16 );
1829 mbedtls_md5_finish_ret( &md5, hash );
1830
1831 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1832 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1833 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1834
1835 mbedtls_sha1_starts_ret( &sha1 );
1836 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1837 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1838 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1839 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1840
1841 *hlen = 36;
1842
1843 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1844 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1845
1846 mbedtls_md5_free( &md5 );
1847 mbedtls_sha1_free( &sha1 );
1848
1849 return;
1850 }
1851 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
1852
1853 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
ssl_calc_verify_tls(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1854 void ssl_calc_verify_tls( const mbedtls_ssl_context *ssl,
1855 unsigned char *hash,
1856 size_t *hlen )
1857 {
1858 mbedtls_md5_context md5;
1859 mbedtls_sha1_context sha1;
1860
1861 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
1862
1863 mbedtls_md5_init( &md5 );
1864 mbedtls_sha1_init( &sha1 );
1865
1866 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1867 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1868
1869 mbedtls_md5_finish_ret( &md5, hash );
1870 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1871
1872 *hlen = 36;
1873
1874 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1875 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1876
1877 mbedtls_md5_free( &md5 );
1878 mbedtls_sha1_free( &sha1 );
1879
1880 return;
1881 }
1882 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1883
1884 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1885 #if defined(MBEDTLS_SHA256_C)
ssl_calc_verify_tls_sha256(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1886 void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1887 unsigned char *hash,
1888 size_t *hlen )
1889 {
1890 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1891 size_t hash_size;
1892 psa_status_t status;
1893 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
1894
1895 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
1896 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
1897 if( status != PSA_SUCCESS )
1898 {
1899 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1900 return;
1901 }
1902
1903 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
1904 if( status != PSA_SUCCESS )
1905 {
1906 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1907 return;
1908 }
1909
1910 *hlen = 32;
1911 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
1912 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1913 #else
1914 mbedtls_sha256_context sha256;
1915
1916 mbedtls_sha256_init( &sha256 );
1917
1918 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1919
1920 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1921 mbedtls_sha256_finish_ret( &sha256, hash );
1922
1923 *hlen = 32;
1924
1925 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1926 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1927
1928 mbedtls_sha256_free( &sha256 );
1929 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1930 return;
1931 }
1932 #endif /* MBEDTLS_SHA256_C */
1933
1934 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
ssl_calc_verify_tls_sha384(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1935 void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1936 unsigned char *hash,
1937 size_t *hlen )
1938 {
1939 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1940 size_t hash_size;
1941 psa_status_t status;
1942 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
1943
1944 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
1945 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
1946 if( status != PSA_SUCCESS )
1947 {
1948 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1949 return;
1950 }
1951
1952 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
1953 if( status != PSA_SUCCESS )
1954 {
1955 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1956 return;
1957 }
1958
1959 *hlen = 48;
1960 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
1961 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1962 #else
1963 mbedtls_sha512_context sha512;
1964
1965 mbedtls_sha512_init( &sha512 );
1966
1967 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1968
1969 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1970 mbedtls_sha512_finish_ret( &sha512, hash );
1971
1972 *hlen = 48;
1973
1974 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1975 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1976
1977 mbedtls_sha512_free( &sha512 );
1978 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1979 return;
1980 }
1981 #endif /* MBEDTLS_SHA512_C && !MBEDTLS_SHA512_NO_SHA384 */
1982 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1983
1984 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
mbedtls_ssl_psk_derive_premaster(mbedtls_ssl_context * ssl,mbedtls_key_exchange_type_t key_ex)1985 int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
1986 {
1987 unsigned char *p = ssl->handshake->premaster;
1988 unsigned char *end = p + sizeof( ssl->handshake->premaster );
1989 const unsigned char *psk = NULL;
1990 size_t psk_len = 0;
1991
1992 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
1993 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
1994 {
1995 /*
1996 * This should never happen because the existence of a PSK is always
1997 * checked before calling this function
1998 */
1999 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2000 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2001 }
2002
2003 /*
2004 * PMS = struct {
2005 * opaque other_secret<0..2^16-1>;
2006 * opaque psk<0..2^16-1>;
2007 * };
2008 * with "other_secret" depending on the particular key exchange
2009 */
2010 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
2011 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
2012 {
2013 if( end - p < 2 )
2014 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2015
2016 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
2017 p += 2;
2018
2019 if( end < p || (size_t)( end - p ) < psk_len )
2020 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2021
2022 memset( p, 0, psk_len );
2023 p += psk_len;
2024 }
2025 else
2026 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
2027 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2028 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2029 {
2030 /*
2031 * other_secret already set by the ClientKeyExchange message,
2032 * and is 48 bytes long
2033 */
2034 if( end - p < 2 )
2035 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2036
2037 *p++ = 0;
2038 *p++ = 48;
2039 p += 48;
2040 }
2041 else
2042 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2043 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2044 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
2045 {
2046 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2047 size_t len;
2048
2049 /* Write length only when we know the actual value */
2050 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
2051 p + 2, end - ( p + 2 ), &len,
2052 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2053 {
2054 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
2055 return( ret );
2056 }
2057 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
2058 p += 2 + len;
2059
2060 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
2061 }
2062 else
2063 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2064 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2065 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
2066 {
2067 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2068 size_t zlen;
2069
2070 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
2071 p + 2, end - ( p + 2 ),
2072 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2073 {
2074 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
2075 return( ret );
2076 }
2077
2078 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
2079 p += 2 + zlen;
2080
2081 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2082 MBEDTLS_DEBUG_ECDH_Z );
2083 }
2084 else
2085 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
2086 {
2087 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2088 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2089 }
2090
2091 /* opaque psk<0..2^16-1>; */
2092 if( end - p < 2 )
2093 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2094
2095 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
2096 p += 2;
2097
2098 if( end < p || (size_t)( end - p ) < psk_len )
2099 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2100
2101 memcpy( p, psk, psk_len );
2102 p += psk_len;
2103
2104 ssl->handshake->pmslen = p - ssl->handshake->premaster;
2105
2106 return( 0 );
2107 }
2108 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
2109
2110 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
2111 static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
2112
2113 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_resend_hello_request(mbedtls_ssl_context * ssl)2114 int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
2115 {
2116 /* If renegotiation is not enforced, retransmit until we would reach max
2117 * timeout if we were using the usual handshake doubling scheme */
2118 if( ssl->conf->renego_max_records < 0 )
2119 {
2120 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
2121 unsigned char doublings = 1;
2122
2123 while( ratio != 0 )
2124 {
2125 ++doublings;
2126 ratio >>= 1;
2127 }
2128
2129 if( ++ssl->renego_records_seen > doublings )
2130 {
2131 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
2132 return( 0 );
2133 }
2134 }
2135
2136 return( ssl_write_hello_request( ssl ) );
2137 }
2138 #endif
2139 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
2140
2141 #if defined(MBEDTLS_X509_CRT_PARSE_C)
ssl_clear_peer_cert(mbedtls_ssl_session * session)2142 static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
2143 {
2144 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2145 if( session->peer_cert != NULL )
2146 {
2147 mbedtls_x509_crt_free( session->peer_cert );
2148 mbedtls_free( session->peer_cert );
2149 session->peer_cert = NULL;
2150 }
2151 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2152 if( session->peer_cert_digest != NULL )
2153 {
2154 /* Zeroization is not necessary. */
2155 mbedtls_free( session->peer_cert_digest );
2156 session->peer_cert_digest = NULL;
2157 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
2158 session->peer_cert_digest_len = 0;
2159 }
2160 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2161 }
2162 #endif /* MBEDTLS_X509_CRT_PARSE_C */
2163
2164 /*
2165 * Handshake functions
2166 */
2167 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
2168 /* No certificate support -> dummy functions */
mbedtls_ssl_write_certificate(mbedtls_ssl_context * ssl)2169 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
2170 {
2171 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2172 ssl->handshake->ciphersuite_info;
2173
2174 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
2175
2176 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2177 {
2178 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
2179 ssl->state++;
2180 return( 0 );
2181 }
2182
2183 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2184 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2185 }
2186
mbedtls_ssl_parse_certificate(mbedtls_ssl_context * ssl)2187 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
2188 {
2189 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2190 ssl->handshake->ciphersuite_info;
2191
2192 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2193
2194 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2195 {
2196 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
2197 ssl->state++;
2198 return( 0 );
2199 }
2200
2201 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2202 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2203 }
2204
2205 #else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
2206 /* Some certificate support -> implement write and parse */
2207
mbedtls_ssl_write_certificate(mbedtls_ssl_context * ssl)2208 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
2209 {
2210 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2211 size_t i, n;
2212 const mbedtls_x509_crt *crt;
2213 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2214 ssl->handshake->ciphersuite_info;
2215
2216 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
2217
2218 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2219 {
2220 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
2221 ssl->state++;
2222 return( 0 );
2223 }
2224
2225 #if defined(MBEDTLS_SSL_CLI_C)
2226 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
2227 {
2228 if( ssl->client_auth == 0 )
2229 {
2230 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
2231 ssl->state++;
2232 return( 0 );
2233 }
2234
2235 #if defined(MBEDTLS_SSL_PROTO_SSL3)
2236 /*
2237 * If using SSLv3 and got no cert, send an Alert message
2238 * (otherwise an empty Certificate message will be sent).
2239 */
2240 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
2241 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
2242 {
2243 ssl->out_msglen = 2;
2244 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
2245 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
2246 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
2247
2248 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
2249 goto write_msg;
2250 }
2251 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
2252 }
2253 #endif /* MBEDTLS_SSL_CLI_C */
2254 #if defined(MBEDTLS_SSL_SRV_C)
2255 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2256 {
2257 if( mbedtls_ssl_own_cert( ssl ) == NULL )
2258 {
2259 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
2260 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
2261 }
2262 }
2263 #endif
2264
2265 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
2266
2267 /*
2268 * 0 . 0 handshake type
2269 * 1 . 3 handshake length
2270 * 4 . 6 length of all certs
2271 * 7 . 9 length of cert. 1
2272 * 10 . n-1 peer certificate
2273 * n . n+2 length of cert. 2
2274 * n+3 . ... upper level cert, etc.
2275 */
2276 i = 7;
2277 crt = mbedtls_ssl_own_cert( ssl );
2278
2279 while( crt != NULL )
2280 {
2281 n = crt->raw.len;
2282 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
2283 {
2284 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
2285 " > %" MBEDTLS_PRINTF_SIZET,
2286 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
2287 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
2288 }
2289
2290 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
2291 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
2292 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
2293
2294 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
2295 i += n; crt = crt->next;
2296 }
2297
2298 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
2299 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
2300 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
2301
2302 ssl->out_msglen = i;
2303 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2304 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
2305
2306 #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
2307 write_msg:
2308 #endif
2309
2310 ssl->state++;
2311
2312 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
2313 {
2314 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
2315 return( ret );
2316 }
2317
2318 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
2319
2320 return( ret );
2321 }
2322
2323 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
2324
2325 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ssl_check_peer_crt_unchanged(mbedtls_ssl_context * ssl,unsigned char * crt_buf,size_t crt_buf_len)2326 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
2327 unsigned char *crt_buf,
2328 size_t crt_buf_len )
2329 {
2330 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
2331
2332 if( peer_crt == NULL )
2333 return( -1 );
2334
2335 if( peer_crt->raw.len != crt_buf_len )
2336 return( -1 );
2337
2338 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
2339 }
2340 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
ssl_check_peer_crt_unchanged(mbedtls_ssl_context * ssl,unsigned char * crt_buf,size_t crt_buf_len)2341 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
2342 unsigned char *crt_buf,
2343 size_t crt_buf_len )
2344 {
2345 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2346 unsigned char const * const peer_cert_digest =
2347 ssl->session->peer_cert_digest;
2348 mbedtls_md_type_t const peer_cert_digest_type =
2349 ssl->session->peer_cert_digest_type;
2350 mbedtls_md_info_t const * const digest_info =
2351 mbedtls_md_info_from_type( peer_cert_digest_type );
2352 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
2353 size_t digest_len;
2354
2355 if( peer_cert_digest == NULL || digest_info == NULL )
2356 return( -1 );
2357
2358 digest_len = mbedtls_md_get_size( digest_info );
2359 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
2360 return( -1 );
2361
2362 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
2363 if( ret != 0 )
2364 return( -1 );
2365
2366 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
2367 }
2368 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2369 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
2370
2371 /*
2372 * Once the certificate message is read, parse it into a cert chain and
2373 * perform basic checks, but leave actual verification to the caller
2374 */
ssl_parse_certificate_chain(mbedtls_ssl_context * ssl,mbedtls_x509_crt * chain)2375 static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
2376 mbedtls_x509_crt *chain )
2377 {
2378 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2379 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
2380 int crt_cnt=0;
2381 #endif
2382 size_t i, n;
2383 uint8_t alert;
2384
2385 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2386 {
2387 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2388 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2389 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2390 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2391 }
2392
2393 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
2394 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
2395 {
2396 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2397 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2398 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2399 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2400 }
2401
2402 i = mbedtls_ssl_hs_hdr_len( ssl );
2403
2404 /*
2405 * Same message structure as in mbedtls_ssl_write_certificate()
2406 */
2407 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
2408
2409 if( ssl->in_msg[i] != 0 ||
2410 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
2411 {
2412 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2413 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2414 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2415 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2416 }
2417
2418 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
2419 i += 3;
2420
2421 /* Iterate through and parse the CRTs in the provided chain. */
2422 while( i < ssl->in_hslen )
2423 {
2424 /* Check that there's room for the next CRT's length fields. */
2425 if ( i + 3 > ssl->in_hslen ) {
2426 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2427 mbedtls_ssl_send_alert_message( ssl,
2428 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2429 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2430 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2431 }
2432 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
2433 * anything beyond 2**16 ~ 64K. */
2434 if( ssl->in_msg[i] != 0 )
2435 {
2436 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2437 mbedtls_ssl_send_alert_message( ssl,
2438 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2439 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2440 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2441 }
2442
2443 /* Read length of the next CRT in the chain. */
2444 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
2445 | (unsigned int) ssl->in_msg[i + 2];
2446 i += 3;
2447
2448 if( n < 128 || i + n > ssl->in_hslen )
2449 {
2450 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2451 mbedtls_ssl_send_alert_message( ssl,
2452 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2453 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2454 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2455 }
2456
2457 /* Check if we're handling the first CRT in the chain. */
2458 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
2459 if( crt_cnt++ == 0 &&
2460 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2461 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
2462 {
2463 /* During client-side renegotiation, check that the server's
2464 * end-CRTs hasn't changed compared to the initial handshake,
2465 * mitigating the triple handshake attack. On success, reuse
2466 * the original end-CRT instead of parsing it again. */
2467 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
2468 if( ssl_check_peer_crt_unchanged( ssl,
2469 &ssl->in_msg[i],
2470 n ) != 0 )
2471 {
2472 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
2473 mbedtls_ssl_send_alert_message( ssl,
2474 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2475 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
2476 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2477 }
2478
2479 /* Now we can safely free the original chain. */
2480 ssl_clear_peer_cert( ssl->session );
2481 }
2482 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
2483
2484 /* Parse the next certificate in the chain. */
2485 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2486 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
2487 #else
2488 /* If we don't need to store the CRT chain permanently, parse
2489 * it in-place from the input buffer instead of making a copy. */
2490 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
2491 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2492 switch( ret )
2493 {
2494 case 0: /*ok*/
2495 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
2496 /* Ignore certificate with an unknown algorithm: maybe a
2497 prior certificate was already trusted. */
2498 break;
2499
2500 case MBEDTLS_ERR_X509_ALLOC_FAILED:
2501 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
2502 goto crt_parse_der_failed;
2503
2504 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
2505 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2506 goto crt_parse_der_failed;
2507
2508 default:
2509 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
2510 crt_parse_der_failed:
2511 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
2512 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
2513 return( ret );
2514 }
2515
2516 i += n;
2517 }
2518
2519 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
2520 return( 0 );
2521 }
2522
2523 #if defined(MBEDTLS_SSL_SRV_C)
ssl_srv_check_client_no_crt_notification(mbedtls_ssl_context * ssl)2524 static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
2525 {
2526 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
2527 return( -1 );
2528
2529 #if defined(MBEDTLS_SSL_PROTO_SSL3)
2530 /*
2531 * Check if the client sent an empty certificate
2532 */
2533 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
2534 {
2535 if( ssl->in_msglen == 2 &&
2536 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
2537 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
2538 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
2539 {
2540 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
2541 return( 0 );
2542 }
2543
2544 return( -1 );
2545 }
2546 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
2547
2548 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2549 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2550 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
2551 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2552 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
2553 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
2554 {
2555 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
2556 return( 0 );
2557 }
2558
2559 return( -1 );
2560 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2561 MBEDTLS_SSL_PROTO_TLS1_2 */
2562 }
2563 #endif /* MBEDTLS_SSL_SRV_C */
2564
2565 /* Check if a certificate message is expected.
2566 * Return either
2567 * - SSL_CERTIFICATE_EXPECTED, or
2568 * - SSL_CERTIFICATE_SKIP
2569 * indicating whether a Certificate message is expected or not.
2570 */
2571 #define SSL_CERTIFICATE_EXPECTED 0
2572 #define SSL_CERTIFICATE_SKIP 1
ssl_parse_certificate_coordinate(mbedtls_ssl_context * ssl,int authmode)2573 static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
2574 int authmode )
2575 {
2576 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2577 ssl->handshake->ciphersuite_info;
2578
2579 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2580 return( SSL_CERTIFICATE_SKIP );
2581
2582 #if defined(MBEDTLS_SSL_SRV_C)
2583 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2584 {
2585 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2586 return( SSL_CERTIFICATE_SKIP );
2587
2588 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2589 {
2590 ssl->session_negotiate->verify_result =
2591 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
2592 return( SSL_CERTIFICATE_SKIP );
2593 }
2594 }
2595 #else
2596 ((void) authmode);
2597 #endif /* MBEDTLS_SSL_SRV_C */
2598
2599 return( SSL_CERTIFICATE_EXPECTED );
2600 }
2601
ssl_parse_certificate_verify(mbedtls_ssl_context * ssl,int authmode,mbedtls_x509_crt * chain,void * rs_ctx)2602 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
2603 int authmode,
2604 mbedtls_x509_crt *chain,
2605 void *rs_ctx )
2606 {
2607 int ret = 0;
2608 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2609 ssl->handshake->ciphersuite_info;
2610 int have_ca_chain = 0;
2611
2612 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
2613 void *p_vrfy;
2614
2615 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2616 return( 0 );
2617
2618 if( ssl->f_vrfy != NULL )
2619 {
2620 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
2621 f_vrfy = ssl->f_vrfy;
2622 p_vrfy = ssl->p_vrfy;
2623 }
2624 else
2625 {
2626 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
2627 f_vrfy = ssl->conf->f_vrfy;
2628 p_vrfy = ssl->conf->p_vrfy;
2629 }
2630
2631 /*
2632 * Main check: verify certificate
2633 */
2634 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
2635 if( ssl->conf->f_ca_cb != NULL )
2636 {
2637 ((void) rs_ctx);
2638 have_ca_chain = 1;
2639
2640 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
2641 ret = mbedtls_x509_crt_verify_with_ca_cb(
2642 chain,
2643 ssl->conf->f_ca_cb,
2644 ssl->conf->p_ca_cb,
2645 ssl->conf->cert_profile,
2646 ssl->hostname,
2647 &ssl->session_negotiate->verify_result,
2648 f_vrfy, p_vrfy );
2649 }
2650 else
2651 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
2652 {
2653 mbedtls_x509_crt *ca_chain;
2654 mbedtls_x509_crl *ca_crl;
2655
2656 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2657 if( ssl->handshake->sni_ca_chain != NULL )
2658 {
2659 ca_chain = ssl->handshake->sni_ca_chain;
2660 ca_crl = ssl->handshake->sni_ca_crl;
2661 }
2662 else
2663 #endif
2664 {
2665 ca_chain = ssl->conf->ca_chain;
2666 ca_crl = ssl->conf->ca_crl;
2667 }
2668
2669 if( ca_chain != NULL )
2670 have_ca_chain = 1;
2671
2672 ret = mbedtls_x509_crt_verify_restartable(
2673 chain,
2674 ca_chain, ca_crl,
2675 ssl->conf->cert_profile,
2676 ssl->hostname,
2677 &ssl->session_negotiate->verify_result,
2678 f_vrfy, p_vrfy, rs_ctx );
2679 }
2680
2681 if( ret != 0 )
2682 {
2683 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
2684 }
2685
2686 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2687 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2688 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
2689 #endif
2690
2691 /*
2692 * Secondary checks: always done, but change 'ret' only if it was 0
2693 */
2694
2695 #if defined(MBEDTLS_ECP_C)
2696 {
2697 const mbedtls_pk_context *pk = &chain->pk;
2698
2699 /* If certificate uses an EC key, make sure the curve is OK */
2700 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
2701 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
2702 {
2703 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
2704
2705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
2706 if( ret == 0 )
2707 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
2708 }
2709 }
2710 #endif /* MBEDTLS_ECP_C */
2711
2712 if( mbedtls_ssl_check_cert_usage( chain,
2713 ciphersuite_info,
2714 ! ssl->conf->endpoint,
2715 &ssl->session_negotiate->verify_result ) != 0 )
2716 {
2717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
2718 if( ret == 0 )
2719 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
2720 }
2721
2722 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
2723 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
2724 * with details encoded in the verification flags. All other kinds
2725 * of error codes, including those from the user provided f_vrfy
2726 * functions, are treated as fatal and lead to a failure of
2727 * ssl_parse_certificate even if verification was optional. */
2728 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
2729 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
2730 ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
2731 {
2732 ret = 0;
2733 }
2734
2735 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
2736 {
2737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
2738 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
2739 }
2740
2741 if( ret != 0 )
2742 {
2743 uint8_t alert;
2744
2745 /* The certificate may have been rejected for several reasons.
2746 Pick one and send the corresponding alert. Which alert to send
2747 may be a subject of debate in some cases. */
2748 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
2749 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
2750 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
2751 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
2752 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
2753 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2754 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
2755 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2756 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
2757 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2758 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
2759 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2760 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
2761 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2762 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
2763 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
2764 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
2765 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
2766 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
2767 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
2768 else
2769 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
2770 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2771 alert );
2772 }
2773
2774 #if defined(MBEDTLS_DEBUG_C)
2775 if( ssl->session_negotiate->verify_result != 0 )
2776 {
2777 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
2778 (unsigned int) ssl->session_negotiate->verify_result ) );
2779 }
2780 else
2781 {
2782 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
2783 }
2784 #endif /* MBEDTLS_DEBUG_C */
2785
2786 return( ret );
2787 }
2788
2789 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ssl_remember_peer_crt_digest(mbedtls_ssl_context * ssl,unsigned char * start,size_t len)2790 static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
2791 unsigned char *start, size_t len )
2792 {
2793 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2794 /* Remember digest of the peer's end-CRT. */
2795 ssl->session_negotiate->peer_cert_digest =
2796 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
2797 if( ssl->session_negotiate->peer_cert_digest == NULL )
2798 {
2799 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
2800 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
2801 mbedtls_ssl_send_alert_message( ssl,
2802 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2803 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2804
2805 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2806 }
2807
2808 ret = mbedtls_md( mbedtls_md_info_from_type(
2809 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
2810 start, len,
2811 ssl->session_negotiate->peer_cert_digest );
2812
2813 ssl->session_negotiate->peer_cert_digest_type =
2814 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
2815 ssl->session_negotiate->peer_cert_digest_len =
2816 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
2817
2818 return( ret );
2819 }
2820
ssl_remember_peer_pubkey(mbedtls_ssl_context * ssl,unsigned char * start,size_t len)2821 static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
2822 unsigned char *start, size_t len )
2823 {
2824 unsigned char *end = start + len;
2825 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2826
2827 /* Make a copy of the peer's raw public key. */
2828 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
2829 ret = mbedtls_pk_parse_subpubkey( &start, end,
2830 &ssl->handshake->peer_pubkey );
2831 if( ret != 0 )
2832 {
2833 /* We should have parsed the public key before. */
2834 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2835 }
2836
2837 return( 0 );
2838 }
2839 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2840
mbedtls_ssl_parse_certificate(mbedtls_ssl_context * ssl)2841 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
2842 {
2843 int ret = 0;
2844 int crt_expected;
2845 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2846 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
2847 ? ssl->handshake->sni_authmode
2848 : ssl->conf->authmode;
2849 #else
2850 const int authmode = ssl->conf->authmode;
2851 #endif
2852 void *rs_ctx = NULL;
2853 mbedtls_x509_crt *chain = NULL;
2854
2855 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2856
2857 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
2858 if( crt_expected == SSL_CERTIFICATE_SKIP )
2859 {
2860 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
2861 goto exit;
2862 }
2863
2864 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2865 if( ssl->handshake->ecrs_enabled &&
2866 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
2867 {
2868 chain = ssl->handshake->ecrs_peer_cert;
2869 ssl->handshake->ecrs_peer_cert = NULL;
2870 goto crt_verify;
2871 }
2872 #endif
2873
2874 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2875 {
2876 /* mbedtls_ssl_read_record may have sent an alert already. We
2877 let it decide whether to alert. */
2878 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2879 goto exit;
2880 }
2881
2882 #if defined(MBEDTLS_SSL_SRV_C)
2883 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
2884 {
2885 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
2886
2887 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
2888 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
2889
2890 goto exit;
2891 }
2892 #endif /* MBEDTLS_SSL_SRV_C */
2893
2894 /* Clear existing peer CRT structure in case we tried to
2895 * reuse a session but it failed, and allocate a new one. */
2896 ssl_clear_peer_cert( ssl->session_negotiate );
2897
2898 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
2899 if( chain == NULL )
2900 {
2901 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
2902 sizeof( mbedtls_x509_crt ) ) );
2903 mbedtls_ssl_send_alert_message( ssl,
2904 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2905 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2906
2907 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
2908 goto exit;
2909 }
2910 mbedtls_x509_crt_init( chain );
2911
2912 ret = ssl_parse_certificate_chain( ssl, chain );
2913 if( ret != 0 )
2914 goto exit;
2915
2916 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2917 if( ssl->handshake->ecrs_enabled)
2918 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
2919
2920 crt_verify:
2921 if( ssl->handshake->ecrs_enabled)
2922 rs_ctx = &ssl->handshake->ecrs_ctx;
2923 #endif
2924
2925 ret = ssl_parse_certificate_verify( ssl, authmode,
2926 chain, rs_ctx );
2927 if( ret != 0 )
2928 goto exit;
2929
2930 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2931 {
2932 unsigned char *crt_start, *pk_start;
2933 size_t crt_len, pk_len;
2934
2935 /* We parse the CRT chain without copying, so
2936 * these pointers point into the input buffer,
2937 * and are hence still valid after freeing the
2938 * CRT chain. */
2939
2940 crt_start = chain->raw.p;
2941 crt_len = chain->raw.len;
2942
2943 pk_start = chain->pk_raw.p;
2944 pk_len = chain->pk_raw.len;
2945
2946 /* Free the CRT structures before computing
2947 * digest and copying the peer's public key. */
2948 mbedtls_x509_crt_free( chain );
2949 mbedtls_free( chain );
2950 chain = NULL;
2951
2952 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
2953 if( ret != 0 )
2954 goto exit;
2955
2956 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
2957 if( ret != 0 )
2958 goto exit;
2959 }
2960 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2961 /* Pass ownership to session structure. */
2962 ssl->session_negotiate->peer_cert = chain;
2963 chain = NULL;
2964 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2965
2966 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
2967
2968 exit:
2969
2970 if( ret == 0 )
2971 ssl->state++;
2972
2973 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2974 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
2975 {
2976 ssl->handshake->ecrs_peer_cert = chain;
2977 chain = NULL;
2978 }
2979 #endif
2980
2981 if( chain != NULL )
2982 {
2983 mbedtls_x509_crt_free( chain );
2984 mbedtls_free( chain );
2985 }
2986
2987 return( ret );
2988 }
2989 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
2990
mbedtls_ssl_optimize_checksum(mbedtls_ssl_context * ssl,const mbedtls_ssl_ciphersuite_t * ciphersuite_info)2991 void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
2992 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
2993 {
2994 ((void) ciphersuite_info);
2995
2996 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2997 defined(MBEDTLS_SSL_PROTO_TLS1_1)
2998 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
2999 ssl->handshake->update_checksum = ssl_update_checksum_md5sha1;
3000 else
3001 #endif
3002 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3003 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
3004 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
3005 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
3006 else
3007 #endif
3008 #if defined(MBEDTLS_SHA256_C)
3009 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
3010 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
3011 else
3012 #endif
3013 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3014 {
3015 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3016 return;
3017 }
3018 }
3019
mbedtls_ssl_reset_checksum(mbedtls_ssl_context * ssl)3020 void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
3021 {
3022 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3023 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3024 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
3025 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
3026 #endif
3027 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3028 #if defined(MBEDTLS_SHA256_C)
3029 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3030 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
3031 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
3032 #else
3033 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
3034 #endif
3035 #endif
3036 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
3037 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3038 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
3039 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
3040 #else
3041 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
3042 #endif
3043 #endif
3044 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3045 }
3046
ssl_update_checksum_start(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)3047 static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
3048 const unsigned char *buf, size_t len )
3049 {
3050 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3051 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3052 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
3053 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
3054 #endif
3055 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3056 #if defined(MBEDTLS_SHA256_C)
3057 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3058 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
3059 #else
3060 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
3061 #endif
3062 #endif
3063 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
3064 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3065 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
3066 #else
3067 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
3068 #endif
3069 #endif
3070 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3071 }
3072
3073 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3074 defined(MBEDTLS_SSL_PROTO_TLS1_1)
ssl_update_checksum_md5sha1(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)3075 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *ssl,
3076 const unsigned char *buf, size_t len )
3077 {
3078 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
3079 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
3080 }
3081 #endif
3082
3083 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3084 #if defined(MBEDTLS_SHA256_C)
ssl_update_checksum_sha256(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)3085 static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
3086 const unsigned char *buf, size_t len )
3087 {
3088 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3089 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
3090 #else
3091 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
3092 #endif
3093 }
3094 #endif
3095
3096 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
ssl_update_checksum_sha384(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)3097 static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
3098 const unsigned char *buf, size_t len )
3099 {
3100 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3101 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
3102 #else
3103 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
3104 #endif
3105 }
3106 #endif
3107 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3108
3109 #if defined(MBEDTLS_SSL_PROTO_SSL3)
ssl_calc_finished_ssl(mbedtls_ssl_context * ssl,unsigned char * buf,int from)3110 static void ssl_calc_finished_ssl(
3111 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
3112 {
3113 const char *sender;
3114 mbedtls_md5_context md5;
3115 mbedtls_sha1_context sha1;
3116
3117 unsigned char padbuf[48];
3118 unsigned char md5sum[16];
3119 unsigned char sha1sum[20];
3120
3121 mbedtls_ssl_session *session = ssl->session_negotiate;
3122 if( !session )
3123 session = ssl->session;
3124
3125 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
3126
3127 mbedtls_md5_init( &md5 );
3128 mbedtls_sha1_init( &sha1 );
3129
3130 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
3131 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
3132
3133 /*
3134 * SSLv3:
3135 * hash =
3136 * MD5( master + pad2 +
3137 * MD5( handshake + sender + master + pad1 ) )
3138 * + SHA1( master + pad2 +
3139 * SHA1( handshake + sender + master + pad1 ) )
3140 */
3141
3142 #if !defined(MBEDTLS_MD5_ALT)
3143 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
3144 md5.state, sizeof( md5.state ) );
3145 #endif
3146
3147 #if !defined(MBEDTLS_SHA1_ALT)
3148 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
3149 sha1.state, sizeof( sha1.state ) );
3150 #endif
3151
3152 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
3153 : "SRVR";
3154
3155 memset( padbuf, 0x36, 48 );
3156
3157 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
3158 mbedtls_md5_update_ret( &md5, session->master, 48 );
3159 mbedtls_md5_update_ret( &md5, padbuf, 48 );
3160 mbedtls_md5_finish_ret( &md5, md5sum );
3161
3162 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
3163 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
3164 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
3165 mbedtls_sha1_finish_ret( &sha1, sha1sum );
3166
3167 memset( padbuf, 0x5C, 48 );
3168
3169 mbedtls_md5_starts_ret( &md5 );
3170 mbedtls_md5_update_ret( &md5, session->master, 48 );
3171 mbedtls_md5_update_ret( &md5, padbuf, 48 );
3172 mbedtls_md5_update_ret( &md5, md5sum, 16 );
3173 mbedtls_md5_finish_ret( &md5, buf );
3174
3175 mbedtls_sha1_starts_ret( &sha1 );
3176 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
3177 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
3178 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
3179 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
3180
3181 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
3182
3183 mbedtls_md5_free( &md5 );
3184 mbedtls_sha1_free( &sha1 );
3185
3186 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
3187 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
3188 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
3189
3190 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
3191 }
3192 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
3193
3194 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
ssl_calc_finished_tls(mbedtls_ssl_context * ssl,unsigned char * buf,int from)3195 static void ssl_calc_finished_tls(
3196 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
3197 {
3198 int len = 12;
3199 const char *sender;
3200 mbedtls_md5_context md5;
3201 mbedtls_sha1_context sha1;
3202 unsigned char padbuf[36];
3203
3204 mbedtls_ssl_session *session = ssl->session_negotiate;
3205 if( !session )
3206 session = ssl->session;
3207
3208 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
3209
3210 mbedtls_md5_init( &md5 );
3211 mbedtls_sha1_init( &sha1 );
3212
3213 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
3214 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
3215
3216 /*
3217 * TLSv1:
3218 * hash = PRF( master, finished_label,
3219 * MD5( handshake ) + SHA1( handshake ) )[0..11]
3220 */
3221
3222 #if !defined(MBEDTLS_MD5_ALT)
3223 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
3224 md5.state, sizeof( md5.state ) );
3225 #endif
3226
3227 #if !defined(MBEDTLS_SHA1_ALT)
3228 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
3229 sha1.state, sizeof( sha1.state ) );
3230 #endif
3231
3232 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
3233 ? "client finished"
3234 : "server finished";
3235
3236 mbedtls_md5_finish_ret( &md5, padbuf );
3237 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
3238
3239 ssl->handshake->tls_prf( session->master, 48, sender,
3240 padbuf, 36, buf, len );
3241
3242 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
3243
3244 mbedtls_md5_free( &md5 );
3245 mbedtls_sha1_free( &sha1 );
3246
3247 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
3248
3249 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
3250 }
3251 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
3252
3253 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3254 #if defined(MBEDTLS_SHA256_C)
ssl_calc_finished_tls_sha256(mbedtls_ssl_context * ssl,unsigned char * buf,int from)3255 static void ssl_calc_finished_tls_sha256(
3256 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
3257 {
3258 int len = 12;
3259 const char *sender;
3260 unsigned char padbuf[32];
3261 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3262 size_t hash_size;
3263 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
3264 psa_status_t status;
3265 #else
3266 mbedtls_sha256_context sha256;
3267 #endif
3268
3269 mbedtls_ssl_session *session = ssl->session_negotiate;
3270 if( !session )
3271 session = ssl->session;
3272
3273 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
3274 ? "client finished"
3275 : "server finished";
3276
3277 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3278 sha256_psa = psa_hash_operation_init();
3279
3280 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
3281
3282 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
3283 if( status != PSA_SUCCESS )
3284 {
3285 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
3286 return;
3287 }
3288
3289 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
3290 if( status != PSA_SUCCESS )
3291 {
3292 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
3293 return;
3294 }
3295 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
3296 #else
3297
3298 mbedtls_sha256_init( &sha256 );
3299
3300 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
3301
3302 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
3303
3304 /*
3305 * TLSv1.2:
3306 * hash = PRF( master, finished_label,
3307 * Hash( handshake ) )[0.11]
3308 */
3309
3310 #if !defined(MBEDTLS_SHA256_ALT)
3311 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
3312 sha256.state, sizeof( sha256.state ) );
3313 #endif
3314
3315 mbedtls_sha256_finish_ret( &sha256, padbuf );
3316 mbedtls_sha256_free( &sha256 );
3317 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3318
3319 ssl->handshake->tls_prf( session->master, 48, sender,
3320 padbuf, 32, buf, len );
3321
3322 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
3323
3324 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
3325
3326 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
3327 }
3328 #endif /* MBEDTLS_SHA256_C */
3329
3330 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
3331
ssl_calc_finished_tls_sha384(mbedtls_ssl_context * ssl,unsigned char * buf,int from)3332 static void ssl_calc_finished_tls_sha384(
3333 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
3334 {
3335 int len = 12;
3336 const char *sender;
3337 unsigned char padbuf[48];
3338 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3339 size_t hash_size;
3340 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
3341 psa_status_t status;
3342 #else
3343 mbedtls_sha512_context sha512;
3344 #endif
3345
3346 mbedtls_ssl_session *session = ssl->session_negotiate;
3347 if( !session )
3348 session = ssl->session;
3349
3350 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
3351 ? "client finished"
3352 : "server finished";
3353
3354 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3355 sha384_psa = psa_hash_operation_init();
3356
3357 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
3358
3359 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
3360 if( status != PSA_SUCCESS )
3361 {
3362 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
3363 return;
3364 }
3365
3366 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
3367 if( status != PSA_SUCCESS )
3368 {
3369 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
3370 return;
3371 }
3372 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
3373 #else
3374 mbedtls_sha512_init( &sha512 );
3375
3376 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
3377
3378 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
3379
3380 /*
3381 * TLSv1.2:
3382 * hash = PRF( master, finished_label,
3383 * Hash( handshake ) )[0.11]
3384 */
3385
3386 #if !defined(MBEDTLS_SHA512_ALT)
3387 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
3388 sha512.state, sizeof( sha512.state ) );
3389 #endif
3390 /* mbedtls_sha512_finish_ret's output parameter is declared as a
3391 * 64-byte buffer, but sice we're using SHA-384, we know that the
3392 * output fits in 48 bytes. This is correct C, but GCC 11.1 warns
3393 * about it.
3394 */
3395 #if defined(__GNUC__) && __GNUC__ >= 11
3396 #pragma GCC diagnostic push
3397 #pragma GCC diagnostic ignored "-Wstringop-overflow"
3398 #endif
3399 mbedtls_sha512_finish_ret( &sha512, padbuf );
3400 #if defined(__GNUC__) && __GNUC__ >= 11
3401 #pragma GCC diagnostic pop
3402 #endif
3403
3404 mbedtls_sha512_free( &sha512 );
3405 #endif
3406
3407 ssl->handshake->tls_prf( session->master, 48, sender,
3408 padbuf, 48, buf, len );
3409
3410 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
3411
3412 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
3413
3414 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
3415 }
3416 #endif /* MBEDTLS_SHA512_C && !MBEDTLS_SHA512_NO_SHA384 */
3417 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3418
mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context * ssl)3419 void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
3420 {
3421 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
3422
3423 /*
3424 * Free our handshake params
3425 */
3426 mbedtls_ssl_handshake_free( ssl );
3427 mbedtls_free( ssl->handshake );
3428 ssl->handshake = NULL;
3429
3430 /*
3431 * Free the previous transform and swith in the current one
3432 */
3433 if( ssl->transform )
3434 {
3435 mbedtls_ssl_transform_free( ssl->transform );
3436 mbedtls_free( ssl->transform );
3437 }
3438 ssl->transform = ssl->transform_negotiate;
3439 ssl->transform_negotiate = NULL;
3440
3441 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
3442 }
3443
mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context * ssl)3444 void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
3445 {
3446 int resume = ssl->handshake->resume;
3447
3448 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
3449
3450 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3451 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
3452 {
3453 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
3454 ssl->renego_records_seen = 0;
3455 }
3456 #endif
3457
3458 /*
3459 * Free the previous session and switch in the current one
3460 */
3461 if( ssl->session )
3462 {
3463 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
3464 /* RFC 7366 3.1: keep the EtM state */
3465 ssl->session_negotiate->encrypt_then_mac =
3466 ssl->session->encrypt_then_mac;
3467 #endif
3468
3469 mbedtls_ssl_session_free( ssl->session );
3470 mbedtls_free( ssl->session );
3471 }
3472 ssl->session = ssl->session_negotiate;
3473 ssl->session_negotiate = NULL;
3474
3475 /*
3476 * Add cache entry
3477 */
3478 if( ssl->conf->f_set_cache != NULL &&
3479 ssl->session->id_len != 0 &&
3480 resume == 0 )
3481 {
3482 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
3483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
3484 }
3485
3486 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3487 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3488 ssl->handshake->flight != NULL )
3489 {
3490 /* Cancel handshake timer */
3491 mbedtls_ssl_set_timer( ssl, 0 );
3492
3493 /* Keep last flight around in case we need to resend it:
3494 * we need the handshake and transform structures for that */
3495 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
3496 }
3497 else
3498 #endif
3499 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
3500
3501 ssl->state++;
3502
3503 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
3504 }
3505
mbedtls_ssl_write_finished(mbedtls_ssl_context * ssl)3506 int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
3507 {
3508 int ret, hash_len;
3509
3510 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
3511
3512 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
3513
3514 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
3515
3516 /*
3517 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
3518 * may define some other value. Currently (early 2016), no defined
3519 * ciphersuite does this (and this is unlikely to change as activity has
3520 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
3521 */
3522 hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
3523
3524 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3525 ssl->verify_data_len = hash_len;
3526 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
3527 #endif
3528
3529 ssl->out_msglen = 4 + hash_len;
3530 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3531 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
3532
3533 /*
3534 * In case of session resuming, invert the client and server
3535 * ChangeCipherSpec messages order.
3536 */
3537 if( ssl->handshake->resume != 0 )
3538 {
3539 #if defined(MBEDTLS_SSL_CLI_C)
3540 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3541 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
3542 #endif
3543 #if defined(MBEDTLS_SSL_SRV_C)
3544 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
3545 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
3546 #endif
3547 }
3548 else
3549 ssl->state++;
3550
3551 /*
3552 * Switch to our negotiated transform and session parameters for outbound
3553 * data.
3554 */
3555 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
3556
3557 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3558 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3559 {
3560 unsigned char i;
3561
3562 /* Remember current epoch settings for resending */
3563 ssl->handshake->alt_transform_out = ssl->transform_out;
3564 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
3565
3566 /* Set sequence_number to zero */
3567 memset( ssl->cur_out_ctr + 2, 0, 6 );
3568
3569 /* Increment epoch */
3570 for( i = 2; i > 0; i-- )
3571 if( ++ssl->cur_out_ctr[i - 1] != 0 )
3572 break;
3573
3574 /* The loop goes to its end iff the counter is wrapping */
3575 if( i == 0 )
3576 {
3577 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
3578 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
3579 }
3580 }
3581 else
3582 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3583 memset( ssl->cur_out_ctr, 0, 8 );
3584
3585 ssl->transform_out = ssl->transform_negotiate;
3586 ssl->session_out = ssl->session_negotiate;
3587
3588 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3589 if( mbedtls_ssl_hw_record_activate != NULL )
3590 {
3591 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
3592 {
3593 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
3594 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3595 }
3596 }
3597 #endif
3598
3599 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3600 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3601 mbedtls_ssl_send_flight_completed( ssl );
3602 #endif
3603
3604 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
3605 {
3606 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
3607 return( ret );
3608 }
3609
3610 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3611 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3612 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3613 {
3614 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
3615 return( ret );
3616 }
3617 #endif
3618
3619 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
3620
3621 return( 0 );
3622 }
3623
3624 #if defined(MBEDTLS_SSL_PROTO_SSL3)
3625 #define SSL_MAX_HASH_LEN 36
3626 #else
3627 #define SSL_MAX_HASH_LEN 12
3628 #endif
3629
mbedtls_ssl_parse_finished(mbedtls_ssl_context * ssl)3630 int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
3631 {
3632 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3633 unsigned int hash_len;
3634 unsigned char buf[SSL_MAX_HASH_LEN];
3635
3636 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
3637
3638 /* There is currently no ciphersuite using another length with TLS 1.2 */
3639 #if defined(MBEDTLS_SSL_PROTO_SSL3)
3640 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
3641 hash_len = 36;
3642 else
3643 #endif
3644 hash_len = 12;
3645
3646 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
3647
3648 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
3649 {
3650 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3651 goto exit;
3652 }
3653
3654 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3655 {
3656 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
3657 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3658 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
3659 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
3660 goto exit;
3661 }
3662
3663 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
3664 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
3665 {
3666 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
3667 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3668 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3669 ret = MBEDTLS_ERR_SSL_BAD_HS_FINISHED;
3670 goto exit;
3671 }
3672
3673 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
3674 buf, hash_len ) != 0 )
3675 {
3676 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
3677 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3678 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
3679 ret = MBEDTLS_ERR_SSL_BAD_HS_FINISHED;
3680 goto exit;
3681 }
3682
3683 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3684 ssl->verify_data_len = hash_len;
3685 memcpy( ssl->peer_verify_data, buf, hash_len );
3686 #endif
3687
3688 if( ssl->handshake->resume != 0 )
3689 {
3690 #if defined(MBEDTLS_SSL_CLI_C)
3691 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3692 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
3693 #endif
3694 #if defined(MBEDTLS_SSL_SRV_C)
3695 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
3696 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
3697 #endif
3698 }
3699 else
3700 ssl->state++;
3701
3702 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3703 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3704 mbedtls_ssl_recv_flight_completed( ssl );
3705 #endif
3706
3707 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
3708
3709 exit:
3710 mbedtls_platform_zeroize( buf, hash_len );
3711 return( ret );
3712 }
3713
ssl_handshake_params_init(mbedtls_ssl_handshake_params * handshake)3714 static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
3715 {
3716 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
3717
3718 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3719 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3720 mbedtls_md5_init( &handshake->fin_md5 );
3721 mbedtls_sha1_init( &handshake->fin_sha1 );
3722 mbedtls_md5_starts_ret( &handshake->fin_md5 );
3723 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
3724 #endif
3725 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3726 #if defined(MBEDTLS_SHA256_C)
3727 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3728 handshake->fin_sha256_psa = psa_hash_operation_init();
3729 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
3730 #else
3731 mbedtls_sha256_init( &handshake->fin_sha256 );
3732 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
3733 #endif
3734 #endif
3735 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
3736 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3737 handshake->fin_sha384_psa = psa_hash_operation_init();
3738 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
3739 #else
3740 mbedtls_sha512_init( &handshake->fin_sha512 );
3741 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
3742 #endif
3743 #endif
3744 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3745
3746 handshake->update_checksum = ssl_update_checksum_start;
3747
3748 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
3749 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3750 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
3751 #endif
3752
3753 #if defined(MBEDTLS_DHM_C)
3754 mbedtls_dhm_init( &handshake->dhm_ctx );
3755 #endif
3756 #if defined(MBEDTLS_ECDH_C)
3757 mbedtls_ecdh_init( &handshake->ecdh_ctx );
3758 #endif
3759 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3760 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
3761 #if defined(MBEDTLS_SSL_CLI_C)
3762 handshake->ecjpake_cache = NULL;
3763 handshake->ecjpake_cache_len = 0;
3764 #endif
3765 #endif
3766
3767 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3768 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
3769 #endif
3770
3771 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3772 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
3773 #endif
3774
3775 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3776 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3777 mbedtls_pk_init( &handshake->peer_pubkey );
3778 #endif
3779 }
3780
mbedtls_ssl_transform_init(mbedtls_ssl_transform * transform)3781 void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
3782 {
3783 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
3784
3785 mbedtls_cipher_init( &transform->cipher_ctx_enc );
3786 mbedtls_cipher_init( &transform->cipher_ctx_dec );
3787
3788 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
3789 mbedtls_md_init( &transform->md_ctx_enc );
3790 mbedtls_md_init( &transform->md_ctx_dec );
3791 #endif
3792 }
3793
mbedtls_ssl_session_init(mbedtls_ssl_session * session)3794 void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
3795 {
3796 memset( session, 0, sizeof(mbedtls_ssl_session) );
3797 }
3798
ssl_handshake_init(mbedtls_ssl_context * ssl)3799 static int ssl_handshake_init( mbedtls_ssl_context *ssl )
3800 {
3801 /* Clear old handshake information if present */
3802 if( ssl->transform_negotiate )
3803 mbedtls_ssl_transform_free( ssl->transform_negotiate );
3804 if( ssl->session_negotiate )
3805 mbedtls_ssl_session_free( ssl->session_negotiate );
3806 if( ssl->handshake )
3807 mbedtls_ssl_handshake_free( ssl );
3808
3809 /*
3810 * Either the pointers are now NULL or cleared properly and can be freed.
3811 * Now allocate missing structures.
3812 */
3813 if( ssl->transform_negotiate == NULL )
3814 {
3815 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
3816 }
3817
3818 if( ssl->session_negotiate == NULL )
3819 {
3820 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
3821 }
3822
3823 if( ssl->handshake == NULL )
3824 {
3825 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
3826 }
3827 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3828 /* If the buffers are too small - reallocate */
3829
3830 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
3831 MBEDTLS_SSL_OUT_BUFFER_LEN );
3832 #endif
3833
3834 /* All pointers should exist and can be directly freed without issue */
3835 if( ssl->handshake == NULL ||
3836 ssl->transform_negotiate == NULL ||
3837 ssl->session_negotiate == NULL )
3838 {
3839 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
3840
3841 mbedtls_free( ssl->handshake );
3842 mbedtls_free( ssl->transform_negotiate );
3843 mbedtls_free( ssl->session_negotiate );
3844
3845 ssl->handshake = NULL;
3846 ssl->transform_negotiate = NULL;
3847 ssl->session_negotiate = NULL;
3848
3849 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3850 }
3851
3852 /* Initialize structures */
3853 mbedtls_ssl_session_init( ssl->session_negotiate );
3854 mbedtls_ssl_transform_init( ssl->transform_negotiate );
3855 ssl_handshake_params_init( ssl->handshake );
3856
3857 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3858 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3859 {
3860 ssl->handshake->alt_transform_out = ssl->transform_out;
3861
3862 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3863 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
3864 else
3865 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
3866
3867 mbedtls_ssl_set_timer( ssl, 0 );
3868 }
3869 #endif
3870
3871 return( 0 );
3872 }
3873
3874 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
3875 /* Dummy cookie callbacks for defaults */
ssl_cookie_write_dummy(void * ctx,unsigned char ** p,unsigned char * end,const unsigned char * cli_id,size_t cli_id_len)3876 static int ssl_cookie_write_dummy( void *ctx,
3877 unsigned char **p, unsigned char *end,
3878 const unsigned char *cli_id, size_t cli_id_len )
3879 {
3880 ((void) ctx);
3881 ((void) p);
3882 ((void) end);
3883 ((void) cli_id);
3884 ((void) cli_id_len);
3885
3886 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3887 }
3888
ssl_cookie_check_dummy(void * ctx,const unsigned char * cookie,size_t cookie_len,const unsigned char * cli_id,size_t cli_id_len)3889 static int ssl_cookie_check_dummy( void *ctx,
3890 const unsigned char *cookie, size_t cookie_len,
3891 const unsigned char *cli_id, size_t cli_id_len )
3892 {
3893 ((void) ctx);
3894 ((void) cookie);
3895 ((void) cookie_len);
3896 ((void) cli_id);
3897 ((void) cli_id_len);
3898
3899 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3900 }
3901 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
3902
3903 /*
3904 * Initialize an SSL context
3905 */
mbedtls_ssl_init(mbedtls_ssl_context * ssl)3906 void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
3907 {
3908 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
3909 }
3910
3911 /*
3912 * Setup an SSL context
3913 */
3914
mbedtls_ssl_setup(mbedtls_ssl_context * ssl,const mbedtls_ssl_config * conf)3915 int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
3916 const mbedtls_ssl_config *conf )
3917 {
3918 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3919 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3920 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3921
3922 ssl->conf = conf;
3923
3924 /*
3925 * Prepare base structures
3926 */
3927
3928 /* Set to NULL in case of an error condition */
3929 ssl->out_buf = NULL;
3930
3931 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3932 ssl->in_buf_len = in_buf_len;
3933 #endif
3934 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
3935 if( ssl->in_buf == NULL )
3936 {
3937 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
3938 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
3939 goto error;
3940 }
3941
3942 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3943 ssl->out_buf_len = out_buf_len;
3944 #endif
3945 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
3946 if( ssl->out_buf == NULL )
3947 {
3948 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
3949 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
3950 goto error;
3951 }
3952
3953 mbedtls_ssl_reset_in_out_pointers( ssl );
3954
3955 #if defined(MBEDTLS_SSL_DTLS_SRTP)
3956 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
3957 #endif
3958
3959 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3960 goto error;
3961
3962 return( 0 );
3963
3964 error:
3965 mbedtls_free( ssl->in_buf );
3966 mbedtls_free( ssl->out_buf );
3967
3968 ssl->conf = NULL;
3969
3970 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3971 ssl->in_buf_len = 0;
3972 ssl->out_buf_len = 0;
3973 #endif
3974 ssl->in_buf = NULL;
3975 ssl->out_buf = NULL;
3976
3977 ssl->in_hdr = NULL;
3978 ssl->in_ctr = NULL;
3979 ssl->in_len = NULL;
3980 ssl->in_iv = NULL;
3981 ssl->in_msg = NULL;
3982
3983 ssl->out_hdr = NULL;
3984 ssl->out_ctr = NULL;
3985 ssl->out_len = NULL;
3986 ssl->out_iv = NULL;
3987 ssl->out_msg = NULL;
3988
3989 return( ret );
3990 }
3991
3992 /*
3993 * Reset an initialized and used SSL context for re-use while retaining
3994 * all application-set variables, function pointers and data.
3995 *
3996 * If partial is non-zero, keep data in the input buffer and client ID.
3997 * (Use when a DTLS client reconnects from the same port.)
3998 */
mbedtls_ssl_session_reset_int(mbedtls_ssl_context * ssl,int partial)3999 int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
4000 {
4001 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4002 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4003 size_t in_buf_len = ssl->in_buf_len;
4004 size_t out_buf_len = ssl->out_buf_len;
4005 #else
4006 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4007 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4008 #endif
4009
4010 #if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
4011 !defined(MBEDTLS_SSL_SRV_C)
4012 ((void) partial);
4013 #endif
4014
4015 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
4016
4017 /* Cancel any possibly running timer */
4018 mbedtls_ssl_set_timer( ssl, 0 );
4019
4020 #if defined(MBEDTLS_SSL_RENEGOTIATION)
4021 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
4022 ssl->renego_records_seen = 0;
4023
4024 ssl->verify_data_len = 0;
4025 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
4026 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
4027 #endif
4028 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
4029
4030 ssl->in_offt = NULL;
4031 mbedtls_ssl_reset_in_out_pointers( ssl );
4032
4033 ssl->in_msgtype = 0;
4034 ssl->in_msglen = 0;
4035 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4036 ssl->next_record_offset = 0;
4037 ssl->in_epoch = 0;
4038 #endif
4039 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4040 mbedtls_ssl_dtls_replay_reset( ssl );
4041 #endif
4042
4043 ssl->in_hslen = 0;
4044 ssl->nb_zero = 0;
4045
4046 ssl->keep_current_message = 0;
4047
4048 ssl->out_msgtype = 0;
4049 ssl->out_msglen = 0;
4050 ssl->out_left = 0;
4051 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
4052 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
4053 ssl->split_done = 0;
4054 #endif
4055
4056 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
4057
4058 ssl->transform_in = NULL;
4059 ssl->transform_out = NULL;
4060
4061 ssl->session_in = NULL;
4062 ssl->session_out = NULL;
4063
4064 memset( ssl->out_buf, 0, out_buf_len );
4065
4066 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
4067 if( partial == 0 )
4068 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
4069 {
4070 ssl->in_left = 0;
4071 memset( ssl->in_buf, 0, in_buf_len );
4072 }
4073
4074 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4075 if( mbedtls_ssl_hw_record_reset != NULL )
4076 {
4077 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
4078 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
4079 {
4080 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
4081 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4082 }
4083 }
4084 #endif
4085
4086 if( ssl->transform )
4087 {
4088 mbedtls_ssl_transform_free( ssl->transform );
4089 mbedtls_free( ssl->transform );
4090 ssl->transform = NULL;
4091 }
4092
4093 if( ssl->session )
4094 {
4095 mbedtls_ssl_session_free( ssl->session );
4096 mbedtls_free( ssl->session );
4097 ssl->session = NULL;
4098 }
4099
4100 #if defined(MBEDTLS_SSL_ALPN)
4101 ssl->alpn_chosen = NULL;
4102 #endif
4103
4104 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
4105 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
4106 if( partial == 0 )
4107 #endif
4108 {
4109 mbedtls_free( ssl->cli_id );
4110 ssl->cli_id = NULL;
4111 ssl->cli_id_len = 0;
4112 }
4113 #endif
4114
4115 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
4116 return( ret );
4117
4118 return( 0 );
4119 }
4120
4121 /*
4122 * Reset an initialized and used SSL context for re-use while retaining
4123 * all application-set variables, function pointers and data.
4124 */
mbedtls_ssl_session_reset(mbedtls_ssl_context * ssl)4125 int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
4126 {
4127 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
4128 }
4129
4130 /*
4131 * SSL set accessors
4132 */
mbedtls_ssl_conf_endpoint(mbedtls_ssl_config * conf,int endpoint)4133 void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
4134 {
4135 conf->endpoint = endpoint;
4136 }
4137
mbedtls_ssl_conf_transport(mbedtls_ssl_config * conf,int transport)4138 void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
4139 {
4140 conf->transport = transport;
4141 }
4142
4143 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
mbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config * conf,char mode)4144 void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
4145 {
4146 conf->anti_replay = mode;
4147 }
4148 #endif
4149
4150 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
mbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config * conf,unsigned limit)4151 void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
4152 {
4153 conf->badmac_limit = limit;
4154 }
4155 #endif
4156
4157 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4158
mbedtls_ssl_set_datagram_packing(mbedtls_ssl_context * ssl,unsigned allow_packing)4159 void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
4160 unsigned allow_packing )
4161 {
4162 ssl->disable_datagram_packing = !allow_packing;
4163 }
4164
mbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config * conf,uint32_t min,uint32_t max)4165 void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
4166 uint32_t min, uint32_t max )
4167 {
4168 conf->hs_timeout_min = min;
4169 conf->hs_timeout_max = max;
4170 }
4171 #endif
4172
mbedtls_ssl_conf_authmode(mbedtls_ssl_config * conf,int authmode)4173 void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
4174 {
4175 conf->authmode = authmode;
4176 }
4177
4178 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_conf_verify(mbedtls_ssl_config * conf,int (* f_vrfy)(void *,mbedtls_x509_crt *,int,uint32_t *),void * p_vrfy)4179 void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
4180 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
4181 void *p_vrfy )
4182 {
4183 conf->f_vrfy = f_vrfy;
4184 conf->p_vrfy = p_vrfy;
4185 }
4186 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4187
mbedtls_ssl_conf_rng(mbedtls_ssl_config * conf,int (* f_rng)(void *,unsigned char *,size_t),void * p_rng)4188 void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
4189 int (*f_rng)(void *, unsigned char *, size_t),
4190 void *p_rng )
4191 {
4192 conf->f_rng = f_rng;
4193 conf->p_rng = p_rng;
4194 }
4195
mbedtls_ssl_conf_dbg(mbedtls_ssl_config * conf,void (* f_dbg)(void *,int,const char *,int,const char *),void * p_dbg)4196 void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
4197 void (*f_dbg)(void *, int, const char *, int, const char *),
4198 void *p_dbg )
4199 {
4200 conf->f_dbg = f_dbg;
4201 conf->p_dbg = p_dbg;
4202 }
4203
mbedtls_ssl_set_bio(mbedtls_ssl_context * ssl,void * p_bio,mbedtls_ssl_send_t * f_send,mbedtls_ssl_recv_t * f_recv,mbedtls_ssl_recv_timeout_t * f_recv_timeout)4204 void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
4205 void *p_bio,
4206 mbedtls_ssl_send_t *f_send,
4207 mbedtls_ssl_recv_t *f_recv,
4208 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
4209 {
4210 ssl->p_bio = p_bio;
4211 ssl->f_send = f_send;
4212 ssl->f_recv = f_recv;
4213 ssl->f_recv_timeout = f_recv_timeout;
4214 }
4215
4216 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_set_mtu(mbedtls_ssl_context * ssl,uint16_t mtu)4217 void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
4218 {
4219 ssl->mtu = mtu;
4220 }
4221 #endif
4222
mbedtls_ssl_conf_read_timeout(mbedtls_ssl_config * conf,uint32_t timeout)4223 void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
4224 {
4225 conf->read_timeout = timeout;
4226 }
4227
mbedtls_ssl_set_timer_cb(mbedtls_ssl_context * ssl,void * p_timer,mbedtls_ssl_set_timer_t * f_set_timer,mbedtls_ssl_get_timer_t * f_get_timer)4228 void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
4229 void *p_timer,
4230 mbedtls_ssl_set_timer_t *f_set_timer,
4231 mbedtls_ssl_get_timer_t *f_get_timer )
4232 {
4233 ssl->p_timer = p_timer;
4234 ssl->f_set_timer = f_set_timer;
4235 ssl->f_get_timer = f_get_timer;
4236
4237 /* Make sure we start with no timer running */
4238 mbedtls_ssl_set_timer( ssl, 0 );
4239 }
4240
4241 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_session_cache(mbedtls_ssl_config * conf,void * p_cache,int (* f_get_cache)(void *,mbedtls_ssl_session *),int (* f_set_cache)(void *,const mbedtls_ssl_session *))4242 void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
4243 void *p_cache,
4244 int (*f_get_cache)(void *, mbedtls_ssl_session *),
4245 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
4246 {
4247 conf->p_cache = p_cache;
4248 conf->f_get_cache = f_get_cache;
4249 conf->f_set_cache = f_set_cache;
4250 }
4251 #endif /* MBEDTLS_SSL_SRV_C */
4252
4253 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_set_session(mbedtls_ssl_context * ssl,const mbedtls_ssl_session * session)4254 int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
4255 {
4256 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4257
4258 if( ssl == NULL ||
4259 session == NULL ||
4260 ssl->session_negotiate == NULL ||
4261 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
4262 {
4263 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4264 }
4265
4266 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
4267 session ) ) != 0 )
4268 return( ret );
4269
4270 ssl->handshake->resume = 1;
4271
4272 return( 0 );
4273 }
4274 #endif /* MBEDTLS_SSL_CLI_C */
4275
mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config * conf,const int * ciphersuites)4276 void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
4277 const int *ciphersuites )
4278 {
4279 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites;
4280 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites;
4281 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites;
4282 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites;
4283 }
4284
mbedtls_ssl_conf_ciphersuites_for_version(mbedtls_ssl_config * conf,const int * ciphersuites,int major,int minor)4285 void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
4286 const int *ciphersuites,
4287 int major, int minor )
4288 {
4289 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
4290 return;
4291
4292 if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 )
4293 return;
4294
4295 conf->ciphersuite_list[minor] = ciphersuites;
4296 }
4297
4298 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_conf_cert_profile(mbedtls_ssl_config * conf,const mbedtls_x509_crt_profile * profile)4299 void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
4300 const mbedtls_x509_crt_profile *profile )
4301 {
4302 conf->cert_profile = profile;
4303 }
4304
4305 /* Append a new keycert entry to a (possibly empty) list */
ssl_append_key_cert(mbedtls_ssl_key_cert ** head,mbedtls_x509_crt * cert,mbedtls_pk_context * key)4306 static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
4307 mbedtls_x509_crt *cert,
4308 mbedtls_pk_context *key )
4309 {
4310 mbedtls_ssl_key_cert *new_cert;
4311
4312 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
4313 if( new_cert == NULL )
4314 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4315
4316 new_cert->cert = cert;
4317 new_cert->key = key;
4318 new_cert->next = NULL;
4319
4320 /* Update head is the list was null, else add to the end */
4321 if( *head == NULL )
4322 {
4323 *head = new_cert;
4324 }
4325 else
4326 {
4327 mbedtls_ssl_key_cert *cur = *head;
4328 while( cur->next != NULL )
4329 cur = cur->next;
4330 cur->next = new_cert;
4331 }
4332
4333 return( 0 );
4334 }
4335
mbedtls_ssl_conf_own_cert(mbedtls_ssl_config * conf,mbedtls_x509_crt * own_cert,mbedtls_pk_context * pk_key)4336 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
4337 mbedtls_x509_crt *own_cert,
4338 mbedtls_pk_context *pk_key )
4339 {
4340 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
4341 }
4342
mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config * conf,mbedtls_x509_crt * ca_chain,mbedtls_x509_crl * ca_crl)4343 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
4344 mbedtls_x509_crt *ca_chain,
4345 mbedtls_x509_crl *ca_crl )
4346 {
4347 conf->ca_chain = ca_chain;
4348 conf->ca_crl = ca_crl;
4349
4350 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
4351 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
4352 * cannot be used together. */
4353 conf->f_ca_cb = NULL;
4354 conf->p_ca_cb = NULL;
4355 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
4356 }
4357
4358 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
mbedtls_ssl_conf_ca_cb(mbedtls_ssl_config * conf,mbedtls_x509_crt_ca_cb_t f_ca_cb,void * p_ca_cb)4359 void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
4360 mbedtls_x509_crt_ca_cb_t f_ca_cb,
4361 void *p_ca_cb )
4362 {
4363 conf->f_ca_cb = f_ca_cb;
4364 conf->p_ca_cb = p_ca_cb;
4365
4366 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
4367 * cannot be used together. */
4368 conf->ca_chain = NULL;
4369 conf->ca_crl = NULL;
4370 }
4371 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
4372 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4373
4374 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context * ssl,mbedtls_x509_crt * own_cert,mbedtls_pk_context * pk_key)4375 int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
4376 mbedtls_x509_crt *own_cert,
4377 mbedtls_pk_context *pk_key )
4378 {
4379 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
4380 own_cert, pk_key ) );
4381 }
4382
mbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context * ssl,mbedtls_x509_crt * ca_chain,mbedtls_x509_crl * ca_crl)4383 void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
4384 mbedtls_x509_crt *ca_chain,
4385 mbedtls_x509_crl *ca_crl )
4386 {
4387 ssl->handshake->sni_ca_chain = ca_chain;
4388 ssl->handshake->sni_ca_crl = ca_crl;
4389 }
4390
mbedtls_ssl_set_hs_authmode(mbedtls_ssl_context * ssl,int authmode)4391 void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
4392 int authmode )
4393 {
4394 ssl->handshake->sni_authmode = authmode;
4395 }
4396 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
4397
4398 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_set_verify(mbedtls_ssl_context * ssl,int (* f_vrfy)(void *,mbedtls_x509_crt *,int,uint32_t *),void * p_vrfy)4399 void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
4400 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
4401 void *p_vrfy )
4402 {
4403 ssl->f_vrfy = f_vrfy;
4404 ssl->p_vrfy = p_vrfy;
4405 }
4406 #endif
4407
4408 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
4409 /*
4410 * Set EC J-PAKE password for current handshake
4411 */
mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context * ssl,const unsigned char * pw,size_t pw_len)4412 int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
4413 const unsigned char *pw,
4414 size_t pw_len )
4415 {
4416 mbedtls_ecjpake_role role;
4417
4418 if( ssl->handshake == NULL || ssl->conf == NULL )
4419 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4420
4421 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
4422 role = MBEDTLS_ECJPAKE_SERVER;
4423 else
4424 role = MBEDTLS_ECJPAKE_CLIENT;
4425
4426 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
4427 role,
4428 MBEDTLS_MD_SHA256,
4429 MBEDTLS_ECP_DP_SECP256R1,
4430 pw, pw_len ) );
4431 }
4432 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
4433
4434 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
4435
ssl_conf_remove_psk(mbedtls_ssl_config * conf)4436 static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
4437 {
4438 /* Remove reference to existing PSK, if any. */
4439 #if defined(MBEDTLS_USE_PSA_CRYPTO)
4440 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
4441 {
4442 /* The maintenance of the PSK key slot is the
4443 * user's responsibility. */
4444 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4445 }
4446 /* This and the following branch should never
4447 * be taken simultaenously as we maintain the
4448 * invariant that raw and opaque PSKs are never
4449 * configured simultaneously. As a safeguard,
4450 * though, `else` is omitted here. */
4451 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4452 if( conf->psk != NULL )
4453 {
4454 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
4455
4456 mbedtls_free( conf->psk );
4457 conf->psk = NULL;
4458 conf->psk_len = 0;
4459 }
4460
4461 /* Remove reference to PSK identity, if any. */
4462 if( conf->psk_identity != NULL )
4463 {
4464 mbedtls_free( conf->psk_identity );
4465 conf->psk_identity = NULL;
4466 conf->psk_identity_len = 0;
4467 }
4468 }
4469
4470 /* This function assumes that PSK identity in the SSL config is unset.
4471 * It checks that the provided identity is well-formed and attempts
4472 * to make a copy of it in the SSL config.
4473 * On failure, the PSK identity in the config remains unset. */
ssl_conf_set_psk_identity(mbedtls_ssl_config * conf,unsigned char const * psk_identity,size_t psk_identity_len)4474 static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
4475 unsigned char const *psk_identity,
4476 size_t psk_identity_len )
4477 {
4478 /* Identity len will be encoded on two bytes */
4479 if( psk_identity == NULL ||
4480 ( psk_identity_len >> 16 ) != 0 ||
4481 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
4482 {
4483 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4484 }
4485
4486 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
4487 if( conf->psk_identity == NULL )
4488 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4489
4490 conf->psk_identity_len = psk_identity_len;
4491 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
4492
4493 return( 0 );
4494 }
4495
mbedtls_ssl_conf_psk(mbedtls_ssl_config * conf,const unsigned char * psk,size_t psk_len,const unsigned char * psk_identity,size_t psk_identity_len)4496 int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
4497 const unsigned char *psk, size_t psk_len,
4498 const unsigned char *psk_identity, size_t psk_identity_len )
4499 {
4500 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4501 /* Remove opaque/raw PSK + PSK Identity */
4502 ssl_conf_remove_psk( conf );
4503
4504 /* Check and set raw PSK */
4505 if( psk == NULL )
4506 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4507 if( psk_len == 0 )
4508 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4509 if( psk_len > MBEDTLS_PSK_MAX_LEN )
4510 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4511
4512 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
4513 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4514 conf->psk_len = psk_len;
4515 memcpy( conf->psk, psk, conf->psk_len );
4516
4517 /* Check and set PSK Identity */
4518 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
4519 if( ret != 0 )
4520 ssl_conf_remove_psk( conf );
4521
4522 return( ret );
4523 }
4524
ssl_remove_psk(mbedtls_ssl_context * ssl)4525 static void ssl_remove_psk( mbedtls_ssl_context *ssl )
4526 {
4527 #if defined(MBEDTLS_USE_PSA_CRYPTO)
4528 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
4529 {
4530 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4531 }
4532 else
4533 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4534 if( ssl->handshake->psk != NULL )
4535 {
4536 mbedtls_platform_zeroize( ssl->handshake->psk,
4537 ssl->handshake->psk_len );
4538 mbedtls_free( ssl->handshake->psk );
4539 ssl->handshake->psk_len = 0;
4540 }
4541 }
4542
mbedtls_ssl_set_hs_psk(mbedtls_ssl_context * ssl,const unsigned char * psk,size_t psk_len)4543 int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
4544 const unsigned char *psk, size_t psk_len )
4545 {
4546 if( psk == NULL || ssl->handshake == NULL )
4547 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4548
4549 if( psk_len > MBEDTLS_PSK_MAX_LEN )
4550 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4551
4552 ssl_remove_psk( ssl );
4553
4554 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
4555 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4556
4557 ssl->handshake->psk_len = psk_len;
4558 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
4559
4560 return( 0 );
4561 }
4562
4563 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config * conf,psa_key_id_t psk,const unsigned char * psk_identity,size_t psk_identity_len)4564 int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
4565 psa_key_id_t psk,
4566 const unsigned char *psk_identity,
4567 size_t psk_identity_len )
4568 {
4569 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4570 /* Clear opaque/raw PSK + PSK Identity, if present. */
4571 ssl_conf_remove_psk( conf );
4572
4573 /* Check and set opaque PSK */
4574 if( mbedtls_svc_key_id_is_null( psk ) )
4575 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4576 conf->psk_opaque = psk;
4577
4578 /* Check and set PSK Identity */
4579 ret = ssl_conf_set_psk_identity( conf, psk_identity,
4580 psk_identity_len );
4581 if( ret != 0 )
4582 ssl_conf_remove_psk( conf );
4583
4584 return( ret );
4585 }
4586
mbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context * ssl,psa_key_id_t psk)4587 int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
4588 psa_key_id_t psk )
4589 {
4590 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
4591 ( ssl->handshake == NULL ) )
4592 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4593
4594 ssl_remove_psk( ssl );
4595 ssl->handshake->psk_opaque = psk;
4596 return( 0 );
4597 }
4598 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4599
mbedtls_ssl_conf_psk_cb(mbedtls_ssl_config * conf,int (* f_psk)(void *,mbedtls_ssl_context *,const unsigned char *,size_t),void * p_psk)4600 void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
4601 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
4602 size_t),
4603 void *p_psk )
4604 {
4605 conf->f_psk = f_psk;
4606 conf->p_psk = p_psk;
4607 }
4608 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
4609
4610 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
4611
4612 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_ssl_conf_dh_param(mbedtls_ssl_config * conf,const char * dhm_P,const char * dhm_G)4613 int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
4614 {
4615 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4616
4617 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
4618 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
4619 {
4620 mbedtls_mpi_free( &conf->dhm_P );
4621 mbedtls_mpi_free( &conf->dhm_G );
4622 return( ret );
4623 }
4624
4625 return( 0 );
4626 }
4627 #endif /* MBEDTLS_DEPRECATED_REMOVED */
4628
mbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config * conf,const unsigned char * dhm_P,size_t P_len,const unsigned char * dhm_G,size_t G_len)4629 int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
4630 const unsigned char *dhm_P, size_t P_len,
4631 const unsigned char *dhm_G, size_t G_len )
4632 {
4633 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4634
4635 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
4636 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
4637 {
4638 mbedtls_mpi_free( &conf->dhm_P );
4639 mbedtls_mpi_free( &conf->dhm_G );
4640 return( ret );
4641 }
4642
4643 return( 0 );
4644 }
4645
mbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config * conf,mbedtls_dhm_context * dhm_ctx)4646 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
4647 {
4648 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4649
4650 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
4651 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
4652 {
4653 mbedtls_mpi_free( &conf->dhm_P );
4654 mbedtls_mpi_free( &conf->dhm_G );
4655 return( ret );
4656 }
4657
4658 return( 0 );
4659 }
4660 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
4661
4662 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
4663 /*
4664 * Set the minimum length for Diffie-Hellman parameters
4665 */
mbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config * conf,unsigned int bitlen)4666 void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
4667 unsigned int bitlen )
4668 {
4669 conf->dhm_min_bitlen = bitlen;
4670 }
4671 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
4672
4673 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
4674 /*
4675 * Set allowed/preferred hashes for handshake signatures
4676 */
mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config * conf,const int * hashes)4677 void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
4678 const int *hashes )
4679 {
4680 conf->sig_hashes = hashes;
4681 }
4682 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4683
4684 #if defined(MBEDTLS_ECP_C)
4685 /*
4686 * Set the allowed elliptic curves
4687 */
mbedtls_ssl_conf_curves(mbedtls_ssl_config * conf,const mbedtls_ecp_group_id * curve_list)4688 void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
4689 const mbedtls_ecp_group_id *curve_list )
4690 {
4691 conf->curve_list = curve_list;
4692 }
4693 #endif /* MBEDTLS_ECP_C */
4694
4695 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_set_hostname(mbedtls_ssl_context * ssl,const char * hostname)4696 int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
4697 {
4698 /* Initialize to suppress unnecessary compiler warning */
4699 size_t hostname_len = 0;
4700
4701 /* Check if new hostname is valid before
4702 * making any change to current one */
4703 if( hostname != NULL )
4704 {
4705 hostname_len = strlen( hostname );
4706
4707 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
4708 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4709 }
4710
4711 /* Now it's clear that we will overwrite the old hostname,
4712 * so we can free it safely */
4713
4714 if( ssl->hostname != NULL )
4715 {
4716 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
4717 mbedtls_free( ssl->hostname );
4718 }
4719
4720 /* Passing NULL as hostname shall clear the old one */
4721
4722 if( hostname == NULL )
4723 {
4724 ssl->hostname = NULL;
4725 }
4726 else
4727 {
4728 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
4729 if( ssl->hostname == NULL )
4730 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4731
4732 memcpy( ssl->hostname, hostname, hostname_len );
4733
4734 ssl->hostname[hostname_len] = '\0';
4735 }
4736
4737 return( 0 );
4738 }
4739 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4740
4741 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedtls_ssl_conf_sni(mbedtls_ssl_config * conf,int (* f_sni)(void *,mbedtls_ssl_context *,const unsigned char *,size_t),void * p_sni)4742 void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
4743 int (*f_sni)(void *, mbedtls_ssl_context *,
4744 const unsigned char *, size_t),
4745 void *p_sni )
4746 {
4747 conf->f_sni = f_sni;
4748 conf->p_sni = p_sni;
4749 }
4750 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
4751
4752 #if defined(MBEDTLS_SSL_ALPN)
mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config * conf,const char ** protos)4753 int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
4754 {
4755 size_t cur_len, tot_len;
4756 const char **p;
4757
4758 /*
4759 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
4760 * MUST NOT be truncated."
4761 * We check lengths now rather than later.
4762 */
4763 tot_len = 0;
4764 for( p = protos; *p != NULL; p++ )
4765 {
4766 cur_len = strlen( *p );
4767 tot_len += cur_len;
4768
4769 if( ( cur_len == 0 ) ||
4770 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
4771 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
4772 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4773 }
4774
4775 conf->alpn_list = protos;
4776
4777 return( 0 );
4778 }
4779
mbedtls_ssl_get_alpn_protocol(const mbedtls_ssl_context * ssl)4780 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
4781 {
4782 return( ssl->alpn_chosen );
4783 }
4784 #endif /* MBEDTLS_SSL_ALPN */
4785
4786 #if defined(MBEDTLS_SSL_DTLS_SRTP)
mbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config * conf,int support_mki_value)4787 void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
4788 int support_mki_value )
4789 {
4790 conf->dtls_srtp_mki_support = support_mki_value;
4791 }
4792
mbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context * ssl,unsigned char * mki_value,uint16_t mki_len)4793 int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
4794 unsigned char *mki_value,
4795 uint16_t mki_len )
4796 {
4797 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
4798 {
4799 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4800 }
4801
4802 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
4803 {
4804 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4805 }
4806
4807 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
4808 ssl->dtls_srtp_info.mki_len = mki_len;
4809 return( 0 );
4810 }
4811
mbedtls_ssl_conf_dtls_srtp_protection_profiles(mbedtls_ssl_config * conf,const mbedtls_ssl_srtp_profile * profiles)4812 int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
4813 const mbedtls_ssl_srtp_profile *profiles )
4814 {
4815 const mbedtls_ssl_srtp_profile *p;
4816 size_t list_size = 0;
4817
4818 /* check the profiles list: all entry must be valid,
4819 * its size cannot be more than the total number of supported profiles, currently 4 */
4820 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
4821 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
4822 p++ )
4823 {
4824 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
4825 {
4826 list_size++;
4827 }
4828 else
4829 {
4830 /* unsupported value, stop parsing and set the size to an error value */
4831 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
4832 }
4833 }
4834
4835 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
4836 {
4837 conf->dtls_srtp_profile_list = NULL;
4838 conf->dtls_srtp_profile_list_len = 0;
4839 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4840 }
4841
4842 conf->dtls_srtp_profile_list = profiles;
4843 conf->dtls_srtp_profile_list_len = list_size;
4844
4845 return( 0 );
4846 }
4847
mbedtls_ssl_get_dtls_srtp_negotiation_result(const mbedtls_ssl_context * ssl,mbedtls_dtls_srtp_info * dtls_srtp_info)4848 void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
4849 mbedtls_dtls_srtp_info *dtls_srtp_info )
4850 {
4851 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
4852 /* do not copy the mki value if there is no chosen profile */
4853 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
4854 {
4855 dtls_srtp_info->mki_len = 0;
4856 }
4857 else
4858 {
4859 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
4860 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
4861 ssl->dtls_srtp_info.mki_len );
4862 }
4863 }
4864 #endif /* MBEDTLS_SSL_DTLS_SRTP */
4865
mbedtls_ssl_conf_max_version(mbedtls_ssl_config * conf,int major,int minor)4866 void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
4867 {
4868 conf->max_major_ver = major;
4869 conf->max_minor_ver = minor;
4870 }
4871
mbedtls_ssl_conf_min_version(mbedtls_ssl_config * conf,int major,int minor)4872 void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
4873 {
4874 conf->min_major_ver = major;
4875 conf->min_minor_ver = minor;
4876 }
4877
4878 #if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_conf_fallback(mbedtls_ssl_config * conf,char fallback)4879 void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
4880 {
4881 conf->fallback = fallback;
4882 }
4883 #endif
4884
4885 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config * conf,char cert_req_ca_list)4886 void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
4887 char cert_req_ca_list )
4888 {
4889 conf->cert_req_ca_list = cert_req_ca_list;
4890 }
4891 #endif
4892
4893 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
mbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config * conf,char etm)4894 void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
4895 {
4896 conf->encrypt_then_mac = etm;
4897 }
4898 #endif
4899
4900 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
mbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config * conf,char ems)4901 void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
4902 {
4903 conf->extended_ms = ems;
4904 }
4905 #endif
4906
4907 #if defined(MBEDTLS_ARC4_C)
mbedtls_ssl_conf_arc4_support(mbedtls_ssl_config * conf,char arc4)4908 void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
4909 {
4910 conf->arc4_disabled = arc4;
4911 }
4912 #endif
4913
4914 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config * conf,unsigned char mfl_code)4915 int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
4916 {
4917 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
4918 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
4919 {
4920 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4921 }
4922
4923 conf->mfl_code = mfl_code;
4924
4925 return( 0 );
4926 }
4927 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4928
4929 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
mbedtls_ssl_conf_truncated_hmac(mbedtls_ssl_config * conf,int truncate)4930 void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
4931 {
4932 conf->trunc_hmac = truncate;
4933 }
4934 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
4935
4936 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
mbedtls_ssl_conf_cbc_record_splitting(mbedtls_ssl_config * conf,char split)4937 void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
4938 {
4939 conf->cbc_record_splitting = split;
4940 }
4941 #endif
4942
mbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config * conf,int allow_legacy)4943 void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
4944 {
4945 conf->allow_legacy_renegotiation = allow_legacy;
4946 }
4947
4948 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config * conf,int renegotiation)4949 void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
4950 {
4951 conf->disable_renegotiation = renegotiation;
4952 }
4953
mbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config * conf,int max_records)4954 void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
4955 {
4956 conf->renego_max_records = max_records;
4957 }
4958
mbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config * conf,const unsigned char period[8])4959 void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
4960 const unsigned char period[8] )
4961 {
4962 memcpy( conf->renego_period, period, 8 );
4963 }
4964 #endif /* MBEDTLS_SSL_RENEGOTIATION */
4965
4966 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4967 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_conf_session_tickets(mbedtls_ssl_config * conf,int use_tickets)4968 void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
4969 {
4970 conf->session_tickets = use_tickets;
4971 }
4972 #endif
4973
4974 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config * conf,mbedtls_ssl_ticket_write_t * f_ticket_write,mbedtls_ssl_ticket_parse_t * f_ticket_parse,void * p_ticket)4975 void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
4976 mbedtls_ssl_ticket_write_t *f_ticket_write,
4977 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
4978 void *p_ticket )
4979 {
4980 conf->f_ticket_write = f_ticket_write;
4981 conf->f_ticket_parse = f_ticket_parse;
4982 conf->p_ticket = p_ticket;
4983 }
4984 #endif
4985 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4986
4987 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
mbedtls_ssl_conf_export_keys_cb(mbedtls_ssl_config * conf,mbedtls_ssl_export_keys_t * f_export_keys,void * p_export_keys)4988 void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
4989 mbedtls_ssl_export_keys_t *f_export_keys,
4990 void *p_export_keys )
4991 {
4992 conf->f_export_keys = f_export_keys;
4993 conf->p_export_keys = p_export_keys;
4994 }
4995
mbedtls_ssl_conf_export_keys_ext_cb(mbedtls_ssl_config * conf,mbedtls_ssl_export_keys_ext_t * f_export_keys_ext,void * p_export_keys)4996 void mbedtls_ssl_conf_export_keys_ext_cb( mbedtls_ssl_config *conf,
4997 mbedtls_ssl_export_keys_ext_t *f_export_keys_ext,
4998 void *p_export_keys )
4999 {
5000 conf->f_export_keys_ext = f_export_keys_ext;
5001 conf->p_export_keys = p_export_keys;
5002 }
5003 #endif
5004
5005 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
mbedtls_ssl_conf_async_private_cb(mbedtls_ssl_config * conf,mbedtls_ssl_async_sign_t * f_async_sign,mbedtls_ssl_async_decrypt_t * f_async_decrypt,mbedtls_ssl_async_resume_t * f_async_resume,mbedtls_ssl_async_cancel_t * f_async_cancel,void * async_config_data)5006 void mbedtls_ssl_conf_async_private_cb(
5007 mbedtls_ssl_config *conf,
5008 mbedtls_ssl_async_sign_t *f_async_sign,
5009 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
5010 mbedtls_ssl_async_resume_t *f_async_resume,
5011 mbedtls_ssl_async_cancel_t *f_async_cancel,
5012 void *async_config_data )
5013 {
5014 conf->f_async_sign_start = f_async_sign;
5015 conf->f_async_decrypt_start = f_async_decrypt;
5016 conf->f_async_resume = f_async_resume;
5017 conf->f_async_cancel = f_async_cancel;
5018 conf->p_async_config_data = async_config_data;
5019 }
5020
mbedtls_ssl_conf_get_async_config_data(const mbedtls_ssl_config * conf)5021 void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
5022 {
5023 return( conf->p_async_config_data );
5024 }
5025
mbedtls_ssl_get_async_operation_data(const mbedtls_ssl_context * ssl)5026 void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
5027 {
5028 if( ssl->handshake == NULL )
5029 return( NULL );
5030 else
5031 return( ssl->handshake->user_async_ctx );
5032 }
5033
mbedtls_ssl_set_async_operation_data(mbedtls_ssl_context * ssl,void * ctx)5034 void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
5035 void *ctx )
5036 {
5037 if( ssl->handshake != NULL )
5038 ssl->handshake->user_async_ctx = ctx;
5039 }
5040 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
5041
5042 /*
5043 * SSL get accessors
5044 */
mbedtls_ssl_get_verify_result(const mbedtls_ssl_context * ssl)5045 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
5046 {
5047 if( ssl->session != NULL )
5048 return( ssl->session->verify_result );
5049
5050 if( ssl->session_negotiate != NULL )
5051 return( ssl->session_negotiate->verify_result );
5052
5053 return( 0xFFFFFFFF );
5054 }
5055
mbedtls_ssl_get_ciphersuite(const mbedtls_ssl_context * ssl)5056 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
5057 {
5058 if( ssl == NULL || ssl->session == NULL )
5059 return( NULL );
5060
5061 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
5062 }
5063
mbedtls_ssl_get_version(const mbedtls_ssl_context * ssl)5064 const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
5065 {
5066 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5067 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5068 {
5069 switch( ssl->minor_ver )
5070 {
5071 case MBEDTLS_SSL_MINOR_VERSION_2:
5072 return( "DTLSv1.0" );
5073
5074 case MBEDTLS_SSL_MINOR_VERSION_3:
5075 return( "DTLSv1.2" );
5076
5077 default:
5078 return( "unknown (DTLS)" );
5079 }
5080 }
5081 #endif
5082
5083 switch( ssl->minor_ver )
5084 {
5085 case MBEDTLS_SSL_MINOR_VERSION_0:
5086 return( "SSLv3.0" );
5087
5088 case MBEDTLS_SSL_MINOR_VERSION_1:
5089 return( "TLSv1.0" );
5090
5091 case MBEDTLS_SSL_MINOR_VERSION_2:
5092 return( "TLSv1.1" );
5093
5094 case MBEDTLS_SSL_MINOR_VERSION_3:
5095 return( "TLSv1.2" );
5096
5097 default:
5098 return( "unknown" );
5099 }
5100 }
5101
5102 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context * ssl)5103 size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
5104 {
5105 size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
5106 size_t read_mfl;
5107
5108 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
5109 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
5110 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
5111 {
5112 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
5113 }
5114
5115 /* Check if a smaller max length was negotiated */
5116 if( ssl->session_out != NULL )
5117 {
5118 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
5119 if( read_mfl < max_len )
5120 {
5121 max_len = read_mfl;
5122 }
5123 }
5124
5125 // During a handshake, use the value being negotiated
5126 if( ssl->session_negotiate != NULL )
5127 {
5128 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
5129 if( read_mfl < max_len )
5130 {
5131 max_len = read_mfl;
5132 }
5133 }
5134
5135 return( max_len );
5136 }
5137
mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context * ssl)5138 size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
5139 {
5140 size_t max_len;
5141
5142 /*
5143 * Assume mfl_code is correct since it was checked when set
5144 */
5145 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
5146
5147 /* Check if a smaller max length was negotiated */
5148 if( ssl->session_out != NULL &&
5149 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
5150 {
5151 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
5152 }
5153
5154 /* During a handshake, use the value being negotiated */
5155 if( ssl->session_negotiate != NULL &&
5156 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
5157 {
5158 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
5159 }
5160
5161 return( max_len );
5162 }
5163
5164 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_ssl_get_max_frag_len(const mbedtls_ssl_context * ssl)5165 size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
5166 {
5167 return mbedtls_ssl_get_output_max_frag_len( ssl );
5168 }
5169 #endif /* !MBEDTLS_DEPRECATED_REMOVED */
5170 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
5171
5172 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context * ssl)5173 size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
5174 {
5175 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
5176 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
5177 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
5178 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
5179 return ( 0 );
5180
5181 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
5182 return( ssl->mtu );
5183
5184 if( ssl->mtu == 0 )
5185 return( ssl->handshake->mtu );
5186
5187 return( ssl->mtu < ssl->handshake->mtu ?
5188 ssl->mtu : ssl->handshake->mtu );
5189 }
5190 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5191
mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context * ssl)5192 int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
5193 {
5194 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
5195
5196 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
5197 !defined(MBEDTLS_SSL_PROTO_DTLS)
5198 (void) ssl;
5199 #endif
5200
5201 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5202 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
5203
5204 if( max_len > mfl )
5205 max_len = mfl;
5206 #endif
5207
5208 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5209 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
5210 {
5211 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
5212 const int ret = mbedtls_ssl_get_record_expansion( ssl );
5213 const size_t overhead = (size_t) ret;
5214
5215 if( ret < 0 )
5216 return( ret );
5217
5218 if( mtu <= overhead )
5219 {
5220 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
5221 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
5222 }
5223
5224 if( max_len > mtu - overhead )
5225 max_len = mtu - overhead;
5226 }
5227 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5228
5229 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
5230 !defined(MBEDTLS_SSL_PROTO_DTLS)
5231 ((void) ssl);
5232 #endif
5233
5234 return( (int) max_len );
5235 }
5236
5237 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_get_peer_cert(const mbedtls_ssl_context * ssl)5238 const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
5239 {
5240 if( ssl == NULL || ssl->session == NULL )
5241 return( NULL );
5242
5243 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5244 return( ssl->session->peer_cert );
5245 #else
5246 return( NULL );
5247 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5248 }
5249 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5250
5251 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_get_session(const mbedtls_ssl_context * ssl,mbedtls_ssl_session * dst)5252 int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
5253 mbedtls_ssl_session *dst )
5254 {
5255 if( ssl == NULL ||
5256 dst == NULL ||
5257 ssl->session == NULL ||
5258 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
5259 {
5260 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5261 }
5262
5263 return( mbedtls_ssl_session_copy( dst, ssl->session ) );
5264 }
5265 #endif /* MBEDTLS_SSL_CLI_C */
5266
mbedtls_ssl_get_session_pointer(const mbedtls_ssl_context * ssl)5267 const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl )
5268 {
5269 if( ssl == NULL )
5270 return( NULL );
5271
5272 return( ssl->session );
5273 }
5274
5275 /*
5276 * Define ticket header determining Mbed TLS version
5277 * and structure of the ticket.
5278 */
5279
5280 /*
5281 * Define bitflag determining compile-time settings influencing
5282 * structure of serialized SSL sessions.
5283 */
5284
5285 #if defined(MBEDTLS_HAVE_TIME)
5286 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
5287 #else
5288 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
5289 #endif /* MBEDTLS_HAVE_TIME */
5290
5291 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5292 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
5293 #else
5294 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
5295 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5296
5297 #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
5298 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
5299 #else
5300 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
5301 #endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
5302
5303 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5304 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
5305 #else
5306 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
5307 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
5308
5309 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
5310 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 1
5311 #else
5312 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 0
5313 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
5314
5315 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5316 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
5317 #else
5318 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
5319 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
5320
5321 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
5322 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
5323 #else
5324 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
5325 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
5326
5327 #define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
5328 #define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
5329 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
5330 #define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
5331 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT 4
5332 #define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 5
5333 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 6
5334
5335 #define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
5336 ( (uint16_t) ( \
5337 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
5338 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
5339 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
5340 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
5341 ( SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC << SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT ) | \
5342 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
5343 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
5344
5345 static unsigned char ssl_serialized_session_header[] = {
5346 MBEDTLS_VERSION_MAJOR,
5347 MBEDTLS_VERSION_MINOR,
5348 MBEDTLS_VERSION_PATCH,
5349 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5350 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5351 };
5352
5353 /*
5354 * Serialize a session in the following format:
5355 * (in the presentation language of TLS, RFC 8446 section 3)
5356 *
5357 * opaque mbedtls_version[3]; // major, minor, patch
5358 * opaque session_format[2]; // version-specific 16-bit field determining
5359 * // the format of the remaining
5360 * // serialized data.
5361 *
5362 * Note: When updating the format, remember to keep
5363 * these version+format bytes.
5364 *
5365 * // In this version, `session_format` determines
5366 * // the setting of those compile-time
5367 * // configuration options which influence
5368 * // the structure of mbedtls_ssl_session.
5369 * uint64 start_time;
5370 * uint8 ciphersuite[2]; // defined by the standard
5371 * uint8 compression; // 0 or 1
5372 * uint8 session_id_len; // at most 32
5373 * opaque session_id[32];
5374 * opaque master[48]; // fixed length in the standard
5375 * uint32 verify_result;
5376 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
5377 * opaque ticket<0..2^24-1>; // length 0 means no ticket
5378 * uint32 ticket_lifetime;
5379 * uint8 mfl_code; // up to 255 according to standard
5380 * uint8 trunc_hmac; // 0 or 1
5381 * uint8 encrypt_then_mac; // 0 or 1
5382 *
5383 * The order is the same as in the definition of the structure, except
5384 * verify_result is put before peer_cert so that all mandatory fields come
5385 * together in one block.
5386 */
ssl_session_save(const mbedtls_ssl_session * session,unsigned char omit_header,unsigned char * buf,size_t buf_len,size_t * olen)5387 static int ssl_session_save( const mbedtls_ssl_session *session,
5388 unsigned char omit_header,
5389 unsigned char *buf,
5390 size_t buf_len,
5391 size_t *olen )
5392 {
5393 unsigned char *p = buf;
5394 size_t used = 0;
5395 #if defined(MBEDTLS_HAVE_TIME)
5396 uint64_t start;
5397 #endif
5398 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5399 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5400 size_t cert_len;
5401 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5402 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5403
5404
5405 if( !omit_header )
5406 {
5407 /*
5408 * Add version identifier
5409 */
5410
5411 used += sizeof( ssl_serialized_session_header );
5412
5413 if( used <= buf_len )
5414 {
5415 memcpy( p, ssl_serialized_session_header,
5416 sizeof( ssl_serialized_session_header ) );
5417 p += sizeof( ssl_serialized_session_header );
5418 }
5419 }
5420
5421 /*
5422 * Time
5423 */
5424 #if defined(MBEDTLS_HAVE_TIME)
5425 used += 8;
5426
5427 if( used <= buf_len )
5428 {
5429 start = (uint64_t) session->start;
5430
5431 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
5432 p += 8;
5433 }
5434 #endif /* MBEDTLS_HAVE_TIME */
5435
5436 /*
5437 * Basic mandatory fields
5438 */
5439 used += 2 /* ciphersuite */
5440 + 1 /* compression */
5441 + 1 /* id_len */
5442 + sizeof( session->id )
5443 + sizeof( session->master )
5444 + 4; /* verify_result */
5445
5446 if( used <= buf_len )
5447 {
5448 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
5449 p += 2;
5450
5451 *p++ = MBEDTLS_BYTE_0( session->compression );
5452
5453 *p++ = MBEDTLS_BYTE_0( session->id_len );
5454 memcpy( p, session->id, 32 );
5455 p += 32;
5456
5457 memcpy( p, session->master, 48 );
5458 p += 48;
5459
5460 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
5461 p += 4;
5462 }
5463
5464 /*
5465 * Peer's end-entity certificate
5466 */
5467 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5468 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5469 if( session->peer_cert == NULL )
5470 cert_len = 0;
5471 else
5472 cert_len = session->peer_cert->raw.len;
5473
5474 used += 3 + cert_len;
5475
5476 if( used <= buf_len )
5477 {
5478 *p++ = MBEDTLS_BYTE_2( cert_len );
5479 *p++ = MBEDTLS_BYTE_1( cert_len );
5480 *p++ = MBEDTLS_BYTE_0( cert_len );
5481
5482 if( session->peer_cert != NULL )
5483 {
5484 memcpy( p, session->peer_cert->raw.p, cert_len );
5485 p += cert_len;
5486 }
5487 }
5488 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5489 if( session->peer_cert_digest != NULL )
5490 {
5491 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
5492 if( used <= buf_len )
5493 {
5494 *p++ = (unsigned char) session->peer_cert_digest_type;
5495 *p++ = (unsigned char) session->peer_cert_digest_len;
5496 memcpy( p, session->peer_cert_digest,
5497 session->peer_cert_digest_len );
5498 p += session->peer_cert_digest_len;
5499 }
5500 }
5501 else
5502 {
5503 used += 2;
5504 if( used <= buf_len )
5505 {
5506 *p++ = (unsigned char) MBEDTLS_MD_NONE;
5507 *p++ = 0;
5508 }
5509 }
5510 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5511 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5512
5513 /*
5514 * Session ticket if any, plus associated data
5515 */
5516 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5517 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
5518
5519 if( used <= buf_len )
5520 {
5521 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
5522 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
5523 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
5524
5525 if( session->ticket != NULL )
5526 {
5527 memcpy( p, session->ticket, session->ticket_len );
5528 p += session->ticket_len;
5529 }
5530
5531 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
5532 p += 4;
5533 }
5534 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5535
5536 /*
5537 * Misc extension-related info
5538 */
5539 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5540 used += 1;
5541
5542 if( used <= buf_len )
5543 *p++ = session->mfl_code;
5544 #endif
5545
5546 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
5547 used += 1;
5548
5549 if( used <= buf_len )
5550 *p++ = (unsigned char)( ( session->trunc_hmac ) & 0xFF );
5551 #endif
5552
5553 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5554 used += 1;
5555
5556 if( used <= buf_len )
5557 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
5558 #endif
5559
5560 /* Done */
5561 *olen = used;
5562
5563 if( used > buf_len )
5564 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5565
5566 return( 0 );
5567 }
5568
5569 /*
5570 * Public wrapper for ssl_session_save()
5571 */
mbedtls_ssl_session_save(const mbedtls_ssl_session * session,unsigned char * buf,size_t buf_len,size_t * olen)5572 int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
5573 unsigned char *buf,
5574 size_t buf_len,
5575 size_t *olen )
5576 {
5577 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
5578 }
5579
5580 /*
5581 * Deserialize session, see mbedtls_ssl_session_save() for format.
5582 *
5583 * This internal version is wrapped by a public function that cleans up in
5584 * case of error, and has an extra option omit_header.
5585 */
ssl_session_load(mbedtls_ssl_session * session,unsigned char omit_header,const unsigned char * buf,size_t len)5586 static int ssl_session_load( mbedtls_ssl_session *session,
5587 unsigned char omit_header,
5588 const unsigned char *buf,
5589 size_t len )
5590 {
5591 const unsigned char *p = buf;
5592 const unsigned char * const end = buf + len;
5593 #if defined(MBEDTLS_HAVE_TIME)
5594 uint64_t start;
5595 #endif
5596 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5597 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5598 size_t cert_len;
5599 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5600 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5601
5602 if( !omit_header )
5603 {
5604 /*
5605 * Check version identifier
5606 */
5607
5608 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
5609 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5610
5611 if( memcmp( p, ssl_serialized_session_header,
5612 sizeof( ssl_serialized_session_header ) ) != 0 )
5613 {
5614 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
5615 }
5616 p += sizeof( ssl_serialized_session_header );
5617 }
5618
5619 /*
5620 * Time
5621 */
5622 #if defined(MBEDTLS_HAVE_TIME)
5623 if( 8 > (size_t)( end - p ) )
5624 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5625
5626 start = ( (uint64_t) p[0] << 56 ) |
5627 ( (uint64_t) p[1] << 48 ) |
5628 ( (uint64_t) p[2] << 40 ) |
5629 ( (uint64_t) p[3] << 32 ) |
5630 ( (uint64_t) p[4] << 24 ) |
5631 ( (uint64_t) p[5] << 16 ) |
5632 ( (uint64_t) p[6] << 8 ) |
5633 ( (uint64_t) p[7] );
5634 p += 8;
5635
5636 session->start = (time_t) start;
5637 #endif /* MBEDTLS_HAVE_TIME */
5638
5639 /*
5640 * Basic mandatory fields
5641 */
5642 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
5643 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5644
5645 session->ciphersuite = ( p[0] << 8 ) | p[1];
5646 p += 2;
5647
5648 session->compression = *p++;
5649
5650 session->id_len = *p++;
5651 memcpy( session->id, p, 32 );
5652 p += 32;
5653
5654 memcpy( session->master, p, 48 );
5655 p += 48;
5656
5657 session->verify_result = ( (uint32_t) p[0] << 24 ) |
5658 ( (uint32_t) p[1] << 16 ) |
5659 ( (uint32_t) p[2] << 8 ) |
5660 ( (uint32_t) p[3] );
5661 p += 4;
5662
5663 /* Immediately clear invalid pointer values that have been read, in case
5664 * we exit early before we replaced them with valid ones. */
5665 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5666 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5667 session->peer_cert = NULL;
5668 #else
5669 session->peer_cert_digest = NULL;
5670 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5671 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5672 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5673 session->ticket = NULL;
5674 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5675
5676 /*
5677 * Peer certificate
5678 */
5679 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5680 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5681 /* Deserialize CRT from the end of the ticket. */
5682 if( 3 > (size_t)( end - p ) )
5683 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5684
5685 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5686 p += 3;
5687
5688 if( cert_len != 0 )
5689 {
5690 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5691
5692 if( cert_len > (size_t)( end - p ) )
5693 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5694
5695 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
5696
5697 if( session->peer_cert == NULL )
5698 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5699
5700 mbedtls_x509_crt_init( session->peer_cert );
5701
5702 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
5703 p, cert_len ) ) != 0 )
5704 {
5705 mbedtls_x509_crt_free( session->peer_cert );
5706 mbedtls_free( session->peer_cert );
5707 session->peer_cert = NULL;
5708 return( ret );
5709 }
5710
5711 p += cert_len;
5712 }
5713 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5714 /* Deserialize CRT digest from the end of the ticket. */
5715 if( 2 > (size_t)( end - p ) )
5716 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5717
5718 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
5719 session->peer_cert_digest_len = (size_t) *p++;
5720
5721 if( session->peer_cert_digest_len != 0 )
5722 {
5723 const mbedtls_md_info_t *md_info =
5724 mbedtls_md_info_from_type( session->peer_cert_digest_type );
5725 if( md_info == NULL )
5726 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5727 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
5728 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5729
5730 if( session->peer_cert_digest_len > (size_t)( end - p ) )
5731 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5732
5733 session->peer_cert_digest =
5734 mbedtls_calloc( 1, session->peer_cert_digest_len );
5735 if( session->peer_cert_digest == NULL )
5736 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5737
5738 memcpy( session->peer_cert_digest, p,
5739 session->peer_cert_digest_len );
5740 p += session->peer_cert_digest_len;
5741 }
5742 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5743 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5744
5745 /*
5746 * Session ticket and associated data
5747 */
5748 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5749 if( 3 > (size_t)( end - p ) )
5750 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5751
5752 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5753 p += 3;
5754
5755 if( session->ticket_len != 0 )
5756 {
5757 if( session->ticket_len > (size_t)( end - p ) )
5758 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5759
5760 session->ticket = mbedtls_calloc( 1, session->ticket_len );
5761 if( session->ticket == NULL )
5762 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5763
5764 memcpy( session->ticket, p, session->ticket_len );
5765 p += session->ticket_len;
5766 }
5767
5768 if( 4 > (size_t)( end - p ) )
5769 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5770
5771 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
5772 ( (uint32_t) p[1] << 16 ) |
5773 ( (uint32_t) p[2] << 8 ) |
5774 ( (uint32_t) p[3] );
5775 p += 4;
5776 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5777
5778 /*
5779 * Misc extension-related info
5780 */
5781 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5782 if( 1 > (size_t)( end - p ) )
5783 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5784
5785 session->mfl_code = *p++;
5786 #endif
5787
5788 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
5789 if( 1 > (size_t)( end - p ) )
5790 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5791
5792 session->trunc_hmac = *p++;
5793 #endif
5794
5795 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5796 if( 1 > (size_t)( end - p ) )
5797 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5798
5799 session->encrypt_then_mac = *p++;
5800 #endif
5801
5802 /* Done, should have consumed entire buffer */
5803 if( p != end )
5804 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5805
5806 return( 0 );
5807 }
5808
5809 /*
5810 * Deserialize session: public wrapper for error cleaning
5811 */
mbedtls_ssl_session_load(mbedtls_ssl_session * session,const unsigned char * buf,size_t len)5812 int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
5813 const unsigned char *buf,
5814 size_t len )
5815 {
5816 int ret = ssl_session_load( session, 0, buf, len );
5817
5818 if( ret != 0 )
5819 mbedtls_ssl_session_free( session );
5820
5821 return( ret );
5822 }
5823
5824 /*
5825 * Perform a single step of the SSL handshake
5826 */
mbedtls_ssl_handshake_step(mbedtls_ssl_context * ssl)5827 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
5828 {
5829 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5830
5831 if( ssl == NULL || ssl->conf == NULL )
5832 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5833
5834 #if defined(MBEDTLS_SSL_CLI_C)
5835 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5836 ret = mbedtls_ssl_handshake_client_step( ssl );
5837 #endif
5838 #if defined(MBEDTLS_SSL_SRV_C)
5839 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5840 ret = mbedtls_ssl_handshake_server_step( ssl );
5841 #endif
5842
5843 return( ret );
5844 }
5845
5846 /*
5847 * Perform the SSL handshake
5848 */
mbedtls_ssl_handshake(mbedtls_ssl_context * ssl)5849 int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
5850 {
5851 int ret = 0;
5852
5853 /* Sanity checks */
5854
5855 if( ssl == NULL || ssl->conf == NULL )
5856 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5857
5858 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5859 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5860 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
5861 {
5862 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
5863 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
5864 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5865 }
5866 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5867
5868 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
5869
5870 /* Main handshake loop */
5871 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5872 {
5873 ret = mbedtls_ssl_handshake_step( ssl );
5874
5875 if( ret != 0 )
5876 break;
5877 }
5878
5879 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
5880
5881 return( ret );
5882 }
5883
5884 #if defined(MBEDTLS_SSL_RENEGOTIATION)
5885 #if defined(MBEDTLS_SSL_SRV_C)
5886 /*
5887 * Write HelloRequest to request renegotiation on server
5888 */
ssl_write_hello_request(mbedtls_ssl_context * ssl)5889 static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
5890 {
5891 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5892
5893 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
5894
5895 ssl->out_msglen = 4;
5896 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5897 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
5898
5899 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
5900 {
5901 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
5902 return( ret );
5903 }
5904
5905 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
5906
5907 return( 0 );
5908 }
5909 #endif /* MBEDTLS_SSL_SRV_C */
5910
5911 /*
5912 * Actually renegotiate current connection, triggered by either:
5913 * - any side: calling mbedtls_ssl_renegotiate(),
5914 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
5915 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
5916 * the initial handshake is completed.
5917 * If the handshake doesn't complete due to waiting for I/O, it will continue
5918 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
5919 */
mbedtls_ssl_start_renegotiation(mbedtls_ssl_context * ssl)5920 int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
5921 {
5922 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5923
5924 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
5925
5926 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
5927 return( ret );
5928
5929 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
5930 * the ServerHello will have message_seq = 1" */
5931 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5932 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5933 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
5934 {
5935 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5936 ssl->handshake->out_msg_seq = 1;
5937 else
5938 ssl->handshake->in_msg_seq = 1;
5939 }
5940 #endif
5941
5942 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
5943 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
5944
5945 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
5946 {
5947 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
5948 return( ret );
5949 }
5950
5951 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
5952
5953 return( 0 );
5954 }
5955
5956 /*
5957 * Renegotiate current connection on client,
5958 * or request renegotiation on server
5959 */
mbedtls_ssl_renegotiate(mbedtls_ssl_context * ssl)5960 int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
5961 {
5962 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5963
5964 if( ssl == NULL || ssl->conf == NULL )
5965 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5966
5967 #if defined(MBEDTLS_SSL_SRV_C)
5968 /* On server, just send the request */
5969 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5970 {
5971 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5972 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5973
5974 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
5975
5976 /* Did we already try/start sending HelloRequest? */
5977 if( ssl->out_left != 0 )
5978 return( mbedtls_ssl_flush_output( ssl ) );
5979
5980 return( ssl_write_hello_request( ssl ) );
5981 }
5982 #endif /* MBEDTLS_SSL_SRV_C */
5983
5984 #if defined(MBEDTLS_SSL_CLI_C)
5985 /*
5986 * On client, either start the renegotiation process or,
5987 * if already in progress, continue the handshake
5988 */
5989 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
5990 {
5991 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5992 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5993
5994 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
5995 {
5996 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
5997 return( ret );
5998 }
5999 }
6000 else
6001 {
6002 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
6003 {
6004 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
6005 return( ret );
6006 }
6007 }
6008 #endif /* MBEDTLS_SSL_CLI_C */
6009
6010 return( ret );
6011 }
6012 #endif /* MBEDTLS_SSL_RENEGOTIATION */
6013
6014 #if defined(MBEDTLS_X509_CRT_PARSE_C)
ssl_key_cert_free(mbedtls_ssl_key_cert * key_cert)6015 static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
6016 {
6017 mbedtls_ssl_key_cert *cur = key_cert, *next;
6018
6019 while( cur != NULL )
6020 {
6021 next = cur->next;
6022 mbedtls_free( cur );
6023 cur = next;
6024 }
6025 }
6026 #endif /* MBEDTLS_X509_CRT_PARSE_C */
6027
mbedtls_ssl_handshake_free(mbedtls_ssl_context * ssl)6028 void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
6029 {
6030 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
6031
6032 if( handshake == NULL )
6033 return;
6034
6035 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
6036 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
6037 {
6038 ssl->conf->f_async_cancel( ssl );
6039 handshake->async_in_progress = 0;
6040 }
6041 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
6042
6043 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6044 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6045 mbedtls_md5_free( &handshake->fin_md5 );
6046 mbedtls_sha1_free( &handshake->fin_sha1 );
6047 #endif
6048 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6049 #if defined(MBEDTLS_SHA256_C)
6050 #if defined(MBEDTLS_USE_PSA_CRYPTO)
6051 psa_hash_abort( &handshake->fin_sha256_psa );
6052 #else
6053 mbedtls_sha256_free( &handshake->fin_sha256 );
6054 #endif
6055 #endif
6056 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
6057 #if defined(MBEDTLS_USE_PSA_CRYPTO)
6058 psa_hash_abort( &handshake->fin_sha384_psa );
6059 #else
6060 mbedtls_sha512_free( &handshake->fin_sha512 );
6061 #endif
6062 #endif
6063 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6064
6065 #if defined(MBEDTLS_DHM_C)
6066 mbedtls_dhm_free( &handshake->dhm_ctx );
6067 #endif
6068 #if defined(MBEDTLS_ECDH_C)
6069 mbedtls_ecdh_free( &handshake->ecdh_ctx );
6070 #endif
6071 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
6072 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
6073 #if defined(MBEDTLS_SSL_CLI_C)
6074 mbedtls_free( handshake->ecjpake_cache );
6075 handshake->ecjpake_cache = NULL;
6076 handshake->ecjpake_cache_len = 0;
6077 #endif
6078 #endif
6079
6080 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
6081 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
6082 /* explicit void pointer cast for buggy MS compiler */
6083 mbedtls_free( (void *) handshake->curves );
6084 #endif
6085
6086 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
6087 if( handshake->psk != NULL )
6088 {
6089 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
6090 mbedtls_free( handshake->psk );
6091 }
6092 #endif
6093
6094 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
6095 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6096 /*
6097 * Free only the linked list wrapper, not the keys themselves
6098 * since the belong to the SNI callback
6099 */
6100 if( handshake->sni_key_cert != NULL )
6101 {
6102 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
6103
6104 while( cur != NULL )
6105 {
6106 next = cur->next;
6107 mbedtls_free( cur );
6108 cur = next;
6109 }
6110 }
6111 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
6112
6113 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6114 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
6115 if( handshake->ecrs_peer_cert != NULL )
6116 {
6117 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
6118 mbedtls_free( handshake->ecrs_peer_cert );
6119 }
6120 #endif
6121
6122 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
6123 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6124 mbedtls_pk_free( &handshake->peer_pubkey );
6125 #endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6126
6127 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6128 mbedtls_free( handshake->verify_cookie );
6129 mbedtls_ssl_flight_free( handshake->flight );
6130 mbedtls_ssl_buffering_free( ssl );
6131 #endif
6132
6133 #if defined(MBEDTLS_ECDH_C) && \
6134 defined(MBEDTLS_USE_PSA_CRYPTO)
6135 psa_destroy_key( handshake->ecdh_psa_privkey );
6136 #endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
6137
6138 mbedtls_platform_zeroize( handshake,
6139 sizeof( mbedtls_ssl_handshake_params ) );
6140
6141 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6142 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
6143 * processes datagrams and the fact that a datagram is allowed to have
6144 * several records in it, it is possible that the I/O buffers are not
6145 * empty at this stage */
6146 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
6147 mbedtls_ssl_get_output_buflen( ssl ) );
6148 #endif
6149 }
6150
mbedtls_ssl_session_free(mbedtls_ssl_session * session)6151 void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
6152 {
6153 if( session == NULL )
6154 return;
6155
6156 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6157 ssl_clear_peer_cert( session );
6158 #endif
6159
6160 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
6161 mbedtls_free( session->ticket );
6162 #endif
6163
6164 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
6165 }
6166
6167 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
6168
6169 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6170 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
6171 #else
6172 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
6173 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6174
6175 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
6176 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
6177 #else
6178 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 0u
6179 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
6180
6181 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6182 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
6183 #else
6184 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
6185 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6186
6187 #if defined(MBEDTLS_SSL_ALPN)
6188 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
6189 #else
6190 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
6191 #endif /* MBEDTLS_SSL_ALPN */
6192
6193 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
6194 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
6195 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
6196 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
6197
6198 #define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
6199 ( (uint32_t) ( \
6200 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
6201 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
6202 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
6203 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
6204 0u ) )
6205
6206 static unsigned char ssl_serialized_context_header[] = {
6207 MBEDTLS_VERSION_MAJOR,
6208 MBEDTLS_VERSION_MINOR,
6209 MBEDTLS_VERSION_PATCH,
6210 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
6211 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
6212 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
6213 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
6214 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
6215 };
6216
6217 /*
6218 * Serialize a full SSL context
6219 *
6220 * The format of the serialized data is:
6221 * (in the presentation language of TLS, RFC 8446 section 3)
6222 *
6223 * // header
6224 * opaque mbedtls_version[3]; // major, minor, patch
6225 * opaque context_format[5]; // version-specific field determining
6226 * // the format of the remaining
6227 * // serialized data.
6228 * Note: When updating the format, remember to keep these
6229 * version+format bytes. (We may make their size part of the API.)
6230 *
6231 * // session sub-structure
6232 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
6233 * // transform sub-structure
6234 * uint8 random[64]; // ServerHello.random+ClientHello.random
6235 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
6236 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
6237 * // fields from ssl_context
6238 * uint32 badmac_seen; // DTLS: number of records with failing MAC
6239 * uint64 in_window_top; // DTLS: last validated record seq_num
6240 * uint64 in_window; // DTLS: bitmask for replay protection
6241 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
6242 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
6243 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
6244 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
6245 *
6246 * Note that many fields of the ssl_context or sub-structures are not
6247 * serialized, as they fall in one of the following categories:
6248 *
6249 * 1. forced value (eg in_left must be 0)
6250 * 2. pointer to dynamically-allocated memory (eg session, transform)
6251 * 3. value can be re-derived from other data (eg session keys from MS)
6252 * 4. value was temporary (eg content of input buffer)
6253 * 5. value will be provided by the user again (eg I/O callbacks and context)
6254 */
mbedtls_ssl_context_save(mbedtls_ssl_context * ssl,unsigned char * buf,size_t buf_len,size_t * olen)6255 int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
6256 unsigned char *buf,
6257 size_t buf_len,
6258 size_t *olen )
6259 {
6260 unsigned char *p = buf;
6261 size_t used = 0;
6262 size_t session_len;
6263 int ret = 0;
6264
6265 /*
6266 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
6267 * this function's documentation.
6268 *
6269 * These are due to assumptions/limitations in the implementation. Some of
6270 * them are likely to stay (no handshake in progress) some might go away
6271 * (only DTLS) but are currently used to simplify the implementation.
6272 */
6273 /* The initial handshake must be over */
6274 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
6275 {
6276 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
6277 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6278 }
6279 if( ssl->handshake != NULL )
6280 {
6281 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
6282 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6283 }
6284 /* Double-check that sub-structures are indeed ready */
6285 if( ssl->transform == NULL || ssl->session == NULL )
6286 {
6287 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
6288 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6289 }
6290 /* There must be no pending incoming or outgoing data */
6291 if( mbedtls_ssl_check_pending( ssl ) != 0 )
6292 {
6293 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
6294 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6295 }
6296 if( ssl->out_left != 0 )
6297 {
6298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
6299 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6300 }
6301 /* Protocol must be DLTS, not TLS */
6302 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6303 {
6304 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
6305 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6306 }
6307 /* Version must be 1.2 */
6308 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
6309 {
6310 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
6311 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6312 }
6313 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
6314 {
6315 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
6316 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6317 }
6318 /* We must be using an AEAD ciphersuite */
6319 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
6320 {
6321 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
6322 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6323 }
6324 /* Renegotiation must not be enabled */
6325 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6326 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
6327 {
6328 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
6329 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6330 }
6331 #endif
6332
6333 /*
6334 * Version and format identifier
6335 */
6336 used += sizeof( ssl_serialized_context_header );
6337
6338 if( used <= buf_len )
6339 {
6340 memcpy( p, ssl_serialized_context_header,
6341 sizeof( ssl_serialized_context_header ) );
6342 p += sizeof( ssl_serialized_context_header );
6343 }
6344
6345 /*
6346 * Session (length + data)
6347 */
6348 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
6349 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
6350 return( ret );
6351
6352 used += 4 + session_len;
6353 if( used <= buf_len )
6354 {
6355 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
6356 p += 4;
6357
6358 ret = ssl_session_save( ssl->session, 1,
6359 p, session_len, &session_len );
6360 if( ret != 0 )
6361 return( ret );
6362
6363 p += session_len;
6364 }
6365
6366 /*
6367 * Transform
6368 */
6369 used += sizeof( ssl->transform->randbytes );
6370 if( used <= buf_len )
6371 {
6372 memcpy( p, ssl->transform->randbytes,
6373 sizeof( ssl->transform->randbytes ) );
6374 p += sizeof( ssl->transform->randbytes );
6375 }
6376
6377 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6378 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
6379 if( used <= buf_len )
6380 {
6381 *p++ = ssl->transform->in_cid_len;
6382 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
6383 p += ssl->transform->in_cid_len;
6384
6385 *p++ = ssl->transform->out_cid_len;
6386 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
6387 p += ssl->transform->out_cid_len;
6388 }
6389 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6390
6391 /*
6392 * Saved fields from top-level ssl_context structure
6393 */
6394 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
6395 used += 4;
6396 if( used <= buf_len )
6397 {
6398 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
6399 p += 4;
6400 }
6401 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
6402
6403 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6404 used += 16;
6405 if( used <= buf_len )
6406 {
6407 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
6408 p += 8;
6409
6410 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
6411 p += 8;
6412 }
6413 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6414
6415 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6416 used += 1;
6417 if( used <= buf_len )
6418 {
6419 *p++ = ssl->disable_datagram_packing;
6420 }
6421 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6422
6423 used += 8;
6424 if( used <= buf_len )
6425 {
6426 memcpy( p, ssl->cur_out_ctr, 8 );
6427 p += 8;
6428 }
6429
6430 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6431 used += 2;
6432 if( used <= buf_len )
6433 {
6434 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
6435 p += 2;
6436 }
6437 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6438
6439 #if defined(MBEDTLS_SSL_ALPN)
6440 {
6441 const uint8_t alpn_len = ssl->alpn_chosen
6442 ? (uint8_t) strlen( ssl->alpn_chosen )
6443 : 0;
6444
6445 used += 1 + alpn_len;
6446 if( used <= buf_len )
6447 {
6448 *p++ = alpn_len;
6449
6450 if( ssl->alpn_chosen != NULL )
6451 {
6452 memcpy( p, ssl->alpn_chosen, alpn_len );
6453 p += alpn_len;
6454 }
6455 }
6456 }
6457 #endif /* MBEDTLS_SSL_ALPN */
6458
6459 /*
6460 * Done
6461 */
6462 *olen = used;
6463
6464 if( used > buf_len )
6465 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
6466
6467 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
6468
6469 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
6470 }
6471
6472 /*
6473 * Helper to get TLS 1.2 PRF from ciphersuite
6474 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
6475 */
6476 typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
6477 const char *label,
6478 const unsigned char *random, size_t rlen,
6479 unsigned char *dstbuf, size_t dlen );
ssl_tls12prf_from_cs(int ciphersuite_id)6480 static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
6481 {
6482 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
6483 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
6484 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
6485
6486 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
6487 return( tls_prf_sha384 );
6488 #else
6489 (void) ciphersuite_id;
6490 #endif
6491 return( tls_prf_sha256 );
6492 }
6493
6494 /*
6495 * Deserialize context, see mbedtls_ssl_context_save() for format.
6496 *
6497 * This internal version is wrapped by a public function that cleans up in
6498 * case of error.
6499 */
ssl_context_load(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)6500 static int ssl_context_load( mbedtls_ssl_context *ssl,
6501 const unsigned char *buf,
6502 size_t len )
6503 {
6504 const unsigned char *p = buf;
6505 const unsigned char * const end = buf + len;
6506 size_t session_len;
6507 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6508
6509 /*
6510 * The context should have been freshly setup or reset.
6511 * Give the user an error in case of obvious misuse.
6512 * (Checking session is useful because it won't be NULL if we're
6513 * renegotiating, or if the user mistakenly loaded a session first.)
6514 */
6515 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
6516 ssl->session != NULL )
6517 {
6518 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6519 }
6520
6521 /*
6522 * We can't check that the config matches the initial one, but we can at
6523 * least check it matches the requirements for serializing.
6524 */
6525 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
6526 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
6527 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 ||
6528 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ||
6529 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 ||
6530 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6531 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
6532 #endif
6533 0 )
6534 {
6535 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6536 }
6537
6538 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
6539
6540 /*
6541 * Check version identifier
6542 */
6543 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
6544 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6545
6546 if( memcmp( p, ssl_serialized_context_header,
6547 sizeof( ssl_serialized_context_header ) ) != 0 )
6548 {
6549 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
6550 }
6551 p += sizeof( ssl_serialized_context_header );
6552
6553 /*
6554 * Session
6555 */
6556 if( (size_t)( end - p ) < 4 )
6557 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6558
6559 session_len = ( (size_t) p[0] << 24 ) |
6560 ( (size_t) p[1] << 16 ) |
6561 ( (size_t) p[2] << 8 ) |
6562 ( (size_t) p[3] );
6563 p += 4;
6564
6565 /* This has been allocated by ssl_handshake_init(), called by
6566 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
6567 ssl->session = ssl->session_negotiate;
6568 ssl->session_in = ssl->session;
6569 ssl->session_out = ssl->session;
6570 ssl->session_negotiate = NULL;
6571
6572 if( (size_t)( end - p ) < session_len )
6573 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6574
6575 ret = ssl_session_load( ssl->session, 1, p, session_len );
6576 if( ret != 0 )
6577 {
6578 mbedtls_ssl_session_free( ssl->session );
6579 return( ret );
6580 }
6581
6582 p += session_len;
6583
6584 /*
6585 * Transform
6586 */
6587
6588 /* This has been allocated by ssl_handshake_init(), called by
6589 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
6590 ssl->transform = ssl->transform_negotiate;
6591 ssl->transform_in = ssl->transform;
6592 ssl->transform_out = ssl->transform;
6593 ssl->transform_negotiate = NULL;
6594
6595 /* Read random bytes and populate structure */
6596 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
6597 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6598
6599 ret = ssl_populate_transform( ssl->transform,
6600 ssl->session->ciphersuite,
6601 ssl->session->master,
6602 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
6603 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6604 ssl->session->encrypt_then_mac,
6605 #endif
6606 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
6607 ssl->session->trunc_hmac,
6608 #endif
6609 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
6610 #if defined(MBEDTLS_ZLIB_SUPPORT)
6611 ssl->session->compression,
6612 #endif
6613 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
6614 p, /* currently pointing to randbytes */
6615 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
6616 ssl->conf->endpoint,
6617 ssl );
6618 if( ret != 0 )
6619 return( ret );
6620
6621 p += sizeof( ssl->transform->randbytes );
6622
6623 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6624 /* Read connection IDs and store them */
6625 if( (size_t)( end - p ) < 1 )
6626 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6627
6628 ssl->transform->in_cid_len = *p++;
6629
6630 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
6631 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6632
6633 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
6634 p += ssl->transform->in_cid_len;
6635
6636 ssl->transform->out_cid_len = *p++;
6637
6638 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
6639 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6640
6641 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
6642 p += ssl->transform->out_cid_len;
6643 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6644
6645 /*
6646 * Saved fields from top-level ssl_context structure
6647 */
6648 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
6649 if( (size_t)( end - p ) < 4 )
6650 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6651
6652 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
6653 ( (uint32_t) p[1] << 16 ) |
6654 ( (uint32_t) p[2] << 8 ) |
6655 ( (uint32_t) p[3] );
6656 p += 4;
6657 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
6658
6659 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6660 if( (size_t)( end - p ) < 16 )
6661 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6662
6663 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
6664 ( (uint64_t) p[1] << 48 ) |
6665 ( (uint64_t) p[2] << 40 ) |
6666 ( (uint64_t) p[3] << 32 ) |
6667 ( (uint64_t) p[4] << 24 ) |
6668 ( (uint64_t) p[5] << 16 ) |
6669 ( (uint64_t) p[6] << 8 ) |
6670 ( (uint64_t) p[7] );
6671 p += 8;
6672
6673 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
6674 ( (uint64_t) p[1] << 48 ) |
6675 ( (uint64_t) p[2] << 40 ) |
6676 ( (uint64_t) p[3] << 32 ) |
6677 ( (uint64_t) p[4] << 24 ) |
6678 ( (uint64_t) p[5] << 16 ) |
6679 ( (uint64_t) p[6] << 8 ) |
6680 ( (uint64_t) p[7] );
6681 p += 8;
6682 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6683
6684 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6685 if( (size_t)( end - p ) < 1 )
6686 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6687
6688 ssl->disable_datagram_packing = *p++;
6689 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6690
6691 if( (size_t)( end - p ) < 8 )
6692 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6693
6694 memcpy( ssl->cur_out_ctr, p, 8 );
6695 p += 8;
6696
6697 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6698 if( (size_t)( end - p ) < 2 )
6699 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6700
6701 ssl->mtu = ( p[0] << 8 ) | p[1];
6702 p += 2;
6703 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6704
6705 #if defined(MBEDTLS_SSL_ALPN)
6706 {
6707 uint8_t alpn_len;
6708 const char **cur;
6709
6710 if( (size_t)( end - p ) < 1 )
6711 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6712
6713 alpn_len = *p++;
6714
6715 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
6716 {
6717 /* alpn_chosen should point to an item in the configured list */
6718 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
6719 {
6720 if( strlen( *cur ) == alpn_len &&
6721 memcmp( p, cur, alpn_len ) == 0 )
6722 {
6723 ssl->alpn_chosen = *cur;
6724 break;
6725 }
6726 }
6727 }
6728
6729 /* can only happen on conf mismatch */
6730 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
6731 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6732
6733 p += alpn_len;
6734 }
6735 #endif /* MBEDTLS_SSL_ALPN */
6736
6737 /*
6738 * Forced fields from top-level ssl_context structure
6739 *
6740 * Most of them already set to the correct value by mbedtls_ssl_init() and
6741 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
6742 */
6743 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
6744
6745 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6746 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6747
6748 /* Adjust pointers for header fields of outgoing records to
6749 * the given transform, accounting for explicit IV and CID. */
6750 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
6751
6752 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6753 ssl->in_epoch = 1;
6754 #endif
6755
6756 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
6757 * which we don't want - otherwise we'd end up freeing the wrong transform
6758 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
6759 * inappropriately. */
6760 if( ssl->handshake != NULL )
6761 {
6762 mbedtls_ssl_handshake_free( ssl );
6763 mbedtls_free( ssl->handshake );
6764 ssl->handshake = NULL;
6765 }
6766
6767 /*
6768 * Done - should have consumed entire buffer
6769 */
6770 if( p != end )
6771 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6772
6773 return( 0 );
6774 }
6775
6776 /*
6777 * Deserialize context: public wrapper for error cleaning
6778 */
mbedtls_ssl_context_load(mbedtls_ssl_context * context,const unsigned char * buf,size_t len)6779 int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
6780 const unsigned char *buf,
6781 size_t len )
6782 {
6783 int ret = ssl_context_load( context, buf, len );
6784
6785 if( ret != 0 )
6786 mbedtls_ssl_free( context );
6787
6788 return( ret );
6789 }
6790 #endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
6791
6792 /*
6793 * Free an SSL context
6794 */
mbedtls_ssl_free(mbedtls_ssl_context * ssl)6795 void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
6796 {
6797 if( ssl == NULL )
6798 return;
6799
6800 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
6801
6802 if( ssl->out_buf != NULL )
6803 {
6804 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6805 size_t out_buf_len = ssl->out_buf_len;
6806 #else
6807 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
6808 #endif
6809
6810 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
6811 mbedtls_free( ssl->out_buf );
6812 ssl->out_buf = NULL;
6813 }
6814
6815 if( ssl->in_buf != NULL )
6816 {
6817 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6818 size_t in_buf_len = ssl->in_buf_len;
6819 #else
6820 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6821 #endif
6822
6823 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
6824 mbedtls_free( ssl->in_buf );
6825 ssl->in_buf = NULL;
6826 }
6827
6828 #if defined(MBEDTLS_ZLIB_SUPPORT)
6829 if( ssl->compress_buf != NULL )
6830 {
6831 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
6832 mbedtls_free( ssl->compress_buf );
6833 }
6834 #endif
6835
6836 if( ssl->transform )
6837 {
6838 mbedtls_ssl_transform_free( ssl->transform );
6839 mbedtls_free( ssl->transform );
6840 }
6841
6842 if( ssl->handshake )
6843 {
6844 mbedtls_ssl_handshake_free( ssl );
6845 mbedtls_ssl_transform_free( ssl->transform_negotiate );
6846 mbedtls_ssl_session_free( ssl->session_negotiate );
6847
6848 mbedtls_free( ssl->handshake );
6849 mbedtls_free( ssl->transform_negotiate );
6850 mbedtls_free( ssl->session_negotiate );
6851 }
6852
6853 if( ssl->session )
6854 {
6855 mbedtls_ssl_session_free( ssl->session );
6856 mbedtls_free( ssl->session );
6857 }
6858
6859 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6860 if( ssl->hostname != NULL )
6861 {
6862 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
6863 mbedtls_free( ssl->hostname );
6864 }
6865 #endif
6866
6867 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
6868 if( mbedtls_ssl_hw_record_finish != NULL )
6869 {
6870 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
6871 mbedtls_ssl_hw_record_finish( ssl );
6872 }
6873 #endif
6874
6875 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6876 mbedtls_free( ssl->cli_id );
6877 #endif
6878
6879 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
6880
6881 /* Actually clear after last debug message */
6882 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
6883 }
6884
6885 /*
6886 * Initialze mbedtls_ssl_config
6887 */
mbedtls_ssl_config_init(mbedtls_ssl_config * conf)6888 void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
6889 {
6890 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
6891 }
6892
6893 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6894 static int ssl_preset_default_hashes[] = {
6895 #if defined(MBEDTLS_SHA512_C)
6896 MBEDTLS_MD_SHA512,
6897 #endif
6898 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
6899 MBEDTLS_MD_SHA384,
6900 #endif
6901 #if defined(MBEDTLS_SHA256_C)
6902 MBEDTLS_MD_SHA256,
6903 MBEDTLS_MD_SHA224,
6904 #endif
6905 #if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
6906 MBEDTLS_MD_SHA1,
6907 #endif
6908 MBEDTLS_MD_NONE
6909 };
6910 #endif
6911
6912 static int ssl_preset_suiteb_ciphersuites[] = {
6913 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
6914 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
6915 0
6916 };
6917
6918 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6919 static int ssl_preset_suiteb_hashes[] = {
6920 MBEDTLS_MD_SHA256,
6921 MBEDTLS_MD_SHA384,
6922 MBEDTLS_MD_NONE
6923 };
6924 #endif
6925
6926 #if defined(MBEDTLS_ECP_C)
6927 static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
6928 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6929 MBEDTLS_ECP_DP_SECP256R1,
6930 #endif
6931 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6932 MBEDTLS_ECP_DP_SECP384R1,
6933 #endif
6934 MBEDTLS_ECP_DP_NONE
6935 };
6936 #endif
6937
6938 /*
6939 * Load default in mbedtls_ssl_config
6940 */
mbedtls_ssl_config_defaults(mbedtls_ssl_config * conf,int endpoint,int transport,int preset)6941 int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
6942 int endpoint, int transport, int preset )
6943 {
6944 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
6945 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6946 #endif
6947
6948 /* Use the functions here so that they are covered in tests,
6949 * but otherwise access member directly for efficiency */
6950 mbedtls_ssl_conf_endpoint( conf, endpoint );
6951 mbedtls_ssl_conf_transport( conf, transport );
6952
6953 /*
6954 * Things that are common to all presets
6955 */
6956 #if defined(MBEDTLS_SSL_CLI_C)
6957 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
6958 {
6959 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
6960 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
6961 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
6962 #endif
6963 }
6964 #endif
6965
6966 #if defined(MBEDTLS_ARC4_C)
6967 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
6968 #endif
6969
6970 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6971 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
6972 #endif
6973
6974 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6975 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
6976 #endif
6977
6978 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
6979 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
6980 #endif
6981
6982 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6983 conf->f_cookie_write = ssl_cookie_write_dummy;
6984 conf->f_cookie_check = ssl_cookie_check_dummy;
6985 #endif
6986
6987 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6988 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
6989 #endif
6990
6991 #if defined(MBEDTLS_SSL_SRV_C)
6992 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
6993 #endif
6994
6995 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6996 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
6997 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
6998 #endif
6999
7000 #if defined(MBEDTLS_SSL_RENEGOTIATION)
7001 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
7002 memset( conf->renego_period, 0x00, 2 );
7003 memset( conf->renego_period + 2, 0xFF, 6 );
7004 #endif
7005
7006 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
7007 if( endpoint == MBEDTLS_SSL_IS_SERVER )
7008 {
7009 const unsigned char dhm_p[] =
7010 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
7011 const unsigned char dhm_g[] =
7012 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
7013
7014 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
7015 dhm_p, sizeof( dhm_p ),
7016 dhm_g, sizeof( dhm_g ) ) ) != 0 )
7017 {
7018 return( ret );
7019 }
7020 }
7021 #endif
7022
7023 /*
7024 * Preset-specific defaults
7025 */
7026 switch( preset )
7027 {
7028 /*
7029 * NSA Suite B
7030 */
7031 case MBEDTLS_SSL_PRESET_SUITEB:
7032 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
7033 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
7034 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
7035 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
7036
7037 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
7038 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
7039 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
7040 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
7041 ssl_preset_suiteb_ciphersuites;
7042
7043 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7044 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
7045 #endif
7046
7047 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7048 conf->sig_hashes = ssl_preset_suiteb_hashes;
7049 #endif
7050
7051 #if defined(MBEDTLS_ECP_C)
7052 conf->curve_list = ssl_preset_suiteb_curves;
7053 #endif
7054 break;
7055
7056 /*
7057 * Default
7058 */
7059 default:
7060 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
7061 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
7062 MBEDTLS_SSL_MIN_MAJOR_VERSION :
7063 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
7064 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
7065 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
7066 MBEDTLS_SSL_MIN_MINOR_VERSION :
7067 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
7068 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
7069 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
7070
7071 #if defined(MBEDTLS_SSL_PROTO_DTLS)
7072 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7073 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
7074 #endif
7075
7076 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
7077 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
7078 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
7079 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
7080 mbedtls_ssl_list_ciphersuites();
7081
7082 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7083 conf->cert_profile = &mbedtls_x509_crt_profile_default;
7084 #endif
7085
7086 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7087 conf->sig_hashes = ssl_preset_default_hashes;
7088 #endif
7089
7090 #if defined(MBEDTLS_ECP_C)
7091 conf->curve_list = mbedtls_ecp_grp_id_list();
7092 #endif
7093
7094 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
7095 conf->dhm_min_bitlen = 1024;
7096 #endif
7097 }
7098
7099 return( 0 );
7100 }
7101
7102 /*
7103 * Free mbedtls_ssl_config
7104 */
mbedtls_ssl_config_free(mbedtls_ssl_config * conf)7105 void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
7106 {
7107 #if defined(MBEDTLS_DHM_C)
7108 mbedtls_mpi_free( &conf->dhm_P );
7109 mbedtls_mpi_free( &conf->dhm_G );
7110 #endif
7111
7112 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
7113 if( conf->psk != NULL )
7114 {
7115 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
7116 mbedtls_free( conf->psk );
7117 conf->psk = NULL;
7118 conf->psk_len = 0;
7119 }
7120
7121 if( conf->psk_identity != NULL )
7122 {
7123 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
7124 mbedtls_free( conf->psk_identity );
7125 conf->psk_identity = NULL;
7126 conf->psk_identity_len = 0;
7127 }
7128 #endif
7129
7130 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7131 ssl_key_cert_free( conf->key_cert );
7132 #endif
7133
7134 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
7135 }
7136
7137 #if defined(MBEDTLS_PK_C) && \
7138 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
7139 /*
7140 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
7141 */
mbedtls_ssl_sig_from_pk(mbedtls_pk_context * pk)7142 unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
7143 {
7144 #if defined(MBEDTLS_RSA_C)
7145 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
7146 return( MBEDTLS_SSL_SIG_RSA );
7147 #endif
7148 #if defined(MBEDTLS_ECDSA_C)
7149 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
7150 return( MBEDTLS_SSL_SIG_ECDSA );
7151 #endif
7152 return( MBEDTLS_SSL_SIG_ANON );
7153 }
7154
mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type)7155 unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
7156 {
7157 switch( type ) {
7158 case MBEDTLS_PK_RSA:
7159 return( MBEDTLS_SSL_SIG_RSA );
7160 case MBEDTLS_PK_ECDSA:
7161 case MBEDTLS_PK_ECKEY:
7162 return( MBEDTLS_SSL_SIG_ECDSA );
7163 default:
7164 return( MBEDTLS_SSL_SIG_ANON );
7165 }
7166 }
7167
mbedtls_ssl_pk_alg_from_sig(unsigned char sig)7168 mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
7169 {
7170 switch( sig )
7171 {
7172 #if defined(MBEDTLS_RSA_C)
7173 case MBEDTLS_SSL_SIG_RSA:
7174 return( MBEDTLS_PK_RSA );
7175 #endif
7176 #if defined(MBEDTLS_ECDSA_C)
7177 case MBEDTLS_SSL_SIG_ECDSA:
7178 return( MBEDTLS_PK_ECDSA );
7179 #endif
7180 default:
7181 return( MBEDTLS_PK_NONE );
7182 }
7183 }
7184 #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
7185
7186 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
7187 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7188
7189 /* Find an entry in a signature-hash set matching a given hash algorithm. */
mbedtls_ssl_sig_hash_set_find(mbedtls_ssl_sig_hash_set_t * set,mbedtls_pk_type_t sig_alg)7190 mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
7191 mbedtls_pk_type_t sig_alg )
7192 {
7193 switch( sig_alg )
7194 {
7195 case MBEDTLS_PK_RSA:
7196 return( set->rsa );
7197 case MBEDTLS_PK_ECDSA:
7198 return( set->ecdsa );
7199 default:
7200 return( MBEDTLS_MD_NONE );
7201 }
7202 }
7203
7204 /* Add a signature-hash-pair to a signature-hash set */
mbedtls_ssl_sig_hash_set_add(mbedtls_ssl_sig_hash_set_t * set,mbedtls_pk_type_t sig_alg,mbedtls_md_type_t md_alg)7205 void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
7206 mbedtls_pk_type_t sig_alg,
7207 mbedtls_md_type_t md_alg )
7208 {
7209 switch( sig_alg )
7210 {
7211 case MBEDTLS_PK_RSA:
7212 if( set->rsa == MBEDTLS_MD_NONE )
7213 set->rsa = md_alg;
7214 break;
7215
7216 case MBEDTLS_PK_ECDSA:
7217 if( set->ecdsa == MBEDTLS_MD_NONE )
7218 set->ecdsa = md_alg;
7219 break;
7220
7221 default:
7222 break;
7223 }
7224 }
7225
7226 /* Allow exactly one hash algorithm for each signature. */
mbedtls_ssl_sig_hash_set_const_hash(mbedtls_ssl_sig_hash_set_t * set,mbedtls_md_type_t md_alg)7227 void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
7228 mbedtls_md_type_t md_alg )
7229 {
7230 set->rsa = md_alg;
7231 set->ecdsa = md_alg;
7232 }
7233
7234 #endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
7235 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7236
7237 /*
7238 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
7239 */
mbedtls_ssl_md_alg_from_hash(unsigned char hash)7240 mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
7241 {
7242 switch( hash )
7243 {
7244 #if defined(MBEDTLS_MD5_C)
7245 case MBEDTLS_SSL_HASH_MD5:
7246 return( MBEDTLS_MD_MD5 );
7247 #endif
7248 #if defined(MBEDTLS_SHA1_C)
7249 case MBEDTLS_SSL_HASH_SHA1:
7250 return( MBEDTLS_MD_SHA1 );
7251 #endif
7252 #if defined(MBEDTLS_SHA256_C)
7253 case MBEDTLS_SSL_HASH_SHA224:
7254 return( MBEDTLS_MD_SHA224 );
7255 case MBEDTLS_SSL_HASH_SHA256:
7256 return( MBEDTLS_MD_SHA256 );
7257 #endif
7258 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
7259 case MBEDTLS_SSL_HASH_SHA384:
7260 return( MBEDTLS_MD_SHA384 );
7261 #endif
7262 #if defined(MBEDTLS_SHA512_C)
7263 case MBEDTLS_SSL_HASH_SHA512:
7264 return( MBEDTLS_MD_SHA512 );
7265 #endif
7266 default:
7267 return( MBEDTLS_MD_NONE );
7268 }
7269 }
7270
7271 /*
7272 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
7273 */
mbedtls_ssl_hash_from_md_alg(int md)7274 unsigned char mbedtls_ssl_hash_from_md_alg( int md )
7275 {
7276 switch( md )
7277 {
7278 #if defined(MBEDTLS_MD5_C)
7279 case MBEDTLS_MD_MD5:
7280 return( MBEDTLS_SSL_HASH_MD5 );
7281 #endif
7282 #if defined(MBEDTLS_SHA1_C)
7283 case MBEDTLS_MD_SHA1:
7284 return( MBEDTLS_SSL_HASH_SHA1 );
7285 #endif
7286 #if defined(MBEDTLS_SHA256_C)
7287 case MBEDTLS_MD_SHA224:
7288 return( MBEDTLS_SSL_HASH_SHA224 );
7289 case MBEDTLS_MD_SHA256:
7290 return( MBEDTLS_SSL_HASH_SHA256 );
7291 #endif
7292 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
7293 case MBEDTLS_MD_SHA384:
7294 return( MBEDTLS_SSL_HASH_SHA384 );
7295 #endif
7296 #if defined(MBEDTLS_SHA512_C)
7297 case MBEDTLS_MD_SHA512:
7298 return( MBEDTLS_SSL_HASH_SHA512 );
7299 #endif
7300 default:
7301 return( MBEDTLS_SSL_HASH_NONE );
7302 }
7303 }
7304
7305 #if defined(MBEDTLS_ECP_C)
7306 /*
7307 * Check if a curve proposed by the peer is in our list.
7308 * Return 0 if we're willing to use it, -1 otherwise.
7309 */
mbedtls_ssl_check_curve(const mbedtls_ssl_context * ssl,mbedtls_ecp_group_id grp_id)7310 int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
7311 {
7312 const mbedtls_ecp_group_id *gid;
7313
7314 if( ssl->conf->curve_list == NULL )
7315 return( -1 );
7316
7317 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
7318 if( *gid == grp_id )
7319 return( 0 );
7320
7321 return( -1 );
7322 }
7323 #endif /* MBEDTLS_ECP_C */
7324
7325 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7326 /*
7327 * Check if a hash proposed by the peer is in our list.
7328 * Return 0 if we're willing to use it, -1 otherwise.
7329 */
mbedtls_ssl_check_sig_hash(const mbedtls_ssl_context * ssl,mbedtls_md_type_t md)7330 int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
7331 mbedtls_md_type_t md )
7332 {
7333 const int *cur;
7334
7335 if( ssl->conf->sig_hashes == NULL )
7336 return( -1 );
7337
7338 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
7339 if( *cur == (int) md )
7340 return( 0 );
7341
7342 return( -1 );
7343 }
7344 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7345
7346 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt * cert,const mbedtls_ssl_ciphersuite_t * ciphersuite,int cert_endpoint,uint32_t * flags)7347 int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
7348 const mbedtls_ssl_ciphersuite_t *ciphersuite,
7349 int cert_endpoint,
7350 uint32_t *flags )
7351 {
7352 int ret = 0;
7353 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
7354 int usage = 0;
7355 #endif
7356 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
7357 const char *ext_oid;
7358 size_t ext_len;
7359 #endif
7360
7361 #if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
7362 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
7363 ((void) cert);
7364 ((void) cert_endpoint);
7365 ((void) flags);
7366 #endif
7367
7368 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
7369 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
7370 {
7371 /* Server part of the key exchange */
7372 switch( ciphersuite->key_exchange )
7373 {
7374 case MBEDTLS_KEY_EXCHANGE_RSA:
7375 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
7376 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
7377 break;
7378
7379 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
7380 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
7381 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
7382 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
7383 break;
7384
7385 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
7386 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
7387 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
7388 break;
7389
7390 /* Don't use default: we want warnings when adding new values */
7391 case MBEDTLS_KEY_EXCHANGE_NONE:
7392 case MBEDTLS_KEY_EXCHANGE_PSK:
7393 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
7394 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
7395 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
7396 usage = 0;
7397 }
7398 }
7399 else
7400 {
7401 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
7402 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
7403 }
7404
7405 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
7406 {
7407 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
7408 ret = -1;
7409 }
7410 #else
7411 ((void) ciphersuite);
7412 #endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
7413
7414 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
7415 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
7416 {
7417 ext_oid = MBEDTLS_OID_SERVER_AUTH;
7418 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
7419 }
7420 else
7421 {
7422 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
7423 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
7424 }
7425
7426 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
7427 {
7428 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
7429 ret = -1;
7430 }
7431 #endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
7432
7433 return( ret );
7434 }
7435 #endif /* MBEDTLS_X509_CRT_PARSE_C */
7436
mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context * ssl,int md)7437 int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
7438 {
7439 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
7440 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
7441 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
7442
7443 switch( md )
7444 {
7445 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
7446 #if defined(MBEDTLS_MD5_C)
7447 case MBEDTLS_SSL_HASH_MD5:
7448 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
7449 #endif
7450 #if defined(MBEDTLS_SHA1_C)
7451 case MBEDTLS_SSL_HASH_SHA1:
7452 ssl->handshake->calc_verify = ssl_calc_verify_tls;
7453 break;
7454 #endif
7455 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
7456 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384)
7457 case MBEDTLS_SSL_HASH_SHA384:
7458 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
7459 break;
7460 #endif
7461 #if defined(MBEDTLS_SHA256_C)
7462 case MBEDTLS_SSL_HASH_SHA256:
7463 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
7464 break;
7465 #endif
7466 default:
7467 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
7468 }
7469
7470 return 0;
7471 #else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
7472 (void) ssl;
7473 (void) md;
7474
7475 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
7476 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7477 }
7478
7479 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
7480 defined(MBEDTLS_SSL_PROTO_TLS1_1)
mbedtls_ssl_get_key_exchange_md_ssl_tls(mbedtls_ssl_context * ssl,unsigned char * output,unsigned char * data,size_t data_len)7481 int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
7482 unsigned char *output,
7483 unsigned char *data, size_t data_len )
7484 {
7485 int ret = 0;
7486 mbedtls_md5_context mbedtls_md5;
7487 mbedtls_sha1_context mbedtls_sha1;
7488
7489 mbedtls_md5_init( &mbedtls_md5 );
7490 mbedtls_sha1_init( &mbedtls_sha1 );
7491
7492 /*
7493 * digitally-signed struct {
7494 * opaque md5_hash[16];
7495 * opaque sha_hash[20];
7496 * };
7497 *
7498 * md5_hash
7499 * MD5(ClientHello.random + ServerHello.random
7500 * + ServerParams);
7501 * sha_hash
7502 * SHA(ClientHello.random + ServerHello.random
7503 * + ServerParams);
7504 */
7505 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
7506 {
7507 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
7508 goto exit;
7509 }
7510 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
7511 ssl->handshake->randbytes, 64 ) ) != 0 )
7512 {
7513 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
7514 goto exit;
7515 }
7516 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
7517 {
7518 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
7519 goto exit;
7520 }
7521 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
7522 {
7523 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
7524 goto exit;
7525 }
7526
7527 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
7528 {
7529 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
7530 goto exit;
7531 }
7532 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
7533 ssl->handshake->randbytes, 64 ) ) != 0 )
7534 {
7535 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
7536 goto exit;
7537 }
7538 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
7539 data_len ) ) != 0 )
7540 {
7541 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
7542 goto exit;
7543 }
7544 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
7545 output + 16 ) ) != 0 )
7546 {
7547 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
7548 goto exit;
7549 }
7550
7551 exit:
7552 mbedtls_md5_free( &mbedtls_md5 );
7553 mbedtls_sha1_free( &mbedtls_sha1 );
7554
7555 if( ret != 0 )
7556 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7557 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7558
7559 return( ret );
7560
7561 }
7562 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
7563 MBEDTLS_SSL_PROTO_TLS1_1 */
7564
7565 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
7566 defined(MBEDTLS_SSL_PROTO_TLS1_2)
7567
7568 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hashlen,unsigned char * data,size_t data_len,mbedtls_md_type_t md_alg)7569 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7570 unsigned char *hash, size_t *hashlen,
7571 unsigned char *data, size_t data_len,
7572 mbedtls_md_type_t md_alg )
7573 {
7574 psa_status_t status;
7575 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
7576 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
7577
7578 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
7579
7580 if( ( status = psa_hash_setup( &hash_operation,
7581 hash_alg ) ) != PSA_SUCCESS )
7582 {
7583 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
7584 goto exit;
7585 }
7586
7587 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
7588 64 ) ) != PSA_SUCCESS )
7589 {
7590 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7591 goto exit;
7592 }
7593
7594 if( ( status = psa_hash_update( &hash_operation,
7595 data, data_len ) ) != PSA_SUCCESS )
7596 {
7597 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7598 goto exit;
7599 }
7600
7601 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
7602 hashlen ) ) != PSA_SUCCESS )
7603 {
7604 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
7605 goto exit;
7606 }
7607
7608 exit:
7609 if( status != PSA_SUCCESS )
7610 {
7611 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7612 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7613 switch( status )
7614 {
7615 case PSA_ERROR_NOT_SUPPORTED:
7616 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
7617 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
7618 case PSA_ERROR_BUFFER_TOO_SMALL:
7619 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7620 case PSA_ERROR_INSUFFICIENT_MEMORY:
7621 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7622 default:
7623 return( MBEDTLS_ERR_MD_HW_ACCEL_FAILED );
7624 }
7625 }
7626 return( 0 );
7627 }
7628
7629 #else
7630
mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hashlen,unsigned char * data,size_t data_len,mbedtls_md_type_t md_alg)7631 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7632 unsigned char *hash, size_t *hashlen,
7633 unsigned char *data, size_t data_len,
7634 mbedtls_md_type_t md_alg )
7635 {
7636 int ret = 0;
7637 mbedtls_md_context_t ctx;
7638 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
7639 *hashlen = mbedtls_md_get_size( md_info );
7640
7641 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
7642
7643 mbedtls_md_init( &ctx );
7644
7645 /*
7646 * digitally-signed struct {
7647 * opaque client_random[32];
7648 * opaque server_random[32];
7649 * ServerDHParams params;
7650 * };
7651 */
7652 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7653 {
7654 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7655 goto exit;
7656 }
7657 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7658 {
7659 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7660 goto exit;
7661 }
7662 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7663 {
7664 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7665 goto exit;
7666 }
7667 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7668 {
7669 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7670 goto exit;
7671 }
7672 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
7673 {
7674 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7675 goto exit;
7676 }
7677
7678 exit:
7679 mbedtls_md_free( &ctx );
7680
7681 if( ret != 0 )
7682 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7683 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7684
7685 return( ret );
7686 }
7687 #endif /* MBEDTLS_USE_PSA_CRYPTO */
7688
7689 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
7690 MBEDTLS_SSL_PROTO_TLS1_2 */
7691
7692 #endif /* MBEDTLS_SSL_TLS_C */
7693
