blob: e144c243314a9d1b86bce5577855ec601f0e40c9 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Jerry Yub476a442022-01-21 18:14:45 +080028#include <assert.h>
29
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
Jerry Yu6ade7432022-01-25 10:39:33 +080034#include <stdio.h>
SimonBd5800b72016-04-26 07:43:27 +010035#define mbedtls_calloc calloc
36#define mbedtls_free free
Jerry Yu6ade7432022-01-25 10:39:33 +080037#define mbedtls_printf printf
38#endif /* !MBEDTLS_PLATFORM_C */
SimonBd5800b72016-04-26 07:43:27 +010039
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000040#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010041#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010042#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000043#include "ssl_misc.h"
Janos Follath73c616b2019-12-18 15:07:04 +000044#include "mbedtls/debug.h"
45#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050046#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010047#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020048#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020049
Rich Evans00ab4702015-02-06 13:43:58 +000050#include <string.h>
51
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050052#if defined(MBEDTLS_USE_PSA_CRYPTO)
53#include "mbedtls/psa_util.h"
54#include "psa/crypto.h"
55#endif
56
Janos Follath23bdca02016-10-07 14:47:14 +010057#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000058#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020059#endif
60
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020061#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010062
Hanno Beckera0e20d02019-05-15 14:03:01 +010063#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010064/* Top-level Connection ID API */
65
Hanno Becker8367ccc2019-05-14 11:30:10 +010066int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
67 size_t len,
68 int ignore_other_cid )
Hanno Beckerad4a1372019-05-03 13:06:44 +010069{
70 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
71 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
72
Hanno Becker611ac772019-05-14 11:45:26 +010073 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
74 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
75 {
76 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
77 }
78
79 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010080 conf->cid_len = len;
81 return( 0 );
82}
83
Hanno Beckerf8542cf2019-04-09 15:22:03 +010084int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
85 int enable,
86 unsigned char const *own_cid,
87 size_t own_cid_len )
88{
Hanno Becker76a79ab2019-05-03 14:38:32 +010089 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
90 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
91
Hanno Beckerca092242019-04-25 16:01:49 +010092 ssl->negotiate_cid = enable;
93 if( enable == MBEDTLS_SSL_CID_DISABLED )
94 {
95 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
96 return( 0 );
97 }
98 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckerad4a1372019-05-03 13:06:44 +010099 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Beckerca092242019-04-25 16:01:49 +0100100
Hanno Beckerad4a1372019-05-03 13:06:44 +0100101 if( own_cid_len != ssl->conf->cid_len )
Hanno Beckerca092242019-04-25 16:01:49 +0100102 {
Hanno Beckerad4a1372019-05-03 13:06:44 +0100103 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
104 (unsigned) own_cid_len,
105 (unsigned) ssl->conf->cid_len ) );
Hanno Beckerca092242019-04-25 16:01:49 +0100106 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
107 }
108
109 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100110 /* Truncation is not an issue here because
111 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
112 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100113
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100114 return( 0 );
115}
116
117int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
118 int *enabled,
119 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
120 size_t *peer_cid_len )
121{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100122 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100123
Hanno Becker76a79ab2019-05-03 14:38:32 +0100124 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
125 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
126 {
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100127 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker76a79ab2019-05-03 14:38:32 +0100128 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100129
Hanno Beckerc5f24222019-05-03 12:54:52 +0100130 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
131 * were used, but client and server requested the empty CID.
132 * This is indistinguishable from not using the CID extension
133 * in the first place. */
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100134 if( ssl->transform_in->in_cid_len == 0 &&
135 ssl->transform_in->out_cid_len == 0 )
136 {
137 return( 0 );
138 }
139
Hanno Becker615ef172019-05-22 16:50:35 +0100140 if( peer_cid_len != NULL )
141 {
142 *peer_cid_len = ssl->transform_in->out_cid_len;
143 if( peer_cid != NULL )
144 {
145 memcpy( peer_cid, ssl->transform_in->out_cid,
146 ssl->transform_in->out_cid_len );
147 }
148 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100149
150 *enabled = MBEDTLS_SSL_CID_ENABLED;
151
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100152 return( 0 );
153}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100154#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100155
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200156#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200158#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200159/*
160 * Convert max_fragment_length codes to length.
161 * RFC 6066 says:
162 * enum{
163 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
164 * } MaxFragmentLength;
165 * and we add 0 -> extension unused
166 */
Angus Grattond8213d02016-05-25 20:56:48 +1000167static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200168{
Angus Grattond8213d02016-05-25 20:56:48 +1000169 switch( mfl )
170 {
171 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
172 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
173 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
174 return 512;
175 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
176 return 1024;
177 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
178 return 2048;
179 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
180 return 4096;
181 default:
182 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
183 }
184}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200185#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200186
Hanno Becker52055ae2019-02-06 14:30:46 +0000187int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
188 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200189{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200190 mbedtls_ssl_session_free( dst );
191 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200192
吴敬辉0b716112021-11-29 10:46:35 +0800193#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
194 dst->ticket = NULL;
195#endif
196
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200197#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000198
199#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200200 if( src->peer_cert != NULL )
201 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000202 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200203
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200204 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200205 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200206 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200208 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200210 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200211 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200212 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200213 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200214 dst->peer_cert = NULL;
215 return( ret );
216 }
217 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000218#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker9198ad12019-02-05 17:00:50 +0000219 if( src->peer_cert_digest != NULL )
220 {
Hanno Becker9198ad12019-02-05 17:00:50 +0000221 dst->peer_cert_digest =
Hanno Beckeraccc5992019-02-25 10:06:59 +0000222 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9198ad12019-02-05 17:00:50 +0000223 if( dst->peer_cert_digest == NULL )
224 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
225
226 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
227 src->peer_cert_digest_len );
228 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000229 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000230 }
231#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
232
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200233#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200234
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200235#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200236 if( src->ticket != NULL )
237 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200238 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200239 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200240 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200241
242 memcpy( dst->ticket, src->ticket, src->ticket_len );
243 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200244#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200245
246 return( 0 );
247}
248
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500249#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
250static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
251{
252 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
253 if( resized_buffer == NULL )
254 return -1;
255
256 /* We want to copy len_new bytes when downsizing the buffer, and
257 * len_old bytes when upsizing, so we choose the smaller of two sizes,
258 * to fit one buffer into another. Size checks, ensuring that no data is
259 * lost, are done outside of this function. */
260 memcpy( resized_buffer, *buffer,
261 ( len_new < *len_old ) ? len_new : *len_old );
262 mbedtls_platform_zeroize( *buffer, *len_old );
263 mbedtls_free( *buffer );
264
265 *buffer = resized_buffer;
266 *len_old = len_new;
267
268 return 0;
269}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200270
271static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
Andrzej Kurek069fa962021-01-07 08:02:15 -0500272 size_t in_buf_new_len,
273 size_t out_buf_new_len )
Andrzej Kurek4a063792020-10-21 15:08:44 +0200274{
275 int modified = 0;
276 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
277 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
278 if( ssl->in_buf != NULL )
279 {
280 written_in = ssl->in_msg - ssl->in_buf;
281 iv_offset_in = ssl->in_iv - ssl->in_buf;
282 len_offset_in = ssl->in_len - ssl->in_buf;
283 if( downsizing ?
284 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
285 ssl->in_buf_len < in_buf_new_len )
286 {
287 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
288 {
289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
290 }
291 else
292 {
Paul Elliottb7449902021-03-10 18:14:58 +0000293 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
294 in_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200295 modified = 1;
296 }
297 }
298 }
299
300 if( ssl->out_buf != NULL )
301 {
302 written_out = ssl->out_msg - ssl->out_buf;
303 iv_offset_out = ssl->out_iv - ssl->out_buf;
304 len_offset_out = ssl->out_len - ssl->out_buf;
305 if( downsizing ?
306 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
307 ssl->out_buf_len < out_buf_new_len )
308 {
309 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
310 {
311 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
312 }
313 else
314 {
Paul Elliottb7449902021-03-10 18:14:58 +0000315 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
316 out_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200317 modified = 1;
318 }
319 }
320 }
321 if( modified )
322 {
323 /* Update pointers here to avoid doing it twice. */
324 mbedtls_ssl_reset_in_out_pointers( ssl );
325 /* Fields below might not be properly updated with record
326 * splitting or with CID, so they are manually updated here. */
327 ssl->out_msg = ssl->out_buf + written_out;
328 ssl->out_len = ssl->out_buf + len_offset_out;
329 ssl->out_iv = ssl->out_buf + iv_offset_out;
330
331 ssl->in_msg = ssl->in_buf + written_in;
332 ssl->in_len = ssl->in_buf + len_offset_in;
333 ssl->in_iv = ssl->in_buf + iv_offset_in;
334 }
335}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500336#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
337
Jerry Yudb8c48a2022-01-27 14:54:54 +0800338#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800339
340#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
341typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
342 const char *label,
343 const unsigned char *random, size_t rlen,
344 unsigned char *dstbuf, size_t dlen );
345
346static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id );
347
348#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
349
350/* Type for the TLS PRF */
351typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
352 const unsigned char *, size_t,
353 unsigned char *, size_t);
354
355static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
356 int ciphersuite,
357 const unsigned char master[48],
358#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
359 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
360 int encrypt_then_mac,
361#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
362 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
363 ssl_tls_prf_t tls_prf,
364 const unsigned char randbytes[64],
365 int minor_ver,
366 unsigned endpoint,
367 const mbedtls_ssl_context *ssl );
368
369#if defined(MBEDTLS_SHA256_C)
370static int tls_prf_sha256( const unsigned char *secret, size_t slen,
371 const char *label,
372 const unsigned char *random, size_t rlen,
373 unsigned char *dstbuf, size_t dlen );
374static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
375static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
376
377#endif /* MBEDTLS_SHA256_C */
378
379#if defined(MBEDTLS_SHA384_C)
380static int tls_prf_sha384( const unsigned char *secret, size_t slen,
381 const char *label,
382 const unsigned char *random, size_t rlen,
383 unsigned char *dstbuf, size_t dlen );
384
385static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
386static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
387#endif /* MBEDTLS_SHA384_C */
388
389static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
390 unsigned char *buf,
391 size_t buf_len );
392static int ssl_session_load_tls12( mbedtls_ssl_session *session,
393 const unsigned char *buf,
394 size_t len );
395#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
396
Jerry Yu53d23e22022-02-09 16:25:09 +0800397static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
398
Jerry Yudb8c48a2022-01-27 14:54:54 +0800399#if defined(MBEDTLS_SHA256_C)
400static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
Jerry Yu53d23e22022-02-09 16:25:09 +0800401#endif /* MBEDTLS_SHA256_C */
Jerry Yudb8c48a2022-01-27 14:54:54 +0800402
403#if defined(MBEDTLS_SHA384_C)
404static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
Jerry Yu53d23e22022-02-09 16:25:09 +0800405#endif /* MBEDTLS_SHA384_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000406
Ron Eldor51d3ab52019-05-12 14:54:30 +0300407int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
408 const unsigned char *secret, size_t slen,
409 const char *label,
410 const unsigned char *random, size_t rlen,
411 unsigned char *dstbuf, size_t dlen )
412{
413 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
414
415 switch( prf )
416 {
Ron Eldord2f25f72019-05-15 14:54:22 +0300417#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200418#if defined(MBEDTLS_SHA384_C)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300419 case MBEDTLS_SSL_TLS_PRF_SHA384:
420 tls_prf = tls_prf_sha384;
421 break;
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200422#endif /* MBEDTLS_SHA384_C */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300423#if defined(MBEDTLS_SHA256_C)
424 case MBEDTLS_SSL_TLS_PRF_SHA256:
425 tls_prf = tls_prf_sha256;
426 break;
Ron Eldord2f25f72019-05-15 14:54:22 +0300427#endif /* MBEDTLS_SHA256_C */
428#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300429 default:
430 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
431 }
432
433 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
434}
435
Jerry Yuc73c6182022-02-08 20:29:25 +0800436#if defined(MBEDTLS_X509_CRT_PARSE_C)
437static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
438{
439#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
440 if( session->peer_cert != NULL )
441 {
442 mbedtls_x509_crt_free( session->peer_cert );
443 mbedtls_free( session->peer_cert );
444 session->peer_cert = NULL;
445 }
446#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
447 if( session->peer_cert_digest != NULL )
448 {
449 /* Zeroization is not necessary. */
450 mbedtls_free( session->peer_cert_digest );
451 session->peer_cert_digest = NULL;
452 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
453 session->peer_cert_digest_len = 0;
454 }
455#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
456}
457#endif /* MBEDTLS_X509_CRT_PARSE_C */
458
459void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
460 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
461{
462 ((void) ciphersuite_info);
463
464#if defined(MBEDTLS_SHA384_C)
465 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
466 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
467 else
468#endif
469#if defined(MBEDTLS_SHA256_C)
470 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
471 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
472 else
473#endif
474 {
475 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
476 return;
477 }
478}
479
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100480static void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
481 unsigned hs_type,
482 size_t total_hs_len )
483{
484 unsigned char hs_hdr[4];
485
486 /* Build HS header for checksum update. */
487 hs_hdr[0] = MBEDTLS_BYTE_0( hs_type );
488 hs_hdr[1] = MBEDTLS_BYTE_2( total_hs_len );
489 hs_hdr[2] = MBEDTLS_BYTE_1( total_hs_len );
490 hs_hdr[3] = MBEDTLS_BYTE_0( total_hs_len );
491
492 ssl->handshake->update_checksum( ssl, hs_hdr, sizeof( hs_hdr ) );
493}
494
495void mbedtls_ssl_add_hs_msg_to_checksum( mbedtls_ssl_context *ssl,
496 unsigned hs_type,
497 unsigned char const *msg,
498 size_t msg_len )
499{
500 mbedtls_ssl_add_hs_hdr_to_checksum( ssl, hs_type, msg_len );
501 ssl->handshake->update_checksum( ssl, msg, msg_len );
502}
503
Jerry Yuc73c6182022-02-08 20:29:25 +0800504void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
505{
506 ((void) ssl);
507#if defined(MBEDTLS_SHA256_C)
508#if defined(MBEDTLS_USE_PSA_CRYPTO)
509 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
510 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
511#else
512 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
513#endif
514#endif
515#if defined(MBEDTLS_SHA384_C)
516#if defined(MBEDTLS_USE_PSA_CRYPTO)
517 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
518 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
519#else
520 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
521#endif
522#endif
523}
524
525static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
526 const unsigned char *buf, size_t len )
527{
528#if defined(MBEDTLS_SHA256_C)
529#if defined(MBEDTLS_USE_PSA_CRYPTO)
530 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
531#else
532 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
533#endif
534#endif
535#if defined(MBEDTLS_SHA384_C)
536#if defined(MBEDTLS_USE_PSA_CRYPTO)
537 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
538#else
539 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
540#endif
541#endif
542}
543
544#if defined(MBEDTLS_SHA256_C)
545static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
546 const unsigned char *buf, size_t len )
547{
548#if defined(MBEDTLS_USE_PSA_CRYPTO)
549 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
550#else
551 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
552#endif
553}
554#endif
555
556#if defined(MBEDTLS_SHA384_C)
557static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
558 const unsigned char *buf, size_t len )
559{
560#if defined(MBEDTLS_USE_PSA_CRYPTO)
561 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
562#else
563 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
564#endif
565}
566#endif
567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200568static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200569{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200570 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200572#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500573#if defined(MBEDTLS_USE_PSA_CRYPTO)
574 handshake->fin_sha256_psa = psa_hash_operation_init();
575 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
576#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200577 mbedtls_sha256_init( &handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +0200578 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200579#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500580#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200581#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500582#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500583 handshake->fin_sha384_psa = psa_hash_operation_init();
584 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -0500585#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200586 mbedtls_sha512_init( &handshake->fin_sha512 );
TRodziewicz26371e42021-06-08 16:45:41 +0200587 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200588#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500589#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200590
591 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100592
593#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +0100594 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100595 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
596#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200598#if defined(MBEDTLS_DHM_C)
599 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200600#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200601#if defined(MBEDTLS_ECDH_C)
602 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200603#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200604#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200605 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +0200606#if defined(MBEDTLS_SSL_CLI_C)
607 handshake->ecjpake_cache = NULL;
608 handshake->ecjpake_cache_len = 0;
609#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200610#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200611
Gilles Peskineeccd8882020-03-10 12:19:08 +0100612#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +0200613 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +0200614#endif
615
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200616#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
617 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
618#endif
Hanno Becker75173122019-02-06 16:18:31 +0000619
620#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
621 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
622 mbedtls_pk_init( &handshake->peer_pubkey );
623#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200624}
625
Hanno Beckera18d1322018-01-03 14:27:32 +0000626void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200627{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200628 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +0200629
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100630#if defined(MBEDTLS_USE_PSA_CRYPTO)
631 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
632 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100633#else
634 mbedtls_cipher_init( &transform->cipher_ctx_enc );
635 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100636#endif
637
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000638#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +0100639#if defined(MBEDTLS_USE_PSA_CRYPTO)
640 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
641 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100642#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200643 mbedtls_md_init( &transform->md_ctx_enc );
644 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +0000645#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100646#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200647}
648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200649void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200650{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200651 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200652}
653
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200654static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +0000655{
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200656 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +0000657 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200658 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200659 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200660 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200661 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +0200662 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200663
664 /*
665 * Either the pointers are now NULL or cleared properly and can be freed.
666 * Now allocate missing structures.
667 */
668 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200669 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200670 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200671 }
Paul Bakker48916f92012-09-16 19:57:18 +0000672
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200673 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200674 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200675 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200676 }
Paul Bakker48916f92012-09-16 19:57:18 +0000677
Paul Bakker82788fb2014-10-20 13:59:19 +0200678 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200679 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200680 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200681 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500682#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
683 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -0400684
Andrzej Kurek4a063792020-10-21 15:08:44 +0200685 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
686 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500687#endif
Paul Bakker48916f92012-09-16 19:57:18 +0000688
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200689 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +0000690 if( ssl->handshake == NULL ||
691 ssl->transform_negotiate == NULL ||
692 ssl->session_negotiate == NULL )
693 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +0200694 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200695
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200696 mbedtls_free( ssl->handshake );
697 mbedtls_free( ssl->transform_negotiate );
698 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200699
700 ssl->handshake = NULL;
701 ssl->transform_negotiate = NULL;
702 ssl->session_negotiate = NULL;
703
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200704 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +0000705 }
706
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200707 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200708 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Beckera18d1322018-01-03 14:27:32 +0000709 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +0200710 ssl_handshake_params_init( ssl->handshake );
711
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200712#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200713 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
714 {
715 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200716
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200717 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
718 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
719 else
720 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200721
Hanno Becker0f57a652020-02-05 10:37:26 +0000722 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200723 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200724#endif
725
Brett Warrene0edc842021-08-17 09:53:13 +0100726/*
727 * curve_list is translated to IANA TLS group identifiers here because
728 * mbedtls_ssl_conf_curves returns void and so can't return
729 * any error codes.
730 */
731#if defined(MBEDTLS_ECP_C)
732#if !defined(MBEDTLS_DEPRECATED_REMOVED)
733 /* Heap allocate and translate curve_list from internal to IANA group ids */
734 if ( ssl->conf->curve_list != NULL )
735 {
736 size_t length;
737 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
738
739 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
740 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
741
742 /* Leave room for zero termination */
743 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
744 if ( group_list == NULL )
745 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
746
747 for( size_t i = 0; i < length; i++ )
748 {
749 const mbedtls_ecp_curve_info *info =
750 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
751 if ( info == NULL )
752 {
753 mbedtls_free( group_list );
754 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
755 }
756 group_list[i] = info->tls_id;
757 }
758
759 group_list[length] = 0;
760
761 ssl->handshake->group_list = group_list;
762 ssl->handshake->group_list_heap_allocated = 1;
763 }
764 else
765 {
766 ssl->handshake->group_list = ssl->conf->group_list;
767 ssl->handshake->group_list_heap_allocated = 0;
768 }
769#endif /* MBEDTLS_DEPRECATED_REMOVED */
770#endif /* MBEDTLS_ECP_C */
771
Jerry Yuf017ee42022-01-12 15:49:48 +0800772#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
773#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +0800774#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +0800775 /* Heap allocate and translate sig_hashes from internal hash identifiers to
776 signature algorithms IANA identifiers. */
777 if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) &&
Jerry Yuf017ee42022-01-12 15:49:48 +0800778 ssl->conf->sig_hashes != NULL )
779 {
780 const int *md;
781 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +0800782 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +0800783 uint16_t *p;
784
Jerry Yub476a442022-01-21 18:14:45 +0800785#if defined(static_assert)
786 static_assert( MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
787 <= ( SIZE_MAX - ( 2 * sizeof(uint16_t) ) ),
788 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big" );
Jerry Yua68dca22022-01-20 16:28:27 +0800789#endif
790
Jerry Yuf017ee42022-01-12 15:49:48 +0800791 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
792 {
793 if( mbedtls_ssl_hash_from_md_alg( *md ) == MBEDTLS_SSL_HASH_NONE )
794 continue;
Jerry Yub476a442022-01-21 18:14:45 +0800795#if defined(MBEDTLS_ECDSA_C)
796 sig_algs_len += sizeof( uint16_t );
797#endif
Jerry Yua68dca22022-01-20 16:28:27 +0800798
Jerry Yub476a442022-01-21 18:14:45 +0800799#if defined(MBEDTLS_RSA_C)
800 sig_algs_len += sizeof( uint16_t );
801#endif
802 if( sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN )
803 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Jerry Yuf017ee42022-01-12 15:49:48 +0800804 }
805
Jerry Yub476a442022-01-21 18:14:45 +0800806 if( sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN )
Jerry Yuf017ee42022-01-12 15:49:48 +0800807 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
808
Jerry Yub476a442022-01-21 18:14:45 +0800809 ssl->handshake->sig_algs = mbedtls_calloc( 1, sig_algs_len +
810 sizeof( uint16_t ));
Jerry Yuf017ee42022-01-12 15:49:48 +0800811 if( ssl->handshake->sig_algs == NULL )
812 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
813
814 p = (uint16_t *)ssl->handshake->sig_algs;
815 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
816 {
817 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *md );
818 if( hash == MBEDTLS_SSL_HASH_NONE )
819 continue;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800820#if defined(MBEDTLS_ECDSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800821 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA);
822 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800823#endif
824#if defined(MBEDTLS_RSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800825 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA);
826 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800827#endif
Jerry Yuf017ee42022-01-12 15:49:48 +0800828 }
829 *p = MBEDTLS_TLS1_3_SIG_NONE;
830 ssl->handshake->sig_algs_heap_allocated = 1;
831 }
832 else
Jerry Yua69269a2022-01-17 21:06:01 +0800833#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +0800834 {
835 ssl->handshake->sig_algs = ssl->conf->sig_algs;
836 ssl->handshake->sig_algs_heap_allocated = 0;
837 }
838#endif /* MBEDTLS_DEPRECATED_REMOVED */
839#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +0000840 return( 0 );
841}
842
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200843#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200844/* Dummy cookie callbacks for defaults */
845static int ssl_cookie_write_dummy( void *ctx,
846 unsigned char **p, unsigned char *end,
847 const unsigned char *cli_id, size_t cli_id_len )
848{
849 ((void) ctx);
850 ((void) p);
851 ((void) end);
852 ((void) cli_id);
853 ((void) cli_id_len);
854
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200855 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200856}
857
858static int ssl_cookie_check_dummy( void *ctx,
859 const unsigned char *cookie, size_t cookie_len,
860 const unsigned char *cli_id, size_t cli_id_len )
861{
862 ((void) ctx);
863 ((void) cookie);
864 ((void) cookie_len);
865 ((void) cli_id);
866 ((void) cli_id_len);
867
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200868 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200869}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200870#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200871
Paul Bakker5121ce52009-01-03 21:22:43 +0000872/*
873 * Initialize an SSL context
874 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200875void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
876{
877 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
878}
879
Jerry Yu60835a82021-08-04 10:13:52 +0800880static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
881{
Ronald Cron086ee0b2022-03-15 15:18:51 +0100882 const mbedtls_ssl_config *conf = ssl->conf;
883
Ronald Cron6f135e12021-12-08 16:57:54 +0100884#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100885 if( mbedtls_ssl_conf_is_tls13_only( conf ) )
886 {
887 if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jerry Yu60835a82021-08-04 10:13:52 +0800888 {
Ronald Cron086ee0b2022-03-15 15:18:51 +0100889 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported." ) );
Jerry Yu60835a82021-08-04 10:13:52 +0800890 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
891 }
Ronald Cron37bdaab2022-03-30 16:45:51 +0200892
893 if( conf->endpoint == MBEDTLS_SSL_IS_SERVER )
894 {
895 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 server is not supported yet." ) );
896 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
897 }
898
Jerry Yu60835a82021-08-04 10:13:52 +0800899 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
900 return( 0 );
901 }
902#endif
903
904#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100905 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800906 {
907 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
908 return( 0 );
909 }
910#endif
911
Ronald Cron6f135e12021-12-08 16:57:54 +0100912#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100913 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800914 {
Ronald Crone1d3f062022-02-10 14:50:54 +0100915 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
916 {
917 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2" ) );
918 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
919 }
Ronald Cron37bdaab2022-03-30 16:45:51 +0200920
921 if( conf->endpoint == MBEDTLS_SSL_IS_SERVER )
922 {
923 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 server is not supported yet." ) );
924 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
925 }
926
Ronald Crone1d3f062022-02-10 14:50:54 +0100927 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is TLS 1.3 or TLS 1.2." ) );
928 return( 0 );
Jerry Yu60835a82021-08-04 10:13:52 +0800929 }
930#endif
931
932 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
933 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
934}
935
936static int ssl_conf_check(const mbedtls_ssl_context *ssl)
937{
938 int ret;
939 ret = ssl_conf_version_check( ssl );
940 if( ret != 0 )
941 return( ret );
942
943 /* Space for further checks */
944
945 return( 0 );
946}
947
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200948/*
949 * Setup an SSL context
950 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100951
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +0200952int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +0200953 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +0000954{
Janos Follath865b3eb2019-12-16 11:46:15 +0000955 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +0000956 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
957 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +0000958
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +0200959 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +0000960
Jerry Yu60835a82021-08-04 10:13:52 +0800961 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
962 return( ret );
963
Paul Bakker62f2dee2012-09-28 07:31:51 +0000964 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +0100965 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +0000966 */
k-stachowiakc9a5f022018-07-24 13:53:31 +0200967
968 /* Set to NULL in case of an error condition */
969 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +0200970
Darryl Greenb33cc762019-11-28 14:29:44 +0000971#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
972 ssl->in_buf_len = in_buf_len;
973#endif
974 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +1000975 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +0000976 {
Paul Elliottd48d5c62021-01-07 14:47:05 +0000977 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +0200978 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +0200979 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +1000980 }
981
Darryl Greenb33cc762019-11-28 14:29:44 +0000982#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
983 ssl->out_buf_len = out_buf_len;
984#endif
985 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +1000986 if( ssl->out_buf == NULL )
987 {
Paul Elliottd48d5c62021-01-07 14:47:05 +0000988 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +0200989 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +0200990 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +0000991 }
992
Hanno Becker3e6f8ab2020-02-05 10:40:57 +0000993 mbedtls_ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +0200994
Johan Pascalb62bb512015-12-03 21:56:45 +0100995#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +0200996 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
Johan Pascalb62bb512015-12-03 21:56:45 +0100997#endif
998
Paul Bakker48916f92012-09-16 19:57:18 +0000999 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02001000 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001001
1002 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02001003
1004error:
1005 mbedtls_free( ssl->in_buf );
1006 mbedtls_free( ssl->out_buf );
1007
1008 ssl->conf = NULL;
1009
Darryl Greenb33cc762019-11-28 14:29:44 +00001010#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1011 ssl->in_buf_len = 0;
1012 ssl->out_buf_len = 0;
1013#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001014 ssl->in_buf = NULL;
1015 ssl->out_buf = NULL;
1016
1017 ssl->in_hdr = NULL;
1018 ssl->in_ctr = NULL;
1019 ssl->in_len = NULL;
1020 ssl->in_iv = NULL;
1021 ssl->in_msg = NULL;
1022
1023 ssl->out_hdr = NULL;
1024 ssl->out_ctr = NULL;
1025 ssl->out_len = NULL;
1026 ssl->out_iv = NULL;
1027 ssl->out_msg = NULL;
1028
k-stachowiak9f7798e2018-07-31 16:52:32 +02001029 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001030}
1031
1032/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001033 * Reset an initialized and used SSL context for re-use while retaining
1034 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001035 *
1036 * If partial is non-zero, keep data in the input buffer and client ID.
1037 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001038 */
XiaokangQian78b1fa72022-01-19 06:56:30 +00001039void mbedtls_ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
1040 int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00001041{
Darryl Greenb33cc762019-11-28 14:29:44 +00001042#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1043 size_t in_buf_len = ssl->in_buf_len;
1044 size_t out_buf_len = ssl->out_buf_len;
1045#else
1046 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1047 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1048#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001049
Hanno Beckerb0302c42021-08-03 09:39:42 +01001050#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1051 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001052#endif
1053
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001054 /* Cancel any possibly running timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00001055 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001056
Hanno Beckerb0302c42021-08-03 09:39:42 +01001057 mbedtls_ssl_reset_in_out_pointers( ssl );
1058
1059 /* Reset incoming message parsing */
1060 ssl->in_offt = NULL;
1061 ssl->nb_zero = 0;
1062 ssl->in_msgtype = 0;
1063 ssl->in_msglen = 0;
1064 ssl->in_hslen = 0;
1065 ssl->keep_current_message = 0;
1066 ssl->transform_in = NULL;
1067
1068#if defined(MBEDTLS_SSL_PROTO_DTLS)
1069 ssl->next_record_offset = 0;
1070 ssl->in_epoch = 0;
1071#endif
1072
1073 /* Keep current datagram if partial == 1 */
1074 if( partial == 0 )
1075 {
1076 ssl->in_left = 0;
1077 memset( ssl->in_buf, 0, in_buf_len );
1078 }
1079
1080 /* Reset outgoing message writing */
1081 ssl->out_msgtype = 0;
1082 ssl->out_msglen = 0;
1083 ssl->out_left = 0;
1084 memset( ssl->out_buf, 0, out_buf_len );
1085 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
1086 ssl->transform_out = NULL;
1087
1088#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1089 mbedtls_ssl_dtls_replay_reset( ssl );
1090#endif
1091
XiaokangQian2b01dc32022-01-21 02:53:13 +00001092#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001093 if( ssl->transform )
1094 {
1095 mbedtls_ssl_transform_free( ssl->transform );
1096 mbedtls_free( ssl->transform );
1097 ssl->transform = NULL;
1098 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001099#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1100
XiaokangQian2b01dc32022-01-21 02:53:13 +00001101#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1102 mbedtls_ssl_transform_free( ssl->transform_application );
1103 mbedtls_free( ssl->transform_application );
1104 ssl->transform_application = NULL;
1105
1106 if( ssl->handshake != NULL )
1107 {
1108 mbedtls_ssl_transform_free( ssl->handshake->transform_earlydata );
1109 mbedtls_free( ssl->handshake->transform_earlydata );
1110 ssl->handshake->transform_earlydata = NULL;
1111
1112 mbedtls_ssl_transform_free( ssl->handshake->transform_handshake );
1113 mbedtls_free( ssl->handshake->transform_handshake );
1114 ssl->handshake->transform_handshake = NULL;
1115 }
1116
XiaokangQian2b01dc32022-01-21 02:53:13 +00001117#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001118}
1119
1120int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
1121{
1122 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1123
1124 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
1125
XiaokangQian78b1fa72022-01-19 06:56:30 +00001126 mbedtls_ssl_session_reset_msg_layer( ssl, partial );
Hanno Beckerb0302c42021-08-03 09:39:42 +01001127
1128 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001129#if defined(MBEDTLS_SSL_RENEGOTIATION)
1130 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001131 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001132
1133 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001134 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
1135 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001136#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001137 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001138
Hanno Beckerb0302c42021-08-03 09:39:42 +01001139 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001140 ssl->session_out = NULL;
Paul Bakkerc0463502013-02-14 11:19:38 +01001141 if( ssl->session )
1142 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001143 mbedtls_ssl_session_free( ssl->session );
1144 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01001145 ssl->session = NULL;
1146 }
1147
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001148#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001149 ssl->alpn_chosen = NULL;
1150#endif
1151
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001152#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01001153#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001154 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01001155#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001156 {
1157 mbedtls_free( ssl->cli_id );
1158 ssl->cli_id = NULL;
1159 ssl->cli_id_len = 0;
1160 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001161#endif
1162
Paul Bakker48916f92012-09-16 19:57:18 +00001163 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
1164 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001165
1166 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00001167}
1168
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001169/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001170 * Reset an initialized and used SSL context for re-use while retaining
1171 * all application-set variables, function pointers and data.
1172 */
1173int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
1174{
Hanno Becker43aefe22020-02-05 10:44:56 +00001175 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001176}
1177
1178/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001179 * SSL set accessors
1180 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001181void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00001182{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001183 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001184}
1185
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02001186void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001187{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001188 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001189}
1190
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001191#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001192void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001193{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001194 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001195}
1196#endif
1197
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001198void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001199{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001200 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001201}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001202
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001203#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001204
Hanno Becker1841b0a2018-08-24 11:13:57 +01001205void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
1206 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01001207{
1208 ssl->disable_datagram_packing = !allow_packing;
1209}
1210
1211void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
1212 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001213{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001214 conf->hs_timeout_min = min;
1215 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001216}
1217#endif
1218
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001219void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00001220{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001221 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001222}
1223
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001224#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001225void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02001226 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001227 void *p_vrfy )
1228{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001229 conf->f_vrfy = f_vrfy;
1230 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001231}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001232#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001233
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001234void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001235 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00001236 void *p_rng )
1237{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001238 conf->f_rng = f_rng;
1239 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001240}
1241
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001242void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02001243 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00001244 void *p_dbg )
1245{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001246 conf->f_dbg = f_dbg;
1247 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001248}
1249
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001250void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001251 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00001252 mbedtls_ssl_send_t *f_send,
1253 mbedtls_ssl_recv_t *f_recv,
1254 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001255{
1256 ssl->p_bio = p_bio;
1257 ssl->f_send = f_send;
1258 ssl->f_recv = f_recv;
1259 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001260}
1261
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001262#if defined(MBEDTLS_SSL_PROTO_DTLS)
1263void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
1264{
1265 ssl->mtu = mtu;
1266}
1267#endif
1268
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001269void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001270{
1271 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001272}
1273
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001274void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
1275 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00001276 mbedtls_ssl_set_timer_t *f_set_timer,
1277 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001278{
1279 ssl->p_timer = p_timer;
1280 ssl->f_set_timer = f_set_timer;
1281 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001282
1283 /* Make sure we start with no timer running */
Hanno Becker0f57a652020-02-05 10:37:26 +00001284 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001285}
1286
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001287#if defined(MBEDTLS_SSL_SRV_C)
Glenn Strauss2ed95272022-01-21 18:02:17 -05001288void mbedtls_ssl_conf_cert_cb( mbedtls_ssl_config *conf,
1289 int (*f_cert_cb)(mbedtls_ssl_context *) )
1290{
1291 conf->f_cert_cb = f_cert_cb;
1292}
1293#endif /* MBEDTLS_SSL_SRV_C */
1294
1295#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001296void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Hanno Beckera637ff62021-04-15 08:42:48 +01001297 void *p_cache,
1298 mbedtls_ssl_cache_get_t *f_get_cache,
1299 mbedtls_ssl_cache_set_t *f_set_cache )
Paul Bakker5121ce52009-01-03 21:22:43 +00001300{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001301 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001302 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001303 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001304}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001305#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001306
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001307#if defined(MBEDTLS_SSL_CLI_C)
1308int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00001309{
Janos Follath865b3eb2019-12-16 11:46:15 +00001310 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001311
1312 if( ssl == NULL ||
1313 session == NULL ||
1314 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001315 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001316 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001317 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001318 }
1319
Hanno Beckere810bbc2021-05-14 16:01:05 +01001320 if( ssl->handshake->resume == 1 )
1321 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1322
Hanno Becker52055ae2019-02-06 14:30:46 +00001323 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
1324 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001325 return( ret );
1326
Paul Bakker0a597072012-09-25 21:55:46 +00001327 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001328
1329 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001330}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001331#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001332
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001333void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
1334 const int *ciphersuites )
1335{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001336 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001337}
1338
Ronald Cron6f135e12021-12-08 16:57:54 +01001339#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yucadebe52021-08-24 10:36:45 +08001340void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
Hanno Becker71f1ed62021-07-24 06:01:47 +01001341 const int kex_modes )
1342{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001343 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001344}
Ronald Cron6f135e12021-12-08 16:57:54 +01001345#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001347#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001348void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01001349 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001350{
1351 conf->cert_profile = profile;
1352}
1353
Glenn Strauss36872db2022-01-22 05:06:31 -05001354static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
1355{
1356 mbedtls_ssl_key_cert *cur = key_cert, *next;
1357
1358 while( cur != NULL )
1359 {
1360 next = cur->next;
1361 mbedtls_free( cur );
1362 cur = next;
1363 }
1364}
1365
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001366/* Append a new keycert entry to a (possibly empty) list */
1367static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
1368 mbedtls_x509_crt *cert,
1369 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001370{
niisato8ee24222018-06-25 19:05:48 +09001371 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001372
Glenn Strauss36872db2022-01-22 05:06:31 -05001373 if( cert == NULL )
1374 {
1375 /* Free list if cert is null */
1376 ssl_key_cert_free( *head );
1377 *head = NULL;
1378 return( 0 );
1379 }
1380
niisato8ee24222018-06-25 19:05:48 +09001381 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
1382 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001383 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001384
niisato8ee24222018-06-25 19:05:48 +09001385 new_cert->cert = cert;
1386 new_cert->key = key;
1387 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001388
Glenn Strauss36872db2022-01-22 05:06:31 -05001389 /* Update head if the list was null, else add to the end */
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001390 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01001391 {
niisato8ee24222018-06-25 19:05:48 +09001392 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01001393 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001394 else
1395 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001396 mbedtls_ssl_key_cert *cur = *head;
1397 while( cur->next != NULL )
1398 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09001399 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001400 }
1401
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001402 return( 0 );
1403}
1404
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001405int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001406 mbedtls_x509_crt *own_cert,
1407 mbedtls_pk_context *pk_key )
1408{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02001409 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001410}
1411
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001412void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001413 mbedtls_x509_crt *ca_chain,
1414 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001415{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001416 conf->ca_chain = ca_chain;
1417 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001418
1419#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1420 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1421 * cannot be used together. */
1422 conf->f_ca_cb = NULL;
1423 conf->p_ca_cb = NULL;
1424#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001425}
Hanno Becker5adaad92019-03-27 16:54:37 +00001426
1427#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1428void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00001429 mbedtls_x509_crt_ca_cb_t f_ca_cb,
Hanno Becker5adaad92019-03-27 16:54:37 +00001430 void *p_ca_cb )
1431{
1432 conf->f_ca_cb = f_ca_cb;
1433 conf->p_ca_cb = p_ca_cb;
1434
1435 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1436 * cannot be used together. */
1437 conf->ca_chain = NULL;
1438 conf->ca_crl = NULL;
1439}
1440#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001441#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001442
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001443#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Glenn Strauss69894072022-01-24 12:58:00 -05001444const unsigned char *mbedtls_ssl_get_hs_sni( mbedtls_ssl_context *ssl,
1445 size_t *name_len )
1446{
1447 *name_len = ssl->handshake->sni_name_len;
1448 return( ssl->handshake->sni_name );
1449}
1450
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001451int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
1452 mbedtls_x509_crt *own_cert,
1453 mbedtls_pk_context *pk_key )
1454{
1455 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
1456 own_cert, pk_key ) );
1457}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001458
1459void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
1460 mbedtls_x509_crt *ca_chain,
1461 mbedtls_x509_crl *ca_crl )
1462{
1463 ssl->handshake->sni_ca_chain = ca_chain;
1464 ssl->handshake->sni_ca_crl = ca_crl;
1465}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001466
1467void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
1468 int authmode )
1469{
1470 ssl->handshake->sni_authmode = authmode;
1471}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001472#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1473
Hanno Becker8927c832019-04-03 12:52:50 +01001474#if defined(MBEDTLS_X509_CRT_PARSE_C)
1475void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
1476 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1477 void *p_vrfy )
1478{
1479 ssl->f_vrfy = f_vrfy;
1480 ssl->p_vrfy = p_vrfy;
1481}
1482#endif
1483
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001484#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001485/*
1486 * Set EC J-PAKE password for current handshake
1487 */
1488int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
1489 const unsigned char *pw,
1490 size_t pw_len )
1491{
1492 mbedtls_ecjpake_role role;
1493
Janos Follath8eb64132016-06-03 15:40:57 +01001494 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001495 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1496
1497 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1498 role = MBEDTLS_ECJPAKE_SERVER;
1499 else
1500 role = MBEDTLS_ECJPAKE_CLIENT;
1501
1502 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
1503 role,
1504 MBEDTLS_MD_SHA256,
1505 MBEDTLS_ECP_DP_SECP256R1,
1506 pw, pw_len ) );
1507}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001508#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001509
Gilles Peskineeccd8882020-03-10 12:19:08 +01001510#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001511
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001512static int ssl_conf_psk_is_configured( mbedtls_ssl_config const *conf )
1513{
1514#if defined(MBEDTLS_USE_PSA_CRYPTO)
1515 if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
1516 return( 1 );
1517#endif /* MBEDTLS_USE_PSA_CRYPTO */
1518
1519 if( conf->psk != NULL )
1520 return( 1 );
1521
1522 return( 0 );
1523}
1524
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001525static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
1526{
1527 /* Remove reference to existing PSK, if any. */
1528#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001529 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001530 {
1531 /* The maintenance of the PSK key slot is the
1532 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001533 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001534 }
Hanno Beckera63ac3f2018-11-05 12:47:16 +00001535 /* This and the following branch should never
1536 * be taken simultaenously as we maintain the
1537 * invariant that raw and opaque PSKs are never
1538 * configured simultaneously. As a safeguard,
1539 * though, `else` is omitted here. */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001540#endif /* MBEDTLS_USE_PSA_CRYPTO */
1541 if( conf->psk != NULL )
1542 {
1543 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
1544
1545 mbedtls_free( conf->psk );
1546 conf->psk = NULL;
1547 conf->psk_len = 0;
1548 }
1549
1550 /* Remove reference to PSK identity, if any. */
1551 if( conf->psk_identity != NULL )
1552 {
1553 mbedtls_free( conf->psk_identity );
1554 conf->psk_identity = NULL;
1555 conf->psk_identity_len = 0;
1556 }
1557}
1558
Hanno Becker7390c712018-11-15 13:33:04 +00001559/* This function assumes that PSK identity in the SSL config is unset.
1560 * It checks that the provided identity is well-formed and attempts
1561 * to make a copy of it in the SSL config.
1562 * On failure, the PSK identity in the config remains unset. */
1563static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
1564 unsigned char const *psk_identity,
1565 size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001566{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001567 /* Identity len will be encoded on two bytes */
Hanno Becker7390c712018-11-15 13:33:04 +00001568 if( psk_identity == NULL ||
1569 ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10001570 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001571 {
1572 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1573 }
1574
Hanno Becker7390c712018-11-15 13:33:04 +00001575 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
1576 if( conf->psk_identity == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001577 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker6db455e2013-09-18 17:29:31 +02001578
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001579 conf->psk_identity_len = psk_identity_len;
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001580 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker5ad403f2013-09-18 21:21:30 +02001581
1582 return( 0 );
Paul Bakker6db455e2013-09-18 17:29:31 +02001583}
1584
Hanno Becker7390c712018-11-15 13:33:04 +00001585int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
1586 const unsigned char *psk, size_t psk_len,
1587 const unsigned char *psk_identity, size_t psk_identity_len )
1588{
Janos Follath865b3eb2019-12-16 11:46:15 +00001589 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001590
1591 /* We currently only support one PSK, raw or opaque. */
1592 if( ssl_conf_psk_is_configured( conf ) )
1593 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Becker7390c712018-11-15 13:33:04 +00001594
1595 /* Check and set raw PSK */
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001596 if( psk == NULL )
Hanno Becker7390c712018-11-15 13:33:04 +00001597 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001598 if( psk_len == 0 )
1599 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1600 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1601 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1602
Hanno Becker7390c712018-11-15 13:33:04 +00001603 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
1604 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1605 conf->psk_len = psk_len;
1606 memcpy( conf->psk, psk, conf->psk_len );
1607
1608 /* Check and set PSK Identity */
1609 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
1610 if( ret != 0 )
1611 ssl_conf_remove_psk( conf );
1612
1613 return( ret );
1614}
1615
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001616static void ssl_remove_psk( mbedtls_ssl_context *ssl )
1617{
1618#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001619 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001620 {
Ronald Croncf56a0a2020-08-04 09:51:30 +02001621 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001622 }
1623 else
1624#endif /* MBEDTLS_USE_PSA_CRYPTO */
1625 if( ssl->handshake->psk != NULL )
1626 {
1627 mbedtls_platform_zeroize( ssl->handshake->psk,
1628 ssl->handshake->psk_len );
1629 mbedtls_free( ssl->handshake->psk );
1630 ssl->handshake->psk_len = 0;
1631 }
1632}
1633
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001634int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
1635 const unsigned char *psk, size_t psk_len )
1636{
1637 if( psk == NULL || ssl->handshake == NULL )
1638 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1639
1640 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1641 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1642
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001643 ssl_remove_psk( ssl );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001644
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02001645 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001646 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001647
1648 ssl->handshake->psk_len = psk_len;
1649 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
1650
1651 return( 0 );
1652}
1653
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001654#if defined(MBEDTLS_USE_PSA_CRYPTO)
1655int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
Andrzej Kurek03e01462022-01-03 12:53:24 +01001656 mbedtls_svc_key_id_t psk,
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001657 const unsigned char *psk_identity,
1658 size_t psk_identity_len )
1659{
Janos Follath865b3eb2019-12-16 11:46:15 +00001660 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001661
1662 /* We currently only support one PSK, raw or opaque. */
1663 if( ssl_conf_psk_is_configured( conf ) )
1664 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001665
Hanno Becker7390c712018-11-15 13:33:04 +00001666 /* Check and set opaque PSK */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001667 if( mbedtls_svc_key_id_is_null( psk ) )
Hanno Becker7390c712018-11-15 13:33:04 +00001668 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ronald Croncf56a0a2020-08-04 09:51:30 +02001669 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00001670
1671 /* Check and set PSK Identity */
1672 ret = ssl_conf_set_psk_identity( conf, psk_identity,
1673 psk_identity_len );
1674 if( ret != 0 )
1675 ssl_conf_remove_psk( conf );
1676
1677 return( ret );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001678}
1679
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01001680int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
1681 mbedtls_svc_key_id_t psk )
1682{
1683 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
1684 ( ssl->handshake == NULL ) )
1685 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1686
1687 ssl_remove_psk( ssl );
1688 ssl->handshake->psk_opaque = psk;
1689 return( 0 );
1690}
1691#endif /* MBEDTLS_USE_PSA_CRYPTO */
1692
1693void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
1694 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
1695 size_t),
1696 void *p_psk )
1697{
1698 conf->f_psk = f_psk;
1699 conf->p_psk = p_psk;
1700}
1701#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1702
1703#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01001704psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01001705 size_t taglen,
1706 psa_algorithm_t *alg,
1707 psa_key_type_t *key_type,
1708 size_t *key_size )
1709{
1710 switch ( mbedtls_cipher_type )
1711 {
1712 case MBEDTLS_CIPHER_AES_128_CBC:
1713 *alg = PSA_ALG_CBC_NO_PADDING;
1714 *key_type = PSA_KEY_TYPE_AES;
1715 *key_size = 128;
1716 break;
1717 case MBEDTLS_CIPHER_AES_128_CCM:
1718 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1719 *key_type = PSA_KEY_TYPE_AES;
1720 *key_size = 128;
1721 break;
1722 case MBEDTLS_CIPHER_AES_128_GCM:
1723 *alg = PSA_ALG_GCM;
1724 *key_type = PSA_KEY_TYPE_AES;
1725 *key_size = 128;
1726 break;
1727 case MBEDTLS_CIPHER_AES_192_CCM:
1728 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1729 *key_type = PSA_KEY_TYPE_AES;
1730 *key_size = 192;
1731 break;
1732 case MBEDTLS_CIPHER_AES_192_GCM:
1733 *alg = PSA_ALG_GCM;
1734 *key_type = PSA_KEY_TYPE_AES;
1735 *key_size = 192;
1736 break;
1737 case MBEDTLS_CIPHER_AES_256_CBC:
1738 *alg = PSA_ALG_CBC_NO_PADDING;
1739 *key_type = PSA_KEY_TYPE_AES;
1740 *key_size = 256;
1741 break;
1742 case MBEDTLS_CIPHER_AES_256_CCM:
1743 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1744 *key_type = PSA_KEY_TYPE_AES;
1745 *key_size = 256;
1746 break;
1747 case MBEDTLS_CIPHER_AES_256_GCM:
1748 *alg = PSA_ALG_GCM;
1749 *key_type = PSA_KEY_TYPE_AES;
1750 *key_size = 256;
1751 break;
1752 case MBEDTLS_CIPHER_ARIA_128_CBC:
1753 *alg = PSA_ALG_CBC_NO_PADDING;
1754 *key_type = PSA_KEY_TYPE_ARIA;
1755 *key_size = 128;
1756 break;
1757 case MBEDTLS_CIPHER_ARIA_128_CCM:
1758 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1759 *key_type = PSA_KEY_TYPE_ARIA;
1760 *key_size = 128;
1761 break;
1762 case MBEDTLS_CIPHER_ARIA_128_GCM:
1763 *alg = PSA_ALG_GCM;
1764 *key_type = PSA_KEY_TYPE_ARIA;
1765 *key_size = 128;
1766 break;
1767 case MBEDTLS_CIPHER_ARIA_192_CCM:
1768 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1769 *key_type = PSA_KEY_TYPE_ARIA;
1770 *key_size = 192;
1771 break;
1772 case MBEDTLS_CIPHER_ARIA_192_GCM:
1773 *alg = PSA_ALG_GCM;
1774 *key_type = PSA_KEY_TYPE_ARIA;
1775 *key_size = 192;
1776 break;
1777 case MBEDTLS_CIPHER_ARIA_256_CBC:
1778 *alg = PSA_ALG_CBC_NO_PADDING;
1779 *key_type = PSA_KEY_TYPE_ARIA;
1780 *key_size = 256;
1781 break;
1782 case MBEDTLS_CIPHER_ARIA_256_CCM:
1783 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1784 *key_type = PSA_KEY_TYPE_ARIA;
1785 *key_size = 256;
1786 break;
1787 case MBEDTLS_CIPHER_ARIA_256_GCM:
1788 *alg = PSA_ALG_GCM;
1789 *key_type = PSA_KEY_TYPE_ARIA;
1790 *key_size = 256;
1791 break;
1792 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
1793 *alg = PSA_ALG_CBC_NO_PADDING;
1794 *key_type = PSA_KEY_TYPE_CAMELLIA;
1795 *key_size = 128;
1796 break;
1797 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
1798 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1799 *key_type = PSA_KEY_TYPE_CAMELLIA;
1800 *key_size = 128;
1801 break;
1802 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
1803 *alg = PSA_ALG_GCM;
1804 *key_type = PSA_KEY_TYPE_CAMELLIA;
1805 *key_size = 128;
1806 break;
1807 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
1808 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1809 *key_type = PSA_KEY_TYPE_CAMELLIA;
1810 *key_size = 192;
1811 break;
1812 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
1813 *alg = PSA_ALG_GCM;
1814 *key_type = PSA_KEY_TYPE_CAMELLIA;
1815 *key_size = 192;
1816 break;
1817 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
1818 *alg = PSA_ALG_CBC_NO_PADDING;
1819 *key_type = PSA_KEY_TYPE_CAMELLIA;
1820 *key_size = 256;
1821 break;
1822 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
1823 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1824 *key_type = PSA_KEY_TYPE_CAMELLIA;
1825 *key_size = 256;
1826 break;
1827 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
1828 *alg = PSA_ALG_GCM;
1829 *key_type = PSA_KEY_TYPE_CAMELLIA;
1830 *key_size = 256;
1831 break;
1832 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
1833 *alg = PSA_ALG_CHACHA20_POLY1305;
1834 *key_type = PSA_KEY_TYPE_CHACHA20;
1835 *key_size = 256;
1836 break;
1837 case MBEDTLS_CIPHER_NULL:
1838 *alg = MBEDTLS_SSL_NULL_CIPHER;
1839 *key_type = 0;
1840 *key_size = 0;
1841 break;
1842 default:
1843 return PSA_ERROR_NOT_SUPPORTED;
1844 }
1845
1846 return PSA_SUCCESS;
1847}
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001848#endif /* MBEDTLS_USE_PSA_CRYPTO */
1849
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02001850#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckera90658f2017-10-04 15:29:08 +01001851int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
1852 const unsigned char *dhm_P, size_t P_len,
1853 const unsigned char *dhm_G, size_t G_len )
1854{
Janos Follath865b3eb2019-12-16 11:46:15 +00001855 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01001856
Glenn Strausscee11292021-12-20 01:43:17 -05001857 mbedtls_mpi_free( &conf->dhm_P );
1858 mbedtls_mpi_free( &conf->dhm_G );
1859
Hanno Beckera90658f2017-10-04 15:29:08 +01001860 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
1861 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
1862 {
1863 mbedtls_mpi_free( &conf->dhm_P );
1864 mbedtls_mpi_free( &conf->dhm_G );
1865 return( ret );
1866 }
1867
1868 return( 0 );
1869}
Paul Bakker5121ce52009-01-03 21:22:43 +00001870
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001871int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00001872{
Janos Follath865b3eb2019-12-16 11:46:15 +00001873 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00001874
Glenn Strausscee11292021-12-20 01:43:17 -05001875 mbedtls_mpi_free( &conf->dhm_P );
1876 mbedtls_mpi_free( &conf->dhm_G );
1877
Gilles Peskinee5702482021-06-11 21:59:08 +02001878 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
1879 &conf->dhm_P ) ) != 0 ||
1880 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
1881 &conf->dhm_G ) ) != 0 )
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01001882 {
1883 mbedtls_mpi_free( &conf->dhm_P );
1884 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00001885 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01001886 }
Paul Bakker1b57b062011-01-06 15:48:19 +00001887
1888 return( 0 );
1889}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02001890#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00001891
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02001892#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
1893/*
1894 * Set the minimum length for Diffie-Hellman parameters
1895 */
1896void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
1897 unsigned int bitlen )
1898{
1899 conf->dhm_min_bitlen = bitlen;
1900}
1901#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
1902
Gilles Peskineeccd8882020-03-10 12:19:08 +01001903#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08001904#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02001905/*
1906 * Set allowed/preferred hashes for handshake signatures
1907 */
1908void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
1909 const int *hashes )
1910{
1911 conf->sig_hashes = hashes;
1912}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08001913#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01001914
Jerry Yuf017ee42022-01-12 15:49:48 +08001915/* Configure allowed signature algorithms for handshake */
Hanno Becker1cd6e002021-08-10 13:27:10 +01001916void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
1917 const uint16_t* sig_algs )
1918{
Jerry Yuf017ee42022-01-12 15:49:48 +08001919#if !defined(MBEDTLS_DEPRECATED_REMOVED)
1920 conf->sig_hashes = NULL;
1921#endif /* !MBEDTLS_DEPRECATED_REMOVED */
1922 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01001923}
Gilles Peskineeccd8882020-03-10 12:19:08 +01001924#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02001925
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02001926#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01001927#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001928/*
1929 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01001930 *
1931 * mbedtls_ssl_setup() takes the provided list
1932 * and translates it to a list of IANA TLS group identifiers,
1933 * stored in ssl->handshake->group_list.
1934 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001935 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001936void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001937 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001938{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001939 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01001940 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001941}
Brett Warrene0edc842021-08-17 09:53:13 +01001942#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01001943#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001944
Brett Warrene0edc842021-08-17 09:53:13 +01001945/*
1946 * Set the allowed groups
1947 */
1948void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
1949 const uint16_t *group_list )
1950{
1951#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
1952 conf->curve_list = NULL;
1953#endif
1954 conf->group_list = group_list;
1955}
1956
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001957#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001958int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00001959{
Hanno Becker947194e2017-04-07 13:25:49 +01001960 /* Initialize to suppress unnecessary compiler warning */
1961 size_t hostname_len = 0;
1962
1963 /* Check if new hostname is valid before
1964 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01001965 if( hostname != NULL )
1966 {
1967 hostname_len = strlen( hostname );
1968
1969 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
1970 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1971 }
1972
1973 /* Now it's clear that we will overwrite the old hostname,
1974 * so we can free it safely */
1975
1976 if( ssl->hostname != NULL )
1977 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001978 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01001979 mbedtls_free( ssl->hostname );
1980 }
1981
1982 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01001983
Paul Bakker5121ce52009-01-03 21:22:43 +00001984 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01001985 {
1986 ssl->hostname = NULL;
1987 }
1988 else
1989 {
1990 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01001991 if( ssl->hostname == NULL )
1992 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02001993
Hanno Becker947194e2017-04-07 13:25:49 +01001994 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02001995
Hanno Becker947194e2017-04-07 13:25:49 +01001996 ssl->hostname[hostname_len] = '\0';
1997 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001998
1999 return( 0 );
2000}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01002001#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002002
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002003#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002004void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002005 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00002006 const unsigned char *, size_t),
2007 void *p_sni )
2008{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002009 conf->f_sni = f_sni;
2010 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00002011}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002012#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00002013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002014#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002015int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002016{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002017 size_t cur_len, tot_len;
2018 const char **p;
2019
2020 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08002021 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
2022 * MUST NOT be truncated."
2023 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002024 */
2025 tot_len = 0;
2026 for( p = protos; *p != NULL; p++ )
2027 {
2028 cur_len = strlen( *p );
2029 tot_len += cur_len;
2030
Ronald Cron8216dd32020-04-23 16:41:44 +02002031 if( ( cur_len == 0 ) ||
2032 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
2033 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002034 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002035 }
2036
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002037 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002038
2039 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002040}
2041
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002042const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002043{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002044 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002045}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002046#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002047
Johan Pascalb62bb512015-12-03 21:56:45 +01002048#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldoref72faf2018-07-12 11:54:20 +03002049void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
2050 int support_mki_value )
Ron Eldor591f1622018-01-22 12:30:04 +02002051{
2052 conf->dtls_srtp_mki_support = support_mki_value;
2053}
2054
Ron Eldoref72faf2018-07-12 11:54:20 +03002055int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
2056 unsigned char *mki_value,
Johan Pascalf6417ec2020-09-22 15:15:19 +02002057 uint16_t mki_len )
Ron Eldor591f1622018-01-22 12:30:04 +02002058{
Johan Pascal5ef72d22020-10-28 17:05:47 +01002059 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
Ron Eldora9788042018-12-05 11:04:31 +02002060 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002061 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ron Eldora9788042018-12-05 11:04:31 +02002062 }
Ron Eldor591f1622018-01-22 12:30:04 +02002063
2064 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
Ron Eldora9788042018-12-05 11:04:31 +02002065 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002066 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ron Eldora9788042018-12-05 11:04:31 +02002067 }
Ron Eldor591f1622018-01-22 12:30:04 +02002068
2069 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
2070 ssl->dtls_srtp_info.mki_len = mki_len;
Ron Eldora9788042018-12-05 11:04:31 +02002071 return( 0 );
Ron Eldor591f1622018-01-22 12:30:04 +02002072}
2073
Ron Eldoref72faf2018-07-12 11:54:20 +03002074int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
Johan Pascal253d0262020-09-22 13:04:45 +02002075 const mbedtls_ssl_srtp_profile *profiles )
Johan Pascalb62bb512015-12-03 21:56:45 +01002076{
Johan Pascal253d0262020-09-22 13:04:45 +02002077 const mbedtls_ssl_srtp_profile *p;
2078 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002079
Johan Pascal253d0262020-09-22 13:04:45 +02002080 /* check the profiles list: all entry must be valid,
2081 * its size cannot be more than the total number of supported profiles, currently 4 */
Johan Pascald387aa02020-09-23 18:47:56 +02002082 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
2083 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
2084 p++ )
Johan Pascald576fdb2020-09-22 10:39:53 +02002085 {
Johan Pascal5ef72d22020-10-28 17:05:47 +01002086 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
Johan Pascald576fdb2020-09-22 10:39:53 +02002087 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002088 list_size++;
2089 }
2090 else
2091 {
2092 /* unsupported value, stop parsing and set the size to an error value */
2093 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01002094 }
2095 }
2096
Johan Pascal5ef72d22020-10-28 17:05:47 +01002097 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
Johan Pascald387aa02020-09-23 18:47:56 +02002098 {
Johan Pascal253d0262020-09-22 13:04:45 +02002099 conf->dtls_srtp_profile_list = NULL;
2100 conf->dtls_srtp_profile_list_len = 0;
2101 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2102 }
2103
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002104 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02002105 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01002106
2107 return( 0 );
2108}
2109
Johan Pascal5ef72d22020-10-28 17:05:47 +01002110void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
2111 mbedtls_dtls_srtp_info *dtls_srtp_info )
Johan Pascalb62bb512015-12-03 21:56:45 +01002112{
Johan Pascal2258a4f2020-10-28 13:53:09 +01002113 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
2114 /* do not copy the mki value if there is no chosen profile */
Johan Pascal5ef72d22020-10-28 17:05:47 +01002115 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002116 {
Johan Pascal2258a4f2020-10-28 13:53:09 +01002117 dtls_srtp_info->mki_len = 0;
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002118 }
Johan Pascal2258a4f2020-10-28 13:53:09 +01002119 else
2120 {
2121 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Johan Pascal5ef72d22020-10-28 17:05:47 +01002122 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
2123 ssl->dtls_srtp_info.mki_len );
Johan Pascal2258a4f2020-10-28 13:53:09 +01002124 }
Johan Pascalb62bb512015-12-03 21:56:45 +01002125}
Johan Pascalb62bb512015-12-03 21:56:45 +01002126#endif /* MBEDTLS_SSL_DTLS_SRTP */
2127
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002128void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00002129{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002130 conf->max_major_ver = major;
2131 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00002132}
2133
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002134void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00002135{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002136 conf->min_major_ver = major;
2137 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00002138}
2139
Janos Follath088ce432017-04-10 12:42:31 +01002140#if defined(MBEDTLS_SSL_SRV_C)
2141void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
2142 char cert_req_ca_list )
2143{
2144 conf->cert_req_ca_list = cert_req_ca_list;
2145}
2146#endif
2147
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002148#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002149void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002150{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002151 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002152}
2153#endif
2154
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002155#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002156void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002157{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002158 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002159}
2160#endif
2161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002162#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002163int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002164{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002165 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10002166 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002167 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002168 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002169 }
2170
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01002171 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002172
2173 return( 0 );
2174}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002175#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002176
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002177void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00002178{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002179 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00002180}
2181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002182#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002183void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002184{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002185 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002186}
2187
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002188void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002189{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002190 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002191}
2192
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002193void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002194 const unsigned char period[8] )
2195{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002196 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002197}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002198#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002200#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002201#if defined(MBEDTLS_SSL_CLI_C)
2202void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002203{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01002204 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002205}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002206#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02002207
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002208#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002209void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
2210 mbedtls_ssl_ticket_write_t *f_ticket_write,
2211 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
2212 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02002213{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002214 conf->f_ticket_write = f_ticket_write;
2215 conf->f_ticket_parse = f_ticket_parse;
2216 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02002217}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002218#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002219#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002220
Hanno Becker7e6c1782021-06-08 09:24:55 +01002221void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
2222 mbedtls_ssl_export_keys_t *f_export_keys,
2223 void *p_export_keys )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002224{
Hanno Becker7e6c1782021-06-08 09:24:55 +01002225 ssl->f_export_keys = f_export_keys;
2226 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03002227}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002228
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002229#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002230void mbedtls_ssl_conf_async_private_cb(
2231 mbedtls_ssl_config *conf,
2232 mbedtls_ssl_async_sign_t *f_async_sign,
2233 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
2234 mbedtls_ssl_async_resume_t *f_async_resume,
2235 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002236 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002237{
2238 conf->f_async_sign_start = f_async_sign;
2239 conf->f_async_decrypt_start = f_async_decrypt;
2240 conf->f_async_resume = f_async_resume;
2241 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002242 conf->p_async_config_data = async_config_data;
2243}
2244
Gilles Peskine8f97af72018-04-26 11:46:10 +02002245void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
2246{
2247 return( conf->p_async_config_data );
2248}
2249
Gilles Peskine1febfef2018-04-30 11:54:39 +02002250void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002251{
2252 if( ssl->handshake == NULL )
2253 return( NULL );
2254 else
2255 return( ssl->handshake->user_async_ctx );
2256}
2257
Gilles Peskine1febfef2018-04-30 11:54:39 +02002258void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002259 void *ctx )
2260{
2261 if( ssl->handshake != NULL )
2262 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002263}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002264#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002265
Paul Bakker5121ce52009-01-03 21:22:43 +00002266/*
2267 * SSL get accessors
2268 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02002269uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002270{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00002271 if( ssl->session != NULL )
2272 return( ssl->session->verify_result );
2273
2274 if( ssl->session_negotiate != NULL )
2275 return( ssl->session_negotiate->verify_result );
2276
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02002277 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00002278}
2279
Glenn Strauss8f526902022-01-13 00:04:49 -05002280int mbedtls_ssl_get_ciphersuite_id_from_ssl( const mbedtls_ssl_context *ssl )
2281{
2282 if( ssl == NULL || ssl->session == NULL )
2283 return( 0 );
2284
2285 return( ssl->session->ciphersuite );
2286}
2287
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002288const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00002289{
Paul Bakker926c8e42013-03-06 10:23:34 +01002290 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002291 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01002292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002293 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00002294}
2295
Gilles Peskinee1a0c252022-01-13 01:08:03 +01002296mbedtls_ssl_protocol_version mbedtls_ssl_get_version_number(
2297 const mbedtls_ssl_context *ssl )
2298{
2299 /* For major_ver, only 3 is supported, so skip checking it. */
2300 switch( ssl->minor_ver )
2301 {
2302 case MBEDTLS_SSL_MINOR_VERSION_3:
2303 return( MBEDTLS_SSL_VERSION_1_2 );
2304 case MBEDTLS_SSL_MINOR_VERSION_4:
2305 return( MBEDTLS_SSL_VERSION_1_3 );
2306 default:
2307 return( MBEDTLS_SSL_VERSION_UNKNOWN );
2308 }
2309}
2310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002311const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00002312{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002313#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002314 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002315 {
2316 switch( ssl->minor_ver )
2317 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002318 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002319 return( "DTLSv1.2" );
2320
2321 default:
2322 return( "unknown (DTLS)" );
2323 }
2324 }
2325#endif
2326
Paul Bakker43ca69c2011-01-15 17:35:19 +00002327 switch( ssl->minor_ver )
2328 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002329 case MBEDTLS_SSL_MINOR_VERSION_3:
Paul Bakker1ef83d62012-04-11 12:09:53 +00002330 return( "TLSv1.2" );
Gilles Peskinec63a1e02022-01-13 01:10:24 +01002331 case MBEDTLS_SSL_MINOR_VERSION_4:
2332 return( "TLSv1.3" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002333 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002334 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002335 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00002336}
2337
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002338#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002339size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
2340{
David Horstmann95d516f2021-05-04 18:36:56 +01002341 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002342 size_t read_mfl;
2343
2344 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
2345 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2346 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
2347 {
2348 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
2349 }
2350
2351 /* Check if a smaller max length was negotiated */
2352 if( ssl->session_out != NULL )
2353 {
2354 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
2355 if( read_mfl < max_len )
2356 {
2357 max_len = read_mfl;
2358 }
2359 }
2360
2361 // During a handshake, use the value being negotiated
2362 if( ssl->session_negotiate != NULL )
2363 {
2364 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2365 if( read_mfl < max_len )
2366 {
2367 max_len = read_mfl;
2368 }
2369 }
2370
2371 return( max_len );
2372}
2373
2374size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002375{
2376 size_t max_len;
2377
2378 /*
2379 * Assume mfl_code is correct since it was checked when set
2380 */
Angus Grattond8213d02016-05-25 20:56:48 +10002381 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002382
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002383 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002384 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10002385 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002386 {
Angus Grattond8213d02016-05-25 20:56:48 +10002387 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002388 }
2389
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002390 /* During a handshake, use the value being negotiated */
2391 if( ssl->session_negotiate != NULL &&
2392 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
2393 {
2394 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2395 }
2396
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002397 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002398}
2399#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2400
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002401#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002402size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002403{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04002404 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
2405 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2406 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
2407 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
2408 return ( 0 );
2409
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002410 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
2411 return( ssl->mtu );
2412
2413 if( ssl->mtu == 0 )
2414 return( ssl->handshake->mtu );
2415
2416 return( ssl->mtu < ssl->handshake->mtu ?
2417 ssl->mtu : ssl->handshake->mtu );
2418}
2419#endif /* MBEDTLS_SSL_PROTO_DTLS */
2420
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002421int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
2422{
2423 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
2424
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02002425#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2426 !defined(MBEDTLS_SSL_PROTO_DTLS)
2427 (void) ssl;
2428#endif
2429
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002430#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002431 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002432
2433 if( max_len > mfl )
2434 max_len = mfl;
2435#endif
2436
2437#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002438 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002439 {
Hanno Becker89490712020-02-05 10:50:12 +00002440 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002441 const int ret = mbedtls_ssl_get_record_expansion( ssl );
2442 const size_t overhead = (size_t) ret;
2443
2444 if( ret < 0 )
2445 return( ret );
2446
2447 if( mtu <= overhead )
2448 {
2449 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
2450 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2451 }
2452
2453 if( max_len > mtu - overhead )
2454 max_len = mtu - overhead;
2455 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002456#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002457
Hanno Becker0defedb2018-08-10 12:35:02 +01002458#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2459 !defined(MBEDTLS_SSL_PROTO_DTLS)
2460 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002461#endif
2462
2463 return( (int) max_len );
2464}
2465
Hanno Becker2d8e99b2021-04-21 06:19:50 +01002466int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
2467{
2468 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
2469
2470#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2471 (void) ssl;
2472#endif
2473
2474#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2475 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
2476
2477 if( max_len > mfl )
2478 max_len = mfl;
2479#endif
2480
2481 return( (int) max_len );
2482}
2483
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002484#if defined(MBEDTLS_X509_CRT_PARSE_C)
2485const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00002486{
2487 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002488 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00002489
Hanno Beckere6824572019-02-07 13:18:46 +00002490#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002491 return( ssl->session->peer_cert );
Hanno Beckere6824572019-02-07 13:18:46 +00002492#else
2493 return( NULL );
2494#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002495}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002496#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002497
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002498#if defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerf852b1c2019-02-05 11:42:30 +00002499int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
2500 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002501{
Hanno Beckere810bbc2021-05-14 16:01:05 +01002502 int ret;
2503
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002504 if( ssl == NULL ||
2505 dst == NULL ||
2506 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002507 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002508 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002509 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002510 }
2511
Hanno Beckere810bbc2021-05-14 16:01:05 +01002512 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
2513 * idempotent: Each session can only be exported once.
2514 *
2515 * (This is in preparation for TLS 1.3 support where we will
2516 * need the ability to export multiple sessions (aka tickets),
2517 * which will be achieved by calling mbedtls_ssl_get_session()
2518 * multiple times until it fails.)
2519 *
2520 * Check whether we have already exported the current session,
2521 * and fail if so.
2522 */
2523 if( ssl->session->exported == 1 )
2524 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2525
2526 ret = mbedtls_ssl_session_copy( dst, ssl->session );
2527 if( ret != 0 )
2528 return( ret );
2529
2530 /* Remember that we've exported the session. */
2531 ssl->session->exported = 1;
2532 return( 0 );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002533}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002534#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002535
Paul Bakker5121ce52009-01-03 21:22:43 +00002536/*
Hanno Beckera835da52019-05-16 12:39:07 +01002537 * Define ticket header determining Mbed TLS version
2538 * and structure of the ticket.
2539 */
2540
Hanno Becker94ef3b32019-05-16 12:50:45 +01002541/*
Hanno Becker50b59662019-05-28 14:30:45 +01002542 * Define bitflag determining compile-time settings influencing
2543 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01002544 */
2545
Hanno Becker50b59662019-05-28 14:30:45 +01002546#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01002547#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01002548#else
Hanno Becker3e088662019-05-29 11:10:18 +01002549#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002550#endif /* MBEDTLS_HAVE_TIME */
2551
2552#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01002553#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002554#else
Hanno Becker3e088662019-05-29 11:10:18 +01002555#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002556#endif /* MBEDTLS_X509_CRT_PARSE_C */
2557
2558#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01002559#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002560#else
Hanno Becker3e088662019-05-29 11:10:18 +01002561#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002562#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
2563
2564#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01002565#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002566#else
Hanno Becker3e088662019-05-29 11:10:18 +01002567#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002568#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2569
Hanno Becker94ef3b32019-05-16 12:50:45 +01002570#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01002571#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002572#else
Hanno Becker3e088662019-05-29 11:10:18 +01002573#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002574#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
2575
Hanno Becker94ef3b32019-05-16 12:50:45 +01002576#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2577#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
2578#else
2579#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
2580#endif /* MBEDTLS_SSL_SESSION_TICKETS */
2581
Hanno Becker3e088662019-05-29 11:10:18 +01002582#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
2583#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
2584#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
2585#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01002586#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
2587#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01002588
Hanno Becker50b59662019-05-28 14:30:45 +01002589#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Becker3e088662019-05-29 11:10:18 +01002590 ( (uint16_t) ( \
2591 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
2592 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
2593 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
2594 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
Hanno Becker3e088662019-05-29 11:10:18 +01002595 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Beckerbe34e8e2019-06-04 09:43:16 +01002596 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
Hanno Becker94ef3b32019-05-16 12:50:45 +01002597
Hanno Beckerf8787072019-05-16 12:41:07 +01002598static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01002599 MBEDTLS_VERSION_MAJOR,
2600 MBEDTLS_VERSION_MINOR,
2601 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01002602 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
2603 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
Hanno Beckerf8787072019-05-16 12:41:07 +01002604};
Hanno Beckera835da52019-05-16 12:39:07 +01002605
2606/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002607 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02002608 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002609 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002610 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01002611 *
Hanno Beckerdce50972021-08-01 05:39:23 +01002612 * opaque mbedtls_version[3]; // library version: major, minor, patch
2613 * opaque session_format[2]; // library-version specific 16-bit field
2614 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002615 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01002616 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002617 * Note: When updating the format, remember to keep
2618 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002619 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002620 * // In this version, `session_format` determines
2621 * // the setting of those compile-time
2622 * // configuration options which influence
2623 * // the structure of mbedtls_ssl_session.
2624 *
Hanno Beckerfa0d61e2021-08-02 08:56:14 +01002625 * uint8_t minor_ver; // Protocol-version. Possible values:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002626 * // - TLS 1.2 (MBEDTLS_SSL_MINOR_VERSION_3)
2627 *
2628 * select (serialized_session.minor_ver) {
2629 *
2630 * case MBEDTLS_SSL_MINOR_VERSION_3: // TLS 1.2
2631 * serialized_session_tls12 data;
2632 *
2633 * };
2634 *
2635 * } serialized_session;
2636 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002637 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002638
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002639static int ssl_session_save( const mbedtls_ssl_session *session,
2640 unsigned char omit_header,
2641 unsigned char *buf,
2642 size_t buf_len,
2643 size_t *olen )
2644{
2645 unsigned char *p = buf;
2646 size_t used = 0;
2647
2648 if( !omit_header )
2649 {
2650 /*
2651 * Add Mbed TLS version identifier
2652 */
2653
2654 used += sizeof( ssl_serialized_session_header );
2655
2656 if( used <= buf_len )
2657 {
2658 memcpy( p, ssl_serialized_session_header,
2659 sizeof( ssl_serialized_session_header ) );
2660 p += sizeof( ssl_serialized_session_header );
2661 }
2662 }
2663
2664 /*
2665 * TLS version identifier
2666 */
2667 used += 1;
2668 if( used <= buf_len )
2669 {
2670 *p++ = session->minor_ver;
2671 }
2672
2673 /* Forward to version-specific serialization routine. */
2674 switch( session->minor_ver )
2675 {
2676#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2677 case MBEDTLS_SSL_MINOR_VERSION_3:
2678 {
2679 size_t remaining_len = used <= buf_len ? buf_len - used : 0;
2680 used += ssl_session_save_tls12( session, p, remaining_len );
2681 break;
2682 }
2683#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2684
2685 default:
2686 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2687 }
2688
2689 *olen = used;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02002690 if( used > buf_len )
2691 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002692
2693 return( 0 );
2694}
2695
2696/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02002697 * Public wrapper for ssl_session_save()
2698 */
2699int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
2700 unsigned char *buf,
2701 size_t buf_len,
2702 size_t *olen )
2703{
2704 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
2705}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002706
Jerry Yuf1b23ca2022-02-18 11:48:47 +08002707/*
2708 * Deserialize session, see mbedtls_ssl_session_save() for format.
2709 *
2710 * This internal version is wrapped by a public function that cleans up in
2711 * case of error, and has an extra option omit_header.
2712 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002713static int ssl_session_load( mbedtls_ssl_session *session,
2714 unsigned char omit_header,
2715 const unsigned char *buf,
2716 size_t len )
2717{
2718 const unsigned char *p = buf;
2719 const unsigned char * const end = buf + len;
2720
2721 if( !omit_header )
2722 {
2723 /*
2724 * Check Mbed TLS version identifier
2725 */
2726
2727 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
2728 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2729
2730 if( memcmp( p, ssl_serialized_session_header,
2731 sizeof( ssl_serialized_session_header ) ) != 0 )
2732 {
2733 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
2734 }
2735 p += sizeof( ssl_serialized_session_header );
2736 }
2737
2738 /*
2739 * TLS version identifier
2740 */
2741 if( 1 > (size_t)( end - p ) )
2742 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2743 session->minor_ver = *p++;
2744
2745 /* Dispatch according to TLS version. */
2746 switch( session->minor_ver )
2747 {
2748#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2749 case MBEDTLS_SSL_MINOR_VERSION_3: /* TLS 1.2 */
2750 {
2751 size_t remaining_len = ( end - p );
2752 return( ssl_session_load_tls12( session, p, remaining_len ) );
2753 }
2754#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2755
2756 default:
2757 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2758 }
2759}
2760
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002761/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02002762 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02002763 */
2764int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
2765 const unsigned char *buf,
2766 size_t len )
2767{
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02002768 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02002769
2770 if( ret != 0 )
2771 mbedtls_ssl_session_free( session );
2772
2773 return( ret );
2774}
2775
2776/*
Paul Bakker1961b702013-01-25 14:49:24 +01002777 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00002778 */
Hanno Becker41934dd2021-08-07 19:13:43 +01002779static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
2780{
2781 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2782
Ronald Cron66dbf912022-02-02 15:33:46 +01002783 /*
2784 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01002785 * that were written into the output buffer by the previous handshake step,
2786 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01002787 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
2788 * We proceed to the next handshake step only when all data from the
2789 * previous one have been sent to the peer, thus we make sure that this is
2790 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
2791 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
2792 * we have to wait before to go ahead.
2793 * In the case of TLS 1.3, handshake step handlers do not send data to the
2794 * peer. Data are only sent here and through
2795 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
2796 * alert occured.
2797 */
Hanno Becker41934dd2021-08-07 19:13:43 +01002798 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
2799 return( ret );
2800
2801#if defined(MBEDTLS_SSL_PROTO_DTLS)
2802 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2803 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
2804 {
2805 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2806 return( ret );
2807 }
2808#endif /* MBEDTLS_SSL_PROTO_DTLS */
2809
2810 return( ret );
2811}
2812
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002813int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002814{
Hanno Becker41934dd2021-08-07 19:13:43 +01002815 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00002816
Hanno Becker41934dd2021-08-07 19:13:43 +01002817 if( ssl == NULL ||
2818 ssl->conf == NULL ||
2819 ssl->handshake == NULL ||
2820 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
2821 {
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02002822 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker41934dd2021-08-07 19:13:43 +01002823 }
2824
2825 ret = ssl_prepare_handshake_step( ssl );
2826 if( ret != 0 )
2827 return( ret );
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02002828
Jerry Yue7047812021-09-13 19:26:39 +08002829 ret = mbedtls_ssl_handle_pending_alert( ssl );
2830 if( ret != 0 )
2831 goto cleanup;
2832
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002833#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002834 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Jerry Yub9930e72021-08-06 17:11:51 +08002835 {
Ronald Cron27c85e72022-03-08 11:37:55 +01002836 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %s",
2837 mbedtls_ssl_states_str( ssl->state ) ) );
2838
Ronald Cron9f0fba32022-02-10 16:45:15 +01002839 switch( ssl->state )
2840 {
2841 case MBEDTLS_SSL_HELLO_REQUEST:
2842 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
2843 break;
Jerry Yub9930e72021-08-06 17:11:51 +08002844
Ronald Cron9f0fba32022-02-10 16:45:15 +01002845 case MBEDTLS_SSL_CLIENT_HELLO:
2846 ret = mbedtls_ssl_write_client_hello( ssl );
2847 break;
2848
2849 default:
2850#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
2851 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
2852 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
2853 else
2854 ret = mbedtls_ssl_handshake_client_step( ssl );
2855#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
2856 ret = mbedtls_ssl_handshake_client_step( ssl );
2857#else
2858 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
2859#endif
2860 }
Jerry Yub9930e72021-08-06 17:11:51 +08002861 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002862#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002863#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002864 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Jerry Yub9930e72021-08-06 17:11:51 +08002865 {
Ronald Cron6f135e12021-12-08 16:57:54 +01002866#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yub9930e72021-08-06 17:11:51 +08002867 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yu27561932021-08-27 17:07:38 +08002868 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
Ronald Cron6f135e12021-12-08 16:57:54 +01002869#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08002870
2871#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2872 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
2873 ret = mbedtls_ssl_handshake_server_step( ssl );
2874#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2875 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002876#endif
2877
Jerry Yue7047812021-09-13 19:26:39 +08002878 if( ret != 0 )
2879 {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08002880 /* handshake_step return error. And it is same
2881 * with alert_reason.
2882 */
Jerry Yu3bf1f972021-09-22 21:37:18 +08002883 if( ssl->send_alert )
Jerry Yue7047812021-09-13 19:26:39 +08002884 {
Jerry Yu3bf1f972021-09-22 21:37:18 +08002885 ret = mbedtls_ssl_handle_pending_alert( ssl );
Jerry Yue7047812021-09-13 19:26:39 +08002886 goto cleanup;
2887 }
2888 }
2889
2890cleanup:
Paul Bakker1961b702013-01-25 14:49:24 +01002891 return( ret );
2892}
2893
2894/*
2895 * Perform the SSL handshake
2896 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002897int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01002898{
2899 int ret = 0;
2900
Hanno Beckera817ea42020-10-20 15:20:23 +01002901 /* Sanity checks */
2902
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02002903 if( ssl == NULL || ssl->conf == NULL )
2904 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2905
Hanno Beckera817ea42020-10-20 15:20:23 +01002906#if defined(MBEDTLS_SSL_PROTO_DTLS)
2907 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2908 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
2909 {
2910 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
2911 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
2912 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2913 }
2914#endif /* MBEDTLS_SSL_PROTO_DTLS */
2915
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002916 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01002917
Hanno Beckera817ea42020-10-20 15:20:23 +01002918 /* Main handshake loop */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002919 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +01002920 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002921 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01002922
2923 if( ret != 0 )
2924 break;
2925 }
2926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002927 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002928
2929 return( ret );
2930}
2931
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002932#if defined(MBEDTLS_SSL_RENEGOTIATION)
2933#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00002934/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002935 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00002936 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002937static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002938{
Janos Follath865b3eb2019-12-16 11:46:15 +00002939 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002940
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002941 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002942
2943 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002944 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2945 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002946
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002947 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002948 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002949 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002950 return( ret );
2951 }
2952
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002953 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002954
2955 return( 0 );
2956}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002957#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002958
2959/*
2960 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002961 * - any side: calling mbedtls_ssl_renegotiate(),
2962 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
2963 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02002964 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01002965 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002966 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002967 */
Hanno Becker40cdaa12020-02-05 10:48:27 +00002968int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00002969{
Janos Follath865b3eb2019-12-16 11:46:15 +00002970 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00002971
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002972 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002973
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01002974 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
2975 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00002976
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02002977 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
2978 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002979#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002980 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002981 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02002982 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002983 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02002984 ssl->handshake->out_msg_seq = 1;
2985 else
2986 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02002987 }
2988#endif
2989
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002990 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
2991 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00002992
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002993 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00002994 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002995 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00002996 return( ret );
2997 }
2998
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002999 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003000
3001 return( 0 );
3002}
3003
3004/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003005 * Renegotiate current connection on client,
3006 * or request renegotiation on server
3007 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003008int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003009{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003010 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003011
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003012 if( ssl == NULL || ssl->conf == NULL )
3013 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3014
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003015#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003016 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003017 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003018 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003019 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
3020 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003022 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003023
3024 /* Did we already try/start sending HelloRequest? */
3025 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003026 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003027
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003028 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003029 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003030#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003032#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003033 /*
3034 * On client, either start the renegotiation process or,
3035 * if already in progress, continue the handshake
3036 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003037 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003038 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003039 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
3040 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003041
Hanno Becker40cdaa12020-02-05 10:48:27 +00003042 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003043 {
Hanno Becker40cdaa12020-02-05 10:48:27 +00003044 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003045 return( ret );
3046 }
3047 }
3048 else
3049 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003050 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003051 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003052 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003053 return( ret );
3054 }
3055 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003056#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003057
Paul Bakker37ce0ff2013-10-31 14:32:04 +01003058 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003059}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003060#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003061
Gilles Peskine9b562d52018-04-25 20:32:43 +02003062void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003063{
Gilles Peskine9b562d52018-04-25 20:32:43 +02003064 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3065
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003066 if( handshake == NULL )
3067 return;
3068
Brett Warrene0edc842021-08-17 09:53:13 +01003069#if defined(MBEDTLS_ECP_C)
3070#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3071 if ( ssl->handshake->group_list_heap_allocated )
3072 mbedtls_free( (void*) handshake->group_list );
3073 handshake->group_list = NULL;
3074#endif /* MBEDTLS_DEPRECATED_REMOVED */
3075#endif /* MBEDTLS_ECP_C */
3076
Jerry Yuf017ee42022-01-12 15:49:48 +08003077#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3078#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3079 if ( ssl->handshake->sig_algs_heap_allocated )
3080 mbedtls_free( (void*) handshake->sig_algs );
3081 handshake->sig_algs = NULL;
3082#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00003083#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3084 if( ssl->handshake->certificate_request_context )
3085 {
3086 mbedtls_free( (void*) handshake->certificate_request_context );
3087 }
3088#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuf017ee42022-01-12 15:49:48 +08003089#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
3090
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003091#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3092 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
3093 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003094 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003095 handshake->async_in_progress = 0;
3096 }
3097#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3098
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003099#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003100#if defined(MBEDTLS_USE_PSA_CRYPTO)
3101 psa_hash_abort( &handshake->fin_sha256_psa );
3102#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003103 mbedtls_sha256_free( &handshake->fin_sha256 );
3104#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003105#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02003106#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003107#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05003108 psa_hash_abort( &handshake->fin_sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05003109#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003110 mbedtls_sha512_free( &handshake->fin_sha512 );
3111#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003112#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003113
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003114#if defined(MBEDTLS_DHM_C)
3115 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00003116#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003117#if defined(MBEDTLS_ECDH_C)
3118 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02003119#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003120#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003121 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02003122#if defined(MBEDTLS_SSL_CLI_C)
3123 mbedtls_free( handshake->ecjpake_cache );
3124 handshake->ecjpake_cache = NULL;
3125 handshake->ecjpake_cache_len = 0;
3126#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003127#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02003128
Janos Follath4ae5c292016-02-10 11:27:43 +00003129#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
3130 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02003131 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003132 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02003133#endif
3134
Gilles Peskineeccd8882020-03-10 12:19:08 +01003135#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003136 if( handshake->psk != NULL )
3137 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003138 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003139 mbedtls_free( handshake->psk );
3140 }
3141#endif
3142
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003143#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3144 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02003145 /*
3146 * Free only the linked list wrapper, not the keys themselves
3147 * since the belong to the SNI callback
3148 */
Glenn Strauss36872db2022-01-22 05:06:31 -05003149 ssl_key_cert_free( handshake->sni_key_cert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003150#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02003151
Gilles Peskineeccd8882020-03-10 12:19:08 +01003152#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02003153 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Becker3dad3112019-02-05 17:19:52 +00003154 if( handshake->ecrs_peer_cert != NULL )
3155 {
3156 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
3157 mbedtls_free( handshake->ecrs_peer_cert );
3158 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02003159#endif
3160
Hanno Becker75173122019-02-06 16:18:31 +00003161#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3162 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3163 mbedtls_pk_free( &handshake->peer_pubkey );
3164#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3165
XiaokangQian9b93c0d2022-02-09 06:02:25 +00003166#if defined(MBEDTLS_SSL_CLI_C) && \
3167 ( defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
3168 mbedtls_free( handshake->cookie );
3169#endif /* MBEDTLS_SSL_CLI_C &&
3170 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00003171
3172#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker533ab5f2020-02-05 10:49:13 +00003173 mbedtls_ssl_flight_free( handshake->flight );
3174 mbedtls_ssl_buffering_free( ssl );
XiaokangQian8499b6c2022-01-27 09:00:11 +00003175#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02003176
Ronald Cronf12b81d2022-03-15 10:42:41 +01003177#if defined(MBEDTLS_ECDH_C) && \
3178 ( defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
Hanno Becker4a63ed42019-01-08 11:39:35 +00003179 psa_destroy_key( handshake->ecdh_psa_privkey );
3180#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
3181
Ronald Cron6f135e12021-12-08 16:57:54 +01003182#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yua1a568c2021-11-09 10:17:21 +08003183 mbedtls_ssl_transform_free( handshake->transform_handshake );
3184 mbedtls_ssl_transform_free( handshake->transform_earlydata );
Jerry Yuba9c7272021-10-30 11:54:10 +08003185 mbedtls_free( handshake->transform_earlydata );
3186 mbedtls_free( handshake->transform_handshake );
Ronald Cron6f135e12021-12-08 16:57:54 +01003187#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08003188
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003189
3190#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3191 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
3192 * processes datagrams and the fact that a datagram is allowed to have
3193 * several records in it, it is possible that the I/O buffers are not
3194 * empty at this stage */
Andrzej Kurek4a063792020-10-21 15:08:44 +02003195 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
3196 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003197#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01003198
Jerry Yuba9c7272021-10-30 11:54:10 +08003199 /* mbedtls_platform_zeroize MUST be last one in this function */
3200 mbedtls_platform_zeroize( handshake,
3201 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003202}
3203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003204void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00003205{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003206 if( session == NULL )
3207 return;
3208
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003209#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker1294a0b2019-02-05 12:38:15 +00003210 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +02003211#endif
Paul Bakker0a597072012-09-25 21:55:46 +00003212
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003213#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003214 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02003215#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02003216
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003217 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003218}
3219
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02003220#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003221
3222#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3223#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
3224#else
3225#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
3226#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3227
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003228#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003229
3230#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3231#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
3232#else
3233#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
3234#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3235
3236#if defined(MBEDTLS_SSL_ALPN)
3237#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
3238#else
3239#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
3240#endif /* MBEDTLS_SSL_ALPN */
3241
3242#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
3243#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
3244#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
3245#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
3246
3247#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
3248 ( (uint32_t) ( \
3249 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
3250 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
3251 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
3252 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
3253 0u ) )
3254
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003255static unsigned char ssl_serialized_context_header[] = {
3256 MBEDTLS_VERSION_MAJOR,
3257 MBEDTLS_VERSION_MINOR,
3258 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01003259 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3260 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3261 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3262 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3263 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003264};
3265
Paul Bakker5121ce52009-01-03 21:22:43 +00003266/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003267 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003268 *
3269 * The format of the serialized data is:
3270 * (in the presentation language of TLS, RFC 8446 section 3)
3271 *
3272 * // header
3273 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003274 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003275 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003276 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003277 * Note: When updating the format, remember to keep these
3278 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003279 *
3280 * // session sub-structure
3281 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
3282 * // transform sub-structure
3283 * uint8 random[64]; // ServerHello.random+ClientHello.random
3284 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
3285 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
3286 * // fields from ssl_context
3287 * uint32 badmac_seen; // DTLS: number of records with failing MAC
3288 * uint64 in_window_top; // DTLS: last validated record seq_num
3289 * uint64 in_window; // DTLS: bitmask for replay protection
3290 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
3291 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
3292 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
3293 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
3294 *
3295 * Note that many fields of the ssl_context or sub-structures are not
3296 * serialized, as they fall in one of the following categories:
3297 *
3298 * 1. forced value (eg in_left must be 0)
3299 * 2. pointer to dynamically-allocated memory (eg session, transform)
3300 * 3. value can be re-derived from other data (eg session keys from MS)
3301 * 4. value was temporary (eg content of input buffer)
3302 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003303 */
3304int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
3305 unsigned char *buf,
3306 size_t buf_len,
3307 size_t *olen )
3308{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003309 unsigned char *p = buf;
3310 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003311 size_t session_len;
3312 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003313
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003314 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003315 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
3316 * this function's documentation.
3317 *
3318 * These are due to assumptions/limitations in the implementation. Some of
3319 * them are likely to stay (no handshake in progress) some might go away
3320 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003321 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003322 /* The initial handshake must be over */
3323 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003324 {
3325 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003326 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003327 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003328 if( ssl->handshake != NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003329 {
3330 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003331 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003332 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003333 /* Double-check that sub-structures are indeed ready */
3334 if( ssl->transform == NULL || ssl->session == NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003335 {
3336 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003337 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003338 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003339 /* There must be no pending incoming or outgoing data */
3340 if( mbedtls_ssl_check_pending( ssl ) != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003341 {
3342 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003343 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003344 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003345 if( ssl->out_left != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003346 {
3347 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003348 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003349 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003350 /* Protocol must be DLTS, not TLS */
3351 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003352 {
3353 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003354 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003355 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003356 /* Version must be 1.2 */
3357 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003358 {
3359 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003360 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003361 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003362 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003363 {
3364 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003365 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003366 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003367 /* We must be using an AEAD ciphersuite */
3368 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003369 {
3370 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003371 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003372 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003373 /* Renegotiation must not be enabled */
3374#if defined(MBEDTLS_SSL_RENEGOTIATION)
3375 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003376 {
3377 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003378 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003379 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003380#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003381
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003382 /*
3383 * Version and format identifier
3384 */
3385 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003386
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003387 if( used <= buf_len )
3388 {
3389 memcpy( p, ssl_serialized_context_header,
3390 sizeof( ssl_serialized_context_header ) );
3391 p += sizeof( ssl_serialized_context_header );
3392 }
3393
3394 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003395 * Session (length + data)
3396 */
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003397 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003398 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
3399 return( ret );
3400
3401 used += 4 + session_len;
3402 if( used <= buf_len )
3403 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003404 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
3405 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003406
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003407 ret = ssl_session_save( ssl->session, 1,
3408 p, session_len, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003409 if( ret != 0 )
3410 return( ret );
3411
3412 p += session_len;
3413 }
3414
3415 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003416 * Transform
3417 */
3418 used += sizeof( ssl->transform->randbytes );
3419 if( used <= buf_len )
3420 {
3421 memcpy( p, ssl->transform->randbytes,
3422 sizeof( ssl->transform->randbytes ) );
3423 p += sizeof( ssl->transform->randbytes );
3424 }
3425
3426#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3427 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
3428 if( used <= buf_len )
3429 {
3430 *p++ = ssl->transform->in_cid_len;
3431 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
3432 p += ssl->transform->in_cid_len;
3433
3434 *p++ = ssl->transform->out_cid_len;
3435 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
3436 p += ssl->transform->out_cid_len;
3437 }
3438#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3439
3440 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003441 * Saved fields from top-level ssl_context structure
3442 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003443 used += 4;
3444 if( used <= buf_len )
3445 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003446 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
3447 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003448 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003449
3450#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3451 used += 16;
3452 if( used <= buf_len )
3453 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003454 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
3455 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003456
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003457 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
3458 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003459 }
3460#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3461
3462#if defined(MBEDTLS_SSL_PROTO_DTLS)
3463 used += 1;
3464 if( used <= buf_len )
3465 {
3466 *p++ = ssl->disable_datagram_packing;
3467 }
3468#endif /* MBEDTLS_SSL_PROTO_DTLS */
3469
Jerry Yuae0b2e22021-10-08 15:21:19 +08003470 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003471 if( used <= buf_len )
3472 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08003473 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
3474 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003475 }
3476
3477#if defined(MBEDTLS_SSL_PROTO_DTLS)
3478 used += 2;
3479 if( used <= buf_len )
3480 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003481 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
3482 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003483 }
3484#endif /* MBEDTLS_SSL_PROTO_DTLS */
3485
3486#if defined(MBEDTLS_SSL_ALPN)
3487 {
3488 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnardf041f4e2019-07-24 00:58:27 +02003489 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003490 : 0;
3491
3492 used += 1 + alpn_len;
3493 if( used <= buf_len )
3494 {
3495 *p++ = alpn_len;
3496
3497 if( ssl->alpn_chosen != NULL )
3498 {
3499 memcpy( p, ssl->alpn_chosen, alpn_len );
3500 p += alpn_len;
3501 }
3502 }
3503 }
3504#endif /* MBEDTLS_SSL_ALPN */
3505
3506 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003507 * Done
3508 */
3509 *olen = used;
3510
3511 if( used > buf_len )
3512 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003513
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003514 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
3515
Hanno Becker43aefe22020-02-05 10:44:56 +00003516 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003517}
3518
3519/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003520 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003521 *
3522 * This internal version is wrapped by a public function that cleans up in
3523 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003524 */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003525static int ssl_context_load( mbedtls_ssl_context *ssl,
3526 const unsigned char *buf,
3527 size_t len )
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003528{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003529 const unsigned char *p = buf;
3530 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003531 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00003532 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003533
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003534 /*
3535 * The context should have been freshly setup or reset.
3536 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02003537 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003538 * renegotiating, or if the user mistakenly loaded a session first.)
3539 */
3540 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
3541 ssl->session != NULL )
3542 {
3543 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3544 }
3545
3546 /*
3547 * We can't check that the config matches the initial one, but we can at
3548 * least check it matches the requirements for serializing.
3549 */
3550 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
3551 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
3552 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 ||
3553 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ||
3554 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 ||
3555#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02003556 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003557#endif
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02003558 0 )
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003559 {
3560 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3561 }
3562
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003563 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
3564
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003565 /*
3566 * Check version identifier
3567 */
3568 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
3569 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3570
3571 if( memcmp( p, ssl_serialized_context_header,
3572 sizeof( ssl_serialized_context_header ) ) != 0 )
3573 {
3574 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
3575 }
3576 p += sizeof( ssl_serialized_context_header );
3577
3578 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003579 * Session
3580 */
3581 if( (size_t)( end - p ) < 4 )
3582 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3583
3584 session_len = ( (size_t) p[0] << 24 ) |
3585 ( (size_t) p[1] << 16 ) |
3586 ( (size_t) p[2] << 8 ) |
3587 ( (size_t) p[3] );
3588 p += 4;
3589
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003590 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00003591 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003592 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003593 ssl->session_in = ssl->session;
3594 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003595 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003596
3597 if( (size_t)( end - p ) < session_len )
3598 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3599
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003600 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003601 if( ret != 0 )
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003602 {
3603 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003604 return( ret );
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003605 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003606
3607 p += session_len;
3608
3609 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003610 * Transform
3611 */
3612
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003613 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00003614 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003615 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003616 ssl->transform_in = ssl->transform;
3617 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003618 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003619
3620 /* Read random bytes and populate structure */
3621 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
3622 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yu840fbb22022-02-17 14:59:29 +08003623#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerbd257552021-03-22 06:59:27 +00003624 ret = ssl_tls12_populate_transform( ssl->transform,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003625 ssl->session->ciphersuite,
3626 ssl->session->master,
Hanno Beckerbd257552021-03-22 06:59:27 +00003627#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
3628 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003629 ssl->session->encrypt_then_mac,
Hanno Beckerbd257552021-03-22 06:59:27 +00003630#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
3631 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003632 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
3633 p, /* currently pointing to randbytes */
3634 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
3635 ssl->conf->endpoint,
3636 ssl );
3637 if( ret != 0 )
3638 return( ret );
Jerry Yu840fbb22022-02-17 14:59:29 +08003639#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003640 p += sizeof( ssl->transform->randbytes );
3641
3642#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3643 /* Read connection IDs and store them */
3644 if( (size_t)( end - p ) < 1 )
3645 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3646
3647 ssl->transform->in_cid_len = *p++;
3648
Manuel Pégourié-Gonnard5ea13b82019-07-23 15:02:54 +02003649 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003650 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3651
3652 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
3653 p += ssl->transform->in_cid_len;
3654
3655 ssl->transform->out_cid_len = *p++;
3656
3657 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
3658 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3659
3660 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
3661 p += ssl->transform->out_cid_len;
3662#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3663
3664 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003665 * Saved fields from top-level ssl_context structure
3666 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003667 if( (size_t)( end - p ) < 4 )
3668 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3669
3670 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
3671 ( (uint32_t) p[1] << 16 ) |
3672 ( (uint32_t) p[2] << 8 ) |
3673 ( (uint32_t) p[3] );
3674 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003675
3676#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3677 if( (size_t)( end - p ) < 16 )
3678 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3679
3680 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
3681 ( (uint64_t) p[1] << 48 ) |
3682 ( (uint64_t) p[2] << 40 ) |
3683 ( (uint64_t) p[3] << 32 ) |
3684 ( (uint64_t) p[4] << 24 ) |
3685 ( (uint64_t) p[5] << 16 ) |
3686 ( (uint64_t) p[6] << 8 ) |
3687 ( (uint64_t) p[7] );
3688 p += 8;
3689
3690 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
3691 ( (uint64_t) p[1] << 48 ) |
3692 ( (uint64_t) p[2] << 40 ) |
3693 ( (uint64_t) p[3] << 32 ) |
3694 ( (uint64_t) p[4] << 24 ) |
3695 ( (uint64_t) p[5] << 16 ) |
3696 ( (uint64_t) p[6] << 8 ) |
3697 ( (uint64_t) p[7] );
3698 p += 8;
3699#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3700
3701#if defined(MBEDTLS_SSL_PROTO_DTLS)
3702 if( (size_t)( end - p ) < 1 )
3703 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3704
3705 ssl->disable_datagram_packing = *p++;
3706#endif /* MBEDTLS_SSL_PROTO_DTLS */
3707
Jerry Yud9a94fe2021-09-28 18:58:59 +08003708 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003709 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yud9a94fe2021-09-28 18:58:59 +08003710 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
3711 p += sizeof( ssl->cur_out_ctr );
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003712
3713#if defined(MBEDTLS_SSL_PROTO_DTLS)
3714 if( (size_t)( end - p ) < 2 )
3715 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3716
3717 ssl->mtu = ( p[0] << 8 ) | p[1];
3718 p += 2;
3719#endif /* MBEDTLS_SSL_PROTO_DTLS */
3720
3721#if defined(MBEDTLS_SSL_ALPN)
3722 {
3723 uint8_t alpn_len;
3724 const char **cur;
3725
3726 if( (size_t)( end - p ) < 1 )
3727 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3728
3729 alpn_len = *p++;
3730
3731 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
3732 {
3733 /* alpn_chosen should point to an item in the configured list */
3734 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
3735 {
3736 if( strlen( *cur ) == alpn_len &&
3737 memcmp( p, cur, alpn_len ) == 0 )
3738 {
3739 ssl->alpn_chosen = *cur;
3740 break;
3741 }
3742 }
3743 }
3744
3745 /* can only happen on conf mismatch */
3746 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
3747 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3748
3749 p += alpn_len;
3750 }
3751#endif /* MBEDTLS_SSL_ALPN */
3752
3753 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003754 * Forced fields from top-level ssl_context structure
3755 *
3756 * Most of them already set to the correct value by mbedtls_ssl_init() and
3757 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
3758 */
3759 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
3760
3761 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
3762 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
3763
Hanno Becker361b10d2019-08-30 10:42:49 +01003764 /* Adjust pointers for header fields of outgoing records to
3765 * the given transform, accounting for explicit IV and CID. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00003766 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
Hanno Becker361b10d2019-08-30 10:42:49 +01003767
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003768#if defined(MBEDTLS_SSL_PROTO_DTLS)
3769 ssl->in_epoch = 1;
3770#endif
3771
3772 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
3773 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00003774 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
3775 * inappropriately. */
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003776 if( ssl->handshake != NULL )
3777 {
3778 mbedtls_ssl_handshake_free( ssl );
3779 mbedtls_free( ssl->handshake );
3780 ssl->handshake = NULL;
3781 }
3782
3783 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003784 * Done - should have consumed entire buffer
3785 */
3786 if( p != end )
3787 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003788
3789 return( 0 );
3790}
3791
3792/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003793 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003794 */
3795int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
3796 const unsigned char *buf,
3797 size_t len )
3798{
3799 int ret = ssl_context_load( context, buf, len );
3800
3801 if( ret != 0 )
3802 mbedtls_ssl_free( context );
3803
3804 return( ret );
3805}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02003806#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003807
3808/*
Paul Bakker5121ce52009-01-03 21:22:43 +00003809 * Free an SSL context
3810 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003811void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003812{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003813 if( ssl == NULL )
3814 return;
3815
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003816 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003817
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01003818 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003819 {
sander-visserb8aa2072020-05-06 22:05:13 +02003820#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3821 size_t out_buf_len = ssl->out_buf_len;
3822#else
3823 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3824#endif
3825
Darryl Greenb33cc762019-11-28 14:29:44 +00003826 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003827 mbedtls_free( ssl->out_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003828 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00003829 }
3830
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01003831 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003832 {
sander-visserb8aa2072020-05-06 22:05:13 +02003833#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3834 size_t in_buf_len = ssl->in_buf_len;
3835#else
3836 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3837#endif
3838
Darryl Greenb33cc762019-11-28 14:29:44 +00003839 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003840 mbedtls_free( ssl->in_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003841 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00003842 }
3843
Paul Bakker48916f92012-09-16 19:57:18 +00003844 if( ssl->transform )
3845 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003846 mbedtls_ssl_transform_free( ssl->transform );
3847 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00003848 }
3849
3850 if( ssl->handshake )
3851 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02003852 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003853 mbedtls_ssl_transform_free( ssl->transform_negotiate );
3854 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00003855
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003856 mbedtls_free( ssl->handshake );
3857 mbedtls_free( ssl->transform_negotiate );
3858 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00003859 }
3860
Ronald Cron6f135e12021-12-08 16:57:54 +01003861#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker3aa186f2021-08-10 09:24:19 +01003862 mbedtls_ssl_transform_free( ssl->transform_application );
3863 mbedtls_free( ssl->transform_application );
Ronald Cron6f135e12021-12-08 16:57:54 +01003864#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01003865
Paul Bakkerc0463502013-02-14 11:19:38 +01003866 if( ssl->session )
3867 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003868 mbedtls_ssl_session_free( ssl->session );
3869 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01003870 }
3871
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02003872#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02003873 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003874 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003875 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003876 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00003877 }
Paul Bakker0be444a2013-08-27 21:55:01 +02003878#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003879
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02003880#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003881 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02003882#endif
3883
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003884 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00003885
Paul Bakker86f04f42013-02-14 11:20:09 +01003886 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003887 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003888}
3889
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02003890/*
3891 * Initialze mbedtls_ssl_config
3892 */
3893void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
3894{
3895 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
3896}
3897
Gilles Peskineeccd8882020-03-10 12:19:08 +01003898#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08003899#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskineae270bf2021-06-02 00:05:29 +02003900/* The selection should be the same as mbedtls_x509_crt_profile_default in
Gilles Peskinea28f0f52021-06-02 15:29:38 +02003901 * x509_crt.c. Here, the order matters. Currently we favor stronger hashes,
3902 * for no fundamental reason.
Gilles Peskineae270bf2021-06-02 00:05:29 +02003903 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
3904 * about this list. */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01003905static int ssl_preset_default_hashes[] = {
3906#if defined(MBEDTLS_SHA512_C)
3907 MBEDTLS_MD_SHA512,
Mateusz Starzyk3352a532021-04-06 14:28:22 +02003908#endif
3909#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01003910 MBEDTLS_MD_SHA384,
3911#endif
3912#if defined(MBEDTLS_SHA256_C)
3913 MBEDTLS_MD_SHA256,
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02003914#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01003915 MBEDTLS_MD_NONE
3916};
Jerry Yuf017ee42022-01-12 15:49:48 +08003917#endif /* !MBEDTLS_DEPRECATED_REMOVED */
3918#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01003919
Gilles Peskineae270bf2021-06-02 00:05:29 +02003920/* The selection should be the same as mbedtls_x509_crt_profile_default in
3921 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02003922 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02003923 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02003924 * about this list.
3925 */
Brett Warrene0edc842021-08-17 09:53:13 +01003926static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02003927#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003928 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02003929#endif
3930#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003931 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02003932#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02003933#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003934 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003935#endif
3936#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003937 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003938#endif
3939#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003940 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003941#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02003942#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003943 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02003944#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02003945#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003946 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003947#endif
3948#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003949 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003950#endif
Brett Warrene0edc842021-08-17 09:53:13 +01003951 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02003952};
Gilles Peskineae270bf2021-06-02 00:05:29 +02003953
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02003954static int ssl_preset_suiteb_ciphersuites[] = {
3955 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
3956 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
3957 0
3958};
3959
Gilles Peskineeccd8882020-03-10 12:19:08 +01003960#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08003961#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02003962static int ssl_preset_suiteb_hashes[] = {
Jerry Yuf017ee42022-01-12 15:49:48 +08003963#if defined(MBEDTLS_SHA256_C)
3964 MBEDTLS_MD_SHA256,
3965#endif
Jerry Yu713013f2022-01-17 18:16:35 +08003966#if defined(MBEDTLS_SHA384_C)
3967 MBEDTLS_MD_SHA384,
3968#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02003969 MBEDTLS_MD_NONE
3970};
Jerry Yuf017ee42022-01-12 15:49:48 +08003971#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01003972
Jerry Yu909df7b2022-01-22 11:56:27 +08003973/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08003974 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08003975 * rules SHOULD be upheld.
3976 * - No duplicate entries.
3977 * - But if there is a good reason, do not change the order of the algorithms.
3978 * - ssl_tls12_present* is for TLS 1.2 use only.
3979 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08003980 */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01003981static uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08003982
Jerry Yued5e9f42022-01-26 11:21:34 +08003983#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
3984 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
3985 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
3986#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
3987 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08003988
Jerry Yu909df7b2022-01-22 11:56:27 +08003989#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
3990 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
3991 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
3992#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
3993 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
3994
Jerry Yued5e9f42022-01-26 11:21:34 +08003995#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA512_C) && \
3996 defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
3997 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
3998#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
3999 MBEDTLS_ECP_DP_SECP521R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004000
Jerry Yu909df7b2022-01-22 11:56:27 +08004001#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
4002 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4003#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
4004
Ronald Cron8540cf62022-03-16 08:01:09 +01004005#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA512_C)
4006 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
4007#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */
4008
4009#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA384_C)
4010 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
4011#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */
4012
Jerry Yu53037892022-01-25 11:02:06 +08004013#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
4014 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4015#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4016
Jerry Yu909df7b2022-01-22 11:56:27 +08004017 MBEDTLS_TLS1_3_SIG_NONE
4018};
4019
4020/* NOTICE: see above */
4021#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4022static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08004023#if defined(MBEDTLS_SHA512_C)
4024 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA512 )
4025#endif
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004026#if defined(MBEDTLS_SHA384_C)
4027 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
4028#endif
4029#if defined(MBEDTLS_SHA256_C)
4030 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
4031#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08004032 MBEDTLS_TLS1_3_SIG_NONE
4033};
4034#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4035/* NOTICE: see above */
4036static uint16_t ssl_preset_suiteb_sig_algs[] = {
4037
Jerry Yu909df7b2022-01-22 11:56:27 +08004038#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
4039 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4040 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
4041#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
4042 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
4043
Jerry Yu53037892022-01-25 11:02:06 +08004044#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
4045 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4046 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
4047#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4048 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004049
4050#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
4051 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4052#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004053
Jerry Yu53037892022-01-25 11:02:06 +08004054#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
4055 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4056#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4057
Jerry Yu713013f2022-01-17 18:16:35 +08004058 MBEDTLS_TLS1_3_SIG_NONE
4059};
Jerry Yu6106fdc2022-01-12 16:36:14 +08004060
Jerry Yu909df7b2022-01-22 11:56:27 +08004061/* NOTICE: see above */
4062#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4063static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08004064#if defined(MBEDTLS_SHA256_C)
4065 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
4066#endif
Jerry Yu18c833e2022-01-25 10:55:47 +08004067#if defined(MBEDTLS_SHA384_C)
4068 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
4069#endif
Xiaofei Bai95395012021-11-25 08:51:30 +00004070 MBEDTLS_TLS1_3_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004071};
Jerry Yu909df7b2022-01-22 11:56:27 +08004072#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4073
Jerry Yu1a8b4812022-01-20 17:56:50 +08004074#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004075
Brett Warrene0edc842021-08-17 09:53:13 +01004076static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01004077#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004078 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004079#endif
4080#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004081 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004082#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004083 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004084};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004085
Jerry Yu1a8b4812022-01-20 17:56:50 +08004086#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004087/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08004088 * to make sure there are no duplicated signature algorithm entries. */
Jerry Yuf377d642022-01-25 10:43:59 +08004089static int ssl_check_no_sig_alg_duplication( uint16_t * sig_algs )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004090{
4091 size_t i, j;
4092 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08004093
Jerry Yuf377d642022-01-25 10:43:59 +08004094 for( i = 0; sig_algs[i] != MBEDTLS_TLS1_3_SIG_NONE; i++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004095 {
Jerry Yuf377d642022-01-25 10:43:59 +08004096 for( j = 0; j < i; j++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004097 {
Jerry Yuf377d642022-01-25 10:43:59 +08004098 if( sig_algs[i] != sig_algs[j] )
4099 continue;
4100 mbedtls_printf( " entry(%04x,%" MBEDTLS_PRINTF_SIZET
4101 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
4102 sig_algs[i], j, i );
4103 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08004104 }
4105 }
4106 return( ret );
4107}
4108
4109#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4110
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004111/*
Tillmann Karras588ad502015-09-25 04:27:22 +02004112 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004113 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004114int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004115 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004116{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004117#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00004118 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004119#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004120
Jerry Yu1a8b4812022-01-20 17:56:50 +08004121#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf377d642022-01-25 10:43:59 +08004122 if( ssl_check_no_sig_alg_duplication( ssl_preset_suiteb_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004123 {
4124 mbedtls_printf( "ssl_preset_suiteb_sig_algs has duplicated entries\n" );
4125 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4126 }
4127
Jerry Yuf377d642022-01-25 10:43:59 +08004128 if( ssl_check_no_sig_alg_duplication( ssl_preset_default_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004129 {
4130 mbedtls_printf( "ssl_preset_default_sig_algs has duplicated entries\n" );
4131 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4132 }
Jerry Yu909df7b2022-01-22 11:56:27 +08004133
4134#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yuf377d642022-01-25 10:43:59 +08004135 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_suiteb_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004136 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004137 mbedtls_printf( "ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004138 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4139 }
4140
Jerry Yuf377d642022-01-25 10:43:59 +08004141 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_default_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004142 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004143 mbedtls_printf( "ssl_tls12_preset_default_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004144 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4145 }
4146#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004147#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4148
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02004149 /* Use the functions here so that they are covered in tests,
4150 * but otherwise access member directly for efficiency */
4151 mbedtls_ssl_conf_endpoint( conf, endpoint );
4152 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004153
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004154 /*
4155 * Things that are common to all presets
4156 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004157#if defined(MBEDTLS_SSL_CLI_C)
4158 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
4159 {
4160 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
4161#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4162 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
4163#endif
4164 }
4165#endif
4166
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004167#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4168 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
4169#endif
4170
4171#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
4172 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
4173#endif
4174
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004175#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004176 conf->f_cookie_write = ssl_cookie_write_dummy;
4177 conf->f_cookie_check = ssl_cookie_check_dummy;
4178#endif
4179
4180#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4181 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
4182#endif
4183
Janos Follath088ce432017-04-10 12:42:31 +01004184#if defined(MBEDTLS_SSL_SRV_C)
4185 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02004186 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01004187#endif
4188
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004189#if defined(MBEDTLS_SSL_PROTO_DTLS)
4190 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
4191 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
4192#endif
4193
4194#if defined(MBEDTLS_SSL_RENEGOTIATION)
4195 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00004196 memset( conf->renego_period, 0x00, 2 );
4197 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004198#endif
4199
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004200#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckere2defad2021-07-24 05:59:17 +01004201 if( endpoint == MBEDTLS_SSL_IS_SERVER )
4202 {
4203 const unsigned char dhm_p[] =
4204 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
4205 const unsigned char dhm_g[] =
4206 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01004207
Hanno Beckere2defad2021-07-24 05:59:17 +01004208 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
4209 dhm_p, sizeof( dhm_p ),
4210 dhm_g, sizeof( dhm_g ) ) ) != 0 )
4211 {
4212 return( ret );
4213 }
4214 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02004215#endif
4216
Ronald Cron6f135e12021-12-08 16:57:54 +01004217#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker71f1ed62021-07-24 06:01:47 +01004218 /*
4219 * Allow all TLS 1.3 key exchange modes by default.
4220 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00004221 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01004222#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01004223
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004224 /*
4225 * Preset-specific defaults
4226 */
4227 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004228 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004229 /*
4230 * NSA Suite B
4231 */
4232 case MBEDTLS_SSL_PRESET_SUITEB:
Ronald Crone71639d2022-03-11 11:31:31 +01004233 conf->min_major_ver = MBEDTLS_SSL_MIN_MAJOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004234 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Ronald Crone71639d2022-03-11 11:31:31 +01004235
Ronald Cronf6606552022-03-15 11:23:25 +01004236 if( ( endpoint == MBEDTLS_SSL_IS_SERVER ) ||
4237 ( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) )
4238#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4239 {
4240 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
4241 conf->max_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
4242 }
Jerry Yu7d239632022-01-27 14:16:44 +08004243#else
Ronald Cronf6606552022-03-15 11:23:25 +01004244 {
4245 conf->min_major_ver = 0;
4246 conf->max_major_ver = 0;
4247 conf->min_minor_ver = 0;
4248 conf->max_minor_ver = 0;
Ronald Cron1fa4f682022-03-30 17:35:18 +02004249 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ronald Cronf6606552022-03-15 11:23:25 +01004250 }
4251#endif
4252 else
4253 {
4254 conf->min_minor_ver = MBEDTLS_SSL_MIN_MINOR_VERSION;
4255 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
4256 }
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004257 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004258
4259#if defined(MBEDTLS_X509_CRT_PARSE_C)
4260 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004261#endif
4262
Gilles Peskineeccd8882020-03-10 12:19:08 +01004263#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004264#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004265 conf->sig_hashes = ssl_preset_suiteb_hashes;
Jerry Yuf017ee42022-01-12 15:49:48 +08004266#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004267#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4268 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4269 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
4270 else
4271#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4272 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004273#endif
4274
Brett Warrene0edc842021-08-17 09:53:13 +01004275#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4276 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004277#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004278 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02004279 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004280
4281 /*
4282 * Default
4283 */
4284 default:
Ronald Crone71639d2022-03-11 11:31:31 +01004285 conf->min_major_ver = MBEDTLS_SSL_MIN_MAJOR_VERSION;
4286 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
4287
Ronald Cronf6606552022-03-15 11:23:25 +01004288 if( ( endpoint == MBEDTLS_SSL_IS_SERVER ) ||
4289 ( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) )
4290#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4291 {
TRodziewiczef73f012021-05-13 14:53:36 +02004292 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Ronald Cronf6606552022-03-15 11:23:25 +01004293 conf->max_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
4294 }
4295#else
4296 {
4297 conf->min_major_ver = 0;
4298 conf->max_major_ver = 0;
4299 conf->min_minor_ver = 0;
4300 conf->max_minor_ver = 0;
Ronald Cron1fa4f682022-03-30 17:35:18 +02004301 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ronald Cronf6606552022-03-15 11:23:25 +01004302 }
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004303#endif
Ronald Cronf6606552022-03-15 11:23:25 +01004304 else
4305 {
4306 conf->min_minor_ver = MBEDTLS_SSL_MIN_MINOR_VERSION;
4307 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
4308 }
4309
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004310 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004311
4312#if defined(MBEDTLS_X509_CRT_PARSE_C)
4313 conf->cert_profile = &mbedtls_x509_crt_profile_default;
4314#endif
4315
Gilles Peskineeccd8882020-03-10 12:19:08 +01004316#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004317#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01004318 conf->sig_hashes = ssl_preset_default_hashes;
Jerry Yuf017ee42022-01-12 15:49:48 +08004319#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004320#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4321 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4322 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
4323 else
4324#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4325 conf->sig_algs = ssl_preset_default_sig_algs;
Hanno Beckerdeb68ce2021-08-10 16:04:05 +01004326#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004327
Brett Warrene0edc842021-08-17 09:53:13 +01004328#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4329 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004330#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004331 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004332
4333#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
4334 conf->dhm_min_bitlen = 1024;
4335#endif
4336 }
4337
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004338 return( 0 );
4339}
4340
4341/*
4342 * Free mbedtls_ssl_config
4343 */
4344void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
4345{
4346#if defined(MBEDTLS_DHM_C)
4347 mbedtls_mpi_free( &conf->dhm_P );
4348 mbedtls_mpi_free( &conf->dhm_G );
4349#endif
4350
Gilles Peskineeccd8882020-03-10 12:19:08 +01004351#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004352 if( conf->psk != NULL )
4353 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004354 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004355 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00004356 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004357 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09004358 }
4359
4360 if( conf->psk_identity != NULL )
4361 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004362 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09004363 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00004364 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004365 conf->psk_identity_len = 0;
4366 }
4367#endif
4368
4369#if defined(MBEDTLS_X509_CRT_PARSE_C)
4370 ssl_key_cert_free( conf->key_cert );
4371#endif
4372
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004373 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004374}
4375
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004376#if defined(MBEDTLS_PK_C) && \
4377 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004378/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004379 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004380 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004381unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004382{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004383#if defined(MBEDTLS_RSA_C)
4384 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
4385 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004386#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004387#if defined(MBEDTLS_ECDSA_C)
4388 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
4389 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004390#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004391 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004392}
4393
Hanno Becker7e5437a2017-04-28 17:15:26 +01004394unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
4395{
4396 switch( type ) {
4397 case MBEDTLS_PK_RSA:
4398 return( MBEDTLS_SSL_SIG_RSA );
4399 case MBEDTLS_PK_ECDSA:
4400 case MBEDTLS_PK_ECKEY:
4401 return( MBEDTLS_SSL_SIG_ECDSA );
4402 default:
4403 return( MBEDTLS_SSL_SIG_ANON );
4404 }
4405}
4406
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004407mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004408{
4409 switch( sig )
4410 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004411#if defined(MBEDTLS_RSA_C)
4412 case MBEDTLS_SSL_SIG_RSA:
4413 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004414#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004415#if defined(MBEDTLS_ECDSA_C)
4416 case MBEDTLS_SSL_SIG_ECDSA:
4417 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004418#endif
4419 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004420 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004421 }
4422}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004423#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004424
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004425/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004426 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004427 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004428mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004429{
4430 switch( hash )
4431 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004432#if defined(MBEDTLS_MD5_C)
4433 case MBEDTLS_SSL_HASH_MD5:
4434 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004435#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004436#if defined(MBEDTLS_SHA1_C)
4437 case MBEDTLS_SSL_HASH_SHA1:
4438 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004439#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004440#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004441 case MBEDTLS_SSL_HASH_SHA224:
4442 return( MBEDTLS_MD_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004443#endif
4444#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004445 case MBEDTLS_SSL_HASH_SHA256:
4446 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004447#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004448#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004449 case MBEDTLS_SSL_HASH_SHA384:
4450 return( MBEDTLS_MD_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004451#endif
4452#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004453 case MBEDTLS_SSL_HASH_SHA512:
4454 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004455#endif
4456 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004457 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004458 }
4459}
4460
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004461/*
4462 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
4463 */
4464unsigned char mbedtls_ssl_hash_from_md_alg( int md )
4465{
4466 switch( md )
4467 {
4468#if defined(MBEDTLS_MD5_C)
4469 case MBEDTLS_MD_MD5:
4470 return( MBEDTLS_SSL_HASH_MD5 );
4471#endif
4472#if defined(MBEDTLS_SHA1_C)
4473 case MBEDTLS_MD_SHA1:
4474 return( MBEDTLS_SSL_HASH_SHA1 );
4475#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004476#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004477 case MBEDTLS_MD_SHA224:
4478 return( MBEDTLS_SSL_HASH_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004479#endif
4480#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004481 case MBEDTLS_MD_SHA256:
4482 return( MBEDTLS_SSL_HASH_SHA256 );
4483#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004484#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004485 case MBEDTLS_MD_SHA384:
4486 return( MBEDTLS_SSL_HASH_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004487#endif
4488#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004489 case MBEDTLS_MD_SHA512:
4490 return( MBEDTLS_SSL_HASH_SHA512 );
4491#endif
4492 default:
4493 return( MBEDTLS_SSL_HASH_NONE );
4494 }
4495}
4496
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004497/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004498 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004499 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004500 */
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004501int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004502{
Brett Warrene0edc842021-08-17 09:53:13 +01004503 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004504
Brett Warrene0edc842021-08-17 09:53:13 +01004505 if( group_list == NULL )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004506 return( -1 );
4507
Brett Warrene0edc842021-08-17 09:53:13 +01004508 for( ; *group_list != 0; group_list++ )
4509 {
4510 if( *group_list == tls_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004511 return( 0 );
Brett Warrene0edc842021-08-17 09:53:13 +01004512 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004513
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004514 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004515}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004516
4517#if defined(MBEDTLS_ECP_C)
4518/*
4519 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
4520 */
4521int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
4522{
Manuel Pégourié-Gonnard422370d2022-02-07 11:55:21 +01004523 uint16_t tls_id = mbedtls_ecp_curve_info_from_grp_id( grp_id )->tls_id;
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004524 return mbedtls_ssl_check_curve_tls_id( ssl, tls_id );
4525}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02004526#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004527
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004528#if defined(MBEDTLS_X509_CRT_PARSE_C)
4529int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
4530 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004531 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02004532 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004533{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004534 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004535 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004536 const char *ext_oid;
4537 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004538
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004539 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004540 {
4541 /* Server part of the key exchange */
4542 switch( ciphersuite->key_exchange )
4543 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004544 case MBEDTLS_KEY_EXCHANGE_RSA:
4545 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004546 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004547 break;
4548
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004549 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
4550 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
4551 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
4552 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004553 break;
4554
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004555 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
4556 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004557 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004558 break;
4559
4560 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004561 case MBEDTLS_KEY_EXCHANGE_NONE:
4562 case MBEDTLS_KEY_EXCHANGE_PSK:
4563 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
4564 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02004565 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004566 usage = 0;
4567 }
4568 }
4569 else
4570 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004571 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
4572 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004573 }
4574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004575 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004576 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004577 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004578 ret = -1;
4579 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004580
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004581 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004582 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004583 ext_oid = MBEDTLS_OID_SERVER_AUTH;
4584 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004585 }
4586 else
4587 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004588 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
4589 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004590 }
4591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004592 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004593 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004594 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004595 ret = -1;
4596 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004597
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004598 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004599}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004600#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02004601
Jerry Yu148165c2021-09-24 23:20:59 +08004602#if defined(MBEDTLS_USE_PSA_CRYPTO)
4603int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
4604 const mbedtls_md_type_t md,
4605 unsigned char *dst,
4606 size_t dst_len,
4607 size_t *olen )
4608{
Ronald Cronf6893e12022-01-07 22:09:01 +01004609 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4610 psa_hash_operation_t *hash_operation_to_clone;
4611 psa_hash_operation_t hash_operation = psa_hash_operation_init();
4612
Jerry Yu148165c2021-09-24 23:20:59 +08004613 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01004614
4615 switch( md )
4616 {
4617#if defined(MBEDTLS_SHA384_C)
4618 case MBEDTLS_MD_SHA384:
4619 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
4620 break;
4621#endif
4622
4623#if defined(MBEDTLS_SHA256_C)
4624 case MBEDTLS_MD_SHA256:
4625 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
4626 break;
4627#endif
4628
4629 default:
4630 goto exit;
4631 }
4632
4633 status = psa_hash_clone( hash_operation_to_clone, &hash_operation );
4634 if( status != PSA_SUCCESS )
4635 goto exit;
4636
4637 status = psa_hash_finish( &hash_operation, dst, dst_len, olen );
4638 if( status != PSA_SUCCESS )
4639 goto exit;
4640
4641exit:
Ronald Cronb788c042022-02-15 09:14:15 +01004642 return( psa_ssl_status_to_mbedtls( status ) );
Jerry Yu148165c2021-09-24 23:20:59 +08004643}
4644#else /* MBEDTLS_USE_PSA_CRYPTO */
4645
Jerry Yu24c0ec32021-09-09 14:21:07 +08004646#if defined(MBEDTLS_SHA384_C)
Jerry Yu000f9762021-09-14 11:12:51 +08004647static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
4648 unsigned char *dst,
4649 size_t dst_len,
4650 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004651{
Jerry Yu24c0ec32021-09-09 14:21:07 +08004652 int ret;
4653 mbedtls_sha512_context sha512;
4654
4655 if( dst_len < 48 )
4656 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4657
4658 mbedtls_sha512_init( &sha512 );
4659 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
4660
4661 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
4662 {
4663 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
4664 goto exit;
4665 }
4666
4667 *olen = 48;
4668
4669exit:
4670
4671 mbedtls_sha512_free( &sha512 );
4672 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004673}
4674#endif /* MBEDTLS_SHA384_C */
4675
4676#if defined(MBEDTLS_SHA256_C)
Jerry Yu000f9762021-09-14 11:12:51 +08004677static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
4678 unsigned char *dst,
4679 size_t dst_len,
4680 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004681{
Jerry Yu24c0ec32021-09-09 14:21:07 +08004682 int ret;
4683 mbedtls_sha256_context sha256;
4684
4685 if( dst_len < 32 )
4686 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4687
4688 mbedtls_sha256_init( &sha256 );
4689 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Jerry Yuc5aef882021-12-23 20:15:02 +08004690
Jerry Yu24c0ec32021-09-09 14:21:07 +08004691 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
4692 {
4693 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
4694 goto exit;
4695 }
4696
4697 *olen = 32;
4698
4699exit:
4700
4701 mbedtls_sha256_free( &sha256 );
4702 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004703}
4704#endif /* MBEDTLS_SHA256_C */
4705
Jerry Yu000f9762021-09-14 11:12:51 +08004706int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
4707 const mbedtls_md_type_t md,
4708 unsigned char *dst,
4709 size_t dst_len,
4710 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004711{
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004712 switch( md )
4713 {
4714
Jerry Yu24c0ec32021-09-09 14:21:07 +08004715#if defined(MBEDTLS_SHA384_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004716 case MBEDTLS_MD_SHA384:
Jerry Yuc5aef882021-12-23 20:15:02 +08004717 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08004718#endif /* MBEDTLS_SHA384_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004719
Jerry Yu24c0ec32021-09-09 14:21:07 +08004720#if defined(MBEDTLS_SHA256_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004721 case MBEDTLS_MD_SHA256:
Jerry Yuc5aef882021-12-23 20:15:02 +08004722 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08004723#endif /* MBEDTLS_SHA256_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004724
4725 default:
4726 break;
4727 }
Jerry Yuc5aef882021-12-23 20:15:02 +08004728 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004729}
XiaokangQian647719a2021-12-07 09:16:29 +00004730
Jerry Yu148165c2021-09-24 23:20:59 +08004731#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08004732
Jerry Yudc7bd172022-02-17 13:44:15 +08004733#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4734
4735#if defined(MBEDTLS_USE_PSA_CRYPTO)
4736
4737static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
4738 mbedtls_svc_key_id_t key,
4739 psa_algorithm_t alg,
4740 const unsigned char* seed, size_t seed_length,
4741 const unsigned char* label, size_t label_length,
4742 size_t capacity )
4743{
4744 psa_status_t status;
4745
4746 status = psa_key_derivation_setup( derivation, alg );
4747 if( status != PSA_SUCCESS )
4748 return( status );
4749
4750 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
4751 {
4752 status = psa_key_derivation_input_bytes( derivation,
4753 PSA_KEY_DERIVATION_INPUT_SEED,
4754 seed, seed_length );
4755 if( status != PSA_SUCCESS )
4756 return( status );
4757
4758 if( mbedtls_svc_key_id_is_null( key ) )
4759 {
4760 status = psa_key_derivation_input_bytes(
4761 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
4762 NULL, 0 );
4763 }
4764 else
4765 {
4766 status = psa_key_derivation_input_key(
4767 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
4768 }
4769 if( status != PSA_SUCCESS )
4770 return( status );
4771
4772 status = psa_key_derivation_input_bytes( derivation,
4773 PSA_KEY_DERIVATION_INPUT_LABEL,
4774 label, label_length );
4775 if( status != PSA_SUCCESS )
4776 return( status );
4777 }
4778 else
4779 {
4780 return( PSA_ERROR_NOT_SUPPORTED );
4781 }
4782
4783 status = psa_key_derivation_set_capacity( derivation, capacity );
4784 if( status != PSA_SUCCESS )
4785 return( status );
4786
4787 return( PSA_SUCCESS );
4788}
4789
4790static int tls_prf_generic( mbedtls_md_type_t md_type,
4791 const unsigned char *secret, size_t slen,
4792 const char *label,
4793 const unsigned char *random, size_t rlen,
4794 unsigned char *dstbuf, size_t dlen )
4795{
4796 psa_status_t status;
4797 psa_algorithm_t alg;
4798 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
4799 psa_key_derivation_operation_t derivation =
4800 PSA_KEY_DERIVATION_OPERATION_INIT;
4801
4802 if( md_type == MBEDTLS_MD_SHA384 )
4803 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
4804 else
4805 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
4806
4807 /* Normally a "secret" should be long enough to be impossible to
4808 * find by brute force, and in particular should not be empty. But
4809 * this PRF is also used to derive an IV, in particular in EAP-TLS,
4810 * and for this use case it makes sense to have a 0-length "secret".
4811 * Since the key API doesn't allow importing a key of length 0,
4812 * keep master_key=0, which setup_psa_key_derivation() understands
4813 * to mean a 0-length "secret" input. */
4814 if( slen != 0 )
4815 {
4816 psa_key_attributes_t key_attributes = psa_key_attributes_init();
4817 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
4818 psa_set_key_algorithm( &key_attributes, alg );
4819 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
4820
4821 status = psa_import_key( &key_attributes, secret, slen, &master_key );
4822 if( status != PSA_SUCCESS )
4823 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4824 }
4825
4826 status = setup_psa_key_derivation( &derivation,
4827 master_key, alg,
4828 random, rlen,
4829 (unsigned char const *) label,
4830 (size_t) strlen( label ),
4831 dlen );
4832 if( status != PSA_SUCCESS )
4833 {
4834 psa_key_derivation_abort( &derivation );
4835 psa_destroy_key( master_key );
4836 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4837 }
4838
4839 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
4840 if( status != PSA_SUCCESS )
4841 {
4842 psa_key_derivation_abort( &derivation );
4843 psa_destroy_key( master_key );
4844 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4845 }
4846
4847 status = psa_key_derivation_abort( &derivation );
4848 if( status != PSA_SUCCESS )
4849 {
4850 psa_destroy_key( master_key );
4851 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4852 }
4853
4854 if( ! mbedtls_svc_key_id_is_null( master_key ) )
4855 status = psa_destroy_key( master_key );
4856 if( status != PSA_SUCCESS )
4857 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4858
4859 return( 0 );
4860}
4861
4862#else /* MBEDTLS_USE_PSA_CRYPTO */
4863
4864static int tls_prf_generic( mbedtls_md_type_t md_type,
4865 const unsigned char *secret, size_t slen,
4866 const char *label,
4867 const unsigned char *random, size_t rlen,
4868 unsigned char *dstbuf, size_t dlen )
4869{
4870 size_t nb;
4871 size_t i, j, k, md_len;
4872 unsigned char *tmp;
4873 size_t tmp_len = 0;
4874 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
4875 const mbedtls_md_info_t *md_info;
4876 mbedtls_md_context_t md_ctx;
4877 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4878
4879 mbedtls_md_init( &md_ctx );
4880
4881 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
4882 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4883
4884 md_len = mbedtls_md_get_size( md_info );
4885
4886 tmp_len = md_len + strlen( label ) + rlen;
4887 tmp = mbedtls_calloc( 1, tmp_len );
4888 if( tmp == NULL )
4889 {
4890 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
4891 goto exit;
4892 }
4893
4894 nb = strlen( label );
4895 memcpy( tmp + md_len, label, nb );
4896 memcpy( tmp + md_len + nb, random, rlen );
4897 nb += rlen;
4898
4899 /*
4900 * Compute P_<hash>(secret, label + random)[0..dlen]
4901 */
4902 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
4903 goto exit;
4904
4905 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
4906 if( ret != 0 )
4907 goto exit;
4908 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
4909 if( ret != 0 )
4910 goto exit;
4911 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
4912 if( ret != 0 )
4913 goto exit;
4914
4915 for( i = 0; i < dlen; i += md_len )
4916 {
4917 ret = mbedtls_md_hmac_reset ( &md_ctx );
4918 if( ret != 0 )
4919 goto exit;
4920 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
4921 if( ret != 0 )
4922 goto exit;
4923 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
4924 if( ret != 0 )
4925 goto exit;
4926
4927 ret = mbedtls_md_hmac_reset ( &md_ctx );
4928 if( ret != 0 )
4929 goto exit;
4930 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
4931 if( ret != 0 )
4932 goto exit;
4933 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
4934 if( ret != 0 )
4935 goto exit;
4936
4937 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
4938
4939 for( j = 0; j < k; j++ )
4940 dstbuf[i + j] = h_i[j];
4941 }
4942
4943exit:
4944 mbedtls_md_free( &md_ctx );
4945
4946 mbedtls_platform_zeroize( tmp, tmp_len );
4947 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
4948
4949 mbedtls_free( tmp );
4950
4951 return( ret );
4952}
4953#endif /* MBEDTLS_USE_PSA_CRYPTO */
4954
4955#if defined(MBEDTLS_SHA256_C)
4956static int tls_prf_sha256( const unsigned char *secret, size_t slen,
4957 const char *label,
4958 const unsigned char *random, size_t rlen,
4959 unsigned char *dstbuf, size_t dlen )
4960{
4961 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
4962 label, random, rlen, dstbuf, dlen ) );
4963}
4964#endif /* MBEDTLS_SHA256_C */
4965
4966#if defined(MBEDTLS_SHA384_C)
4967static int tls_prf_sha384( const unsigned char *secret, size_t slen,
4968 const char *label,
4969 const unsigned char *random, size_t rlen,
4970 unsigned char *dstbuf, size_t dlen )
4971{
4972 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
4973 label, random, rlen, dstbuf, dlen ) );
4974}
4975#endif /* MBEDTLS_SHA384_C */
4976
Jerry Yuf009d862022-02-17 14:01:37 +08004977/*
4978 * Set appropriate PRF function and other SSL / TLS1.2 functions
4979 *
4980 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08004981 * - hash associated with the ciphersuite (only used by TLS 1.2)
4982 *
4983 * Outputs:
4984 * - the tls_prf, calc_verify and calc_finished members of handshake structure
4985 */
4986static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
Jerry Yuf009d862022-02-17 14:01:37 +08004987 mbedtls_md_type_t hash )
4988{
Jerry Yuf009d862022-02-17 14:01:37 +08004989#if defined(MBEDTLS_SHA384_C)
Ronald Cron81591aa2022-03-07 09:05:51 +01004990 if( hash == MBEDTLS_MD_SHA384 )
Jerry Yuf009d862022-02-17 14:01:37 +08004991 {
4992 handshake->tls_prf = tls_prf_sha384;
4993 handshake->calc_verify = ssl_calc_verify_tls_sha384;
4994 handshake->calc_finished = ssl_calc_finished_tls_sha384;
4995 }
4996 else
4997#endif
4998#if defined(MBEDTLS_SHA256_C)
Jerry Yuf009d862022-02-17 14:01:37 +08004999 {
Ronald Cron81591aa2022-03-07 09:05:51 +01005000 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005001 handshake->tls_prf = tls_prf_sha256;
5002 handshake->calc_verify = ssl_calc_verify_tls_sha256;
5003 handshake->calc_finished = ssl_calc_finished_tls_sha256;
5004 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005005#else
Jerry Yuf009d862022-02-17 14:01:37 +08005006 {
Jerry Yuf009d862022-02-17 14:01:37 +08005007 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01005008 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005009 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5010 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005011#endif
Jerry Yuf009d862022-02-17 14:01:37 +08005012
5013 return( 0 );
5014}
Jerry Yud6ab2352022-02-17 14:03:43 +08005015
5016#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \
5017 defined(MBEDTLS_USE_PSA_CRYPTO)
5018static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
5019{
5020 if( ssl->conf->f_psk != NULL )
5021 {
5022 /* If we've used a callback to select the PSK,
5023 * the static configuration is irrelevant. */
5024 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
5025 return( 1 );
5026
5027 return( 0 );
5028 }
5029
5030 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
5031 return( 1 );
5032
5033 return( 0 );
5034}
5035#endif /* MBEDTLS_USE_PSA_CRYPTO &&
5036 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
5037
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005038/*
5039 * Compute master secret if needed
5040 *
5041 * Parameters:
5042 * [in/out] handshake
5043 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
5044 * (PSA-PSK) ciphersuite_info, psk_opaque
5045 * [out] premaster (cleared)
5046 * [out] master
5047 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
5048 * debug: conf->f_dbg, conf->p_dbg
5049 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01005050 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005051 */
5052static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
5053 unsigned char *master,
5054 const mbedtls_ssl_context *ssl )
5055{
5056 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5057
5058 /* cf. RFC 5246, Section 8.1:
5059 * "The master secret is always exactly 48 bytes in length." */
5060 size_t const master_secret_len = 48;
5061
5062#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5063 unsigned char session_hash[48];
5064#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
5065
5066 /* The label for the KDF used for key expansion.
5067 * This is either "master secret" or "extended master secret"
5068 * depending on whether the Extended Master Secret extension
5069 * is used. */
5070 char const *lbl = "master secret";
5071
5072 /* The salt for the KDF used for key expansion.
5073 * - If the Extended Master Secret extension is not used,
5074 * this is ClientHello.Random + ServerHello.Random
5075 * (see Sect. 8.1 in RFC 5246).
5076 * - If the Extended Master Secret extension is used,
5077 * this is the transcript of the handshake so far.
5078 * (see Sect. 4 in RFC 7627). */
5079 unsigned char const *salt = handshake->randbytes;
5080 size_t salt_len = 64;
5081
5082#if !defined(MBEDTLS_DEBUG_C) && \
5083 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
5084 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
5085 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
5086 ssl = NULL; /* make sure we don't use it except for those cases */
5087 (void) ssl;
5088#endif
5089
5090 if( handshake->resume != 0 )
5091 {
5092 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
5093 return( 0 );
5094 }
5095
5096#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5097 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
5098 {
5099 lbl = "extended master secret";
5100 salt = session_hash;
5101 handshake->calc_verify( ssl, session_hash, &salt_len );
5102
5103 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
5104 session_hash, salt_len );
5105 }
5106#endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */
5107
5108#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
5109 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
5110 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005111 ssl_use_opaque_psk( ssl ) == 1 )
5112 {
5113 /* Perform PSK-to-MS expansion in a single step. */
5114 psa_status_t status;
5115 psa_algorithm_t alg;
5116 mbedtls_svc_key_id_t psk;
5117 psa_key_derivation_operation_t derivation =
5118 PSA_KEY_DERIVATION_OPERATION_INIT;
5119 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
5120
5121 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
5122
5123 psk = mbedtls_ssl_get_opaque_psk( ssl );
5124
5125 if( hash_alg == MBEDTLS_MD_SHA384 )
5126 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
5127 else
5128 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
5129
5130 status = setup_psa_key_derivation( &derivation, psk, alg,
5131 salt, salt_len,
5132 (unsigned char const *) lbl,
5133 (size_t) strlen( lbl ),
5134 master_secret_len );
5135 if( status != PSA_SUCCESS )
5136 {
5137 psa_key_derivation_abort( &derivation );
5138 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5139 }
5140
5141 status = psa_key_derivation_output_bytes( &derivation,
5142 master,
5143 master_secret_len );
5144 if( status != PSA_SUCCESS )
5145 {
5146 psa_key_derivation_abort( &derivation );
5147 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5148 }
5149
5150 status = psa_key_derivation_abort( &derivation );
5151 if( status != PSA_SUCCESS )
5152 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5153 }
5154 else
5155#endif
5156 {
5157 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
5158 lbl, salt, salt_len,
5159 master,
5160 master_secret_len );
5161 if( ret != 0 )
5162 {
5163 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
5164 return( ret );
5165 }
5166
5167 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
5168 handshake->premaster,
5169 handshake->pmslen );
5170
5171 mbedtls_platform_zeroize( handshake->premaster,
5172 sizeof(handshake->premaster) );
5173 }
5174
5175 return( 0 );
5176}
5177
Jerry Yud62f87e2022-02-17 14:09:02 +08005178int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
5179{
5180 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5181 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5182 ssl->handshake->ciphersuite_info;
5183
5184 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
5185
5186 /* Set PRF, calc_verify and calc_finished function pointers */
5187 ret = ssl_set_handshake_prfs( ssl->handshake,
Jerry Yud62f87e2022-02-17 14:09:02 +08005188 ciphersuite_info->mac );
5189 if( ret != 0 )
5190 {
5191 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
5192 return( ret );
5193 }
5194
5195 /* Compute master secret if needed */
5196 ret = ssl_compute_master( ssl->handshake,
5197 ssl->session_negotiate->master,
5198 ssl );
5199 if( ret != 0 )
5200 {
5201 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
5202 return( ret );
5203 }
5204
5205 /* Swap the client and server random values:
5206 * - MS derivation wanted client+server (RFC 5246 8.1)
5207 * - key derivation wants server+client (RFC 5246 6.3) */
5208 {
5209 unsigned char tmp[64];
5210 memcpy( tmp, ssl->handshake->randbytes, 64 );
5211 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
5212 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
5213 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
5214 }
5215
5216 /* Populate transform structure */
5217 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
5218 ssl->session_negotiate->ciphersuite,
5219 ssl->session_negotiate->master,
5220#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
5221 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5222 ssl->session_negotiate->encrypt_then_mac,
5223#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
5224 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
5225 ssl->handshake->tls_prf,
5226 ssl->handshake->randbytes,
5227 ssl->minor_ver,
5228 ssl->conf->endpoint,
5229 ssl );
5230 if( ret != 0 )
5231 {
5232 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
5233 return( ret );
5234 }
5235
5236 /* We no longer need Server/ClientHello.random values */
5237 mbedtls_platform_zeroize( ssl->handshake->randbytes,
5238 sizeof( ssl->handshake->randbytes ) );
5239
5240 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
5241
5242 return( 0 );
5243}
Jerry Yu8392e0d2022-02-17 14:10:24 +08005244
Ronald Cron4dcbca92022-03-07 10:21:40 +01005245int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
5246{
Ronald Cron4dcbca92022-03-07 10:21:40 +01005247 switch( md )
5248 {
5249#if defined(MBEDTLS_SHA384_C)
5250 case MBEDTLS_SSL_HASH_SHA384:
5251 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
5252 break;
5253#endif
5254#if defined(MBEDTLS_SHA256_C)
5255 case MBEDTLS_SSL_HASH_SHA256:
5256 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
5257 break;
5258#endif
5259 default:
5260 return( -1 );
5261 }
5262
Ronald Cronc2f13a02022-03-07 10:25:24 +01005263 return( 0 );
Ronald Cron4dcbca92022-03-07 10:21:40 +01005264}
5265
Jerry Yu8392e0d2022-02-17 14:10:24 +08005266#if defined(MBEDTLS_SHA256_C)
5267void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
5268 unsigned char *hash,
5269 size_t *hlen )
5270{
5271#if defined(MBEDTLS_USE_PSA_CRYPTO)
5272 size_t hash_size;
5273 psa_status_t status;
5274 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
5275
5276 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
5277 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
5278 if( status != PSA_SUCCESS )
5279 {
5280 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5281 return;
5282 }
5283
5284 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
5285 if( status != PSA_SUCCESS )
5286 {
5287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5288 return;
5289 }
5290
5291 *hlen = 32;
5292 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5293 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5294#else
5295 mbedtls_sha256_context sha256;
5296
5297 mbedtls_sha256_init( &sha256 );
5298
5299 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
5300
5301 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
5302 mbedtls_sha256_finish( &sha256, hash );
5303
5304 *hlen = 32;
5305
5306 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
5307 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
5308
5309 mbedtls_sha256_free( &sha256 );
5310#endif /* MBEDTLS_USE_PSA_CRYPTO */
5311 return;
5312}
5313#endif /* MBEDTLS_SHA256_C */
5314
Jerry Yuc1cb3842022-02-17 14:13:48 +08005315#if defined(MBEDTLS_SHA384_C)
5316void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
5317 unsigned char *hash,
5318 size_t *hlen )
5319{
5320#if defined(MBEDTLS_USE_PSA_CRYPTO)
5321 size_t hash_size;
5322 psa_status_t status;
5323 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
5324
5325 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
5326 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
5327 if( status != PSA_SUCCESS )
5328 {
5329 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5330 return;
5331 }
5332
5333 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
5334 if( status != PSA_SUCCESS )
5335 {
5336 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5337 return;
5338 }
5339
5340 *hlen = 48;
5341 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5342 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5343#else
5344 mbedtls_sha512_context sha512;
5345
5346 mbedtls_sha512_init( &sha512 );
5347
5348 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
5349
5350 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
5351 mbedtls_sha512_finish( &sha512, hash );
5352
5353 *hlen = 48;
5354
5355 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
5356 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
5357
5358 mbedtls_sha512_free( &sha512 );
5359#endif /* MBEDTLS_USE_PSA_CRYPTO */
5360 return;
5361}
5362#endif /* MBEDTLS_SHA384_C */
5363
Jerry Yuce3dca42022-02-17 14:16:37 +08005364#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
5365int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
5366{
5367 unsigned char *p = ssl->handshake->premaster;
5368 unsigned char *end = p + sizeof( ssl->handshake->premaster );
5369 const unsigned char *psk = NULL;
5370 size_t psk_len = 0;
5371
5372 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
5373 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
5374 {
5375 /*
5376 * This should never happen because the existence of a PSK is always
5377 * checked before calling this function
5378 */
5379 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5380 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5381 }
5382
5383 /*
5384 * PMS = struct {
5385 * opaque other_secret<0..2^16-1>;
5386 * opaque psk<0..2^16-1>;
5387 * };
5388 * with "other_secret" depending on the particular key exchange
5389 */
5390#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
5391 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
5392 {
5393 if( end - p < 2 )
5394 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5395
5396 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
5397 p += 2;
5398
5399 if( end < p || (size_t)( end - p ) < psk_len )
5400 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5401
5402 memset( p, 0, psk_len );
5403 p += psk_len;
5404 }
5405 else
5406#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
5407#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
5408 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
5409 {
5410 /*
5411 * other_secret already set by the ClientKeyExchange message,
5412 * and is 48 bytes long
5413 */
5414 if( end - p < 2 )
5415 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5416
5417 *p++ = 0;
5418 *p++ = 48;
5419 p += 48;
5420 }
5421 else
5422#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
5423#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
5424 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
5425 {
5426 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5427 size_t len;
5428
5429 /* Write length only when we know the actual value */
5430 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
5431 p + 2, end - ( p + 2 ), &len,
5432 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
5433 {
5434 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
5435 return( ret );
5436 }
5437 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
5438 p += 2 + len;
5439
5440 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
5441 }
5442 else
5443#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
5444#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
5445 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
5446 {
5447 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5448 size_t zlen;
5449
5450 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
5451 p + 2, end - ( p + 2 ),
5452 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
5453 {
5454 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
5455 return( ret );
5456 }
5457
5458 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
5459 p += 2 + zlen;
5460
5461 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
5462 MBEDTLS_DEBUG_ECDH_Z );
5463 }
5464 else
5465#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
5466 {
5467 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5468 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5469 }
5470
5471 /* opaque psk<0..2^16-1>; */
5472 if( end - p < 2 )
5473 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5474
5475 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
5476 p += 2;
5477
5478 if( end < p || (size_t)( end - p ) < psk_len )
5479 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5480
5481 memcpy( p, psk, psk_len );
5482 p += psk_len;
5483
5484 ssl->handshake->pmslen = p - ssl->handshake->premaster;
5485
5486 return( 0 );
5487}
5488#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08005489
5490#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
5491static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
5492
5493#if defined(MBEDTLS_SSL_PROTO_DTLS)
5494int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
5495{
5496 /* If renegotiation is not enforced, retransmit until we would reach max
5497 * timeout if we were using the usual handshake doubling scheme */
5498 if( ssl->conf->renego_max_records < 0 )
5499 {
5500 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
5501 unsigned char doublings = 1;
5502
5503 while( ratio != 0 )
5504 {
5505 ++doublings;
5506 ratio >>= 1;
5507 }
5508
5509 if( ++ssl->renego_records_seen > doublings )
5510 {
5511 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
5512 return( 0 );
5513 }
5514 }
5515
5516 return( ssl_write_hello_request( ssl ) );
5517}
5518#endif
5519#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08005520
Jerry Yud9526692022-02-17 14:23:47 +08005521/*
5522 * Handshake functions
5523 */
5524#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
5525/* No certificate support -> dummy functions */
5526int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
5527{
5528 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5529 ssl->handshake->ciphersuite_info;
5530
5531 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
5532
5533 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5534 {
5535 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5536 ssl->state++;
5537 return( 0 );
5538 }
5539
5540 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5541 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5542}
5543
5544int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
5545{
5546 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5547 ssl->handshake->ciphersuite_info;
5548
5549 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
5550
5551 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5552 {
5553 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5554 ssl->state++;
5555 return( 0 );
5556 }
5557
5558 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5559 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5560}
5561
5562#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
5563/* Some certificate support -> implement write and parse */
5564
5565int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
5566{
5567 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5568 size_t i, n;
5569 const mbedtls_x509_crt *crt;
5570 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5571 ssl->handshake->ciphersuite_info;
5572
5573 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
5574
5575 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5576 {
5577 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5578 ssl->state++;
5579 return( 0 );
5580 }
5581
5582#if defined(MBEDTLS_SSL_CLI_C)
5583 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5584 {
5585 if( ssl->handshake->client_auth == 0 )
5586 {
5587 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5588 ssl->state++;
5589 return( 0 );
5590 }
5591 }
5592#endif /* MBEDTLS_SSL_CLI_C */
5593#if defined(MBEDTLS_SSL_SRV_C)
5594 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5595 {
5596 if( mbedtls_ssl_own_cert( ssl ) == NULL )
5597 {
5598 /* Should never happen because we shouldn't have picked the
5599 * ciphersuite if we don't have a certificate. */
5600 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5601 }
5602 }
5603#endif
5604
5605 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
5606
5607 /*
5608 * 0 . 0 handshake type
5609 * 1 . 3 handshake length
5610 * 4 . 6 length of all certs
5611 * 7 . 9 length of cert. 1
5612 * 10 . n-1 peer certificate
5613 * n . n+2 length of cert. 2
5614 * n+3 . ... upper level cert, etc.
5615 */
5616 i = 7;
5617 crt = mbedtls_ssl_own_cert( ssl );
5618
5619 while( crt != NULL )
5620 {
5621 n = crt->raw.len;
5622 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
5623 {
5624 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
5625 " > %" MBEDTLS_PRINTF_SIZET,
5626 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
5627 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5628 }
5629
5630 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
5631 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
5632 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
5633
5634 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
5635 i += n; crt = crt->next;
5636 }
5637
5638 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
5639 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
5640 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
5641
5642 ssl->out_msglen = i;
5643 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5644 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
5645
5646 ssl->state++;
5647
5648 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
5649 {
5650 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
5651 return( ret );
5652 }
5653
5654 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
5655
5656 return( ret );
5657}
5658
5659#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
5660
5661#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5662static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
5663 unsigned char *crt_buf,
5664 size_t crt_buf_len )
5665{
5666 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
5667
5668 if( peer_crt == NULL )
5669 return( -1 );
5670
5671 if( peer_crt->raw.len != crt_buf_len )
5672 return( -1 );
5673
5674 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
5675}
5676#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5677static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
5678 unsigned char *crt_buf,
5679 size_t crt_buf_len )
5680{
5681 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5682 unsigned char const * const peer_cert_digest =
5683 ssl->session->peer_cert_digest;
5684 mbedtls_md_type_t const peer_cert_digest_type =
5685 ssl->session->peer_cert_digest_type;
5686 mbedtls_md_info_t const * const digest_info =
5687 mbedtls_md_info_from_type( peer_cert_digest_type );
5688 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
5689 size_t digest_len;
5690
5691 if( peer_cert_digest == NULL || digest_info == NULL )
5692 return( -1 );
5693
5694 digest_len = mbedtls_md_get_size( digest_info );
5695 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
5696 return( -1 );
5697
5698 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
5699 if( ret != 0 )
5700 return( -1 );
5701
5702 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
5703}
5704#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5705#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
5706
5707/*
5708 * Once the certificate message is read, parse it into a cert chain and
5709 * perform basic checks, but leave actual verification to the caller
5710 */
5711static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
5712 mbedtls_x509_crt *chain )
5713{
5714 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5715#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
5716 int crt_cnt=0;
5717#endif
5718 size_t i, n;
5719 uint8_t alert;
5720
5721 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
5722 {
5723 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5724 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5725 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
5726 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
5727 }
5728
5729 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
5730 {
5731 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5732 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
5733 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
5734 }
5735
5736 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
5737 {
5738 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5739 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5740 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5741 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5742 }
5743
5744 i = mbedtls_ssl_hs_hdr_len( ssl );
5745
5746 /*
5747 * Same message structure as in mbedtls_ssl_write_certificate()
5748 */
5749 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
5750
5751 if( ssl->in_msg[i] != 0 ||
5752 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
5753 {
5754 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5755 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5756 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5757 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5758 }
5759
5760 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
5761 i += 3;
5762
5763 /* Iterate through and parse the CRTs in the provided chain. */
5764 while( i < ssl->in_hslen )
5765 {
5766 /* Check that there's room for the next CRT's length fields. */
5767 if ( i + 3 > ssl->in_hslen ) {
5768 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5769 mbedtls_ssl_send_alert_message( ssl,
5770 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5771 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5772 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5773 }
5774 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
5775 * anything beyond 2**16 ~ 64K. */
5776 if( ssl->in_msg[i] != 0 )
5777 {
5778 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5779 mbedtls_ssl_send_alert_message( ssl,
5780 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5781 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
5782 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
5783 }
5784
5785 /* Read length of the next CRT in the chain. */
5786 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
5787 | (unsigned int) ssl->in_msg[i + 2];
5788 i += 3;
5789
5790 if( n < 128 || i + n > ssl->in_hslen )
5791 {
5792 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5793 mbedtls_ssl_send_alert_message( ssl,
5794 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5795 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5796 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5797 }
5798
5799 /* Check if we're handling the first CRT in the chain. */
5800#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
5801 if( crt_cnt++ == 0 &&
5802 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
5803 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
5804 {
5805 /* During client-side renegotiation, check that the server's
5806 * end-CRTs hasn't changed compared to the initial handshake,
5807 * mitigating the triple handshake attack. On success, reuse
5808 * the original end-CRT instead of parsing it again. */
5809 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
5810 if( ssl_check_peer_crt_unchanged( ssl,
5811 &ssl->in_msg[i],
5812 n ) != 0 )
5813 {
5814 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
5815 mbedtls_ssl_send_alert_message( ssl,
5816 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5817 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
5818 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
5819 }
5820
5821 /* Now we can safely free the original chain. */
5822 ssl_clear_peer_cert( ssl->session );
5823 }
5824#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
5825
5826 /* Parse the next certificate in the chain. */
5827#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5828 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
5829#else
5830 /* If we don't need to store the CRT chain permanently, parse
5831 * it in-place from the input buffer instead of making a copy. */
5832 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
5833#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5834 switch( ret )
5835 {
5836 case 0: /*ok*/
5837 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
5838 /* Ignore certificate with an unknown algorithm: maybe a
5839 prior certificate was already trusted. */
5840 break;
5841
5842 case MBEDTLS_ERR_X509_ALLOC_FAILED:
5843 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
5844 goto crt_parse_der_failed;
5845
5846 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
5847 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
5848 goto crt_parse_der_failed;
5849
5850 default:
5851 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
5852 crt_parse_der_failed:
5853 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
5854 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
5855 return( ret );
5856 }
5857
5858 i += n;
5859 }
5860
5861 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
5862 return( 0 );
5863}
5864
5865#if defined(MBEDTLS_SSL_SRV_C)
5866static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
5867{
5868 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5869 return( -1 );
5870
5871 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
5872 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
5873 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
5874 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
5875 {
5876 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
5877 return( 0 );
5878 }
5879 return( -1 );
5880}
5881#endif /* MBEDTLS_SSL_SRV_C */
5882
5883/* Check if a certificate message is expected.
5884 * Return either
5885 * - SSL_CERTIFICATE_EXPECTED, or
5886 * - SSL_CERTIFICATE_SKIP
5887 * indicating whether a Certificate message is expected or not.
5888 */
5889#define SSL_CERTIFICATE_EXPECTED 0
5890#define SSL_CERTIFICATE_SKIP 1
5891static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
5892 int authmode )
5893{
5894 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5895 ssl->handshake->ciphersuite_info;
5896
5897 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5898 return( SSL_CERTIFICATE_SKIP );
5899
5900#if defined(MBEDTLS_SSL_SRV_C)
5901 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5902 {
5903 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
5904 return( SSL_CERTIFICATE_SKIP );
5905
5906 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
5907 {
5908 ssl->session_negotiate->verify_result =
5909 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
5910 return( SSL_CERTIFICATE_SKIP );
5911 }
5912 }
5913#else
5914 ((void) authmode);
5915#endif /* MBEDTLS_SSL_SRV_C */
5916
5917 return( SSL_CERTIFICATE_EXPECTED );
5918}
5919
5920static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
5921 int authmode,
5922 mbedtls_x509_crt *chain,
5923 void *rs_ctx )
5924{
5925 int ret = 0;
5926 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5927 ssl->handshake->ciphersuite_info;
5928 int have_ca_chain = 0;
5929
5930 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
5931 void *p_vrfy;
5932
5933 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
5934 return( 0 );
5935
5936 if( ssl->f_vrfy != NULL )
5937 {
5938 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
5939 f_vrfy = ssl->f_vrfy;
5940 p_vrfy = ssl->p_vrfy;
5941 }
5942 else
5943 {
5944 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
5945 f_vrfy = ssl->conf->f_vrfy;
5946 p_vrfy = ssl->conf->p_vrfy;
5947 }
5948
5949 /*
5950 * Main check: verify certificate
5951 */
5952#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
5953 if( ssl->conf->f_ca_cb != NULL )
5954 {
5955 ((void) rs_ctx);
5956 have_ca_chain = 1;
5957
5958 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
5959 ret = mbedtls_x509_crt_verify_with_ca_cb(
5960 chain,
5961 ssl->conf->f_ca_cb,
5962 ssl->conf->p_ca_cb,
5963 ssl->conf->cert_profile,
5964 ssl->hostname,
5965 &ssl->session_negotiate->verify_result,
5966 f_vrfy, p_vrfy );
5967 }
5968 else
5969#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
5970 {
5971 mbedtls_x509_crt *ca_chain;
5972 mbedtls_x509_crl *ca_crl;
5973
5974#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
5975 if( ssl->handshake->sni_ca_chain != NULL )
5976 {
5977 ca_chain = ssl->handshake->sni_ca_chain;
5978 ca_crl = ssl->handshake->sni_ca_crl;
5979 }
5980 else
5981#endif
5982 {
5983 ca_chain = ssl->conf->ca_chain;
5984 ca_crl = ssl->conf->ca_crl;
5985 }
5986
5987 if( ca_chain != NULL )
5988 have_ca_chain = 1;
5989
5990 ret = mbedtls_x509_crt_verify_restartable(
5991 chain,
5992 ca_chain, ca_crl,
5993 ssl->conf->cert_profile,
5994 ssl->hostname,
5995 &ssl->session_negotiate->verify_result,
5996 f_vrfy, p_vrfy, rs_ctx );
5997 }
5998
5999 if( ret != 0 )
6000 {
6001 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
6002 }
6003
6004#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6005 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
6006 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
6007#endif
6008
6009 /*
6010 * Secondary checks: always done, but change 'ret' only if it was 0
6011 */
6012
6013#if defined(MBEDTLS_ECP_C)
6014 {
6015 const mbedtls_pk_context *pk = &chain->pk;
6016
6017 /* If certificate uses an EC key, make sure the curve is OK */
6018 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
6019 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
6020 {
6021 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
6022
6023 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
6024 if( ret == 0 )
6025 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6026 }
6027 }
6028#endif /* MBEDTLS_ECP_C */
6029
6030 if( mbedtls_ssl_check_cert_usage( chain,
6031 ciphersuite_info,
6032 ! ssl->conf->endpoint,
6033 &ssl->session_negotiate->verify_result ) != 0 )
6034 {
6035 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
6036 if( ret == 0 )
6037 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6038 }
6039
6040 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
6041 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
6042 * with details encoded in the verification flags. All other kinds
6043 * of error codes, including those from the user provided f_vrfy
6044 * functions, are treated as fatal and lead to a failure of
6045 * ssl_parse_certificate even if verification was optional. */
6046 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
6047 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
6048 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
6049 {
6050 ret = 0;
6051 }
6052
6053 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
6054 {
6055 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
6056 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
6057 }
6058
6059 if( ret != 0 )
6060 {
6061 uint8_t alert;
6062
6063 /* The certificate may have been rejected for several reasons.
6064 Pick one and send the corresponding alert. Which alert to send
6065 may be a subject of debate in some cases. */
6066 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
6067 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
6068 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
6069 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6070 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
6071 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6072 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
6073 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6074 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
6075 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6076 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
6077 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6078 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
6079 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6080 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
6081 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
6082 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
6083 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
6084 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
6085 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
6086 else
6087 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
6088 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6089 alert );
6090 }
6091
6092#if defined(MBEDTLS_DEBUG_C)
6093 if( ssl->session_negotiate->verify_result != 0 )
6094 {
6095 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
6096 (unsigned int) ssl->session_negotiate->verify_result ) );
6097 }
6098 else
6099 {
6100 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
6101 }
6102#endif /* MBEDTLS_DEBUG_C */
6103
6104 return( ret );
6105}
6106
6107#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6108static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
6109 unsigned char *start, size_t len )
6110{
6111 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6112 /* Remember digest of the peer's end-CRT. */
6113 ssl->session_negotiate->peer_cert_digest =
6114 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
6115 if( ssl->session_negotiate->peer_cert_digest == NULL )
6116 {
6117 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
6118 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
6119 mbedtls_ssl_send_alert_message( ssl,
6120 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6121 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6122
6123 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
6124 }
6125
6126 ret = mbedtls_md( mbedtls_md_info_from_type(
6127 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
6128 start, len,
6129 ssl->session_negotiate->peer_cert_digest );
6130
6131 ssl->session_negotiate->peer_cert_digest_type =
6132 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
6133 ssl->session_negotiate->peer_cert_digest_len =
6134 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
6135
6136 return( ret );
6137}
6138
6139static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
6140 unsigned char *start, size_t len )
6141{
6142 unsigned char *end = start + len;
6143 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6144
6145 /* Make a copy of the peer's raw public key. */
6146 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
6147 ret = mbedtls_pk_parse_subpubkey( &start, end,
6148 &ssl->handshake->peer_pubkey );
6149 if( ret != 0 )
6150 {
6151 /* We should have parsed the public key before. */
6152 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6153 }
6154
6155 return( 0 );
6156}
6157#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6158
6159int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6160{
6161 int ret = 0;
6162 int crt_expected;
6163#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6164 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
6165 ? ssl->handshake->sni_authmode
6166 : ssl->conf->authmode;
6167#else
6168 const int authmode = ssl->conf->authmode;
6169#endif
6170 void *rs_ctx = NULL;
6171 mbedtls_x509_crt *chain = NULL;
6172
6173 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6174
6175 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
6176 if( crt_expected == SSL_CERTIFICATE_SKIP )
6177 {
6178 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6179 goto exit;
6180 }
6181
6182#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6183 if( ssl->handshake->ecrs_enabled &&
6184 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
6185 {
6186 chain = ssl->handshake->ecrs_peer_cert;
6187 ssl->handshake->ecrs_peer_cert = NULL;
6188 goto crt_verify;
6189 }
6190#endif
6191
6192 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
6193 {
6194 /* mbedtls_ssl_read_record may have sent an alert already. We
6195 let it decide whether to alert. */
6196 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6197 goto exit;
6198 }
6199
6200#if defined(MBEDTLS_SSL_SRV_C)
6201 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
6202 {
6203 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
6204
6205 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
6206 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
6207
6208 goto exit;
6209 }
6210#endif /* MBEDTLS_SSL_SRV_C */
6211
6212 /* Clear existing peer CRT structure in case we tried to
6213 * reuse a session but it failed, and allocate a new one. */
6214 ssl_clear_peer_cert( ssl->session_negotiate );
6215
6216 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
6217 if( chain == NULL )
6218 {
6219 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
6220 sizeof( mbedtls_x509_crt ) ) );
6221 mbedtls_ssl_send_alert_message( ssl,
6222 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6223 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6224
6225 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
6226 goto exit;
6227 }
6228 mbedtls_x509_crt_init( chain );
6229
6230 ret = ssl_parse_certificate_chain( ssl, chain );
6231 if( ret != 0 )
6232 goto exit;
6233
6234#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6235 if( ssl->handshake->ecrs_enabled)
6236 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
6237
6238crt_verify:
6239 if( ssl->handshake->ecrs_enabled)
6240 rs_ctx = &ssl->handshake->ecrs_ctx;
6241#endif
6242
6243 ret = ssl_parse_certificate_verify( ssl, authmode,
6244 chain, rs_ctx );
6245 if( ret != 0 )
6246 goto exit;
6247
6248#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6249 {
6250 unsigned char *crt_start, *pk_start;
6251 size_t crt_len, pk_len;
6252
6253 /* We parse the CRT chain without copying, so
6254 * these pointers point into the input buffer,
6255 * and are hence still valid after freeing the
6256 * CRT chain. */
6257
6258 crt_start = chain->raw.p;
6259 crt_len = chain->raw.len;
6260
6261 pk_start = chain->pk_raw.p;
6262 pk_len = chain->pk_raw.len;
6263
6264 /* Free the CRT structures before computing
6265 * digest and copying the peer's public key. */
6266 mbedtls_x509_crt_free( chain );
6267 mbedtls_free( chain );
6268 chain = NULL;
6269
6270 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
6271 if( ret != 0 )
6272 goto exit;
6273
6274 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
6275 if( ret != 0 )
6276 goto exit;
6277 }
6278#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6279 /* Pass ownership to session structure. */
6280 ssl->session_negotiate->peer_cert = chain;
6281 chain = NULL;
6282#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6283
6284 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
6285
6286exit:
6287
6288 if( ret == 0 )
6289 ssl->state++;
6290
6291#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6292 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
6293 {
6294 ssl->handshake->ecrs_peer_cert = chain;
6295 chain = NULL;
6296 }
6297#endif
6298
6299 if( chain != NULL )
6300 {
6301 mbedtls_x509_crt_free( chain );
6302 mbedtls_free( chain );
6303 }
6304
6305 return( ret );
6306}
6307#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6308
Jerry Yu615bd6f2022-02-17 14:25:15 +08006309#if defined(MBEDTLS_SHA256_C)
6310static void ssl_calc_finished_tls_sha256(
6311 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
6312{
6313 int len = 12;
6314 const char *sender;
6315 unsigned char padbuf[32];
6316#if defined(MBEDTLS_USE_PSA_CRYPTO)
6317 size_t hash_size;
6318 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
6319 psa_status_t status;
6320#else
6321 mbedtls_sha256_context sha256;
6322#endif
6323
6324 mbedtls_ssl_session *session = ssl->session_negotiate;
6325 if( !session )
6326 session = ssl->session;
6327
6328 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
6329 ? "client finished"
6330 : "server finished";
6331
6332#if defined(MBEDTLS_USE_PSA_CRYPTO)
6333 sha256_psa = psa_hash_operation_init();
6334
6335 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
6336
6337 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
6338 if( status != PSA_SUCCESS )
6339 {
6340 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6341 return;
6342 }
6343
6344 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
6345 if( status != PSA_SUCCESS )
6346 {
6347 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6348 return;
6349 }
6350 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
6351#else
6352
6353 mbedtls_sha256_init( &sha256 );
6354
6355 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
6356
6357 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
6358
6359 /*
6360 * TLSv1.2:
6361 * hash = PRF( master, finished_label,
6362 * Hash( handshake ) )[0.11]
6363 */
6364
6365#if !defined(MBEDTLS_SHA256_ALT)
6366 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
6367 sha256.state, sizeof( sha256.state ) );
6368#endif
6369
6370 mbedtls_sha256_finish( &sha256, padbuf );
6371 mbedtls_sha256_free( &sha256 );
6372#endif /* MBEDTLS_USE_PSA_CRYPTO */
6373
6374 ssl->handshake->tls_prf( session->master, 48, sender,
6375 padbuf, 32, buf, len );
6376
6377 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
6378
6379 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6380
6381 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6382}
6383#endif /* MBEDTLS_SHA256_C */
6384
Jerry Yub7ba49e2022-02-17 14:25:53 +08006385
6386#if defined(MBEDTLS_SHA384_C)
6387
6388static void ssl_calc_finished_tls_sha384(
6389 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
6390{
6391 int len = 12;
6392 const char *sender;
6393 unsigned char padbuf[48];
6394#if defined(MBEDTLS_USE_PSA_CRYPTO)
6395 size_t hash_size;
6396 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
6397 psa_status_t status;
6398#else
6399 mbedtls_sha512_context sha512;
6400#endif
6401
6402 mbedtls_ssl_session *session = ssl->session_negotiate;
6403 if( !session )
6404 session = ssl->session;
6405
6406 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
6407 ? "client finished"
6408 : "server finished";
6409
6410#if defined(MBEDTLS_USE_PSA_CRYPTO)
6411 sha384_psa = psa_hash_operation_init();
6412
6413 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
6414
6415 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
6416 if( status != PSA_SUCCESS )
6417 {
6418 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6419 return;
6420 }
6421
6422 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
6423 if( status != PSA_SUCCESS )
6424 {
6425 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6426 return;
6427 }
6428 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
6429#else
6430 mbedtls_sha512_init( &sha512 );
6431
6432 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
6433
6434 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
6435
6436 /*
6437 * TLSv1.2:
6438 * hash = PRF( master, finished_label,
6439 * Hash( handshake ) )[0.11]
6440 */
6441
6442#if !defined(MBEDTLS_SHA512_ALT)
6443 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
6444 sha512.state, sizeof( sha512.state ) );
6445#endif
6446 mbedtls_sha512_finish( &sha512, padbuf );
6447
6448 mbedtls_sha512_free( &sha512 );
6449#endif
6450
6451 ssl->handshake->tls_prf( session->master, 48, sender,
6452 padbuf, 48, buf, len );
6453
6454 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
6455
6456 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6457
6458 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6459}
6460#endif /* MBEDTLS_SHA384_C */
6461
Jerry Yuaef00152022-02-17 14:27:31 +08006462void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
6463{
6464 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
6465
6466 /*
6467 * Free our handshake params
6468 */
6469 mbedtls_ssl_handshake_free( ssl );
6470 mbedtls_free( ssl->handshake );
6471 ssl->handshake = NULL;
6472
6473 /*
6474 * Free the previous transform and swith in the current one
6475 */
6476 if( ssl->transform )
6477 {
6478 mbedtls_ssl_transform_free( ssl->transform );
6479 mbedtls_free( ssl->transform );
6480 }
6481 ssl->transform = ssl->transform_negotiate;
6482 ssl->transform_negotiate = NULL;
6483
6484 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
6485}
6486
Jerry Yu2a9fff52022-02-17 14:28:51 +08006487void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
6488{
6489 int resume = ssl->handshake->resume;
6490
6491 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
6492
6493#if defined(MBEDTLS_SSL_RENEGOTIATION)
6494 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
6495 {
6496 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
6497 ssl->renego_records_seen = 0;
6498 }
6499#endif
6500
6501 /*
6502 * Free the previous session and switch in the current one
6503 */
6504 if( ssl->session )
6505 {
6506#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6507 /* RFC 7366 3.1: keep the EtM state */
6508 ssl->session_negotiate->encrypt_then_mac =
6509 ssl->session->encrypt_then_mac;
6510#endif
6511
6512 mbedtls_ssl_session_free( ssl->session );
6513 mbedtls_free( ssl->session );
6514 }
6515 ssl->session = ssl->session_negotiate;
6516 ssl->session_negotiate = NULL;
6517
6518 /*
6519 * Add cache entry
6520 */
6521 if( ssl->conf->f_set_cache != NULL &&
6522 ssl->session->id_len != 0 &&
6523 resume == 0 )
6524 {
6525 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
6526 ssl->session->id,
6527 ssl->session->id_len,
6528 ssl->session ) != 0 )
6529 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
6530 }
6531
6532#if defined(MBEDTLS_SSL_PROTO_DTLS)
6533 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
6534 ssl->handshake->flight != NULL )
6535 {
6536 /* Cancel handshake timer */
6537 mbedtls_ssl_set_timer( ssl, 0 );
6538
6539 /* Keep last flight around in case we need to resend it:
6540 * we need the handshake and transform structures for that */
6541 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
6542 }
6543 else
6544#endif
6545 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
6546
6547 ssl->state++;
6548
6549 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
6550}
6551
Jerry Yu3c8e47b2022-02-17 14:30:01 +08006552int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
6553{
6554 int ret, hash_len;
6555
6556 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
6557
6558 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
6559
6560 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
6561
6562 /*
6563 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
6564 * may define some other value. Currently (early 2016), no defined
6565 * ciphersuite does this (and this is unlikely to change as activity has
6566 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
6567 */
6568 hash_len = 12;
6569
6570#if defined(MBEDTLS_SSL_RENEGOTIATION)
6571 ssl->verify_data_len = hash_len;
6572 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
6573#endif
6574
6575 ssl->out_msglen = 4 + hash_len;
6576 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6577 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
6578
6579 /*
6580 * In case of session resuming, invert the client and server
6581 * ChangeCipherSpec messages order.
6582 */
6583 if( ssl->handshake->resume != 0 )
6584 {
6585#if defined(MBEDTLS_SSL_CLI_C)
6586 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6587 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
6588#endif
6589#if defined(MBEDTLS_SSL_SRV_C)
6590 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6591 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
6592#endif
6593 }
6594 else
6595 ssl->state++;
6596
6597 /*
6598 * Switch to our negotiated transform and session parameters for outbound
6599 * data.
6600 */
6601 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
6602
6603#if defined(MBEDTLS_SSL_PROTO_DTLS)
6604 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6605 {
6606 unsigned char i;
6607
6608 /* Remember current epoch settings for resending */
6609 ssl->handshake->alt_transform_out = ssl->transform_out;
6610 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
6611 sizeof( ssl->handshake->alt_out_ctr ) );
6612
6613 /* Set sequence_number to zero */
6614 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
6615
6616
6617 /* Increment epoch */
6618 for( i = 2; i > 0; i-- )
6619 if( ++ssl->cur_out_ctr[i - 1] != 0 )
6620 break;
6621
6622 /* The loop goes to its end iff the counter is wrapping */
6623 if( i == 0 )
6624 {
6625 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
6626 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
6627 }
6628 }
6629 else
6630#endif /* MBEDTLS_SSL_PROTO_DTLS */
6631 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
6632
6633 ssl->transform_out = ssl->transform_negotiate;
6634 ssl->session_out = ssl->session_negotiate;
6635
6636#if defined(MBEDTLS_SSL_PROTO_DTLS)
6637 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6638 mbedtls_ssl_send_flight_completed( ssl );
6639#endif
6640
6641 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
6642 {
6643 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
6644 return( ret );
6645 }
6646
6647#if defined(MBEDTLS_SSL_PROTO_DTLS)
6648 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
6649 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
6650 {
6651 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
6652 return( ret );
6653 }
6654#endif
6655
6656 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
6657
6658 return( 0 );
6659}
6660
Jerry Yu0b3d7c12022-02-17 14:30:51 +08006661#define SSL_MAX_HASH_LEN 12
6662
6663int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
6664{
6665 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6666 unsigned int hash_len = 12;
6667 unsigned char buf[SSL_MAX_HASH_LEN];
6668
6669 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
6670
6671 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
6672
6673 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
6674 {
6675 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6676 goto exit;
6677 }
6678
6679 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
6680 {
6681 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6682 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6683 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6684 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
6685 goto exit;
6686 }
6687
6688 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
6689 {
6690 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6691 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6692 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
6693 goto exit;
6694 }
6695
6696 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
6697 {
6698 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6699 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6700 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6701 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
6702 goto exit;
6703 }
6704
6705 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
6706 buf, hash_len ) != 0 )
6707 {
6708 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6709 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6710 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
6711 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
6712 goto exit;
6713 }
6714
6715#if defined(MBEDTLS_SSL_RENEGOTIATION)
6716 ssl->verify_data_len = hash_len;
6717 memcpy( ssl->peer_verify_data, buf, hash_len );
6718#endif
6719
6720 if( ssl->handshake->resume != 0 )
6721 {
6722#if defined(MBEDTLS_SSL_CLI_C)
6723 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6724 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
6725#endif
6726#if defined(MBEDTLS_SSL_SRV_C)
6727 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6728 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
6729#endif
6730 }
6731 else
6732 ssl->state++;
6733
6734#if defined(MBEDTLS_SSL_PROTO_DTLS)
6735 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6736 mbedtls_ssl_recv_flight_completed( ssl );
6737#endif
6738
6739 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
6740
6741exit:
6742 mbedtls_platform_zeroize( buf, hash_len );
6743 return( ret );
6744}
6745
Jerry Yu392112c2022-02-17 14:34:10 +08006746#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
6747/*
6748 * Helper to get TLS 1.2 PRF from ciphersuite
6749 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
6750 */
6751static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
6752{
6753#if defined(MBEDTLS_SHA384_C)
6754 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
6755 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
6756
6757 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
6758 return( tls_prf_sha384 );
6759#else
6760 (void) ciphersuite_id;
6761#endif
6762 return( tls_prf_sha256 );
6763}
6764#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08006765
6766static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
6767{
6768 ((void) tls_prf);
6769#if defined(MBEDTLS_SHA384_C)
6770 if( tls_prf == tls_prf_sha384 )
6771 {
6772 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
6773 }
6774 else
6775#endif
6776#if defined(MBEDTLS_SHA256_C)
6777 if( tls_prf == tls_prf_sha256 )
6778 {
6779 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
6780 }
6781 else
6782#endif
6783 return( MBEDTLS_SSL_TLS_PRF_NONE );
6784}
6785
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006786/*
6787 * Populate a transform structure with session keys and all the other
6788 * necessary information.
6789 *
6790 * Parameters:
6791 * - [in/out]: transform: structure to populate
6792 * [in] must be just initialised with mbedtls_ssl_transform_init()
6793 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
6794 * - [in] ciphersuite
6795 * - [in] master
6796 * - [in] encrypt_then_mac
6797 * - [in] compression
6798 * - [in] tls_prf: pointer to PRF to use for key derivation
6799 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
6800 * - [in] minor_ver: SSL/TLS minor version
6801 * - [in] endpoint: client or server
6802 * - [in] ssl: used for:
6803 * - ssl->conf->{f,p}_export_keys
6804 * [in] optionally used for:
6805 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
6806 */
6807static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
6808 int ciphersuite,
6809 const unsigned char master[48],
6810#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
6811 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6812 int encrypt_then_mac,
6813#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
6814 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
6815 ssl_tls_prf_t tls_prf,
6816 const unsigned char randbytes[64],
6817 int minor_ver,
6818 unsigned endpoint,
6819 const mbedtls_ssl_context *ssl )
6820{
6821 int ret = 0;
6822 unsigned char keyblk[256];
6823 unsigned char *key1;
6824 unsigned char *key2;
6825 unsigned char *mac_enc;
6826 unsigned char *mac_dec;
6827 size_t mac_key_len = 0;
6828 size_t iv_copy_len;
6829 size_t keylen;
6830 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
6831 const mbedtls_cipher_info_t *cipher_info;
6832 const mbedtls_md_info_t *md_info;
6833
6834#if defined(MBEDTLS_USE_PSA_CRYPTO)
6835 psa_key_type_t key_type;
6836 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
6837 psa_algorithm_t alg;
6838 size_t key_bits;
6839 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
6840#endif
6841
6842#if !defined(MBEDTLS_DEBUG_C) && \
6843 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6844 if( ssl->f_export_keys == NULL )
6845 {
6846 ssl = NULL; /* make sure we don't use it except for these cases */
6847 (void) ssl;
6848 }
6849#endif
6850
6851 /*
6852 * Some data just needs copying into the structure
6853 */
6854#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
6855 defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
6856 transform->encrypt_then_mac = encrypt_then_mac;
6857#endif
6858 transform->minor_ver = minor_ver;
6859
6860#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
6861 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
6862#endif
6863
6864#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6865 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
6866 {
6867 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
6868 * generation separate. This should never happen. */
6869 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6870 }
6871#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6872
6873 /*
6874 * Get various info structures
6875 */
6876 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
6877 if( ciphersuite_info == NULL )
6878 {
6879 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
6880 ciphersuite ) );
6881 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6882 }
6883
6884 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
6885 if( cipher_info == NULL )
6886 {
6887 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
6888 ciphersuite_info->cipher ) );
6889 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6890 }
6891
6892 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
6893 if( md_info == NULL )
6894 {
6895 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
6896 (unsigned) ciphersuite_info->mac ) );
6897 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6898 }
6899
6900#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6901 /* Copy own and peer's CID if the use of the CID
6902 * extension has been negotiated. */
6903 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
6904 {
6905 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
6906
6907 transform->in_cid_len = ssl->own_cid_len;
6908 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
6909 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
6910 transform->in_cid_len );
6911
6912 transform->out_cid_len = ssl->handshake->peer_cid_len;
6913 memcpy( transform->out_cid, ssl->handshake->peer_cid,
6914 ssl->handshake->peer_cid_len );
6915 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
6916 transform->out_cid_len );
6917 }
6918#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6919
6920 /*
6921 * Compute key block using the PRF
6922 */
6923 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
6924 if( ret != 0 )
6925 {
6926 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
6927 return( ret );
6928 }
6929
6930 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
6931 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
6932 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
6933 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
6934 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
6935
6936 /*
6937 * Determine the appropriate key, IV and MAC length.
6938 */
6939
6940 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
6941
6942#if defined(MBEDTLS_GCM_C) || \
6943 defined(MBEDTLS_CCM_C) || \
6944 defined(MBEDTLS_CHACHAPOLY_C)
6945 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_GCM ||
6946 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CCM ||
6947 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
6948 {
6949 size_t explicit_ivlen;
6950
6951 transform->maclen = 0;
6952 mac_key_len = 0;
6953 transform->taglen =
6954 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
6955
6956 /* All modes haves 96-bit IVs, but the length of the static parts vary
6957 * with mode and version:
6958 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
6959 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
6960 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
6961 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
6962 * sequence number).
6963 */
6964 transform->ivlen = 12;
6965 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
6966 transform->fixed_ivlen = 12;
6967 else
6968 transform->fixed_ivlen = 4;
6969
6970 /* Minimum length of encrypted record */
6971 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
6972 transform->minlen = explicit_ivlen + transform->taglen;
6973 }
6974 else
6975#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
6976#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
6977 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM ||
6978 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
6979 {
Neil Armstrongcf8841a2022-02-24 11:17:45 +01006980#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006981 /* Initialize HMAC contexts */
6982 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
6983 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
6984 {
6985 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
6986 goto end;
6987 }
Neil Armstrongcf8841a2022-02-24 11:17:45 +01006988#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006989
6990 /* Get MAC length */
6991 mac_key_len = mbedtls_md_get_size( md_info );
6992 transform->maclen = mac_key_len;
6993
6994 /* IV length */
6995 transform->ivlen = cipher_info->iv_size;
6996
6997 /* Minimum length */
6998 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM )
6999 transform->minlen = transform->maclen;
7000 else
7001 {
7002 /*
7003 * GenericBlockCipher:
7004 * 1. if EtM is in use: one block plus MAC
7005 * otherwise: * first multiple of blocklen greater than maclen
7006 * 2. IV
7007 */
7008#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7009 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
7010 {
7011 transform->minlen = transform->maclen
7012 + cipher_info->block_size;
7013 }
7014 else
7015#endif
7016 {
7017 transform->minlen = transform->maclen
7018 + cipher_info->block_size
7019 - transform->maclen % cipher_info->block_size;
7020 }
7021
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007022 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
7023 {
7024 transform->minlen += transform->ivlen;
7025 }
7026 else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007027 {
7028 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7029 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7030 goto end;
7031 }
7032 }
7033 }
7034 else
7035#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7036 {
7037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7038 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7039 }
7040
7041 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
7042 (unsigned) keylen,
7043 (unsigned) transform->minlen,
7044 (unsigned) transform->ivlen,
7045 (unsigned) transform->maclen ) );
7046
7047 /*
7048 * Finally setup the cipher contexts, IVs and MAC secrets.
7049 */
7050#if defined(MBEDTLS_SSL_CLI_C)
7051 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
7052 {
7053 key1 = keyblk + mac_key_len * 2;
7054 key2 = keyblk + mac_key_len * 2 + keylen;
7055
7056 mac_enc = keyblk;
7057 mac_dec = keyblk + mac_key_len;
7058
7059 /*
7060 * This is not used in TLS v1.1.
7061 */
7062 iv_copy_len = ( transform->fixed_ivlen ) ?
7063 transform->fixed_ivlen : transform->ivlen;
7064 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
7065 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
7066 iv_copy_len );
7067 }
7068 else
7069#endif /* MBEDTLS_SSL_CLI_C */
7070#if defined(MBEDTLS_SSL_SRV_C)
7071 if( endpoint == MBEDTLS_SSL_IS_SERVER )
7072 {
7073 key1 = keyblk + mac_key_len * 2 + keylen;
7074 key2 = keyblk + mac_key_len * 2;
7075
7076 mac_enc = keyblk + mac_key_len;
7077 mac_dec = keyblk;
7078
7079 /*
7080 * This is not used in TLS v1.1.
7081 */
7082 iv_copy_len = ( transform->fixed_ivlen ) ?
7083 transform->fixed_ivlen : transform->ivlen;
7084 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
7085 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
7086 iv_copy_len );
7087 }
7088 else
7089#endif /* MBEDTLS_SSL_SRV_C */
7090 {
7091 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7092 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7093 goto end;
7094 }
7095
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007096 if( ssl != NULL && ssl->f_export_keys != NULL )
7097 {
7098 ssl->f_export_keys( ssl->p_export_keys,
7099 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
7100 master, 48,
7101 randbytes + 32,
7102 randbytes,
7103 tls_prf_get_type( tls_prf ) );
7104 }
7105
7106#if defined(MBEDTLS_USE_PSA_CRYPTO)
7107 if( ( status = mbedtls_ssl_cipher_to_psa( cipher_info->type,
7108 transform->taglen,
7109 &alg,
7110 &key_type,
7111 &key_bits ) ) != PSA_SUCCESS )
7112 {
7113 ret = psa_ssl_status_to_mbedtls( status );
7114 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", ret );
7115 goto end;
7116 }
7117
7118 transform->psa_alg = alg;
7119
7120 if ( alg != MBEDTLS_SSL_NULL_CIPHER )
7121 {
7122 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
7123 psa_set_key_algorithm( &attributes, alg );
7124 psa_set_key_type( &attributes, key_type );
7125
7126 if( ( status = psa_import_key( &attributes,
7127 key1,
7128 PSA_BITS_TO_BYTES( key_bits ),
7129 &transform->psa_key_enc ) ) != PSA_SUCCESS )
7130 {
7131 MBEDTLS_SSL_DEBUG_RET( 3, "psa_import_key", (int)status );
7132 ret = psa_ssl_status_to_mbedtls( status );
7133 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7134 goto end;
7135 }
7136
7137 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
7138
7139 if( ( status = psa_import_key( &attributes,
7140 key2,
7141 PSA_BITS_TO_BYTES( key_bits ),
7142 &transform->psa_key_dec ) ) != PSA_SUCCESS )
7143 {
7144 ret = psa_ssl_status_to_mbedtls( status );
7145 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7146 goto end;
7147 }
7148 }
7149#else
7150 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
7151 cipher_info ) ) != 0 )
7152 {
7153 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7154 goto end;
7155 }
7156
7157 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
7158 cipher_info ) ) != 0 )
7159 {
7160 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7161 goto end;
7162 }
7163
7164 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
7165 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7166 MBEDTLS_ENCRYPT ) ) != 0 )
7167 {
7168 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7169 goto end;
7170 }
7171
7172 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
7173 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7174 MBEDTLS_DECRYPT ) ) != 0 )
7175 {
7176 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7177 goto end;
7178 }
7179
7180#if defined(MBEDTLS_CIPHER_MODE_CBC)
7181 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
7182 {
7183 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
7184 MBEDTLS_PADDING_NONE ) ) != 0 )
7185 {
7186 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7187 goto end;
7188 }
7189
7190 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
7191 MBEDTLS_PADDING_NONE ) ) != 0 )
7192 {
7193 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7194 goto end;
7195 }
7196 }
7197#endif /* MBEDTLS_CIPHER_MODE_CBC */
7198#endif /* MBEDTLS_USE_PSA_CRYPTO */
7199
Neil Armstrong29c0c042022-03-17 17:47:28 +01007200#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
7201 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
7202 For AEAD-based ciphersuites, there is nothing to do here. */
7203 if( mac_key_len != 0 )
7204 {
7205#if defined(MBEDTLS_USE_PSA_CRYPTO)
7206 alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
7207 if( alg == 0 )
7208 {
7209 ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
7210 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_md_type_to_psa", ret );
7211 goto end;
7212 }
7213
7214 transform->psa_mac_alg = PSA_ALG_HMAC( alg );
7215
7216 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
7217 psa_set_key_algorithm( &attributes, PSA_ALG_HMAC( alg ) );
7218 psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
7219
7220 if( ( status = psa_import_key( &attributes,
7221 mac_enc, mac_key_len,
7222 &transform->psa_mac_enc ) ) != PSA_SUCCESS )
7223 {
7224 ret = psa_ssl_status_to_mbedtls( status );
7225 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7226 goto end;
7227 }
7228
Ronald Cronfb39f152022-03-25 14:36:28 +01007229 if( ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ) ||
7230 ( ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING ) &&
7231 ( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ) ) )
Neil Armstrong29c0c042022-03-17 17:47:28 +01007232 /* mbedtls_ct_hmac() requires the key to be exportable */
7233 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT |
7234 PSA_KEY_USAGE_VERIFY_HASH );
7235 else
7236 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
7237
7238 if( ( status = psa_import_key( &attributes,
7239 mac_dec, mac_key_len,
7240 &transform->psa_mac_dec ) ) != PSA_SUCCESS )
7241 {
7242 ret = psa_ssl_status_to_mbedtls( status );
7243 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7244 goto end;
7245 }
7246#else
7247 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
7248 if( ret != 0 )
7249 goto end;
7250 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
7251 if( ret != 0 )
7252 goto end;
7253#endif /* MBEDTLS_USE_PSA_CRYPTO */
7254 }
7255#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7256
7257 ((void) mac_dec);
7258 ((void) mac_enc);
7259
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007260end:
7261 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
7262 return( ret );
7263}
7264
Jerry Yuee40f9d2022-02-17 14:55:16 +08007265#if defined(MBEDTLS_USE_PSA_CRYPTO)
7266int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7267 unsigned char *hash, size_t *hashlen,
7268 unsigned char *data, size_t data_len,
7269 mbedtls_md_type_t md_alg )
7270{
7271 psa_status_t status;
7272 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
7273 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
7274
7275 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
7276
7277 if( ( status = psa_hash_setup( &hash_operation,
7278 hash_alg ) ) != PSA_SUCCESS )
7279 {
7280 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
7281 goto exit;
7282 }
7283
7284 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
7285 64 ) ) != PSA_SUCCESS )
7286 {
7287 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7288 goto exit;
7289 }
7290
7291 if( ( status = psa_hash_update( &hash_operation,
7292 data, data_len ) ) != PSA_SUCCESS )
7293 {
7294 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7295 goto exit;
7296 }
7297
7298 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
7299 hashlen ) ) != PSA_SUCCESS )
7300 {
7301 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
7302 goto exit;
7303 }
7304
7305exit:
7306 if( status != PSA_SUCCESS )
7307 {
7308 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7309 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7310 switch( status )
7311 {
7312 case PSA_ERROR_NOT_SUPPORTED:
7313 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
7314 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
7315 case PSA_ERROR_BUFFER_TOO_SMALL:
7316 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7317 case PSA_ERROR_INSUFFICIENT_MEMORY:
7318 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7319 default:
7320 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
7321 }
7322 }
7323 return( 0 );
7324}
7325
7326#else
7327
7328int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7329 unsigned char *hash, size_t *hashlen,
7330 unsigned char *data, size_t data_len,
7331 mbedtls_md_type_t md_alg )
7332{
7333 int ret = 0;
7334 mbedtls_md_context_t ctx;
7335 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
7336 *hashlen = mbedtls_md_get_size( md_info );
7337
7338 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
7339
7340 mbedtls_md_init( &ctx );
7341
7342 /*
7343 * digitally-signed struct {
7344 * opaque client_random[32];
7345 * opaque server_random[32];
7346 * ServerDHParams params;
7347 * };
7348 */
7349 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7350 {
7351 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7352 goto exit;
7353 }
7354 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7355 {
7356 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7357 goto exit;
7358 }
7359 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7360 {
7361 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7362 goto exit;
7363 }
7364 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7365 {
7366 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7367 goto exit;
7368 }
7369 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
7370 {
7371 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7372 goto exit;
7373 }
7374
7375exit:
7376 mbedtls_md_free( &ctx );
7377
7378 if( ret != 0 )
7379 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7380 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7381
7382 return( ret );
7383}
7384#endif /* MBEDTLS_USE_PSA_CRYPTO */
7385
Jerry Yud9d91da2022-02-17 14:57:06 +08007386#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7387
7388/* Find an entry in a signature-hash set matching a given hash algorithm. */
7389mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
7390 mbedtls_pk_type_t sig_alg )
7391{
7392 switch( sig_alg )
7393 {
7394 case MBEDTLS_PK_RSA:
7395 return( set->rsa );
7396 case MBEDTLS_PK_ECDSA:
7397 return( set->ecdsa );
7398 default:
7399 return( MBEDTLS_MD_NONE );
7400 }
7401}
7402
7403/* Add a signature-hash-pair to a signature-hash set */
7404void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
7405 mbedtls_pk_type_t sig_alg,
7406 mbedtls_md_type_t md_alg )
7407{
7408 switch( sig_alg )
7409 {
7410 case MBEDTLS_PK_RSA:
7411 if( set->rsa == MBEDTLS_MD_NONE )
7412 set->rsa = md_alg;
7413 break;
7414
7415 case MBEDTLS_PK_ECDSA:
7416 if( set->ecdsa == MBEDTLS_MD_NONE )
7417 set->ecdsa = md_alg;
7418 break;
7419
7420 default:
7421 break;
7422 }
7423}
7424
7425/* Allow exactly one hash algorithm for each signature. */
7426void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
7427 mbedtls_md_type_t md_alg )
7428{
7429 set->rsa = md_alg;
7430 set->ecdsa = md_alg;
7431}
7432
7433#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7434
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08007435/* Serialization of TLS 1.2 sessions:
7436 *
7437 * struct {
7438 * uint64 start_time;
7439 * uint8 ciphersuite[2]; // defined by the standard
7440 * uint8 compression; // 0 or 1
7441 * uint8 session_id_len; // at most 32
7442 * opaque session_id[32];
7443 * opaque master[48]; // fixed length in the standard
7444 * uint32 verify_result;
7445 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
7446 * opaque ticket<0..2^24-1>; // length 0 means no ticket
7447 * uint32 ticket_lifetime;
7448 * uint8 mfl_code; // up to 255 according to standard
7449 * uint8 encrypt_then_mac; // 0 or 1
7450 * } serialized_session_tls12;
7451 *
7452 */
7453static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
7454 unsigned char *buf,
7455 size_t buf_len )
7456{
7457 unsigned char *p = buf;
7458 size_t used = 0;
7459
7460#if defined(MBEDTLS_HAVE_TIME)
7461 uint64_t start;
7462#endif
7463#if defined(MBEDTLS_X509_CRT_PARSE_C)
7464#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7465 size_t cert_len;
7466#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7467#endif /* MBEDTLS_X509_CRT_PARSE_C */
7468
7469 /*
7470 * Time
7471 */
7472#if defined(MBEDTLS_HAVE_TIME)
7473 used += 8;
7474
7475 if( used <= buf_len )
7476 {
7477 start = (uint64_t) session->start;
7478
7479 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
7480 p += 8;
7481 }
7482#endif /* MBEDTLS_HAVE_TIME */
7483
7484 /*
7485 * Basic mandatory fields
7486 */
7487 used += 2 /* ciphersuite */
7488 + 1 /* compression */
7489 + 1 /* id_len */
7490 + sizeof( session->id )
7491 + sizeof( session->master )
7492 + 4; /* verify_result */
7493
7494 if( used <= buf_len )
7495 {
7496 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
7497 p += 2;
7498
7499 *p++ = MBEDTLS_BYTE_0( session->compression );
7500
7501 *p++ = MBEDTLS_BYTE_0( session->id_len );
7502 memcpy( p, session->id, 32 );
7503 p += 32;
7504
7505 memcpy( p, session->master, 48 );
7506 p += 48;
7507
7508 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
7509 p += 4;
7510 }
7511
7512 /*
7513 * Peer's end-entity certificate
7514 */
7515#if defined(MBEDTLS_X509_CRT_PARSE_C)
7516#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7517 if( session->peer_cert == NULL )
7518 cert_len = 0;
7519 else
7520 cert_len = session->peer_cert->raw.len;
7521
7522 used += 3 + cert_len;
7523
7524 if( used <= buf_len )
7525 {
7526 *p++ = MBEDTLS_BYTE_2( cert_len );
7527 *p++ = MBEDTLS_BYTE_1( cert_len );
7528 *p++ = MBEDTLS_BYTE_0( cert_len );
7529
7530 if( session->peer_cert != NULL )
7531 {
7532 memcpy( p, session->peer_cert->raw.p, cert_len );
7533 p += cert_len;
7534 }
7535 }
7536#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7537 if( session->peer_cert_digest != NULL )
7538 {
7539 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
7540 if( used <= buf_len )
7541 {
7542 *p++ = (unsigned char) session->peer_cert_digest_type;
7543 *p++ = (unsigned char) session->peer_cert_digest_len;
7544 memcpy( p, session->peer_cert_digest,
7545 session->peer_cert_digest_len );
7546 p += session->peer_cert_digest_len;
7547 }
7548 }
7549 else
7550 {
7551 used += 2;
7552 if( used <= buf_len )
7553 {
7554 *p++ = (unsigned char) MBEDTLS_MD_NONE;
7555 *p++ = 0;
7556 }
7557 }
7558#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7559#endif /* MBEDTLS_X509_CRT_PARSE_C */
7560
7561 /*
7562 * Session ticket if any, plus associated data
7563 */
7564#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
7565 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
7566
7567 if( used <= buf_len )
7568 {
7569 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
7570 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
7571 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
7572
7573 if( session->ticket != NULL )
7574 {
7575 memcpy( p, session->ticket, session->ticket_len );
7576 p += session->ticket_len;
7577 }
7578
7579 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
7580 p += 4;
7581 }
7582#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
7583
7584 /*
7585 * Misc extension-related info
7586 */
7587#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
7588 used += 1;
7589
7590 if( used <= buf_len )
7591 *p++ = session->mfl_code;
7592#endif
7593
7594#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7595 used += 1;
7596
7597 if( used <= buf_len )
7598 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
7599#endif
7600
7601 return( used );
7602}
7603
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08007604static int ssl_session_load_tls12( mbedtls_ssl_session *session,
7605 const unsigned char *buf,
7606 size_t len )
7607{
7608#if defined(MBEDTLS_HAVE_TIME)
7609 uint64_t start;
7610#endif
7611#if defined(MBEDTLS_X509_CRT_PARSE_C)
7612#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7613 size_t cert_len;
7614#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7615#endif /* MBEDTLS_X509_CRT_PARSE_C */
7616
7617 const unsigned char *p = buf;
7618 const unsigned char * const end = buf + len;
7619
7620 /*
7621 * Time
7622 */
7623#if defined(MBEDTLS_HAVE_TIME)
7624 if( 8 > (size_t)( end - p ) )
7625 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7626
7627 start = ( (uint64_t) p[0] << 56 ) |
7628 ( (uint64_t) p[1] << 48 ) |
7629 ( (uint64_t) p[2] << 40 ) |
7630 ( (uint64_t) p[3] << 32 ) |
7631 ( (uint64_t) p[4] << 24 ) |
7632 ( (uint64_t) p[5] << 16 ) |
7633 ( (uint64_t) p[6] << 8 ) |
7634 ( (uint64_t) p[7] );
7635 p += 8;
7636
7637 session->start = (time_t) start;
7638#endif /* MBEDTLS_HAVE_TIME */
7639
7640 /*
7641 * Basic mandatory fields
7642 */
7643 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
7644 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7645
7646 session->ciphersuite = ( p[0] << 8 ) | p[1];
7647 p += 2;
7648
7649 session->compression = *p++;
7650
7651 session->id_len = *p++;
7652 memcpy( session->id, p, 32 );
7653 p += 32;
7654
7655 memcpy( session->master, p, 48 );
7656 p += 48;
7657
7658 session->verify_result = ( (uint32_t) p[0] << 24 ) |
7659 ( (uint32_t) p[1] << 16 ) |
7660 ( (uint32_t) p[2] << 8 ) |
7661 ( (uint32_t) p[3] );
7662 p += 4;
7663
7664 /* Immediately clear invalid pointer values that have been read, in case
7665 * we exit early before we replaced them with valid ones. */
7666#if defined(MBEDTLS_X509_CRT_PARSE_C)
7667#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7668 session->peer_cert = NULL;
7669#else
7670 session->peer_cert_digest = NULL;
7671#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7672#endif /* MBEDTLS_X509_CRT_PARSE_C */
7673#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
7674 session->ticket = NULL;
7675#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
7676
7677 /*
7678 * Peer certificate
7679 */
7680#if defined(MBEDTLS_X509_CRT_PARSE_C)
7681#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7682 /* Deserialize CRT from the end of the ticket. */
7683 if( 3 > (size_t)( end - p ) )
7684 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7685
7686 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
7687 p += 3;
7688
7689 if( cert_len != 0 )
7690 {
7691 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7692
7693 if( cert_len > (size_t)( end - p ) )
7694 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7695
7696 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
7697
7698 if( session->peer_cert == NULL )
7699 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7700
7701 mbedtls_x509_crt_init( session->peer_cert );
7702
7703 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
7704 p, cert_len ) ) != 0 )
7705 {
7706 mbedtls_x509_crt_free( session->peer_cert );
7707 mbedtls_free( session->peer_cert );
7708 session->peer_cert = NULL;
7709 return( ret );
7710 }
7711
7712 p += cert_len;
7713 }
7714#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7715 /* Deserialize CRT digest from the end of the ticket. */
7716 if( 2 > (size_t)( end - p ) )
7717 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7718
7719 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
7720 session->peer_cert_digest_len = (size_t) *p++;
7721
7722 if( session->peer_cert_digest_len != 0 )
7723 {
7724 const mbedtls_md_info_t *md_info =
7725 mbedtls_md_info_from_type( session->peer_cert_digest_type );
7726 if( md_info == NULL )
7727 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7728 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
7729 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7730
7731 if( session->peer_cert_digest_len > (size_t)( end - p ) )
7732 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7733
7734 session->peer_cert_digest =
7735 mbedtls_calloc( 1, session->peer_cert_digest_len );
7736 if( session->peer_cert_digest == NULL )
7737 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7738
7739 memcpy( session->peer_cert_digest, p,
7740 session->peer_cert_digest_len );
7741 p += session->peer_cert_digest_len;
7742 }
7743#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7744#endif /* MBEDTLS_X509_CRT_PARSE_C */
7745
7746 /*
7747 * Session ticket and associated data
7748 */
7749#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
7750 if( 3 > (size_t)( end - p ) )
7751 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7752
7753 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
7754 p += 3;
7755
7756 if( session->ticket_len != 0 )
7757 {
7758 if( session->ticket_len > (size_t)( end - p ) )
7759 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7760
7761 session->ticket = mbedtls_calloc( 1, session->ticket_len );
7762 if( session->ticket == NULL )
7763 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7764
7765 memcpy( session->ticket, p, session->ticket_len );
7766 p += session->ticket_len;
7767 }
7768
7769 if( 4 > (size_t)( end - p ) )
7770 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7771
7772 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
7773 ( (uint32_t) p[1] << 16 ) |
7774 ( (uint32_t) p[2] << 8 ) |
7775 ( (uint32_t) p[3] );
7776 p += 4;
7777#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
7778
7779 /*
7780 * Misc extension-related info
7781 */
7782#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
7783 if( 1 > (size_t)( end - p ) )
7784 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7785
7786 session->mfl_code = *p++;
7787#endif
7788
7789#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7790 if( 1 > (size_t)( end - p ) )
7791 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7792
7793 session->encrypt_then_mac = *p++;
7794#endif
7795
7796 /* Done, should have consumed entire buffer */
7797 if( p != end )
7798 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7799
7800 return( 0 );
7801}
Jerry Yudc7bd172022-02-17 13:44:15 +08007802#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7803
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007804#endif /* MBEDTLS_SSL_TLS_C */