blob: 40b6f70c7313c1d48045b7fe66bf698f94adcf7c [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 shared functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21/*
22 * The SSL 3.0 specification was drafted by Netscape in 1996,
23 * and became an IETF standard in 1999.
24 *
25 * http://wp.netscape.com/eng/ssl3/
26 * http://www.ietf.org/rfc/rfc2246.txt
27 * http://www.ietf.org/rfc/rfc4346.txt
28 */
29
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020030#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000031#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020032#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020034#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000037
SimonBd5800b72016-04-26 07:43:27 +010038#if defined(MBEDTLS_PLATFORM_C)
39#include "mbedtls/platform.h"
40#else
41#include <stdlib.h>
42#define mbedtls_calloc calloc
43#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010044#endif
45
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/debug.h"
47#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020048#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050049#include "mbedtls/platform_util.h"
Hanno Beckerb5352f02019-05-16 12:39:07 +010050#include "mbedtls/version.h"
Jarno Lamsaaf60cd72019-12-19 16:45:23 +020051#include "mbedtls/platform.h"
52
Rich Evans00ab4702015-02-06 13:43:58 +000053#include <string.h>
54
Janos Follath23bdca02016-10-07 14:47:14 +010055#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000056#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020057#endif
58
Andrzej Kurekf7df0d32020-09-19 12:00:57 +020059#define PROPER_HS_FRAGMENT 0x75
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -040060
Andrzej Kureka7932372020-09-19 07:56:06 +020061#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
62static int mbedtls_ssl_switch_key( mbedtls_ssl_transform *transform,
63 const mbedtls_operation_t operation )
64{
65 unsigned char * key;
Andrzej Kurek69bafce2020-09-19 12:45:20 +020066 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
67 int flow_ctrl = 0;
Andrzej Kureka7932372020-09-19 07:56:06 +020068#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
69 uint32_t hash;
70#endif
71 if( operation == MBEDTLS_ENCRYPT )
72 {
Andrzej Kurek69bafce2020-09-19 12:45:20 +020073 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +020074 key = transform->key_enc;
75#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
76 hash = transform->key_enc_hash;
77#endif
78 }
79 else if ( operation == MBEDTLS_DECRYPT )
80 {
Andrzej Kurek69bafce2020-09-19 12:45:20 +020081 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +020082 key = transform->key_dec;
83#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
84 hash = transform->key_dec_hash;
85#endif
86 }
87 else
88 {
89 return ( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
90 }
91#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
92 /* Check hash */
93 if( hash != mbedtls_hash( key, transform->key_bitlen >> 3 ) )
94 {
95 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
96 }
Andrzej Kurek69bafce2020-09-19 12:45:20 +020097 else
98 {
99 flow_ctrl++;
100 }
101#else
102 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +0200103#endif
104 if( operation != transform->cipher_ctx.operation )
105 {
106 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx,
107 key,
108 transform->key_bitlen,
109 operation ) ) != 0 )
110 {
111 return( ret );
112 }
113 }
Andrzej Kurek69bafce2020-09-19 12:45:20 +0200114 if( flow_ctrl == 2 )
115 {
116 return( 0 );
117 }
118 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Andrzej Kureka7932372020-09-19 07:56:06 +0200119}
120#endif
121
Hanno Beckeref982d52019-07-23 15:56:18 +0100122#if defined(MBEDTLS_USE_TINYCRYPT)
123static int uecc_rng_wrapper( uint8_t *dest, unsigned int size )
124{
Hanno Beckerd089fad2019-07-24 09:05:05 +0100125 int ret;
126 ret = mbedtls_ssl_conf_rng_func( NULL, dest, size );
127 if( ret == 0 )
128 return( (int) size );
129
130 return( 0 );
Hanno Beckeref982d52019-07-23 15:56:18 +0100131}
Hanno Becker75f12d12019-07-23 16:16:15 +0100132
133int mbedtls_ssl_ecdh_read_peerkey( mbedtls_ssl_context *ssl,
134 unsigned char **p, unsigned char *end )
135{
136 size_t const secp256r1_uncompressed_point_length =
137 1 /* length */ + 1 /* length */ + 2 * NUM_ECC_BYTES /* data */;
138
139 if( (size_t)( end - *p ) < secp256r1_uncompressed_point_length )
140 {
141 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Bad ECDH peer pubkey (too short)" ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +0100142 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +0100143 }
144
145 if( (*p)[0] != 2 * NUM_ECC_BYTES + 1 ||
146 (*p)[1] != 0x04 )
147 {
148 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Unexpected ECDH peer pubkey header - expected { %#02x, %#02x }, got { %#02x, %#02x }",
149 2 * NUM_ECC_BYTES + 1,
150 0x04,
151 (unsigned) (*p)[0],
152 (unsigned) (*p)[1] ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +0100153 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +0100154 }
155
Piotr Nowicki305a5ec2020-08-10 17:42:18 +0200156 if( mbedtls_platform_memcpy( ssl->handshake->ecdh_peerkey, *p + 2, 2 * NUM_ECC_BYTES ) !=
157 ssl->handshake->ecdh_peerkey )
158 {
159 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
160 }
Hanno Becker75f12d12019-07-23 16:16:15 +0100161
162 *p += secp256r1_uncompressed_point_length;
163 return( 0 );
164}
Hanno Beckeref982d52019-07-23 15:56:18 +0100165#endif /* MBEDTLS_USE_TINYCRYPT */
166
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100167static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl );
Hanno Beckercd9dcda2018-08-28 17:18:56 +0100168static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100169
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100170/* Length of the "epoch" field in the record header */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200171static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100172{
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200173#if !defined(MBEDTLS_SSL_TRANSPORT__BOTH)
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +0100174 ((void) ssl);
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100175#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200176
177#if defined(MBEDTLS_SSL_PROTO_DTLS)
178 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
179 return( 2 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200180 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200181#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200182#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100183 return( 0 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200184#endif
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100185}
186
Hanno Beckerb82350b2019-07-26 07:24:05 +0100187static void ssl_send_pending_fatal_alert( mbedtls_ssl_context *ssl )
188{
189 if( ssl->pending_fatal_alert_msg == MBEDTLS_SSL_ALERT_MSG_NONE )
190 return;
191
192 mbedtls_ssl_send_alert_message( ssl,
193 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
194 ssl->pending_fatal_alert_msg );
195 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
196}
197
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200198/*
199 * Start a timer.
200 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200201 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200203{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100204 if( mbedtls_ssl_get_set_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200205 return;
206
207 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
Hanno Becker0ae6b242019-06-13 16:45:36 +0100208 mbedtls_ssl_get_set_timer( ssl )( ssl->p_timer,
209 millisecs / 4,
210 millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200211}
212
213/*
214 * Return -1 is timer is expired, 0 if it isn't.
215 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200216static int ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200217{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100218 if( mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +0200219 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200220
Hanno Becker0ae6b242019-06-13 16:45:36 +0100221 if( mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200222 {
223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200224 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200225 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200226
227 return( 0 );
228}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200229
Hanno Becker5aa4e2c2018-08-06 09:26:08 +0100230static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
231 mbedtls_ssl_transform *transform );
Hanno Beckerf5970a02019-05-08 09:38:41 +0100232static void ssl_update_in_pointers( mbedtls_ssl_context *ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100233
Hanno Becker02f26092019-07-03 16:13:00 +0100234#if defined(MBEDTLS_SSL_RECORD_CHECKING)
Hanno Becker03e2db62019-07-12 14:40:00 +0100235static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
236 unsigned char *buf,
237 size_t len,
238 mbedtls_record *rec );
239
Hanno Becker02f26092019-07-03 16:13:00 +0100240int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl,
241 unsigned char *buf,
242 size_t buflen )
243{
Andrzej Kurekfd56f402020-05-25 11:52:05 -0400244 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker03e2db62019-07-12 14:40:00 +0100245 mbedtls_record rec;
246 MBEDTLS_SSL_DEBUG_MSG( 1, ( "=> mbedtls_ssl_check_record" ) );
247 MBEDTLS_SSL_DEBUG_BUF( 3, "record buffer", buf, buflen );
248
249 /* We don't support record checking in TLS because
250 * (a) there doesn't seem to be a usecase for it, and
251 * (b) In SSLv3 and TLS 1.0, CBC record decryption has state
252 * and we'd need to backup the transform here.
253 */
254#if defined(MBEDTLS_SSL_PROTO_TLS)
255 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
256 {
257 ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
258 goto exit;
259 }
260 MBEDTLS_SSL_TRANSPORT_ELSE
261#endif /* MBEDTLS_SSL_PROTO_TLS */
262#if defined(MBEDTLS_SSL_PROTO_DTLS)
263 {
264 ret = ssl_parse_record_header( ssl, buf, buflen, &rec );
265 if( ret != 0 )
266 {
267 MBEDTLS_SSL_DEBUG_RET( 3, "ssl_parse_record_header", ret );
268 goto exit;
269 }
270
271 if( ssl->transform_in != NULL )
272 {
273 ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in, &rec );
274 if( ret != 0 )
275 {
276 MBEDTLS_SSL_DEBUG_RET( 3, "mbedtls_ssl_decrypt_buf", ret );
277 goto exit;
278 }
279 }
280 }
281#endif /* MBEDTLS_SSL_PROTO_DTLS */
282
283exit:
284 /* On success, we have decrypted the buffer in-place, so make
285 * sure we don't leak any plaintext data. */
286 mbedtls_platform_zeroize( buf, buflen );
287
288 /* For the purpose of this API, treat messages with unexpected CID
289 * as well as such from future epochs as unexpected. */
290 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID ||
291 ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
292 {
293 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
294 }
295
296 MBEDTLS_SSL_DEBUG_MSG( 1, ( "<= mbedtls_ssl_check_record" ) );
297 return( ret );
Hanno Becker02f26092019-07-03 16:13:00 +0100298}
299#endif /* MBEDTLS_SSL_RECORD_CHECKING */
300
Hanno Becker67bc7c32018-08-06 11:33:50 +0100301#define SSL_DONT_FORCE_FLUSH 0
302#define SSL_FORCE_FLUSH 1
303
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200304#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +0100305
Hanno Beckera5a2b082019-05-15 14:03:01 +0100306#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100307/* Top-level Connection ID API */
308
Hanno Beckere0200da2019-06-13 09:23:43 +0100309#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
310 !defined(MBEDTLS_SSL_CONF_CID_LEN) && \
311 !defined(MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +0100312int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
313 size_t len,
314 int ignore_other_cid )
Hanno Beckereec2be92019-05-03 13:06:44 +0100315{
316 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
317 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
318
Hanno Becker791ec6b2019-05-14 11:45:26 +0100319 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
320 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
321 {
322 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
323 }
324
325 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckereec2be92019-05-03 13:06:44 +0100326 conf->cid_len = len;
327 return( 0 );
328}
Hanno Beckere0200da2019-06-13 09:23:43 +0100329#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
330 !MBEDTLS_SSL_CONF_CID_LEN &&
331 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
332
333#if MBEDTLS_SSL_CONF_CID_LEN > MBEDTLS_SSL_CID_IN_LEN_MAX
334#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_CID_LEN"
335#endif
336#if MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE && \
337 MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_FAIL
338#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID"
339#endif
340
341#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
342 !MBEDTLS_SSL_CONF_CID_LEN &&
343 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
Hanno Beckereec2be92019-05-03 13:06:44 +0100344
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100345int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
346 int enable,
347 unsigned char const *own_cid,
348 size_t own_cid_len )
349{
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200350 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker78c43022019-05-03 14:38:32 +0100351 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
352
Hanno Becker07489862019-04-25 16:01:49 +0100353 ssl->negotiate_cid = enable;
354 if( enable == MBEDTLS_SSL_CID_DISABLED )
355 {
356 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
357 return( 0 );
358 }
359 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckereec2be92019-05-03 13:06:44 +0100360 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Becker07489862019-04-25 16:01:49 +0100361
Hanno Beckere0200da2019-06-13 09:23:43 +0100362 if( own_cid_len != mbedtls_ssl_conf_get_cid_len( ssl->conf ) )
Hanno Becker07489862019-04-25 16:01:49 +0100363 {
Hanno Beckereec2be92019-05-03 13:06:44 +0100364 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
365 (unsigned) own_cid_len,
Hanno Beckere0200da2019-06-13 09:23:43 +0100366 (unsigned) mbedtls_ssl_conf_get_cid_len( ssl->conf ) ) );
Hanno Becker07489862019-04-25 16:01:49 +0100367 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
368 }
369
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300370 /* Not using more secure mbedtls_platform_memcpy as cid is public */
371 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb4a56062019-04-30 14:07:31 +0100372 /* Truncation is not an issue here because
373 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
374 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Becker07489862019-04-25 16:01:49 +0100375
Andrzej Kurekafec8852020-07-15 16:31:27 -0400376 return( 0 );
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100377}
378
379int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
380 int *enabled,
381 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
382 size_t *peer_cid_len )
383{
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100384 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Becker2de89fa2019-04-26 17:08:02 +0100385
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200386 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker78c43022019-05-03 14:38:32 +0100387 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
388 {
Hanno Becker2de89fa2019-04-26 17:08:02 +0100389 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker78c43022019-05-03 14:38:32 +0100390 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100391
Hanno Beckercb063f52019-05-03 12:54:52 +0100392 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
393 * were used, but client and server requested the empty CID.
394 * This is indistinguishable from not using the CID extension
395 * in the first place. */
Hanno Becker2de89fa2019-04-26 17:08:02 +0100396 if( ssl->transform_in->in_cid_len == 0 &&
397 ssl->transform_in->out_cid_len == 0 )
398 {
399 return( 0 );
400 }
401
Hanno Becker633d6042019-05-22 16:50:35 +0100402 if( peer_cid_len != NULL )
403 {
404 *peer_cid_len = ssl->transform_in->out_cid_len;
405 if( peer_cid != NULL )
406 {
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300407 /* Not using more secure mbedtls_platform_memcpy as cid is public */
408 memcpy( peer_cid, ssl->transform_in->out_cid,
Hanno Becker633d6042019-05-22 16:50:35 +0100409 ssl->transform_in->out_cid_len );
410 }
411 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100412
413 *enabled = MBEDTLS_SSL_CID_ENABLED;
414
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100415 return( 0 );
416}
Hanno Beckera5a2b082019-05-15 14:03:01 +0100417#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100418
Hanno Beckerd5847772018-08-28 10:09:23 +0100419/* Forward declarations for functions related to message buffering. */
420static void ssl_buffering_free( mbedtls_ssl_context *ssl );
421static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
422 uint8_t slot );
423static void ssl_free_buffered_record( mbedtls_ssl_context *ssl );
424static int ssl_load_buffered_message( mbedtls_ssl_context *ssl );
425static int ssl_load_buffered_record( mbedtls_ssl_context *ssl );
426static int ssl_buffer_message( mbedtls_ssl_context *ssl );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +0100427static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
428 mbedtls_record const *rec );
Hanno Beckeref7afdf2018-08-28 17:16:31 +0100429static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl );
Hanno Beckerd5847772018-08-28 10:09:23 +0100430
Hanno Beckera67dee22018-08-22 10:05:20 +0100431static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl );
Hanno Becker11682cc2018-08-22 14:41:02 +0100432static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context const *ssl )
Hanno Becker2b1e3542018-08-06 11:19:13 +0100433{
Hanno Becker11682cc2018-08-22 14:41:02 +0100434 size_t mtu = ssl_get_current_mtu( ssl );
Andrzej Kurekf3844952020-10-16 23:03:01 +0200435#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
436 size_t out_buf_len = ssl->out_buf_len;
437#else
438 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
439#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +0100440
Andrzej Kurekf3844952020-10-16 23:03:01 +0200441 if( mtu != 0 && mtu < out_buf_len )
Hanno Becker11682cc2018-08-22 14:41:02 +0100442 return( mtu );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100443
Andrzej Kurekf3844952020-10-16 23:03:01 +0200444 return( out_buf_len );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100445}
446
Hanno Becker67bc7c32018-08-06 11:33:50 +0100447static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
448{
Hanno Becker11682cc2018-08-22 14:41:02 +0100449 size_t const bytes_written = ssl->out_left;
450 size_t const mtu = ssl_get_maximum_datagram_size( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100451
452 /* Double-check that the write-index hasn't gone
453 * past what we can transmit in a single datagram. */
Hanno Becker11682cc2018-08-22 14:41:02 +0100454 if( bytes_written > mtu )
Hanno Becker67bc7c32018-08-06 11:33:50 +0100455 {
456 /* Should never happen... */
457 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
458 }
459
460 return( (int) ( mtu - bytes_written ) );
461}
462
463static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl )
464{
465 int ret;
466 size_t remaining, expansion;
Andrzej Kurek748face2018-10-11 07:20:19 -0400467 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100468
469#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +0200470 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100471
472 if( max_len > mfl )
473 max_len = mfl;
Hanno Beckerf4b010e2018-08-24 10:47:29 +0100474
475 /* By the standard (RFC 6066 Sect. 4), the MFL extension
476 * only limits the maximum record payload size, so in theory
477 * we would be allowed to pack multiple records of payload size
478 * MFL into a single datagram. However, this would mean that there's
479 * no way to explicitly communicate MTU restrictions to the peer.
480 *
481 * The following reduction of max_len makes sure that we never
482 * write datagrams larger than MFL + Record Expansion Overhead.
483 */
484 if( max_len <= ssl->out_left )
485 return( 0 );
486
487 max_len -= ssl->out_left;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100488#endif
489
490 ret = ssl_get_remaining_space_in_datagram( ssl );
491 if( ret < 0 )
492 return( ret );
493 remaining = (size_t) ret;
494
495 ret = mbedtls_ssl_get_record_expansion( ssl );
496 if( ret < 0 )
497 return( ret );
498 expansion = (size_t) ret;
499
500 if( remaining <= expansion )
501 return( 0 );
502
503 remaining -= expansion;
504 if( remaining >= max_len )
505 remaining = max_len;
506
507 return( (int) remaining );
508}
509
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200510/*
511 * Double the retransmit timeout value, within the allowed range,
512 * returning -1 if the maximum value has already been reached.
513 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200514static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200515{
516 uint32_t new_timeout;
517
Hanno Becker1f835fa2019-06-13 10:14:59 +0100518 if( ssl->handshake->retransmit_timeout >=
519 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
520 {
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200521 return( -1 );
Hanno Becker1f835fa2019-06-13 10:14:59 +0100522 }
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200523
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200524 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
525 * in the following way: after the initial transmission and a first
526 * retransmission, back off to a temporary estimated MTU of 508 bytes.
527 * This value is guaranteed to be deliverable (if not guaranteed to be
528 * delivered) of any compliant IPv4 (and IPv6) network, and should work
529 * on most non-IP stacks too. */
Hanno Becker1f835fa2019-06-13 10:14:59 +0100530 if( ssl->handshake->retransmit_timeout !=
531 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) )
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400532 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200533 ssl->handshake->mtu = 508;
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400534 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl->handshake->mtu ) );
535 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200536
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200537 new_timeout = 2 * ssl->handshake->retransmit_timeout;
538
539 /* Avoid arithmetic overflow and range overflow */
540 if( new_timeout < ssl->handshake->retransmit_timeout ||
Hanno Becker1f835fa2019-06-13 10:14:59 +0100541 new_timeout > mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200542 {
Hanno Becker1f835fa2019-06-13 10:14:59 +0100543 new_timeout = mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200544 }
545
546 ssl->handshake->retransmit_timeout = new_timeout;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200547 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200548 ssl->handshake->retransmit_timeout ) );
549
550 return( 0 );
551}
552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200553static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200554{
Hanno Becker1f835fa2019-06-13 10:14:59 +0100555 ssl->handshake->retransmit_timeout = mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200556 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200557 ssl->handshake->retransmit_timeout ) );
558}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200559#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200560
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200561#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200562/*
563 * Convert max_fragment_length codes to length.
564 * RFC 6066 says:
565 * enum{
566 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
567 * } MaxFragmentLength;
568 * and we add 0 -> extension unused
569 */
Angus Grattond8213d02016-05-25 20:56:48 +1000570static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200571{
Angus Grattond8213d02016-05-25 20:56:48 +1000572 switch( mfl )
573 {
574 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300575 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000576 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
577 return 512;
578 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
579 return 1024;
580 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
581 return 2048;
582 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
583 return 4096;
584 default:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300585 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000586 }
587}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200588#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200589
Hanno Becker58fccf22019-02-06 14:30:46 +0000590int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
591 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200592{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200593 mbedtls_ssl_session_free( dst );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300594 mbedtls_platform_memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200595
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerd5258fa2019-02-07 12:27:42 +0000597
598#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200599 if( src->peer_cert != NULL )
600 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200601 int ret;
602
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200603 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200604 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200605 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200607 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200608
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200609 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200610 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200611 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200612 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200613 dst->peer_cert = NULL;
614 return( ret );
615 }
616 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100617#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000618 if( src->peer_cert_digest != NULL )
619 {
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000620 dst->peer_cert_digest =
Hanno Becker9d64b782019-02-25 10:06:59 +0000621 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000622 if( dst->peer_cert_digest == NULL )
623 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
624
Teppo Järvelin91d79382019-10-02 09:09:31 +0300625 mbedtls_platform_memcpy( dst->peer_cert_digest, src->peer_cert_digest,
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000626 src->peer_cert_digest_len );
627 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Becker9d64b782019-02-25 10:06:59 +0000628 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000629 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100630#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200632#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200633
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200634#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200635 if( src->ticket != NULL )
636 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200637 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200638 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200639 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200640
Teppo Järvelin91d79382019-10-02 09:09:31 +0300641 mbedtls_platform_memcpy( dst->ticket, src->ticket, src->ticket_len );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200642 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200643#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200644
645 return( 0 );
646}
647
Andrzej Kurekf3844952020-10-16 23:03:01 +0200648#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
649static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
650{
651 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
652 if( resized_buffer == NULL )
653 return -1;
654
655 /* We want to copy len_new bytes when downsizing the buffer, and
656 * len_old bytes when upsizing, so we choose the smaller of two sizes,
657 * to fit one buffer into another. Size checks, ensuring that no data is
658 * lost, are done outside of this function. */
659 memcpy( resized_buffer, *buffer,
660 ( len_new < *len_old ) ? len_new : *len_old );
661 mbedtls_platform_zeroize( *buffer, *len_old );
662 mbedtls_free( *buffer );
663
664 *buffer = resized_buffer;
665 *len_old = len_new;
666
667 return 0;
668}
669#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200671#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
672int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
Paul Bakker9af723c2014-05-01 13:03:14 +0200673 const unsigned char *key_enc, const unsigned char *key_dec,
674 size_t keylen,
675 const unsigned char *iv_enc, const unsigned char *iv_dec,
676 size_t ivlen,
677 const unsigned char *mac_enc, const unsigned char *mac_dec,
Paul Bakker66d5d072014-06-17 16:39:18 +0200678 size_t maclen ) = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200679int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
680int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
681int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
682int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
683int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
684#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000685
Paul Bakker5121ce52009-01-03 21:22:43 +0000686/*
687 * Key material generation
688 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200689#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +0100690MBEDTLS_NO_INLINE static int ssl3_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200691 const char *label,
692 const unsigned char *random, size_t rlen,
Paul Bakker5f70b252012-09-13 14:23:06 +0000693 unsigned char *dstbuf, size_t dlen )
694{
Andres Amaya Garcia33952502017-07-20 16:29:16 +0100695 int ret = 0;
Paul Bakker5f70b252012-09-13 14:23:06 +0000696 size_t i;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200697 mbedtls_md5_context md5;
698 mbedtls_sha1_context sha1;
Paul Bakker5f70b252012-09-13 14:23:06 +0000699 unsigned char padding[16];
700 unsigned char sha1sum[20];
Andrzej Kurekafec8852020-07-15 16:31:27 -0400701 ((void)label);
Paul Bakker5f70b252012-09-13 14:23:06 +0000702
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200703 mbedtls_md5_init( &md5 );
704 mbedtls_sha1_init( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +0200705
Paul Bakker5f70b252012-09-13 14:23:06 +0000706 /*
707 * SSLv3:
708 * block =
709 * MD5( secret + SHA1( 'A' + secret + random ) ) +
710 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
711 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
712 * ...
713 */
714 for( i = 0; i < dlen / 16; i++ )
715 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200716 mbedtls_platform_memset( padding, (unsigned char) ('A' + i), 1 + i );
Paul Bakker5f70b252012-09-13 14:23:06 +0000717
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100718 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100719 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100720 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100721 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100722 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100723 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100724 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100725 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100726 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100727 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000728
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100729 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100730 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100731 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100732 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100733 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100734 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100735 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100736 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000737 }
738
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100739exit:
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200740 mbedtls_md5_free( &md5 );
741 mbedtls_sha1_free( &sha1 );
Paul Bakker5f70b252012-09-13 14:23:06 +0000742
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500743 mbedtls_platform_zeroize( padding, sizeof( padding ) );
744 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5f70b252012-09-13 14:23:06 +0000745
Andrzej Kurekafec8852020-07-15 16:31:27 -0400746 return( ret );
Paul Bakker5f70b252012-09-13 14:23:06 +0000747}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200748#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +0000749
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200750#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +0100751MBEDTLS_NO_INLINE static int tls1_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200752 const char *label,
753 const unsigned char *random, size_t rlen,
Paul Bakker23986e52011-04-24 08:57:21 +0000754 unsigned char *dstbuf, size_t dlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000755{
Paul Bakker23986e52011-04-24 08:57:21 +0000756 size_t nb, hs;
757 size_t i, j, k;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200758 const unsigned char *S1, *S2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000759 unsigned char tmp[128];
760 unsigned char h_i[20];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100761 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200762 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100763 int ret;
764
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200765 mbedtls_md_init( &md_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +0000766
767 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200768 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000769
770 hs = ( slen + 1 ) / 2;
771 S1 = secret;
772 S2 = secret + slen - hs;
773
774 nb = strlen( label );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300775 mbedtls_platform_memcpy( tmp + 20, label, nb );
776 mbedtls_platform_memcpy( tmp + 20 + nb, random, rlen );
Paul Bakker5121ce52009-01-03 21:22:43 +0000777 nb += rlen;
778
779 /*
780 * First compute P_md5(secret,label+random)[0..dlen]
781 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100782 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) ==
783 MBEDTLS_MD_INVALID_HANDLE )
784 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200785 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100786 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100787
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200788 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100789 return( ret );
790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200791 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
792 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
793 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000794
795 for( i = 0; i < dlen; i += 16 )
796 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200797 mbedtls_md_hmac_reset ( &md_ctx );
798 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
799 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100800
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200801 mbedtls_md_hmac_reset ( &md_ctx );
802 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
803 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000804
805 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
806
807 for( j = 0; j < k; j++ )
808 dstbuf[i + j] = h_i[j];
809 }
810
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200811 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100812
Paul Bakker5121ce52009-01-03 21:22:43 +0000813 /*
814 * XOR out with P_sha1(secret,label+random)[0..dlen]
815 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100816 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) ==
817 MBEDTLS_MD_INVALID_HANDLE )
818 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200819 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100820 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100821
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200822 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100823 return( ret );
824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200825 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
826 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
827 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000828
829 for( i = 0; i < dlen; i += 20 )
830 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200831 mbedtls_md_hmac_reset ( &md_ctx );
832 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
833 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100834
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200835 mbedtls_md_hmac_reset ( &md_ctx );
836 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
837 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000838
839 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
840
841 for( j = 0; j < k; j++ )
842 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
843 }
844
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200845 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100846
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500847 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
848 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000849
Andrzej Kurekafec8852020-07-15 16:31:27 -0400850 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000851}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200852#endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000853
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200854#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerf6cc7422019-08-16 14:34:52 +0100855#if !( defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_SHA512_C) )
856MBEDTLS_ALWAYS_INLINE static inline
857#else
858static
859#endif
860int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100861 const unsigned char *secret, size_t slen,
862 const char *label,
863 const unsigned char *random, size_t rlen,
864 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000865{
866 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100867 size_t i, j, k, md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000868 unsigned char tmp[128];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200869 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100870 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200871 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100872 int ret;
873
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200874 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000875
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100876 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) ==
877 MBEDTLS_MD_INVALID_HANDLE )
878 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200879 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100880 }
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200882 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100883
884 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200885 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000886
887 nb = strlen( label );
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200888 (void)mbedtls_platform_memcpy( tmp + md_len, label, nb );
889 (void)mbedtls_platform_memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000890 nb += rlen;
891
892 /*
893 * Compute P_<hash>(secret, label + random)[0..dlen]
894 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200895 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100896 return( ret );
897
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200898 if ( ( ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen ) ) != 0 )
899 return( ret );
900 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb ) ) != 0 )
901 return( ret );
902 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
903 return( ret );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100904
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100905 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000906 {
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200907 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
908 return( ret );
909 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb ) ) != 0 )
910 return( ret );
911 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, h_i ) ) != 0 )
912 return( ret );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100913
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200914 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
915 return( ret );
916 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len ) ) != 0 )
917 return( ret );
918 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
919 return( ret );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000920
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100921 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000922
923 for( j = 0; j < k; j++ )
924 dstbuf[i + j] = h_i[j];
925 }
926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200927 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100928
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200929 (void)mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
930 (void)mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000931
Andrzej Kurekafec8852020-07-15 16:31:27 -0400932 return( 0 );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000933}
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100934
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200935#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +0100936MBEDTLS_NO_INLINE static int tls_prf_sha256(
937 const unsigned char *secret, size_t slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100938 const char *label,
939 const unsigned char *random, size_t rlen,
940 unsigned char *dstbuf, size_t dlen )
941{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200942 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100943 label, random, rlen, dstbuf, dlen ) );
944}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200947#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +0100948MBEDTLS_NO_INLINE static int tls_prf_sha384(
949 const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200950 const char *label,
951 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000952 unsigned char *dstbuf, size_t dlen )
953{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200954 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100955 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +0000956}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200957#endif /* MBEDTLS_SHA512_C */
958#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +0000959
Hanno Becker39c7f7e2019-08-15 16:17:34 +0100960/*
961 * Call the appropriate PRF function
962 */
Hanno Becker2793f742019-08-16 14:28:43 +0100963MBEDTLS_ALWAYS_INLINE static inline int ssl_prf( int minor_ver,
Hanno Becker39c7f7e2019-08-15 16:17:34 +0100964 mbedtls_md_type_t hash,
965 const unsigned char *secret, size_t slen,
966 const char *label,
967 const unsigned char *random, size_t rlen,
968 unsigned char *dstbuf, size_t dlen )
969{
970#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
971 (void) hash;
972#endif
973
974#if defined(MBEDTLS_SSL_PROTO_SSL3)
975 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
976 return( ssl3_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
977 else
978#endif
979#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +0100980 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker39c7f7e2019-08-15 16:17:34 +0100981 return( tls1_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
982 else
983#endif
984#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
985#if defined(MBEDTLS_SHA512_C)
986 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
987 hash == MBEDTLS_MD_SHA384 )
988 {
989 return( tls_prf_sha384( secret, slen, label, random, rlen,
990 dstbuf, dlen ) );
991 }
992 else
993#endif
994#if defined(MBEDTLS_SHA256_C)
995 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
996 {
997 return( tls_prf_sha256( secret, slen, label, random, rlen,
998 dstbuf, dlen ) );
999 }
1000#endif
1001#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1002
1003 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1004}
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001005
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001006#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +01001007MBEDTLS_NO_INLINE static void ssl_calc_finished_ssl(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001008 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1009{
1010 const char *sender;
1011 mbedtls_md5_context md5;
1012 mbedtls_sha1_context sha1;
1013
1014 unsigned char padbuf[48];
1015 unsigned char md5sum[16];
1016 unsigned char sha1sum[20];
1017
1018 mbedtls_ssl_session *session = ssl->session_negotiate;
1019 if( !session )
1020 session = ssl->session;
1021
1022 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
1023
1024 mbedtls_md5_init( &md5 );
1025 mbedtls_sha1_init( &sha1 );
1026
1027 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1028 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1029
1030 /*
1031 * SSLv3:
1032 * hash =
1033 * MD5( master + pad2 +
1034 * MD5( handshake + sender + master + pad1 ) )
1035 * + SHA1( master + pad2 +
1036 * SHA1( handshake + sender + master + pad1 ) )
1037 */
1038
1039#if !defined(MBEDTLS_MD5_ALT)
1040 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1041 md5.state, sizeof( md5.state ) );
1042#endif
1043
1044#if !defined(MBEDTLS_SHA1_ALT)
1045 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1046 sha1.state, sizeof( sha1.state ) );
1047#endif
1048
1049 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
1050 : "SRVR";
1051
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001052 mbedtls_platform_memset( padbuf, 0x36, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001053
1054 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
1055 mbedtls_md5_update_ret( &md5, session->master, 48 );
1056 mbedtls_md5_update_ret( &md5, padbuf, 48 );
1057 mbedtls_md5_finish_ret( &md5, md5sum );
1058
1059 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
1060 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
1061 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
1062 mbedtls_sha1_finish_ret( &sha1, sha1sum );
1063
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001064 mbedtls_platform_memset( padbuf, 0x5C, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001065
1066 mbedtls_md5_starts_ret( &md5 );
1067 mbedtls_md5_update_ret( &md5, session->master, 48 );
1068 mbedtls_md5_update_ret( &md5, padbuf, 48 );
1069 mbedtls_md5_update_ret( &md5, md5sum, 16 );
1070 mbedtls_md5_finish_ret( &md5, buf );
1071
1072 mbedtls_sha1_starts_ret( &sha1 );
1073 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
1074 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
1075 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
1076 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
1077
1078 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
1079
1080 mbedtls_md5_free( &md5 );
1081 mbedtls_sha1_free( &sha1 );
1082
1083 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1084 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
1085 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
1086
1087 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1088}
1089#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1090
1091#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +01001092MBEDTLS_NO_INLINE static void ssl_calc_finished_tls(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001093 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1094{
1095 int len = 12;
1096 const char *sender;
1097 mbedtls_md5_context md5;
1098 mbedtls_sha1_context sha1;
1099 unsigned char padbuf[36];
1100
1101 mbedtls_ssl_session *session = ssl->session_negotiate;
1102 if( !session )
1103 session = ssl->session;
1104
1105 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
1106
1107 mbedtls_md5_init( &md5 );
1108 mbedtls_sha1_init( &sha1 );
1109
1110 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1111 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1112
1113 /*
1114 * TLSv1:
1115 * hash = PRF( master, finished_label,
1116 * MD5( handshake ) + SHA1( handshake ) )[0..11]
1117 */
1118
1119#if !defined(MBEDTLS_MD5_ALT)
1120 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1121 md5.state, sizeof( md5.state ) );
1122#endif
1123
1124#if !defined(MBEDTLS_SHA1_ALT)
1125 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1126 sha1.state, sizeof( sha1.state ) );
1127#endif
1128
1129 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1130 ? "client finished"
1131 : "server finished";
1132
1133 mbedtls_md5_finish_ret( &md5, padbuf );
1134 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
1135
1136 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1137 mbedtls_ssl_suite_get_mac(
1138 mbedtls_ssl_ciphersuite_from_id(
1139 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1140 session->master, 48, sender,
1141 padbuf, 36, buf, len );
1142
1143 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1144
1145 mbedtls_md5_free( &md5 );
1146 mbedtls_sha1_free( &sha1 );
1147
1148 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1149
1150 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1151}
1152#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1153
1154#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1155#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001156MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha256(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001157 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1158{
1159 int len = 12;
1160 const char *sender;
1161 mbedtls_sha256_context sha256;
1162 unsigned char padbuf[32];
1163
1164 mbedtls_ssl_session *session = ssl->session_negotiate;
1165 if( !session )
1166 session = ssl->session;
1167
1168 mbedtls_sha256_init( &sha256 );
1169
1170 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
1171
1172 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1173
1174 /*
1175 * TLSv1.2:
1176 * hash = PRF( master, finished_label,
1177 * Hash( handshake ) )[0.11]
1178 */
1179
1180#if !defined(MBEDTLS_SHA256_ALT)
1181 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
1182 sha256.state, sizeof( sha256.state ) );
1183#endif
1184
1185 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1186 ? "client finished"
1187 : "server finished";
1188
1189 mbedtls_sha256_finish_ret( &sha256, padbuf );
1190
1191 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1192 mbedtls_ssl_suite_get_mac(
1193 mbedtls_ssl_ciphersuite_from_id(
1194 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1195 session->master, 48, sender,
1196 padbuf, 32, buf, len );
1197
1198 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1199
1200 mbedtls_sha256_free( &sha256 );
1201
1202 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1203
1204 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1205}
1206#endif /* MBEDTLS_SHA256_C */
1207
1208#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001209MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha384(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001210 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1211{
1212 int len = 12;
1213 const char *sender;
1214 mbedtls_sha512_context sha512;
1215 unsigned char padbuf[48];
1216
1217 mbedtls_ssl_session *session = ssl->session_negotiate;
1218 if( !session )
1219 session = ssl->session;
1220
1221 mbedtls_sha512_init( &sha512 );
1222
1223 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
1224
1225 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1226
1227 /*
1228 * TLSv1.2:
1229 * hash = PRF( master, finished_label,
1230 * Hash( handshake ) )[0.11]
1231 */
1232
1233#if !defined(MBEDTLS_SHA512_ALT)
1234 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
1235 sha512.state, sizeof( sha512.state ) );
1236#endif
1237
1238 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1239 ? "client finished"
1240 : "server finished";
1241
1242 mbedtls_sha512_finish_ret( &sha512, padbuf );
1243
1244 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1245 mbedtls_ssl_suite_get_mac(
1246 mbedtls_ssl_ciphersuite_from_id(
1247 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1248 session->master, 48, sender,
1249 padbuf, 48, buf, len );
1250
1251 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1252
1253 mbedtls_sha512_free( &sha512 );
1254
1255 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1256
1257 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1258}
1259#endif /* MBEDTLS_SHA512_C */
1260#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1261
Hanno Becker2793f742019-08-16 14:28:43 +01001262MBEDTLS_ALWAYS_INLINE static inline int ssl_calc_finished(
1263 int minor_ver,
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001264 mbedtls_md_type_t hash,
1265 mbedtls_ssl_context *ssl,
1266 unsigned char *buf,
1267 int from )
1268{
1269#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1270 (void) hash;
1271#endif
1272
1273#if defined(MBEDTLS_SSL_PROTO_SSL3)
1274 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1275 ssl_calc_finished_ssl( ssl, buf, from );
1276 else
1277#endif
1278#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001279 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001280 ssl_calc_finished_tls( ssl, buf, from );
1281 else
1282#endif
1283#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1284#if defined(MBEDTLS_SHA512_C)
1285 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1286 hash == MBEDTLS_MD_SHA384 )
1287 {
1288 ssl_calc_finished_tls_sha384( ssl, buf, from );
1289 }
1290 else
1291#endif
1292#if defined(MBEDTLS_SHA256_C)
1293 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1294 ssl_calc_finished_tls_sha256( ssl, buf, from );
1295 else
1296#endif
1297#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1298 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1299
1300 return( 0 );
1301}
1302
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001303/*
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001304 * Populate a transform structure with session keys and all the other
1305 * necessary information.
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001306 *
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001307 * Parameters:
1308 * - [in/out]: transform: structure to populate
1309 * [in] must be just initialised with mbedtls_ssl_transform_init()
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001310 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001311 * - [in] ciphersuite
1312 * - [in] master
1313 * - [in] encrypt_then_mac
1314 * - [in] trunc_hmac
1315 * - [in] compression
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001316 * - [in] tls_prf: pointer to PRF to use for key derivation
1317 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001318 * - [in] minor_ver: SSL/TLS minor version
1319 * - [in] endpoint: client or server
1320 * - [in] ssl: optionally used for:
1321 * - MBEDTLS_SSL_HW_RECORD_ACCEL: whole context
1322 * - MBEDTLS_SSL_EXPORT_KEYS: ssl->conf->{f,p}_export_keys
1323 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001324 */
Hanno Becker298a4702019-08-16 10:21:32 +01001325/* Force compilers to inline this function if it's used only
1326 * from one place, because at least ARMC5 doesn't do that
1327 * automatically. */
1328#if !defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
1329MBEDTLS_ALWAYS_INLINE static inline
1330#else
1331static
1332#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
1333int ssl_populate_transform( mbedtls_ssl_transform *transform,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001334 int ciphersuite,
1335 const unsigned char master[48],
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001336#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001337#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1338 int encrypt_then_mac,
1339#endif
1340#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1341 int trunc_hmac,
1342#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001343#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001344#if defined(MBEDTLS_ZLIB_SUPPORT)
1345 int compression,
1346#endif
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001347 const unsigned char randbytes[64],
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001348 int minor_ver,
1349 unsigned endpoint,
Manuel Pégourié-Gonnard13bebd02020-03-13 11:28:19 +01001350#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1351 const
1352#endif
1353 mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001354{
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001355 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001356 unsigned char keyblk[256];
1357 unsigned char *key1;
1358 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +01001359 unsigned char *mac_enc;
1360 unsigned char *mac_dec;
Hanno Becker81c7b182017-11-09 18:39:33 +00001361 size_t mac_key_len;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001362 size_t iv_copy_len;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001363 unsigned keylen;
Hanno Becker473f98f2019-06-26 10:27:32 +01001364 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001365 const mbedtls_cipher_info_t *cipher_info;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001366 mbedtls_md_handle_t md_info;
Paul Bakker68884e32013-01-07 18:20:04 +01001367
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001368#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \
1369 !defined(MBEDTLS_SSL_EXPORT_KEYS) && \
1370 !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02001371 ssl = NULL; /* make sure we don't use it except for those cases */
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001372 (void) ssl;
Hanno Becker3307b532017-12-27 21:37:21 +00001373#endif
Hanno Becker3307b532017-12-27 21:37:21 +00001374
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001375 /*
1376 * Some data just needs copying into the structure
1377 */
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001378#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
1379 defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001380 transform->encrypt_then_mac = encrypt_then_mac;
Paul Bakker5121ce52009-01-03 21:22:43 +00001381#endif
Hanno Becker0a92b812019-06-24 15:46:40 +01001382
1383#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001384 transform->minor_ver = minor_ver;
Hanno Becker0a92b812019-06-24 15:46:40 +01001385#else
1386 ((void) minor_ver);
1387#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Paul Bakker5121ce52009-01-03 21:22:43 +00001388
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001389#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Teppo Järvelin91d79382019-10-02 09:09:31 +03001390 mbedtls_platform_memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001391#endif
1392
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001393 /*
1394 * Get various info structures
1395 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001396 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
Hanno Becker473f98f2019-06-26 10:27:32 +01001397 if( ciphersuite_info == MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE )
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001398 {
1399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001400 ciphersuite ) );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001401 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1402 }
1403
Hanno Becker473f98f2019-06-26 10:27:32 +01001404 cipher_info = mbedtls_cipher_info_from_type(
1405 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) );
Paul Bakker68884e32013-01-07 18:20:04 +01001406 if( cipher_info == NULL )
1407 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001408 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001409 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001410 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001411 }
1412
Hanno Becker473f98f2019-06-26 10:27:32 +01001413 md_info = mbedtls_md_info_from_type(
1414 mbedtls_ssl_suite_get_mac( ciphersuite_info ) );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001415 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Paul Bakker68884e32013-01-07 18:20:04 +01001416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001417 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001418 mbedtls_ssl_suite_get_mac( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001419 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001420 }
1421
Hanno Beckera5a2b082019-05-15 14:03:01 +01001422#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001423 /* Copy own and peer's CID if the use of the CID
1424 * extension has been negotiated. */
1425 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
1426 {
1427 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
Hanno Beckerd91dc372019-04-30 13:52:29 +01001428
Hanno Becker4932f9f2019-05-03 15:23:51 +01001429 transform->in_cid_len = ssl->own_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001430 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1431 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
Hanno Becker8013b272019-05-03 12:55:51 +01001432 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001433 transform->in_cid_len );
Hanno Beckere582d122019-05-15 10:21:55 +01001434
1435 transform->out_cid_len = ssl->handshake->peer_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001436 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1437 memcpy( transform->out_cid, ssl->handshake->peer_cid,
Hanno Beckere582d122019-05-15 10:21:55 +01001438 ssl->handshake->peer_cid_len );
1439 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
1440 transform->out_cid_len );
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001441 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01001442#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001443
Paul Bakker5121ce52009-01-03 21:22:43 +00001444 /*
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001445 * Compute key block using the PRF
Paul Bakker1ef83d62012-04-11 12:09:53 +00001446 */
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001447 ret = ssl_prf( minor_ver,
1448 mbedtls_ssl_suite_get_mac( ciphersuite_info ),
1449 master, 48, "key expansion", randbytes, 64,
1450 keyblk, 256 );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001451 if( ret != 0 )
1452 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001453 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001454 return( ret );
1455 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001456
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001457 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02001458 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001459 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001460 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001461 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001462
Paul Bakker5121ce52009-01-03 21:22:43 +00001463 /*
1464 * Determine the appropriate key, IV and MAC length.
1465 */
Paul Bakker68884e32013-01-07 18:20:04 +01001466
Hanno Beckere7f2df02017-12-27 08:17:40 +00001467 keylen = cipher_info->key_bitlen / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001468
Hanno Beckerf1229442018-01-03 15:32:31 +00001469#if defined(MBEDTLS_GCM_C) || \
1470 defined(MBEDTLS_CCM_C) || \
1471 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001472 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001473 cipher_info->mode == MBEDTLS_MODE_CCM ||
1474 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +00001475 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001476 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +00001477 mac_key_len = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01001478 transform->taglen = mbedtls_ssl_suite_get_flags( ciphersuite_info ) &
1479 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001480
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001481 /* All modes haves 96-bit IVs;
1482 * GCM and CCM has 4 implicit and 8 explicit bytes
1483 * ChachaPoly has all 12 bytes implicit
1484 */
Paul Bakker68884e32013-01-07 18:20:04 +01001485 transform->ivlen = 12;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001486 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
1487 transform->fixed_ivlen = 12;
1488 else
1489 transform->fixed_ivlen = 4;
Paul Bakker68884e32013-01-07 18:20:04 +01001490 }
1491 else
Hanno Beckerf1229442018-01-03 15:32:31 +00001492#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
1493#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1494 if( cipher_info->mode == MBEDTLS_MODE_STREAM ||
1495 cipher_info->mode == MBEDTLS_MODE_CBC )
Paul Bakker68884e32013-01-07 18:20:04 +01001496 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001497 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001498 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
1499 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001500 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001501 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001502 return( ret );
Paul Bakker68884e32013-01-07 18:20:04 +01001503 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001504
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001505 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +00001506 mac_key_len = mbedtls_md_get_size( md_info );
1507 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001508
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001509#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001510 /*
1511 * If HMAC is to be truncated, we shall keep the leftmost bytes,
1512 * (rfc 6066 page 13 or rfc 2104 section 4),
1513 * so we only need to adjust the length here.
1514 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001515 if( trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Hanno Beckere89353a2017-11-20 16:36:41 +00001516 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001517 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
Hanno Beckere89353a2017-11-20 16:36:41 +00001518
1519#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
1520 /* Fall back to old, non-compliant version of the truncated
Hanno Becker563423f2017-11-21 17:20:17 +00001521 * HMAC implementation which also truncates the key
1522 * (Mbed TLS versions from 1.3 to 2.6.0) */
Hanno Beckere89353a2017-11-20 16:36:41 +00001523 mac_key_len = transform->maclen;
1524#endif
1525 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001526#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001527
1528 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +01001529 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001530 }
Hanno Beckerf1229442018-01-03 15:32:31 +00001531 else
1532#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1533 {
1534 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1535 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1536 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001537
Hanno Beckera9d5c452019-07-25 16:47:12 +01001538 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, ivlen: %u, maclen: %u",
Hanno Beckere7f2df02017-12-27 08:17:40 +00001539 (unsigned) keylen,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001540 (unsigned) transform->ivlen,
1541 (unsigned) transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001542
1543 /*
1544 * Finally setup the cipher contexts, IVs and MAC secrets.
1545 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001546#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001547 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00001548 {
Hanno Becker81c7b182017-11-09 18:39:33 +00001549 key1 = keyblk + mac_key_len * 2;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001550 key2 = keyblk + mac_key_len * 2 + keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +00001551
Paul Bakker68884e32013-01-07 18:20:04 +01001552 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +00001553 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001554
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001555 /*
1556 * This is not used in TLS v1.1.
1557 */
Paul Bakker48916f92012-09-16 19:57:18 +00001558 iv_copy_len = ( transform->fixed_ivlen ) ?
1559 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001560 mbedtls_platform_memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
1561 mbedtls_platform_memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001562 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001563 }
1564 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001565#endif /* MBEDTLS_SSL_CLI_C */
1566#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001567 if( endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00001568 {
Hanno Beckere7f2df02017-12-27 08:17:40 +00001569 key1 = keyblk + mac_key_len * 2 + keylen;
Hanno Becker81c7b182017-11-09 18:39:33 +00001570 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00001571
Hanno Becker81c7b182017-11-09 18:39:33 +00001572 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +01001573 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +00001574
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001575 /*
1576 * This is not used in TLS v1.1.
1577 */
Paul Bakker48916f92012-09-16 19:57:18 +00001578 iv_copy_len = ( transform->fixed_ivlen ) ?
1579 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001580 mbedtls_platform_memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
1581 mbedtls_platform_memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001582 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001583 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001584 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001585#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001586 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001587 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1588 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001589 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001590
Hanno Becker92231322018-01-03 15:32:51 +00001591#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001592#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001593 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001594 {
Hanno Becker92231322018-01-03 15:32:51 +00001595 if( mac_key_len > sizeof( transform->mac_enc ) )
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001596 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001597 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1598 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001599 }
1600
Teppo Järvelin91d79382019-10-02 09:09:31 +03001601 mbedtls_platform_memcpy( transform->mac_enc, mac_enc, mac_key_len );
1602 mbedtls_platform_memcpy( transform->mac_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +01001603 }
1604 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001605#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1606#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1607 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001608 if( mbedtls_ssl_ver_geq( minor_ver, MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakker68884e32013-01-07 18:20:04 +01001609 {
Gilles Peskine039fd122018-03-19 19:06:08 +01001610 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1611 For AEAD-based ciphersuites, there is nothing to do here. */
1612 if( mac_key_len != 0 )
1613 {
1614 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
1615 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
1616 }
Paul Bakker68884e32013-01-07 18:20:04 +01001617 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001618 else
1619#endif
Paul Bakker577e0062013-08-28 11:57:20 +02001620 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001621 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1622 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02001623 }
Hanno Becker92231322018-01-03 15:32:51 +00001624#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker68884e32013-01-07 18:20:04 +01001625
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001626#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1627 if( mbedtls_ssl_hw_record_init != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00001628 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001629 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00001630
Hanno Beckere7f2df02017-12-27 08:17:40 +00001631 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen,
Paul Bakker07eb38b2012-12-19 14:42:06 +01001632 transform->iv_enc, transform->iv_dec,
1633 iv_copy_len,
Paul Bakker68884e32013-01-07 18:20:04 +01001634 mac_enc, mac_dec,
Hanno Becker81c7b182017-11-09 18:39:33 +00001635 mac_key_len ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00001636 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001637 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1638 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00001639 }
1640 }
Hanno Becker92231322018-01-03 15:32:51 +00001641#else
1642 ((void) mac_dec);
1643 ((void) mac_enc);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001644#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00001645
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001646#if defined(MBEDTLS_SSL_EXPORT_KEYS)
1647 if( ssl->conf->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001648 {
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001649 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001650 master, keyblk,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001651 mac_key_len, keylen,
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001652 iv_copy_len );
1653 }
1654#endif
Andrzej Kurek11750442020-09-17 07:12:06 -04001655#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
1656 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx,
1657 cipher_info ) ) != 0 )
1658 {
1659 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1660 return( ret );
1661 }
1662 transform->key_enc = mbedtls_calloc( 1, cipher_info->key_bitlen >> 3 );
1663 transform->key_dec = mbedtls_calloc( 1, cipher_info->key_bitlen >> 3 );
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001664
Andrzej Kurek28b3b292020-10-22 11:40:41 +02001665 if( transform->key_enc == NULL || transform->key_dec == NULL )
1666 {
1667 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to allocate cipher keys" ) );
1668 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1669 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001670 memcpy( transform->key_enc, key1, cipher_info->key_bitlen >> 3 );
1671 memcpy( transform->key_dec, key2, cipher_info->key_bitlen >> 3 );
1672
1673 transform->key_bitlen = cipher_info->key_bitlen;
Andrzej Kureka7932372020-09-19 07:56:06 +02001674#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
1675 transform->key_enc_hash = mbedtls_hash( transform->key_enc, transform->key_bitlen >> 3 );
1676 transform->key_dec_hash = mbedtls_hash( transform->key_dec, transform->key_bitlen >> 3 );
1677#endif
1678
Andrzej Kurek11750442020-09-17 07:12:06 -04001679#else
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001680 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001681 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001682 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001683 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001684 return( ret );
1685 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001686
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001687 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001688 cipher_info ) ) != 0 )
1689 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001690 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001691 return( ret );
1692 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001693
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001694 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001695 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001696 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001697 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001698 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001699 return( ret );
1700 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001701
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001702 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001703 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001704 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001705 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001706 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001707 return( ret );
1708 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001709#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001710#if defined(MBEDTLS_CIPHER_MODE_CBC)
1711 if( cipher_info->mode == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001712 {
Andrzej Kurek11750442020-09-17 07:12:06 -04001713#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
1714 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx,
1715 MBEDTLS_PADDING_NONE ) ) != 0 )
1716 {
1717 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1718 return( ret );
1719 }
1720#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001721 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1722 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001723 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001724 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001725 return( ret );
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001726 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001727
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001728 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1729 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001730 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001731 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001732 return( ret );
1733 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001734#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001735 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001736#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001737
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001738 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001739
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02001740 /* Initialize Zlib contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001741#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001742 if( compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001743 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001744 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001745
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001746 mbedtls_platform_memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1747 mbedtls_platform_memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001748
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001749 if( deflateInit( &transform->ctx_deflate,
1750 Z_DEFAULT_COMPRESSION ) != Z_OK ||
Paul Bakker48916f92012-09-16 19:57:18 +00001751 inflateInit( &transform->ctx_inflate ) != Z_OK )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001752 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001753 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1754 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001755 }
1756 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001757#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00001758
Paul Bakker5121ce52009-01-03 21:22:43 +00001759 return( 0 );
1760}
1761
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001762#if defined(MBEDTLS_SSL_PROTO_SSL3)
1763static inline void ssl_calc_verify_ssl( const mbedtls_ssl_context *ssl,
1764 unsigned char hash[36],
1765 size_t *hlen )
1766{
1767 mbedtls_md5_context md5;
1768 mbedtls_sha1_context sha1;
1769 unsigned char pad_1[48];
1770 unsigned char pad_2[48];
1771
1772 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
1773
1774 mbedtls_md5_init( &md5 );
1775 mbedtls_sha1_init( &sha1 );
1776
1777 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1778 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1779
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001780 mbedtls_platform_memset( pad_1, 0x36, 48 );
1781 mbedtls_platform_memset( pad_2, 0x5C, 48 );
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001782
1783 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1784 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1785 mbedtls_md5_finish_ret( &md5, hash );
1786
1787 mbedtls_md5_starts_ret( &md5 );
1788 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1789 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1790 mbedtls_md5_update_ret( &md5, hash, 16 );
1791 mbedtls_md5_finish_ret( &md5, hash );
1792
1793 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1794 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1795 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1796
1797 mbedtls_sha1_starts_ret( &sha1 );
1798 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1799 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1800 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1801 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1802
1803 *hlen = 36;
1804
1805 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1806 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1807
1808 mbedtls_md5_free( &md5 );
1809 mbedtls_sha1_free( &sha1 );
1810
1811 return;
1812}
1813#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1814
1815#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1816static inline void ssl_calc_verify_tls( const mbedtls_ssl_context *ssl,
1817 unsigned char hash[36],
1818 size_t *hlen )
1819{
1820 mbedtls_md5_context md5;
1821 mbedtls_sha1_context sha1;
1822
1823 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
1824
1825 mbedtls_md5_init( &md5 );
1826 mbedtls_sha1_init( &sha1 );
1827
1828 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1829 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1830
1831 mbedtls_md5_finish_ret( &md5, hash );
1832 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1833
1834 *hlen = 36;
1835
1836 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1837 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1838
1839 mbedtls_md5_free( &md5 );
1840 mbedtls_sha1_free( &sha1 );
1841
1842 return;
1843}
1844#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1845
1846#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1847#if defined(MBEDTLS_SHA256_C)
1848static inline void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1849 unsigned char hash[32],
1850 size_t *hlen )
1851{
1852 mbedtls_sha256_context sha256;
1853
1854 mbedtls_sha256_init( &sha256 );
1855
1856 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1857
1858 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1859 mbedtls_sha256_finish_ret( &sha256, hash );
1860
1861 *hlen = 32;
1862
1863 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1864 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1865
1866 mbedtls_sha256_free( &sha256 );
1867
1868 return;
1869}
1870#endif /* MBEDTLS_SHA256_C */
1871
1872#if defined(MBEDTLS_SHA512_C)
1873static inline void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1874 unsigned char hash[48],
1875 size_t *hlen )
1876{
1877 mbedtls_sha512_context sha512;
1878
1879 mbedtls_sha512_init( &sha512 );
1880
1881 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1882
1883 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1884 mbedtls_sha512_finish_ret( &sha512, hash );
1885
1886 *hlen = 48;
1887
1888 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1889 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1890
1891 mbedtls_sha512_free( &sha512 );
1892
1893 return;
1894}
1895#endif /* MBEDTLS_SHA512_C */
1896#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1897
Hanno Becker2f41b242019-08-15 17:29:43 +01001898int mbedtls_ssl_calc_verify( int minor_ver,
1899 mbedtls_md_type_t hash,
1900 mbedtls_ssl_context const *ssl,
1901 unsigned char *dst,
1902 size_t *hlen )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001903{
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001904#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1905 (void) hash;
1906#endif
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001907
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001908#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001909 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker2f41b242019-08-15 17:29:43 +01001910 ssl_calc_verify_ssl( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001911 else
1912#endif
1913#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001914 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker2f41b242019-08-15 17:29:43 +01001915 ssl_calc_verify_tls( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001916 else
1917#endif
1918#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1919#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001920 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1921 hash == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001922 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001923 ssl_calc_verify_tls_sha384( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001924 }
1925 else
1926#endif
1927#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001928 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001929 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001930 ssl_calc_verify_tls_sha256( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001931 }
1932 else
1933#endif
1934#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1935 {
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001936 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1937 }
1938
1939 return( 0 );
1940}
1941
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001942/*
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001943 * Compute master secret if needed
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001944 *
1945 * Parameters:
1946 * [in/out] handshake
1947 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
1948 * [out] premaster (cleared)
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001949 * [out] master
1950 * [in] ssl: optionally used for debugging and calc_verify
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001951 */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001952static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001953 unsigned char *master,
Manuel Pégourié-Gonnarded3b7a92019-05-03 09:58:33 +02001954 const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001955{
1956 int ret;
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001957
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001958/* #if !defined(MBEDTLS_DEBUG_C) && !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) */
1959/* ssl = NULL; /\* make sure we don't use it except for debug and EMS *\/ */
1960/* (void) ssl; */
1961/* #endif */
1962
1963 mbedtls_ssl_ciphersuite_handle_t const ciphersuite =
1964 mbedtls_ssl_handshake_get_ciphersuite( handshake );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001965
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03001966#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02001967 if( handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001968 {
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001969 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
1970 return( 0 );
1971 }
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03001972#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001973
1974 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
1975 handshake->pmslen );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001976
1977#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckera49ec562019-06-11 14:47:55 +01001978 if( mbedtls_ssl_hs_get_extended_ms( handshake )
1979 == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001980 {
1981 unsigned char session_hash[48];
1982 size_t hash_len;
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001983
Hanno Becker2f41b242019-08-15 17:29:43 +01001984 mbedtls_ssl_calc_verify(
1985 mbedtls_ssl_get_minor_ver( ssl ),
1986 mbedtls_ssl_suite_get_mac( ciphersuite ),
1987 ssl, session_hash, &hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001988
Manuel Pégourié-Gonnard9c5bcc92019-05-20 12:09:50 +02001989 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
1990 session_hash, hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001991
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001992 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1993 mbedtls_ssl_suite_get_mac( ciphersuite ),
1994 handshake->premaster, handshake->pmslen,
1995 "extended master secret",
1996 session_hash, hash_len,
1997 master, 48 );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001998 }
1999 else
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002000#endif
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02002001 {
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002002 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
2003 mbedtls_ssl_suite_get_mac( ciphersuite ),
2004 handshake->premaster, handshake->pmslen,
2005 "master secret",
2006 handshake->randbytes, 64,
2007 master, 48 );
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02002008 }
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002009 if( ret != 0 )
2010 {
2011 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
2012 return( ret );
2013 }
2014
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02002015 if( handshake->premaster == mbedtls_platform_zeroize(
Piotr Nowickia6348ed2020-06-29 15:03:56 +02002016 handshake->premaster, sizeof(handshake->premaster) ) )
2017 {
2018 return( 0 );
2019 }
2020
2021 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002022}
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002023
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02002024int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
2025{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04002026 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002027
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002028 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
Jarno Lamsa4031a452019-12-19 08:11:12 +02002029 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_UNSET;
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002030 /* Compute master secret if needed */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002031 ret = ssl_compute_master( ssl->handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002032 ssl->session_negotiate->master,
2033 ssl );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002034 if( ret != 0 )
2035 {
2036 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
2037 return( ret );
2038 }
2039
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002040 /* Swap the client and server random values:
2041 * - MS derivation wanted client+server (RFC 5246 8.1)
2042 * - key derivation wants server+client (RFC 5246 6.3) */
2043 {
2044 unsigned char tmp[64];
Teppo Järvelin91d79382019-10-02 09:09:31 +03002045 mbedtls_platform_memcpy( tmp, ssl->handshake->randbytes, 64 );
2046 mbedtls_platform_memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
2047 mbedtls_platform_memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002048 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
2049 }
2050
2051 /* Populate transform structure */
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02002052 ret = ssl_populate_transform( ssl->transform_negotiate,
Hanno Beckere02758c2019-06-26 15:31:31 +01002053 mbedtls_ssl_session_get_ciphersuite( ssl->session_negotiate ),
2054 ssl->session_negotiate->master,
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01002055#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002056#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01002057 ssl->session_negotiate->encrypt_then_mac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002058#endif
2059#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01002060 ssl->session_negotiate->trunc_hmac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002061#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01002062#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002063#if defined(MBEDTLS_ZLIB_SUPPORT)
Hanno Beckere02758c2019-06-26 15:31:31 +01002064 ssl->session_negotiate->compression,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002065#endif
Hanno Beckere02758c2019-06-26 15:31:31 +01002066 ssl->handshake->randbytes,
Hanno Becker2881d802019-05-22 14:44:53 +01002067 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Beckere02758c2019-06-26 15:31:31 +01002068 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
2069 ssl );
Jarno Lamsa4031a452019-12-19 08:11:12 +02002070 if( ret == 0 )
2071 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002072 mbedtls_platform_random_delay();
Jarno Lamsa4031a452019-12-19 08:11:12 +02002073 if( ret == 0 )
2074 {
2075 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_SET;
2076 }
2077 else
2078 {
2079 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2080 }
2081 }
2082 else
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002083 {
2084 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
2085 return( ret );
2086 }
2087
2088 /* We no longer need Server/ClientHello.random values */
2089 mbedtls_platform_zeroize( ssl->handshake->randbytes,
2090 sizeof( ssl->handshake->randbytes ) );
2091
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002092 /* Allocate compression buffer */
2093#if defined(MBEDTLS_ZLIB_SUPPORT)
jiblime92af9a92019-12-18 21:40:01 -08002094 if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002095 ssl->compress_buf == NULL )
2096 {
2097 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
2098 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
2099 if( ssl->compress_buf == NULL )
2100 {
2101 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02002102 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002103 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2104 }
2105 }
2106#endif
2107
Paul Bakker5121ce52009-01-03 21:22:43 +00002108 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
2109
2110 return( 0 );
2111}
2112
Hanno Becker09d23642019-07-22 17:18:18 +01002113int mbedtls_ssl_build_pms( mbedtls_ssl_context *ssl )
2114{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04002115 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker09d23642019-07-22 17:18:18 +01002116
2117 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
2118 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Beckera3c2c172019-07-23 16:51:57 +01002119#if defined(MBEDTLS_USE_TINYCRYPT)
2120 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01002121 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
Hanno Beckera3c2c172019-07-23 16:51:57 +01002122 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01002123 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2124 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2125 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2126 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2127 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002128 {
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002129 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2130 ssl->handshake->ecdh_privkey,
2131 ssl->handshake->premaster );
2132 if( ret == UECC_FAULT_DETECTED )
2133 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2134 if( ret != UECC_SUCCESS )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002135 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002136 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Hanno Beckera3c2c172019-07-23 16:51:57 +01002137
2138 ssl->handshake->pmslen = NUM_ECC_BYTES;
2139 }
2140 else
2141#endif
Hanno Becker09d23642019-07-22 17:18:18 +01002142#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
2143 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2144 == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
2145 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002146 ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002147 ssl->handshake->premaster,
2148 MBEDTLS_PREMASTER_SIZE,
2149 &ssl->handshake->pmslen,
2150 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002151 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2152 if( ret == 0 )
2153 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002154 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002155 if( ret == 0 )
2156 {
2157 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2158 }
2159 else
2160 {
Piotr Nowickie048b912020-06-05 17:59:28 +02002161 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret",
2162 MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2163 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002164 }
2165 }
2166 else
Hanno Becker09d23642019-07-22 17:18:18 +01002167 {
2168 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
2169 return( ret );
2170 }
2171
2172 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
2173 }
2174 else
2175#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
Hanno Becker29d16552019-07-24 11:11:45 +01002176#if defined(MBEDTLS_ECDH_C) && \
2177 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2178 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2179 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2180 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) )
Hanno Becker09d23642019-07-22 17:18:18 +01002181 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2182 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2183 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2184 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2185 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2186 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2187 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2188 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2189 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002190 ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002191 &ssl->handshake->pmslen,
2192 ssl->handshake->premaster,
2193 MBEDTLS_MPI_MAX_SIZE,
2194 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002195 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2196 if( ret == 0 )
2197 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002198 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002199 if( ret == 0 )
2200 {
2201 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2202 }
2203 else
2204 {
2205 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002206 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002207 }
2208 }
2209 else
Hanno Becker09d23642019-07-22 17:18:18 +01002210 {
2211 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
2212 return( ret );
2213 }
2214
2215 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
2216 }
2217 else
2218#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2219 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2220 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2221 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2222#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2223 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
2224 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002225 ret = mbedtls_ssl_psk_derive_premaster( ssl,
2226 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) );
2227 if( ret == 0 )
2228 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002229 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002230 if( ret == 0 )
2231 {
2232 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2233 }
2234 else
2235 {
2236 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002237 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002238 }
2239 }
2240 else
Hanno Becker09d23642019-07-22 17:18:18 +01002241 {
2242 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
2243 return( ret );
2244 }
2245 }
2246 else
2247#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2248#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2249 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
2250 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2251 {
2252 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
2253 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
2254 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002255 mbedtls_ssl_conf_get_prng( ssl->conf ) );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002256 if( ret == 0 )
2257 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002258 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002259 if( ret == 0 )
2260 {
2261 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2262 }
2263 else
2264 {
2265 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002266 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002267 }
2268 }
2269 else
Hanno Becker09d23642019-07-22 17:18:18 +01002270 {
2271 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
2272 return( ret );
2273 }
2274 }
2275 else
2276#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2277#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
2278 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2279 == MBEDTLS_KEY_EXCHANGE_RSA )
2280 {
2281 ((void) ret);
Manuel Pégourié-Gonnard8793fab2019-08-01 10:44:07 +02002282 /* The premaster secret has already been set by
Hanno Becker09d23642019-07-22 17:18:18 +01002283 * ssl_rsa_generate_partial_pms(). Only the
2284 * PMS length needs to be set. */
2285 ssl->handshake->pmslen = 48;
2286 }
2287 else
2288#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2289 {
2290 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2291 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2292 }
2293
2294 return( 0 );
2295}
2296
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002297#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2298int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002299{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002300 unsigned char *p = ssl->handshake->premaster;
2301 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002302 const unsigned char *psk = ssl->conf->psk;
2303 size_t psk_len = ssl->conf->psk_len;
2304
2305 /* If the psk callback was called, use its result */
2306 if( ssl->handshake->psk != NULL )
2307 {
2308 psk = ssl->handshake->psk;
2309 psk_len = ssl->handshake->psk_len;
2310 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002311
2312 /*
2313 * PMS = struct {
2314 * opaque other_secret<0..2^16-1>;
2315 * opaque psk<0..2^16-1>;
2316 * };
2317 * with "other_secret" depending on the particular key exchange
2318 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002319#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
2320 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002321 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002322 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002323 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002324
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002325 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002326
2327 if( end < p || (size_t)( end - p ) < psk_len )
2328 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2329
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002330 mbedtls_platform_memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002331 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002332 }
2333 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002334#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
2335#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2336 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002337 {
2338 /*
2339 * other_secret already set by the ClientKeyExchange message,
2340 * and is 48 bytes long
2341 */
Philippe Antoine747fd532018-05-30 09:13:21 +02002342 if( end - p < 2 )
2343 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2344
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002345 *p++ = 0;
2346 *p++ = 48;
2347 p += 48;
2348 }
2349 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002350#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2351#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2352 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002353 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002354 int ret;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002355 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002356
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02002357 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002358 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002359 p + 2, end - ( p + 2 ), &len,
Hanno Beckerece325c2019-06-13 15:39:27 +01002360 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002361 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002362 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002363 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002364 return( ret );
2365 }
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002366 p = mbedtls_platform_put_uint16_be( p, len );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002367 p += len;
2368
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002369 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002370 }
2371 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002372#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2373#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2374 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002375 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002376 int ret;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002377 size_t zlen;
2378
Hanno Becker982da7e2019-09-02 09:47:39 +01002379#if defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002380 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2381 ssl->handshake->ecdh_privkey,
2382 p + 2 );
2383 if( ret == UECC_FAULT_DETECTED )
2384 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2385 if( ret != UECC_SUCCESS )
Hanno Becker982da7e2019-09-02 09:47:39 +01002386 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Hanno Becker982da7e2019-09-02 09:47:39 +01002387
2388 zlen = NUM_ECC_BYTES;
2389#else /* MBEDTLS_USE_TINYCRYPT */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002390 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02002391 p + 2, end - ( p + 2 ),
Hanno Beckerece325c2019-06-13 15:39:27 +01002392 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002393 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002394 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002395 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002396 return( ret );
2397 }
2398
Hanno Becker982da7e2019-09-02 09:47:39 +01002399 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2400 MBEDTLS_DEBUG_ECDH_Z );
2401#endif /* MBEDTLS_USE_TINYCRYPT */
2402
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002403 p = mbedtls_platform_put_uint16_be( p, zlen );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002404 p += zlen;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002405 }
2406 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002407#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002408 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002409 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2410 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002411 }
2412
2413 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002414 if( end - p < 2 )
2415 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01002416
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002417 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002418
2419 if( end < p || (size_t)( end - p ) < psk_len )
2420 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2421
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02002422 if( mbedtls_platform_memcpy( p, psk, psk_len ) != p )
2423 {
2424 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2425 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002426 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002427
2428 ssl->handshake->pmslen = p - ssl->handshake->premaster;
2429
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002430 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2431
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002432 return( 0 );
2433}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002434#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002435
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002436#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00002437/*
2438 * SSLv3.0 MAC functions
2439 */
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002440#define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002441static void ssl_mac( mbedtls_md_context_t *md_ctx,
2442 const unsigned char *secret,
2443 const unsigned char *buf, size_t len,
2444 const unsigned char *ctr, int type,
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002445 unsigned char out[SSL_MAC_MAX_BYTES] )
Paul Bakker5121ce52009-01-03 21:22:43 +00002446{
2447 unsigned char header[11];
2448 unsigned char padding[48];
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002449 int padlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002450 int md_size = mbedtls_md_get_size( md_ctx->md_info );
2451 int md_type = mbedtls_md_get_type( md_ctx->md_info );
Paul Bakker68884e32013-01-07 18:20:04 +01002452
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002453 /* Only MD5 and SHA-1 supported */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002454 if( md_type == MBEDTLS_MD_MD5 )
Paul Bakker68884e32013-01-07 18:20:04 +01002455 padlen = 48;
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002456 else
Paul Bakker68884e32013-01-07 18:20:04 +01002457 padlen = 40;
Paul Bakker5121ce52009-01-03 21:22:43 +00002458
Teppo Järvelin91d79382019-10-02 09:09:31 +03002459 mbedtls_platform_memcpy( header, ctr, 8 );
Arto Kinnunen6e3f09b2019-09-06 17:37:01 +03002460 header[8] = (unsigned char) type;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002461 (void)mbedtls_platform_put_uint16_be( &header[9], len );
Paul Bakker5121ce52009-01-03 21:22:43 +00002462
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002463 mbedtls_platform_memset( padding, 0x36, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002464 mbedtls_md_starts( md_ctx );
2465 mbedtls_md_update( md_ctx, secret, md_size );
2466 mbedtls_md_update( md_ctx, padding, padlen );
2467 mbedtls_md_update( md_ctx, header, 11 );
2468 mbedtls_md_update( md_ctx, buf, len );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002469 mbedtls_md_finish( md_ctx, out );
Paul Bakker5121ce52009-01-03 21:22:43 +00002470
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002471 mbedtls_platform_memset( padding, 0x5C, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002472 mbedtls_md_starts( md_ctx );
2473 mbedtls_md_update( md_ctx, secret, md_size );
2474 mbedtls_md_update( md_ctx, padding, padlen );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002475 mbedtls_md_update( md_ctx, out, md_size );
2476 mbedtls_md_finish( md_ctx, out );
Paul Bakker5f70b252012-09-13 14:23:06 +00002477}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002478#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +00002479
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002480/* The function below is only used in the Lucky 13 counter-measure in
Hanno Becker30d02cd2018-10-18 15:43:13 +01002481 * mbedtls_ssl_decrypt_buf(). These are the defines that guard the call site. */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002482#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) && \
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002483 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
2484 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2485 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
2486/* This function makes sure every byte in the memory region is accessed
2487 * (in ascending addresses order) */
2488static void ssl_read_memory( unsigned char *p, size_t len )
2489{
2490 unsigned char acc = 0;
2491 volatile unsigned char force;
2492
2493 for( ; len != 0; p++, len-- )
2494 acc ^= *p;
2495
2496 force = acc;
2497 (void) force;
2498}
2499#endif /* SSL_SOME_MODES_USE_MAC && ( TLS1 || TLS1_1 || TLS1_2 ) */
2500
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002501/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002502 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +02002503 */
Hanno Becker3307b532017-12-27 21:37:21 +00002504
Hanno Beckera5a2b082019-05-15 14:03:01 +01002505#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker89693692019-05-20 15:06:12 +01002506/* This functions transforms a DTLS plaintext fragment and a record content
2507 * type into an instance of the DTLSInnerPlaintext structure:
Hanno Becker92c930f2019-04-29 17:31:37 +01002508 *
2509 * struct {
2510 * opaque content[DTLSPlaintext.length];
2511 * ContentType real_type;
2512 * uint8 zeros[length_of_padding];
2513 * } DTLSInnerPlaintext;
2514 *
2515 * Input:
2516 * - `content`: The beginning of the buffer holding the
2517 * plaintext to be wrapped.
2518 * - `*content_size`: The length of the plaintext in Bytes.
2519 * - `max_len`: The number of Bytes available starting from
2520 * `content`. This must be `>= *content_size`.
2521 * - `rec_type`: The desired record content type.
2522 *
2523 * Output:
2524 * - `content`: The beginning of the resulting DTLSInnerPlaintext structure.
2525 * - `*content_size`: The length of the resulting DTLSInnerPlaintext structure.
2526 *
2527 * Returns:
2528 * - `0` on success.
2529 * - A negative error code if `max_len` didn't offer enough space
2530 * for the expansion.
2531 */
2532static int ssl_cid_build_inner_plaintext( unsigned char *content,
2533 size_t *content_size,
2534 size_t remaining,
2535 uint8_t rec_type )
2536{
2537 size_t len = *content_size;
Hanno Becker78426092019-05-13 15:31:17 +01002538 size_t pad = ( MBEDTLS_SSL_CID_PADDING_GRANULARITY -
2539 ( len + 1 ) % MBEDTLS_SSL_CID_PADDING_GRANULARITY ) %
2540 MBEDTLS_SSL_CID_PADDING_GRANULARITY;
Hanno Becker92c930f2019-04-29 17:31:37 +01002541
2542 /* Write real content type */
2543 if( remaining == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002544 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Hanno Becker92c930f2019-04-29 17:31:37 +01002545 content[ len ] = rec_type;
2546 len++;
2547 remaining--;
2548
2549 if( remaining < pad )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002550 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002551 mbedtls_platform_memset( content + len, 0, pad );
Hanno Becker92c930f2019-04-29 17:31:37 +01002552 len += pad;
2553 remaining -= pad;
2554
2555 *content_size = len;
Andrzej Kurekafec8852020-07-15 16:31:27 -04002556 return( 0 );
Hanno Becker92c930f2019-04-29 17:31:37 +01002557}
2558
Hanno Becker7dc25772019-05-20 15:08:01 +01002559/* This function parses a DTLSInnerPlaintext structure.
2560 * See ssl_cid_build_inner_plaintext() for details. */
Hanno Becker92c930f2019-04-29 17:31:37 +01002561static int ssl_cid_parse_inner_plaintext( unsigned char const *content,
2562 size_t *content_size,
2563 uint8_t *rec_type )
2564{
2565 size_t remaining = *content_size;
2566
2567 /* Determine length of padding by skipping zeroes from the back. */
2568 do
2569 {
2570 if( remaining == 0 )
2571 return( -1 );
2572 remaining--;
2573 } while( content[ remaining ] == 0 );
2574
2575 *content_size = remaining;
2576 *rec_type = content[ remaining ];
2577
2578 return( 0 );
2579}
Hanno Beckera5a2b082019-05-15 14:03:01 +01002580#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01002581
Hanno Becker99abf512019-05-20 14:50:53 +01002582/* `add_data` must have size 13 Bytes if the CID extension is disabled,
Hanno Beckeracadb0a2019-05-08 18:15:21 +01002583 * and 13 + 1 + CID-length Bytes if the CID extension is enabled. */
Hanno Becker3307b532017-12-27 21:37:21 +00002584static void ssl_extract_add_data_from_record( unsigned char* add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002585 size_t *add_data_len,
Hanno Becker3307b532017-12-27 21:37:21 +00002586 mbedtls_record *rec )
2587{
Hanno Becker99abf512019-05-20 14:50:53 +01002588 /* Quoting RFC 5246 (TLS 1.2):
Hanno Beckere83efe62019-04-29 13:52:53 +01002589 *
2590 * additional_data = seq_num + TLSCompressed.type +
2591 * TLSCompressed.version + TLSCompressed.length;
2592 *
Hanno Becker99abf512019-05-20 14:50:53 +01002593 * For the CID extension, this is extended as follows
2594 * (quoting draft-ietf-tls-dtls-connection-id-05,
2595 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05):
Hanno Beckere83efe62019-04-29 13:52:53 +01002596 *
2597 * additional_data = seq_num + DTLSPlaintext.type +
2598 * DTLSPlaintext.version +
Hanno Becker99abf512019-05-20 14:50:53 +01002599 * cid +
2600 * cid_length +
Hanno Beckere83efe62019-04-29 13:52:53 +01002601 * length_of_DTLSInnerPlaintext;
2602 */
2603
Teppo Järvelin91d79382019-10-02 09:09:31 +03002604 mbedtls_platform_memcpy( add_data, rec->ctr, sizeof( rec->ctr ) );
Hanno Becker3307b532017-12-27 21:37:21 +00002605 add_data[8] = rec->type;
Teppo Järvelin91d79382019-10-02 09:09:31 +03002606 mbedtls_platform_memcpy( add_data + 9, rec->ver, sizeof( rec->ver ) );
Hanno Beckere83efe62019-04-29 13:52:53 +01002607
Hanno Beckera5a2b082019-05-15 14:03:01 +01002608#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker1f02f052019-05-09 11:38:24 +01002609 if( rec->cid_len != 0 )
2610 {
Teppo Järvelin91d79382019-10-02 09:09:31 +03002611 mbedtls_platform_memcpy( add_data + 11, rec->cid, rec->cid_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002612 add_data[11 + rec->cid_len + 0] = rec->cid_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002613 (void)mbedtls_platform_put_uint16_be( &add_data[11 + rec->cid_len + 1],
2614 rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002615 *add_data_len = 13 + 1 + rec->cid_len;
2616 }
2617 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01002618#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker1f02f052019-05-09 11:38:24 +01002619 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002620 (void)mbedtls_platform_put_uint16_be( &add_data[11], rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002621 *add_data_len = 13;
2622 }
Hanno Becker3307b532017-12-27 21:37:21 +00002623}
2624
Hanno Becker611a83b2018-01-03 14:27:32 +00002625int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl,
2626 mbedtls_ssl_transform *transform,
2627 mbedtls_record *rec,
2628 int (*f_rng)(void *, unsigned char *, size_t),
2629 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +00002630{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002631 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002632 int auth_done = 0;
Hanno Becker3307b532017-12-27 21:37:21 +00002633 unsigned char * data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01002634 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_OUT_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01002635 size_t add_data_len;
Hanno Becker3307b532017-12-27 21:37:21 +00002636 size_t post_avail;
Andrzej Kurekff517212020-08-10 07:10:35 -04002637 int encryption_status = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker3307b532017-12-27 21:37:21 +00002638
2639 /* The SSL context is only used for debugging purposes! */
Hanno Becker611a83b2018-01-03 14:27:32 +00002640#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02002641 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker3307b532017-12-27 21:37:21 +00002642 ((void) ssl);
2643#endif
2644
2645 /* The PRNG is used for dynamic IV generation that's used
2646 * for CBC transformations in TLS 1.1 and TLS 1.2. */
2647#if !( defined(MBEDTLS_CIPHER_MODE_CBC) && \
2648 ( defined(MBEDTLS_AES_C) || \
2649 defined(MBEDTLS_ARIA_C) || \
2650 defined(MBEDTLS_CAMELLIA_C) ) && \
2651 ( defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) ) )
2652 ((void) f_rng);
2653 ((void) p_rng);
2654#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002655
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002656 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002657
Hanno Becker3307b532017-12-27 21:37:21 +00002658 if( transform == NULL )
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002659 {
Hanno Becker3307b532017-12-27 21:37:21 +00002660 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to encrypt_buf" ) );
2661 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2662 }
Hanno Becker505089d2019-05-01 09:45:57 +01002663 if( rec == NULL
2664 || rec->buf == NULL
2665 || rec->buf_len < rec->data_offset
2666 || rec->buf_len - rec->data_offset < rec->data_len
Hanno Beckera5a2b082019-05-15 14:03:01 +01002667#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01002668 || rec->cid_len != 0
2669#endif
2670 )
Hanno Becker3307b532017-12-27 21:37:21 +00002671 {
2672 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to encrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002673 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002674 }
2675
Hanno Becker3307b532017-12-27 21:37:21 +00002676 data = rec->buf + rec->data_offset;
Hanno Becker92c930f2019-04-29 17:31:37 +01002677 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002678 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Hanno Becker3307b532017-12-27 21:37:21 +00002679 data, rec->data_len );
Andrzej Kurek11750442020-09-17 07:12:06 -04002680#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
2681 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx );
2682#else
Hanno Becker3307b532017-12-27 21:37:21 +00002683 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc );
Andrzej Kurek11750442020-09-17 07:12:06 -04002684#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002685 if( rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
2686 {
2687 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record content %u too large, maximum %d",
2688 (unsigned) rec->data_len,
2689 MBEDTLS_SSL_OUT_CONTENT_LEN ) );
2690 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2691 }
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +01002692
Hanno Beckera5a2b082019-05-15 14:03:01 +01002693#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01002694 /*
2695 * Add CID information
2696 */
2697 rec->cid_len = transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03002698 /* Not using more secure mbedtls_platform_memcpy as cid is public */
2699 memcpy( rec->cid, transform->out_cid, transform->out_cid_len );
Hanno Beckere83efe62019-04-29 13:52:53 +01002700 MBEDTLS_SSL_DEBUG_BUF( 3, "CID", rec->cid, rec->cid_len );
Hanno Becker92c930f2019-04-29 17:31:37 +01002701 if( rec->cid_len != 0 )
2702 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002703 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker92c930f2019-04-29 17:31:37 +01002704 /*
Hanno Becker7dc25772019-05-20 15:08:01 +01002705 * Wrap plaintext into DTLSInnerPlaintext structure.
2706 * See ssl_cid_build_inner_plaintext() for more information.
Hanno Becker92c930f2019-04-29 17:31:37 +01002707 *
Hanno Becker7dc25772019-05-20 15:08:01 +01002708 * Note that this changes `rec->data_len`, and hence
2709 * `post_avail` needs to be recalculated afterwards.
Hanno Becker92c930f2019-04-29 17:31:37 +01002710 */
Andrzej Kurek84bde412020-07-06 15:27:34 -04002711 if( ( ret = ssl_cid_build_inner_plaintext( data,
2712 &rec->data_len,
2713 post_avail,
2714 rec->type ) ) != 0 )
Hanno Becker92c930f2019-04-29 17:31:37 +01002715 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002716 return( ret );
Hanno Becker92c930f2019-04-29 17:31:37 +01002717 }
2718
2719 rec->type = MBEDTLS_SSL_MSG_CID;
2720 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01002721#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01002722
Hanno Becker92c930f2019-04-29 17:31:37 +01002723 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
2724
Paul Bakker5121ce52009-01-03 21:22:43 +00002725 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002726 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +00002727 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002728#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002729 if( mode == MBEDTLS_MODE_STREAM ||
2730 ( mode == MBEDTLS_MODE_CBC
2731#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3307b532017-12-27 21:37:21 +00002732 && transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002733#endif
2734 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00002735 {
Hanno Becker3307b532017-12-27 21:37:21 +00002736 if( post_avail < transform->maclen )
2737 {
2738 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2739 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2740 }
2741
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002742#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01002743 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
2744 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002745 {
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002746 unsigned char mac[SSL_MAC_MAX_BYTES];
Hanno Becker3307b532017-12-27 21:37:21 +00002747 ssl_mac( &transform->md_ctx_enc, transform->mac_enc,
2748 data, rec->data_len, rec->ctr, rec->type, mac );
Teppo Järvelin91d79382019-10-02 09:09:31 +03002749 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002750 }
2751 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002752#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002753#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2754 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01002755 if( mbedtls_ssl_ver_geq(
2756 mbedtls_ssl_transform_get_minor_ver( transform ),
2757 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002758 {
Hanno Becker992b6872017-11-09 18:57:39 +00002759 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
2760
Hanno Beckere83efe62019-04-29 13:52:53 +01002761 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker992b6872017-11-09 18:57:39 +00002762
Hanno Becker3307b532017-12-27 21:37:21 +00002763 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002764 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00002765 mbedtls_md_hmac_update( &transform->md_ctx_enc,
2766 data, rec->data_len );
2767 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
2768 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
2769
Teppo Järvelin91d79382019-10-02 09:09:31 +03002770 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002771 }
2772 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002773#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002774 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002775 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2776 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002777 }
2778
Hanno Becker3307b532017-12-27 21:37:21 +00002779 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", data + rec->data_len,
2780 transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002781
Hanno Becker3307b532017-12-27 21:37:21 +00002782 rec->data_len += transform->maclen;
2783 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002784 auth_done++;
Paul Bakker577e0062013-08-28 11:57:20 +02002785 }
Hanno Becker5cc04d52018-01-03 15:24:20 +00002786#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00002787
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002788 /*
2789 * Encrypt
2790 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002791#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
2792 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00002793 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002794 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00002795 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002796 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Hanno Becker3307b532017-12-27 21:37:21 +00002797 "including %d bytes of padding",
2798 rec->data_len, 0 ) );
Andrzej Kurek11750442020-09-17 07:12:06 -04002799#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02002800 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
2801 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04002802 {
Andrzej Kureka7932372020-09-19 07:56:06 +02002803 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04002804 return( ret );
2805 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002806
Andrzej Kurekff517212020-08-10 07:10:35 -04002807 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04002808 transform->iv_enc, transform->ivlen,
2809 data, rec->data_len,
2810 data, &olen ) ) != 0 )
2811 {
2812 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
2813 return( ret );
2814 }
2815#else
Andrzej Kurekff517212020-08-10 07:10:35 -04002816 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002817 transform->iv_enc, transform->ivlen,
2818 data, rec->data_len,
2819 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002820 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002821 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002822 return( ret );
2823 }
Andrzej Kurek11750442020-09-17 07:12:06 -04002824#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002825 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002826 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002827 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2828 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002829 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002830 }
Paul Bakker68884e32013-01-07 18:20:04 +01002831 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002832#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002833
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002834#if defined(MBEDTLS_GCM_C) || \
2835 defined(MBEDTLS_CCM_C) || \
2836 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002837 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002838 mode == MBEDTLS_MODE_CCM ||
2839 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002840 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02002841 int ret;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002842 unsigned char iv[12];
Hanno Becker3307b532017-12-27 21:37:21 +00002843 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002844
Hanno Becker3307b532017-12-27 21:37:21 +00002845 /* Check that there's space for both the authentication tag
2846 * and the explicit IV before and after the record content. */
2847 if( post_avail < transform->taglen ||
2848 rec->data_offset < explicit_iv_len )
2849 {
2850 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2851 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2852 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00002853
Paul Bakker68884e32013-01-07 18:20:04 +01002854 /*
2855 * Generate IV
2856 */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002857 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
2858 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002859 /* GCM and CCM: fixed || explicit (=seqnum) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002860 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
2861 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, rec->ctr,
Hanno Becker3307b532017-12-27 21:37:21 +00002862 explicit_iv_len );
2863 /* Prefix record content with explicit IV. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002864 mbedtls_platform_memcpy( data - explicit_iv_len, rec->ctr, explicit_iv_len );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002865 }
2866 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
2867 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002868 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002869 unsigned char i;
2870
Teppo Järvelin91d79382019-10-02 09:09:31 +03002871 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002872
2873 for( i = 0; i < 8; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00002874 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002875 }
2876 else
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002877 {
2878 /* Reminder if we ever add an AEAD mode with a different size */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002879 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2880 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002881 }
2882
Hanno Beckere83efe62019-04-29 13:52:53 +01002883 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker08885812019-04-26 13:34:37 +01002884
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002885 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
2886 iv, transform->ivlen );
2887 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
Hanno Becker3307b532017-12-27 21:37:21 +00002888 data - explicit_iv_len, explicit_iv_len );
2889 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01002890 add_data, add_data_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002891 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002892 "including 0 bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00002893 rec->data_len ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002894
Paul Bakker68884e32013-01-07 18:20:04 +01002895 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02002896 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002897 */
Andrzej Kurek11750442020-09-17 07:12:06 -04002898#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02002899 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
2900 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04002901 {
Andrzej Kureka7932372020-09-19 07:56:06 +02002902 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04002903 return( ret );
2904 }
Hanno Becker3307b532017-12-27 21:37:21 +00002905
Andrzej Kurekff517212020-08-10 07:10:35 -04002906 if( ( ret = encryption_status = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04002907 iv, transform->ivlen,
2908 add_data, add_data_len, /* add data */
2909 data, rec->data_len, /* source */
2910 data, &rec->data_len, /* destination */
2911 data + rec->data_len, transform->taglen ) ) != 0 )
2912 {
2913 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
2914 return( ret );
2915 }
2916#else
Andrzej Kurekff517212020-08-10 07:10:35 -04002917 if( ( ret = encryption_status = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002918 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01002919 add_data, add_data_len, /* add data */
Hanno Becker3307b532017-12-27 21:37:21 +00002920 data, rec->data_len, /* source */
2921 data, &rec->data_len, /* destination */
2922 data + rec->data_len, transform->taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002923 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002924 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002925 return( ret );
2926 }
Andrzej Kurek11750442020-09-17 07:12:06 -04002927#endif
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04002928
Hanno Becker3307b532017-12-27 21:37:21 +00002929 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag",
2930 data + rec->data_len, transform->taglen );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002931
Hanno Becker3307b532017-12-27 21:37:21 +00002932 rec->data_len += transform->taglen + explicit_iv_len;
2933 rec->data_offset -= explicit_iv_len;
2934 post_avail -= transform->taglen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002935 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002936 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002937 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002938#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
2939#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00002940 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002941 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00002942 {
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002943 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00002944 size_t padlen, i;
2945 size_t olen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002946
Hanno Becker3307b532017-12-27 21:37:21 +00002947 /* Currently we're always using minimal padding
2948 * (up to 255 bytes would be allowed). */
2949 padlen = transform->ivlen - ( rec->data_len + 1 ) % transform->ivlen;
2950 if( padlen == transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00002951 padlen = 0;
2952
Hanno Becker3307b532017-12-27 21:37:21 +00002953 /* Check there's enough space in the buffer for the padding. */
2954 if( post_avail < padlen + 1 )
2955 {
2956 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2957 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2958 }
2959
Paul Bakker5121ce52009-01-03 21:22:43 +00002960 for( i = 0; i <= padlen; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00002961 data[rec->data_len + i] = (unsigned char) padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002962
Hanno Becker3307b532017-12-27 21:37:21 +00002963 rec->data_len += padlen + 1;
2964 post_avail -= padlen + 1;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002965
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002966#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002967 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00002968 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
2969 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002970 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01002971 if( mbedtls_ssl_ver_geq(
2972 mbedtls_ssl_transform_get_minor_ver( transform ),
2973 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002974 {
Hanno Becker3307b532017-12-27 21:37:21 +00002975 if( f_rng == NULL )
2976 {
2977 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No PRNG provided to encrypt_record routine" ) );
2978 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2979 }
2980
2981 if( rec->data_offset < transform->ivlen )
2982 {
2983 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2984 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2985 }
2986
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002987 /*
2988 * Generate IV
2989 */
Hanno Becker3307b532017-12-27 21:37:21 +00002990 ret = f_rng( p_rng, transform->iv_enc, transform->ivlen );
Paul Bakkera3d195c2011-11-27 21:07:34 +00002991 if( ret != 0 )
2992 return( ret );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002993
Teppo Järvelin91d79382019-10-02 09:09:31 +03002994 mbedtls_platform_memcpy( data - transform->ivlen, transform->iv_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002995 transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002996
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002997 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002998#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002999
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003000 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003001 "including %d bytes of IV and %d bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00003002 rec->data_len, transform->ivlen,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02003003 padlen + 1 ) );
Andrzej Kurek11750442020-09-17 07:12:06 -04003004#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003005 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
3006 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003007 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003008 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003009 return( ret );
3010 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003011
Andrzej Kurekff517212020-08-10 07:10:35 -04003012 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04003013 transform->iv_enc,
3014 transform->ivlen,
3015 data, rec->data_len,
3016 data, &olen ) ) != 0 )
3017 {
3018 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3019 return( ret );
3020 }
3021#else
Andrzej Kurekff517212020-08-10 07:10:35 -04003022 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00003023 transform->iv_enc,
3024 transform->ivlen,
3025 data, rec->data_len,
3026 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003027 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003028 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003029 return( ret );
3030 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003031#endif
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04003032
Hanno Becker3307b532017-12-27 21:37:21 +00003033 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003034 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003035 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3036 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003037 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003038
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003039#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003040 if( mbedtls_ssl_ver_lt(
3041 mbedtls_ssl_transform_get_minor_ver( transform ),
3042 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003043 {
3044 /*
3045 * Save IV in SSL3 and TLS1
3046 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003047#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3048 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx.iv,
3049 transform->ivlen );
3050#else
Teppo Järvelin91d79382019-10-02 09:09:31 +03003051 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx_enc.iv,
Hanno Becker3307b532017-12-27 21:37:21 +00003052 transform->ivlen );
Andrzej Kurek11750442020-09-17 07:12:06 -04003053#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003054 }
Hanno Becker3307b532017-12-27 21:37:21 +00003055 else
Paul Bakkercca5b812013-08-31 17:40:26 +02003056#endif
Hanno Becker3307b532017-12-27 21:37:21 +00003057 {
3058 data -= transform->ivlen;
3059 rec->data_offset -= transform->ivlen;
3060 rec->data_len += transform->ivlen;
3061 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003063#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003064 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003065 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00003066 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
3067
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003068 /*
3069 * MAC(MAC_write_key, seq_num +
3070 * TLSCipherText.type +
3071 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003072 * length_of( (IV +) ENC(...) ) +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003073 * IV + // except for TLS 1.0
3074 * ENC(content + padding + padding_length));
3075 */
Hanno Becker3307b532017-12-27 21:37:21 +00003076
3077 if( post_avail < transform->maclen)
3078 {
3079 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3080 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3081 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003082
Hanno Beckere83efe62019-04-29 13:52:53 +01003083 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003084
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003085 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Hanno Becker3307b532017-12-27 21:37:21 +00003086 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01003087 add_data_len );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003088
Hanno Becker3307b532017-12-27 21:37:21 +00003089 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01003090 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00003091 mbedtls_md_hmac_update( &transform->md_ctx_enc,
3092 data, rec->data_len );
3093 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
3094 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003095
Teppo Järvelin91d79382019-10-02 09:09:31 +03003096 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003097
Hanno Becker3307b532017-12-27 21:37:21 +00003098 rec->data_len += transform->maclen;
3099 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003100 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003101 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003102#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00003103 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003104 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003105#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003106 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003107 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003108 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3109 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003110 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003111
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003112 /* Make extra sure authentication was performed, exactly once */
3113 if( auth_done != 1 )
3114 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003115 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3116 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003117 }
3118
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003119 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003120
Andrzej Kurekff517212020-08-10 07:10:35 -04003121 if( encryption_status == 0 )
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04003122 {
3123 return( 0 );
3124 }
3125 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +00003126}
3127
Hanno Becker40478be2019-07-12 08:23:59 +01003128int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
Hanno Becker611a83b2018-01-03 14:27:32 +00003129 mbedtls_ssl_transform *transform,
3130 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00003131{
Hanno Becker4c6876b2017-12-27 21:28:58 +00003132 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003133 mbedtls_cipher_mode_t mode;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003134 int ret, auth_done = 0;
Hanno Becker5cc04d52018-01-03 15:24:20 +00003135#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01003136 size_t padlen = 0, correct = 1;
3137#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003138 unsigned char* data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01003139 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_IN_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01003140 size_t add_data_len;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003141
Hanno Becker611a83b2018-01-03 14:27:32 +00003142#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02003143 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003144 ((void) ssl);
3145#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003147 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003148 if( rec == NULL ||
3149 rec->buf == NULL ||
3150 rec->buf_len < rec->data_offset ||
3151 rec->buf_len - rec->data_offset < rec->data_len )
3152 {
3153 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to decrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003154 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003155 }
3156
Hanno Becker4c6876b2017-12-27 21:28:58 +00003157 data = rec->buf + rec->data_offset;
Andrzej Kurek11750442020-09-17 07:12:06 -04003158#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3159 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx );
3160#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003161 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -04003162#endif
Hanno Beckera5a2b082019-05-15 14:03:01 +01003163#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01003164 /*
3165 * Match record's CID with incoming CID.
3166 */
Hanno Beckerabd7c892019-05-08 13:02:22 +01003167 if( rec->cid_len != transform->in_cid_len ||
Teppo Järvelin0efac532019-10-04 13:21:08 +03003168 memcmp( rec->cid, transform->in_cid, rec->cid_len ) != 0 ) // use regular memcmp as CID is public
Hanno Beckerabd7c892019-05-08 13:02:22 +01003169 {
Hanno Beckere8eff9a2019-05-14 11:30:10 +01003170 return( MBEDTLS_ERR_SSL_UNEXPECTED_CID );
Hanno Beckerabd7c892019-05-08 13:02:22 +01003171 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003172#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01003173
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003174#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
3175 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker68884e32013-01-07 18:20:04 +01003176 {
3177 padlen = 0;
Andrzej Kurek11750442020-09-17 07:12:06 -04003178#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003179 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3180 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003181 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003182 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003183 return( ret );
3184 }
3185 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx,
3186 transform->iv_dec,
3187 transform->ivlen,
3188 data, rec->data_len,
3189 data, &olen ) ) != 0 )
3190 {
3191 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3192 return( ret );
3193 }
3194#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003195 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3196 transform->iv_dec,
3197 transform->ivlen,
3198 data, rec->data_len,
3199 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003200 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003201 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003202 return( ret );
3203 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003204#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003205 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003206 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003207 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3208 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003209 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003210 }
Paul Bakker68884e32013-01-07 18:20:04 +01003211 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003212#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003213#if defined(MBEDTLS_GCM_C) || \
3214 defined(MBEDTLS_CCM_C) || \
3215 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003216 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003217 mode == MBEDTLS_MODE_CCM ||
3218 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003219 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003220 unsigned char iv[12];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003221 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003222
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003223 /*
3224 * Prepare IV from explicit and implicit data.
3225 */
3226
3227 /* Check that there's enough space for the explicit IV
3228 * (at the beginning of the record) and the MAC (at the
3229 * end of the record). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003230 if( rec->data_len < explicit_iv_len + transform->taglen )
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003231 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003232 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003233 "+ taglen (%d)", rec->data_len,
3234 explicit_iv_len, transform->taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003235 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003236 }
Paul Bakker68884e32013-01-07 18:20:04 +01003237
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003238#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003239 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
3240 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003241 /* GCM and CCM: fixed || explicit */
Paul Bakker68884e32013-01-07 18:20:04 +01003242
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003243 /* Fixed */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003244 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003245 /* Explicit */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003246 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, data, 8 );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003247 }
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003248 else
3249#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3250#if defined(MBEDTLS_CHACHAPOLY_C)
3251 if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003252 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02003253 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003254 unsigned char i;
3255
Teppo Järvelin91d79382019-10-02 09:09:31 +03003256 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003257
3258 for( i = 0; i < 8; i++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003259 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003260 }
3261 else
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003262#endif /* MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003263 {
3264 /* Reminder if we ever add an AEAD mode with a different size */
3265 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3266 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3267 }
3268
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003269 /* Group changes to data, data_len, and add_data, because
3270 * add_data depends on data_len. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003271 data += explicit_iv_len;
3272 rec->data_offset += explicit_iv_len;
3273 rec->data_len -= explicit_iv_len + transform->taglen;
3274
Hanno Beckere83efe62019-04-29 13:52:53 +01003275 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003276 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01003277 add_data, add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003278
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003279 /* Because of the check above, we know that there are
3280 * explicit_iv_len Bytes preceeding data, and taglen
3281 * bytes following data + data_len. This justifies
Hanno Becker07d420d2019-07-10 11:44:13 +01003282 * the debug message and the invocation of
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003283 * mbedtls_cipher_auth_decrypt() below. */
3284
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003285 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv, transform->ivlen );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003286 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", data + rec->data_len,
Hanno Becker8759e162017-12-27 21:34:08 +00003287 transform->taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01003288
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003289 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003290 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003291 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003292#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003293 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3294 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003295 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003296 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003297 return( ret );
3298 }
3299 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx,
3300 iv, transform->ivlen,
3301 add_data, add_data_len,
3302 data, rec->data_len,
3303 data, &olen,
3304 data + rec->data_len,
3305 transform->taglen ) ) != 0 )
3306 {
3307 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
3308
3309 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3310 return( MBEDTLS_ERR_SSL_INVALID_MAC );
3311
3312 return( ret );
3313 }
3314#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003315 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx_dec,
3316 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01003317 add_data, add_data_len,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003318 data, rec->data_len,
3319 data, &olen,
3320 data + rec->data_len,
3321 transform->taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003322 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003323 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003324
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003325 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3326 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003327
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003328 return( ret );
3329 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003330#endif
3331
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003332 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003333
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003334 /* Double-check that AEAD decryption doesn't change content length. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003335 if( olen != rec->data_len )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003336 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003337 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3338 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003339 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00003340 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003341 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003342#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3343#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003344 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003345 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00003346 {
Paul Bakkere47b34b2013-02-27 14:48:00 +01003347 size_t minlen = 0;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003348
Paul Bakker5121ce52009-01-03 21:22:43 +00003349 /*
Paul Bakker45829992013-01-03 14:52:21 +01003350 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00003351 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003352#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003353 if( mbedtls_ssl_ver_geq(
3354 mbedtls_ssl_transform_get_minor_ver( transform ),
3355 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003356 {
3357 /* The ciphertext is prefixed with the CBC IV. */
3358 minlen += transform->ivlen;
3359 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003360#endif
Paul Bakker45829992013-01-03 14:52:21 +01003361
Hanno Becker4c6876b2017-12-27 21:28:58 +00003362 /* Size considerations:
3363 *
3364 * - The CBC cipher text must not be empty and hence
3365 * at least of size transform->ivlen.
3366 *
3367 * Together with the potential IV-prefix, this explains
3368 * the first of the two checks below.
3369 *
3370 * - The record must contain a MAC, either in plain or
3371 * encrypted, depending on whether Encrypt-then-MAC
3372 * is used or not.
3373 * - If it is, the message contains the IV-prefix,
3374 * the CBC ciphertext, and the MAC.
3375 * - If it is not, the padded plaintext, and hence
3376 * the CBC ciphertext, has at least length maclen + 1
3377 * because there is at least the padding length byte.
3378 *
3379 * As the CBC ciphertext is not empty, both cases give the
3380 * lower bound minlen + maclen + 1 on the record size, which
3381 * we test for in the second check below.
3382 */
3383 if( rec->data_len < minlen + transform->ivlen ||
3384 rec->data_len < minlen + transform->maclen + 1 )
Paul Bakker45829992013-01-03 14:52:21 +01003385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003386 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003387 "+ 1 ) ( + expl IV )", rec->data_len,
3388 transform->ivlen,
3389 transform->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003390 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01003391 }
3392
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003393 /*
3394 * Authenticate before decrypt if enabled
3395 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003396#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003397 if( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003398 {
Hanno Becker992b6872017-11-09 18:57:39 +00003399 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003400
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003401 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003402
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003403 /* Update data_len in tandem with add_data.
3404 *
3405 * The subtraction is safe because of the previous check
3406 * data_len >= minlen + maclen + 1.
3407 *
3408 * Afterwards, we know that data + data_len is followed by at
3409 * least maclen Bytes, which justifies the call to
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003410 * mbedtls_platform_memequal() below.
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003411 *
3412 * Further, we still know that data_len > minlen */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003413 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003414 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003415
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003416 /* Calculate expected MAC. */
Hanno Beckere83efe62019-04-29 13:52:53 +01003417 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
3418 add_data_len );
3419 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3420 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003421 mbedtls_md_hmac_update( &transform->md_ctx_dec,
3422 data, rec->data_len );
3423 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
3424 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003425
Hanno Becker4c6876b2017-12-27 21:28:58 +00003426 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len,
3427 transform->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00003428 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003429 transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003430
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003431 /* Compare expected MAC with MAC at the end of the record. */
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003432 if( mbedtls_platform_memequal( data + rec->data_len, mac_expect,
3433 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003434 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003435 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003436 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003437 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003438 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003439 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003440#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003441
3442 /*
3443 * Check length sanity
3444 */
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003445
3446 /* We know from above that data_len > minlen >= 0,
3447 * so the following check in particular implies that
3448 * data_len >= minlen + ivlen ( = minlen or 2 * minlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003449 if( rec->data_len % transform->ivlen != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003450 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003451 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003452 rec->data_len, transform->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003453 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003454 }
3455
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003456#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003457 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00003458 * Initialize for prepended IV for block cipher in TLS v1.1 and up
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003459 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003460 if( mbedtls_ssl_ver_geq(
3461 mbedtls_ssl_transform_get_minor_ver( transform ),
3462 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003463 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003464 /* Safe because data_len >= minlen + ivlen = 2 * ivlen. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003465 mbedtls_platform_memcpy( transform->iv_dec, data, transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003466
Hanno Becker4c6876b2017-12-27 21:28:58 +00003467 data += transform->ivlen;
3468 rec->data_offset += transform->ivlen;
3469 rec->data_len -= transform->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003470 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003471#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003472
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003473 /* We still have data_len % ivlen == 0 and data_len >= ivlen here. */
Andrzej Kurek11750442020-09-17 07:12:06 -04003474#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003475 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3476 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003477 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003478 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003479 return( ret );
3480 }
Andrzej Kureka7932372020-09-19 07:56:06 +02003481
Andrzej Kurek11750442020-09-17 07:12:06 -04003482 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx,
3483 transform->iv_dec, transform->ivlen,
3484 data, rec->data_len, data, &olen ) ) != 0 )
3485 {
3486 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3487 return( ret );
3488 }
3489#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003490 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3491 transform->iv_dec, transform->ivlen,
3492 data, rec->data_len, data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003493 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003494 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003495 return( ret );
3496 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003497#endif
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003498 /* Double-check that length hasn't changed during decryption. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003499 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003500 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003501 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3502 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003503 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003504
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003505#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003506 if( mbedtls_ssl_ver_lt(
3507 mbedtls_ssl_transform_get_minor_ver( transform ),
3508 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003509 {
3510 /*
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003511 * Save IV in SSL3 and TLS1, where CBC decryption of consecutive
3512 * records is equivalent to CBC decryption of the concatenation
3513 * of the records; in other words, IVs are maintained across
3514 * record decryptions.
Paul Bakkercca5b812013-08-31 17:40:26 +02003515 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003516#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3517 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx.iv,
3518 transform->ivlen );
3519#else
Teppo Järvelin91d79382019-10-02 09:09:31 +03003520 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx_dec.iv,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003521 transform->ivlen );
Andrzej Kurek11750442020-09-17 07:12:06 -04003522#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003523 }
Paul Bakkercca5b812013-08-31 17:40:26 +02003524#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003525
Hanno Becker4c6876b2017-12-27 21:28:58 +00003526 /* Safe since data_len >= minlen + maclen + 1, so after having
3527 * subtracted at most minlen and maclen up to this point,
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003528 * data_len > 0 (because of data_len % ivlen == 0, it's actually
3529 * >= ivlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003530 padlen = data[rec->data_len - 1];
Paul Bakker45829992013-01-03 14:52:21 +01003531
Hanno Becker4c6876b2017-12-27 21:28:58 +00003532 if( auth_done == 1 )
3533 {
3534 correct *= ( rec->data_len >= padlen + 1 );
3535 padlen *= ( rec->data_len >= padlen + 1 );
3536 }
3537 else
Paul Bakker45829992013-01-03 14:52:21 +01003538 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003539#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003540 if( rec->data_len < transform->maclen + padlen + 1 )
3541 {
3542 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
3543 rec->data_len,
3544 transform->maclen,
3545 padlen + 1 ) );
3546 }
Paul Bakkerd66f0702013-01-31 16:57:45 +01003547#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003548
3549 correct *= ( rec->data_len >= transform->maclen + padlen + 1 );
3550 padlen *= ( rec->data_len >= transform->maclen + padlen + 1 );
Paul Bakker45829992013-01-03 14:52:21 +01003551 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003552
Hanno Becker4c6876b2017-12-27 21:28:58 +00003553 padlen++;
3554
3555 /* Regardless of the validity of the padding,
3556 * we have data_len >= padlen here. */
3557
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003558#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003559 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3560 MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003561 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003562 if( padlen > transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003563 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003564#if defined(MBEDTLS_SSL_DEBUG_ALL)
3565 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003566 "should be no more than %d",
3567 padlen, transform->ivlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003568#endif
Paul Bakker45829992013-01-03 14:52:21 +01003569 correct = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00003570 }
3571 }
3572 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003573#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3574#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3575 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003576 if( mbedtls_ssl_ver_gt(
3577 mbedtls_ssl_transform_get_minor_ver( transform ),
3578 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003579 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003580 /* The padding check involves a series of up to 256
3581 * consecutive memory reads at the end of the record
3582 * plaintext buffer. In order to hide the length and
3583 * validity of the padding, always perform exactly
3584 * `min(256,plaintext_len)` reads (but take into account
3585 * only the last `padlen` bytes for the padding check). */
3586 size_t pad_count = 0;
3587 size_t real_count = 0;
3588 volatile unsigned char* const check = data;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003589
Hanno Becker4c6876b2017-12-27 21:28:58 +00003590 /* Index of first padding byte; it has been ensured above
3591 * that the subtraction is safe. */
3592 size_t const padding_idx = rec->data_len - padlen;
3593 size_t const num_checks = rec->data_len <= 256 ? rec->data_len : 256;
3594 size_t const start_idx = rec->data_len - num_checks;
3595 size_t idx;
Paul Bakker956c9e02013-12-19 14:42:28 +01003596
Hanno Becker4c6876b2017-12-27 21:28:58 +00003597 for( idx = start_idx; idx < rec->data_len; idx++ )
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003598 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003599 real_count |= ( idx >= padding_idx );
3600 pad_count += real_count * ( check[idx] == padlen - 1 );
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003601 }
Hanno Becker4c6876b2017-12-27 21:28:58 +00003602 correct &= ( pad_count == padlen );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003603
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003604#if defined(MBEDTLS_SSL_DEBUG_ALL)
Paul Bakker66d5d072014-06-17 16:39:18 +02003605 if( padlen > 0 && correct == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003606 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003607#endif
Paul Bakkere47b34b2013-02-27 14:48:00 +01003608 padlen &= correct * 0x1FF;
Paul Bakker5121ce52009-01-03 21:22:43 +00003609 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003610 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003611#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3612 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003613 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003614 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3615 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003616 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003617
Hanno Becker4c6876b2017-12-27 21:28:58 +00003618 /* If the padding was found to be invalid, padlen == 0
3619 * and the subtraction is safe. If the padding was found valid,
3620 * padlen hasn't been changed and the previous assertion
3621 * data_len >= padlen still holds. */
3622 rec->data_len -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00003623 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003624 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003625#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003626 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003627 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003628 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3629 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003630 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003631
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003632#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003633 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003634 data, rec->data_len );
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003635#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003636
3637 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003638 * Authenticate if not done yet.
3639 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00003640 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00003641#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003642 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003643 {
Hanno Becker992b6872017-11-09 18:57:39 +00003644 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01003645
Hanno Becker4c6876b2017-12-27 21:28:58 +00003646 /* If the initial value of padlen was such that
3647 * data_len < maclen + padlen + 1, then padlen
3648 * got reset to 1, and the initial check
3649 * data_len >= minlen + maclen + 1
3650 * guarantees that at this point we still
3651 * have at least data_len >= maclen.
3652 *
3653 * If the initial value of padlen was such that
3654 * data_len >= maclen + padlen + 1, then we have
3655 * subtracted either padlen + 1 (if the padding was correct)
3656 * or 0 (if the padding was incorrect) since then,
3657 * hence data_len >= maclen in any case.
3658 */
3659 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003660 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Paul Bakker5121ce52009-01-03 21:22:43 +00003661
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003662#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003663 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3664 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003665 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003666 ssl_mac( &transform->md_ctx_dec,
3667 transform->mac_dec,
3668 data, rec->data_len,
3669 rec->ctr, rec->type,
3670 mac_expect );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003671 }
3672 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003673#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3674#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3675 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003676 if( mbedtls_ssl_ver_gt(
3677 mbedtls_ssl_transform_get_minor_ver( transform ),
3678 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003679 {
3680 /*
3681 * Process MAC and always update for padlen afterwards to make
Gilles Peskine20b44082018-05-29 14:06:49 +02003682 * total time independent of padlen.
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003683 *
3684 * Known timing attacks:
3685 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
3686 *
Gilles Peskine20b44082018-05-29 14:06:49 +02003687 * To compensate for different timings for the MAC calculation
3688 * depending on how much padding was removed (which is determined
3689 * by padlen), process extra_run more blocks through the hash
3690 * function.
3691 *
3692 * The formula in the paper is
3693 * extra_run = ceil( (L1-55) / 64 ) - ceil( (L2-55) / 64 )
3694 * where L1 is the size of the header plus the decrypted message
3695 * plus CBC padding and L2 is the size of the header plus the
3696 * decrypted message. This is for an underlying hash function
3697 * with 64-byte blocks.
3698 * We use ( (Lx+8) / 64 ) to handle 'negative Lx' values
3699 * correctly. We round down instead of up, so -56 is the correct
3700 * value for our calculations instead of -55.
3701 *
Gilles Peskine1bd9d582018-06-04 11:58:44 +02003702 * Repeat the formula rather than defining a block_size variable.
3703 * This avoids requiring division by a variable at runtime
3704 * (which would be marginally less efficient and would require
3705 * linking an extra division function in some builds).
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003706 */
3707 size_t j, extra_run = 0;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003708 unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003709
3710 /*
3711 * The next two sizes are the minimum and maximum values of
3712 * in_msglen over all padlen values.
3713 *
3714 * They're independent of padlen, since we previously did
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003715 * data_len -= padlen.
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003716 *
3717 * Note that max_len + maclen is never more than the buffer
3718 * length, as we previously did in_msglen -= maclen too.
3719 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003720 const size_t max_len = rec->data_len + padlen;
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003721 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
3722
Hanno Becker4c6876b2017-12-27 21:28:58 +00003723 memset( tmp, 0, sizeof( tmp ) );
3724
Hanno Beckera5cedbc2019-07-17 11:21:02 +01003725 switch( mbedtls_md_get_type(
3726 mbedtls_md_get_handle( &transform->md_ctx_dec ) ) )
Gilles Peskine20b44082018-05-29 14:06:49 +02003727 {
Gilles Peskined0e55a42018-06-04 12:03:30 +02003728#if defined(MBEDTLS_MD5_C) || defined(MBEDTLS_SHA1_C) || \
3729 defined(MBEDTLS_SHA256_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003730 case MBEDTLS_MD_MD5:
3731 case MBEDTLS_MD_SHA1:
Gilles Peskine20b44082018-05-29 14:06:49 +02003732 case MBEDTLS_MD_SHA256:
Gilles Peskine20b44082018-05-29 14:06:49 +02003733 /* 8 bytes of message size, 64-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003734 extra_run =
3735 ( add_data_len + rec->data_len + padlen + 8 ) / 64 -
3736 ( add_data_len + rec->data_len + 8 ) / 64;
Gilles Peskine20b44082018-05-29 14:06:49 +02003737 break;
3738#endif
Gilles Peskinea7fe25d2018-06-04 12:01:18 +02003739#if defined(MBEDTLS_SHA512_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003740 case MBEDTLS_MD_SHA384:
Gilles Peskine20b44082018-05-29 14:06:49 +02003741 /* 16 bytes of message size, 128-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003742 extra_run =
3743 ( add_data_len + rec->data_len + padlen + 16 ) / 128 -
3744 ( add_data_len + rec->data_len + 16 ) / 128;
Gilles Peskine20b44082018-05-29 14:06:49 +02003745 break;
3746#endif
3747 default:
Gilles Peskine5c389842018-06-04 12:02:43 +02003748 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Gilles Peskine20b44082018-05-29 14:06:49 +02003749 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3750 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01003751
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003752 extra_run &= correct * 0xFF;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003753
Hanno Beckere83efe62019-04-29 13:52:53 +01003754 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3755 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003756 mbedtls_md_hmac_update( &transform->md_ctx_dec, data,
3757 rec->data_len );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003758 /* Make sure we access everything even when padlen > 0. This
3759 * makes the synchronisation requirements for just-in-time
3760 * Prime+Probe attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003761 ssl_read_memory( data + rec->data_len, padlen );
3762 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003763
3764 /* Call mbedtls_md_process at least once due to cache attacks
3765 * that observe whether md_process() was called of not */
Manuel Pégourié-Gonnard47fede02015-04-29 01:35:48 +02003766 for( j = 0; j < extra_run + 1; j++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003767 mbedtls_md_process( &transform->md_ctx_dec, tmp );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003768
Hanno Becker4c6876b2017-12-27 21:28:58 +00003769 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003770
3771 /* Make sure we access all the memory that could contain the MAC,
3772 * before we check it in the next code block. This makes the
3773 * synchronisation requirements for just-in-time Prime+Probe
3774 * attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003775 ssl_read_memory( data + min_len,
3776 max_len - min_len + transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003777 }
3778 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003779#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3780 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003781 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003782 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3783 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003784 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003785
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003786#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003787 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, transform->maclen );
3788 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len, transform->maclen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003789#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003790
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003791 if( mbedtls_platform_memequal( data + rec->data_len, mac_expect,
3792 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003793 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003794#if defined(MBEDTLS_SSL_DEBUG_ALL)
3795 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003796#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003797 correct = 0;
3798 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003799 auth_done++;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003800 }
Hanno Beckerdd3ab132018-10-17 14:43:14 +01003801
3802 /*
3803 * Finally check the correct flag
3804 */
3805 if( correct == 0 )
3806 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Hanno Becker5cc04d52018-01-03 15:24:20 +00003807#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003808
3809 /* Make extra sure authentication was performed, exactly once */
3810 if( auth_done != 1 )
3811 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003812 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3813 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003814 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003815
Hanno Beckera5a2b082019-05-15 14:03:01 +01003816#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker92c930f2019-04-29 17:31:37 +01003817 if( rec->cid_len != 0 )
3818 {
3819 ret = ssl_cid_parse_inner_plaintext( data, &rec->data_len,
3820 &rec->type );
3821 if( ret != 0 )
3822 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3823 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003824#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01003825
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003826 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003827
3828 return( 0 );
3829}
3830
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01003831#undef MAC_NONE
3832#undef MAC_PLAINTEXT
3833#undef MAC_CIPHERTEXT
3834
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003835#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00003836/*
3837 * Compression/decompression functions
3838 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003839static int ssl_compress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003840{
3841 int ret;
3842 unsigned char *msg_post = ssl->out_msg;
Andrzej Kurek5462e022018-04-20 07:58:53 -04003843 ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003844 size_t len_pre = ssl->out_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003845 unsigned char *msg_pre = ssl->compress_buf;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003846#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3847 size_t out_buf_len = ssl->out_buf_len;
3848#else
3849 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3850#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00003851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003852 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003853
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003854 if( len_pre == 0 )
3855 return( 0 );
3856
Teppo Järvelin91d79382019-10-02 09:09:31 +03003857 mbedtls_platform_memcpy( msg_pre, ssl->out_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003858
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003859 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003860 ssl->out_msglen ) );
3861
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003862 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003863 ssl->out_msg, ssl->out_msglen );
3864
Paul Bakker48916f92012-09-16 19:57:18 +00003865 ssl->transform_out->ctx_deflate.next_in = msg_pre;
3866 ssl->transform_out->ctx_deflate.avail_in = len_pre;
3867 ssl->transform_out->ctx_deflate.next_out = msg_post;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003868 ssl->transform_out->ctx_deflate.avail_out = out_buf_len - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003869
Paul Bakker48916f92012-09-16 19:57:18 +00003870 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003871 if( ret != Z_OK )
3872 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003873 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
3874 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003875 }
3876
Andrzej Kurekf3844952020-10-16 23:03:01 +02003877 ssl->out_msglen = out_buf_len -
Andrzej Kurek5462e022018-04-20 07:58:53 -04003878 ssl->transform_out->ctx_deflate.avail_out - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003879
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003880 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003881 ssl->out_msglen ) );
3882
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003883 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003884 ssl->out_msg, ssl->out_msglen );
3885
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003886 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003887
3888 return( 0 );
3889}
3890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003891static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003892{
3893 int ret;
3894 unsigned char *msg_post = ssl->in_msg;
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003895 ptrdiff_t header_bytes = ssl->in_msg - ssl->in_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003896 size_t len_pre = ssl->in_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003897 unsigned char *msg_pre = ssl->compress_buf;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003898#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3899 size_t in_buf_len = ssl->in_buf_len;
3900#else
3901 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3902#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00003903
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003904 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003905
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003906 if( len_pre == 0 )
3907 return( 0 );
3908
Teppo Järvelin91d79382019-10-02 09:09:31 +03003909 mbedtls_platform_memcpy( msg_pre, ssl->in_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003910
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003911 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003912 ssl->in_msglen ) );
3913
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003914 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003915 ssl->in_msg, ssl->in_msglen );
3916
Paul Bakker48916f92012-09-16 19:57:18 +00003917 ssl->transform_in->ctx_inflate.next_in = msg_pre;
3918 ssl->transform_in->ctx_inflate.avail_in = len_pre;
3919 ssl->transform_in->ctx_inflate.next_out = msg_post;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003920 ssl->transform_in->ctx_inflate.avail_out = in_buf_len -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003921 header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003922
Paul Bakker48916f92012-09-16 19:57:18 +00003923 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003924 if( ret != Z_OK )
3925 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003926 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
3927 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003928 }
3929
Andrzej Kurekf3844952020-10-16 23:03:01 +02003930 ssl->in_msglen = in_buf_len -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003931 ssl->transform_in->ctx_inflate.avail_out - header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003932
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003933 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003934 ssl->in_msglen ) );
3935
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003936 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003937 ssl->in_msg, ssl->in_msglen );
3938
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003939 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003940
3941 return( 0 );
3942}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003943#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00003944
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003945#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
3946static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003947
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003948#if defined(MBEDTLS_SSL_PROTO_DTLS)
3949static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003950{
3951 /* If renegotiation is not enforced, retransmit until we would reach max
3952 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003953 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003954 {
Hanno Becker1f835fa2019-06-13 10:14:59 +01003955 uint32_t ratio =
3956 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) /
3957 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003958 unsigned char doublings = 1;
3959
3960 while( ratio != 0 )
3961 {
3962 ++doublings;
3963 ratio >>= 1;
3964 }
3965
3966 if( ++ssl->renego_records_seen > doublings )
3967 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02003968 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003969 return( 0 );
3970 }
3971 }
3972
3973 return( ssl_write_hello_request( ssl ) );
3974}
3975#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003976#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003977
Paul Bakker5121ce52009-01-03 21:22:43 +00003978/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003979 * Fill the input message buffer by appending data to it.
3980 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003981 *
3982 * If we return 0, is it guaranteed that (at least) nb_want bytes are
3983 * available (from this read and/or a previous one). Otherwise, an error code
3984 * is returned (possibly EOF or WANT_READ).
3985 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003986 * With stream transport (TLS) on success ssl->in_left == nb_want, but
3987 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
3988 * since we always read a whole datagram at once.
3989 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003990 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003991 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00003992 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003993int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00003994{
Paul Bakker23986e52011-04-24 08:57:21 +00003995 int ret;
3996 size_t len;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003997#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3998 size_t in_buf_len = ssl->in_buf_len;
3999#else
4000 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4001#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004002
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004003 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004004
Hanno Beckera58a8962019-06-13 16:11:15 +01004005 if( mbedtls_ssl_get_recv( ssl ) == NULL &&
4006 mbedtls_ssl_get_recv_timeout( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004007 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004008 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01004009 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004010 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004011 }
4012
Andrzej Kurekf3844952020-10-16 23:03:01 +02004013 if( nb_want > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004014 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004015 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
4016 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004017 }
4018
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004019#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004020 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004021 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004022 uint32_t timeout;
4023
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02004024 /* Just to be sure */
Hanno Becker0ae6b242019-06-13 16:45:36 +01004025 if( mbedtls_ssl_get_set_timer( ssl ) == NULL ||
4026 mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02004027 {
4028 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
4029 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
4030 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4031 }
4032
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004033 /*
4034 * The point is, we need to always read a full datagram at once, so we
4035 * sometimes read more then requested, and handle the additional data.
4036 * It could be the rest of the current record (while fetching the
4037 * header) and/or some other records in the same datagram.
4038 */
4039
4040 /*
4041 * Move to the next record in the already read datagram if applicable
4042 */
4043 if( ssl->next_record_offset != 0 )
4044 {
4045 if( ssl->in_left < ssl->next_record_offset )
4046 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004047 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4048 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004049 }
4050
4051 ssl->in_left -= ssl->next_record_offset;
4052
4053 if( ssl->in_left != 0 )
4054 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004055 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004056 ssl->next_record_offset ) );
4057 memmove( ssl->in_hdr,
4058 ssl->in_hdr + ssl->next_record_offset,
4059 ssl->in_left );
4060 }
4061
4062 ssl->next_record_offset = 0;
4063 }
4064
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004065 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Paul Bakker5121ce52009-01-03 21:22:43 +00004066 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004067
4068 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004069 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004070 */
4071 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004072 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004073 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004074 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004075 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004076
4077 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01004078 * A record can't be split across datagrams. If we need to read but
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004079 * are not at the beginning of a new record, the caller did something
4080 * wrong.
4081 */
4082 if( ssl->in_left != 0 )
4083 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004084 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4085 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004086 }
4087
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004088 /*
4089 * Don't even try to read if time's out already.
4090 * This avoids by-passing the timer when repeatedly receiving messages
4091 * that will end up being dropped.
4092 */
4093 if( ssl_check_timer( ssl ) != 0 )
Hanno Beckere65ce782017-05-22 14:47:48 +01004094 {
4095 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004096 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Hanno Beckere65ce782017-05-22 14:47:48 +01004097 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004098 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004099 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02004100 len = in_buf_len - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004101
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004102 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004103 timeout = ssl->handshake->retransmit_timeout;
4104 else
Hanno Becker1f835fa2019-06-13 10:14:59 +01004105 timeout = mbedtls_ssl_conf_get_read_timeout( ssl->conf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004106
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004107 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004108
Hanno Beckera58a8962019-06-13 16:11:15 +01004109 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
4110 {
4111 ret = mbedtls_ssl_get_recv_timeout( ssl )
4112 ( ssl->p_bio, ssl->in_hdr, len, timeout );
4113 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004114 else
Hanno Beckera58a8962019-06-13 16:11:15 +01004115 {
4116 ret = mbedtls_ssl_get_recv( ssl )
4117 ( ssl->p_bio, ssl->in_hdr, len );
4118 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004119
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004120 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004121
4122 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004123 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004124 }
4125
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004126 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004127 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004128 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004129 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004130
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004131 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004132 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004133 if( ssl_double_retransmit_timeout( ssl ) != 0 )
4134 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004135 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004136 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004137 }
4138
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004139 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004140 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004141 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004142 return( ret );
4143 }
4144
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004145 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004146 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004147#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +01004148 else if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4149 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004150 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004151 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004152 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004153 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004154 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004155 return( ret );
4156 }
4157
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004158 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004159 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004160#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004161 }
4162
Paul Bakker5121ce52009-01-03 21:22:43 +00004163 if( ret < 0 )
4164 return( ret );
4165
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004166 ssl->in_left = ret;
4167 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004168 MBEDTLS_SSL_TRANSPORT_ELSE
4169#endif /* MBEDTLS_SSL_PROTO_DTLS */
4170#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004171 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004172 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004173 ssl->in_left, nb_want ) );
4174
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004175 while( ssl->in_left < nb_want )
4176 {
4177 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02004178
4179 if( ssl_check_timer( ssl ) != 0 )
4180 ret = MBEDTLS_ERR_SSL_TIMEOUT;
4181 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004182 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004183 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004184 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004185 ret = mbedtls_ssl_get_recv_timeout( ssl )( ssl->p_bio,
4186 ssl->in_hdr + ssl->in_left, len,
4187 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004188 }
4189 else
4190 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004191 ret = mbedtls_ssl_get_recv( ssl )( ssl->p_bio,
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004192 ssl->in_hdr + ssl->in_left, len );
4193 }
4194 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004195
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004196 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004197 ssl->in_left, nb_want ) );
4198 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004199
4200 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004201 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004202
4203 if( ret < 0 )
4204 return( ret );
4205
mohammad160352aecb92018-03-28 23:41:40 -07004206 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16035bd15cb2018-02-28 04:30:59 -08004207 {
Darryl Green11999bb2018-03-13 15:22:58 +00004208 MBEDTLS_SSL_DEBUG_MSG( 1,
4209 ( "f_recv returned %d bytes but only %lu were requested",
mohammad160319d392b2018-04-02 07:25:26 -07004210 ret, (unsigned long)len ) );
mohammad16035bd15cb2018-02-28 04:30:59 -08004211 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4212 }
4213
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004214 ssl->in_left += ret;
4215 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004216 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004217#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00004218
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004219 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004220
4221 return( 0 );
4222}
4223
4224/*
4225 * Flush any data not yet written
4226 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004227int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004228{
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01004229 int ret;
Hanno Becker04484622018-08-06 09:49:38 +01004230 unsigned char *buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00004231
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004232 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004233
Hanno Beckera58a8962019-06-13 16:11:15 +01004234 if( mbedtls_ssl_get_send( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004235 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004236 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01004237 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004238 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004239 }
4240
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004241 /* Avoid incrementing counter if data is flushed */
4242 if( ssl->out_left == 0 )
4243 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004244 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004245 return( 0 );
4246 }
4247
Paul Bakker5121ce52009-01-03 21:22:43 +00004248 while( ssl->out_left > 0 )
4249 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004250 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
Hanno Becker43395762019-05-03 14:46:38 +01004251 mbedtls_ssl_out_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004252
Hanno Becker2b1e3542018-08-06 11:19:13 +01004253 buf = ssl->out_hdr - ssl->out_left;
Hanno Beckera58a8962019-06-13 16:11:15 +01004254 ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00004255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004256 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004257
4258 if( ret <= 0 )
4259 return( ret );
4260
mohammad160352aecb92018-03-28 23:41:40 -07004261 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16034bbaeb42018-02-22 04:29:04 -08004262 {
Darryl Green11999bb2018-03-13 15:22:58 +00004263 MBEDTLS_SSL_DEBUG_MSG( 1,
4264 ( "f_send returned %d bytes but only %lu bytes were sent",
mohammad160319d392b2018-04-02 07:25:26 -07004265 ret, (unsigned long)ssl->out_left ) );
mohammad16034bbaeb42018-02-22 04:29:04 -08004266 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4267 }
4268
Paul Bakker5121ce52009-01-03 21:22:43 +00004269 ssl->out_left -= ret;
4270 }
4271
Hanno Becker2b1e3542018-08-06 11:19:13 +01004272#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004273 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004274 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004275 ssl->out_hdr = ssl->out_buf;
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004276 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004277 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2b1e3542018-08-06 11:19:13 +01004278#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004279#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +01004280 {
4281 ssl->out_hdr = ssl->out_buf + 8;
4282 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004283#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004284 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004285
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004286 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004287
4288 return( 0 );
4289}
4290
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004291/*
4292 * Functions to handle the DTLS retransmission state machine
4293 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004294#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004295/*
4296 * Append current handshake message to current outgoing flight
4297 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004298static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004299{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004300 mbedtls_ssl_flight_item *msg;
Hanno Becker3b235902018-08-06 09:54:53 +01004301 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
4302 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
4303 ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004304
4305 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004306 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004307 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004308 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004309 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004310 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004311 }
4312
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004313 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004314 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004315 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004316 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004317 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004318 }
4319
4320 /* Copy current handshake message with headers */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004321 mbedtls_platform_memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004322 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004323 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004324 msg->next = NULL;
4325
4326 /* Append to the current flight */
4327 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004328 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004329 else
4330 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004331 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004332 while( cur->next != NULL )
4333 cur = cur->next;
4334 cur->next = msg;
4335 }
4336
Hanno Becker3b235902018-08-06 09:54:53 +01004337 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004338 return( 0 );
4339}
4340
4341/*
4342 * Free the current flight of handshake messages
4343 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004344static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004345{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004346 mbedtls_ssl_flight_item *cur = flight;
4347 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004348
4349 while( cur != NULL )
4350 {
4351 next = cur->next;
4352
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004353 mbedtls_free( cur->p );
4354 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004355
4356 cur = next;
4357 }
4358}
4359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004360#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4361static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004362#endif
4363
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004364/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004365 * Swap transform_out and out_ctr with the alternative ones
4366 */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004367static int ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004368{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004369 mbedtls_ssl_transform *tmp_transform;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004370 unsigned char tmp_out_ctr[8];
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004371#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4372 int ret;
4373#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004374
4375 if( ssl->transform_out == ssl->handshake->alt_transform_out )
4376 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004377 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004378 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004379 }
4380
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004381 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004382
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004383 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004384 tmp_transform = ssl->transform_out;
4385 ssl->transform_out = ssl->handshake->alt_transform_out;
4386 ssl->handshake->alt_transform_out = tmp_transform;
4387
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004388 /* Swap epoch + sequence_number */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004389 mbedtls_platform_memcpy( tmp_out_ctr, ssl->cur_out_ctr, 8 );
4390 mbedtls_platform_memcpy( ssl->cur_out_ctr, ssl->handshake->alt_out_ctr, 8 );
4391 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004392
4393 /* Adjust to the newly activated transform */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004394 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004395
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004396#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4397 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004398 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004399 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004400 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004401 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
4402 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004403 }
4404 }
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004405#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
4406
4407 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004408}
4409
4410/*
4411 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004412 */
4413int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
4414{
4415 int ret = 0;
4416
4417 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
4418
4419 ret = mbedtls_ssl_flight_transmit( ssl );
4420
4421 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
4422
4423 return( ret );
4424}
4425
4426/*
4427 * Transmit or retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004428 *
4429 * Need to remember the current message in case flush_output returns
4430 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004431 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004432 */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004433int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004434{
Hanno Becker67bc7c32018-08-06 11:33:50 +01004435 int ret;
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004436 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004438 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004439 {
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004440 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004441
4442 ssl->handshake->cur_msg = ssl->handshake->flight;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004443 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004444 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4445 return( ret );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004446
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004447 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004448 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004449
4450 while( ssl->handshake->cur_msg != NULL )
4451 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004452 size_t max_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004453 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004454
Hanno Beckere1dcb032018-08-17 16:47:58 +01004455 int const is_finished =
4456 ( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
4457 cur->p[0] == MBEDTLS_SSL_HS_FINISHED );
4458
Hanno Becker04da1892018-08-14 13:22:10 +01004459 uint8_t const force_flush = ssl->disable_datagram_packing == 1 ?
4460 SSL_FORCE_FLUSH : SSL_DONT_FORCE_FLUSH;
4461
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004462 /* Swap epochs before sending Finished: we can't do it after
4463 * sending ChangeCipherSpec, in case write returns WANT_READ.
4464 * Must be done before copying, may change out_msg pointer */
Hanno Beckere1dcb032018-08-17 16:47:58 +01004465 if( is_finished && ssl->handshake->cur_msg_p == ( cur->p + 12 ) )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004466 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004467 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004468 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4469 return( ret );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004470 }
4471
Hanno Becker67bc7c32018-08-06 11:33:50 +01004472 ret = ssl_get_remaining_payload_in_datagram( ssl );
4473 if( ret < 0 )
4474 return( ret );
4475 max_frag_len = (size_t) ret;
4476
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004477 /* CCS is copied as is, while HS messages may need fragmentation */
4478 if( cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4479 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004480 if( max_frag_len == 0 )
4481 {
4482 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4483 return( ret );
4484
4485 continue;
4486 }
4487
Teppo Järvelin91d79382019-10-02 09:09:31 +03004488 mbedtls_platform_memcpy( ssl->out_msg, cur->p, cur->len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004489 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004490 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004491
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004492 /* Update position inside current message */
4493 ssl->handshake->cur_msg_p += cur->len;
4494 }
4495 else
4496 {
4497 const unsigned char * const p = ssl->handshake->cur_msg_p;
4498 const size_t hs_len = cur->len - 12;
4499 const size_t frag_off = p - ( cur->p + 12 );
4500 const size_t rem_len = hs_len - frag_off;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004501 size_t cur_hs_frag_len, max_hs_frag_len;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004502
Hanno Beckere1dcb032018-08-17 16:47:58 +01004503 if( ( max_frag_len < 12 ) || ( max_frag_len == 12 && hs_len != 0 ) )
Manuel Pégourié-Gonnarda1071a52018-08-20 11:56:14 +02004504 {
Hanno Beckere1dcb032018-08-17 16:47:58 +01004505 if( is_finished )
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004506 {
4507 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4508 return( ret );
4509 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004510
Hanno Becker67bc7c32018-08-06 11:33:50 +01004511 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4512 return( ret );
4513
4514 continue;
4515 }
4516 max_hs_frag_len = max_frag_len - 12;
4517
4518 cur_hs_frag_len = rem_len > max_hs_frag_len ?
4519 max_hs_frag_len : rem_len;
4520
4521 if( frag_off == 0 && cur_hs_frag_len != hs_len )
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004522 {
4523 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
Hanno Becker67bc7c32018-08-06 11:33:50 +01004524 (unsigned) cur_hs_frag_len,
4525 (unsigned) max_hs_frag_len ) );
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004526 }
Manuel Pégourié-Gonnardb747c6c2018-08-12 13:28:53 +02004527
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004528 /* Messages are stored with handshake headers as if not fragmented,
4529 * copy beginning of headers then fill fragmentation fields.
4530 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004531 mbedtls_platform_memcpy( ssl->out_msg, cur->p, 6 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004532
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004533 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[6], frag_off );
4534 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[9],
4535 cur_hs_frag_len );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004536
4537 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl->out_msg, 12 );
4538
Hanno Becker3f7b9732018-08-28 09:53:25 +01004539 /* Copy the handshake message content and set records fields */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004540 mbedtls_platform_memcpy( ssl->out_msg + 12, p, cur_hs_frag_len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004541 ssl->out_msglen = cur_hs_frag_len + 12;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004542 ssl->out_msgtype = cur->type;
4543
4544 /* Update position inside current message */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004545 ssl->handshake->cur_msg_p += cur_hs_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004546 }
4547
4548 /* If done with the current message move to the next one if any */
4549 if( ssl->handshake->cur_msg_p >= cur->p + cur->len )
4550 {
4551 if( cur->next != NULL )
4552 {
4553 ssl->handshake->cur_msg = cur->next;
4554 ssl->handshake->cur_msg_p = cur->next->p + 12;
4555 }
4556 else
4557 {
4558 ssl->handshake->cur_msg = NULL;
4559 ssl->handshake->cur_msg_p = NULL;
4560 }
4561 }
4562
4563 /* Actually send the message out */
Hanno Becker04da1892018-08-14 13:22:10 +01004564 if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004565 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004566 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004567 return( ret );
4568 }
4569 }
4570
Hanno Becker67bc7c32018-08-06 11:33:50 +01004571 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4572 return( ret );
4573
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004574 /* Update state and set timer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004575 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
4576 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02004577 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004578 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004579 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004580 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
4581 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004582
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004583 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004584
4585 return( 0 );
4586}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004587
4588/*
4589 * To be called when the last message of an incoming flight is received.
4590 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004591void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004592{
4593 /* We won't need to resend that one any more */
4594 ssl_flight_free( ssl->handshake->flight );
4595 ssl->handshake->flight = NULL;
4596 ssl->handshake->cur_msg = NULL;
4597
4598 /* The next incoming flight will start with this msg_seq */
4599 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
4600
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004601 /* We don't want to remember CCS's across flight boundaries. */
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004602 ssl->handshake->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004603
Hanno Becker0271f962018-08-16 13:23:47 +01004604 /* Clear future message buffering structure. */
4605 ssl_buffering_free( ssl );
4606
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004607 /* Cancel timer */
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004608 ssl_set_timer( ssl, 0 );
4609
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004610 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4611 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004612 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004613 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004614 }
4615 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004616 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004617}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004618
4619/*
4620 * To be called when the last message of an outgoing flight is send.
4621 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004622void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004623{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004624 ssl_reset_retransmit_timeout( ssl );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004625 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004626
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004627 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4628 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004629 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004630 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004631 }
4632 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004633 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004634}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004635#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004636
Paul Bakker5121ce52009-01-03 21:22:43 +00004637/*
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004638 * Handshake layer functions
Paul Bakker5121ce52009-01-03 21:22:43 +00004639 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004640
4641/*
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004642 * Write (DTLS: or queue) current handshake (including CCS) message.
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004643 *
4644 * - fill in handshake headers
4645 * - update handshake checksum
4646 * - DTLS: save message for resending
4647 * - then pass to the record layer
4648 *
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004649 * DTLS: except for HelloRequest, messages are only queued, and will only be
4650 * actually sent when calling flight_transmit() or resend().
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004651 *
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004652 * Inputs:
4653 * - ssl->out_msglen: 4 + actual handshake message len
4654 * (4 is the size of handshake headers for TLS)
4655 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
4656 * - ssl->out_msg + 4: the handshake message body
4657 *
Manuel Pégourié-Gonnard065a2a32018-08-20 11:09:26 +02004658 * Outputs, ie state before passing to flight_append() or write_record():
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004659 * - ssl->out_msglen: the length of the record contents
4660 * (including handshake headers but excluding record headers)
4661 * - ssl->out_msg: the record contents (handshake headers + content)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004662 */
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004663int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004664{
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004665 int ret;
4666 const size_t hs_len = ssl->out_msglen - 4;
4667 const unsigned char hs_type = ssl->out_msg[0];
Paul Bakker5121ce52009-01-03 21:22:43 +00004668
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004669 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
4670
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004671 /*
4672 * Sanity checks
4673 */
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004674 if( ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004675 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4676 {
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004677 /* In SSLv3, the client might send a NoCertificate alert. */
4678#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2881d802019-05-22 14:44:53 +01004679 if( ! ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004680 ssl->out_msgtype == MBEDTLS_SSL_MSG_ALERT &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01004681 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4682 MBEDTLS_SSL_IS_CLIENT ) )
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004683#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
4684 {
4685 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4686 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4687 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004688 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004689
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004690 /* Whenever we send anything different from a
4691 * HelloRequest we should be in a handshake - double check. */
4692 if( ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4693 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) &&
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004694 ssl->handshake == NULL )
4695 {
4696 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4697 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4698 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004699
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004700#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004701 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004702 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004703 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004704 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4706 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004707 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004708#endif
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004709
Hanno Beckerb50a2532018-08-06 11:52:54 +01004710 /* Double-check that we did not exceed the bounds
4711 * of the outgoing record buffer.
4712 * This should never fail as the various message
4713 * writing functions must obey the bounds of the
4714 * outgoing record buffer, but better be safe.
4715 *
4716 * Note: We deliberately do not check for the MTU or MFL here.
4717 */
4718 if( ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN )
4719 {
4720 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
4721 "size %u, maximum %u",
4722 (unsigned) ssl->out_msglen,
4723 (unsigned) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
4724 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4725 }
4726
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004727 /*
4728 * Fill handshake headers
4729 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004730 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004731 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004732 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[1], hs_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00004733
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004734 /*
4735 * DTLS has additional fields in the Handshake layer,
4736 * between the length field and the actual payload:
4737 * uint16 message_seq;
4738 * uint24 fragment_offset;
4739 * uint24 fragment_length;
4740 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004741#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004742 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004743 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004744 /* Make room for the additional DTLS fields */
Angus Grattond8213d02016-05-25 20:56:48 +10004745 if( MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8 )
Hanno Becker9648f8b2017-09-18 10:55:54 +01004746 {
4747 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
4748 "size %u, maximum %u",
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004749 (unsigned) ( hs_len ),
Angus Grattond8213d02016-05-25 20:56:48 +10004750 (unsigned) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
Hanno Becker9648f8b2017-09-18 10:55:54 +01004751 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4752 }
4753
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004754 memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004755 ssl->out_msglen += 8;
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004756
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004757 /* Write message_seq and update it, except for HelloRequest */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004758 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004759 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004760 (void)mbedtls_platform_put_uint16_be( &ssl->out_msg[4],
4761 ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02004762 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004763 }
4764 else
4765 {
4766 ssl->out_msg[4] = 0;
4767 ssl->out_msg[5] = 0;
4768 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004769
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004770 /* Handshake hashes are computed without fragmentation,
4771 * so set frag_offset = 0 and frag_len = hs_len for now */
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02004772 if( mbedtls_platform_memset( ssl->out_msg + 6, 0x00, 3 ) !=
4773 ssl->out_msg + 6 )
4774 {
4775 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
4776 }
4777 if( mbedtls_platform_memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 ) !=
4778 ssl->out_msg + 9 )
4779 {
4780 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
4781 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004782 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004783#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004784
Hanno Becker0207e532018-08-28 10:28:28 +01004785 /* Update running hashes of handshake messages seen */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004786 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Hanno Becker8a4b5902019-08-15 17:04:57 +01004787 mbedtls_ssl_update_checksum( ssl, ssl->out_msg, ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00004788 }
4789
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004790 /* Either send now, or just save to be sent (and resent) later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004791#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004792 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004793 ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4794 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004795 {
4796 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
4797 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004798 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004799 return( ret );
4800 }
4801 }
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004802 else
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004803#endif
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004804 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004805 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004806 {
4807 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
4808 return( ret );
4809 }
4810 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004811
4812 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
4813
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004814 return( 0 );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004815}
4816
4817/*
4818 * Record layer functions
4819 */
4820
4821/*
4822 * Write current record.
4823 *
4824 * Uses:
4825 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
4826 * - ssl->out_msglen: length of the record content (excl headers)
4827 * - ssl->out_msg: record content
4828 */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004829int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush )
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004830{
4831 int ret, done = 0;
4832 size_t len = ssl->out_msglen;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004833 uint8_t flush = force_flush;
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004834
4835 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004836
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004837#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00004838 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004839 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00004840 {
4841 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
4842 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004843 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004844 return( ret );
4845 }
4846
4847 len = ssl->out_msglen;
4848 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004849#endif /*MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004850
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004851#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4852 if( mbedtls_ssl_hw_record_write != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004853 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004854 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004855
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004856 ret = mbedtls_ssl_hw_record_write( ssl );
4857 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00004858 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004859 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
4860 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004861 }
Paul Bakkerc7878112012-12-19 14:41:14 +01004862
4863 if( ret == 0 )
4864 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00004865 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004866#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00004867 if( !done )
4868 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004869 unsigned i;
4870 size_t protected_record_size;
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004871 volatile int encrypted_fi = 0;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004872#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4873 size_t out_buf_len = ssl->out_buf_len;
4874#else
4875 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4876#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004877
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004878 /* Skip writing the record content type to after the encryption,
4879 * as it may change when using the CID extension. */
4880
Hanno Becker2881d802019-05-22 14:44:53 +01004881 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4882 mbedtls_ssl_get_minor_ver( ssl ),
4883 ssl->conf->transport, ssl->out_hdr + 1 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01004884
Teppo Järvelin91d79382019-10-02 09:09:31 +03004885 mbedtls_platform_memcpy( ssl->out_ctr, ssl->cur_out_ctr, 8 );
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004886 (void)mbedtls_platform_put_uint16_be( ssl->out_len, len );
Paul Bakker05ef8352012-05-08 09:17:57 +00004887
Paul Bakker48916f92012-09-16 19:57:18 +00004888 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00004889 {
Hanno Becker3307b532017-12-27 21:37:21 +00004890 mbedtls_record rec;
4891
4892 rec.buf = ssl->out_iv;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004893 rec.buf_len = out_buf_len - ( ssl->out_iv - ssl->out_buf );
Hanno Becker3307b532017-12-27 21:37:21 +00004894 rec.data_len = ssl->out_msglen;
4895 rec.data_offset = ssl->out_msg - rec.buf;
4896
Teppo Järvelin91d79382019-10-02 09:09:31 +03004897 mbedtls_platform_memcpy( &rec.ctr[0], ssl->out_ctr, 8 );
Hanno Becker2881d802019-05-22 14:44:53 +01004898 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4899 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Becker3307b532017-12-27 21:37:21 +00004900 ssl->conf->transport, rec.ver );
4901 rec.type = ssl->out_msgtype;
4902
Hanno Beckera5a2b082019-05-15 14:03:01 +01004903#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01004904 /* The CID is set by mbedtls_ssl_encrypt_buf(). */
Hanno Beckere83efe62019-04-29 13:52:53 +01004905 rec.cid_len = 0;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004906#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01004907
Hanno Becker611a83b2018-01-03 14:27:32 +00004908 if( ( ret = mbedtls_ssl_encrypt_buf( ssl, ssl->transform_out, &rec,
Hanno Beckerece325c2019-06-13 15:39:27 +01004909 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01004910 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00004911 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004912 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00004913 return( ret );
4914 }
4915
Hanno Becker3307b532017-12-27 21:37:21 +00004916 if( rec.data_offset != 0 )
4917 {
4918 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4919 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4920 }
4921
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004922 /* Update the record content type and CID. */
4923 ssl->out_msgtype = rec.type;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004924#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID )
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03004925 /* Not using more secure mbedtls_platform_memcpy as cid is public */
4926 memcpy( ssl->out_cid, rec.cid, rec.cid_len );
Hanno Beckera5a2b082019-05-15 14:03:01 +01004927#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc5aee962019-03-14 12:56:23 +00004928 ssl->out_msglen = len = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004929 (void)mbedtls_platform_put_uint16_be( ssl->out_len, rec.data_len );
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004930 encrypted_fi = 1;
4931 }
4932
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004933 /* Double check to ensure the encryption has been done */
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004934 if( ssl->transform_out != NULL && encrypted_fi == 0 )
4935 {
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004936 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004937 }
4938
Hanno Becker43395762019-05-03 14:46:38 +01004939 protected_record_size = len + mbedtls_ssl_out_hdr_len( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01004940
4941#if defined(MBEDTLS_SSL_PROTO_DTLS)
4942 /* In case of DTLS, double-check that we don't exceed
4943 * the remaining space in the datagram. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004944 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2b1e3542018-08-06 11:19:13 +01004945 {
Hanno Becker554b0af2018-08-22 20:33:41 +01004946 ret = ssl_get_remaining_space_in_datagram( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01004947 if( ret < 0 )
4948 return( ret );
4949
4950 if( protected_record_size > (size_t) ret )
4951 {
4952 /* Should never happen */
4953 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4954 }
4955 }
4956#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker05ef8352012-05-08 09:17:57 +00004957
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004958 /* Now write the potentially updated record content type. */
4959 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
4960
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004961 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01004962 "version = [%d:%d], msglen = %d",
4963 ssl->out_hdr[0], ssl->out_hdr[1],
4964 ssl->out_hdr[2], len ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00004965
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004966 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01004967 ssl->out_hdr, protected_record_size );
Hanno Becker2b1e3542018-08-06 11:19:13 +01004968
4969 ssl->out_left += protected_record_size;
4970 ssl->out_hdr += protected_record_size;
4971 ssl_update_out_pointers( ssl, ssl->transform_out );
4972
Hanno Becker04484622018-08-06 09:49:38 +01004973 for( i = 8; i > ssl_ep_len( ssl ); i-- )
4974 if( ++ssl->cur_out_ctr[i - 1] != 0 )
4975 break;
4976
4977 /* The loop goes to its end iff the counter is wrapping */
4978 if( i == ssl_ep_len( ssl ) )
4979 {
4980 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
4981 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
4982 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004983 }
4984
Hanno Becker67bc7c32018-08-06 11:33:50 +01004985#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004986 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker47db8772018-08-21 13:32:13 +01004987 flush == SSL_DONT_FORCE_FLUSH )
Hanno Becker67bc7c32018-08-06 11:33:50 +01004988 {
Hanno Becker1f5a15d2018-08-21 13:31:31 +01004989 size_t remaining;
4990 ret = ssl_get_remaining_payload_in_datagram( ssl );
4991 if( ret < 0 )
4992 {
4993 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
4994 ret );
4995 return( ret );
4996 }
4997
4998 remaining = (size_t) ret;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004999 if( remaining == 0 )
Hanno Beckerf0da6672018-08-28 09:55:10 +01005000 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01005001 flush = SSL_FORCE_FLUSH;
Hanno Beckerf0da6672018-08-28 09:55:10 +01005002 }
Hanno Becker67bc7c32018-08-06 11:33:50 +01005003 else
5004 {
Hanno Becker513815a2018-08-20 11:56:09 +01005005 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining ) );
Hanno Becker67bc7c32018-08-06 11:33:50 +01005006 }
5007 }
5008#endif /* MBEDTLS_SSL_PROTO_DTLS */
5009
5010 if( ( flush == SSL_FORCE_FLUSH ) &&
5011 ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005012 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005013 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005014 return( ret );
5015 }
5016
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005017 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005018
5019 return( 0 );
5020}
5021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005022#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckere25e3b72018-08-16 09:30:53 +01005023
5024static int ssl_hs_is_proper_fragment( mbedtls_ssl_context *ssl )
5025{
5026 if( ssl->in_msglen < ssl->in_hslen ||
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02005027 mbedtls_platform_memequal( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
5028 mbedtls_platform_memequal( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
Hanno Beckere25e3b72018-08-16 09:30:53 +01005029 {
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04005030 return( PROPER_HS_FRAGMENT );
Hanno Beckere25e3b72018-08-16 09:30:53 +01005031 }
5032 return( 0 );
5033}
Hanno Becker44650b72018-08-16 12:51:11 +01005034
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005035static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005036{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005037 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[9] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01005038}
5039
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005040static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005041{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005042 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[6] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01005043}
5044
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005045static int ssl_check_hs_header( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005046{
5047 uint32_t msg_len, frag_off, frag_len;
5048
5049 msg_len = ssl_get_hs_total_len( ssl );
5050 frag_off = ssl_get_hs_frag_off( ssl );
5051 frag_len = ssl_get_hs_frag_len( ssl );
5052
5053 if( frag_off > msg_len )
5054 return( -1 );
5055
5056 if( frag_len > msg_len - frag_off )
5057 return( -1 );
5058
5059 if( frag_len + 12 > ssl->in_msglen )
5060 return( -1 );
5061
5062 return( 0 );
5063}
5064
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005065/*
5066 * Mark bits in bitmask (used for DTLS HS reassembly)
5067 */
5068static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
5069{
5070 unsigned int start_bits, end_bits;
5071
5072 start_bits = 8 - ( offset % 8 );
5073 if( start_bits != 8 )
5074 {
5075 size_t first_byte_idx = offset / 8;
5076
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02005077 /* Special case */
5078 if( len <= start_bits )
5079 {
5080 for( ; len != 0; len-- )
5081 mask[first_byte_idx] |= 1 << ( start_bits - len );
5082
5083 /* Avoid potential issues with offset or len becoming invalid */
5084 return;
5085 }
5086
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005087 offset += start_bits; /* Now offset % 8 == 0 */
5088 len -= start_bits;
5089
5090 for( ; start_bits != 0; start_bits-- )
5091 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
5092 }
5093
5094 end_bits = len % 8;
5095 if( end_bits != 0 )
5096 {
5097 size_t last_byte_idx = ( offset + len ) / 8;
5098
5099 len -= end_bits; /* Now len % 8 == 0 */
5100
5101 for( ; end_bits != 0; end_bits-- )
5102 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
5103 }
5104
5105 memset( mask + offset / 8, 0xFF, len / 8 );
5106}
5107
Andrzej Kurek0919b142020-07-06 15:28:59 -04005108#define BITMASK_CHECK_FAILED 0x75555555
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005109/*
5110 * Check that bitmask is full
5111 */
5112static int ssl_bitmask_check( unsigned char *mask, size_t len )
5113{
5114 size_t i;
5115
5116 for( i = 0; i < len / 8; i++ )
5117 if( mask[i] != 0xFF )
Andrzej Kurek0919b142020-07-06 15:28:59 -04005118 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005119
5120 for( i = 0; i < len % 8; i++ )
5121 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04005122 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005123
5124 return( 0 );
5125}
5126
Hanno Becker56e205e2018-08-16 09:06:12 +01005127/* msg_len does not include the handshake header */
Hanno Becker65dc8852018-08-23 09:40:49 +01005128static size_t ssl_get_reassembly_buffer_size( size_t msg_len,
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005129 unsigned add_bitmap )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005130{
Hanno Becker56e205e2018-08-16 09:06:12 +01005131 size_t alloc_len;
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005132
Hanno Becker56e205e2018-08-16 09:06:12 +01005133 alloc_len = 12; /* Handshake header */
5134 alloc_len += msg_len; /* Content buffer */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005135
Hanno Beckerd07df862018-08-16 09:14:58 +01005136 if( add_bitmap )
5137 alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap */
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005138
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005139 return( alloc_len );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005140}
Hanno Becker56e205e2018-08-16 09:06:12 +01005141
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005142#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005143
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005144static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl )
Hanno Becker12555c62018-08-16 12:47:53 +01005145{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005146 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[1] ) );
Hanno Becker12555c62018-08-16 12:47:53 +01005147}
Hanno Beckere25e3b72018-08-16 09:30:53 +01005148
Simon Butcher99000142016-10-13 17:21:01 +01005149int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005150{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005151 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005152 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005153 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005154 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005155 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005156 }
5157
Hanno Becker12555c62018-08-16 12:47:53 +01005158 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005160 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005161 " %d, type = %d, hslen = %d",
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01005162 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005163
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005164#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005165 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005166 {
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005167 int ret;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005168 unsigned int recv_msg_seq = (unsigned int)
5169 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005170
Hanno Becker44650b72018-08-16 12:51:11 +01005171 if( ssl_check_hs_header( ssl ) != 0 )
5172 {
5173 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
5174 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5175 }
5176
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005177 if( ssl->handshake != NULL &&
Hanno Beckerc76c6192017-06-06 10:03:17 +01005178 ( ( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
5179 recv_msg_seq != ssl->handshake->in_msg_seq ) ||
5180 ( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5181 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) ) )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005182 {
Hanno Becker9e1ec222018-08-15 15:54:43 +01005183 if( recv_msg_seq > ssl->handshake->in_msg_seq )
5184 {
5185 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
5186 recv_msg_seq,
5187 ssl->handshake->in_msg_seq ) );
5188 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5189 }
5190
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02005191 /* Retransmit only on last message from previous flight, to avoid
5192 * too many retransmissions.
5193 * Besides, No sane server ever retransmits HelloVerifyRequest */
5194 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005195 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005196 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005197 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005198 "message_seq = %d, start_of_flight = %d",
5199 recv_msg_seq,
5200 ssl->handshake->in_flight_start_seq ) );
5201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005202 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005203 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005204 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005205 return( ret );
5206 }
5207 }
5208 else
5209 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005210 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005211 "message_seq = %d, expected = %d",
5212 recv_msg_seq,
5213 ssl->handshake->in_msg_seq ) );
5214 }
5215
Hanno Becker90333da2017-10-10 11:27:13 +01005216 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005217 }
5218 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005219
Hanno Becker6d97ef52018-08-16 13:09:04 +01005220 /* Message reassembly is handled alongside buffering of future
5221 * messages; the commonality is that both handshake fragments and
Hanno Becker83ab41c2018-08-28 17:19:38 +01005222 * future messages cannot be forwarded immediately to the
Hanno Becker6d97ef52018-08-16 13:09:04 +01005223 * handshake logic layer. */
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04005224 if( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005225 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005226 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Hanno Becker6d97ef52018-08-16 13:09:04 +01005227 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005228 }
5229 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005230 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005231#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005232#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005233 {
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005234 /* With TLS we don't handle fragmentation (for now) */
5235 if( ssl->in_msglen < ssl->in_hslen )
5236 {
5237 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
5238 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
5239 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005240 }
Manuel Pégourié-Gonnardec1c2222019-06-12 10:18:26 +02005241#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005242
Simon Butcher99000142016-10-13 17:21:01 +01005243 return( 0 );
5244}
5245
5246void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
5247{
Hanno Becker0271f962018-08-16 13:23:47 +01005248 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Simon Butcher99000142016-10-13 17:21:01 +01005249
Hanno Becker0271f962018-08-16 13:23:47 +01005250 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && hs != NULL )
Hanno Becker8a4b5902019-08-15 17:04:57 +01005251 mbedtls_ssl_update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005252
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005253 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005254#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005255 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005256 ssl->handshake != NULL )
5257 {
Hanno Becker0271f962018-08-16 13:23:47 +01005258 unsigned offset;
5259 mbedtls_ssl_hs_buffer *hs_buf;
Hanno Beckere25e3b72018-08-16 09:30:53 +01005260
Hanno Becker0271f962018-08-16 13:23:47 +01005261 /* Increment handshake sequence number */
5262 hs->in_msg_seq++;
5263
5264 /*
5265 * Clear up handshake buffering and reassembly structure.
5266 */
5267
5268 /* Free first entry */
Hanno Beckere605b192018-08-21 15:59:07 +01005269 ssl_buffering_free_slot( ssl, 0 );
Hanno Becker0271f962018-08-16 13:23:47 +01005270
5271 /* Shift all other entries */
Hanno Beckere605b192018-08-21 15:59:07 +01005272 for( offset = 0, hs_buf = &hs->buffering.hs[0];
5273 offset + 1 < MBEDTLS_SSL_MAX_BUFFERED_HS;
Hanno Becker0271f962018-08-16 13:23:47 +01005274 offset++, hs_buf++ )
5275 {
5276 *hs_buf = *(hs_buf + 1);
5277 }
5278
5279 /* Create a fresh last entry */
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02005280 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005281 }
5282#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005283}
5284
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005285/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005286 * DTLS anti-replay: RFC 6347 4.1.2.6
5287 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005288 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
5289 * Bit n is set iff record number in_window_top - n has been seen.
5290 *
5291 * Usually, in_window_top is the last record number seen and the lsb of
5292 * in_window is set. The only exception is the initial state (record number 0
5293 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005294 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005295#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5296static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005297{
5298 ssl->in_window_top = 0;
5299 ssl->in_window = 0;
5300}
5301
5302static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
5303{
5304 return( ( (uint64_t) buf[0] << 40 ) |
5305 ( (uint64_t) buf[1] << 32 ) |
5306 ( (uint64_t) buf[2] << 24 ) |
5307 ( (uint64_t) buf[3] << 16 ) |
5308 ( (uint64_t) buf[4] << 8 ) |
5309 ( (uint64_t) buf[5] ) );
5310}
5311
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005312static int mbedtls_ssl_dtls_record_replay_check( mbedtls_ssl_context *ssl, uint8_t *record_in_ctr )
5313{
5314 int ret;
5315 unsigned char *original_in_ctr;
5316
5317 // save original in_ctr
5318 original_in_ctr = ssl->in_ctr;
5319
5320 // use counter from record
5321 ssl->in_ctr = record_in_ctr;
5322
5323 ret = mbedtls_ssl_dtls_replay_check( (mbedtls_ssl_context const *) ssl );
5324
5325 // restore the counter
5326 ssl->in_ctr = original_in_ctr;
5327
5328 return ret;
5329}
5330
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005331/*
5332 * Return 0 if sequence number is acceptable, -1 otherwise
5333 */
Hanno Beckerfc551722019-07-12 08:50:37 +01005334int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context const *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005335{
5336 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5337 uint64_t bit;
5338
Hanno Becker7f376f42019-06-12 16:20:48 +01005339 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5340 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5341 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005342 return( 0 );
Hanno Becker7f376f42019-06-12 16:20:48 +01005343 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005344
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005345 if( rec_seqnum > ssl->in_window_top )
5346 return( 0 );
5347
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005348 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005349
5350 if( bit >= 64 )
5351 return( -1 );
5352
5353 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
5354 return( -1 );
5355
5356 return( 0 );
5357}
5358
5359/*
5360 * Update replay window on new validated record
5361 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005362void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005363{
5364 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5365
Hanno Becker7f376f42019-06-12 16:20:48 +01005366 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5367 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5368 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005369 return;
Hanno Becker7f376f42019-06-12 16:20:48 +01005370 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005371
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005372 if( rec_seqnum > ssl->in_window_top )
5373 {
5374 /* Update window_top and the contents of the window */
5375 uint64_t shift = rec_seqnum - ssl->in_window_top;
5376
5377 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005378 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005379 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005380 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005381 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005382 ssl->in_window |= 1;
5383 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005384
5385 ssl->in_window_top = rec_seqnum;
5386 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005387 else
5388 {
5389 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005390 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005391
5392 if( bit < 64 ) /* Always true, but be extra sure */
5393 ssl->in_window |= (uint64_t) 1 << bit;
5394 }
5395}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005396#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005397
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005398#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005399/* Forward declaration */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005400static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
5401
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005402/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005403 * Without any SSL context, check if a datagram looks like a ClientHello with
5404 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01005405 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005406 *
5407 * - if cookie is valid, return 0
5408 * - if ClientHello looks superficially valid but cookie is not,
5409 * fill obuf and set olen, then
5410 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
5411 * - otherwise return a specific error code
5412 */
5413static int ssl_check_dtls_clihlo_cookie(
5414 mbedtls_ssl_cookie_write_t *f_cookie_write,
5415 mbedtls_ssl_cookie_check_t *f_cookie_check,
5416 void *p_cookie,
5417 const unsigned char *cli_id, size_t cli_id_len,
5418 const unsigned char *in, size_t in_len,
5419 unsigned char *obuf, size_t buf_len, size_t *olen )
5420{
5421 size_t sid_len, cookie_len;
5422 unsigned char *p;
5423
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005424 /*
5425 * Structure of ClientHello with record and handshake headers,
5426 * and expected values. We don't need to check a lot, more checks will be
5427 * done when actually parsing the ClientHello - skipping those checks
5428 * avoids code duplication and does not make cookie forging any easier.
5429 *
5430 * 0-0 ContentType type; copied, must be handshake
5431 * 1-2 ProtocolVersion version; copied
5432 * 3-4 uint16 epoch; copied, must be 0
5433 * 5-10 uint48 sequence_number; copied
5434 * 11-12 uint16 length; (ignored)
5435 *
5436 * 13-13 HandshakeType msg_type; (ignored)
5437 * 14-16 uint24 length; (ignored)
5438 * 17-18 uint16 message_seq; copied
5439 * 19-21 uint24 fragment_offset; copied, must be 0
5440 * 22-24 uint24 fragment_length; (ignored)
5441 *
5442 * 25-26 ProtocolVersion client_version; (ignored)
5443 * 27-58 Random random; (ignored)
5444 * 59-xx SessionID session_id; 1 byte len + sid_len content
5445 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
5446 * ...
5447 *
5448 * Minimum length is 61 bytes.
5449 */
5450 if( in_len < 61 ||
5451 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
5452 in[3] != 0 || in[4] != 0 ||
5453 in[19] != 0 || in[20] != 0 || in[21] != 0 )
5454 {
5455 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5456 }
5457
5458 sid_len = in[59];
5459 if( sid_len > in_len - 61 )
5460 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5461
5462 cookie_len = in[60 + sid_len];
5463 if( cookie_len > in_len - 60 )
5464 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5465
5466 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
5467 cli_id, cli_id_len ) == 0 )
5468 {
5469 /* Valid cookie */
5470 return( 0 );
5471 }
5472
5473 /*
5474 * If we get here, we've got an invalid cookie, let's prepare HVR.
5475 *
5476 * 0-0 ContentType type; copied
5477 * 1-2 ProtocolVersion version; copied
5478 * 3-4 uint16 epoch; copied
5479 * 5-10 uint48 sequence_number; copied
5480 * 11-12 uint16 length; olen - 13
5481 *
5482 * 13-13 HandshakeType msg_type; hello_verify_request
5483 * 14-16 uint24 length; olen - 25
5484 * 17-18 uint16 message_seq; copied
5485 * 19-21 uint24 fragment_offset; copied
5486 * 22-24 uint24 fragment_length; olen - 25
5487 *
5488 * 25-26 ProtocolVersion server_version; 0xfe 0xff
5489 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
5490 *
5491 * Minimum length is 28.
5492 */
5493 if( buf_len < 28 )
5494 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5495
5496 /* Copy most fields and adapt others */
Teppo Järvelin91d79382019-10-02 09:09:31 +03005497 mbedtls_platform_memcpy( obuf, in, 25 );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005498 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
5499 obuf[25] = 0xfe;
5500 obuf[26] = 0xff;
5501
5502 /* Generate and write actual cookie */
5503 p = obuf + 28;
5504 if( f_cookie_write( p_cookie,
5505 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
5506 {
5507 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5508 }
5509
5510 *olen = p - obuf;
5511
5512 /* Go back and fill length fields */
5513 obuf[27] = (unsigned char)( *olen - 28 );
5514
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005515 (void)mbedtls_platform_put_uint24_be( &obuf[14], ( *olen - 25 ) );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005516 obuf[22] = obuf[14];
5517 obuf[23] = obuf[15];
5518 obuf[24] = obuf[16];
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005519
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005520 (void)mbedtls_platform_put_uint16_be( &obuf[11], ( *olen - 13 ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005521
5522 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
5523}
5524
5525/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005526 * Handle possible client reconnect with the same UDP quadruplet
5527 * (RFC 6347 Section 4.2.8).
5528 *
5529 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
5530 * that looks like a ClientHello.
5531 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005532 * - if the input looks like a ClientHello without cookies,
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005533 * send back HelloVerifyRequest, then return 0
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005534 * - if the input looks like a ClientHello with a valid cookie,
5535 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02005536 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005537 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005538 *
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005539 * This function is called (through ssl_check_client_reconnect()) when an
5540 * unexpected record is found in ssl_get_next_record(), which will discard the
5541 * record if we return 0, and bubble up the return value otherwise (this
5542 * includes the case of MBEDTLS_ERR_SSL_CLIENT_RECONNECT and of unexpected
5543 * errors, and is the right thing to do in both cases).
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005544 */
5545static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
5546{
5547 int ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005548 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005549
Hanno Becker87b56262019-07-10 14:37:41 +01005550 if( ssl->conf->f_cookie_write == NULL ||
5551 ssl->conf->f_cookie_check == NULL )
5552 {
5553 /* If we can't use cookies to verify reachability of the peer,
5554 * drop the record. */
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005555 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no cookie callbacks, "
5556 "can't check reconnect validity" ) );
Hanno Becker87b56262019-07-10 14:37:41 +01005557 return( 0 );
5558 }
5559
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005560 ret = ssl_check_dtls_clihlo_cookie(
5561 ssl->conf->f_cookie_write,
5562 ssl->conf->f_cookie_check,
5563 ssl->conf->p_cookie,
5564 ssl->cli_id, ssl->cli_id_len,
5565 ssl->in_buf, ssl->in_left,
Angus Grattond8213d02016-05-25 20:56:48 +10005566 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005567
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005568 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
5569
5570 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005571 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005572 int send_ret;
5573 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
5574 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
5575 ssl->out_buf, len );
Brian J Murray1903fb32016-11-06 04:45:15 -08005576 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005577 * If the error is permanent we'll catch it later,
5578 * if it's not, then hopefully it'll work next time. */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005579 send_ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, ssl->out_buf, len );
5580 MBEDTLS_SSL_DEBUG_RET( 2, "mbedtls_ssl_get_send", send_ret );
5581 (void) send_ret;
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005582 return( 0 );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005583 }
5584
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005585 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005586 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005587 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005588 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
5589 {
5590 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
5591 return( ret );
5592 }
5593
5594 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005595 }
5596
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005597 return( ret );
5598}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005599#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005600
Hanno Becker46483f12019-05-03 13:25:54 +01005601static int ssl_check_record_type( uint8_t record_type )
5602{
5603 if( record_type != MBEDTLS_SSL_MSG_HANDSHAKE &&
5604 record_type != MBEDTLS_SSL_MSG_ALERT &&
5605 record_type != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
5606 record_type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
5607 {
5608 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5609 }
5610
5611 return( 0 );
5612}
5613
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005614/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005615 * ContentType type;
5616 * ProtocolVersion version;
5617 * uint16 epoch; // DTLS only
5618 * uint48 sequence_number; // DTLS only
5619 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005620 *
5621 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00005622 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005623 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
5624 *
5625 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00005626 * 1. proceed with the record if this function returns 0
5627 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
5628 * 3. return CLIENT_RECONNECT if this function return that value
5629 * 4. drop the whole datagram if this function returns anything else.
5630 * Point 2 is needed when the peer is resending, and we have already received
5631 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005632 */
Hanno Becker21fc61c2019-07-12 11:10:16 +01005633static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005634 unsigned char *buf,
5635 size_t len,
5636 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00005637{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005638 int major_ver, minor_ver;
Paul Bakker5121ce52009-01-03 21:22:43 +00005639
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005640 size_t const rec_hdr_type_offset = 0;
5641 size_t const rec_hdr_type_len = 1;
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02005642
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005643 size_t const rec_hdr_version_offset = rec_hdr_type_offset +
5644 rec_hdr_type_len;
5645 size_t const rec_hdr_version_len = 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00005646
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005647 size_t const rec_hdr_ctr_len = 8;
5648#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker61817612019-07-25 10:13:02 +01005649 uint32_t rec_epoch;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005650 size_t const rec_hdr_ctr_offset = rec_hdr_version_offset +
5651 rec_hdr_version_len;
5652
Hanno Beckera5a2b082019-05-15 14:03:01 +01005653#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005654 size_t const rec_hdr_cid_offset = rec_hdr_ctr_offset +
5655 rec_hdr_ctr_len;
Hanno Becker61817612019-07-25 10:13:02 +01005656 size_t rec_hdr_cid_len = 0;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005657#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5658#endif /* MBEDTLS_SSL_PROTO_DTLS */
5659
5660 size_t rec_hdr_len_offset; /* To be determined */
5661 size_t const rec_hdr_len_len = 2;
5662
5663 /*
5664 * Check minimum lengths for record header.
5665 */
5666
5667#if defined(MBEDTLS_SSL_PROTO_DTLS)
5668 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5669 {
5670 rec_hdr_len_offset = rec_hdr_ctr_offset + rec_hdr_ctr_len;
5671 }
5672 MBEDTLS_SSL_TRANSPORT_ELSE
5673#endif /* MBEDTLS_SSL_PROTO_DTLS */
5674#if defined(MBEDTLS_SSL_PROTO_TLS)
5675 {
5676 rec_hdr_len_offset = rec_hdr_version_offset + rec_hdr_version_len;
5677 }
5678#endif /* MBEDTLS_SSL_PROTO_DTLS */
5679
5680 if( len < rec_hdr_len_offset + rec_hdr_len_len )
5681 {
5682 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header of length %u",
5683 (unsigned) len,
5684 (unsigned)( rec_hdr_len_len + rec_hdr_len_len ) ) );
5685 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5686 }
5687
5688 /*
5689 * Parse and validate record content type
5690 */
5691
5692 rec->type = buf[ rec_hdr_type_offset ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005693
5694 /* Check record content type */
5695#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5696 rec->cid_len = 0;
5697
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005698 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005699 mbedtls_ssl_conf_get_cid_len( ssl->conf ) != 0 &&
5700 rec->type == MBEDTLS_SSL_MSG_CID )
Hanno Becker8b09b732019-05-08 12:03:28 +01005701 {
5702 /* Shift pointers to account for record header including CID
5703 * struct {
5704 * ContentType special_type = tls12_cid;
5705 * ProtocolVersion version;
5706 * uint16 epoch;
5707 * uint48 sequence_number;
Hanno Becker3b2bf5b2019-05-23 17:03:19 +01005708 * opaque cid[cid_length]; // Additional field compared to
5709 * // default DTLS record format
Hanno Becker8b09b732019-05-08 12:03:28 +01005710 * uint16 length;
5711 * opaque enc_content[DTLSCiphertext.length];
5712 * } DTLSCiphertext;
5713 */
5714
5715 /* So far, we only support static CID lengths
5716 * fixed in the configuration. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005717 rec_hdr_cid_len = mbedtls_ssl_conf_get_cid_len( ssl->conf );
5718 rec_hdr_len_offset += rec_hdr_cid_len;
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005719
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005720 if( len < rec_hdr_len_offset + rec_hdr_len_len )
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005721 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005722 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header including CID, length %u",
5723 (unsigned) len,
5724 (unsigned)( rec_hdr_len_offset + rec_hdr_len_len ) ) );
Hanno Becker29823462019-07-10 14:53:43 +01005725 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005726 }
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005727
Manuel Pégourié-Gonnardf3a15b32019-08-02 10:17:15 +02005728 /* configured CID len is guaranteed at most 255, see
5729 * MBEDTLS_SSL_CID_OUT_LEN_MAX in check_config.h */
5730 rec->cid_len = (uint8_t) rec_hdr_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005731 /* Not using more secure mbedtls_platform_memcpy as cid is public */
5732 memcpy( rec->cid, buf + rec_hdr_cid_offset, rec_hdr_cid_len );
Hanno Becker8b09b732019-05-08 12:03:28 +01005733 }
5734 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01005735#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005736 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005737 if( ssl_check_record_type( rec->type ) )
5738 {
Hanno Becker03e2db62019-07-12 14:40:00 +01005739 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type %u",
5740 (unsigned) rec->type ) );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005741 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5742 }
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005743 }
5744
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005745 /*
5746 * Parse and validate record version
5747 */
5748
Hanno Becker8061c6e2019-07-26 08:07:03 +01005749 rec->ver[0] = buf[ rec_hdr_version_offset + 0 ];
5750 rec->ver[1] = buf[ rec_hdr_version_offset + 1 ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005751 mbedtls_ssl_read_version( &major_ver, &minor_ver,
5752 ssl->conf->transport,
Hanno Becker8061c6e2019-07-26 08:07:03 +01005753 &rec->ver[0] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005754
Hanno Becker2881d802019-05-22 14:44:53 +01005755 if( major_ver != mbedtls_ssl_get_major_ver( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005756 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005757 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
5758 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005759 }
5760
Hanno Becker7bcf2b52019-07-26 09:02:40 +01005761 if( mbedtls_ssl_ver_gt( minor_ver,
5762 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ) ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005763 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005764 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
5765 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005766 }
5767
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005768 /*
5769 * Parse/Copy record sequence number.
5770 */
Hanno Becker8b09b732019-05-08 12:03:28 +01005771
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005772#if defined(MBEDTLS_SSL_PROTO_DTLS)
5773 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5774 {
5775 /* Copy explicit record sequence number from input buffer. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005776 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5777 memcpy( &rec->ctr[0], buf + rec_hdr_ctr_offset,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005778 rec_hdr_ctr_len );
5779 }
5780 MBEDTLS_SSL_TRANSPORT_ELSE
5781#endif /* MBEDTLS_SSL_PROTO_DTLS */
5782#if defined(MBEDTLS_SSL_PROTO_TLS)
5783 {
5784 /* Copy implicit record sequence number from SSL context structure. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005785 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5786 memcpy( &rec->ctr[0], ssl->in_ctr, rec_hdr_ctr_len );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005787 }
5788#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker8b09b732019-05-08 12:03:28 +01005789
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005790 /*
5791 * Parse record length.
5792 */
5793
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005794 rec->data_offset = rec_hdr_len_offset + rec_hdr_len_len;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005795 rec->data_len = mbedtls_platform_get_uint16_be( &buf[rec_hdr_len_offset] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005796 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", buf, rec->data_offset );
5797
Hanno Becker8b09b732019-05-08 12:03:28 +01005798 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
Hanno Beckerd8f7c4a2019-05-23 17:03:44 +01005799 "version = [%d:%d], msglen = %d",
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005800 rec->type,
5801 major_ver, minor_ver, rec->data_len ) );
5802
5803 rec->buf = buf;
5804 rec->buf_len = rec->data_offset + rec->data_len;
Hanno Becker8b09b732019-05-08 12:03:28 +01005805
Hanno Beckerec014082019-07-26 08:20:27 +01005806 if( rec->data_len == 0 )
5807 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5808
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005809 /*
Hanno Becker52c6dc62017-05-26 16:07:36 +01005810 * DTLS-related tests.
5811 * Check epoch before checking length constraint because
5812 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
5813 * message gets duplicated before the corresponding Finished message,
5814 * the second ChangeCipherSpec should be discarded because it belongs
5815 * to an old epoch, but not because its length is shorter than
5816 * the minimum record length for packets using the new record transform.
5817 * Note that these two kinds of failures are handled differently,
5818 * as an unexpected record is silently skipped but an invalid
5819 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005820 */
5821#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005822 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005823 {
Arto Kinnunena3fa06e2019-09-09 12:22:51 +03005824 rec_epoch = (uint32_t)mbedtls_platform_get_uint16_be( rec->ctr );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005825
Hanno Beckere0452772019-07-10 17:12:07 +01005826 /* Check that the datagram is large enough to contain a record
5827 * of the advertised length. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005828 if( len < rec->data_offset + rec->data_len )
Hanno Beckere0452772019-07-10 17:12:07 +01005829 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005830 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Datagram of length %u too small to contain record of advertised length %u.",
5831 (unsigned) len,
5832 (unsigned)( rec->data_offset + rec->data_len ) ) );
Hanno Beckere0452772019-07-10 17:12:07 +01005833 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5834 }
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005835
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005836 /* Records from other, non-matching epochs are silently discarded.
5837 * (The case of same-port Client reconnects must be considered in
5838 * the caller). */
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005839 if( rec_epoch != ssl->in_epoch )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005840 {
5841 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
5842 "expected %d, received %d",
5843 ssl->in_epoch, rec_epoch ) );
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005844
5845 /* Records from the next epoch are considered for buffering
5846 * (concretely: early Finished messages). */
5847 if( rec_epoch == (unsigned) ssl->in_epoch + 1 )
5848 {
5849 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
5850 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5851 }
5852
Hanno Becker87b56262019-07-10 14:37:41 +01005853 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005854 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005855#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005856 /* For records from the correct epoch, check whether their
5857 * sequence number has been seen before. */
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005858 else if( mbedtls_ssl_dtls_record_replay_check( (mbedtls_ssl_context *) ssl,
5859 &rec->ctr[0] ) != 0 )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005860 {
5861 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
5862 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
5863 }
5864#endif
5865 }
5866#endif /* MBEDTLS_SSL_PROTO_DTLS */
5867
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005868 return( 0 );
5869}
Paul Bakker5121ce52009-01-03 21:22:43 +00005870
Hanno Becker87b56262019-07-10 14:37:41 +01005871
5872#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
5873static int ssl_check_client_reconnect( mbedtls_ssl_context *ssl )
5874{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005875 unsigned int rec_epoch = (unsigned int)
5876 mbedtls_platform_get_uint16_be( &ssl->in_ctr[0] );
Hanno Becker87b56262019-07-10 14:37:41 +01005877
5878 /*
5879 * Check for an epoch 0 ClientHello. We can't use in_msg here to
5880 * access the first byte of record content (handshake type), as we
5881 * have an active transform (possibly iv_len != 0), so use the
5882 * fact that the record header len is 13 instead.
5883 */
5884 if( rec_epoch == 0 &&
5885 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
5886 MBEDTLS_SSL_IS_SERVER &&
5887 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5888 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
5889 ssl->in_left > 13 &&
5890 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
5891 {
5892 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
5893 "from the same port" ) );
5894 return( ssl_handle_possible_reconnect( ssl ) );
5895 }
5896
5897 return( 0 );
5898}
5899#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
5900
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005901/*
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01005902 * If applicable, decrypt record content
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005903 */
Hanno Beckera89610a2019-07-11 13:07:45 +01005904static int ssl_prepare_record_content( mbedtls_ssl_context *ssl,
5905 mbedtls_record *rec )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005906{
5907 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02005908
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005909 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
Hanno Beckera89610a2019-07-11 13:07:45 +01005910 rec->buf, rec->buf_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00005911
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005912#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
5913 if( mbedtls_ssl_hw_record_read != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00005914 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005915 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00005916
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005917 ret = mbedtls_ssl_hw_record_read( ssl );
5918 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00005919 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005920 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
5921 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00005922 }
Paul Bakkerc7878112012-12-19 14:41:14 +01005923
5924 if( ret == 0 )
5925 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00005926 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005927#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker48916f92012-09-16 19:57:18 +00005928 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005929 {
Hanno Becker106f3da2019-07-12 09:35:58 +01005930 unsigned char const old_msg_type = rec->type;
5931
Hanno Becker611a83b2018-01-03 14:27:32 +00005932 if( ( ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in,
Hanno Beckera89610a2019-07-11 13:07:45 +01005933 rec ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005934 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005935 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005936
Hanno Beckera5a2b082019-05-15 14:03:01 +01005937#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005938 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID &&
Hanno Beckere0200da2019-06-13 09:23:43 +01005939 mbedtls_ssl_conf_get_ignore_unexpected_cid( ssl->conf )
5940 == MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005941 {
Hanno Becker675c4d62019-05-24 10:11:06 +01005942 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ignoring unexpected CID" ) );
Hanno Becker687e0fb2019-05-08 13:02:55 +01005943 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005944 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01005945#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker687e0fb2019-05-08 13:02:55 +01005946
Paul Bakker5121ce52009-01-03 21:22:43 +00005947 return( ret );
5948 }
5949
Hanno Becker106f3da2019-07-12 09:35:58 +01005950 if( old_msg_type != rec->type )
Hanno Becker93012fe2018-08-07 14:30:18 +01005951 {
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005952 MBEDTLS_SSL_DEBUG_MSG( 4, ( "record type after decrypt (before %d): %d",
Hanno Becker106f3da2019-07-12 09:35:58 +01005953 old_msg_type, rec->type ) );
Hanno Becker93012fe2018-08-07 14:30:18 +01005954 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005955
Paul Bakker5121ce52009-01-03 21:22:43 +00005956 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Hanno Becker106f3da2019-07-12 09:35:58 +01005957 rec->buf + rec->data_offset, rec->data_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00005958
Hanno Beckera5a2b082019-05-15 14:03:01 +01005959#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005960 /* We have already checked the record content type
5961 * in ssl_parse_record_header(), failing or silently
5962 * dropping the record in the case of an unknown type.
5963 *
5964 * Since with the use of CIDs, the record content type
5965 * might change during decryption, re-check the record
5966 * content type, but treat a failure as fatal this time. */
Hanno Becker106f3da2019-07-12 09:35:58 +01005967 if( ssl_check_record_type( rec->type ) )
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005968 {
5969 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
5970 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5971 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01005972#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005973
Hanno Becker106f3da2019-07-12 09:35:58 +01005974 if( rec->data_len == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00005975 {
5976#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker2881d802019-05-22 14:44:53 +01005977 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_3
Hanno Becker106f3da2019-07-12 09:35:58 +01005978 && rec->type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Hanno Becker4c6876b2017-12-27 21:28:58 +00005979 {
5980 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
5981 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
5982 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5983 }
5984#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5985
5986 ssl->nb_zero++;
5987
5988 /*
5989 * Three or more empty messages may be a DoS attack
5990 * (excessive CPU consumption).
5991 */
5992 if( ssl->nb_zero > 3 )
5993 {
5994 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Hanno Becker70463db2019-05-08 10:38:32 +01005995 "messages, possible DoS attack" ) );
5996 /* Treat the records as if they were not properly authenticated,
5997 * thereby failing the connection if we see more than allowed
5998 * by the configured bad MAC threshold. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00005999 return( MBEDTLS_ERR_SSL_INVALID_MAC );
6000 }
6001 }
6002 else
6003 ssl->nb_zero = 0;
6004
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006005 /* Only needed for TLS, as with DTLS in_ctr is read from the header */
6006#if defined(MBEDTLS_SSL_PROTO_TLS)
6007 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006008 {
6009 unsigned i;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006010 for( i = 8; i > 0; i-- )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006011 if( ++ssl->in_ctr[i - 1] != 0 )
6012 break;
6013
Manuel Pégourié-Gonnard8794a422019-06-11 10:04:57 +02006014 /* The loop goes to its end only if the counter is wrapping around */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006015 if( i == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006016 {
6017 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
6018 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
6019 }
6020 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006021#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker4c6876b2017-12-27 21:28:58 +00006022
Paul Bakker5121ce52009-01-03 21:22:43 +00006023 }
6024
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006025#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006026 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02006027 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006028 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02006029 }
6030#endif
6031
Hanno Beckerf0242852019-07-09 17:30:02 +01006032 /* Check actual (decrypted) record content length against
6033 * configured maximum. */
6034 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
6035 {
6036 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
6037 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6038 }
6039
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006040 return( 0 );
6041}
6042
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006043static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006044
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006045/*
6046 * Read a record.
6047 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02006048 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
6049 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
6050 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006051 */
Hanno Becker1097b342018-08-15 14:09:41 +01006052
6053/* Helper functions for mbedtls_ssl_read_record(). */
6054static int ssl_consume_current_message( mbedtls_ssl_context *ssl );
Hanno Beckere74d5562018-08-15 14:26:08 +01006055static int ssl_get_next_record( mbedtls_ssl_context *ssl );
6056static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl );
Hanno Becker4162b112018-08-15 14:05:04 +01006057
Hanno Becker327c93b2018-08-15 13:56:18 +01006058int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
Hanno Becker3a0aad12018-08-20 09:44:02 +01006059 unsigned update_hs_digest )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006060{
6061 int ret;
6062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006063 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006064
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006065 if( ssl->keep_current_message == 0 )
6066 {
6067 do {
Simon Butcher99000142016-10-13 17:21:01 +01006068
Hanno Becker26994592018-08-15 14:14:59 +01006069 ret = ssl_consume_current_message( ssl );
Hanno Becker90333da2017-10-10 11:27:13 +01006070 if( ret != 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006071 return( ret );
Hanno Becker26994592018-08-15 14:14:59 +01006072
Hanno Beckere74d5562018-08-15 14:26:08 +01006073 if( ssl_record_is_in_progress( ssl ) == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006074 {
Hanno Becker40f50842018-08-15 14:48:01 +01006075#if defined(MBEDTLS_SSL_PROTO_DTLS)
6076 int have_buffered = 0;
Hanno Beckere74d5562018-08-15 14:26:08 +01006077
Hanno Becker40f50842018-08-15 14:48:01 +01006078 /* We only check for buffered messages if the
6079 * current datagram is fully consumed. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006080 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006081 ssl_next_record_is_in_datagram( ssl ) == 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006082 {
Hanno Becker40f50842018-08-15 14:48:01 +01006083 if( ssl_load_buffered_message( ssl ) == 0 )
6084 have_buffered = 1;
6085 }
6086
6087 if( have_buffered == 0 )
6088#endif /* MBEDTLS_SSL_PROTO_DTLS */
6089 {
6090 ret = ssl_get_next_record( ssl );
6091 if( ret == MBEDTLS_ERR_SSL_CONTINUE_PROCESSING )
6092 continue;
6093
6094 if( ret != 0 )
6095 {
Hanno Beckerc573ac32018-08-28 17:15:25 +01006096 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
Hanno Becker42a6b042019-07-26 07:25:20 +01006097 ssl_send_pending_fatal_alert( ssl );
Hanno Becker40f50842018-08-15 14:48:01 +01006098 return( ret );
6099 }
Hanno Beckere74d5562018-08-15 14:26:08 +01006100 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006101 }
6102
6103 ret = mbedtls_ssl_handle_message_type( ssl );
6104
Hanno Becker40f50842018-08-15 14:48:01 +01006105#if defined(MBEDTLS_SSL_PROTO_DTLS)
6106 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6107 {
6108 /* Buffer future message */
6109 ret = ssl_buffer_message( ssl );
6110 if( ret != 0 )
6111 return( ret );
6112
6113 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
6114 }
6115#endif /* MBEDTLS_SSL_PROTO_DTLS */
6116
Hanno Becker90333da2017-10-10 11:27:13 +01006117 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret ||
6118 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING == ret );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006119
6120 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01006121 {
Hanno Becker05c4fc82017-11-09 14:34:06 +00006122 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
Simon Butcher99000142016-10-13 17:21:01 +01006123 return( ret );
6124 }
6125
Hanno Becker327c93b2018-08-15 13:56:18 +01006126 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
Hanno Becker3a0aad12018-08-20 09:44:02 +01006127 update_hs_digest == 1 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006128 {
6129 mbedtls_ssl_update_handshake_status( ssl );
6130 }
Simon Butcher99000142016-10-13 17:21:01 +01006131 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006132 else
Simon Butcher99000142016-10-13 17:21:01 +01006133 {
Hanno Becker02f59072018-08-15 14:00:24 +01006134 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006135 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01006136 }
6137
6138 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
6139
6140 return( 0 );
6141}
6142
Hanno Becker40f50842018-08-15 14:48:01 +01006143#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006144static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
Simon Butcher99000142016-10-13 17:21:01 +01006145{
Hanno Becker40f50842018-08-15 14:48:01 +01006146 if( ssl->in_left > ssl->next_record_offset )
6147 return( 1 );
Simon Butcher99000142016-10-13 17:21:01 +01006148
Hanno Becker40f50842018-08-15 14:48:01 +01006149 return( 0 );
6150}
6151
6152static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
6153{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006154 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker37f95322018-08-16 13:55:32 +01006155 mbedtls_ssl_hs_buffer * hs_buf;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006156 int ret = 0;
6157
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006158 if( hs == NULL )
6159 return( -1 );
6160
Hanno Beckere00ae372018-08-20 09:39:42 +01006161 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
6162
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006163 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC ||
6164 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
6165 {
6166 /* Check if we have seen a ChangeCipherSpec before.
6167 * If yes, synthesize a CCS record. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006168 if( !hs->buffering.seen_ccs )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006169 {
6170 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
6171 ret = -1;
Hanno Becker0d4b3762018-08-20 09:36:59 +01006172 goto exit;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006173 }
6174
Hanno Becker39b8bc92018-08-28 17:17:13 +01006175 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006176 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
6177 ssl->in_msglen = 1;
6178 ssl->in_msg[0] = 1;
6179
6180 /* As long as they are equal, the exact value doesn't matter. */
6181 ssl->in_left = 0;
6182 ssl->next_record_offset = 0;
6183
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006184 hs->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006185 goto exit;
6186 }
Hanno Becker37f95322018-08-16 13:55:32 +01006187
Hanno Beckerb8f50142018-08-28 10:01:34 +01006188#if defined(MBEDTLS_DEBUG_C)
Hanno Becker37f95322018-08-16 13:55:32 +01006189 /* Debug only */
6190 {
6191 unsigned offset;
6192 for( offset = 1; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
6193 {
6194 hs_buf = &hs->buffering.hs[offset];
6195 if( hs_buf->is_valid == 1 )
6196 {
6197 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
6198 hs->in_msg_seq + offset,
Hanno Beckera591c482018-08-28 17:20:00 +01006199 hs_buf->is_complete ? "fully" : "partially" ) );
Hanno Becker37f95322018-08-16 13:55:32 +01006200 }
6201 }
6202 }
Hanno Beckerb8f50142018-08-28 10:01:34 +01006203#endif /* MBEDTLS_DEBUG_C */
Hanno Becker37f95322018-08-16 13:55:32 +01006204
6205 /* Check if we have buffered and/or fully reassembled the
6206 * next handshake message. */
6207 hs_buf = &hs->buffering.hs[0];
6208 if( ( hs_buf->is_valid == 1 ) && ( hs_buf->is_complete == 1 ) )
6209 {
6210 /* Synthesize a record containing the buffered HS message. */
Arto Kinnunen84eeb4f2019-09-10 10:32:30 +03006211 size_t msg_len = mbedtls_platform_get_uint24_be( &hs_buf->data[1] );
Hanno Becker37f95322018-08-16 13:55:32 +01006212
6213 /* Double-check that we haven't accidentally buffered
6214 * a message that doesn't fit into the input buffer. */
6215 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
6216 {
6217 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6218 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6219 }
6220
6221 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
6222 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
6223 hs_buf->data, msg_len + 12 );
6224
6225 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6226 ssl->in_hslen = msg_len + 12;
6227 ssl->in_msglen = msg_len + 12;
Teppo Järvelin91d79382019-10-02 09:09:31 +03006228 mbedtls_platform_memcpy( ssl->in_msg, hs_buf->data, ssl->in_hslen );
Hanno Becker37f95322018-08-16 13:55:32 +01006229
6230 ret = 0;
6231 goto exit;
6232 }
6233 else
6234 {
6235 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
6236 hs->in_msg_seq ) );
6237 }
6238
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006239 ret = -1;
6240
6241exit:
6242
6243 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
6244 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006245}
6246
Hanno Beckera02b0b42018-08-21 17:20:27 +01006247static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
6248 size_t desired )
6249{
6250 int offset;
6251 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006252 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
6253 (unsigned) desired ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006254
Hanno Becker01315ea2018-08-21 17:22:17 +01006255 /* Get rid of future records epoch first, if such exist. */
6256 ssl_free_buffered_record( ssl );
6257
6258 /* Check if we have enough space available now. */
6259 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6260 hs->buffering.total_bytes_buffered ) )
6261 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006262 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
Hanno Becker01315ea2018-08-21 17:22:17 +01006263 return( 0 );
6264 }
Hanno Beckera02b0b42018-08-21 17:20:27 +01006265
Hanno Becker4f432ad2018-08-28 10:02:32 +01006266 /* We don't have enough space to buffer the next expected handshake
6267 * message. Remove buffers used for future messages to gain space,
6268 * starting with the most distant one. */
Hanno Beckera02b0b42018-08-21 17:20:27 +01006269 for( offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1;
6270 offset >= 0; offset-- )
6271 {
6272 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
6273 offset ) );
6274
Hanno Beckerb309b922018-08-23 13:18:05 +01006275 ssl_buffering_free_slot( ssl, (uint8_t) offset );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006276
6277 /* Check if we have enough space available now. */
6278 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6279 hs->buffering.total_bytes_buffered ) )
6280 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006281 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006282 return( 0 );
6283 }
6284 }
6285
6286 return( -1 );
6287}
6288
Hanno Becker40f50842018-08-15 14:48:01 +01006289static int ssl_buffer_message( mbedtls_ssl_context *ssl )
6290{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006291 int ret = 0;
6292 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6293
6294 if( hs == NULL )
6295 return( 0 );
6296
6297 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
6298
6299 switch( ssl->in_msgtype )
6300 {
6301 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC:
6302 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
Hanno Beckere678eaa2018-08-21 14:57:46 +01006303
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006304 hs->buffering.seen_ccs = 1;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006305 break;
6306
6307 case MBEDTLS_SSL_MSG_HANDSHAKE:
Hanno Becker37f95322018-08-16 13:55:32 +01006308 {
6309 unsigned recv_msg_seq_offset;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03006310 unsigned recv_msg_seq = (unsigned)
6311 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03006312
Hanno Becker37f95322018-08-16 13:55:32 +01006313 mbedtls_ssl_hs_buffer *hs_buf;
6314 size_t msg_len = ssl->in_hslen - 12;
6315
6316 /* We should never receive an old handshake
6317 * message - double-check nonetheless. */
6318 if( recv_msg_seq < ssl->handshake->in_msg_seq )
6319 {
6320 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6321 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6322 }
6323
6324 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
6325 if( recv_msg_seq_offset >= MBEDTLS_SSL_MAX_BUFFERED_HS )
6326 {
6327 /* Silently ignore -- message too far in the future */
6328 MBEDTLS_SSL_DEBUG_MSG( 2,
6329 ( "Ignore future HS message with sequence number %u, "
6330 "buffering window %u - %u",
6331 recv_msg_seq, ssl->handshake->in_msg_seq,
6332 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - 1 ) );
6333
6334 goto exit;
6335 }
6336
6337 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
6338 recv_msg_seq, recv_msg_seq_offset ) );
6339
6340 hs_buf = &hs->buffering.hs[ recv_msg_seq_offset ];
6341
6342 /* Check if the buffering for this seq nr has already commenced. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006343 if( !hs_buf->is_valid )
Hanno Becker37f95322018-08-16 13:55:32 +01006344 {
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006345 size_t reassembly_buf_sz;
6346
Hanno Becker37f95322018-08-16 13:55:32 +01006347 hs_buf->is_fragmented =
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04006348 ( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT );
Hanno Becker37f95322018-08-16 13:55:32 +01006349
6350 /* We copy the message back into the input buffer
6351 * after reassembly, so check that it's not too large.
6352 * This is an implementation-specific limitation
6353 * and not one from the standard, hence it is not
6354 * checked in ssl_check_hs_header(). */
Hanno Becker96a6c692018-08-21 15:56:03 +01006355 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker37f95322018-08-16 13:55:32 +01006356 {
6357 /* Ignore message */
6358 goto exit;
6359 }
6360
Hanno Beckere0b150f2018-08-21 15:51:03 +01006361 /* Check if we have enough space to buffer the message. */
6362 if( hs->buffering.total_bytes_buffered >
6363 MBEDTLS_SSL_DTLS_MAX_BUFFERING )
6364 {
6365 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6366 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6367 }
6368
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006369 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
6370 hs_buf->is_fragmented );
Hanno Beckere0b150f2018-08-21 15:51:03 +01006371
6372 if( reassembly_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6373 hs->buffering.total_bytes_buffered ) )
6374 {
6375 if( recv_msg_seq_offset > 0 )
6376 {
6377 /* If we can't buffer a future message because
6378 * of space limitations -- ignore. */
6379 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
6380 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6381 (unsigned) hs->buffering.total_bytes_buffered ) );
6382 goto exit;
6383 }
Hanno Beckere1801392018-08-21 16:51:05 +01006384 else
6385 {
6386 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- attempt to make space by freeing buffered future messages\n",
6387 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6388 (unsigned) hs->buffering.total_bytes_buffered ) );
6389 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006390
Hanno Beckera02b0b42018-08-21 17:20:27 +01006391 if( ssl_buffer_make_space( ssl, reassembly_buf_sz ) != 0 )
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006392 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006393 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %u (%u with bitmap) would exceed the compile-time limit %u (already %u bytes buffered) -- fail\n",
6394 (unsigned) msg_len,
6395 (unsigned) reassembly_buf_sz,
6396 MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Beckere0b150f2018-08-21 15:51:03 +01006397 (unsigned) hs->buffering.total_bytes_buffered ) );
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006398 ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
6399 goto exit;
6400 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006401 }
6402
6403 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
6404 msg_len ) );
6405
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006406 hs_buf->data = mbedtls_calloc( 1, reassembly_buf_sz );
6407 if( hs_buf->data == NULL )
Hanno Becker37f95322018-08-16 13:55:32 +01006408 {
Hanno Beckere0b150f2018-08-21 15:51:03 +01006409 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
Hanno Becker37f95322018-08-16 13:55:32 +01006410 goto exit;
6411 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006412 hs_buf->data_len = reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006413
6414 /* Prepare final header: copy msg_type, length and message_seq,
6415 * then add standardised fragment_offset and fragment_length */
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02006416 if( mbedtls_platform_memcpy( hs_buf->data, ssl->in_msg, 6 ) !=
6417 hs_buf->data )
6418 {
6419 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6420 goto exit;
6421 }
6422 if( mbedtls_platform_memset( hs_buf->data + 6, 0, 3 ) !=
6423 hs_buf->data + 6 )
6424 {
6425 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6426 goto exit;
6427 }
6428 if( mbedtls_platform_memcpy( hs_buf->data + 9, hs_buf->data + 1, 3 ) !=
6429 hs_buf->data + 9 )
6430 {
6431 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6432 goto exit;
6433 }
Hanno Becker37f95322018-08-16 13:55:32 +01006434
6435 hs_buf->is_valid = 1;
Hanno Beckere0b150f2018-08-21 15:51:03 +01006436
6437 hs->buffering.total_bytes_buffered += reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006438 }
6439 else
6440 {
6441 /* Make sure msg_type and length are consistent */
Teppo Järvelin0efac532019-10-04 13:21:08 +03006442 if( memcmp( hs_buf->data, ssl->in_msg, 4 ) != 0 ) // use regular memcmp as msg type is public
Hanno Becker37f95322018-08-16 13:55:32 +01006443 {
6444 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
6445 /* Ignore */
6446 goto exit;
6447 }
6448 }
6449
Hanno Becker4422bbb2018-08-20 09:40:19 +01006450 if( !hs_buf->is_complete )
Hanno Becker37f95322018-08-16 13:55:32 +01006451 {
6452 size_t frag_len, frag_off;
6453 unsigned char * const msg = hs_buf->data + 12;
6454
6455 /*
6456 * Check and copy current fragment
6457 */
6458
6459 /* Validation of header fields already done in
6460 * mbedtls_ssl_prepare_handshake_record(). */
6461 frag_off = ssl_get_hs_frag_off( ssl );
6462 frag_len = ssl_get_hs_frag_len( ssl );
6463
6464 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
6465 frag_off, frag_len ) );
Teppo Järvelin91d79382019-10-02 09:09:31 +03006466 mbedtls_platform_memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
Hanno Becker37f95322018-08-16 13:55:32 +01006467
6468 if( hs_buf->is_fragmented )
6469 {
6470 unsigned char * const bitmask = msg + msg_len;
6471 ssl_bitmask_set( bitmask, frag_off, frag_len );
6472 hs_buf->is_complete = ( ssl_bitmask_check( bitmask,
6473 msg_len ) == 0 );
6474 }
6475 else
6476 {
6477 hs_buf->is_complete = 1;
6478 }
6479
6480 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
6481 hs_buf->is_complete ? "" : "not yet " ) );
6482 }
6483
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006484 break;
Hanno Becker37f95322018-08-16 13:55:32 +01006485 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006486
6487 default:
Hanno Becker360bef32018-08-28 10:04:33 +01006488 /* We don't buffer other types of messages. */
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006489 break;
6490 }
6491
6492exit:
6493
6494 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
6495 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006496}
6497#endif /* MBEDTLS_SSL_PROTO_DTLS */
6498
Hanno Becker1097b342018-08-15 14:09:41 +01006499static int ssl_consume_current_message( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006500{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006501 /*
Hanno Becker4a810fb2017-05-24 16:27:30 +01006502 * Consume last content-layer message and potentially
6503 * update in_msglen which keeps track of the contents'
6504 * consumption state.
6505 *
6506 * (1) Handshake messages:
6507 * Remove last handshake message, move content
6508 * and adapt in_msglen.
6509 *
6510 * (2) Alert messages:
6511 * Consume whole record content, in_msglen = 0.
6512 *
Hanno Becker4a810fb2017-05-24 16:27:30 +01006513 * (3) Change cipher spec:
6514 * Consume whole record content, in_msglen = 0.
6515 *
6516 * (4) Application data:
6517 * Don't do anything - the record layer provides
6518 * the application data as a stream transport
6519 * and consumes through mbedtls_ssl_read only.
6520 *
6521 */
6522
6523 /* Case (1): Handshake messages */
6524 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006525 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006526 /* Hard assertion to be sure that no application data
6527 * is in flight, as corrupting ssl->in_msglen during
6528 * ssl->in_offt != NULL is fatal. */
6529 if( ssl->in_offt != NULL )
6530 {
6531 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6532 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6533 }
6534
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006535 /*
6536 * Get next Handshake message in the current record
6537 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006538
Hanno Becker4a810fb2017-05-24 16:27:30 +01006539 /* Notes:
Hanno Beckere72489d2017-10-23 13:23:50 +01006540 * (1) in_hslen is not necessarily the size of the
Hanno Becker4a810fb2017-05-24 16:27:30 +01006541 * current handshake content: If DTLS handshake
6542 * fragmentation is used, that's the fragment
6543 * size instead. Using the total handshake message
Hanno Beckere72489d2017-10-23 13:23:50 +01006544 * size here is faulty and should be changed at
6545 * some point.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006546 * (2) While it doesn't seem to cause problems, one
6547 * has to be very careful not to assume that in_hslen
6548 * is always <= in_msglen in a sensible communication.
6549 * Again, it's wrong for DTLS handshake fragmentation.
6550 * The following check is therefore mandatory, and
6551 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006552 * Additionally, ssl->in_hslen might be arbitrarily out of
6553 * bounds after handling a DTLS message with an unexpected
6554 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006555 */
6556 if( ssl->in_hslen < ssl->in_msglen )
6557 {
6558 ssl->in_msglen -= ssl->in_hslen;
6559 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
6560 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006561
Hanno Becker4a810fb2017-05-24 16:27:30 +01006562 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
6563 ssl->in_msg, ssl->in_msglen );
6564 }
6565 else
6566 {
6567 ssl->in_msglen = 0;
6568 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02006569
Hanno Becker4a810fb2017-05-24 16:27:30 +01006570 ssl->in_hslen = 0;
6571 }
6572 /* Case (4): Application data */
6573 else if( ssl->in_offt != NULL )
6574 {
6575 return( 0 );
6576 }
6577 /* Everything else (CCS & Alerts) */
6578 else
6579 {
6580 ssl->in_msglen = 0;
6581 }
6582
Hanno Becker1097b342018-08-15 14:09:41 +01006583 return( 0 );
6584}
Hanno Becker4a810fb2017-05-24 16:27:30 +01006585
Hanno Beckere74d5562018-08-15 14:26:08 +01006586static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
6587{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006588 if( ssl->in_msglen > 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006589 return( 1 );
6590
6591 return( 0 );
6592}
6593
Hanno Becker5f066e72018-08-16 14:56:31 +01006594#if defined(MBEDTLS_SSL_PROTO_DTLS)
6595
6596static void ssl_free_buffered_record( mbedtls_ssl_context *ssl )
6597{
6598 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6599 if( hs == NULL )
6600 return;
6601
Hanno Becker01315ea2018-08-21 17:22:17 +01006602 if( hs->buffering.future_record.data != NULL )
Hanno Becker4a810fb2017-05-24 16:27:30 +01006603 {
Hanno Becker01315ea2018-08-21 17:22:17 +01006604 hs->buffering.total_bytes_buffered -=
6605 hs->buffering.future_record.len;
6606
6607 mbedtls_free( hs->buffering.future_record.data );
6608 hs->buffering.future_record.data = NULL;
6609 }
Hanno Becker5f066e72018-08-16 14:56:31 +01006610}
6611
6612static int ssl_load_buffered_record( mbedtls_ssl_context *ssl )
6613{
6614 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6615 unsigned char * rec;
6616 size_t rec_len;
6617 unsigned rec_epoch;
Andrzej Kurekf3844952020-10-16 23:03:01 +02006618#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6619 size_t in_buf_len = ssl->in_buf_len;
6620#else
6621 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6622#endif
Hanno Becker5f066e72018-08-16 14:56:31 +01006623
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006624 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006625 return( 0 );
6626
6627 if( hs == NULL )
6628 return( 0 );
6629
Hanno Becker5f066e72018-08-16 14:56:31 +01006630 rec = hs->buffering.future_record.data;
6631 rec_len = hs->buffering.future_record.len;
6632 rec_epoch = hs->buffering.future_record.epoch;
6633
6634 if( rec == NULL )
6635 return( 0 );
6636
Hanno Becker4cb782d2018-08-20 11:19:05 +01006637 /* Only consider loading future records if the
6638 * input buffer is empty. */
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006639 if( ssl_next_record_is_in_datagram( ssl ) == 1 )
Hanno Becker4cb782d2018-08-20 11:19:05 +01006640 return( 0 );
6641
Hanno Becker5f066e72018-08-16 14:56:31 +01006642 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
6643
6644 if( rec_epoch != ssl->in_epoch )
6645 {
6646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
6647 goto exit;
6648 }
6649
6650 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
6651
6652 /* Double-check that the record is not too large */
Andrzej Kurekf3844952020-10-16 23:03:01 +02006653 if( rec_len > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006654 {
6655 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6656 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6657 }
6658
Teppo Järvelin91d79382019-10-02 09:09:31 +03006659 mbedtls_platform_memcpy( ssl->in_hdr, rec, rec_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006660 ssl->in_left = rec_len;
6661 ssl->next_record_offset = 0;
6662
6663 ssl_free_buffered_record( ssl );
6664
6665exit:
6666 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
6667 return( 0 );
6668}
6669
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006670static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
6671 mbedtls_record const *rec )
Hanno Becker5f066e72018-08-16 14:56:31 +01006672{
6673 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker5f066e72018-08-16 14:56:31 +01006674
6675 /* Don't buffer future records outside handshakes. */
6676 if( hs == NULL )
6677 return( 0 );
6678
6679 /* Only buffer handshake records (we are only interested
6680 * in Finished messages). */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006681 if( rec->type != MBEDTLS_SSL_MSG_HANDSHAKE )
Hanno Becker5f066e72018-08-16 14:56:31 +01006682 return( 0 );
6683
6684 /* Don't buffer more than one future epoch record. */
6685 if( hs->buffering.future_record.data != NULL )
6686 return( 0 );
6687
Hanno Becker01315ea2018-08-21 17:22:17 +01006688 /* Don't buffer record if there's not enough buffering space remaining. */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006689 if( rec->buf_len > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
Hanno Becker01315ea2018-08-21 17:22:17 +01006690 hs->buffering.total_bytes_buffered ) )
6691 {
6692 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006693 (unsigned) rec->buf_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Becker01315ea2018-08-21 17:22:17 +01006694 (unsigned) hs->buffering.total_bytes_buffered ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006695 return( 0 );
6696 }
6697
Hanno Becker5f066e72018-08-16 14:56:31 +01006698 /* Buffer record */
6699 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
6700 ssl->in_epoch + 1 ) );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006701 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006702
6703 /* ssl_parse_record_header() only considers records
6704 * of the next epoch as candidates for buffering. */
6705 hs->buffering.future_record.epoch = ssl->in_epoch + 1;
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006706 hs->buffering.future_record.len = rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006707
6708 hs->buffering.future_record.data =
6709 mbedtls_calloc( 1, hs->buffering.future_record.len );
6710 if( hs->buffering.future_record.data == NULL )
6711 {
6712 /* If we run out of RAM trying to buffer a
6713 * record from the next epoch, just ignore. */
6714 return( 0 );
6715 }
6716
Teppo Järvelin91d79382019-10-02 09:09:31 +03006717 mbedtls_platform_memcpy( hs->buffering.future_record.data, rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006718
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006719 hs->buffering.total_bytes_buffered += rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006720 return( 0 );
6721}
6722
6723#endif /* MBEDTLS_SSL_PROTO_DTLS */
6724
Hanno Beckere74d5562018-08-15 14:26:08 +01006725static int ssl_get_next_record( mbedtls_ssl_context *ssl )
Hanno Becker1097b342018-08-15 14:09:41 +01006726{
6727 int ret;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006728 mbedtls_record rec;
Hanno Becker1097b342018-08-15 14:09:41 +01006729
Hanno Becker5f066e72018-08-16 14:56:31 +01006730#if defined(MBEDTLS_SSL_PROTO_DTLS)
6731 /* We might have buffered a future record; if so,
6732 * and if the epoch matches now, load it.
6733 * On success, this call will set ssl->in_left to
6734 * the length of the buffered record, so that
6735 * the calls to ssl_fetch_input() below will
6736 * essentially be no-ops. */
6737 ret = ssl_load_buffered_record( ssl );
6738 if( ret != 0 )
6739 return( ret );
6740#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker4a810fb2017-05-24 16:27:30 +01006741
Hanno Becker8b09b732019-05-08 12:03:28 +01006742 /* Ensure that we have enough space available for the default form
6743 * of TLS / DTLS record headers (5 Bytes for TLS, 13 Bytes for DTLS,
6744 * with no space for CIDs counted in). */
6745 ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_in_hdr_len( ssl ) );
6746 if( ret != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006747 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006748 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006749 return( ret );
6750 }
6751
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006752 ret = ssl_parse_record_header( ssl, ssl->in_hdr, ssl->in_left, &rec );
6753 if( ret != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006754 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006755#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker87b56262019-07-10 14:37:41 +01006756 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006757 {
Hanno Becker5f066e72018-08-16 14:56:31 +01006758 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6759 {
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006760 ret = ssl_buffer_future_record( ssl, &rec );
Hanno Becker5f066e72018-08-16 14:56:31 +01006761 if( ret != 0 )
6762 return( ret );
6763
6764 /* Fall through to handling of unexpected records */
6765 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
6766 }
6767
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006768 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
6769 {
Hanno Becker87b56262019-07-10 14:37:41 +01006770#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker68379722019-07-12 09:23:47 +01006771 /* Reset in pointers to default state for TLS/DTLS records,
6772 * assuming no CID and no offset between record content and
6773 * record plaintext. */
6774 ssl_update_in_pointers( ssl );
6775
Hanno Becker69412452019-07-12 08:33:49 +01006776 /* Setup internal message pointers from record structure. */
6777 ssl->in_msgtype = rec.type;
6778#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6779 ssl->in_len = ssl->in_cid + rec.cid_len;
6780#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006781 ssl->in_msg = ssl->in_len + 2;
Hanno Becker69412452019-07-12 08:33:49 +01006782 ssl->in_msglen = rec.data_len;
6783
Hanno Becker87b56262019-07-10 14:37:41 +01006784 ret = ssl_check_client_reconnect( ssl );
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02006785 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_client_reconnect", ret );
Hanno Becker87b56262019-07-10 14:37:41 +01006786 if( ret != 0 )
6787 return( ret );
6788#endif
6789
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006790 /* Skip unexpected record (but not whole datagram) */
Hanno Becker2528ee02019-07-11 12:48:53 +01006791 ssl->next_record_offset = rec.buf_len;
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006792
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006793 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
6794 "(header)" ) );
6795 }
6796 else
6797 {
6798 /* Skip invalid record and the rest of the datagram */
6799 ssl->next_record_offset = 0;
6800 ssl->in_left = 0;
6801
6802 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
6803 "(header)" ) );
6804 }
6805
6806 /* Get next record */
Hanno Becker90333da2017-10-10 11:27:13 +01006807 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006808 }
Hanno Becker87b56262019-07-10 14:37:41 +01006809 else
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006810#endif
Hanno Becker87b56262019-07-10 14:37:41 +01006811 {
6812 return( ret );
6813 }
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006814 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006815
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006816#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006817 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckere65ce782017-05-22 14:47:48 +01006818 {
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006819 /* Remember offset of next record within datagram. */
Hanno Becker2720f4c2019-07-11 12:50:10 +01006820 ssl->next_record_offset = rec.buf_len;
Hanno Beckere65ce782017-05-22 14:47:48 +01006821 if( ssl->next_record_offset < ssl->in_left )
6822 {
6823 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
6824 }
6825 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006826 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006827#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006828#if defined(MBEDTLS_SSL_PROTO_TLS)
6829 {
Hanno Beckere0452772019-07-10 17:12:07 +01006830 /*
6831 * Fetch record contents from underlying transport.
6832 */
Hanno Becker9babbf72019-07-11 12:50:29 +01006833 ret = mbedtls_ssl_fetch_input( ssl, rec.buf_len );
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006834 if( ret != 0 )
6835 {
6836 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
6837 return( ret );
6838 }
6839
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006840 ssl->in_left = 0;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006841 }
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006842#endif /* MBEDTLS_SSL_PROTO_TLS */
6843
6844 /*
6845 * Decrypt record contents.
6846 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006847
Hanno Beckera89610a2019-07-11 13:07:45 +01006848 if( ( ret = ssl_prepare_record_content( ssl, &rec ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006849 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006850#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006851 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006852 {
6853 /* Silently discard invalid records */
Hanno Becker16e9ae22019-05-03 16:36:59 +01006854 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006855 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006856 /* Except when waiting for Finished as a bad mac here
6857 * probably means something went wrong in the handshake
6858 * (eg wrong psk used, mitm downgrade attempt, etc.) */
6859 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
6860 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
6861 {
6862#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6863 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
6864 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006865 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006866 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
6867 }
6868#endif
6869 return( ret );
6870 }
6871
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006872#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Hanno Beckerde671542019-06-12 16:30:46 +01006873 if( mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) != 0 &&
6874 ++ssl->badmac_seen >= mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006875 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006876 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
6877 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006878 }
6879#endif
6880
Hanno Becker4a810fb2017-05-24 16:27:30 +01006881 /* As above, invalid records cause
6882 * dismissal of the whole datagram. */
6883
6884 ssl->next_record_offset = 0;
6885 ssl->in_left = 0;
6886
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006887 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Hanno Becker90333da2017-10-10 11:27:13 +01006888 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006889 }
6890
6891 return( ret );
6892 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006893 MBEDTLS_SSL_TRANSPORT_ELSE
6894#endif /* MBEDTLS_SSL_PROTO_DTLS */
6895#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006896 {
6897 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006898#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6899 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006900 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006901 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006902 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006903 }
6904#endif
6905 return( ret );
6906 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006907#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006908 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006909
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006910
6911 /* Reset in pointers to default state for TLS/DTLS records,
6912 * assuming no CID and no offset between record content and
6913 * record plaintext. */
6914 ssl_update_in_pointers( ssl );
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006915#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6916 ssl->in_len = ssl->in_cid + rec.cid_len;
6917#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006918 ssl->in_msg = ssl->in_len + 2;
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006919
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006920 /* The record content type may change during decryption,
6921 * so re-read it. */
6922 ssl->in_msgtype = rec.type;
6923 /* Also update the input buffer, because unfortunately
6924 * the server-side ssl_parse_client_hello() reparses the
6925 * record header when receiving a ClientHello initiating
6926 * a renegotiation. */
6927 ssl->in_hdr[0] = rec.type;
6928 ssl->in_msg = rec.buf + rec.data_offset;
6929 ssl->in_msglen = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03006930 (void)mbedtls_platform_put_uint16_be( ssl->in_len, rec.data_len );
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006931
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01006932#if defined(MBEDTLS_ZLIB_SUPPORT)
6933 if( ssl->transform_in != NULL &&
6934 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
6935 {
6936 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
6937 {
6938 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
6939 return( ret );
6940 }
6941
6942 /* Check actual (decompress) record content length against
6943 * configured maximum. */
6944 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
6945 {
6946 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
6947 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6948 }
6949 }
6950#endif /* MBEDTLS_ZLIB_SUPPORT */
6951
Simon Butcher99000142016-10-13 17:21:01 +01006952 return( 0 );
6953}
6954
6955int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
6956{
6957 int ret;
6958
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006959 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006960 * Handle particular types of records
6961 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006962 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00006963 {
Simon Butcher99000142016-10-13 17:21:01 +01006964 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
6965 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01006966 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01006967 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006968 }
6969
Hanno Beckere678eaa2018-08-21 14:57:46 +01006970 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006971 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01006972 if( ssl->in_msglen != 1 )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006973 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01006974 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %d",
6975 ssl->in_msglen ) );
6976 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006977 }
6978
Hanno Beckere678eaa2018-08-21 14:57:46 +01006979 if( ssl->in_msg[0] != 1 )
6980 {
6981 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
6982 ssl->in_msg[0] ) );
6983 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6984 }
6985
6986#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006987 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckere678eaa2018-08-21 14:57:46 +01006988 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
6989 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
6990 {
6991 if( ssl->handshake == NULL )
6992 {
6993 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
6994 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
6995 }
6996
6997 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
6998 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
6999 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007000#endif
Hanno Beckere678eaa2018-08-21 14:57:46 +01007001 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007002
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007003 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00007004 {
Angus Gratton1a7a17e2018-06-20 15:43:50 +10007005 if( ssl->in_msglen != 2 )
7006 {
7007 /* Note: Standard allows for more than one 2 byte alert
7008 to be packed in a single message, but Mbed TLS doesn't
7009 currently support this. */
7010 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
7011 ssl->in_msglen ) );
7012 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7013 }
7014
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007015 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00007016 ssl->in_msg[0], ssl->in_msg[1] ) );
7017
7018 /*
Simon Butcher459a9502015-10-27 16:09:03 +00007019 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00007020 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007021 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007022 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007023 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00007024 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007025 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007026 }
7027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007028 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7029 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00007030 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007031 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
7032 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00007033 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007034
7035#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
7036 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7037 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
7038 {
Hanno Becker90333da2017-10-10 11:27:13 +01007039 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no renegotiation alert" ) );
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007040 /* Will be handled when trying to parse ServerHello */
7041 return( 0 );
7042 }
7043#endif
7044
7045#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2881d802019-05-22 14:44:53 +01007046 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007047 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7048 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007049 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7050 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7051 {
7052 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
7053 /* Will be handled in mbedtls_ssl_parse_certificate() */
7054 return( 0 );
7055 }
7056#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
7057
7058 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01007059 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00007060 }
7061
Hanno Beckerc76c6192017-06-06 10:03:17 +01007062#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02007063 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckerc76c6192017-06-06 10:03:17 +01007064 {
Hanno Becker74dd3a72019-05-03 16:54:26 +01007065 /* Drop unexpected ApplicationData records,
7066 * except at the beginning of renegotiations */
7067 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
7068 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
7069#if defined(MBEDTLS_SSL_RENEGOTIATION)
7070 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
7071 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
Hanno Beckerc76c6192017-06-06 10:03:17 +01007072#endif
Hanno Becker74dd3a72019-05-03 16:54:26 +01007073 )
7074 {
7075 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
7076 return( MBEDTLS_ERR_SSL_NON_FATAL );
7077 }
7078
7079 if( ssl->handshake != NULL &&
7080 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
7081 {
7082 ssl_handshake_wrapup_free_hs_transform( ssl );
7083 }
7084 }
Hanno Beckerf65ad822019-05-08 16:26:21 +01007085#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Beckerc76c6192017-06-06 10:03:17 +01007086
Paul Bakker5121ce52009-01-03 21:22:43 +00007087 return( 0 );
7088}
7089
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007090int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007091{
7092 int ret;
7093
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007094 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
7095 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7096 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007097 {
7098 return( ret );
7099 }
7100
7101 return( 0 );
7102}
7103
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007104int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Hanno Becker1facd552019-07-03 13:57:23 +01007105 unsigned char level,
7106 unsigned char message )
Paul Bakker0a925182012-04-16 06:46:41 +00007107{
7108 int ret;
7109
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02007110 if( ssl == NULL || ssl->conf == NULL )
7111 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7112
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007113 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007114 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00007115
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007116 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00007117 ssl->out_msglen = 2;
7118 ssl->out_msg[0] = level;
7119 ssl->out_msg[1] = message;
7120
Hanno Becker67bc7c32018-08-06 11:33:50 +01007121 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00007122 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007123 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00007124 return( ret );
7125 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007126 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00007127
7128 return( 0 );
7129}
7130
Hanno Becker17572472019-02-08 07:19:04 +00007131#if defined(MBEDTLS_X509_CRT_PARSE_C)
7132static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
7133{
7134#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7135 if( session->peer_cert != NULL )
7136 {
7137 mbedtls_x509_crt_free( session->peer_cert );
7138 mbedtls_free( session->peer_cert );
7139 session->peer_cert = NULL;
7140 }
Hanno Becker5882dd02019-06-06 16:25:57 +01007141#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker17572472019-02-08 07:19:04 +00007142 if( session->peer_cert_digest != NULL )
7143 {
7144 /* Zeroization is not necessary. */
7145 mbedtls_free( session->peer_cert_digest );
7146 session->peer_cert_digest = NULL;
7147 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
7148 session->peer_cert_digest_len = 0;
7149 }
Hanno Becker5882dd02019-06-06 16:25:57 +01007150#else
7151 ((void) session);
7152#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker17572472019-02-08 07:19:04 +00007153}
7154#endif /* MBEDTLS_X509_CRT_PARSE_C */
7155
Paul Bakker5121ce52009-01-03 21:22:43 +00007156/*
7157 * Handshake functions
7158 */
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007159#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02007160/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007161int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007162{
Hanno Beckerdf645962019-06-26 13:02:22 +01007163 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7164 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker5121ce52009-01-03 21:22:43 +00007165
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007166 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007167
Hanno Becker5097cba2019-02-05 13:36:46 +00007168 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007169 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007170 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007171 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7172 {
7173 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7174 }
7175 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7176 {
7177 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7178 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007179 else
7180 {
7181 ssl->state = MBEDTLS_SSL_INVALID;
7182 }
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007183 return( 0 );
7184 }
7185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007186 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7187 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007188}
7189
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007190int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007191{
Hanno Beckerdf645962019-06-26 13:02:22 +01007192 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7193 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007194
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007195 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007196
Hanno Becker5097cba2019-02-05 13:36:46 +00007197 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007198 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007199 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007200 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7201 {
7202 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7203 }
7204 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7205 {
7206 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7207 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007208 else
7209 {
7210 ssl->state = MBEDTLS_SSL_INVALID;
7211 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007212 return( 0 );
7213 }
7214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007215 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7216 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007217}
Gilles Peskinef9828522017-05-03 12:28:43 +02007218
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007219#else /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Gilles Peskinef9828522017-05-03 12:28:43 +02007220/* Some certificate support -> implement write and parse */
7221
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007222int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007223{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007224 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007225 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007226 const mbedtls_x509_crt *crt;
Hanno Beckerdf645962019-06-26 13:02:22 +01007227 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7228 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007230 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007231
Hanno Becker5097cba2019-02-05 13:36:46 +00007232 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007233 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007234 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007235 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7236 {
7237 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7238 }
7239 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7240 {
7241 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7242 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007243 else
7244 {
7245 ssl->state = MBEDTLS_SSL_INVALID;
7246 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007247 return( 0 );
7248 }
7249
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007250#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007251 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7252 MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00007253 {
7254 if( ssl->client_auth == 0 )
7255 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007256 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007257 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7258 {
7259 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7260 }
7261 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7262 {
7263 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7264 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007265 else
7266 {
7267 ssl->state = MBEDTLS_SSL_INVALID;
7268 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007269 return( 0 );
7270 }
7271
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007272#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00007273 /*
7274 * If using SSLv3 and got no cert, send an Alert message
7275 * (otherwise an empty Certificate message will be sent).
7276 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007277 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
Hanno Becker2881d802019-05-22 14:44:53 +01007278 mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007279 {
7280 ssl->out_msglen = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007281 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
7282 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
7283 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
Paul Bakker5121ce52009-01-03 21:22:43 +00007284
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007285 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007286 goto write_msg;
7287 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007288#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00007289 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007290#endif /* MBEDTLS_SSL_CLI_C */
7291#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007292 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00007293 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007294 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007295 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007296 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
7297 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00007298 }
7299 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01007300#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007301
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007302 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007303
7304 /*
7305 * 0 . 0 handshake type
7306 * 1 . 3 handshake length
7307 * 4 . 6 length of all certs
7308 * 7 . 9 length of cert. 1
7309 * 10 . n-1 peer certificate
7310 * n . n+2 length of cert. 2
7311 * n+3 . ... upper level cert, etc.
7312 */
7313 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007314 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00007315
Paul Bakker29087132010-03-21 21:03:34 +00007316 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007317 {
7318 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10007319 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00007320 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007321 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
Angus Grattond8213d02016-05-25 20:56:48 +10007322 i + 3 + n, MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007323 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007324 }
7325
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007326 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[i], n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007327
Teppo Järvelin91d79382019-10-02 09:09:31 +03007328 i += 3; mbedtls_platform_memcpy( ssl->out_msg + i, crt->raw.p, n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007329 i += n; crt = crt->next;
7330 }
7331
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007332 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[4], ( i - 7 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007333
7334 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007335 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7336 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00007337
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02007338#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00007339write_msg:
Paul Bakkerd2f068e2013-08-27 21:19:20 +02007340#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007341
Jarno Lamsa2b205162019-11-12 15:36:21 +02007342 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7343 {
7344 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7345 }
7346 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7347 {
7348 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7349 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007350 else
7351 {
7352 ssl->state = MBEDTLS_SSL_INVALID;
7353 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007354
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007355 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007356 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007357 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007358 return( ret );
7359 }
7360
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007361 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007362
Paul Bakkered27a042013-04-18 22:46:23 +02007363 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007364}
7365
Hanno Becker285ff0c2019-01-31 07:44:03 +00007366#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerdf759382019-02-05 17:02:46 +00007367
7368#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007369#define PEER_CRT_CHANGED 0x75555555
Hanno Becker33c3dc82019-01-30 14:46:46 +00007370static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7371 unsigned char *crt_buf,
7372 size_t crt_buf_len )
7373{
7374 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
7375
7376 if( peer_crt == NULL )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007377 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007378
7379 if( peer_crt->raw.len != crt_buf_len )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007380 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007381
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02007382 return( mbedtls_platform_memequal( peer_crt->raw.p, crt_buf, crt_buf_len ) );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007383}
Hanno Becker5882dd02019-06-06 16:25:57 +01007384#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007385#define PEER_CRT_CHANGED 0x75555555
Hanno Beckerdf759382019-02-05 17:02:46 +00007386static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7387 unsigned char *crt_buf,
7388 size_t crt_buf_len )
7389{
7390 int ret;
7391 unsigned char const * const peer_cert_digest =
7392 ssl->session->peer_cert_digest;
7393 mbedtls_md_type_t const peer_cert_digest_type =
7394 ssl->session->peer_cert_digest_type;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007395 mbedtls_md_handle_t digest_info =
Hanno Beckerdf759382019-02-05 17:02:46 +00007396 mbedtls_md_info_from_type( peer_cert_digest_type );
7397 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
7398 size_t digest_len;
7399
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007400 if( peer_cert_digest == NULL ||
7401 digest_info == MBEDTLS_MD_INVALID_HANDLE )
7402 {
Andrzej Kurek0919b142020-07-06 15:28:59 -04007403 return( PEER_CRT_CHANGED );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007404 }
Hanno Beckerdf759382019-02-05 17:02:46 +00007405
7406 digest_len = mbedtls_md_get_size( digest_info );
7407 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
Andrzej Kurek45e71992020-07-08 10:09:44 -04007408 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007409
7410 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
7411 if( ret != 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007412 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007413
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02007414 return( mbedtls_platform_memequal( tmp_digest, peer_cert_digest, digest_len ) );
Hanno Beckerdf759382019-02-05 17:02:46 +00007415}
Hanno Becker5882dd02019-06-06 16:25:57 +01007416#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker285ff0c2019-01-31 07:44:03 +00007417#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Hanno Becker33c3dc82019-01-30 14:46:46 +00007418
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007419/*
7420 * Once the certificate message is read, parse it into a cert chain and
7421 * perform basic checks, but leave actual verification to the caller
7422 */
Hanno Becker35e41772019-02-05 15:37:23 +00007423static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
7424 mbedtls_x509_crt *chain )
Paul Bakker5121ce52009-01-03 21:22:43 +00007425{
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007426 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker35e41772019-02-05 15:37:23 +00007427#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7428 int crt_cnt=0;
7429#endif
Paul Bakker23986e52011-04-24 08:57:21 +00007430 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02007431 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00007432
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007433 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007434 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007435 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007436 mbedtls_ssl_pend_fatal_alert( ssl,
7437 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007438 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007439 }
7440
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007441 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
7442 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007443 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007444 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007445 mbedtls_ssl_pend_fatal_alert( ssl,
7446 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007447 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007448 }
7449
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007450 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007451
Paul Bakker5121ce52009-01-03 21:22:43 +00007452 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007453 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00007454 */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007455 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007456
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007457 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007458 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00007459 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007460 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007461 mbedtls_ssl_pend_fatal_alert( ssl,
7462 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007463 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007464 }
7465
Hanno Becker33c3dc82019-01-30 14:46:46 +00007466 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
7467 i += 3;
7468
Hanno Becker33c3dc82019-01-30 14:46:46 +00007469 /* Iterate through and parse the CRTs in the provided chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007470 while( i < ssl->in_hslen )
7471 {
Hanno Becker33c3dc82019-01-30 14:46:46 +00007472 /* Check that there's room for the next CRT's length fields. */
Philippe Antoine747fd532018-05-30 09:13:21 +02007473 if ( i + 3 > ssl->in_hslen ) {
7474 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007475 mbedtls_ssl_pend_fatal_alert( ssl,
7476 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +02007477 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
7478 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007479 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
7480 * anything beyond 2**16 ~ 64K. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007481 if( ssl->in_msg[i] != 0 )
7482 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007484 mbedtls_ssl_pend_fatal_alert( ssl,
7485 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007486 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007487 }
7488
Hanno Becker33c3dc82019-01-30 14:46:46 +00007489 /* Read length of the next CRT in the chain. */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007490 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007491 i += 3;
7492
7493 if( n < 128 || i + n > ssl->in_hslen )
7494 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007495 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007496 mbedtls_ssl_pend_fatal_alert( ssl,
7497 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007498 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007499 }
7500
Hanno Becker33c3dc82019-01-30 14:46:46 +00007501 /* Check if we're handling the first CRT in the chain. */
Hanno Becker35e41772019-02-05 15:37:23 +00007502#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7503 if( crt_cnt++ == 0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007504 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7505 MBEDTLS_SSL_IS_CLIENT &&
Hanno Becker35e41772019-02-05 15:37:23 +00007506 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007507 {
Hanno Becker68b856d2019-02-08 14:00:04 +00007508 /* During client-side renegotiation, check that the server's
7509 * end-CRTs hasn't changed compared to the initial handshake,
7510 * mitigating the triple handshake attack. On success, reuse
7511 * the original end-CRT instead of parsing it again. */
Hanno Becker35e41772019-02-05 15:37:23 +00007512 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
7513 if( ssl_check_peer_crt_unchanged( ssl,
7514 &ssl->in_msg[i],
7515 n ) != 0 )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007516 {
Hanno Becker35e41772019-02-05 15:37:23 +00007517 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007518 mbedtls_ssl_pend_fatal_alert( ssl,
7519 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Hanno Becker35e41772019-02-05 15:37:23 +00007520 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007521 }
Hanno Becker35e41772019-02-05 15:37:23 +00007522
7523 /* Now we can safely free the original chain. */
7524 ssl_clear_peer_cert( ssl->session );
7525 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007526#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7527
Hanno Becker33c3dc82019-01-30 14:46:46 +00007528 /* Parse the next certificate in the chain. */
Hanno Becker0cc7af52019-02-08 14:39:16 +00007529#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker35e41772019-02-05 15:37:23 +00007530 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
Hanno Becker0cc7af52019-02-08 14:39:16 +00007531#else
Hanno Becker42de8f82019-02-26 11:51:34 +00007532 /* If we don't need to store the CRT chain permanently, parse
Hanno Becker0cc7af52019-02-08 14:39:16 +00007533 * it in-place from the input buffer instead of making a copy. */
7534 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
7535#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007536 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00007537 {
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007538 case 0: /* ok */
7539 mbedtls_platform_random_delay();
7540 if( ret != 0 )
7541 {
7542 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7543 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7544 goto crt_parse_der_failed;
7545 }
7546 break;
Hanno Becker33c3dc82019-01-30 14:46:46 +00007547 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7548 /* Ignore certificate with an unknown algorithm: maybe a
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007549 * prior certificate was already trusted. */
7550 mbedtls_platform_random_delay();
7551 if( ret != MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND )
7552 {
7553 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7554 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7555 goto crt_parse_der_failed;
7556 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007557 break;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007558
Hanno Becker33c3dc82019-01-30 14:46:46 +00007559 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7560 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7561 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007562
Hanno Becker33c3dc82019-01-30 14:46:46 +00007563 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7564 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7565 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007566
Hanno Becker33c3dc82019-01-30 14:46:46 +00007567 default:
7568 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7569 crt_parse_der_failed:
Hanno Beckerde62da92019-07-24 13:23:50 +01007570 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007571 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
7572 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007573 }
7574
7575 i += n;
7576 }
7577
Hanno Becker35e41772019-02-05 15:37:23 +00007578 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007579 return( 0 );
7580}
7581
Hanno Beckerb8a08572019-02-05 12:49:06 +00007582#if defined(MBEDTLS_SSL_SRV_C)
7583static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
7584{
Hanno Becker2d9623f2019-06-13 12:07:05 +01007585 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007586 return( -1 );
7587
7588#if defined(MBEDTLS_SSL_PROTO_SSL3)
7589 /*
7590 * Check if the client sent an empty certificate
7591 */
Hanno Becker2881d802019-05-22 14:44:53 +01007592 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007593 {
7594 if( ssl->in_msglen == 2 &&
7595 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
7596 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7597 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7598 {
7599 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
7600 return( 0 );
7601 }
7602
7603 return( -1 );
7604 }
7605#endif /* MBEDTLS_SSL_PROTO_SSL3 */
7606
7607#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
7608 defined(MBEDTLS_SSL_PROTO_TLS1_2)
7609 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
7610 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7611 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
Teppo Järvelin0efac532019-10-04 13:21:08 +03007612 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 ) // use regular memcmp as comparing public data
Hanno Beckerb8a08572019-02-05 12:49:06 +00007613 {
7614 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
7615 return( 0 );
7616 }
7617
Hanno Beckerb8a08572019-02-05 12:49:06 +00007618#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
7619 MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker17daaa52019-06-18 12:31:45 +01007620
7621 return( -1 );
Hanno Beckerb8a08572019-02-05 12:49:06 +00007622}
7623#endif /* MBEDTLS_SSL_SRV_C */
7624
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007625/* Check if a certificate message is expected.
7626 * Return either
7627 * - SSL_CERTIFICATE_EXPECTED, or
7628 * - SSL_CERTIFICATE_SKIP
7629 * indicating whether a Certificate message is expected or not.
7630 */
7631#define SSL_CERTIFICATE_EXPECTED 0
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02007632#define SSL_CERTIFICATE_SKIP 0xff
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007633static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
7634 int authmode )
7635{
Hanno Becker473f98f2019-06-26 10:27:32 +01007636 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007637 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007638
7639 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
7640 return( SSL_CERTIFICATE_SKIP );
7641
7642#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007643 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007644 {
Hanno Becker473f98f2019-06-26 10:27:32 +01007645 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
7646 MBEDTLS_KEY_EXCHANGE_RSA_PSK )
7647 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007648 return( SSL_CERTIFICATE_SKIP );
Hanno Becker473f98f2019-06-26 10:27:32 +01007649 }
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007650
7651 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
7652 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007653 ssl->session_negotiate->verify_result =
7654 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
7655 return( SSL_CERTIFICATE_SKIP );
7656 }
7657 }
Hanno Beckerfd5dc8a2019-03-01 08:10:46 +00007658#else
7659 ((void) authmode);
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007660#endif /* MBEDTLS_SSL_SRV_C */
7661
7662 return( SSL_CERTIFICATE_EXPECTED );
7663}
7664
Hanno Becker3cf50612019-02-05 14:36:34 +00007665static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007666 volatile int authmode,
Hanno Becker3cf50612019-02-05 14:36:34 +00007667 mbedtls_x509_crt *chain,
7668 void *rs_ctx )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007669{
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007670 volatile int verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Andrzej Kurekfd56f402020-05-25 11:52:05 -04007671 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007672 volatile int flow_counter = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01007673 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007674 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker3cf50612019-02-05 14:36:34 +00007675 mbedtls_x509_crt *ca_chain;
7676 mbedtls_x509_crl *ca_crl;
7677
7678 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
Jarno Lamsae1621d42019-12-19 08:58:56 +02007679 {
Hanno Becker3cf50612019-02-05 14:36:34 +00007680 return( 0 );
Jarno Lamsae1621d42019-12-19 08:58:56 +02007681 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007682
Jarno Lamsae1621d42019-12-19 08:58:56 +02007683 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Hanno Becker3cf50612019-02-05 14:36:34 +00007684#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7685 if( ssl->handshake->sni_ca_chain != NULL )
7686 {
7687 ca_chain = ssl->handshake->sni_ca_chain;
7688 ca_crl = ssl->handshake->sni_ca_crl;
7689 }
7690 else
7691#endif
7692 {
7693 ca_chain = ssl->conf->ca_chain;
7694 ca_crl = ssl->conf->ca_crl;
7695 }
7696
7697 /*
7698 * Main check: verify certificate
7699 */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007700 verify_ret = mbedtls_x509_crt_verify_restartable(
Hanno Becker3cf50612019-02-05 14:36:34 +00007701 chain,
7702 ca_chain, ca_crl,
7703 ssl->conf->cert_profile,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007704#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Hanno Becker3cf50612019-02-05 14:36:34 +00007705 ssl->hostname,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007706#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Hanno Becker3cf50612019-02-05 14:36:34 +00007707 &ssl->session_negotiate->verify_result,
Hanno Becker9ec3fe02019-07-01 17:36:12 +01007708#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
7709 ssl->conf->f_vrfy, ssl->conf->p_vrfy,
7710#endif /* MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
7711 rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00007712
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007713 if( verify_ret == 0 )
7714 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007715 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007716 if( verify_ret == 0 )
7717 {
7718 flow_counter++;
7719 }
7720 else
7721 {
7722 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7723 }
7724 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007725 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007726 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007727 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", verify_ret );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007728 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007729 }
7730
7731#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Hanno Becker8c13ee62019-02-26 16:48:17 +00007732 if( verify_ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Hanno Becker3cf50612019-02-05 14:36:34 +00007733 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
7734#endif
7735
7736 /*
7737 * Secondary checks: always done, but change 'ret' only if it was 0
7738 */
7739
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007740#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
Hanno Becker3cf50612019-02-05 14:36:34 +00007741 {
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007742#if defined(MBEDTLS_USE_TINYCRYPT)
Hanno Beckeree902df2019-08-23 13:47:47 +01007743 ret = mbedtls_ssl_check_curve_uecc( ssl, MBEDTLS_UECC_DP_SECP256R1 );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007744#else /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007745 mbedtls_pk_context *pk;
7746 ret = mbedtls_x509_crt_pk_acquire( chain, &pk );
7747 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +01007748 {
7749 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007750 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +01007751 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007752
7753 /* If certificate uses an EC key, make sure the curve is OK */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007754 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) )
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007755 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007756 ret = mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007757 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007758
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00007759 mbedtls_x509_crt_pk_release( chain );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007760#endif /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007761
7762 if( ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007763 {
7764 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
7765
7766 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007767 if( verify_ret == 0 )
7768 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007769 flow_counter++;
7770 }
7771 if( ret == 0 )
7772 {
7773 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007774 }
7775 }
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007776#endif /* MBEDTLS_ECP_C || MEDTLS_USE_TINYCRYPT */
Hanno Becker3cf50612019-02-05 14:36:34 +00007777
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007778 ret = mbedtls_ssl_check_cert_usage( chain,
Hanno Becker3cf50612019-02-05 14:36:34 +00007779 ciphersuite_info,
Hanno Becker2d9623f2019-06-13 12:07:05 +01007780 ( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7781 MBEDTLS_SSL_IS_CLIENT ),
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007782 &ssl->session_negotiate->verify_result );
7783 if( ret == 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007784 {
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007785 flow_counter++;
7786 }
7787 else
7788 {
7789 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007790 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007791 if( verify_ret == 0 )
7792 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Hanno Becker3cf50612019-02-05 14:36:34 +00007793 }
7794
7795 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
7796 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
7797 * with details encoded in the verification flags. All other kinds
7798 * of error codes, including those from the user provided f_vrfy
7799 * functions, are treated as fatal and lead to a failure of
7800 * ssl_parse_certificate even if verification was optional. */
7801 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
Hanno Becker8c13ee62019-02-26 16:48:17 +00007802 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7803 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
Hanno Becker3cf50612019-02-05 14:36:34 +00007804 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007805 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007806 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
7807 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7808 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
7809 {
7810 verify_ret = 0;
7811 flow_counter++;
7812 }
7813 else
7814 {
7815 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7816 }
7817 } else {
7818 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007819 }
7820
7821 if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
7822 {
7823 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007824 verify_ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007825 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007826 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007827 else
7828 {
7829 flow_counter++;
7830 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007831
Hanno Becker8c13ee62019-02-26 16:48:17 +00007832 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007833 {
7834 uint8_t alert;
7835
7836 /* The certificate may have been rejected for several reasons.
7837 Pick one and send the corresponding alert. Which alert to send
7838 may be a subject of debate in some cases. */
7839 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
7840 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
7841 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
7842 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7843 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
7844 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7845 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
7846 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7847 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
7848 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7849 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
7850 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7851 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
7852 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7853 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
7854 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
7855 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
7856 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
7857 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
7858 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
7859 else
7860 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Hanno Beckerde62da92019-07-24 13:23:50 +01007861 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker3cf50612019-02-05 14:36:34 +00007862 }
7863
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007864 if( verify_ret == 0 &&
7865#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7866 flow_counter == 5 )
7867#else
7868 flow_counter == 4 )
7869#endif
7870 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007871 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007872 if( verify_ret == 0 &&
7873#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7874 flow_counter == 5 )
7875#else
7876 flow_counter == 4 )
7877#endif
7878 {
Jarno Lamsae1621d42019-12-19 08:58:56 +02007879 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER AUTHENTICATED" ) );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007880 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
7881 }
7882 else
7883 {
7884 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7885 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007886 } else {
7887 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER NOT AUTHENTICATED, %d", flow_counter));
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007888 }
7889
Hanno Becker3cf50612019-02-05 14:36:34 +00007890#if defined(MBEDTLS_DEBUG_C)
7891 if( ssl->session_negotiate->verify_result != 0 )
7892 {
7893 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
7894 ssl->session_negotiate->verify_result ) );
7895 }
7896 else
7897 {
7898 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
7899 }
7900#endif /* MBEDTLS_DEBUG_C */
7901
Hanno Becker8c13ee62019-02-26 16:48:17 +00007902 return( verify_ret );
Hanno Becker3cf50612019-02-05 14:36:34 +00007903}
7904
Hanno Becker34106f62019-02-08 14:59:05 +00007905#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker5882dd02019-06-06 16:25:57 +01007906
7907#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00007908static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
7909 unsigned char *start, size_t len )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007910{
7911 int ret;
Hanno Becker34106f62019-02-08 14:59:05 +00007912 /* Remember digest of the peer's end-CRT. */
7913 ssl->session_negotiate->peer_cert_digest =
7914 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
7915 if( ssl->session_negotiate->peer_cert_digest == NULL )
7916 {
7917 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
7918 sizeof( MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007919 mbedtls_ssl_pend_fatal_alert( ssl,
7920 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Becker34106f62019-02-08 14:59:05 +00007921
7922 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7923 }
7924
7925 ret = mbedtls_md( mbedtls_md_info_from_type(
7926 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
7927 start, len,
7928 ssl->session_negotiate->peer_cert_digest );
7929
7930 ssl->session_negotiate->peer_cert_digest_type =
7931 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
7932 ssl->session_negotiate->peer_cert_digest_len =
7933 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
7934
7935 return( ret );
7936}
Hanno Becker5882dd02019-06-06 16:25:57 +01007937#endif /* MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker34106f62019-02-08 14:59:05 +00007938
7939static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
7940 unsigned char *start, size_t len )
7941{
7942 unsigned char *end = start + len;
7943 int ret;
7944
7945 /* Make a copy of the peer's raw public key. */
7946 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
7947 ret = mbedtls_pk_parse_subpubkey( &start, end,
7948 &ssl->handshake->peer_pubkey );
7949 if( ret != 0 )
7950 {
7951 /* We should have parsed the public key before. */
7952 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7953 }
7954
Manuel Pégourié-Gonnard2829bbf2019-09-19 10:45:14 +02007955 ssl->handshake->got_peer_pubkey = 1;
Hanno Becker34106f62019-02-08 14:59:05 +00007956 return( 0 );
7957}
7958#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7959
Hanno Becker3cf50612019-02-05 14:36:34 +00007960int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
7961{
7962 int ret = 0;
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007963 int crt_expected;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007964#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7965 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
7966 ? ssl->handshake->sni_authmode
Hanno Beckeracd4fc02019-06-12 16:40:50 +01007967 : mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007968#else
Hanno Beckeracd4fc02019-06-12 16:40:50 +01007969 const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007970#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007971 void *rs_ctx = NULL;
Hanno Beckere4aeb762019-02-05 17:19:52 +00007972 mbedtls_x509_crt *chain = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007973
7974 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
7975
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007976 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
7977 if( crt_expected == SSL_CERTIFICATE_SKIP )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007978 {
7979 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Hanno Becker613d4902019-02-05 13:11:17 +00007980 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007981 }
7982
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007983#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
7984 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02007985 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007986 {
Hanno Beckere4aeb762019-02-05 17:19:52 +00007987 chain = ssl->handshake->ecrs_peer_cert;
7988 ssl->handshake->ecrs_peer_cert = NULL;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007989 goto crt_verify;
7990 }
7991#endif
7992
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02007993 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007994 {
7995 /* mbedtls_ssl_read_record may have sent an alert already. We
7996 let it decide whether to alert. */
7997 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Hanno Beckere4aeb762019-02-05 17:19:52 +00007998 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007999 }
8000
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008001#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerb8a08572019-02-05 12:49:06 +00008002 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
8003 {
8004 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008005
Hanno Beckerb8a08572019-02-05 12:49:06 +00008006 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
Hanno Becker613d4902019-02-05 13:11:17 +00008007 ret = 0;
8008 else
8009 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Hanno Beckerb8a08572019-02-05 12:49:06 +00008010
Hanno Becker613d4902019-02-05 13:11:17 +00008011 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008012 }
Hanno Beckerb8a08572019-02-05 12:49:06 +00008013#endif /* MBEDTLS_SSL_SRV_C */
8014
Hanno Becker35e41772019-02-05 15:37:23 +00008015 /* Clear existing peer CRT structure in case we tried to
8016 * reuse a session but it failed, and allocate a new one. */
Hanno Beckera46c2872019-02-05 13:08:01 +00008017 ssl_clear_peer_cert( ssl->session_negotiate );
Hanno Beckere4aeb762019-02-05 17:19:52 +00008018
8019 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
8020 if( chain == NULL )
Hanno Becker35e41772019-02-05 15:37:23 +00008021 {
8022 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
8023 sizeof( mbedtls_x509_crt ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008024 mbedtls_ssl_pend_fatal_alert( ssl,
8025 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Beckera46c2872019-02-05 13:08:01 +00008026
Hanno Beckere4aeb762019-02-05 17:19:52 +00008027 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
8028 goto exit;
8029 }
8030 mbedtls_x509_crt_init( chain );
8031
8032 ret = ssl_parse_certificate_chain( ssl, chain );
Hanno Becker35e41772019-02-05 15:37:23 +00008033 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00008034 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008035
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008036#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8037 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02008038 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008039
8040crt_verify:
8041 if( ssl->handshake->ecrs_enabled)
8042 rs_ctx = &ssl->handshake->ecrs_ctx;
8043#endif
8044
Hanno Becker3cf50612019-02-05 14:36:34 +00008045 ret = ssl_parse_certificate_verify( ssl, authmode,
Hanno Beckere4aeb762019-02-05 17:19:52 +00008046 chain, rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00008047 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00008048 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00008049
Hanno Becker3008d282019-02-05 17:02:28 +00008050#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakker5121ce52009-01-03 21:22:43 +00008051 {
Hanno Becker5882dd02019-06-06 16:25:57 +01008052 size_t pk_len;
8053 unsigned char *pk_start;
Paul Bakker5121ce52009-01-03 21:22:43 +00008054
Hanno Becker34106f62019-02-08 14:59:05 +00008055 /* We parse the CRT chain without copying, so
8056 * these pointers point into the input buffer,
8057 * and are hence still valid after freeing the
8058 * CRT chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00008059
Hanno Becker5882dd02019-06-06 16:25:57 +01008060#if defined(MBEDTLS_SSL_RENEGOTIATION)
8061 unsigned char *crt_start;
8062 size_t crt_len;
8063
Hanno Becker34106f62019-02-08 14:59:05 +00008064 crt_start = chain->raw.p;
8065 crt_len = chain->raw.len;
Hanno Becker5882dd02019-06-06 16:25:57 +01008066#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008067
Hanno Becker8c13ee62019-02-26 16:48:17 +00008068 pk_start = chain->cache->pk_raw.p;
8069 pk_len = chain->cache->pk_raw.len;
Hanno Becker34106f62019-02-08 14:59:05 +00008070
8071 /* Free the CRT structures before computing
8072 * digest and copying the peer's public key. */
8073 mbedtls_x509_crt_free( chain );
8074 mbedtls_free( chain );
8075 chain = NULL;
8076
Hanno Becker5882dd02019-06-06 16:25:57 +01008077#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00008078 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008079 if( ret != 0 )
Hanno Beckercf291d62019-02-06 16:19:04 +00008080 goto exit;
Hanno Becker5882dd02019-06-06 16:25:57 +01008081#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008082
Hanno Becker34106f62019-02-08 14:59:05 +00008083 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008084 if( ret != 0 )
Hanno Becker34106f62019-02-08 14:59:05 +00008085 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00008086 }
Hanno Becker34106f62019-02-08 14:59:05 +00008087#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8088 /* Pass ownership to session structure. */
Hanno Beckere4aeb762019-02-05 17:19:52 +00008089 ssl->session_negotiate->peer_cert = chain;
8090 chain = NULL;
Hanno Becker34106f62019-02-08 14:59:05 +00008091#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008092
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008093 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008094
Hanno Becker613d4902019-02-05 13:11:17 +00008095exit:
8096
Hanno Beckere4aeb762019-02-05 17:19:52 +00008097 if( ret == 0 )
Jarno Lamsa2b205162019-11-12 15:36:21 +02008098 {
8099 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
8100 {
8101 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
8102 }
8103 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
8104 {
8105 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
8106 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008107 else
8108 {
8109 ssl->state = MBEDTLS_SSL_INVALID;
8110 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008111 }
Hanno Beckere4aeb762019-02-05 17:19:52 +00008112
8113#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8114 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
8115 {
8116 ssl->handshake->ecrs_peer_cert = chain;
8117 chain = NULL;
8118 }
8119#endif
8120
8121 if( chain != NULL )
8122 {
8123 mbedtls_x509_crt_free( chain );
8124 mbedtls_free( chain );
8125 }
8126
Paul Bakker5121ce52009-01-03 21:22:43 +00008127 return( ret );
8128}
Hanno Beckerb71e90a2019-02-05 13:20:55 +00008129#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00008130
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008131int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008132{
8133 int ret;
8134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008135 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008136
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008137 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00008138 ssl->out_msglen = 1;
8139 ssl->out_msg[0] = 1;
8140
Jarno Lamsa2b205162019-11-12 15:36:21 +02008141 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
8142 {
8143 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
8144 }
8145 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
8146 {
8147 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
8148 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008149 else
8150 {
8151 ssl->state = MBEDTLS_SSL_INVALID;
8152 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008153
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008154 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008155 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008156 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008157 return( ret );
8158 }
8159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008160 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008161
8162 return( 0 );
8163}
8164
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008165int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008166{
8167 int ret;
8168
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008169 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008170
Hanno Becker327c93b2018-08-15 13:56:18 +01008171 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008172 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008173 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008174 return( ret );
8175 }
8176
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008177 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00008178 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008179 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008180 mbedtls_ssl_pend_fatal_alert( ssl,
8181 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008182 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008183 }
8184
Hanno Beckere678eaa2018-08-21 14:57:46 +01008185 /* CCS records are only accepted if they have length 1 and content '1',
8186 * so we don't need to check this here. */
Paul Bakker5121ce52009-01-03 21:22:43 +00008187
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008188 /*
8189 * Switch to our negotiated transform and session parameters for inbound
8190 * data.
8191 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008192 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008193 ssl->transform_in = ssl->transform_negotiate;
8194 ssl->session_in = ssl->session_negotiate;
8195
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008196#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008197 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008198 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008199#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008200 ssl_dtls_replay_reset( ssl );
8201#endif
8202
8203 /* Increment epoch */
8204 if( ++ssl->in_epoch == 0 )
8205 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008206 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02008207 /* This is highly unlikely to happen for legitimate reasons, so
8208 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008209 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008210 }
8211 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008212 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008213#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008214#if defined(MBEDTLS_SSL_PROTO_TLS)
8215 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008216 mbedtls_platform_memset( ssl->in_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008217 }
8218#endif
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008219
Hanno Beckerf5970a02019-05-08 09:38:41 +01008220 ssl_update_in_pointers( ssl );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008221
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008222#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8223 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008224 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008225 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008226 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008227 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
Hanno Beckerde62da92019-07-24 13:23:50 +01008228 mbedtls_ssl_pend_fatal_alert( ssl,
8229 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008230 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008231 }
8232 }
8233#endif
8234
Jarno Lamsa2b205162019-11-12 15:36:21 +02008235 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
8236 {
8237 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
8238 }
8239 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
8240 {
8241 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
8242 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008243 else
8244 {
8245 ssl->state = MBEDTLS_SSL_INVALID;
8246 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008247
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008248 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008249
8250 return( 0 );
8251}
8252
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008253void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008254{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008255#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8256 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker533f5b12019-08-15 16:56:35 +01008257 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008258 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008259#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008260#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8261#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008262 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008263#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008264#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008265 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008266#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008267#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008268}
8269
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008270static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008271{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008272 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008273
8274 /*
8275 * Free our handshake params
8276 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02008277 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008278 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00008279 ssl->handshake = NULL;
8280
8281 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008282 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00008283 */
8284 if( ssl->transform )
8285 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008286 mbedtls_ssl_transform_free( ssl->transform );
8287 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00008288 }
8289 ssl->transform = ssl->transform_negotiate;
8290 ssl->transform_negotiate = NULL;
8291
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008292 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008293}
8294
Jarno Lamsae1621d42019-12-19 08:58:56 +02008295int mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008296{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04008297 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008298
8299#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Jarno Lamsa015aa442019-12-20 12:09:37 +02008300 volatile const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008301 ? ssl->handshake->sni_authmode
8302 : mbedtls_ssl_conf_get_authmode( ssl->conf );
8303#else
Jarno Lamsa015aa442019-12-20 12:09:37 +02008304 volatile const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008305#endif
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008306#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8307 volatile int crt_expected = SSL_CERTIFICATE_EXPECTED;
8308 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
8309#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008310 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008311
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008312#if defined(MBEDTLS_SSL_RENEGOTIATION)
8313 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008314 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008315 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008316 ssl->renego_records_seen = 0;
8317 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008318#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008319
8320 /*
8321 * Free the previous session and switch in the current one
8322 */
Paul Bakker0a597072012-09-25 21:55:46 +00008323 if( ssl->session )
8324 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008325#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01008326 /* RFC 7366 3.1: keep the EtM state */
8327 ssl->session_negotiate->encrypt_then_mac =
8328 ssl->session->encrypt_then_mac;
8329#endif
8330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008331 mbedtls_ssl_session_free( ssl->session );
8332 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00008333 }
8334 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00008335 ssl->session_negotiate = NULL;
8336
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008337#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Paul Bakker0a597072012-09-25 21:55:46 +00008338 /*
8339 * Add cache entry
8340 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008341 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02008342 ssl->session->id_len != 0 &&
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008343 ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_UNSET )
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008344 {
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01008345 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008346 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008347 }
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008348#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker0a597072012-09-25 21:55:46 +00008349
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008350 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8351 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8352#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8353 crt_expected == SSL_CERTIFICATE_SKIP )
8354#else
8355 1 )
8356#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008357 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008358 mbedtls_platform_random_delay();
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008359 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8360 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8361#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8362 crt_expected == SSL_CERTIFICATE_SKIP )
8363#else
8364 1 )
8365#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008366 {
8367 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
8368 }
8369 else
8370 {
8371 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8372 goto cleanup;
8373 }
8374 }
8375
Jarno Lamsae1621d42019-12-19 08:58:56 +02008376#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008377 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008378 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008379 mbedtls_platform_random_delay();
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008380 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008381 {
Jarno Lamsa06164052019-12-19 14:40:36 +02008382 /* When doing session resume, no premaster or peer authentication */
Jarno Lamsae1621d42019-12-19 08:58:56 +02008383 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsa06164052019-12-19 14:40:36 +02008384 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008385 }
8386 else
8387 {
8388 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008389 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008390 }
8391 }
8392#endif
8393
8394 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8395 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008396 mbedtls_platform_random_delay();
Jarno Lamsae1621d42019-12-19 08:58:56 +02008397 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8398 {
8399 ret = 0;
8400 }
8401 else
8402 {
8403 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008404 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008405 }
8406 }
8407 else
8408 {
8409 ret = MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008410 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008411 }
8412
Jarno Lamsa06164052019-12-19 14:40:36 +02008413 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8414 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8415 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8416 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008417 mbedtls_platform_random_delay();
Jarno Lamsa06164052019-12-19 14:40:36 +02008418 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8419 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8420 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8421 {
8422 ret = 0;
8423 }
8424 else
8425 {
8426 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8427 goto cleanup;
8428 }
8429 }
8430 else
8431 {
8432 MBEDTLS_SSL_DEBUG_MSG( 3, ( "hello random %d", ssl->handshake->hello_random_set ) );
8433 MBEDTLS_SSL_DEBUG_MSG( 3, ( "key_derivation_done %d", ssl->handshake->key_derivation_done ) );
8434 MBEDTLS_SSL_DEBUG_MSG( 3, ( "premaster_generated %d", ssl->handshake->premaster_generated ) );
8435 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8436 }
8437
8438cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008439#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008440 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008441 ssl->handshake->flight != NULL )
8442 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008443 /* Cancel handshake timer */
8444 ssl_set_timer( ssl, 0 );
8445
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008446 /* Keep last flight around in case we need to resend it:
8447 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008448 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008449 }
8450 else
8451#endif
8452 ssl_handshake_wrapup_free_hs_transform( ssl );
8453
Jarno Lamsa2b205162019-11-12 15:36:21 +02008454 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Paul Bakker48916f92012-09-16 19:57:18 +00008455
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008456 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Jarno Lamsae1621d42019-12-19 08:58:56 +02008457 return ret;
Paul Bakker48916f92012-09-16 19:57:18 +00008458}
8459
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008460int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00008461{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008462 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00008463
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008464 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008465
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008466 ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01008467
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008468 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8469 mbedtls_ssl_suite_get_mac(
8470 mbedtls_ssl_ciphersuite_from_id(
8471 mbedtls_ssl_session_get_ciphersuite(
8472 ssl->session_negotiate ) ) ),
8473 ssl, ssl->out_msg + 4,
8474 mbedtls_ssl_conf_get_endpoint( ssl->conf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008475
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01008476 /*
8477 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
8478 * may define some other value. Currently (early 2016), no defined
8479 * ciphersuite does this (and this is unlikely to change as activity has
8480 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
8481 */
Hanno Becker2881d802019-05-22 14:44:53 +01008482 hash_len = ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008483
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008484#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008485 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008486 mbedtls_platform_memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008487#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008488
Paul Bakker5121ce52009-01-03 21:22:43 +00008489 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008490 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8491 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00008492
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008493#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Paul Bakker5121ce52009-01-03 21:22:43 +00008494 /*
8495 * In case of session resuming, invert the client and server
8496 * ChangeCipherSpec messages order.
8497 */
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008498 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008499 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008500#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008501 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8502 MBEDTLS_SSL_IS_CLIENT )
8503 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008504 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008505 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008506#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008507#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008508 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8509 MBEDTLS_SSL_IS_SERVER )
8510 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008511 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008512 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008513#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008514 }
8515 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008516#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008517 {
8518 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8519 {
8520 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8521 }
8522 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8523 {
8524 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8525 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008526 else
8527 {
8528 ssl->state = MBEDTLS_SSL_INVALID;
8529 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008530 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008531
Paul Bakker48916f92012-09-16 19:57:18 +00008532 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02008533 * Switch to our negotiated transform and session parameters for outbound
8534 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00008535 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008536 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01008537
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008538#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008539 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008540 {
8541 unsigned char i;
8542
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008543 /* Remember current epoch settings for resending */
8544 ssl->handshake->alt_transform_out = ssl->transform_out;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008545 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008546
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008547 /* Set sequence_number to zero */
Hanno Becker19859472018-08-06 09:40:20 +01008548 memset( ssl->cur_out_ctr + 2, 0, 6 );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008549
8550 /* Increment epoch */
8551 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01008552 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008553 break;
8554
8555 /* The loop goes to its end iff the counter is wrapping */
8556 if( i == 0 )
8557 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008558 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
8559 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008560 }
8561 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008562 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008563#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008564#if defined(MBEDTLS_SSL_PROTO_TLS)
8565 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008566 mbedtls_platform_memset( ssl->cur_out_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008567 }
8568#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008569
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008570 ssl->transform_out = ssl->transform_negotiate;
8571 ssl->session_out = ssl->session_negotiate;
8572
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008573#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8574 if( mbedtls_ssl_hw_record_activate != NULL )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008575 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008576 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008577 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008578 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
8579 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker07eb38b2012-12-19 14:42:06 +01008580 }
8581 }
8582#endif
8583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008584#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008585 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008586 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02008587#endif
8588
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008589 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008590 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008591 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008592 return( ret );
8593 }
8594
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008595#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008596 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008597 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
8598 {
8599 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
8600 return( ret );
8601 }
8602#endif
8603
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008604 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008605
8606 return( 0 );
8607}
8608
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008609#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008610#define SSL_MAX_HASH_LEN 36
8611#else
8612#define SSL_MAX_HASH_LEN 12
8613#endif
8614
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008615int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008616{
Paul Bakker23986e52011-04-24 08:57:21 +00008617 int ret;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008618 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008619 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00008620
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008621 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008622
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008623 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8624 mbedtls_ssl_suite_get_mac(
8625 mbedtls_ssl_ciphersuite_from_id(
8626 mbedtls_ssl_session_get_ciphersuite(
8627 ssl->session_negotiate ) ) ),
8628 ssl, buf,
8629 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00008630
Hanno Becker327c93b2018-08-15 13:56:18 +01008631 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008632 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008633 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008634 return( ret );
8635 }
8636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008637 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00008638 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008639 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008640 mbedtls_ssl_pend_fatal_alert( ssl,
8641 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008642 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008643 }
8644
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008645 /* There is currently no ciphersuite using another length with TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008646#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +01008647 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008648 hash_len = 36;
8649 else
8650#endif
8651 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008652
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008653 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
8654 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00008655 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008656 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008657 mbedtls_ssl_pend_fatal_alert( ssl,
8658 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008659 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008660 }
8661
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02008662 if( mbedtls_platform_memequal( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
8663 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008664 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008665 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008666 mbedtls_ssl_pend_fatal_alert( ssl,
8667 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008668 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008669 }
8670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008671#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008672 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008673 mbedtls_platform_memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008674#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008675
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008676#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008677 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008678 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008679#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008680 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008681 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008682#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008683#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008684 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008685 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008686#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008687 }
8688 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008689#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008690 {
8691 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8692 {
8693 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8694 }
8695 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8696 {
8697 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8698 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008699 else
8700 {
8701 ssl->state = MBEDTLS_SSL_INVALID;
8702 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008703 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008704
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008705#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008706 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008707 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008708#endif
8709
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008710 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008711
8712 return( 0 );
8713}
8714
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008715static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008716{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008717 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008718
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008719#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8720 defined(MBEDTLS_SSL_PROTO_TLS1_1)
8721 mbedtls_md5_init( &handshake->fin_md5 );
8722 mbedtls_sha1_init( &handshake->fin_sha1 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008723 mbedtls_md5_starts_ret( &handshake->fin_md5 );
8724 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008725#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008726#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8727#if defined(MBEDTLS_SHA256_C)
8728 mbedtls_sha256_init( &handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008729 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008730#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008731#if defined(MBEDTLS_SHA512_C)
8732 mbedtls_sha512_init( &handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008733 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008734#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008735#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008736
Hanno Becker7e5437a2017-04-28 17:15:26 +01008737#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
8738 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8739 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
8740#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008741
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008742#if defined(MBEDTLS_DHM_C)
8743 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008744#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008745#if defined(MBEDTLS_ECDH_C)
8746 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008747#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02008748#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008749 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02008750#if defined(MBEDTLS_SSL_CLI_C)
8751 handshake->ecjpake_cache = NULL;
8752 handshake->ecjpake_cache_len = 0;
8753#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008754#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008755
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008756#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02008757 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008758#endif
8759
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008760#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8761 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
8762#endif
Hanno Becker3bf8cdf2019-02-06 16:18:31 +00008763
8764#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
8765 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8766 mbedtls_pk_init( &handshake->peer_pubkey );
8767#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008768}
8769
Hanno Becker611a83b2018-01-03 14:27:32 +00008770void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008771{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008772 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Andrzej Kurek11750442020-09-17 07:12:06 -04008773#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
8774 mbedtls_cipher_init( &transform->cipher_ctx );
8775#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008776 mbedtls_cipher_init( &transform->cipher_ctx_enc );
8777 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -04008778#endif
Paul Bakker84bbeb52014-07-01 14:53:22 +02008779
Hanno Becker92231322018-01-03 15:32:51 +00008780#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008781 mbedtls_md_init( &transform->md_ctx_enc );
8782 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +00008783#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008784}
8785
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008786void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008787{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008788 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008789}
8790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008791static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008792{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008793 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00008794 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008795 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008796 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008797 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008798 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02008799 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008800
8801 /*
8802 * Either the pointers are now NULL or cleared properly and can be freed.
8803 * Now allocate missing structures.
8804 */
8805 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008806 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008807 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008808 }
Paul Bakker48916f92012-09-16 19:57:18 +00008809
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008810 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008811 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008812 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008813 }
Paul Bakker48916f92012-09-16 19:57:18 +00008814
Paul Bakker82788fb2014-10-20 13:59:19 +02008815 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008816 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008817 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008818 }
Paul Bakker48916f92012-09-16 19:57:18 +00008819
Andrzej Kurekf3844952020-10-16 23:03:01 +02008820#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
8821 /* If the buffers are too small - reallocate */
8822 {
8823 int modified = 0;
8824 size_t written_in = 0, len_offset_in = 0;
8825 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
8826 if( ssl->in_buf != NULL )
8827 {
8828 written_in = ssl->in_msg - ssl->in_buf;
8829 len_offset_in = ssl->in_len - ssl->in_buf;
8830 if( ssl->in_buf_len < MBEDTLS_SSL_IN_BUFFER_LEN )
8831 {
8832 if( resize_buffer( &ssl->in_buf, MBEDTLS_SSL_IN_BUFFER_LEN,
8833 &ssl->in_buf_len ) != 0 )
8834 {
8835 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
8836 }
8837 else
8838 {
8839 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %d", MBEDTLS_SSL_IN_BUFFER_LEN ) );
8840 modified = 1;
8841 }
8842 }
8843 }
8844
8845 if( ssl->out_buf != NULL )
8846 {
8847 written_out = ssl->out_msg - ssl->out_buf;
8848 iv_offset_out = ssl->out_iv - ssl->out_buf;
8849 len_offset_out = ssl->out_len - ssl->out_buf;
8850 if( ssl->out_buf_len < MBEDTLS_SSL_OUT_BUFFER_LEN )
8851 {
8852 if( resize_buffer( &ssl->out_buf, MBEDTLS_SSL_OUT_BUFFER_LEN,
8853 &ssl->out_buf_len ) != 0 )
8854 {
8855 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
8856 }
8857 else
8858 {
8859 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %d", MBEDTLS_SSL_OUT_BUFFER_LEN ) );
8860 modified = 1;
8861 }
8862 }
8863 }
8864 if( modified )
8865 {
8866 /* Update pointers here to avoid doing it twice. */
8867 ssl_reset_in_out_pointers( ssl );
8868 /* Fields below might not be properly updated with record
8869 * splitting or with CID, so they are manually updated here. */
8870 ssl->out_msg = ssl->out_buf + written_out;
8871 ssl->out_len = ssl->out_buf + len_offset_out;
8872 ssl->out_iv = ssl->out_buf + iv_offset_out;
8873
8874 ssl->in_msg = ssl->in_buf + written_in;
8875 ssl->in_len = ssl->in_buf + len_offset_in;
8876 }
8877 }
8878#endif
8879
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008880 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00008881 if( ssl->handshake == NULL ||
8882 ssl->transform_negotiate == NULL ||
8883 ssl->session_negotiate == NULL )
8884 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02008885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008886
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008887 mbedtls_free( ssl->handshake );
8888 mbedtls_free( ssl->transform_negotiate );
8889 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008890
8891 ssl->handshake = NULL;
8892 ssl->transform_negotiate = NULL;
8893 ssl->session_negotiate = NULL;
8894
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02008895 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00008896 }
8897
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008898 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008899 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Becker611a83b2018-01-03 14:27:32 +00008900 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02008901 ssl_handshake_params_init( ssl->handshake );
8902
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008903#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008904 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008905 {
8906 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008907
Hanno Becker2d9623f2019-06-13 12:07:05 +01008908 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008909 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
8910 else
8911 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
8912 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008913#endif
8914
Paul Bakker48916f92012-09-16 19:57:18 +00008915 return( 0 );
8916}
8917
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008918#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008919/* Dummy cookie callbacks for defaults */
8920static int ssl_cookie_write_dummy( void *ctx,
8921 unsigned char **p, unsigned char *end,
8922 const unsigned char *cli_id, size_t cli_id_len )
8923{
8924 ((void) ctx);
8925 ((void) p);
8926 ((void) end);
8927 ((void) cli_id);
8928 ((void) cli_id_len);
8929
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008930 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008931}
8932
8933static int ssl_cookie_check_dummy( void *ctx,
8934 const unsigned char *cookie, size_t cookie_len,
8935 const unsigned char *cli_id, size_t cli_id_len )
8936{
8937 ((void) ctx);
8938 ((void) cookie);
8939 ((void) cookie_len);
8940 ((void) cli_id);
8941 ((void) cli_id_len);
8942
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008943 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008944}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008945#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008946
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008947/* Once ssl->out_hdr as the address of the beginning of the
8948 * next outgoing record is set, deduce the other pointers.
8949 *
8950 * Note: For TLS, we save the implicit record sequence number
8951 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
8952 * and the caller has to make sure there's space for this.
8953 */
8954
8955static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
8956 mbedtls_ssl_transform *transform )
8957{
8958#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008959 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008960 {
8961 ssl->out_ctr = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008962#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01008963 ssl->out_cid = ssl->out_ctr + 8;
8964 ssl->out_len = ssl->out_cid;
8965 if( transform != NULL )
8966 ssl->out_len += transform->out_cid_len;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008967#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008968 ssl->out_len = ssl->out_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008969#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008970 ssl->out_iv = ssl->out_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008971 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008972 MBEDTLS_SSL_TRANSPORT_ELSE
8973#endif /* MBEDTLS_SSL_PROTO_DTLS */
8974#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008975 {
8976 ssl->out_ctr = ssl->out_hdr - 8;
8977 ssl->out_len = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008978#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01008979 ssl->out_cid = ssl->out_len;
8980#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008981 ssl->out_iv = ssl->out_hdr + 5;
8982 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008983#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008984
8985 /* Adjust out_msg to make space for explicit IV, if used. */
8986 if( transform != NULL &&
Hanno Becker7bcf2b52019-07-26 09:02:40 +01008987 mbedtls_ssl_ver_geq(
8988 mbedtls_ssl_get_minor_ver( ssl ),
8989 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008990 {
8991 ssl->out_msg = ssl->out_iv + transform->ivlen - transform->fixed_ivlen;
8992 }
8993 else
8994 ssl->out_msg = ssl->out_iv;
8995}
8996
8997/* Once ssl->in_hdr as the address of the beginning of the
8998 * next incoming record is set, deduce the other pointers.
8999 *
9000 * Note: For TLS, we save the implicit record sequence number
9001 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
9002 * and the caller has to make sure there's space for this.
9003 */
9004
Hanno Beckerf5970a02019-05-08 09:38:41 +01009005static void ssl_update_in_pointers( mbedtls_ssl_context *ssl )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009006{
Hanno Beckerf5970a02019-05-08 09:38:41 +01009007 /* This function sets the pointers to match the case
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009008 * of unprotected TLS/DTLS records, with ssl->in_msg
9009 * pointing to the beginning of the record content.
Hanno Beckerf5970a02019-05-08 09:38:41 +01009010 *
9011 * When decrypting a protected record, ssl->in_msg
9012 * will be shifted to point to the beginning of the
9013 * record plaintext.
9014 */
9015
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009016#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009017 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009018 {
Hanno Becker70e79282019-05-03 14:34:53 +01009019 /* This sets the header pointers to match records
9020 * without CID. When we receive a record containing
9021 * a CID, the fields are shifted accordingly in
9022 * ssl_parse_record_header(). */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009023 ssl->in_ctr = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009024#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01009025 ssl->in_cid = ssl->in_ctr + 8;
9026 ssl->in_len = ssl->in_cid; /* Default: no CID */
Hanno Beckera5a2b082019-05-15 14:03:01 +01009027#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01009028 ssl->in_len = ssl->in_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009029#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009030 ssl->in_msg = ssl->in_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009031 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009032 MBEDTLS_SSL_TRANSPORT_ELSE
9033#endif /* MBEDTLS_SSL_PROTO_DTLS */
9034#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009035 {
9036 ssl->in_ctr = ssl->in_hdr - 8;
9037 ssl->in_len = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009038#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01009039 ssl->in_cid = ssl->in_len;
9040#endif
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009041 ssl->in_msg = ssl->in_hdr + 5;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009042 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009043#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009044}
9045
Paul Bakker5121ce52009-01-03 21:22:43 +00009046/*
9047 * Initialize an SSL context
9048 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02009049void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
9050{
9051 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
9052}
9053
9054/*
9055 * Setup an SSL context
9056 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009057
9058static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl )
9059{
9060 /* Set the incoming and outgoing record pointers. */
9061#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009062 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009063 {
9064 ssl->out_hdr = ssl->out_buf;
9065 ssl->in_hdr = ssl->in_buf;
9066 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009067 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009068#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009069#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009070 {
9071 ssl->out_hdr = ssl->out_buf + 8;
9072 ssl->in_hdr = ssl->in_buf + 8;
9073 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009074#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009075
9076 /* Derive other internal pointers. */
9077 ssl_update_out_pointers( ssl, NULL /* no transform enabled */ );
Hanno Beckerf5970a02019-05-08 09:38:41 +01009078 ssl_update_in_pointers ( ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009079}
9080
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02009081int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02009082 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00009083{
Paul Bakker48916f92012-09-16 19:57:18 +00009084 int ret;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009085 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
9086 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00009087
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02009088 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00009089
Hanno Beckeref982d52019-07-23 15:56:18 +01009090#if defined(MBEDTLS_USE_TINYCRYPT)
9091 uECC_set_rng( &uecc_rng_wrapper );
9092#endif
9093
Paul Bakker62f2dee2012-09-28 07:31:51 +00009094 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01009095 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00009096 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02009097
9098 /* Set to NULL in case of an error condition */
9099 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02009100
Andrzej Kurekf3844952020-10-16 23:03:01 +02009101#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9102 ssl->in_buf_len = in_buf_len;
9103#endif
9104 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10009105 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009106 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02009107 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", in_buf_len) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02009108 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02009109 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10009110 }
9111
Andrzej Kurekf3844952020-10-16 23:03:01 +02009112#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9113 ssl->out_buf_len = out_buf_len;
9114#endif
9115
9116 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10009117 if( ssl->out_buf == NULL )
9118 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02009119 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", out_buf_len) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02009120 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02009121 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00009122 }
9123
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009124 ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02009125
Paul Bakker48916f92012-09-16 19:57:18 +00009126 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02009127 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00009128
Hanno Beckerc8f52992019-07-25 11:15:08 +01009129 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
Hanno Beckerf46e1ce2019-07-03 13:56:59 +01009130
Paul Bakker5121ce52009-01-03 21:22:43 +00009131 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02009132
9133error:
9134 mbedtls_free( ssl->in_buf );
9135 mbedtls_free( ssl->out_buf );
9136
9137 ssl->conf = NULL;
9138
Andrzej Kurekf3844952020-10-16 23:03:01 +02009139#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9140 ssl->in_buf_len = 0;
9141 ssl->out_buf_len = 0;
9142#endif
9143
k-stachowiaka47911c2018-07-04 17:41:58 +02009144 ssl->in_buf = NULL;
9145 ssl->out_buf = NULL;
9146
9147 ssl->in_hdr = NULL;
9148 ssl->in_ctr = NULL;
9149 ssl->in_len = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02009150 ssl->in_msg = NULL;
9151
9152 ssl->out_hdr = NULL;
9153 ssl->out_ctr = NULL;
9154 ssl->out_len = NULL;
9155 ssl->out_iv = NULL;
9156 ssl->out_msg = NULL;
9157
k-stachowiak9f7798e2018-07-31 16:52:32 +02009158 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00009159}
9160
9161/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00009162 * Reset an initialized and used SSL context for re-use while retaining
9163 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009164 *
9165 * If partial is non-zero, keep data in the input buffer and client ID.
9166 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00009167 */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009168static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00009169{
Paul Bakker48916f92012-09-16 19:57:18 +00009170 int ret;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009171#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9172 size_t in_buf_len = ssl->in_buf_len;
9173 size_t out_buf_len = ssl->out_buf_len;
9174#else
9175 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
9176 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
9177#endif
Paul Bakker48916f92012-09-16 19:57:18 +00009178
Hanno Becker7e772132018-08-10 12:38:21 +01009179#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
9180 !defined(MBEDTLS_SSL_SRV_C)
9181 ((void) partial);
9182#endif
9183
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009184 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009185
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009186 /* Cancel any possibly running timer */
9187 ssl_set_timer( ssl, 0 );
9188
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009189#if defined(MBEDTLS_SSL_RENEGOTIATION)
9190 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009191 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00009192
9193 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02009194 mbedtls_platform_memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
9195 mbedtls_platform_memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009196#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009197 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00009198
Paul Bakker7eb013f2011-10-06 12:37:39 +00009199 ssl->in_offt = NULL;
Hanno Beckerf29d4702018-08-10 11:31:15 +01009200 ssl_reset_in_out_pointers( ssl );
Paul Bakker7eb013f2011-10-06 12:37:39 +00009201
9202 ssl->in_msgtype = 0;
9203 ssl->in_msglen = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009204#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02009205 ssl->next_record_offset = 0;
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02009206 ssl->in_epoch = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02009207#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009208#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02009209 ssl_dtls_replay_reset( ssl );
9210#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00009211
9212 ssl->in_hslen = 0;
9213 ssl->nb_zero = 0;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01009214
9215 ssl->keep_current_message = 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00009216
9217 ssl->out_msgtype = 0;
9218 ssl->out_msglen = 0;
9219 ssl->out_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009220#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
9221 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009222 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009223#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00009224
Hanno Becker19859472018-08-06 09:40:20 +01009225 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
9226
Paul Bakker48916f92012-09-16 19:57:18 +00009227 ssl->transform_in = NULL;
9228 ssl->transform_out = NULL;
Paul Bakker7eb013f2011-10-06 12:37:39 +00009229
Hanno Becker78640902018-08-13 16:35:15 +01009230 ssl->session_in = NULL;
9231 ssl->session_out = NULL;
9232
Andrzej Kurekf3844952020-10-16 23:03:01 +02009233 mbedtls_platform_memset( ssl->out_buf, 0, out_buf_len );
Hanno Becker4ccbf062018-08-10 11:20:38 +01009234
9235#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009236 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01009237#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
9238 {
9239 ssl->in_left = 0;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009240 mbedtls_platform_memset( ssl->in_buf, 0, in_buf_len );
Hanno Becker4ccbf062018-08-10 11:20:38 +01009241 }
Paul Bakker05ef8352012-05-08 09:17:57 +00009242
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009243#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
9244 if( mbedtls_ssl_hw_record_reset != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00009245 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009246 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
9247 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
Paul Bakker2770fbd2012-07-03 13:30:23 +00009248 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009249 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
9250 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00009251 }
Paul Bakker05ef8352012-05-08 09:17:57 +00009252 }
9253#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00009254
Paul Bakker48916f92012-09-16 19:57:18 +00009255 if( ssl->transform )
Paul Bakker2770fbd2012-07-03 13:30:23 +00009256 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009257 mbedtls_ssl_transform_free( ssl->transform );
9258 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00009259 ssl->transform = NULL;
Paul Bakker2770fbd2012-07-03 13:30:23 +00009260 }
Paul Bakker48916f92012-09-16 19:57:18 +00009261
Paul Bakkerc0463502013-02-14 11:19:38 +01009262 if( ssl->session )
9263 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009264 mbedtls_ssl_session_free( ssl->session );
9265 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01009266 ssl->session = NULL;
9267 }
9268
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009269#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009270 ssl->alpn_chosen = NULL;
9271#endif
9272
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02009273#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01009274#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009275 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01009276#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009277 {
9278 mbedtls_free( ssl->cli_id );
9279 ssl->cli_id = NULL;
9280 ssl->cli_id_len = 0;
9281 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02009282#endif
9283
Paul Bakker48916f92012-09-16 19:57:18 +00009284 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
9285 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00009286
9287 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00009288}
9289
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02009290/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009291 * Reset an initialized and used SSL context for re-use while retaining
9292 * all application-set variables, function pointers and data.
9293 */
9294int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
9295{
9296 return( ssl_session_reset_int( ssl, 0 ) );
9297}
9298
9299/*
Paul Bakker5121ce52009-01-03 21:22:43 +00009300 * SSL set accessors
9301 */
Hanno Becker2d9623f2019-06-13 12:07:05 +01009302#if !defined(MBEDTLS_SSL_CONF_ENDPOINT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009303void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00009304{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009305 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00009306}
Hanno Becker2d9623f2019-06-13 12:07:05 +01009307#endif /* MBEDTLS_SSL_CONF_ENDPOINT */
Paul Bakker5121ce52009-01-03 21:22:43 +00009308
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009309void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01009310{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009311 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01009312}
9313
Hanno Becker7f376f42019-06-12 16:20:48 +01009314#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
9315 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009316void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009317{
Hanno Becker7f376f42019-06-12 16:20:48 +01009318 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009319}
Hanno Becker7f376f42019-06-12 16:20:48 +01009320#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY && !MBEDTLS_SSL_CONF_ANTI_REPLAY */
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009321
Hanno Beckerde671542019-06-12 16:30:46 +01009322#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
9323 !defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
9324void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf,
9325 unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009326{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009327 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009328}
Hanno Beckerde671542019-06-12 16:30:46 +01009329#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT && !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009331#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01009332
Hanno Becker1841b0a2018-08-24 11:13:57 +01009333void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
9334 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01009335{
9336 ssl->disable_datagram_packing = !allow_packing;
9337}
9338
Hanno Becker1f835fa2019-06-13 10:14:59 +01009339#if !( defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX) && \
9340 defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN) )
Hanno Becker04da1892018-08-14 13:22:10 +01009341void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
9342 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009343{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009344 conf->hs_timeout_min = min;
9345 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009346}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009347#else /* !( MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
9348 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX ) */
9349void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
9350 uint32_t min, uint32_t max )
9351{
9352 ((void) conf);
9353 ((void) min);
9354 ((void) max);
9355}
9356#endif /* MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
9357 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
9358
9359#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009360
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009361void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00009362{
Hanno Beckeracd4fc02019-06-12 16:40:50 +01009363#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
9364 conf->authmode = authmode;
9365#else
9366 ((void) conf);
9367 ((void) authmode);
9368#endif /* MBEDTLS_SSL_CONF_AUTHMODE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009369}
9370
Hanno Becker9ec3fe02019-07-01 17:36:12 +01009371#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
9372 !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009373void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02009374 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009375 void *p_vrfy )
9376{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009377 conf->f_vrfy = f_vrfy;
9378 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009379}
Hanno Becker9ec3fe02019-07-01 17:36:12 +01009380#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009381
Hanno Beckerece325c2019-06-13 15:39:27 +01009382#if !defined(MBEDTLS_SSL_CONF_RNG)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009383void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00009384 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00009385 void *p_rng )
9386{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01009387 conf->f_rng = f_rng;
9388 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00009389}
Hanno Beckerece325c2019-06-13 15:39:27 +01009390#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00009391
Hanno Becker14a4a442019-07-02 17:00:34 +01009392#if defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009393void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02009394 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00009395 void *p_dbg )
9396{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009397 conf->f_dbg = f_dbg;
9398 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00009399}
Hanno Becker14a4a442019-07-02 17:00:34 +01009400#endif /* MBEDTLS_DEBUG_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00009401
Hanno Beckera58a8962019-06-13 16:11:15 +01009402#if !defined(MBEDTLS_SSL_CONF_RECV) && \
9403 !defined(MBEDTLS_SSL_CONF_SEND) && \
9404 !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009405void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009406 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00009407 mbedtls_ssl_send_t *f_send,
9408 mbedtls_ssl_recv_t *f_recv,
9409 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009410{
Hanno Beckera58a8962019-06-13 16:11:15 +01009411 ssl->p_bio = p_bio;
9412 ssl->f_send = f_send;
9413 ssl->f_recv = f_recv;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009414 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009415}
Hanno Beckera58a8962019-06-13 16:11:15 +01009416#else
9417void mbedtls_ssl_set_bio_ctx( mbedtls_ssl_context *ssl,
9418 void *p_bio )
9419{
9420 ssl->p_bio = p_bio;
9421}
9422#endif
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009423
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02009424#if defined(MBEDTLS_SSL_PROTO_DTLS)
9425void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
9426{
9427 ssl->mtu = mtu;
9428}
9429#endif
9430
Hanno Becker1f835fa2019-06-13 10:14:59 +01009431#if !defined(MBEDTLS_SSL_CONF_READ_TIMEOUT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009432void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009433{
9434 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009435}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009436#endif /* MBEDTLS_SSL_CONF_READ_TIMEOUT */
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009437
Hanno Becker0ae6b242019-06-13 16:45:36 +01009438#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && \
9439 !defined(MBEDTLS_SSL_CONF_GET_TIMER)
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009440void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
9441 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00009442 mbedtls_ssl_set_timer_t *f_set_timer,
9443 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009444{
9445 ssl->p_timer = p_timer;
9446 ssl->f_set_timer = f_set_timer;
9447 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009448 /* Make sure we start with no timer running */
9449 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009450}
Hanno Becker0ae6b242019-06-13 16:45:36 +01009451#else
9452void mbedtls_ssl_set_timer_cb_ctx( mbedtls_ssl_context *ssl,
9453 void *p_timer )
9454{
9455 ssl->p_timer = p_timer;
9456 /* Make sure we start with no timer running */
9457 ssl_set_timer( ssl, 0 );
9458}
9459#endif
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009460
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009461#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009462void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009463 void *p_cache,
9464 int (*f_get_cache)(void *, mbedtls_ssl_session *),
9465 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
Paul Bakker5121ce52009-01-03 21:22:43 +00009466{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009467 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009468 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009469 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00009470}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009471#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009472
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009473#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009474int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00009475{
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009476 int ret;
9477
9478 if( ssl == NULL ||
9479 session == NULL ||
9480 ssl->session_negotiate == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +01009481 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009482 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009483 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009484 }
9485
Hanno Becker58fccf22019-02-06 14:30:46 +00009486 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
9487 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009488 return( ret );
9489
Jarno Lamsa8d09e572019-12-19 15:20:19 +02009490 ssl->handshake->resume = MBEDTLS_SSL_FI_FLAG_SET;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009491
9492 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00009493}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009494#endif /* MBEDTLS_SSL_CLI_C && !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009495
Hanno Becker73f4cb12019-06-27 13:51:07 +01009496#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009497void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009498 const int *ciphersuites )
Paul Bakker5121ce52009-01-03 21:22:43 +00009499{
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009500 conf->ciphersuite_list[0] = ciphersuites;
9501 conf->ciphersuite_list[1] = ciphersuites;
9502 conf->ciphersuite_list[2] = ciphersuites;
9503 conf->ciphersuite_list[3] = ciphersuites;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009504}
9505
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009506void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02009507 const int *ciphersuites,
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009508 int major, int minor )
9509{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009510 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009511 return;
9512
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009513 if( mbedtls_ssl_ver_lt( minor, MBEDTLS_SSL_MINOR_VERSION_0 ) ||
9514 mbedtls_ssl_ver_gt( minor, MBEDTLS_SSL_MINOR_VERSION_3 ) )
9515 {
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009516 return;
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009517 }
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009518
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009519 conf->ciphersuite_list[mbedtls_ssl_minor_ver_index( minor )] =
9520 ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00009521}
Hanno Becker73f4cb12019-06-27 13:51:07 +01009522#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009523
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009524#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009525void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01009526 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009527{
9528 conf->cert_profile = profile;
9529}
9530
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009531/* Append a new keycert entry to a (possibly empty) list */
9532static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
9533 mbedtls_x509_crt *cert,
9534 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009535{
niisato8ee24222018-06-25 19:05:48 +09009536 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009537
niisato8ee24222018-06-25 19:05:48 +09009538 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
9539 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009540 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009541
niisato8ee24222018-06-25 19:05:48 +09009542 new_cert->cert = cert;
9543 new_cert->key = key;
9544 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009545
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009546 /* Update head is the list was null, else add to the end */
9547 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01009548 {
niisato8ee24222018-06-25 19:05:48 +09009549 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01009550 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009551 else
9552 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009553 mbedtls_ssl_key_cert *cur = *head;
9554 while( cur->next != NULL )
9555 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09009556 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009557 }
9558
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009559 return( 0 );
9560}
9561
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009562int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009563 mbedtls_x509_crt *own_cert,
9564 mbedtls_pk_context *pk_key )
9565{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02009566 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009567}
9568
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009569void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009570 mbedtls_x509_crt *ca_chain,
9571 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009572{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009573 conf->ca_chain = ca_chain;
9574 conf->ca_crl = ca_crl;
Paul Bakker5121ce52009-01-03 21:22:43 +00009575}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009576#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00009577
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009578#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
9579int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
9580 mbedtls_x509_crt *own_cert,
9581 mbedtls_pk_context *pk_key )
9582{
9583 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
9584 own_cert, pk_key ) );
9585}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02009586
9587void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
9588 mbedtls_x509_crt *ca_chain,
9589 mbedtls_x509_crl *ca_crl )
9590{
9591 ssl->handshake->sni_ca_chain = ca_chain;
9592 ssl->handshake->sni_ca_crl = ca_crl;
9593}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02009594
9595void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
9596 int authmode )
9597{
9598 ssl->handshake->sni_authmode = authmode;
9599}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009600#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9601
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009602#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009603/*
9604 * Set EC J-PAKE password for current handshake
9605 */
9606int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
9607 const unsigned char *pw,
9608 size_t pw_len )
9609{
9610 mbedtls_ecjpake_role role;
9611
Janos Follath8eb64132016-06-03 15:40:57 +01009612 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009613 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9614
Hanno Becker2d9623f2019-06-13 12:07:05 +01009615 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009616 role = MBEDTLS_ECJPAKE_SERVER;
9617 else
9618 role = MBEDTLS_ECJPAKE_CLIENT;
9619
9620 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
9621 role,
9622 MBEDTLS_MD_SHA256,
9623 MBEDTLS_ECP_DP_SECP256R1,
9624 pw, pw_len ) );
9625}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009626#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009627
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009628#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009629int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009630 const unsigned char *psk, size_t psk_len,
9631 const unsigned char *psk_identity, size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009632{
Paul Bakker6db455e2013-09-18 17:29:31 +02009633 if( psk == NULL || psk_identity == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009634 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker6db455e2013-09-18 17:29:31 +02009635
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009636 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9637 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01009638
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009639 /* Identity len will be encoded on two bytes */
9640 if( ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10009641 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009642 {
9643 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9644 }
9645
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009646 if( conf->psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02009647 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009648 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009649
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009650 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009651 conf->psk = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009652 conf->psk_len = 0;
9653 }
9654 if( conf->psk_identity != NULL )
9655 {
9656 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009657 conf->psk_identity = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009658 conf->psk_identity_len = 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02009659 }
9660
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009661 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
9662 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
Mansour Moufidf81088b2015-02-17 13:10:21 -05009663 {
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009664 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009665 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009666 conf->psk = NULL;
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009667 conf->psk_identity = NULL;
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009668 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Mansour Moufidf81088b2015-02-17 13:10:21 -05009669 }
Paul Bakker6db455e2013-09-18 17:29:31 +02009670
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009671 conf->psk_len = psk_len;
9672 conf->psk_identity_len = psk_identity_len;
Paul Bakker6db455e2013-09-18 17:29:31 +02009673
Teppo Järvelin91d79382019-10-02 09:09:31 +03009674 mbedtls_platform_memcpy( conf->psk, psk, conf->psk_len );
9675 mbedtls_platform_memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker6db455e2013-09-18 17:29:31 +02009676
9677 return( 0 );
9678}
9679
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009680int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
9681 const unsigned char *psk, size_t psk_len )
9682{
9683 if( psk == NULL || ssl->handshake == NULL )
9684 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9685
9686 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9687 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9688
9689 if( ssl->handshake->psk != NULL )
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009690 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009691 mbedtls_platform_zeroize( ssl->handshake->psk,
9692 ssl->handshake->psk_len );
Simon Butcher5b8d1d62015-10-04 22:06:51 +01009693 mbedtls_free( ssl->handshake->psk );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009694 ssl->handshake->psk_len = 0;
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009695 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009696
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009697 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009698 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009699
9700 ssl->handshake->psk_len = psk_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03009701 mbedtls_platform_memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009702
9703 return( 0 );
9704}
9705
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009706void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009707 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02009708 size_t),
9709 void *p_psk )
9710{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009711 conf->f_psk = f_psk;
9712 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009713}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009714#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00009715
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009716#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker470a8c42017-10-04 15:28:46 +01009717
9718#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009719int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
Paul Bakker5121ce52009-01-03 21:22:43 +00009720{
9721 int ret;
9722
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009723 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
9724 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
9725 {
9726 mbedtls_mpi_free( &conf->dhm_P );
9727 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker5121ce52009-01-03 21:22:43 +00009728 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009729 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009730
9731 return( 0 );
9732}
Hanno Becker470a8c42017-10-04 15:28:46 +01009733#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker5121ce52009-01-03 21:22:43 +00009734
Hanno Beckera90658f2017-10-04 15:29:08 +01009735int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
9736 const unsigned char *dhm_P, size_t P_len,
9737 const unsigned char *dhm_G, size_t G_len )
9738{
9739 int ret;
9740
9741 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
9742 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
9743 {
9744 mbedtls_mpi_free( &conf->dhm_P );
9745 mbedtls_mpi_free( &conf->dhm_G );
9746 return( ret );
9747 }
9748
9749 return( 0 );
9750}
Paul Bakker5121ce52009-01-03 21:22:43 +00009751
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009752int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00009753{
9754 int ret;
9755
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009756 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
9757 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
9758 {
9759 mbedtls_mpi_free( &conf->dhm_P );
9760 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00009761 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009762 }
Paul Bakker1b57b062011-01-06 15:48:19 +00009763
9764 return( 0 );
9765}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009766#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00009767
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02009768#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
9769/*
9770 * Set the minimum length for Diffie-Hellman parameters
9771 */
9772void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
9773 unsigned int bitlen )
9774{
9775 conf->dhm_min_bitlen = bitlen;
9776}
9777#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
9778
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009779#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009780/*
9781 * Set allowed/preferred hashes for handshake signatures
9782 */
9783void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
9784 const int *hashes )
9785{
Hanno Becker56595f42019-06-19 16:31:38 +01009786#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009787 conf->sig_hashes = hashes;
Hanno Becker56595f42019-06-19 16:31:38 +01009788#else
9789 ((void) conf);
9790 ((void) hashes);
9791#endif /* MBEDTLS_SSL_CONF_SINGLE_SIG_HASH */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009792}
Hanno Becker947194e2017-04-07 13:25:49 +01009793#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009794
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02009795#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +01009796#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009797/*
9798 * Set the allowed elliptic curves
9799 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009800void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009801 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009802{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009803 conf->curve_list = curve_list;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009804}
Hanno Beckerc1096e72019-06-19 12:30:41 +01009805#endif /* MBEDTLS_SSL_CONF_SINGLE_EC */
Hanno Becker947194e2017-04-07 13:25:49 +01009806#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009807
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009808#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009809int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00009810{
Hanno Becker947194e2017-04-07 13:25:49 +01009811 /* Initialize to suppress unnecessary compiler warning */
9812 size_t hostname_len = 0;
9813
9814 /* Check if new hostname is valid before
9815 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01009816 if( hostname != NULL )
9817 {
9818 hostname_len = strlen( hostname );
9819
9820 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
9821 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9822 }
9823
9824 /* Now it's clear that we will overwrite the old hostname,
9825 * so we can free it safely */
9826
9827 if( ssl->hostname != NULL )
9828 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009829 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01009830 mbedtls_free( ssl->hostname );
9831 }
9832
9833 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01009834
Paul Bakker5121ce52009-01-03 21:22:43 +00009835 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01009836 {
9837 ssl->hostname = NULL;
9838 }
9839 else
9840 {
9841 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01009842 if( ssl->hostname == NULL )
9843 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009844
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03009845 /* Not using more secure mbedtls_platform_memcpy as hostname is public in initial handshake */
9846 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009847
Hanno Becker947194e2017-04-07 13:25:49 +01009848 ssl->hostname[hostname_len] = '\0';
9849 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009850
9851 return( 0 );
9852}
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009853#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009854
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009855#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009856void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009857 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00009858 const unsigned char *, size_t),
9859 void *p_sni )
9860{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009861 conf->f_sni = f_sni;
9862 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00009863}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009864#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00009865
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009866#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009867int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009868{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009869 size_t cur_len, tot_len;
9870 const char **p;
9871
9872 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08009873 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
9874 * MUST NOT be truncated."
9875 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009876 */
9877 tot_len = 0;
9878 for( p = protos; *p != NULL; p++ )
9879 {
9880 cur_len = strlen( *p );
9881 tot_len += cur_len;
9882
9883 if( cur_len == 0 || cur_len > 255 || tot_len > 65535 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009884 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009885 }
9886
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009887 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009888
9889 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009890}
9891
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009892const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009893{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02009894 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009895}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009896#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009897
Hanno Becker33b9b252019-07-05 11:23:25 +01009898#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || \
9899 !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
9900void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf,
9901 int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00009902{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009903 conf->max_major_ver = major;
9904 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00009905}
Hanno Becker33b9b252019-07-05 11:23:25 +01009906#endif /* MBEDTLS_SSL_CONF_MAX_MINOR_VER ||
9907 MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
Paul Bakker490ecc82011-10-06 13:04:09 +00009908
Hanno Becker33b9b252019-07-05 11:23:25 +01009909#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || \
9910 !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
9911void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf,
9912 int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00009913{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009914 conf->min_major_ver = major;
9915 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00009916}
Hanno Becker33b9b252019-07-05 11:23:25 +01009917#endif /* MBEDTLS_SSL_CONF_MIN_MINOR_VER ||
9918 MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
Paul Bakker1d29fb52012-09-28 13:28:45 +00009919
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009920#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009921void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009922{
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01009923 conf->fallback = fallback;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009924}
9925#endif
9926
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +01009927#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +01009928void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
9929 char cert_req_ca_list )
9930{
9931 conf->cert_req_ca_list = cert_req_ca_list;
9932}
9933#endif
9934
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009935#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009936void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009937{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009938 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009939}
9940#endif
9941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009942#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckerf765ce62019-06-21 13:17:14 +01009943#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009944void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009945{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009946 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009947}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009948#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
9949#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009950void mbedtls_ssl_conf_extended_master_secret_enforce( mbedtls_ssl_config *conf,
Jarno Lamsa842be162019-06-10 15:05:33 +03009951 char ems_enf )
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009952{
9953 conf->enforce_extended_master_secret = ems_enf;
9954}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009955#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Hanno Beckeraabbb582019-06-11 13:43:27 +01009956#endif /* !MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009957
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009958#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009959void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009960{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009961 conf->arc4_disabled = arc4;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009962}
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009963#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009964
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009965#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009966int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009967{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009968 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10009969 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009970 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009971 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009972 }
9973
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01009974 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009975
9976 return( 0 );
9977}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009978#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009979
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009980#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009981void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009982{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009983 conf->trunc_hmac = truncate;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009984}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009985#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009986
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009987#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009988void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009989{
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01009990 conf->cbc_record_splitting = split;
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009991}
9992#endif
9993
Hanno Beckerb0b2b672019-06-12 16:58:10 +01009994#if !defined(MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009995void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00009996{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009997 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00009998}
Hanno Beckerb0b2b672019-06-12 16:58:10 +01009999#endif /* !MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000010000
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010001#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010002void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +010010003{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010004 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +010010005}
10006
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010007void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020010008{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010009 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020010010}
10011
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010012void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +010010013 const unsigned char period[8] )
10014{
Teppo Järvelin91d79382019-10-02 09:09:31 +030010015 mbedtls_platform_memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +010010016}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010017#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000010018
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010019#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010020#if defined(MBEDTLS_SSL_CLI_C)
10021void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010022{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +010010023 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010024}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010025#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +020010026
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010027#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +020010028void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
10029 mbedtls_ssl_ticket_write_t *f_ticket_write,
10030 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
10031 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +020010032{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +020010033 conf->f_ticket_write = f_ticket_write;
10034 conf->f_ticket_parse = f_ticket_parse;
10035 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +020010036}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010037#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010038#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010039
Robert Cragie4feb7ae2015-10-02 13:33:37 +010010040#if defined(MBEDTLS_SSL_EXPORT_KEYS)
10041void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
10042 mbedtls_ssl_export_keys_t *f_export_keys,
10043 void *p_export_keys )
10044{
10045 conf->f_export_keys = f_export_keys;
10046 conf->p_export_keys = p_export_keys;
10047}
10048#endif
10049
Gilles Peskineb74a1c72018-04-24 13:09:22 +020010050#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010051void mbedtls_ssl_conf_async_private_cb(
10052 mbedtls_ssl_config *conf,
10053 mbedtls_ssl_async_sign_t *f_async_sign,
10054 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
10055 mbedtls_ssl_async_resume_t *f_async_resume,
10056 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010057 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010058{
10059 conf->f_async_sign_start = f_async_sign;
10060 conf->f_async_decrypt_start = f_async_decrypt;
10061 conf->f_async_resume = f_async_resume;
10062 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010063 conf->p_async_config_data = async_config_data;
10064}
10065
Gilles Peskine8f97af72018-04-26 11:46:10 +020010066void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
10067{
10068 return( conf->p_async_config_data );
10069}
10070
Gilles Peskine1febfef2018-04-30 11:54:39 +020010071void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010072{
10073 if( ssl->handshake == NULL )
10074 return( NULL );
10075 else
10076 return( ssl->handshake->user_async_ctx );
10077}
10078
Gilles Peskine1febfef2018-04-30 11:54:39 +020010079void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010080 void *ctx )
10081{
10082 if( ssl->handshake != NULL )
10083 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010084}
Gilles Peskineb74a1c72018-04-24 13:09:22 +020010085#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010086
Paul Bakker5121ce52009-01-03 21:22:43 +000010087/*
10088 * SSL get accessors
10089 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010090size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010091{
10092 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
10093}
10094
Hanno Becker8b170a02017-10-10 11:51:19 +010010095int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
10096{
10097 /*
10098 * Case A: We're currently holding back
10099 * a message for further processing.
10100 */
10101
10102 if( ssl->keep_current_message == 1 )
10103 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010104 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010105 return( 1 );
10106 }
10107
10108 /*
10109 * Case B: Further records are pending in the current datagram.
10110 */
10111
10112#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010113 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker8b170a02017-10-10 11:51:19 +010010114 ssl->in_left > ssl->next_record_offset )
10115 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010116 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010117 return( 1 );
10118 }
10119#endif /* MBEDTLS_SSL_PROTO_DTLS */
10120
10121 /*
10122 * Case C: A handshake message is being processed.
10123 */
10124
Hanno Becker8b170a02017-10-10 11:51:19 +010010125 if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
10126 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010127 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010128 return( 1 );
10129 }
10130
10131 /*
10132 * Case D: An application data message is being processed
10133 */
10134 if( ssl->in_offt != NULL )
10135 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010136 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010137 return( 1 );
10138 }
10139
10140 /*
10141 * In all other cases, the rest of the message can be dropped.
Hanno Beckerc573ac32018-08-28 17:15:25 +010010142 * As in ssl_get_next_record, this needs to be adapted if
Hanno Becker8b170a02017-10-10 11:51:19 +010010143 * we implement support for multiple alerts in single records.
10144 */
10145
10146 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
10147 return( 0 );
10148}
10149
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020010150uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010151{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +000010152 if( ssl->session != NULL )
10153 return( ssl->session->verify_result );
10154
10155 if( ssl->session_negotiate != NULL )
10156 return( ssl->session_negotiate->verify_result );
10157
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +020010158 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +000010159}
10160
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010161const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +000010162{
Hanno Beckere02758c2019-06-26 15:31:31 +010010163 int suite;
10164
Paul Bakker926c8e42013-03-06 10:23:34 +010010165 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010166 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +010010167
Hanno Beckere02758c2019-06-26 15:31:31 +010010168 suite = mbedtls_ssl_session_get_ciphersuite( ssl->session );
10169 return( mbedtls_ssl_get_ciphersuite_name( suite ) );
Paul Bakker72f62662011-01-16 21:27:44 +000010170}
10171
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010172const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +000010173{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010174#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010175 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010176 {
Hanno Becker2881d802019-05-22 14:44:53 +010010177 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010178 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010179 case MBEDTLS_SSL_MINOR_VERSION_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010180 return( "DTLSv1.0" );
10181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010182 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010183 return( "DTLSv1.2" );
10184
10185 default:
10186 return( "unknown (DTLS)" );
10187 }
10188 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010189 MBEDTLS_SSL_TRANSPORT_ELSE
10190#endif /* MBEDTLS_SSL_PROTO_DTLS */
10191#if defined(MBEDTLS_SSL_PROTO_TLS)
Paul Bakker43ca69c2011-01-15 17:35:19 +000010192 {
Hanno Becker2881d802019-05-22 14:44:53 +010010193 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010194 {
10195 case MBEDTLS_SSL_MINOR_VERSION_0:
10196 return( "SSLv3.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010197
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010198 case MBEDTLS_SSL_MINOR_VERSION_1:
10199 return( "TLSv1.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010200
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010201 case MBEDTLS_SSL_MINOR_VERSION_2:
10202 return( "TLSv1.1" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010203
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010204 case MBEDTLS_SSL_MINOR_VERSION_3:
10205 return( "TLSv1.2" );
Paul Bakker1ef83d62012-04-11 12:09:53 +000010206
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010207 default:
10208 return( "unknown" );
10209 }
Paul Bakker43ca69c2011-01-15 17:35:19 +000010210 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010211#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker43ca69c2011-01-15 17:35:19 +000010212}
10213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010214int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010215{
Hanno Becker3136ede2018-08-17 15:28:19 +010010216 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010217 const mbedtls_ssl_transform *transform = ssl->transform_out;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010218
Hanno Becker43395762019-05-03 14:46:38 +010010219 size_t out_hdr_len = mbedtls_ssl_out_hdr_len( ssl );
10220
Hanno Becker78640902018-08-13 16:35:15 +010010221 if( transform == NULL )
Hanno Becker43395762019-05-03 14:46:38 +010010222 return( (int) out_hdr_len );
Hanno Becker78640902018-08-13 16:35:15 +010010223
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010224#if defined(MBEDTLS_ZLIB_SUPPORT)
10225 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
10226 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010227#endif
Andrzej Kurek11750442020-09-17 07:12:06 -040010228#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
10229 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx ) )
10230#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010231 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Andrzej Kurek11750442020-09-17 07:12:06 -040010232#endif
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010233 {
Hanno Beckera9d5c452019-07-25 16:47:12 +010010234#if defined(MBEDTLS_GCM_C) || \
10235 defined(MBEDTLS_CCM_C) || \
10236 defined(MBEDTLS_CHACHAPOLY_C)
10237#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010238 case MBEDTLS_MODE_GCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010239#endif
10240#if defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010241 case MBEDTLS_MODE_CCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010242#endif
10243#if defined(MBEDTLS_CHACHAPOLY_C)
Hanno Becker5b559ac2018-08-03 09:40:07 +010010244 case MBEDTLS_MODE_CHACHAPOLY:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010245#endif
10246 transform_expansion =
10247 transform->ivlen - transform->fixed_ivlen + transform->taglen;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010248 break;
10249
Hanno Beckera9d5c452019-07-25 16:47:12 +010010250#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C ||
10251 MBEDTLS_CHACHAPOLY_C */
10252
10253#if defined(MBEDTLS_CIPHER_MODE_STREAM)
10254 case MBEDTLS_MODE_STREAM:
10255 transform_expansion = transform->maclen;
10256 break;
10257#endif /* MBEDTLS_CIPHER_MODE_STREAM */
10258
10259#if defined(MBEDTLS_CIPHER_MODE_CBC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010260 case MBEDTLS_MODE_CBC:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010261 {
10262 size_t block_size;
Andrzej Kurek11750442020-09-17 07:12:06 -040010263#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
10264 block_size = mbedtls_cipher_get_block_size(
10265 &transform->cipher_ctx );
10266#else
Hanno Becker5b559ac2018-08-03 09:40:07 +010010267 block_size = mbedtls_cipher_get_block_size(
10268 &transform->cipher_ctx_enc );
Andrzej Kurek11750442020-09-17 07:12:06 -040010269#endif
Hanno Becker3136ede2018-08-17 15:28:19 +010010270 /* Expansion due to the addition of the MAC. */
10271 transform_expansion += transform->maclen;
10272
10273 /* Expansion due to the addition of CBC padding;
10274 * Theoretically up to 256 bytes, but we never use
10275 * more than the block size of the underlying cipher. */
10276 transform_expansion += block_size;
10277
10278 /* For TLS 1.1 or higher, an explicit IV is added
10279 * after the record header. */
Hanno Becker5b559ac2018-08-03 09:40:07 +010010280#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010010281 if( mbedtls_ssl_ver_geq(
10282 mbedtls_ssl_get_minor_ver( ssl ),
10283 MBEDTLS_SSL_MINOR_VERSION_2 ) )
10284 {
Hanno Becker3136ede2018-08-17 15:28:19 +010010285 transform_expansion += block_size;
Hanno Becker7bcf2b52019-07-26 09:02:40 +010010286 }
Hanno Becker5b559ac2018-08-03 09:40:07 +010010287#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker3136ede2018-08-17 15:28:19 +010010288
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010289 break;
Hanno Beckera9d5c452019-07-25 16:47:12 +010010290 }
10291#endif /* MBEDTLS_CIPHER_MODE_CBC */
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010292
10293 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020010294 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010295 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010296 }
10297
Hanno Beckera5a2b082019-05-15 14:03:01 +010010298#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckeradd01902019-05-08 15:40:11 +010010299 if( transform->out_cid_len != 0 )
10300 transform_expansion += MBEDTLS_SSL_MAX_CID_EXPANSION;
Hanno Beckera5a2b082019-05-15 14:03:01 +010010301#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckeradd01902019-05-08 15:40:11 +010010302
Hanno Becker43395762019-05-03 14:46:38 +010010303 return( (int)( out_hdr_len + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010304}
10305
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010306#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +020010307size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
10308{
10309 size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
10310 size_t read_mfl;
10311
10312 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
10313 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
10314 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
10315 {
10316 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
10317 }
10318
10319 /* Check if a smaller max length was negotiated */
10320 if( ssl->session_out != NULL )
10321 {
10322 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
10323 if( read_mfl < max_len )
10324 {
10325 max_len = read_mfl;
10326 }
10327 }
10328
10329 // During a handshake, use the value being negotiated
10330 if( ssl->session_negotiate != NULL )
10331 {
10332 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
10333 if( read_mfl < max_len )
10334 {
10335 max_len = read_mfl;
10336 }
10337 }
10338
10339 return( max_len );
10340}
10341
10342size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010343{
10344 size_t max_len;
10345
10346 /*
10347 * Assume mfl_code is correct since it was checked when set
10348 */
Angus Grattond8213d02016-05-25 20:56:48 +100010349 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010350
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +020010351 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010352 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +100010353 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010354 {
Angus Grattond8213d02016-05-25 20:56:48 +100010355 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010356 }
10357
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +020010358 /* During a handshake, use the value being negotiated */
10359 if( ssl->session_negotiate != NULL &&
10360 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
10361 {
10362 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
10363 }
10364
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010365 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010366}
Andrzej Kurekf3844952020-10-16 23:03:01 +020010367
10368#if !defined(MBEDTLS_DEPRECATED_REMOVED)
10369size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
10370{
10371 return mbedtls_ssl_get_output_max_frag_len( ssl );
10372}
10373#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010374#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10375
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010376#if defined(MBEDTLS_SSL_PROTO_DTLS)
10377static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
10378{
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010379 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
Hanno Becker2d9623f2019-06-13 12:07:05 +010010380 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT &&
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010381 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
10382 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010383 return( 0 );
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010384
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010385 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
10386 return( ssl->mtu );
10387
10388 if( ssl->mtu == 0 )
10389 return( ssl->handshake->mtu );
10390
10391 return( ssl->mtu < ssl->handshake->mtu ?
10392 ssl->mtu : ssl->handshake->mtu );
10393}
10394#endif /* MBEDTLS_SSL_PROTO_DTLS */
10395
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010396int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
10397{
10398 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
10399
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +020010400#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
10401 !defined(MBEDTLS_SSL_PROTO_DTLS)
10402 (void) ssl;
10403#endif
10404
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010405#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +020010406 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010407
10408 if( max_len > mfl )
10409 max_len = mfl;
10410#endif
10411
10412#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010413 if( ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010414 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010415 const size_t mtu = ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010416 const int ret = mbedtls_ssl_get_record_expansion( ssl );
10417 const size_t overhead = (size_t) ret;
10418
10419 if( ret < 0 )
10420 return( ret );
10421
10422 if( mtu <= overhead )
10423 {
10424 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
10425 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
10426 }
10427
10428 if( max_len > mtu - overhead )
10429 max_len = mtu - overhead;
10430 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010431#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010432
Hanno Becker0defedb2018-08-10 12:35:02 +010010433#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
10434 !defined(MBEDTLS_SSL_PROTO_DTLS)
10435 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010436#endif
10437
10438 return( (int) max_len );
10439}
10440
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010441#if defined(MBEDTLS_X509_CRT_PARSE_C)
10442const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +000010443{
10444 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010445 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +000010446
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010447#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010448 return( ssl->session->peer_cert );
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010449#else
10450 return( NULL );
10451#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010452}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010453#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010454
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010455#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker933b9fc2019-02-05 11:42:30 +000010456int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
10457 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010458{
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010459 if( ssl == NULL ||
10460 dst == NULL ||
10461 ssl->session == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +010010462 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010463 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010464 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010465 }
10466
Hanno Becker58fccf22019-02-06 14:30:46 +000010467 return( mbedtls_ssl_session_copy( dst, ssl->session ) );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010468}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010469#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010470
Manuel Pégourié-Gonnard37a53242019-05-20 11:12:28 +020010471const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl )
10472{
10473 if( ssl == NULL )
10474 return( NULL );
10475
10476 return( ssl->session );
10477}
10478
Paul Bakker5121ce52009-01-03 21:22:43 +000010479/*
Hanno Beckerb5352f02019-05-16 12:39:07 +010010480 * Define ticket header determining Mbed TLS version
10481 * and structure of the ticket.
10482 */
10483
Hanno Becker41527622019-05-16 12:50:45 +010010484/*
Hanno Becker26829e92019-05-28 14:30:45 +010010485 * Define bitflag determining compile-time settings influencing
10486 * structure of serialized SSL sessions.
Hanno Becker41527622019-05-16 12:50:45 +010010487 */
10488
Hanno Becker26829e92019-05-28 14:30:45 +010010489#if defined(MBEDTLS_HAVE_TIME)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010490#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker26829e92019-05-28 14:30:45 +010010491#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010492#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker41527622019-05-16 12:50:45 +010010493#endif /* MBEDTLS_HAVE_TIME */
10494
10495#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010496#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker41527622019-05-16 12:50:45 +010010497#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010498#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker41527622019-05-16 12:50:45 +010010499#endif /* MBEDTLS_X509_CRT_PARSE_C */
10500
10501#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010502#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker41527622019-05-16 12:50:45 +010010503#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010504#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker41527622019-05-16 12:50:45 +010010505#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
10506
10507#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010508#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker41527622019-05-16 12:50:45 +010010509#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010510#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker41527622019-05-16 12:50:45 +010010511#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10512
10513#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010514#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 1
Hanno Becker41527622019-05-16 12:50:45 +010010515#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010516#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 0
Hanno Becker41527622019-05-16 12:50:45 +010010517#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
10518
10519#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010520#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker41527622019-05-16 12:50:45 +010010521#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010522#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker41527622019-05-16 12:50:45 +010010523#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
10524
Hanno Becker41527622019-05-16 12:50:45 +010010525#if defined(MBEDTLS_SSL_SESSION_TICKETS)
10526#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
10527#else
10528#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
10529#endif /* MBEDTLS_SSL_SESSION_TICKETS */
10530
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010531#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
10532#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 1
10533#else
10534#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 0
10535#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10536
Hanno Becker88440552019-07-03 14:16:13 +010010537#if defined(MBEDTLS_ZLIB_SUPPORT)
10538#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 1
10539#else
10540#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 0
10541#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10542
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010543#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
10544#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
10545#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
10546#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
10547#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT 4
10548#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 5
10549#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 6
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010550#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT 7
Hanno Becker88440552019-07-03 14:16:13 +010010551#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT 8
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010552
Hanno Becker26829e92019-05-28 14:30:45 +010010553#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010554 ( (uint16_t) ( \
10555 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
10556 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
10557 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
10558 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
10559 ( SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC << SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT ) | \
10560 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010561 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) | \
Hanno Becker88440552019-07-03 14:16:13 +010010562 ( SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION << SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010563 ( SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT << SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT ) ) )
Hanno Becker41527622019-05-16 12:50:45 +010010564
Hanno Becker557fe9f2019-05-16 12:41:07 +010010565static unsigned char ssl_serialized_session_header[] = {
Hanno Becker41527622019-05-16 12:50:45 +010010566 MBEDTLS_VERSION_MAJOR,
10567 MBEDTLS_VERSION_MINOR,
10568 MBEDTLS_VERSION_PATCH,
Hanno Becker26829e92019-05-28 14:30:45 +010010569 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
10570 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Hanno Becker557fe9f2019-05-16 12:41:07 +010010571};
Hanno Beckerb5352f02019-05-16 12:39:07 +010010572
10573/*
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010574 * Serialize a session in the following format:
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010575 * (in the presentation language of TLS, RFC 8446 section 3)
10576 *
Hanno Becker26829e92019-05-28 14:30:45 +010010577 * opaque mbedtls_version[3]; // major, minor, patch
10578 * opaque session_format[2]; // version-specific 16-bit field determining
10579 * // the format of the remaining
10580 * // serialized data.
Hanno Beckerb36db4f2019-05-29 11:08:00 +010010581 *
10582 * Note: When updating the format, remember to keep
10583 * these version+format bytes.
10584 *
Hanno Becker7bf77102019-06-04 09:43:16 +010010585 * // In this version, `session_format` determines
10586 * // the setting of those compile-time
10587 * // configuration options which influence
Hanno Becker26829e92019-05-28 14:30:45 +010010588 * // the structure of mbedtls_ssl_session.
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010589 * uint64 start_time;
Hanno Becker26829e92019-05-28 14:30:45 +010010590 * uint8 ciphersuite[2]; // defined by the standard
10591 * uint8 compression; // 0 or 1
10592 * uint8 session_id_len; // at most 32
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010593 * opaque session_id[32];
Hanno Becker26829e92019-05-28 14:30:45 +010010594 * opaque master[48]; // fixed length in the standard
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010595 * uint32 verify_result;
Hanno Becker0528f822019-06-18 12:45:31 +010010596 * select (MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) {
10597 * case enabled: opaque peer_cert<0..2^24-1>; // length 0 means no cert
10598 * case disabled: uint8_t peer_cert_digest_type;
10599 * opaque peer_cert_digest<0..2^8-1>;
10600 * }
Hanno Becker26829e92019-05-28 14:30:45 +010010601 * opaque ticket<0..2^24-1>; // length 0 means no ticket
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010602 * uint32 ticket_lifetime;
Hanno Becker26829e92019-05-28 14:30:45 +010010603 * uint8 mfl_code; // up to 255 according to standard
10604 * uint8 trunc_hmac; // 0 or 1
10605 * uint8 encrypt_then_mac; // 0 or 1
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010606 *
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010607 * The order is the same as in the definition of the structure, except
10608 * verify_result is put before peer_cert so that all mandatory fields come
10609 * together in one block.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010610 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010611static int ssl_session_save( const mbedtls_ssl_session *session,
10612 unsigned char omit_header,
10613 unsigned char *buf,
10614 size_t buf_len,
10615 size_t *olen )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010616{
10617 unsigned char *p = buf;
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010618 size_t used = 0;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010619#if defined(MBEDTLS_HAVE_TIME)
10620 uint64_t start;
10621#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010622#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010623#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010624 size_t cert_len;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010625#endif
Hanno Becker2e6d3472019-02-06 15:40:27 +000010626#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010627
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010628 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010629 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010630 /*
10631 * Add version identifier
10632 */
10633
10634 used += sizeof( ssl_serialized_session_header );
10635
10636 if( used <= buf_len )
10637 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010638 mbedtls_platform_memcpy( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010639 sizeof( ssl_serialized_session_header ) );
10640 p += sizeof( ssl_serialized_session_header );
10641 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010642 }
10643
10644 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010645 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010646 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010647#if defined(MBEDTLS_HAVE_TIME)
10648 used += 8;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010649
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010650 if( used <= buf_len )
10651 {
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010652 start = (uint64_t) session->start;
10653
10654 *p++ = (unsigned char)( ( start >> 56 ) & 0xFF );
10655 *p++ = (unsigned char)( ( start >> 48 ) & 0xFF );
10656 *p++ = (unsigned char)( ( start >> 40 ) & 0xFF );
10657 *p++ = (unsigned char)( ( start >> 32 ) & 0xFF );
10658 *p++ = (unsigned char)( ( start >> 24 ) & 0xFF );
10659 *p++ = (unsigned char)( ( start >> 16 ) & 0xFF );
10660 *p++ = (unsigned char)( ( start >> 8 ) & 0xFF );
10661 *p++ = (unsigned char)( ( start ) & 0xFF );
10662 }
10663#endif /* MBEDTLS_HAVE_TIME */
10664
10665 /*
10666 * Basic mandatory fields
10667 */
Hanno Becker88440552019-07-03 14:16:13 +010010668 {
10669 size_t const ciphersuite_len = 2;
10670#if defined(MBEDTLS_ZLIB_SUPPORT)
10671 size_t const compression_len = 1;
10672#else
10673 size_t const compression_len = 0;
10674#endif
10675 size_t const id_len_len = 1;
10676 size_t const id_len = 32;
10677 size_t const master_len = 48;
10678 size_t const verif_result_len = 4;
10679
10680 size_t const basic_len =
10681 ciphersuite_len +
10682 compression_len +
10683 id_len_len +
10684 id_len +
10685 master_len +
10686 verif_result_len;
10687
10688 used += basic_len;
10689 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010690
10691 if( used <= buf_len )
10692 {
Hanno Beckere02758c2019-06-26 15:31:31 +010010693 const int ciphersuite =
10694 mbedtls_ssl_session_get_ciphersuite( session );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010695 p = mbedtls_platform_put_uint16_be( p, ciphersuite );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010696
Hanno Becker88440552019-07-03 14:16:13 +010010697#if defined(MBEDTLS_ZLIB_SUPPORT)
10698 *p++ = (unsigned char)(
10699 mbedtls_ssl_session_get_compression( session ) );
10700#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010701
10702 *p++ = (unsigned char)( session->id_len & 0xFF );
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010703 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10704 memcpy( p, session->id, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010705 p += 32;
10706
Teppo Järvelin91d79382019-10-02 09:09:31 +030010707 mbedtls_platform_memcpy( p, session->master, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010708 p += 48;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010709 p = mbedtls_platform_put_uint32_be( p, session->verify_result );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010710 }
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010711
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010712 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010713 * Peer's end-entity certificate
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010714 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010715#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010716#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010717 if( session->peer_cert == NULL )
10718 cert_len = 0;
10719 else
10720 cert_len = session->peer_cert->raw.len;
10721
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010722 used += 3 + cert_len;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010723
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010724 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010725 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010726 p = mbedtls_platform_put_uint24_be( p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010727
10728 if( session->peer_cert != NULL )
10729 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010730 mbedtls_platform_memcpy( p, session->peer_cert->raw.p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010731 p += cert_len;
10732 }
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010733 }
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010734
Hanno Becker5882dd02019-06-06 16:25:57 +010010735#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010736 /* Digest of peer certificate */
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010737 if( session->peer_cert_digest != NULL )
10738 {
10739 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
10740 if( used <= buf_len )
10741 {
10742 *p++ = (unsigned char) session->peer_cert_digest_type;
10743 *p++ = (unsigned char) session->peer_cert_digest_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +030010744 mbedtls_platform_memcpy( p, session->peer_cert_digest,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010745 session->peer_cert_digest_len );
10746 p += session->peer_cert_digest_len;
10747 }
10748 }
10749 else
10750 {
10751 used += 2;
10752 if( used <= buf_len )
10753 {
10754 *p++ = (unsigned char) MBEDTLS_MD_NONE;
10755 *p++ = 0;
10756 }
10757 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010758#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010759#endif /* MBEDTLS_X509_CRT_PARSE_C */
10760
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010761 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010762 * Session ticket if any, plus associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010763 */
10764#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010765 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010766
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010767 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010768 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010769 p = mbedtls_platform_put_uint24_be( p, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010770
10771 if( session->ticket != NULL )
10772 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010773 mbedtls_platform_memcpy( p, session->ticket, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010774 p += session->ticket_len;
10775 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010776
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010777 p = mbedtls_platform_put_uint32_be( p, session->ticket_lifetime );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010778 }
10779#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
10780
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010781 /*
10782 * Misc extension-related info
10783 */
10784#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
10785 used += 1;
10786
10787 if( used <= buf_len )
10788 *p++ = session->mfl_code;
10789#endif
10790
10791#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
10792 used += 1;
10793
10794 if( used <= buf_len )
10795 *p++ = (unsigned char)( ( session->trunc_hmac ) & 0xFF );
10796#endif
10797
10798#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
10799 used += 1;
10800
10801 if( used <= buf_len )
10802 *p++ = (unsigned char)( ( session->encrypt_then_mac ) & 0xFF );
10803#endif
10804
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010805 /* Done */
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010806 *olen = used;
10807
10808 if( used > buf_len )
10809 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010810
10811 return( 0 );
10812}
10813
10814/*
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010815 * Public wrapper for ssl_session_save()
10816 */
10817int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
10818 unsigned char *buf,
10819 size_t buf_len,
10820 size_t *olen )
10821{
10822 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
10823}
10824
10825/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020010826 * Deserialize session, see mbedtls_ssl_session_save() for format.
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010827 *
10828 * This internal version is wrapped by a public function that cleans up in
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010829 * case of error, and has an extra option omit_header.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010830 */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010831static int ssl_session_load( mbedtls_ssl_session *session,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010832 unsigned char omit_header,
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010833 const unsigned char *buf,
10834 size_t len )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010835{
10836 const unsigned char *p = buf;
10837 const unsigned char * const end = buf + len;
Hanno Beckere02758c2019-06-26 15:31:31 +010010838 int ciphersuite;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010839#if defined(MBEDTLS_HAVE_TIME)
10840 uint64_t start;
10841#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010842#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010843#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010844 size_t cert_len;
Hanno Becker2e6d3472019-02-06 15:40:27 +000010845#endif
10846#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010847
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010848 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010849 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010850 /*
10851 * Check version identifier
10852 */
10853
10854 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
10855 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10856
Teppo Järvelin0efac532019-10-04 13:21:08 +030010857 // use regular memcmp as session header is public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030010858 if( memcmp( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010859 sizeof( ssl_serialized_session_header ) ) != 0 )
10860 {
10861 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10862 }
10863 p += sizeof( ssl_serialized_session_header );
Hanno Beckerb5352f02019-05-16 12:39:07 +010010864 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010865
10866 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010867 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010868 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010869#if defined(MBEDTLS_HAVE_TIME)
10870 if( 8 > (size_t)( end - p ) )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010871 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10872
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010873 start = ( (uint64_t) p[0] << 56 ) |
10874 ( (uint64_t) p[1] << 48 ) |
10875 ( (uint64_t) p[2] << 40 ) |
10876 ( (uint64_t) p[3] << 32 ) |
10877 ( (uint64_t) p[4] << 24 ) |
10878 ( (uint64_t) p[5] << 16 ) |
10879 ( (uint64_t) p[6] << 8 ) |
10880 ( (uint64_t) p[7] );
10881 p += 8;
10882
10883 session->start = (time_t) start;
10884#endif /* MBEDTLS_HAVE_TIME */
10885
10886 /*
10887 * Basic mandatory fields
10888 */
Hanno Becker88440552019-07-03 14:16:13 +010010889 {
10890 size_t const ciphersuite_len = 2;
10891#if defined(MBEDTLS_ZLIB_SUPPORT)
10892 size_t const compression_len = 1;
10893#else
10894 size_t const compression_len = 0;
10895#endif
10896 size_t const id_len_len = 1;
10897 size_t const id_len = 32;
10898 size_t const master_len = 48;
10899 size_t const verif_result_len = 4;
Hanno Beckere02758c2019-06-26 15:31:31 +010010900
Hanno Becker88440552019-07-03 14:16:13 +010010901 size_t const basic_len =
10902 ciphersuite_len +
10903 compression_len +
10904 id_len_len +
10905 id_len +
10906 master_len +
10907 verif_result_len;
10908
10909 if( basic_len > (size_t)( end - p ) )
10910 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10911 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010912
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010913 ciphersuite = (int)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010914 p += 2;
10915
Hanno Becker73f4cb12019-06-27 13:51:07 +010010916#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Beckere02758c2019-06-26 15:31:31 +010010917 session->ciphersuite = ciphersuite;
10918#else
10919 if( ciphersuite !=
Hanno Becker73f4cb12019-06-27 13:51:07 +010010920 MBEDTLS_SSL_SUITE_ID( MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE ) )
Hanno Beckere02758c2019-06-26 15:31:31 +010010921 {
10922 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10923 }
10924#endif
10925
Hanno Becker88440552019-07-03 14:16:13 +010010926#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010927 session->compression = *p++;
Hanno Becker88440552019-07-03 14:16:13 +010010928#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010929
10930 session->id_len = *p++;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010931 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10932 memcpy( session->id, p, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010933 p += 32;
10934
Teppo Järvelin91d79382019-10-02 09:09:31 +030010935 mbedtls_platform_memcpy( session->master, p, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010936 p += 48;
10937
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010938 session->verify_result = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010939 p += 4;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010940
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010941 /* Immediately clear invalid pointer values that have been read, in case
10942 * we exit early before we replaced them with valid ones. */
10943#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010944#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010945 session->peer_cert = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010946#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010947 session->peer_cert_digest = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010948#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010949#endif
10950#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
10951 session->ticket = NULL;
10952#endif
10953
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010954 /*
10955 * Peer certificate
10956 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010957#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010958#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010959 if( 3 > (size_t)( end - p ) )
10960 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10961
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010962 cert_len = mbedtls_platform_get_uint24_be( &p[0] );
10963
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010964 p += 3;
10965
10966 if( cert_len == 0 )
10967 {
10968 session->peer_cert = NULL;
10969 }
10970 else
10971 {
10972 int ret;
10973
10974 if( cert_len > (size_t)( end - p ) )
10975 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10976
10977 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
10978
10979 if( session->peer_cert == NULL )
10980 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
10981
10982 mbedtls_x509_crt_init( session->peer_cert );
10983
10984 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
10985 p, cert_len ) ) != 0 )
10986 {
10987 mbedtls_x509_crt_free( session->peer_cert );
10988 mbedtls_free( session->peer_cert );
10989 session->peer_cert = NULL;
10990 return( ret );
10991 }
10992
10993 p += cert_len;
10994 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010995#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010996 /* Deserialize CRT digest from the end of the ticket. */
10997 if( 2 > (size_t)( end - p ) )
10998 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10999
11000 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
11001 session->peer_cert_digest_len = (size_t) *p++;
11002
11003 if( session->peer_cert_digest_len != 0 )
11004 {
Hanno Beckera5cedbc2019-07-17 11:21:02 +010011005 mbedtls_md_handle_t md_info =
Hanno Becker2326d202019-06-06 14:54:55 +010011006 mbedtls_md_info_from_type( session->peer_cert_digest_type );
Hanno Beckera5cedbc2019-07-17 11:21:02 +010011007 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Hanno Becker2326d202019-06-06 14:54:55 +010011008 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11009 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
11010 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11011
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011012 if( session->peer_cert_digest_len > (size_t)( end - p ) )
11013 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11014
11015 session->peer_cert_digest =
11016 mbedtls_calloc( 1, session->peer_cert_digest_len );
11017 if( session->peer_cert_digest == NULL )
11018 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
11019
Teppo Järvelin91d79382019-10-02 09:09:31 +030011020 mbedtls_platform_memcpy( session->peer_cert_digest, p,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011021 session->peer_cert_digest_len );
11022 p += session->peer_cert_digest_len;
11023 }
Hanno Becker5882dd02019-06-06 16:25:57 +010011024#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020011025#endif /* MBEDTLS_X509_CRT_PARSE_C */
11026
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011027 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011028 * Session ticket and associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011029 */
11030#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
11031 if( 3 > (size_t)( end - p ) )
11032 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11033
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030011034 session->ticket_len = mbedtls_platform_get_uint24_be( &p[0] );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011035 p += 3;
11036
11037 if( session->ticket_len != 0 )
11038 {
11039 if( session->ticket_len > (size_t)( end - p ) )
11040 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11041
11042 session->ticket = mbedtls_calloc( 1, session->ticket_len );
11043 if( session->ticket == NULL )
11044 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
11045
Teppo Järvelin91d79382019-10-02 09:09:31 +030011046 mbedtls_platform_memcpy( session->ticket, p, session->ticket_len );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011047 p += session->ticket_len;
11048 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011049
11050 if( 4 > (size_t)( end - p ) )
11051 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11052
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030011053 session->ticket_lifetime = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011054 p += 4;
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011055#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
11056
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011057 /*
11058 * Misc extension-related info
11059 */
11060#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
11061 if( 1 > (size_t)( end - p ) )
11062 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11063
11064 session->mfl_code = *p++;
11065#endif
11066
11067#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
11068 if( 1 > (size_t)( end - p ) )
11069 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11070
11071 session->trunc_hmac = *p++;
11072#endif
11073
11074#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
11075 if( 1 > (size_t)( end - p ) )
11076 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11077
11078 session->encrypt_then_mac = *p++;
11079#endif
11080
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011081 /* Done, should have consumed entire buffer */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020011082 if( p != end )
11083 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11084
11085 return( 0 );
11086}
11087
11088/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020011089 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020011090 */
11091int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
11092 const unsigned char *buf,
11093 size_t len )
11094{
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011095 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020011096
11097 if( ret != 0 )
11098 mbedtls_ssl_session_free( session );
11099
11100 return( ret );
11101}
11102
11103/*
Paul Bakker1961b702013-01-25 14:49:24 +010011104 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +000011105 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011106int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011107{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011108 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker5121ce52009-01-03 21:22:43 +000011109
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011110 if( ssl == NULL || ssl->conf == NULL )
11111 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11112
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011113#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011114 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011115 ret = mbedtls_ssl_handshake_client_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000011116#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011117#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011118 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011119 ret = mbedtls_ssl_handshake_server_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000011120#endif
11121
Hanno Beckerb82350b2019-07-26 07:24:05 +010011122 ssl_send_pending_fatal_alert( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010011123 return( ret );
11124}
11125
11126/*
11127 * Perform the SSL handshake
11128 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011129int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +010011130{
11131 int ret = 0;
11132
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011133 if( ssl == NULL || ssl->conf == NULL )
11134 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11135
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011136 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +010011137
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011138 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +010011139 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011140 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010011141
11142 if( ret != 0 )
11143 break;
11144 }
11145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011146 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011147
11148 return( ret );
11149}
11150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011151#if defined(MBEDTLS_SSL_RENEGOTIATION)
11152#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000011153/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011154 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +000011155 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011156static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011157{
11158 int ret;
11159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011160 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011161
11162 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011163 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
11164 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011165
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020011166 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011167 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020011168 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011169 return( ret );
11170 }
11171
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011172 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011173
11174 return( 0 );
11175}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011176#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011177
11178/*
11179 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011180 * - any side: calling mbedtls_ssl_renegotiate(),
11181 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
11182 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +020011183 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011184 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011185 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011186 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011187static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011188{
11189 int ret;
11190
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011191 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011192
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011193 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
11194 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011195
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011196 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
11197 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011198#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011199 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011200 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011201 {
Hanno Becker2d9623f2019-06-13 12:07:05 +010011202 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11203 MBEDTLS_SSL_IS_SERVER )
11204 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011205 ssl->handshake->out_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010011206 }
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011207 else
Hanno Becker2d9623f2019-06-13 12:07:05 +010011208 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011209 ssl->handshake->in_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010011210 }
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011211 }
11212#endif
11213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011214 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
11215 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +000011216
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011217 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011218 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011219 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011220 return( ret );
11221 }
11222
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011223 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011224
11225 return( 0 );
11226}
11227
11228/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011229 * Renegotiate current connection on client,
11230 * or request renegotiation on server
11231 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011232int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011233{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011234 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011235
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011236 if( ssl == NULL || ssl->conf == NULL )
11237 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11238
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011239#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011240 /* On server, just send the request */
Hanno Becker2d9623f2019-06-13 12:07:05 +010011241 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011242 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011243 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
11244 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011245
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011246 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020011247
11248 /* Did we already try/start sending HelloRequest? */
11249 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011250 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020011251
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011252 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011253 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011254#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011256#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011257 /*
11258 * On client, either start the renegotiation process or,
11259 * if already in progress, continue the handshake
11260 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011261 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011262 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011263 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
11264 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011265
11266 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
11267 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011268 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011269 return( ret );
11270 }
11271 }
11272 else
11273 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011274 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011275 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011276 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011277 return( ret );
11278 }
11279 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011280#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011281
Paul Bakker37ce0ff2013-10-31 14:32:04 +010011282 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011283}
11284
11285/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011286 * Check record counters and renegotiate if they're above the limit.
11287 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011288static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011289{
Andres AG2196c7f2016-12-15 17:01:16 +000011290 size_t ep_len = ssl_ep_len( ssl );
11291 int in_ctr_cmp;
11292 int out_ctr_cmp;
11293
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011294 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
11295 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020011296 ! mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011297 {
11298 return( 0 );
11299 }
11300
Teppo Järvelin0efac532019-10-04 13:21:08 +030011301 // use regular memcmp as counters are public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030011302 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000011303 ssl->conf->renego_period + ep_len, 8 - ep_len );
Teppo Järvelin650343c2019-10-03 15:36:59 +030011304 out_ctr_cmp = memcmp( ssl->cur_out_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000011305 ssl->conf->renego_period + ep_len, 8 - ep_len );
11306
11307 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011308 {
11309 return( 0 );
11310 }
11311
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020011312 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011313 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011314}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011315#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000011316
11317/*
11318 * Receive application data decrypted from the SSL layer
11319 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011320int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011321{
Hanno Becker4a810fb2017-05-24 16:27:30 +010011322 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +000011323 size_t n;
Andrzej Kurek84bde412020-07-06 15:27:34 -040011324 volatile unsigned char *buf_dup = buf;
11325 volatile size_t len_dup = len;
Paul Bakker5121ce52009-01-03 21:22:43 +000011326
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011327 if( ssl == NULL || ssl->conf == NULL )
11328 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11329
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011330 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011331
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011332#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011333 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011334 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011335 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011336 return( ret );
11337
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011338 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011339 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011340 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +020011341 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011342 return( ret );
11343 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011344 }
11345#endif
11346
Hanno Becker4a810fb2017-05-24 16:27:30 +010011347 /*
11348 * Check if renegotiation is necessary and/or handshake is
11349 * in process. If yes, perform/continue, and fall through
11350 * if an unexpected packet is received while the client
11351 * is waiting for the ServerHello.
11352 *
11353 * (There is no equivalent to the last condition on
11354 * the server-side as it is not treated as within
11355 * a handshake while waiting for the ClientHello
11356 * after a renegotiation request.)
11357 */
11358
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011359#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011360 ret = ssl_check_ctr_renegotiate( ssl );
11361 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11362 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011363 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011364 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011365 return( ret );
11366 }
11367#endif
11368
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011369 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011370 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011371 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +010011372 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11373 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011374 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011375 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011376 return( ret );
11377 }
11378 }
11379
Hanno Beckere41158b2017-10-23 13:30:32 +010011380 /* Loop as long as no application data record is available */
Hanno Becker90333da2017-10-10 11:27:13 +010011381 while( ssl->in_offt == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000011382 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011383 /* Start timer if not already running */
Hanno Becker0ae6b242019-06-13 16:45:36 +010011384 if( mbedtls_ssl_get_get_timer( ssl ) != NULL &&
11385 mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == -1 )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020011386 {
Hanno Becker1f835fa2019-06-13 10:14:59 +010011387 ssl_set_timer( ssl,
11388 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020011389 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011390
Hanno Becker327c93b2018-08-15 13:56:18 +010011391 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011392 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011393 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
11394 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +000011395
Hanno Becker4a810fb2017-05-24 16:27:30 +010011396 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
11397 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011398 }
11399
11400 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011401 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011402 {
11403 /*
11404 * OpenSSL sends empty messages to randomize the IV
11405 */
Hanno Becker327c93b2018-08-15 13:56:18 +010011406 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011407 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011408 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +000011409 return( 0 );
11410
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011411 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011412 return( ret );
11413 }
11414 }
11415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011416 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +000011417 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011418 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011419
Hanno Becker4a810fb2017-05-24 16:27:30 +010011420 /*
11421 * - For client-side, expect SERVER_HELLO_REQUEST.
11422 * - For server-side, expect CLIENT_HELLO.
11423 * - Fail (TLS) or silently drop record (DTLS) in other cases.
11424 */
11425
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011426#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011427 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11428 MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011429 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
Hanno Becker4a810fb2017-05-24 16:27:30 +010011430 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
Paul Bakker48916f92012-09-16 19:57:18 +000011431 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011432 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011433
11434 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011435#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011436 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011437 {
11438 continue;
11439 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011440 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011441#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011442#if defined(MBEDTLS_SSL_PROTO_TLS)
11443 {
11444 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11445 }
11446#endif
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011447 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011448#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011449
Hanno Becker4a810fb2017-05-24 16:27:30 +010011450#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011451 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11452 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011453 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011454 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011455 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011456
11457 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011458#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011459 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011460 {
11461 continue;
11462 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011463 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011464#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011465#if defined(MBEDTLS_SSL_PROTO_TLS)
11466 {
11467 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11468 }
11469#endif
Paul Bakker48916f92012-09-16 19:57:18 +000011470 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011471#endif /* MBEDTLS_SSL_SRV_C */
11472
Hanno Becker21df7f92017-10-17 11:03:26 +010011473#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011474 /* Determine whether renegotiation attempt should be accepted */
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011475 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
11476 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +010011477 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011478 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
11479 {
11480 /*
11481 * Accept renegotiation request
11482 */
Paul Bakker48916f92012-09-16 19:57:18 +000011483
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011484 /* DTLS clients need to know renego is server-initiated */
11485#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011486 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker2d9623f2019-06-13 12:07:05 +010011487 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11488 MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011489 {
11490 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
11491 }
11492#endif
11493 ret = ssl_start_renegotiation( ssl );
11494 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11495 ret != 0 )
11496 {
11497 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
11498 return( ret );
11499 }
11500 }
11501 else
Hanno Becker21df7f92017-10-17 11:03:26 +010011502#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000011503 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011504 /*
11505 * Refuse renegotiation
11506 */
11507
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011508 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011510#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +010011511 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011512 {
Gilles Peskine92e44262017-05-10 17:27:49 +020011513 /* SSLv3 does not have a "no_renegotiation" warning, so
11514 we send a fatal alert and abort the connection. */
11515 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
11516 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
11517 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011518 }
11519 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011520#endif /* MBEDTLS_SSL_PROTO_SSL3 */
11521#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
11522 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011523 if( mbedtls_ssl_ver_geq(
11524 mbedtls_ssl_get_minor_ver( ssl ),
11525 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011526 {
Hanno Becker2e8d1332019-07-25 10:27:36 +010011527 ret = mbedtls_ssl_send_alert_message( ssl,
11528 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11529 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION );
11530 if( ret != 0 )
11531 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011532 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +020011533 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011534#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
11535 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +020011536 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011537 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
11538 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +020011539 }
Paul Bakker48916f92012-09-16 19:57:18 +000011540 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011541
Hanno Becker90333da2017-10-10 11:27:13 +010011542 /* At this point, we don't know whether the renegotiation has been
11543 * completed or not. The cases to consider are the following:
11544 * 1) The renegotiation is complete. In this case, no new record
11545 * has been read yet.
11546 * 2) The renegotiation is incomplete because the client received
11547 * an application data record while awaiting the ServerHello.
11548 * 3) The renegotiation is incomplete because the client received
11549 * a non-handshake, non-application data message while awaiting
11550 * the ServerHello.
11551 * In each of these case, looping will be the proper action:
11552 * - For 1), the next iteration will read a new record and check
11553 * if it's application data.
11554 * - For 2), the loop condition isn't satisfied as application data
11555 * is present, hence continue is the same as break
11556 * - For 3), the loop condition is satisfied and read_record
11557 * will re-deliver the message that was held back by the client
11558 * when expecting the ServerHello.
11559 */
11560 continue;
Paul Bakker48916f92012-09-16 19:57:18 +000011561 }
Hanno Becker21df7f92017-10-17 11:03:26 +010011562#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011563 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011564 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011565 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011566 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011567 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011568 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011569 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011570 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011571 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011572 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011573 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011574 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011575#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011576
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011577 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
11578 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011579 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011580 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +010011581 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011582 }
11583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011584 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011585 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011586 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
11587 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +000011588 }
11589
11590 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011591
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011592 /* We're going to return something now, cancel timer,
11593 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011594 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011595 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011596
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020011597#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011598 /* If we requested renego but received AppData, resend HelloRequest.
11599 * Do it now, after setting in_offt, to avoid taking this branch
11600 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011601#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011602 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11603 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011604 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011605 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011606 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011607 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011608 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011609 return( ret );
11610 }
11611 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011612#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +010011613#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +000011614 }
11615
11616 n = ( len < ssl->in_msglen )
11617 ? len : ssl->in_msglen;
11618
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011619 if( mbedtls_platform_memcpy( buf, ssl->in_offt, n ) !=
11620 buf )
11621 {
11622 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11623 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011624 ssl->in_msglen -= n;
11625
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011626 // clear incoming data after it's copied to buffer
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011627 if( mbedtls_platform_memset( ssl->in_offt, 0, n ) !=
11628 ssl->in_offt )
11629 {
11630 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11631 }
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011632
Paul Bakker5121ce52009-01-03 21:22:43 +000011633 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +010011634 {
11635 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +000011636 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +010011637 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011638 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011639 else
Hanno Becker4a810fb2017-05-24 16:27:30 +010011640 {
Paul Bakker5121ce52009-01-03 21:22:43 +000011641 /* more data available */
11642 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011643 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011644
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011645 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011646
Andrzej Kurek84bde412020-07-06 15:27:34 -040011647 /* Secure against buffer substitution */
11648 if( buf_dup == buf && len_dup == len )
11649 {
11650 return( (int) n );
11651 }
11652 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +000011653}
11654
11655/*
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011656 * Send application data to be encrypted by the SSL layer, taking care of max
11657 * fragment length and buffer size.
11658 *
11659 * According to RFC 5246 Section 6.2.1:
11660 *
11661 * Zero-length fragments of Application data MAY be sent as they are
11662 * potentially useful as a traffic analysis countermeasure.
11663 *
11664 * Therefore, it is possible that the input message length is 0 and the
11665 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +000011666 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011667static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011668 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011669{
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020011670 int ret = mbedtls_ssl_get_max_out_record_payload( ssl );
11671 const size_t max_len = (size_t) ret;
11672
11673 if( ret < 0 )
11674 {
11675 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
11676 return( ret );
11677 }
11678
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011679 if( len > max_len )
11680 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011681#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011682 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011683 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011684 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011685 "maximum fragment length: %d > %d",
11686 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011687 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011688 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011689 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011690#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011691#if defined(MBEDTLS_SSL_PROTO_TLS)
11692 {
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011693 len = max_len;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011694 }
11695#endif
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011696 }
Paul Bakker887bd502011-06-08 13:10:54 +000011697
Paul Bakker5121ce52009-01-03 21:22:43 +000011698 if( ssl->out_left != 0 )
11699 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011700 /*
11701 * The user has previously tried to send the data and
11702 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
11703 * written. In this case, we expect the high-level write function
11704 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
11705 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011706 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011707 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011708 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011709 return( ret );
11710 }
11711 }
Paul Bakker887bd502011-06-08 13:10:54 +000011712 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +000011713 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011714 /*
11715 * The user is trying to send a message the first time, so we need to
11716 * copy the data into the internal buffers and setup the data structure
11717 * to keep track of partial writes
11718 */
shelib014062d6c2020-07-21 11:54:52 +030011719 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011720 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011721 if( mbedtls_platform_memcpy( ssl->out_msg, buf, len ) != ssl->out_msg )
11722 {
11723 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11724 }
Paul Bakker887bd502011-06-08 13:10:54 +000011725
shelib014062d6c2020-07-21 11:54:52 +030011726#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011727 /*
11728 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11729 * After splitting pointers and data size will not be the same as initaly provides by user.
11730 */
shelib014062d6c2020-07-21 11:54:52 +030011731 /* Secure against buffer substitution */
Shelly Liberman3799fc12020-08-05 15:52:58 +030011732 if( buf == ssl->out_msg_dup &&
shelib014062d6c2020-07-21 11:54:52 +030011733 ssl->out_msglen == ssl->out_msglen_dup &&
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011734 ssl->out_msg_dup[0] == ssl->out_msg[0] )
shelib014062d6c2020-07-21 11:54:52 +030011735 {/*write record only if data was copied from correct user pointer */
11736#endif
Shelly Liberman3799fc12020-08-05 15:52:58 +030011737 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
shelib014062d6c2020-07-21 11:54:52 +030011738 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011739 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
11740 return( ret );
shelib014062d6c2020-07-21 11:54:52 +030011741 }
11742
11743#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Paul Bakker887bd502011-06-08 13:10:54 +000011744 }
shelib014062d6c2020-07-21 11:54:52 +030011745 else
11746 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011747 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011748 }
11749#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000011750 }
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011751 if ( ret == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -040011752 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011753 return( (int) len );
Andrzej Kurek84bde412020-07-06 15:27:34 -040011754 }
shelib014062d6c2020-07-21 11:54:52 +030011755 else
11756 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011757 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011758 }
11759
Paul Bakker5121ce52009-01-03 21:22:43 +000011760}
11761
11762/*
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011763 * Write application data, doing 1/n-1 splitting if necessary.
11764 *
11765 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011766 * then the caller will call us again with the same arguments, so
Hanno Becker2b187c42017-09-18 14:58:11 +010011767 * remember whether we already did the split or not.
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011768 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011769#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011770static int ssl_write_split( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011771 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011772{
11773 int ret;
11774
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010011775 if( ssl->conf->cbc_record_splitting ==
11776 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011777 len <= 1 ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011778 mbedtls_ssl_ver_gt(
11779 mbedtls_ssl_get_minor_ver( ssl ),
11780 MBEDTLS_SSL_MINOR_VERSION_1 ) ||
Andrzej Kurek11750442020-09-17 07:12:06 -040011781#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
11782 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx )
11783 != MBEDTLS_MODE_CBC )
11784#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011785 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
11786 != MBEDTLS_MODE_CBC )
Andrzej Kurek11750442020-09-17 07:12:06 -040011787#endif
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011788 {
11789 return( ssl_write_real( ssl, buf, len ) );
11790 }
11791
11792 if( ssl->split_done == 0 )
11793 {
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011794 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011795 return( ret );
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011796 ssl->split_done = 1;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011797 }
11798
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011799 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
11800 return( ret );
11801 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011802
11803 return( ret + 1 );
11804}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011805#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011806
11807/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011808 * Write application data (public-facing wrapper)
11809 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011810int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011811{
shelib014062d6c2020-07-21 11:54:52 +030011812 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
11813#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011814 /*
11815 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11816 * After splitting pointers and data size will not be the same as initaly provides by user.
11817 */
Andrzej Kurek84bde412020-07-06 15:27:34 -040011818 volatile const unsigned char *buf_dup = buf;
11819 volatile size_t len_dup = len;
shelib014062d6c2020-07-21 11:54:52 +030011820#endif
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011821 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011822
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011823 if( ssl == NULL || ssl->conf == NULL )
11824 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11825
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011826#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011827 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
11828 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011829 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011830 return( ret );
11831 }
11832#endif
11833
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011834 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011835 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011836 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011837 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +020011838 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011839 return( ret );
11840 }
11841 }
11842
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011843#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011844 ret = ssl_write_split( ssl, buf, len );
11845#else
shelib014062d6c2020-07-21 11:54:52 +030011846#if defined(MBEDTLS_FI_COUNTERMEASURES)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011847 /* Add const user pointers to context. We will be able to check its validity before copy to context */
shelib014062d6c2020-07-21 11:54:52 +030011848 ssl->out_msg_dup = (unsigned char*)buf_dup;
11849 ssl->out_msglen_dup = len_dup;
11850#endif //MBEDTLS_FI_COUNTERMEASURES
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011851 ret = ssl_write_real( ssl, buf, len );
11852#endif
11853
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011854 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011855
shelib014062d6c2020-07-21 11:54:52 +030011856
11857 return( ret );
11858
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011859}
11860
11861/*
Paul Bakker5121ce52009-01-03 21:22:43 +000011862 * Notify the peer that the connection is being closed
11863 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011864int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011865{
11866 int ret;
11867
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011868 if( ssl == NULL || ssl->conf == NULL )
11869 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11870
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011871 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011872
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011873 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011874 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011875
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011876 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011877 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011878 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
11879 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11880 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011881 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011882 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011883 return( ret );
11884 }
11885 }
11886
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011887 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011888
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011889 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +000011890}
11891
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011892void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +000011893{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011894 if( transform == NULL )
11895 return;
11896
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011897#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +000011898 deflateEnd( &transform->ctx_deflate );
11899 inflateEnd( &transform->ctx_inflate );
11900#endif
Andrzej Kurek11750442020-09-17 07:12:06 -040011901#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
11902 mbedtls_cipher_free( &transform->cipher_ctx );
11903 if( transform->key_dec != NULL )
11904 mbedtls_free( transform->key_dec );
11905 if( transform->key_enc != NULL )
11906 mbedtls_free( transform->key_enc );
11907#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011908 mbedtls_cipher_free( &transform->cipher_ctx_enc );
11909 mbedtls_cipher_free( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -040011910#endif
Hanno Becker92231322018-01-03 15:32:51 +000011911#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011912 mbedtls_md_free( &transform->md_ctx_enc );
11913 mbedtls_md_free( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +000011914#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020011915
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050011916 mbedtls_platform_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011917}
11918
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011919#if defined(MBEDTLS_X509_CRT_PARSE_C)
11920static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011921{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011922 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011923
11924 while( cur != NULL )
11925 {
11926 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011927 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011928 cur = next;
11929 }
11930}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011931#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011932
Hanno Becker0271f962018-08-16 13:23:47 +010011933#if defined(MBEDTLS_SSL_PROTO_DTLS)
11934
11935static void ssl_buffering_free( mbedtls_ssl_context *ssl )
11936{
11937 unsigned offset;
11938 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11939
11940 if( hs == NULL )
11941 return;
11942
Hanno Becker283f5ef2018-08-24 09:34:47 +010011943 ssl_free_buffered_record( ssl );
11944
Hanno Becker0271f962018-08-16 13:23:47 +010011945 for( offset = 0; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
Hanno Beckere605b192018-08-21 15:59:07 +010011946 ssl_buffering_free_slot( ssl, offset );
11947}
11948
11949static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
11950 uint8_t slot )
11951{
11952 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11953 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot];
Hanno Beckerb309b922018-08-23 13:18:05 +010011954
11955 if( slot >= MBEDTLS_SSL_MAX_BUFFERED_HS )
11956 return;
11957
Hanno Beckere605b192018-08-21 15:59:07 +010011958 if( hs_buf->is_valid == 1 )
Hanno Becker0271f962018-08-16 13:23:47 +010011959 {
Hanno Beckere605b192018-08-21 15:59:07 +010011960 hs->buffering.total_bytes_buffered -= hs_buf->data_len;
Hanno Becker805f2e12018-10-12 16:31:41 +010011961 mbedtls_platform_zeroize( hs_buf->data, hs_buf->data_len );
Hanno Beckere605b192018-08-21 15:59:07 +010011962 mbedtls_free( hs_buf->data );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020011963 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Hanno Becker0271f962018-08-16 13:23:47 +010011964 }
11965}
11966
11967#endif /* MBEDTLS_SSL_PROTO_DTLS */
11968
Gilles Peskine9b562d52018-04-25 20:32:43 +020011969void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011970{
Gilles Peskine9b562d52018-04-25 20:32:43 +020011971 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
11972
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011973 if( handshake == NULL )
11974 return;
11975
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011976#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
11977 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
11978 {
Gilles Peskine8f97af72018-04-26 11:46:10 +020011979 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011980 handshake->async_in_progress = 0;
11981 }
11982#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
11983
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +020011984#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
11985 defined(MBEDTLS_SSL_PROTO_TLS1_1)
11986 mbedtls_md5_free( &handshake->fin_md5 );
11987 mbedtls_sha1_free( &handshake->fin_sha1 );
11988#endif
11989#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
11990#if defined(MBEDTLS_SHA256_C)
11991 mbedtls_sha256_free( &handshake->fin_sha256 );
11992#endif
11993#if defined(MBEDTLS_SHA512_C)
11994 mbedtls_sha512_free( &handshake->fin_sha512 );
11995#endif
11996#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
11997
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011998#if defined(MBEDTLS_DHM_C)
11999 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +000012000#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012001#if defined(MBEDTLS_ECDH_C)
12002 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +020012003#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +020012004#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020012005 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +020012006#if defined(MBEDTLS_SSL_CLI_C)
12007 mbedtls_free( handshake->ecjpake_cache );
12008 handshake->ecjpake_cache = NULL;
12009 handshake->ecjpake_cache_len = 0;
12010#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020012011#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020012012
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010012013#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
12014 if( handshake->psk != NULL )
12015 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012016 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010012017 mbedtls_free( handshake->psk );
12018 }
12019#endif
12020
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012021#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
12022 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012023 /*
12024 * Free only the linked list wrapper, not the keys themselves
12025 * since the belong to the SNI callback
12026 */
12027 if( handshake->sni_key_cert != NULL )
12028 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012029 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012030
12031 while( cur != NULL )
12032 {
12033 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012034 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012035 cur = next;
12036 }
12037 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012038#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020012039
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020012040#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +020012041 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Beckere4aeb762019-02-05 17:19:52 +000012042 if( handshake->ecrs_peer_cert != NULL )
12043 {
12044 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
12045 mbedtls_free( handshake->ecrs_peer_cert );
12046 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020012047#endif
12048
Hanno Becker3bf8cdf2019-02-06 16:18:31 +000012049#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
12050 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
12051 mbedtls_pk_free( &handshake->peer_pubkey );
12052#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
12053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012054#if defined(MBEDTLS_SSL_PROTO_DTLS)
12055 mbedtls_free( handshake->verify_cookie );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +020012056 ssl_flight_free( handshake->flight );
Hanno Becker0271f962018-08-16 13:23:47 +010012057 ssl_buffering_free( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +020012058#endif
12059
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012060 mbedtls_platform_zeroize( handshake,
12061 sizeof( mbedtls_ssl_handshake_params ) );
Andrzej Kurekf3844952020-10-16 23:03:01 +020012062
12063#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12064 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
12065 * processes datagrams and the fact that a datagram is allowed to have
12066 * several records in it, it is possible that the I/O buffers are not
12067 * empty at this stage */
12068 {
12069 int modified = 0;
12070 uint32_t buf_len = mbedtls_ssl_get_input_buflen( ssl );
12071 size_t written_in = 0, len_offset_in = 0;
12072 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
12073 if( ssl->in_buf != NULL )
12074 {
12075 written_in = ssl->in_msg - ssl->in_buf;
12076 len_offset_in = ssl->in_len - ssl->in_buf;
12077 if( ssl->in_buf_len > buf_len && ssl->in_left < buf_len )
12078 {
12079 if( resize_buffer( &ssl->in_buf, buf_len, &ssl->in_buf_len ) != 0 )
12080 {
12081 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
12082 }
12083 else
12084 {
12085 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %d", buf_len ) );
12086 modified = 1;
12087 }
12088 }
12089 }
12090
12091
12092 buf_len = mbedtls_ssl_get_output_buflen( ssl );
12093 if( ssl->out_buf != NULL )
12094 {
12095 written_out = ssl->out_msg - ssl->out_buf;
12096 iv_offset_out = ssl->out_iv - ssl->out_buf;
12097 len_offset_out = ssl->out_len - ssl->out_buf;
12098 if( ssl->out_buf_len > mbedtls_ssl_get_output_buflen( ssl ) &&
12099 ssl->out_left < buf_len )
12100 {
12101 if( resize_buffer( &ssl->out_buf, buf_len, &ssl->out_buf_len ) != 0 )
12102 {
12103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
12104 }
12105 else
12106 {
12107 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %d", buf_len ) );
12108 modified = 1;
12109 }
12110 }
12111 }
12112 if( modified )
12113 {
12114 /* Update pointers here to avoid doing it twice. */
12115 ssl_reset_in_out_pointers( ssl );
12116 /* Fields below might not be properly updated with record
12117 * splitting or with CID, so they are manually updated here. */
12118 ssl->out_msg = ssl->out_buf + written_out;
12119 ssl->out_len = ssl->out_buf + len_offset_out;
12120 ssl->out_iv = ssl->out_buf + iv_offset_out;
12121
12122 ssl->in_msg = ssl->in_buf + written_in;
12123 ssl->in_len = ssl->in_buf + len_offset_in;
12124 }
12125 }
12126#endif
Paul Bakker48916f92012-09-16 19:57:18 +000012127}
12128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012129void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +000012130{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012131 if( session == NULL )
12132 return;
12133
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012134#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker22141592019-02-05 12:38:15 +000012135 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +020012136#endif
Paul Bakker0a597072012-09-25 21:55:46 +000012137
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020012138#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012139 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +020012140#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +020012141
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012142 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +000012143}
12144
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012145#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012146
12147#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12148#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
12149#else
12150#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
12151#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12152
12153#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12154#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
12155#else
12156#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 0u
12157#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12158
12159#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12160#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
12161#else
12162#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
12163#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12164
12165#if defined(MBEDTLS_SSL_ALPN)
12166#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
12167#else
12168#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
12169#endif /* MBEDTLS_SSL_ALPN */
12170
12171#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
12172#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
12173#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
12174#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
12175
12176#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
12177 ( (uint32_t) ( \
12178 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
12179 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
12180 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
12181 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
12182 0u ) )
12183
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012184static unsigned char ssl_serialized_context_header[] = {
12185 MBEDTLS_VERSION_MAJOR,
12186 MBEDTLS_VERSION_MINOR,
12187 MBEDTLS_VERSION_PATCH,
12188 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
12189 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012190 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 16 ) & 0xFF,
12191 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 8 ) & 0xFF,
12192 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012193};
12194
Paul Bakker5121ce52009-01-03 21:22:43 +000012195/*
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012196 * Serialize a full SSL context
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012197 *
12198 * The format of the serialized data is:
12199 * (in the presentation language of TLS, RFC 8446 section 3)
12200 *
12201 * // header
12202 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012203 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012204 * // the format of the remaining
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012205 * // serialized data.
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012206 * Note: When updating the format, remember to keep these
12207 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012208 *
12209 * // session sub-structure
12210 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
12211 * // transform sub-structure
12212 * uint8 random[64]; // ServerHello.random+ClientHello.random
12213 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
12214 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
12215 * // fields from ssl_context
12216 * uint32 badmac_seen; // DTLS: number of records with failing MAC
12217 * uint64 in_window_top; // DTLS: last validated record seq_num
12218 * uint64 in_window; // DTLS: bitmask for replay protection
12219 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
12220 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
12221 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
12222 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
12223 *
12224 * Note that many fields of the ssl_context or sub-structures are not
12225 * serialized, as they fall in one of the following categories:
12226 *
12227 * 1. forced value (eg in_left must be 0)
12228 * 2. pointer to dynamically-allocated memory (eg session, transform)
12229 * 3. value can be re-derived from other data (eg session keys from MS)
12230 * 4. value was temporary (eg content of input buffer)
12231 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012232 */
12233int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
12234 unsigned char *buf,
12235 size_t buf_len,
12236 size_t *olen )
12237{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012238 unsigned char *p = buf;
12239 size_t used = 0;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012240 size_t session_len;
12241 int ret = 0;
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012242
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012243 /*
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012244 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
12245 * this function's documentation.
12246 *
12247 * These are due to assumptions/limitations in the implementation. Some of
12248 * them are likely to stay (no handshake in progress) some might go away
12249 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012250 */
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012251 /* The initial handshake must be over */
12252 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012253 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012254 if( ssl->handshake != NULL )
12255 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12256 /* Double-check that sub-structures are indeed ready */
12257 if( ssl->transform == NULL || ssl->session == NULL )
12258 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12259 /* There must be no pending incoming or outgoing data */
12260 if( mbedtls_ssl_check_pending( ssl ) != 0 )
12261 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12262 if( ssl->out_left != 0 )
12263 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12264 /* Protocol must be DLTS, not TLS */
12265 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
12266 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12267 /* Version must be 1.2 */
12268 if( mbedtls_ssl_get_major_ver( ssl ) != MBEDTLS_SSL_MAJOR_VERSION_3 )
12269 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12270 if( mbedtls_ssl_get_minor_ver( ssl ) != MBEDTLS_SSL_MINOR_VERSION_3 )
12271 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12272 /* We must be using an AEAD ciphersuite */
12273 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
12274 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12275 /* Renegotiation must not be enabled */
12276 if( mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
12277 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012278
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012279 /*
12280 * Version and format identifier
12281 */
12282 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012283
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012284 if( used <= buf_len )
12285 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012286 mbedtls_platform_memcpy( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012287 sizeof( ssl_serialized_context_header ) );
12288 p += sizeof( ssl_serialized_context_header );
12289 }
12290
12291 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012292 * Session (length + data)
12293 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012294 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012295 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
12296 return( ret );
12297
12298 used += 4 + session_len;
12299 if( used <= buf_len )
12300 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012301 p = mbedtls_platform_put_uint32_be( p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012302
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012303 ret = ssl_session_save( ssl->session, 1,
12304 p, session_len, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012305 if( ret != 0 )
12306 return( ret );
12307
12308 p += session_len;
12309 }
12310
12311 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012312 * Transform
12313 */
12314 used += sizeof( ssl->transform->randbytes );
12315 if( used <= buf_len )
12316 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012317 mbedtls_platform_memcpy( p, ssl->transform->randbytes,
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012318 sizeof( ssl->transform->randbytes ) );
12319 p += sizeof( ssl->transform->randbytes );
12320 }
12321
12322#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12323 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
12324 if( used <= buf_len )
12325 {
12326 *p++ = ssl->transform->in_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012327 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12328 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012329 p += ssl->transform->in_cid_len;
12330
12331 *p++ = ssl->transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012332 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12333 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012334 p += ssl->transform->out_cid_len;
12335 }
12336#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12337
12338 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012339 * Saved fields from top-level ssl_context structure
12340 */
12341#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12342 used += 4;
12343 if( used <= buf_len )
12344 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012345 p = mbedtls_platform_put_uint32_be( p, ssl->badmac_seen );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012346 }
12347#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12348
12349#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12350 used += 16;
12351 if( used <= buf_len )
12352 {
12353 *p++ = (unsigned char)( ( ssl->in_window_top >> 56 ) & 0xFF );
12354 *p++ = (unsigned char)( ( ssl->in_window_top >> 48 ) & 0xFF );
12355 *p++ = (unsigned char)( ( ssl->in_window_top >> 40 ) & 0xFF );
12356 *p++ = (unsigned char)( ( ssl->in_window_top >> 32 ) & 0xFF );
12357 *p++ = (unsigned char)( ( ssl->in_window_top >> 24 ) & 0xFF );
12358 *p++ = (unsigned char)( ( ssl->in_window_top >> 16 ) & 0xFF );
12359 *p++ = (unsigned char)( ( ssl->in_window_top >> 8 ) & 0xFF );
12360 *p++ = (unsigned char)( ( ssl->in_window_top ) & 0xFF );
12361
12362 *p++ = (unsigned char)( ( ssl->in_window >> 56 ) & 0xFF );
12363 *p++ = (unsigned char)( ( ssl->in_window >> 48 ) & 0xFF );
12364 *p++ = (unsigned char)( ( ssl->in_window >> 40 ) & 0xFF );
12365 *p++ = (unsigned char)( ( ssl->in_window >> 32 ) & 0xFF );
12366 *p++ = (unsigned char)( ( ssl->in_window >> 24 ) & 0xFF );
12367 *p++ = (unsigned char)( ( ssl->in_window >> 16 ) & 0xFF );
12368 *p++ = (unsigned char)( ( ssl->in_window >> 8 ) & 0xFF );
12369 *p++ = (unsigned char)( ( ssl->in_window ) & 0xFF );
12370 }
12371#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12372
12373#if defined(MBEDTLS_SSL_PROTO_DTLS)
12374 used += 1;
12375 if( used <= buf_len )
12376 {
12377 *p++ = ssl->disable_datagram_packing;
12378 }
12379#endif /* MBEDTLS_SSL_PROTO_DTLS */
12380
12381 used += 8;
12382 if( used <= buf_len )
12383 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012384 mbedtls_platform_memcpy( p, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012385 p += 8;
12386 }
12387
12388#if defined(MBEDTLS_SSL_PROTO_DTLS)
12389 used += 2;
12390 if( used <= buf_len )
12391 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012392 p = mbedtls_platform_put_uint16_be( p, ssl->mtu );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012393 }
12394#endif /* MBEDTLS_SSL_PROTO_DTLS */
12395
12396#if defined(MBEDTLS_SSL_ALPN)
12397 {
12398 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnard7af73752019-07-24 00:58:27 +020012399 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012400 : 0;
12401
12402 used += 1 + alpn_len;
12403 if( used <= buf_len )
12404 {
12405 *p++ = alpn_len;
12406
12407 if( ssl->alpn_chosen != NULL )
12408 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012409 mbedtls_platform_memcpy( p, ssl->alpn_chosen, alpn_len );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012410 p += alpn_len;
12411 }
12412 }
12413 }
12414#endif /* MBEDTLS_SSL_ALPN */
12415
12416 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012417 * Done
12418 */
12419 *olen = used;
12420
12421 if( used > buf_len )
12422 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012423
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012424 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
12425
Manuel Pégourié-Gonnardbc847ca2019-07-23 14:51:09 +020012426 return( ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012427}
12428
12429/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012430 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012431 *
12432 * This internal version is wrapped by a public function that cleans up in
12433 * case of error.
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012434 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012435static int ssl_context_load( mbedtls_ssl_context *ssl,
12436 const unsigned char *buf,
12437 size_t len )
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012438{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012439 const unsigned char *p = buf;
12440 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012441 size_t session_len;
12442 int ret;
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012443
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012444 /*
12445 * The context should have been freshly setup or reset.
12446 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard14e2a8a2019-07-26 16:31:53 +020012447 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012448 * renegotiating, or if the user mistakenly loaded a session first.)
12449 */
12450 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
12451 ssl->session != NULL )
12452 {
12453 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12454 }
12455
12456 /*
12457 * We can't check that the config matches the initial one, but we can at
12458 * least check it matches the requirements for serializing.
12459 */
12460 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012461 mbedtls_ssl_ver_lt(
12462 mbedtls_ssl_conf_get_max_major_ver( ssl->conf ),
12463 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
12464 mbedtls_ssl_ver_gt(
12465 mbedtls_ssl_conf_get_min_major_ver( ssl->conf ),
12466 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
12467 mbedtls_ssl_ver_lt(
12468 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ),
12469 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
12470 mbedtls_ssl_ver_gt(
12471 mbedtls_ssl_conf_get_min_minor_ver( ssl->conf ),
12472 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020012473 mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012474 {
12475 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12476 }
12477
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012478 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
12479
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012480 /*
12481 * Check version identifier
12482 */
12483 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
12484 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12485
Teppo Järvelin650343c2019-10-03 15:36:59 +030012486 // use regular memcmp as header is not that critical
12487 if( memcmp( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012488 sizeof( ssl_serialized_context_header ) ) != 0 )
12489 {
12490 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
12491 }
12492 p += sizeof( ssl_serialized_context_header );
12493
12494 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012495 * Session
12496 */
12497 if( (size_t)( end - p ) < 4 )
12498 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12499
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012500 session_len = mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012501 p += 4;
12502
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012503 /* This has been allocated by ssl_handshake_init(), called by
12504 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12505 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012506 ssl->session_in = ssl->session;
12507 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012508 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012509
12510 if( (size_t)( end - p ) < session_len )
12511 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12512
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012513 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012514 if( ret != 0 )
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012515 {
12516 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012517 return( ret );
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012518 }
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012519
12520 p += session_len;
12521
12522 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012523 * Transform
12524 */
12525
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012526 /* This has been allocated by ssl_handshake_init(), called by
12527 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12528 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012529 ssl->transform_in = ssl->transform;
12530 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012531 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012532
12533 /* Read random bytes and populate structure */
12534 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
12535 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12536
12537 ret = ssl_populate_transform( ssl->transform,
12538 mbedtls_ssl_session_get_ciphersuite( ssl->session ),
12539 ssl->session->master,
12540#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
12541#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12542 ssl->session->encrypt_then_mac,
12543#endif
12544#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
12545 ssl->session->trunc_hmac,
12546#endif
12547#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
12548#if defined(MBEDTLS_ZLIB_SUPPORT)
12549 ssl->session->compression,
12550#endif
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012551 p, /* currently pointing to randbytes */
12552 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
12553 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
12554 ssl );
12555 if( ret != 0 )
12556 return( ret );
12557
12558 p += sizeof( ssl->transform->randbytes );
12559
12560#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12561 /* Read connection IDs and store them */
12562 if( (size_t)( end - p ) < 1 )
12563 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12564
12565 ssl->transform->in_cid_len = *p++;
12566
Manuel Pégourié-Gonnard2f3fa622019-07-23 15:02:54 +020012567 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012568 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12569
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012570 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12571 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012572 p += ssl->transform->in_cid_len;
12573
12574 ssl->transform->out_cid_len = *p++;
12575
12576 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
12577 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12578
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012579 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12580 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012581 p += ssl->transform->out_cid_len;
12582#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12583
12584 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012585 * Saved fields from top-level ssl_context structure
12586 */
12587#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12588 if( (size_t)( end - p ) < 4 )
12589 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12590
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012591 ssl->badmac_seen = (unsigned)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012592 p += 4;
12593#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12594
12595#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12596 if( (size_t)( end - p ) < 16 )
12597 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12598
12599 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
12600 ( (uint64_t) p[1] << 48 ) |
12601 ( (uint64_t) p[2] << 40 ) |
12602 ( (uint64_t) p[3] << 32 ) |
12603 ( (uint64_t) p[4] << 24 ) |
12604 ( (uint64_t) p[5] << 16 ) |
12605 ( (uint64_t) p[6] << 8 ) |
12606 ( (uint64_t) p[7] );
12607 p += 8;
12608
12609 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
12610 ( (uint64_t) p[1] << 48 ) |
12611 ( (uint64_t) p[2] << 40 ) |
12612 ( (uint64_t) p[3] << 32 ) |
12613 ( (uint64_t) p[4] << 24 ) |
12614 ( (uint64_t) p[5] << 16 ) |
12615 ( (uint64_t) p[6] << 8 ) |
12616 ( (uint64_t) p[7] );
12617 p += 8;
12618#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12619
12620#if defined(MBEDTLS_SSL_PROTO_DTLS)
12621 if( (size_t)( end - p ) < 1 )
12622 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12623
12624 ssl->disable_datagram_packing = *p++;
12625#endif /* MBEDTLS_SSL_PROTO_DTLS */
12626
12627 if( (size_t)( end - p ) < 8 )
12628 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12629
Teppo Järvelin91d79382019-10-02 09:09:31 +030012630 mbedtls_platform_memcpy( ssl->cur_out_ctr, p, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012631 p += 8;
12632
12633#if defined(MBEDTLS_SSL_PROTO_DTLS)
12634 if( (size_t)( end - p ) < 2 )
12635 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012636 ssl->mtu = (uint16_t)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012637 p += 2;
12638#endif /* MBEDTLS_SSL_PROTO_DTLS */
12639
12640#if defined(MBEDTLS_SSL_ALPN)
12641 {
12642 uint8_t alpn_len;
12643 const char **cur;
12644
12645 if( (size_t)( end - p ) < 1 )
12646 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12647
12648 alpn_len = *p++;
12649
12650 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
12651 {
12652 /* alpn_chosen should point to an item in the configured list */
12653 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
12654 {
12655 if( strlen( *cur ) == alpn_len &&
Piotr Nowickie3c4ee52020-06-23 12:59:56 +020012656 mbedtls_platform_memequal( p, cur, alpn_len ) == 0 )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012657 {
12658 ssl->alpn_chosen = *cur;
12659 break;
12660 }
12661 }
12662 }
12663
12664 /* can only happen on conf mismatch */
12665 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
12666 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12667
12668 p += alpn_len;
12669 }
12670#endif /* MBEDTLS_SSL_ALPN */
12671
12672 /*
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012673 * Forced fields from top-level ssl_context structure
12674 *
12675 * Most of them already set to the correct value by mbedtls_ssl_init() and
12676 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
12677 */
12678 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
12679
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012680#if !defined(MBEDTLS_SSL_CONF_FIXED_MAJOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012681 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012682#endif /* !MBEDTLS_SSL_CONF_FIXED_MAJOR_VER */
12683#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012684 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012685#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012686
Hanno Becker83985822019-08-30 10:42:49 +010012687 /* Adjust pointers for header fields of outgoing records to
12688 * the given transform, accounting for explicit IV and CID. */
12689 ssl_update_out_pointers( ssl, ssl->transform );
12690
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012691#if defined(MBEDTLS_SSL_PROTO_DTLS)
12692 ssl->in_epoch = 1;
12693#endif
12694
12695 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
12696 * which we don't want - otherwise we'd end up freeing the wrong transform
12697 * by calling ssl_handshake_wrapup_free_hs_transform() inappropriately. */
12698 if( ssl->handshake != NULL )
12699 {
12700 mbedtls_ssl_handshake_free( ssl );
12701 mbedtls_free( ssl->handshake );
12702 ssl->handshake = NULL;
12703 }
12704
12705 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012706 * Done - should have consumed entire buffer
12707 */
12708 if( p != end )
12709 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012710
12711 return( 0 );
12712}
12713
12714/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012715 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012716 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012717int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012718 const unsigned char *buf,
12719 size_t len )
12720{
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012721 int ret = ssl_context_load( context, buf, len );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012722
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012723 if( ret != 0 )
12724 mbedtls_ssl_free( context );
12725
12726 return( ret );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012727}
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012728#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012729
12730/*
Paul Bakker5121ce52009-01-03 21:22:43 +000012731 * Free an SSL context
12732 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012733void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000012734{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012735 if( ssl == NULL )
12736 return;
12737
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012738 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012739
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012740 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012741 {
Andrzej Kurekf3844952020-10-16 23:03:01 +020012742#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12743 size_t out_buf_len = ssl->out_buf_len;
12744#else
12745 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
12746#endif
12747 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012748 mbedtls_free( ssl->out_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012749 }
12750
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012751 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012752 {
Andrzej Kurekf3844952020-10-16 23:03:01 +020012753#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12754 size_t in_buf_len = ssl->in_buf_len;
12755#else
12756 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
12757#endif
12758 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012759 mbedtls_free( ssl->in_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012760 }
12761
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012762#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker16770332013-10-11 09:59:44 +020012763 if( ssl->compress_buf != NULL )
12764 {
Angus Grattond8213d02016-05-25 20:56:48 +100012765 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012766 mbedtls_free( ssl->compress_buf );
Paul Bakker16770332013-10-11 09:59:44 +020012767 }
12768#endif
12769
Paul Bakker48916f92012-09-16 19:57:18 +000012770 if( ssl->transform )
12771 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012772 mbedtls_ssl_transform_free( ssl->transform );
12773 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +000012774 }
12775
12776 if( ssl->handshake )
12777 {
Gilles Peskine9b562d52018-04-25 20:32:43 +020012778 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012779 mbedtls_ssl_transform_free( ssl->transform_negotiate );
12780 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012781
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012782 mbedtls_free( ssl->handshake );
12783 mbedtls_free( ssl->transform_negotiate );
12784 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012785 }
12786
Paul Bakkerc0463502013-02-14 11:19:38 +010012787 if( ssl->session )
12788 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012789 mbedtls_ssl_session_free( ssl->session );
12790 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +010012791 }
12792
Teppo Järvelin4009d8f2019-08-19 14:48:09 +030012793#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Paul Bakker66d5d072014-06-17 16:39:18 +020012794 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012795 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012796 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012797 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +000012798 }
Paul Bakker0be444a2013-08-27 21:55:01 +020012799#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000012800
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012801#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
12802 if( mbedtls_ssl_hw_record_finish != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +000012803 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012804 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
12805 mbedtls_ssl_hw_record_finish( ssl );
Paul Bakker05ef8352012-05-08 09:17:57 +000012806 }
12807#endif
12808
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012809#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012810 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020012811#endif
12812
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012813 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +000012814
Paul Bakker86f04f42013-02-14 11:20:09 +010012815 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012816 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012817}
12818
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012819/*
12820 * Initialze mbedtls_ssl_config
12821 */
12822void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
12823{
12824 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnarde744eab2019-03-18 10:51:18 +010012825
12826#if !defined(MBEDTLS_SSL_PROTO_TLS)
12827 conf->transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
12828#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012829}
12830
Simon Butcherc97b6972015-12-27 23:48:17 +000012831#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012832#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012833static int ssl_preset_default_hashes[] = {
12834#if defined(MBEDTLS_SHA512_C)
12835 MBEDTLS_MD_SHA512,
12836 MBEDTLS_MD_SHA384,
12837#endif
12838#if defined(MBEDTLS_SHA256_C)
12839 MBEDTLS_MD_SHA256,
12840 MBEDTLS_MD_SHA224,
12841#endif
Gilles Peskine5d2511c2017-05-12 13:16:40 +020012842#if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012843 MBEDTLS_MD_SHA1,
12844#endif
12845 MBEDTLS_MD_NONE
12846};
Simon Butcherc97b6972015-12-27 23:48:17 +000012847#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012848#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012849
Hanno Becker73f4cb12019-06-27 13:51:07 +010012850#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012851static int ssl_preset_suiteb_ciphersuites[] = {
12852 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
12853 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
12854 0
12855};
Hanno Becker73f4cb12019-06-27 13:51:07 +010012856#endif /* !MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012857
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012858#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012859#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012860static int ssl_preset_suiteb_hashes[] = {
12861 MBEDTLS_MD_SHA256,
12862 MBEDTLS_MD_SHA384,
12863 MBEDTLS_MD_NONE
12864};
12865#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012866#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012867
Hanno Beckerc1096e72019-06-19 12:30:41 +010012868#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012869static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
Jaeden Amero16529b22019-06-03 08:27:16 +010012870#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012871 MBEDTLS_ECP_DP_SECP256R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012872#endif
12873#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012874 MBEDTLS_ECP_DP_SECP384R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012875#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012876 MBEDTLS_ECP_DP_NONE
12877};
12878#endif
12879
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012880/*
Tillmann Karras588ad502015-09-25 04:27:22 +020012881 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012882 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012883int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012884 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012885{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012886#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012887 int ret;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012888#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012889
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +020012890 /* Use the functions here so that they are covered in tests,
12891 * but otherwise access member directly for efficiency */
12892 mbedtls_ssl_conf_endpoint( conf, endpoint );
12893 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012894
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012895 /*
12896 * Things that are common to all presets
12897 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012898#if defined(MBEDTLS_SSL_CLI_C)
12899 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
12900 {
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012901#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012902 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012903#endif /* !MBEDTLS_SSL_CONF_AUTHMODE */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012904#if defined(MBEDTLS_SSL_SESSION_TICKETS)
12905 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
12906#endif
12907 }
12908#endif
12909
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012910#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012911 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012912#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012913
12914#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12915 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
12916#endif
12917
12918#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckeraabbb582019-06-11 13:43:27 +010012919#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012920 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012921#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
12922#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsad9382f82019-06-10 10:27:14 +030012923 conf->enforce_extended_master_secret =
Jarno Lamsa18b9a492019-06-10 15:23:29 +030012924 MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012925#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012926#endif
12927
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010012928#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
12929 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
12930#endif
12931
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012932#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012933 conf->f_cookie_write = ssl_cookie_write_dummy;
12934 conf->f_cookie_check = ssl_cookie_check_dummy;
12935#endif
12936
Hanno Becker7f376f42019-06-12 16:20:48 +010012937#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
12938 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012939 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
12940#endif
12941
Janos Follath088ce432017-04-10 12:42:31 +010012942#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012943#if !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +010012944 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012945#endif /* !MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST */
12946#endif /* MBEDTLS_SSL_SRV_C */
Janos Follath088ce432017-04-10 12:42:31 +010012947
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012948#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker1f835fa2019-06-13 10:14:59 +010012949#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012950 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012951#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN */
12952#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012953 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012954#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
12955#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012956
12957#if defined(MBEDTLS_SSL_RENEGOTIATION)
12958 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020012959 mbedtls_platform_memset( conf->renego_period, 0x00, 2 );
12960 mbedtls_platform_memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012961#endif
12962
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012963#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
12964 if( endpoint == MBEDTLS_SSL_IS_SERVER )
12965 {
Hanno Becker00d0a682017-10-04 13:14:29 +010012966 const unsigned char dhm_p[] =
12967 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
12968 const unsigned char dhm_g[] =
12969 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
12970
Hanno Beckera90658f2017-10-04 15:29:08 +010012971 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
12972 dhm_p, sizeof( dhm_p ),
12973 dhm_g, sizeof( dhm_g ) ) ) != 0 )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012974 {
12975 return( ret );
12976 }
12977 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +020012978#endif
12979
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012980 /*
12981 * Preset-specific defaults
12982 */
12983 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012984 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012985 /*
12986 * NSA Suite B
12987 */
12988 case MBEDTLS_SSL_PRESET_SUITEB:
Hanno Beckere965bd32019-06-12 14:04:34 +010012989#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012990 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Hanno Beckere965bd32019-06-12 14:04:34 +010012991#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12992#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012993 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
Hanno Beckere965bd32019-06-12 14:04:34 +010012994#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
12995#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012996 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012997#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
12998#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012999 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010013000#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013001
Hanno Becker73f4cb12019-06-27 13:51:07 +010013002#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010013003 conf->ciphersuite_list[0] =
13004 conf->ciphersuite_list[1] =
13005 conf->ciphersuite_list[2] =
13006 conf->ciphersuite_list[3] =
13007 ssl_preset_suiteb_ciphersuites;
Hanno Becker73f4cb12019-06-27 13:51:07 +010013008#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013009
13010#if defined(MBEDTLS_X509_CRT_PARSE_C)
13011 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013012#endif
13013
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013014#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010013015#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013016 conf->sig_hashes = ssl_preset_suiteb_hashes;
13017#endif
Hanno Becker56595f42019-06-19 16:31:38 +010013018#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013019
13020#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010013021#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013022 conf->curve_list = ssl_preset_suiteb_curves;
13023#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010013024#endif
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +020013025 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013026
13027 /*
13028 * Default
13029 */
13030 default:
Hanno Beckere965bd32019-06-12 14:04:34 +010013031#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030013032 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
13033 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
13034 MBEDTLS_SSL_MIN_MAJOR_VERSION :
13035 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010013036#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
13037#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030013038 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
13039 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
13040 MBEDTLS_SSL_MIN_MINOR_VERSION :
13041 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013042#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020013043 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( transport ) )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013044 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
13045#endif
Hanno Beckere965bd32019-06-12 14:04:34 +010013046#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
13047#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
13048 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
13049#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
13050#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
13051 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
13052#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013053
Hanno Becker73f4cb12019-06-27 13:51:07 +010013054#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010013055 conf->ciphersuite_list[0] =
13056 conf->ciphersuite_list[1] =
13057 conf->ciphersuite_list[2] =
13058 conf->ciphersuite_list[3] =
13059 mbedtls_ssl_list_ciphersuites();
Hanno Becker73f4cb12019-06-27 13:51:07 +010013060#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013061
13062#if defined(MBEDTLS_X509_CRT_PARSE_C)
13063 conf->cert_profile = &mbedtls_x509_crt_profile_default;
13064#endif
13065
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013066#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010013067#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010013068 conf->sig_hashes = ssl_preset_default_hashes;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013069#endif
Hanno Becker56595f42019-06-19 16:31:38 +010013070#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013071
13072#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010013073#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013074 conf->curve_list = mbedtls_ecp_grp_id_list();
13075#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010013076#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013077
13078#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
13079 conf->dhm_min_bitlen = 1024;
13080#endif
13081 }
13082
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013083 return( 0 );
13084}
13085
13086/*
13087 * Free mbedtls_ssl_config
13088 */
13089void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
13090{
13091#if defined(MBEDTLS_DHM_C)
13092 mbedtls_mpi_free( &conf->dhm_P );
13093 mbedtls_mpi_free( &conf->dhm_G );
13094#endif
13095
13096#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
13097 if( conf->psk != NULL )
13098 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013099 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013100 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +000013101 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013102 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +090013103 }
13104
13105 if( conf->psk_identity != NULL )
13106 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013107 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +090013108 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +000013109 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013110 conf->psk_identity_len = 0;
13111 }
13112#endif
13113
13114#if defined(MBEDTLS_X509_CRT_PARSE_C)
13115 ssl_key_cert_free( conf->key_cert );
13116#endif
13117
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013118 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013119}
13120
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020013121#if defined(MBEDTLS_PK_C) && \
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013122 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) ) || \
13123 ( defined(MBEDTLS_USE_TINYCRYPT) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013124/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013125 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013126 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013127unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013128{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013129#if defined(MBEDTLS_RSA_C)
13130 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
13131 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013132#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013133#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013134 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
13135 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013136#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013137 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013138}
13139
Hanno Becker7e5437a2017-04-28 17:15:26 +010013140unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
13141{
13142 switch( type ) {
13143 case MBEDTLS_PK_RSA:
13144 return( MBEDTLS_SSL_SIG_RSA );
13145 case MBEDTLS_PK_ECDSA:
13146 case MBEDTLS_PK_ECKEY:
13147 return( MBEDTLS_SSL_SIG_ECDSA );
13148 default:
13149 return( MBEDTLS_SSL_SIG_ANON );
13150 }
13151}
13152
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013153mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013154{
13155 switch( sig )
13156 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013157#if defined(MBEDTLS_RSA_C)
13158 case MBEDTLS_SSL_SIG_RSA:
13159 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013160#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013161#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013162 case MBEDTLS_SSL_SIG_ECDSA:
13163 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013164#endif
13165 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013166 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013167 }
13168}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020013169#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013170
Hanno Becker7e5437a2017-04-28 17:15:26 +010013171#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
13172 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
13173
13174/* Find an entry in a signature-hash set matching a given hash algorithm. */
13175mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
13176 mbedtls_pk_type_t sig_alg )
13177{
13178 switch( sig_alg )
13179 {
13180 case MBEDTLS_PK_RSA:
13181 return( set->rsa );
13182 case MBEDTLS_PK_ECDSA:
13183 return( set->ecdsa );
13184 default:
13185 return( MBEDTLS_MD_NONE );
13186 }
13187}
13188
13189/* Add a signature-hash-pair to a signature-hash set */
13190void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
13191 mbedtls_pk_type_t sig_alg,
13192 mbedtls_md_type_t md_alg )
13193{
13194 switch( sig_alg )
13195 {
13196 case MBEDTLS_PK_RSA:
13197 if( set->rsa == MBEDTLS_MD_NONE )
13198 set->rsa = md_alg;
13199 break;
13200
13201 case MBEDTLS_PK_ECDSA:
13202 if( set->ecdsa == MBEDTLS_MD_NONE )
13203 set->ecdsa = md_alg;
13204 break;
13205
13206 default:
13207 break;
13208 }
13209}
13210
13211/* Allow exactly one hash algorithm for each signature. */
13212void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
13213 mbedtls_md_type_t md_alg )
13214{
13215 set->rsa = md_alg;
13216 set->ecdsa = md_alg;
13217}
13218
13219#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
13220 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
13221
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020013222/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013223 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020013224 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013225mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013226{
13227 switch( hash )
13228 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013229#if defined(MBEDTLS_MD5_C)
13230 case MBEDTLS_SSL_HASH_MD5:
13231 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013232#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013233#if defined(MBEDTLS_SHA1_C)
13234 case MBEDTLS_SSL_HASH_SHA1:
13235 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013236#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013237#if defined(MBEDTLS_SHA256_C)
13238 case MBEDTLS_SSL_HASH_SHA224:
13239 return( MBEDTLS_MD_SHA224 );
13240 case MBEDTLS_SSL_HASH_SHA256:
13241 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013242#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013243#if defined(MBEDTLS_SHA512_C)
13244 case MBEDTLS_SSL_HASH_SHA384:
13245 return( MBEDTLS_MD_SHA384 );
13246 case MBEDTLS_SSL_HASH_SHA512:
13247 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013248#endif
13249 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013250 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013251 }
13252}
13253
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013254/*
13255 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
13256 */
13257unsigned char mbedtls_ssl_hash_from_md_alg( int md )
13258{
13259 switch( md )
13260 {
13261#if defined(MBEDTLS_MD5_C)
13262 case MBEDTLS_MD_MD5:
13263 return( MBEDTLS_SSL_HASH_MD5 );
13264#endif
13265#if defined(MBEDTLS_SHA1_C)
13266 case MBEDTLS_MD_SHA1:
13267 return( MBEDTLS_SSL_HASH_SHA1 );
13268#endif
13269#if defined(MBEDTLS_SHA256_C)
13270 case MBEDTLS_MD_SHA224:
13271 return( MBEDTLS_SSL_HASH_SHA224 );
13272 case MBEDTLS_MD_SHA256:
13273 return( MBEDTLS_SSL_HASH_SHA256 );
13274#endif
13275#if defined(MBEDTLS_SHA512_C)
13276 case MBEDTLS_MD_SHA384:
13277 return( MBEDTLS_SSL_HASH_SHA384 );
13278 case MBEDTLS_MD_SHA512:
13279 return( MBEDTLS_SSL_HASH_SHA512 );
13280#endif
13281 default:
13282 return( MBEDTLS_SSL_HASH_NONE );
13283 }
13284}
13285
Hanno Beckeree902df2019-08-23 13:47:47 +010013286#if defined(MBEDTLS_USE_TINYCRYPT)
13287/*
13288 * Check if a curve proposed by the peer is in our list.
13289 * Return 0 if we're willing to use it, -1 otherwise.
13290 */
13291int mbedtls_ssl_check_curve_uecc( const mbedtls_ssl_context *ssl,
13292 mbedtls_uecc_group_id grp_id )
13293{
13294 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_UECC_GRP_ID( own_ec_id )
13295 if( own_ec_id == grp_id )
13296 return( 0 );
13297 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_UECC_GRP_ID
13298
13299 return( -1 );
13300}
13301#endif /* MBEDTLS_USE_TINYCRYPT */
13302
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020013303#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013304/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013305 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020013306 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013307 */
Hanno Beckeree902df2019-08-23 13:47:47 +010013308int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl,
13309 mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013310{
Hanno Beckera4a9c692019-06-18 16:55:47 +010013311 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_EC_GRP_ID( own_ec_id )
13312 if( own_ec_id == grp_id )
13313 return( 0 );
13314 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_EC_GRP_ID
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013315
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020013316 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013317}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020013318#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013319
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013320#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013321/*
13322 * Check if a hash proposed by the peer is in our list.
13323 * Return 0 if we're willing to use it, -1 otherwise.
13324 */
13325int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
13326 mbedtls_md_type_t md )
13327{
Hanno Beckerf1bc9e12019-06-19 16:23:21 +010013328 MBEDTLS_SSL_BEGIN_FOR_EACH_SIG_HASH( md_alg )
13329 if( md_alg == md )
13330 return( 0 );
13331 MBEDTLS_SSL_END_FOR_EACH_SIG_HASH
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013332
13333 return( -1 );
13334}
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013335#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013336
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013337#if defined(MBEDTLS_X509_CRT_PARSE_C)
13338int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
Hanno Becker473f98f2019-06-26 10:27:32 +010013339 mbedtls_ssl_ciphersuite_handle_t ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013340 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020013341 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013342{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013343 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013344#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013345 int usage = 0;
13346#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013347#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013348 const char *ext_oid;
13349 size_t ext_len;
13350#endif
13351
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013352#if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
13353 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013354 ((void) cert);
13355 ((void) cert_endpoint);
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013356 ((void) flags);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013357#endif
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013358
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013359#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
13360 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013361 {
13362 /* Server part of the key exchange */
Hanno Becker473f98f2019-06-26 10:27:32 +010013363 switch( mbedtls_ssl_suite_get_key_exchange( ciphersuite ) )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013364 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013365 case MBEDTLS_KEY_EXCHANGE_RSA:
13366 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013367 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013368 break;
13369
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013370 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
13371 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
13372 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
13373 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013374 break;
13375
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013376 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
13377 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013378 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013379 break;
13380
13381 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013382 case MBEDTLS_KEY_EXCHANGE_NONE:
13383 case MBEDTLS_KEY_EXCHANGE_PSK:
13384 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
13385 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +020013386 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013387 usage = 0;
13388 }
13389 }
13390 else
13391 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013392 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
13393 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013394 }
13395
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013396 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013397 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013398 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013399 ret = -1;
13400 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013401#else
13402 ((void) ciphersuite);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013403#endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013404
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013405#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
13406 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013407 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013408 ext_oid = MBEDTLS_OID_SERVER_AUTH;
13409 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013410 }
13411 else
13412 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013413 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
13414 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013415 }
13416
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013417 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013418 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013419 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013420 ret = -1;
13421 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013422#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013423
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013424 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013425}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013426#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +020013427
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013428#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
13429 defined(MBEDTLS_SSL_PROTO_TLS1_1)
13430int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
13431 unsigned char *output,
13432 unsigned char *data, size_t data_len )
13433{
13434 int ret = 0;
13435 mbedtls_md5_context mbedtls_md5;
13436 mbedtls_sha1_context mbedtls_sha1;
13437
13438 mbedtls_md5_init( &mbedtls_md5 );
13439 mbedtls_sha1_init( &mbedtls_sha1 );
13440
13441 /*
13442 * digitally-signed struct {
13443 * opaque md5_hash[16];
13444 * opaque sha_hash[20];
13445 * };
13446 *
13447 * md5_hash
13448 * MD5(ClientHello.random + ServerHello.random
13449 * + ServerParams);
13450 * sha_hash
13451 * SHA(ClientHello.random + ServerHello.random
13452 * + ServerParams);
13453 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013454 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013455 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013456 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013457 goto exit;
13458 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013459 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013460 ssl->handshake->randbytes, 64 ) ) != 0 )
13461 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013462 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013463 goto exit;
13464 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013465 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013466 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013467 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013468 goto exit;
13469 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013470 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013471 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013472 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013473 goto exit;
13474 }
13475
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013476 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013477 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013478 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013479 goto exit;
13480 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013481 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013482 ssl->handshake->randbytes, 64 ) ) != 0 )
13483 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013484 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013485 goto exit;
13486 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013487 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013488 data_len ) ) != 0 )
13489 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013490 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013491 goto exit;
13492 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013493 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013494 output + 16 ) ) != 0 )
13495 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013496 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013497 goto exit;
13498 }
13499
13500exit:
13501 mbedtls_md5_free( &mbedtls_md5 );
13502 mbedtls_sha1_free( &mbedtls_sha1 );
13503
13504 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013505 mbedtls_ssl_pend_fatal_alert( ssl,
13506 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013507
13508 return( ret );
13509
13510}
13511#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
13512 MBEDTLS_SSL_PROTO_TLS1_1 */
13513
13514#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
13515 defined(MBEDTLS_SSL_PROTO_TLS1_2)
13516int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +020013517 unsigned char *hash, size_t *hashlen,
13518 unsigned char *data, size_t data_len,
13519 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013520{
13521 int ret = 0;
13522 mbedtls_md_context_t ctx;
Andrzej Kurek84bde412020-07-06 15:27:34 -040013523
Hanno Beckera5cedbc2019-07-17 11:21:02 +010013524 mbedtls_md_handle_t md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +020013525 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013526
13527 mbedtls_md_init( &ctx );
13528
13529 /*
13530 * digitally-signed struct {
13531 * opaque client_random[32];
13532 * opaque server_random[32];
13533 * ServerDHParams params;
13534 * };
13535 */
13536 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
13537 {
13538 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
13539 goto exit;
13540 }
13541 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
13542 {
13543 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
13544 goto exit;
13545 }
13546 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
13547 {
13548 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13549 goto exit;
13550 }
13551 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
13552 {
13553 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13554 goto exit;
13555 }
Gilles Peskineca1d7422018-04-24 11:53:22 +020013556 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013557 {
13558 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
13559 goto exit;
13560 }
13561
13562exit:
13563 mbedtls_md_free( &ctx );
13564
13565 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013566 mbedtls_ssl_pend_fatal_alert( ssl,
13567 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013568
Andrzej Kurekafec8852020-07-15 16:31:27 -040013569 return( ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013570}
13571#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
13572 MBEDTLS_SSL_PROTO_TLS1_2 */
13573
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013574#endif /* MBEDTLS_SSL_TLS_C */