blob: 3c91b45139080cc9af3947952afe149dfbe8663e [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Jerry Yub476a442022-01-21 18:14:45 +080028#include <assert.h>
29
SimonBd5800b72016-04-26 07:43:27 +010030#include "mbedtls/platform.h"
SimonBd5800b72016-04-26 07:43:27 +010031
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000032#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010033#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010034#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000035#include "ssl_misc.h"
Andrzej Kurek25f27152022-08-17 16:09:31 -040036
Janos Follath73c616b2019-12-18 15:07:04 +000037#include "mbedtls/debug.h"
38#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050039#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010040#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020041#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020042
Rich Evans00ab4702015-02-06 13:43:58 +000043#include <string.h>
44
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050045#if defined(MBEDTLS_USE_PSA_CRYPTO)
46#include "mbedtls/psa_util.h"
47#include "psa/crypto.h"
48#endif
Manuel Pégourié-Gonnard07018f92022-09-15 11:29:35 +020049#include "mbedtls/legacy_or_psa.h"
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050050
Janos Follath23bdca02016-10-07 14:47:14 +010051#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000052#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020053#endif
54
Ronald Cronad8c17b2022-06-10 17:18:09 +020055#if defined(MBEDTLS_TEST_HOOKS)
56static mbedtls_ssl_chk_buf_ptr_args chk_buf_ptr_fail_args;
57
58void mbedtls_ssl_set_chk_buf_ptr_fail_args(
59 const uint8_t *cur, const uint8_t *end, size_t need )
60{
61 chk_buf_ptr_fail_args.cur = cur;
62 chk_buf_ptr_fail_args.end = end;
63 chk_buf_ptr_fail_args.need = need;
64}
65
66void mbedtls_ssl_reset_chk_buf_ptr_fail_args( void )
67{
68 memset( &chk_buf_ptr_fail_args, 0, sizeof( chk_buf_ptr_fail_args ) );
69}
70
71int mbedtls_ssl_cmp_chk_buf_ptr_fail_args( mbedtls_ssl_chk_buf_ptr_args *args )
72{
73 return( ( chk_buf_ptr_fail_args.cur != args->cur ) ||
74 ( chk_buf_ptr_fail_args.end != args->end ) ||
75 ( chk_buf_ptr_fail_args.need != args->need ) );
76}
77#endif /* MBEDTLS_TEST_HOOKS */
78
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020079#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010080
Hanno Beckera0e20d02019-05-15 14:03:01 +010081#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010082/* Top-level Connection ID API */
83
Hanno Becker8367ccc2019-05-14 11:30:10 +010084int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
85 size_t len,
86 int ignore_other_cid )
Hanno Beckerad4a1372019-05-03 13:06:44 +010087{
88 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
89 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
90
Hanno Becker611ac772019-05-14 11:45:26 +010091 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
92 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
93 {
94 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
95 }
96
97 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010098 conf->cid_len = len;
99 return( 0 );
100}
101
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100102int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
103 int enable,
104 unsigned char const *own_cid,
105 size_t own_cid_len )
106{
Hanno Becker76a79ab2019-05-03 14:38:32 +0100107 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
108 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
109
Hanno Beckerca092242019-04-25 16:01:49 +0100110 ssl->negotiate_cid = enable;
111 if( enable == MBEDTLS_SSL_CID_DISABLED )
112 {
113 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
114 return( 0 );
115 }
116 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckerad4a1372019-05-03 13:06:44 +0100117 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Beckerca092242019-04-25 16:01:49 +0100118
Hanno Beckerad4a1372019-05-03 13:06:44 +0100119 if( own_cid_len != ssl->conf->cid_len )
Hanno Beckerca092242019-04-25 16:01:49 +0100120 {
Hanno Beckerad4a1372019-05-03 13:06:44 +0100121 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
122 (unsigned) own_cid_len,
123 (unsigned) ssl->conf->cid_len ) );
Hanno Beckerca092242019-04-25 16:01:49 +0100124 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
125 }
126
127 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100128 /* Truncation is not an issue here because
129 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
130 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100131
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100132 return( 0 );
133}
134
Paul Elliott0113cf12022-03-11 20:26:47 +0000135int mbedtls_ssl_get_own_cid( mbedtls_ssl_context *ssl,
136 int *enabled,
137 unsigned char own_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
138 size_t *own_cid_len )
139{
140 *enabled = MBEDTLS_SSL_CID_DISABLED;
141
142 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
143 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
144
145 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID length is
146 * zero as this is indistinguishable from not requesting to use
147 * the CID extension. */
148 if( ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
149 return( 0 );
150
151 if( own_cid_len != NULL )
152 {
153 *own_cid_len = ssl->own_cid_len;
154 if( own_cid != NULL )
155 memcpy( own_cid, ssl->own_cid, ssl->own_cid_len );
156 }
157
158 *enabled = MBEDTLS_SSL_CID_ENABLED;
159
160 return( 0 );
161}
162
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100163int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
164 int *enabled,
165 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
166 size_t *peer_cid_len )
167{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100168 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100169
Hanno Becker76a79ab2019-05-03 14:38:32 +0100170 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Paul Elliott27b0d942022-03-18 21:55:32 +0000171 mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Hanno Becker76a79ab2019-05-03 14:38:32 +0100172 {
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100173 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker76a79ab2019-05-03 14:38:32 +0100174 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100175
Hanno Beckerc5f24222019-05-03 12:54:52 +0100176 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
177 * were used, but client and server requested the empty CID.
178 * This is indistinguishable from not using the CID extension
179 * in the first place. */
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100180 if( ssl->transform_in->in_cid_len == 0 &&
181 ssl->transform_in->out_cid_len == 0 )
182 {
183 return( 0 );
184 }
185
Hanno Becker615ef172019-05-22 16:50:35 +0100186 if( peer_cid_len != NULL )
187 {
188 *peer_cid_len = ssl->transform_in->out_cid_len;
189 if( peer_cid != NULL )
190 {
191 memcpy( peer_cid, ssl->transform_in->out_cid,
192 ssl->transform_in->out_cid_len );
193 }
194 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100195
196 *enabled = MBEDTLS_SSL_CID_ENABLED;
197
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100198 return( 0 );
199}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100200#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200205/*
206 * Convert max_fragment_length codes to length.
207 * RFC 6066 says:
208 * enum{
209 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
210 * } MaxFragmentLength;
211 * and we add 0 -> extension unused
212 */
Angus Grattond8213d02016-05-25 20:56:48 +1000213static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200214{
Angus Grattond8213d02016-05-25 20:56:48 +1000215 switch( mfl )
216 {
217 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
218 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
219 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
220 return 512;
221 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
222 return 1024;
223 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
224 return 2048;
225 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
226 return 4096;
227 default:
228 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
229 }
230}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200231#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200232
Hanno Becker52055ae2019-02-06 14:30:46 +0000233int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
234 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200235{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200236 mbedtls_ssl_session_free( dst );
237 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
吴敬辉0b716112021-11-29 10:46:35 +0800238#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
239 dst->ticket = NULL;
Xiaokang Qian87306442022-10-12 09:47:38 +0000240#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
241 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000242 dst->hostname = NULL;
吴敬辉0b716112021-11-29 10:46:35 +0800243#endif
Xiaokang Qian87306442022-10-12 09:47:38 +0000244#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
吴敬辉0b716112021-11-29 10:46:35 +0800245
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200246#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000247
248#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200249 if( src->peer_cert != NULL )
250 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000251 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200252
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200253 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200254 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200255 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200257 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200258
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200259 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200260 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200261 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200262 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200263 dst->peer_cert = NULL;
264 return( ret );
265 }
266 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000267#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker9198ad12019-02-05 17:00:50 +0000268 if( src->peer_cert_digest != NULL )
269 {
Hanno Becker9198ad12019-02-05 17:00:50 +0000270 dst->peer_cert_digest =
Hanno Beckeraccc5992019-02-25 10:06:59 +0000271 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9198ad12019-02-05 17:00:50 +0000272 if( dst->peer_cert_digest == NULL )
273 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
274
275 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
276 src->peer_cert_digest_len );
277 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000278 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000279 }
280#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
281
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200282#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200283
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200284#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200285 if( src->ticket != NULL )
286 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200287 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200288 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200289 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200290
291 memcpy( dst->ticket, src->ticket, src->ticket_len );
292 }
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000293
294#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
295 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
296 if( src->endpoint == MBEDTLS_SSL_IS_CLIENT )
297 {
298 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
299 ret = mbedtls_ssl_session_set_hostname( dst, src->hostname );
300 if( ret != 0 )
301 return ( ret );
302 }
303#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
304 MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200305#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200306
307 return( 0 );
308}
309
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500310#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200311MBEDTLS_CHECK_RETURN_CRITICAL
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500312static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
313{
314 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
315 if( resized_buffer == NULL )
316 return -1;
317
318 /* We want to copy len_new bytes when downsizing the buffer, and
319 * len_old bytes when upsizing, so we choose the smaller of two sizes,
320 * to fit one buffer into another. Size checks, ensuring that no data is
321 * lost, are done outside of this function. */
322 memcpy( resized_buffer, *buffer,
323 ( len_new < *len_old ) ? len_new : *len_old );
324 mbedtls_platform_zeroize( *buffer, *len_old );
325 mbedtls_free( *buffer );
326
327 *buffer = resized_buffer;
328 *len_old = len_new;
329
330 return 0;
331}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200332
333static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
Andrzej Kurek069fa962021-01-07 08:02:15 -0500334 size_t in_buf_new_len,
335 size_t out_buf_new_len )
Andrzej Kurek4a063792020-10-21 15:08:44 +0200336{
337 int modified = 0;
338 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
339 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
340 if( ssl->in_buf != NULL )
341 {
342 written_in = ssl->in_msg - ssl->in_buf;
343 iv_offset_in = ssl->in_iv - ssl->in_buf;
344 len_offset_in = ssl->in_len - ssl->in_buf;
345 if( downsizing ?
346 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
347 ssl->in_buf_len < in_buf_new_len )
348 {
349 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
350 {
351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
352 }
353 else
354 {
Paul Elliottb7449902021-03-10 18:14:58 +0000355 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
356 in_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200357 modified = 1;
358 }
359 }
360 }
361
362 if( ssl->out_buf != NULL )
363 {
364 written_out = ssl->out_msg - ssl->out_buf;
365 iv_offset_out = ssl->out_iv - ssl->out_buf;
366 len_offset_out = ssl->out_len - ssl->out_buf;
367 if( downsizing ?
368 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
369 ssl->out_buf_len < out_buf_new_len )
370 {
371 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
372 {
373 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
374 }
375 else
376 {
Paul Elliottb7449902021-03-10 18:14:58 +0000377 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
378 out_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200379 modified = 1;
380 }
381 }
382 }
383 if( modified )
384 {
385 /* Update pointers here to avoid doing it twice. */
386 mbedtls_ssl_reset_in_out_pointers( ssl );
387 /* Fields below might not be properly updated with record
388 * splitting or with CID, so they are manually updated here. */
389 ssl->out_msg = ssl->out_buf + written_out;
390 ssl->out_len = ssl->out_buf + len_offset_out;
391 ssl->out_iv = ssl->out_buf + iv_offset_out;
392
393 ssl->in_msg = ssl->in_buf + written_in;
394 ssl->in_len = ssl->in_buf + len_offset_in;
395 ssl->in_iv = ssl->in_buf + iv_offset_in;
396 }
397}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500398#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
399
Jerry Yudb8c48a2022-01-27 14:54:54 +0800400#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800401
402#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
403typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
404 const char *label,
405 const unsigned char *random, size_t rlen,
406 unsigned char *dstbuf, size_t dlen );
407
408static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id );
409
410#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
411
412/* Type for the TLS PRF */
413typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
414 const unsigned char *, size_t,
415 unsigned char *, size_t);
416
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200417MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800418static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
419 int ciphersuite,
420 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200421#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yued14c932022-02-17 13:40:45 +0800422 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200423#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yued14c932022-02-17 13:40:45 +0800424 ssl_tls_prf_t tls_prf,
425 const unsigned char randbytes[64],
Glenn Strauss07c64162022-03-14 12:34:51 -0400426 mbedtls_ssl_protocol_version tls_version,
Jerry Yued14c932022-02-17 13:40:45 +0800427 unsigned endpoint,
428 const mbedtls_ssl_context *ssl );
429
Andrzej Kurek25f27152022-08-17 16:09:31 -0400430#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200431MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800432static int tls_prf_sha256( const unsigned char *secret, size_t slen,
433 const char *label,
434 const unsigned char *random, size_t rlen,
435 unsigned char *dstbuf, size_t dlen );
436static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
437static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
438
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400439#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yued14c932022-02-17 13:40:45 +0800440
Andrzej Kurek25f27152022-08-17 16:09:31 -0400441#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200442MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800443static int tls_prf_sha384( const unsigned char *secret, size_t slen,
444 const char *label,
445 const unsigned char *random, size_t rlen,
446 unsigned char *dstbuf, size_t dlen );
447
448static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
449static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400450#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yued14c932022-02-17 13:40:45 +0800451
Jerry Yu438ddd82022-07-07 06:55:50 +0000452static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
Jerry Yued14c932022-02-17 13:40:45 +0800453 unsigned char *buf,
454 size_t buf_len );
Jerry Yu251a12e2022-07-13 15:15:48 +0800455
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200456MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu438ddd82022-07-07 06:55:50 +0000457static int ssl_tls12_session_load( mbedtls_ssl_session *session,
Jerry Yued14c932022-02-17 13:40:45 +0800458 const unsigned char *buf,
459 size_t len );
460#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
461
Jerry Yu53d23e22022-02-09 16:25:09 +0800462static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
463
Andrzej Kurek25f27152022-08-17 16:09:31 -0400464#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yudb8c48a2022-01-27 14:54:54 +0800465static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400466#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yudb8c48a2022-01-27 14:54:54 +0800467
Andrzej Kurek25f27152022-08-17 16:09:31 -0400468#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yudb8c48a2022-01-27 14:54:54 +0800469static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400470#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Paul Bakker1ef83d62012-04-11 12:09:53 +0000471
Ron Eldor51d3ab52019-05-12 14:54:30 +0300472int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
473 const unsigned char *secret, size_t slen,
474 const char *label,
475 const unsigned char *random, size_t rlen,
476 unsigned char *dstbuf, size_t dlen )
477{
478 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
479
480 switch( prf )
481 {
Ron Eldord2f25f72019-05-15 14:54:22 +0300482#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek25f27152022-08-17 16:09:31 -0400483#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300484 case MBEDTLS_SSL_TLS_PRF_SHA384:
485 tls_prf = tls_prf_sha384;
486 break;
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400487#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -0400488#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300489 case MBEDTLS_SSL_TLS_PRF_SHA256:
490 tls_prf = tls_prf_sha256;
491 break;
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400492#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Ron Eldord2f25f72019-05-15 14:54:22 +0300493#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300494 default:
495 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
496 }
497
498 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
499}
500
Jerry Yuc73c6182022-02-08 20:29:25 +0800501#if defined(MBEDTLS_X509_CRT_PARSE_C)
502static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
503{
504#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
505 if( session->peer_cert != NULL )
506 {
507 mbedtls_x509_crt_free( session->peer_cert );
508 mbedtls_free( session->peer_cert );
509 session->peer_cert = NULL;
510 }
511#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
512 if( session->peer_cert_digest != NULL )
513 {
514 /* Zeroization is not necessary. */
515 mbedtls_free( session->peer_cert_digest );
516 session->peer_cert_digest = NULL;
517 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
518 session->peer_cert_digest_len = 0;
519 }
520#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
521}
522#endif /* MBEDTLS_X509_CRT_PARSE_C */
523
524void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
525 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
526{
527 ((void) ciphersuite_info);
528
Andrzej Kurek25f27152022-08-17 16:09:31 -0400529#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800530 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
531 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
532 else
533#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400534#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800535 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
536 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
537 else
538#endif
539 {
540 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
541 return;
542 }
543}
544
XiaokangQianadab9a62022-07-18 07:41:26 +0000545void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
546 unsigned hs_type,
547 size_t total_hs_len )
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100548{
549 unsigned char hs_hdr[4];
550
551 /* Build HS header for checksum update. */
552 hs_hdr[0] = MBEDTLS_BYTE_0( hs_type );
553 hs_hdr[1] = MBEDTLS_BYTE_2( total_hs_len );
554 hs_hdr[2] = MBEDTLS_BYTE_1( total_hs_len );
555 hs_hdr[3] = MBEDTLS_BYTE_0( total_hs_len );
556
557 ssl->handshake->update_checksum( ssl, hs_hdr, sizeof( hs_hdr ) );
558}
559
560void mbedtls_ssl_add_hs_msg_to_checksum( mbedtls_ssl_context *ssl,
561 unsigned hs_type,
562 unsigned char const *msg,
563 size_t msg_len )
564{
565 mbedtls_ssl_add_hs_hdr_to_checksum( ssl, hs_type, msg_len );
566 ssl->handshake->update_checksum( ssl, msg, msg_len );
567}
568
Jerry Yuc73c6182022-02-08 20:29:25 +0800569void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
570{
571 ((void) ssl);
Andrzej Kurek25f27152022-08-17 16:09:31 -0400572#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800573#if defined(MBEDTLS_USE_PSA_CRYPTO)
574 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
575 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
576#else
577 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
578#endif
579#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400580#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800581#if defined(MBEDTLS_USE_PSA_CRYPTO)
582 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
583 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
584#else
Andrzej Kureka242e832022-08-11 10:03:14 -0400585 mbedtls_sha512_starts( &ssl->handshake->fin_sha384, 1 );
Jerry Yuc73c6182022-02-08 20:29:25 +0800586#endif
587#endif
588}
589
590static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
591 const unsigned char *buf, size_t len )
592{
Andrzej Kurek25f27152022-08-17 16:09:31 -0400593#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800594#if defined(MBEDTLS_USE_PSA_CRYPTO)
595 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
596#else
597 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
598#endif
599#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400600#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800601#if defined(MBEDTLS_USE_PSA_CRYPTO)
602 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
603#else
Andrzej Kureka242e832022-08-11 10:03:14 -0400604 mbedtls_sha512_update( &ssl->handshake->fin_sha384, buf, len );
Jerry Yuc73c6182022-02-08 20:29:25 +0800605#endif
606#endif
Andrzej Kurekeabeb302022-10-17 07:52:51 -0400607#if !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
608 !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
609 (void) ssl;
610 (void) buf;
611 (void) len;
612#endif
Jerry Yuc73c6182022-02-08 20:29:25 +0800613}
614
Andrzej Kurek25f27152022-08-17 16:09:31 -0400615#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800616static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
617 const unsigned char *buf, size_t len )
618{
619#if defined(MBEDTLS_USE_PSA_CRYPTO)
620 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
621#else
622 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
623#endif
624}
625#endif
626
Andrzej Kurek25f27152022-08-17 16:09:31 -0400627#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800628static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
629 const unsigned char *buf, size_t len )
630{
631#if defined(MBEDTLS_USE_PSA_CRYPTO)
632 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
633#else
Andrzej Kureka242e832022-08-11 10:03:14 -0400634 mbedtls_sha512_update( &ssl->handshake->fin_sha384, buf, len );
Jerry Yuc73c6182022-02-08 20:29:25 +0800635#endif
636}
637#endif
638
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200639static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200640{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200641 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200642
Andrzej Kurek25f27152022-08-17 16:09:31 -0400643#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500644#if defined(MBEDTLS_USE_PSA_CRYPTO)
645 handshake->fin_sha256_psa = psa_hash_operation_init();
646 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
647#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200648 mbedtls_sha256_init( &handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +0200649 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200650#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500651#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400652#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500653#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500654 handshake->fin_sha384_psa = psa_hash_operation_init();
655 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -0500656#else
Andrzej Kureka242e832022-08-11 10:03:14 -0400657 mbedtls_sha512_init( &handshake->fin_sha384 );
658 mbedtls_sha512_starts( &handshake->fin_sha384, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200659#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500660#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200661
662 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100663
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200664#if defined(MBEDTLS_DHM_C)
665 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200666#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +0200667#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200668 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200669#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200670#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200671 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +0200672#if defined(MBEDTLS_SSL_CLI_C)
673 handshake->ecjpake_cache = NULL;
674 handshake->ecjpake_cache_len = 0;
675#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200676#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200677
Gilles Peskineeccd8882020-03-10 12:19:08 +0100678#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +0200679 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +0200680#endif
681
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200682#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
683 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
684#endif
Hanno Becker75173122019-02-06 16:18:31 +0000685
686#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
687 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
688 mbedtls_pk_init( &handshake->peer_pubkey );
689#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200690}
691
Hanno Beckera18d1322018-01-03 14:27:32 +0000692void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200693{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200694 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +0200695
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100696#if defined(MBEDTLS_USE_PSA_CRYPTO)
697 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
698 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100699#else
700 mbedtls_cipher_init( &transform->cipher_ctx_enc );
701 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100702#endif
703
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000704#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +0100705#if defined(MBEDTLS_USE_PSA_CRYPTO)
706 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
707 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100708#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200709 mbedtls_md_init( &transform->md_ctx_enc );
710 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +0000711#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100712#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200713}
714
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200715void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200716{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200717 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200718}
719
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200720MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200721static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +0000722{
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200723 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +0000724 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200725 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200726 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200727 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200728 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +0200729 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200730
731 /*
732 * Either the pointers are now NULL or cleared properly and can be freed.
733 * Now allocate missing structures.
734 */
735 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200736 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200737 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200738 }
Paul Bakker48916f92012-09-16 19:57:18 +0000739
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200740 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200741 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200742 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200743 }
Paul Bakker48916f92012-09-16 19:57:18 +0000744
Paul Bakker82788fb2014-10-20 13:59:19 +0200745 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200746 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200747 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200748 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500749#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
750 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -0400751
Andrzej Kurek4a063792020-10-21 15:08:44 +0200752 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
753 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500754#endif
Paul Bakker48916f92012-09-16 19:57:18 +0000755
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200756 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +0000757 if( ssl->handshake == NULL ||
758 ssl->transform_negotiate == NULL ||
759 ssl->session_negotiate == NULL )
760 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +0200761 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200762
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200763 mbedtls_free( ssl->handshake );
764 mbedtls_free( ssl->transform_negotiate );
765 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200766
767 ssl->handshake = NULL;
768 ssl->transform_negotiate = NULL;
769 ssl->session_negotiate = NULL;
770
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200771 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +0000772 }
773
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200774 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200775 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Beckera18d1322018-01-03 14:27:32 +0000776 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +0200777 ssl_handshake_params_init( ssl->handshake );
778
Jerry Yud0766ec2022-09-22 10:46:57 +0800779#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
780 defined(MBEDTLS_SSL_SRV_C) && \
781 defined(MBEDTLS_SSL_SESSION_TICKETS)
782 ssl->handshake->new_session_tickets_count =
783 ssl->conf->new_session_tickets_count ;
784#endif
785
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200786#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200787 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
788 {
789 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200790
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200791 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
792 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
793 else
794 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200795
Hanno Becker0f57a652020-02-05 10:37:26 +0000796 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200797 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200798#endif
799
Brett Warrene0edc842021-08-17 09:53:13 +0100800/*
801 * curve_list is translated to IANA TLS group identifiers here because
802 * mbedtls_ssl_conf_curves returns void and so can't return
803 * any error codes.
804 */
805#if defined(MBEDTLS_ECP_C)
806#if !defined(MBEDTLS_DEPRECATED_REMOVED)
807 /* Heap allocate and translate curve_list from internal to IANA group ids */
808 if ( ssl->conf->curve_list != NULL )
809 {
810 size_t length;
811 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
812
813 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
814 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
815
816 /* Leave room for zero termination */
817 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
818 if ( group_list == NULL )
819 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
820
821 for( size_t i = 0; i < length; i++ )
822 {
823 const mbedtls_ecp_curve_info *info =
824 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
825 if ( info == NULL )
826 {
827 mbedtls_free( group_list );
828 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
829 }
830 group_list[i] = info->tls_id;
831 }
832
833 group_list[length] = 0;
834
835 ssl->handshake->group_list = group_list;
836 ssl->handshake->group_list_heap_allocated = 1;
837 }
838 else
839 {
840 ssl->handshake->group_list = ssl->conf->group_list;
841 ssl->handshake->group_list_heap_allocated = 0;
842 }
843#endif /* MBEDTLS_DEPRECATED_REMOVED */
844#endif /* MBEDTLS_ECP_C */
845
Ronald Crone68ab4f2022-10-05 12:46:29 +0200846#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +0800847#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +0800848#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +0800849 /* Heap allocate and translate sig_hashes from internal hash identifiers to
850 signature algorithms IANA identifiers. */
851 if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) &&
Jerry Yuf017ee42022-01-12 15:49:48 +0800852 ssl->conf->sig_hashes != NULL )
853 {
854 const int *md;
855 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +0800856 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +0800857 uint16_t *p;
858
Jerry Yub476a442022-01-21 18:14:45 +0800859#if defined(static_assert)
860 static_assert( MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
861 <= ( SIZE_MAX - ( 2 * sizeof(uint16_t) ) ),
862 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big" );
Jerry Yua68dca22022-01-20 16:28:27 +0800863#endif
864
Jerry Yuf017ee42022-01-12 15:49:48 +0800865 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
866 {
867 if( mbedtls_ssl_hash_from_md_alg( *md ) == MBEDTLS_SSL_HASH_NONE )
868 continue;
Jerry Yub476a442022-01-21 18:14:45 +0800869#if defined(MBEDTLS_ECDSA_C)
870 sig_algs_len += sizeof( uint16_t );
871#endif
Jerry Yua68dca22022-01-20 16:28:27 +0800872
Jerry Yub476a442022-01-21 18:14:45 +0800873#if defined(MBEDTLS_RSA_C)
874 sig_algs_len += sizeof( uint16_t );
875#endif
876 if( sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN )
877 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Jerry Yuf017ee42022-01-12 15:49:48 +0800878 }
879
Jerry Yub476a442022-01-21 18:14:45 +0800880 if( sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN )
Jerry Yuf017ee42022-01-12 15:49:48 +0800881 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
882
Jerry Yub476a442022-01-21 18:14:45 +0800883 ssl->handshake->sig_algs = mbedtls_calloc( 1, sig_algs_len +
884 sizeof( uint16_t ));
Jerry Yuf017ee42022-01-12 15:49:48 +0800885 if( ssl->handshake->sig_algs == NULL )
886 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
887
888 p = (uint16_t *)ssl->handshake->sig_algs;
889 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
890 {
891 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *md );
892 if( hash == MBEDTLS_SSL_HASH_NONE )
893 continue;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800894#if defined(MBEDTLS_ECDSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800895 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA);
896 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800897#endif
898#if defined(MBEDTLS_RSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800899 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA);
900 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800901#endif
Jerry Yuf017ee42022-01-12 15:49:48 +0800902 }
Gabor Mezei15b95a62022-05-09 16:37:58 +0200903 *p = MBEDTLS_TLS_SIG_NONE;
Jerry Yuf017ee42022-01-12 15:49:48 +0800904 ssl->handshake->sig_algs_heap_allocated = 1;
905 }
906 else
Jerry Yua69269a2022-01-17 21:06:01 +0800907#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +0800908 {
Jerry Yuf017ee42022-01-12 15:49:48 +0800909 ssl->handshake->sig_algs_heap_allocated = 0;
910 }
Jerry Yucc539102022-06-27 16:27:35 +0800911#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Ronald Crone68ab4f2022-10-05 12:46:29 +0200912#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +0000913 return( 0 );
914}
915
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200916#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200917/* Dummy cookie callbacks for defaults */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200918MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200919static int ssl_cookie_write_dummy( void *ctx,
920 unsigned char **p, unsigned char *end,
921 const unsigned char *cli_id, size_t cli_id_len )
922{
923 ((void) ctx);
924 ((void) p);
925 ((void) end);
926 ((void) cli_id);
927 ((void) cli_id_len);
928
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200929 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200930}
931
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200932MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200933static int ssl_cookie_check_dummy( void *ctx,
934 const unsigned char *cookie, size_t cookie_len,
935 const unsigned char *cli_id, size_t cli_id_len )
936{
937 ((void) ctx);
938 ((void) cookie);
939 ((void) cookie_len);
940 ((void) cli_id);
941 ((void) cli_id_len);
942
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200943 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200944}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200945#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200946
Paul Bakker5121ce52009-01-03 21:22:43 +0000947/*
948 * Initialize an SSL context
949 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200950void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
951{
952 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
953}
954
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200955MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +0800956static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
957{
Ronald Cron086ee0b2022-03-15 15:18:51 +0100958 const mbedtls_ssl_config *conf = ssl->conf;
959
Ronald Cron6f135e12021-12-08 16:57:54 +0100960#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100961 if( mbedtls_ssl_conf_is_tls13_only( conf ) )
962 {
XiaokangQianed582dd2022-04-13 08:21:05 +0000963 if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
964 {
965 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported." ) );
966 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
967 }
968
Jerry Yu60835a82021-08-04 10:13:52 +0800969 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
970 return( 0 );
971 }
972#endif
973
974#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100975 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800976 {
977 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
978 return( 0 );
979 }
980#endif
981
Ronald Cron6f135e12021-12-08 16:57:54 +0100982#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100983 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800984 {
XiaokangQianed582dd2022-04-13 08:21:05 +0000985 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
986 {
987 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2" ) );
988 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
989 }
990
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000991 if( conf->endpoint == MBEDTLS_SSL_IS_SERVER )
992 {
993 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 server is not supported yet." ) );
994 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
995 }
996
997
Ronald Crone1d3f062022-02-10 14:50:54 +0100998 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is TLS 1.3 or TLS 1.2." ) );
999 return( 0 );
Jerry Yu60835a82021-08-04 10:13:52 +08001000 }
1001#endif
1002
1003 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
1004 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
1005}
1006
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001007MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +08001008static int ssl_conf_check(const mbedtls_ssl_context *ssl)
1009{
1010 int ret;
1011 ret = ssl_conf_version_check( ssl );
1012 if( ret != 0 )
1013 return( ret );
1014
1015 /* Space for further checks */
1016
1017 return( 0 );
1018}
1019
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001020/*
1021 * Setup an SSL context
1022 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01001023
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001024int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02001025 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00001026{
Janos Follath865b3eb2019-12-16 11:46:15 +00001027 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +00001028 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1029 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00001030
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001031 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00001032
Jerry Yu60835a82021-08-04 10:13:52 +08001033 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
1034 return( ret );
1035
Paul Bakker62f2dee2012-09-28 07:31:51 +00001036 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01001037 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00001038 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02001039
1040 /* Set to NULL in case of an error condition */
1041 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02001042
Darryl Greenb33cc762019-11-28 14:29:44 +00001043#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1044 ssl->in_buf_len = in_buf_len;
1045#endif
1046 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001047 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001048 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001049 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001050 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001051 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10001052 }
1053
Darryl Greenb33cc762019-11-28 14:29:44 +00001054#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1055 ssl->out_buf_len = out_buf_len;
1056#endif
1057 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001058 if( ssl->out_buf == NULL )
1059 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001060 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001061 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001062 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001063 }
1064
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00001065 mbedtls_ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001066
Johan Pascalb62bb512015-12-03 21:56:45 +01001067#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +02001068 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
Johan Pascalb62bb512015-12-03 21:56:45 +01001069#endif
1070
Paul Bakker48916f92012-09-16 19:57:18 +00001071 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02001072 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001073
1074 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02001075
1076error:
1077 mbedtls_free( ssl->in_buf );
1078 mbedtls_free( ssl->out_buf );
1079
1080 ssl->conf = NULL;
1081
Darryl Greenb33cc762019-11-28 14:29:44 +00001082#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1083 ssl->in_buf_len = 0;
1084 ssl->out_buf_len = 0;
1085#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001086 ssl->in_buf = NULL;
1087 ssl->out_buf = NULL;
1088
1089 ssl->in_hdr = NULL;
1090 ssl->in_ctr = NULL;
1091 ssl->in_len = NULL;
1092 ssl->in_iv = NULL;
1093 ssl->in_msg = NULL;
1094
1095 ssl->out_hdr = NULL;
1096 ssl->out_ctr = NULL;
1097 ssl->out_len = NULL;
1098 ssl->out_iv = NULL;
1099 ssl->out_msg = NULL;
1100
k-stachowiak9f7798e2018-07-31 16:52:32 +02001101 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001102}
1103
1104/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001105 * Reset an initialized and used SSL context for re-use while retaining
1106 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001107 *
1108 * If partial is non-zero, keep data in the input buffer and client ID.
1109 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001110 */
XiaokangQian78b1fa72022-01-19 06:56:30 +00001111void mbedtls_ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
1112 int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00001113{
Darryl Greenb33cc762019-11-28 14:29:44 +00001114#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1115 size_t in_buf_len = ssl->in_buf_len;
1116 size_t out_buf_len = ssl->out_buf_len;
1117#else
1118 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1119 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1120#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001121
Hanno Beckerb0302c42021-08-03 09:39:42 +01001122#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1123 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001124#endif
1125
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001126 /* Cancel any possibly running timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00001127 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001128
Hanno Beckerb0302c42021-08-03 09:39:42 +01001129 mbedtls_ssl_reset_in_out_pointers( ssl );
1130
1131 /* Reset incoming message parsing */
1132 ssl->in_offt = NULL;
1133 ssl->nb_zero = 0;
1134 ssl->in_msgtype = 0;
1135 ssl->in_msglen = 0;
1136 ssl->in_hslen = 0;
1137 ssl->keep_current_message = 0;
1138 ssl->transform_in = NULL;
1139
1140#if defined(MBEDTLS_SSL_PROTO_DTLS)
1141 ssl->next_record_offset = 0;
1142 ssl->in_epoch = 0;
1143#endif
1144
1145 /* Keep current datagram if partial == 1 */
1146 if( partial == 0 )
1147 {
1148 ssl->in_left = 0;
1149 memset( ssl->in_buf, 0, in_buf_len );
1150 }
1151
Ronald Cronad8c17b2022-06-10 17:18:09 +02001152 ssl->send_alert = 0;
1153
Hanno Beckerb0302c42021-08-03 09:39:42 +01001154 /* Reset outgoing message writing */
1155 ssl->out_msgtype = 0;
1156 ssl->out_msglen = 0;
1157 ssl->out_left = 0;
1158 memset( ssl->out_buf, 0, out_buf_len );
1159 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
1160 ssl->transform_out = NULL;
1161
1162#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1163 mbedtls_ssl_dtls_replay_reset( ssl );
1164#endif
1165
XiaokangQian2b01dc32022-01-21 02:53:13 +00001166#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001167 if( ssl->transform )
1168 {
1169 mbedtls_ssl_transform_free( ssl->transform );
1170 mbedtls_free( ssl->transform );
1171 ssl->transform = NULL;
1172 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001173#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1174
XiaokangQian2b01dc32022-01-21 02:53:13 +00001175#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1176 mbedtls_ssl_transform_free( ssl->transform_application );
1177 mbedtls_free( ssl->transform_application );
1178 ssl->transform_application = NULL;
1179
1180 if( ssl->handshake != NULL )
1181 {
1182 mbedtls_ssl_transform_free( ssl->handshake->transform_earlydata );
1183 mbedtls_free( ssl->handshake->transform_earlydata );
1184 ssl->handshake->transform_earlydata = NULL;
1185
1186 mbedtls_ssl_transform_free( ssl->handshake->transform_handshake );
1187 mbedtls_free( ssl->handshake->transform_handshake );
1188 ssl->handshake->transform_handshake = NULL;
1189 }
1190
XiaokangQian2b01dc32022-01-21 02:53:13 +00001191#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001192}
1193
1194int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
1195{
1196 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1197
1198 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
1199
XiaokangQian78b1fa72022-01-19 06:56:30 +00001200 mbedtls_ssl_session_reset_msg_layer( ssl, partial );
Hanno Beckerb0302c42021-08-03 09:39:42 +01001201
1202 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001203#if defined(MBEDTLS_SSL_RENEGOTIATION)
1204 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001205 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001206
1207 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001208 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
1209 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001210#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001211 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001212
Hanno Beckerb0302c42021-08-03 09:39:42 +01001213 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001214 ssl->session_out = NULL;
Paul Bakkerc0463502013-02-14 11:19:38 +01001215 if( ssl->session )
1216 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001217 mbedtls_ssl_session_free( ssl->session );
1218 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01001219 ssl->session = NULL;
1220 }
1221
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001222#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001223 ssl->alpn_chosen = NULL;
1224#endif
1225
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001226#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
David Horstmann3b2276a2022-10-06 14:49:08 +01001227 int free_cli_id = 1;
Hanno Becker4ccbf062018-08-10 11:20:38 +01001228#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
David Horstmann3b2276a2022-10-06 14:49:08 +01001229 free_cli_id = ( partial == 0 );
Hanno Becker4ccbf062018-08-10 11:20:38 +01001230#endif
David Horstmann3b2276a2022-10-06 14:49:08 +01001231 if( free_cli_id )
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001232 {
1233 mbedtls_free( ssl->cli_id );
1234 ssl->cli_id = NULL;
1235 ssl->cli_id_len = 0;
1236 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001237#endif
1238
Paul Bakker48916f92012-09-16 19:57:18 +00001239 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
1240 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001241
1242 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00001243}
1244
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001245/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001246 * Reset an initialized and used SSL context for re-use while retaining
1247 * all application-set variables, function pointers and data.
1248 */
1249int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
1250{
Hanno Becker43aefe22020-02-05 10:44:56 +00001251 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001252}
1253
1254/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001255 * SSL set accessors
1256 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001257void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00001258{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001259 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001260}
1261
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02001262void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001263{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001264 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001265}
1266
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001267#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001268void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001269{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001270 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001271}
1272#endif
1273
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001274void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001275{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001276 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001277}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001278
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001279#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001280
Hanno Becker1841b0a2018-08-24 11:13:57 +01001281void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
1282 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01001283{
1284 ssl->disable_datagram_packing = !allow_packing;
1285}
1286
1287void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
1288 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001289{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001290 conf->hs_timeout_min = min;
1291 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001292}
1293#endif
1294
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001295void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00001296{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001297 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001298}
1299
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001300#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001301void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02001302 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001303 void *p_vrfy )
1304{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001305 conf->f_vrfy = f_vrfy;
1306 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001307}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001308#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001309
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001310void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001311 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00001312 void *p_rng )
1313{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001314 conf->f_rng = f_rng;
1315 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001316}
1317
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001318void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02001319 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00001320 void *p_dbg )
1321{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001322 conf->f_dbg = f_dbg;
1323 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001324}
1325
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001326void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001327 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00001328 mbedtls_ssl_send_t *f_send,
1329 mbedtls_ssl_recv_t *f_recv,
1330 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001331{
1332 ssl->p_bio = p_bio;
1333 ssl->f_send = f_send;
1334 ssl->f_recv = f_recv;
1335 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001336}
1337
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001338#if defined(MBEDTLS_SSL_PROTO_DTLS)
1339void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
1340{
1341 ssl->mtu = mtu;
1342}
1343#endif
1344
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001345void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001346{
1347 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001348}
1349
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001350void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
1351 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00001352 mbedtls_ssl_set_timer_t *f_set_timer,
1353 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001354{
1355 ssl->p_timer = p_timer;
1356 ssl->f_set_timer = f_set_timer;
1357 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001358
1359 /* Make sure we start with no timer running */
Hanno Becker0f57a652020-02-05 10:37:26 +00001360 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001361}
1362
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001363#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001364void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Hanno Beckera637ff62021-04-15 08:42:48 +01001365 void *p_cache,
1366 mbedtls_ssl_cache_get_t *f_get_cache,
1367 mbedtls_ssl_cache_set_t *f_set_cache )
Paul Bakker5121ce52009-01-03 21:22:43 +00001368{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001369 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001370 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001371 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001372}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001373#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001375#if defined(MBEDTLS_SSL_CLI_C)
1376int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00001377{
Janos Follath865b3eb2019-12-16 11:46:15 +00001378 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001379
1380 if( ssl == NULL ||
1381 session == NULL ||
1382 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001383 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001384 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001385 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001386 }
1387
Hanno Beckere810bbc2021-05-14 16:01:05 +01001388 if( ssl->handshake->resume == 1 )
1389 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1390
Jerry Yu21092062022-10-10 21:21:31 +08001391#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1392 if( session->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Jerry Yu40afab62022-10-08 10:42:13 +08001393 {
Jerry Yu21092062022-10-10 21:21:31 +08001394 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1395 mbedtls_ssl_ciphersuite_from_id( session->ciphersuite );
1396
1397 if( mbedtls_ssl_validate_ciphersuite(
1398 ssl, ciphersuite_info, MBEDTLS_SSL_VERSION_TLS1_3,
1399 MBEDTLS_SSL_VERSION_TLS1_3 ) != 0 )
1400 {
1401 MBEDTLS_SSL_DEBUG_MSG( 4, ( "%d is not a valid TLS 1.3 ciphersuite.",
1402 session->ciphersuite ) );
1403 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1404 }
Jerry Yu40afab62022-10-08 10:42:13 +08001405 }
Jerry Yu21092062022-10-10 21:21:31 +08001406#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu40afab62022-10-08 10:42:13 +08001407
Hanno Becker52055ae2019-02-06 14:30:46 +00001408 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
1409 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001410 return( ret );
1411
Paul Bakker0a597072012-09-25 21:55:46 +00001412 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001413
1414 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001415}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001416#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001417
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001418void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
1419 const int *ciphersuites )
1420{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001421 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001422}
1423
Ronald Cron6f135e12021-12-08 16:57:54 +01001424#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yucadebe52021-08-24 10:36:45 +08001425void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
Hanno Becker71f1ed62021-07-24 06:01:47 +01001426 const int kex_modes )
1427{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001428 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001429}
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001430
1431#if defined(MBEDTLS_SSL_EARLY_DATA)
1432void mbedtls_ssl_tls13_conf_early_data( mbedtls_ssl_config *conf,
Xiaokang Qian72dbfef2022-10-26 06:33:57 +00001433 int early_data_enabled )
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001434{
1435 conf->early_data_enabled = early_data_enabled;
1436}
1437#endif /* MBEDTLS_SSL_EARLY_DATA */
Ronald Cron6f135e12021-12-08 16:57:54 +01001438#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001439
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001440#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001441void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01001442 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001443{
1444 conf->cert_profile = profile;
1445}
1446
Glenn Strauss36872db2022-01-22 05:06:31 -05001447static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
1448{
1449 mbedtls_ssl_key_cert *cur = key_cert, *next;
1450
1451 while( cur != NULL )
1452 {
1453 next = cur->next;
1454 mbedtls_free( cur );
1455 cur = next;
1456 }
1457}
1458
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001459/* Append a new keycert entry to a (possibly empty) list */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001460MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001461static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
1462 mbedtls_x509_crt *cert,
1463 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001464{
niisato8ee24222018-06-25 19:05:48 +09001465 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001466
Glenn Strauss36872db2022-01-22 05:06:31 -05001467 if( cert == NULL )
1468 {
1469 /* Free list if cert is null */
1470 ssl_key_cert_free( *head );
1471 *head = NULL;
1472 return( 0 );
1473 }
1474
niisato8ee24222018-06-25 19:05:48 +09001475 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
1476 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001477 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001478
niisato8ee24222018-06-25 19:05:48 +09001479 new_cert->cert = cert;
1480 new_cert->key = key;
1481 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001482
Glenn Strauss36872db2022-01-22 05:06:31 -05001483 /* Update head if the list was null, else add to the end */
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001484 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01001485 {
niisato8ee24222018-06-25 19:05:48 +09001486 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01001487 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001488 else
1489 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001490 mbedtls_ssl_key_cert *cur = *head;
1491 while( cur->next != NULL )
1492 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09001493 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001494 }
1495
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001496 return( 0 );
1497}
1498
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001499int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001500 mbedtls_x509_crt *own_cert,
1501 mbedtls_pk_context *pk_key )
1502{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02001503 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001504}
1505
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001506void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001507 mbedtls_x509_crt *ca_chain,
1508 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001509{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001510 conf->ca_chain = ca_chain;
1511 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001512
1513#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1514 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1515 * cannot be used together. */
1516 conf->f_ca_cb = NULL;
1517 conf->p_ca_cb = NULL;
1518#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001519}
Hanno Becker5adaad92019-03-27 16:54:37 +00001520
1521#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1522void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00001523 mbedtls_x509_crt_ca_cb_t f_ca_cb,
Hanno Becker5adaad92019-03-27 16:54:37 +00001524 void *p_ca_cb )
1525{
1526 conf->f_ca_cb = f_ca_cb;
1527 conf->p_ca_cb = p_ca_cb;
1528
1529 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1530 * cannot be used together. */
1531 conf->ca_chain = NULL;
1532 conf->ca_crl = NULL;
1533}
1534#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001535#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001536
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001537#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Glenn Strauss69894072022-01-24 12:58:00 -05001538const unsigned char *mbedtls_ssl_get_hs_sni( mbedtls_ssl_context *ssl,
1539 size_t *name_len )
1540{
1541 *name_len = ssl->handshake->sni_name_len;
1542 return( ssl->handshake->sni_name );
1543}
1544
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001545int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
1546 mbedtls_x509_crt *own_cert,
1547 mbedtls_pk_context *pk_key )
1548{
1549 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
1550 own_cert, pk_key ) );
1551}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001552
1553void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
1554 mbedtls_x509_crt *ca_chain,
1555 mbedtls_x509_crl *ca_crl )
1556{
1557 ssl->handshake->sni_ca_chain = ca_chain;
1558 ssl->handshake->sni_ca_crl = ca_crl;
1559}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001560
Glenn Strauss999ef702022-03-11 01:37:23 -05001561#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
1562void mbedtls_ssl_set_hs_dn_hints( mbedtls_ssl_context *ssl,
1563 const mbedtls_x509_crt *crt)
1564{
1565 ssl->handshake->dn_hints = crt;
1566}
1567#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
1568
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001569void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
1570 int authmode )
1571{
1572 ssl->handshake->sni_authmode = authmode;
1573}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001574#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1575
Hanno Becker8927c832019-04-03 12:52:50 +01001576#if defined(MBEDTLS_X509_CRT_PARSE_C)
1577void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
1578 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1579 void *p_vrfy )
1580{
1581 ssl->f_vrfy = f_vrfy;
1582 ssl->p_vrfy = p_vrfy;
1583}
1584#endif
1585
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001586#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001587/*
1588 * Set EC J-PAKE password for current handshake
1589 */
1590int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
1591 const unsigned char *pw,
1592 size_t pw_len )
1593{
1594 mbedtls_ecjpake_role role;
1595
Janos Follath8eb64132016-06-03 15:40:57 +01001596 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001597 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1598
1599 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1600 role = MBEDTLS_ECJPAKE_SERVER;
1601 else
1602 role = MBEDTLS_ECJPAKE_CLIENT;
1603
1604 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
1605 role,
1606 MBEDTLS_MD_SHA256,
1607 MBEDTLS_ECP_DP_SECP256R1,
1608 pw, pw_len ) );
1609}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001610#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001611
Ronald Cron73fe8df2022-10-05 14:31:43 +02001612#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Ronald Crond29e13e2022-10-19 10:33:48 +02001613int mbedtls_ssl_conf_has_static_psk( mbedtls_ssl_config const *conf )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001614{
Ronald Crond29e13e2022-10-19 10:33:48 +02001615 if( conf->psk_identity == NULL ||
1616 conf->psk_identity_len == 0 )
1617 {
1618 return( 0 );
1619 }
1620
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001621#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Crond29e13e2022-10-19 10:33:48 +02001622 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001623 return( 1 );
1624#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Crond29e13e2022-10-19 10:33:48 +02001625
1626 if( conf->psk != NULL && conf->psk_len != 0 )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001627 return( 1 );
1628
1629 return( 0 );
1630}
1631
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001632static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
1633{
1634 /* Remove reference to existing PSK, if any. */
1635#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001636 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001637 {
1638 /* The maintenance of the PSK key slot is the
1639 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001640 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001641 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001642#endif /* MBEDTLS_USE_PSA_CRYPTO */
1643 if( conf->psk != NULL )
1644 {
1645 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
1646
1647 mbedtls_free( conf->psk );
1648 conf->psk = NULL;
1649 conf->psk_len = 0;
1650 }
1651
1652 /* Remove reference to PSK identity, if any. */
1653 if( conf->psk_identity != NULL )
1654 {
1655 mbedtls_free( conf->psk_identity );
1656 conf->psk_identity = NULL;
1657 conf->psk_identity_len = 0;
1658 }
1659}
1660
Hanno Becker7390c712018-11-15 13:33:04 +00001661/* This function assumes that PSK identity in the SSL config is unset.
1662 * It checks that the provided identity is well-formed and attempts
1663 * to make a copy of it in the SSL config.
1664 * On failure, the PSK identity in the config remains unset. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001665MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker7390c712018-11-15 13:33:04 +00001666static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
1667 unsigned char const *psk_identity,
1668 size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001669{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001670 /* Identity len will be encoded on two bytes */
Hanno Becker7390c712018-11-15 13:33:04 +00001671 if( psk_identity == NULL ||
Ronald Cron2a87e9b2022-10-19 10:55:26 +02001672 psk_identity_len == 0 ||
Hanno Becker7390c712018-11-15 13:33:04 +00001673 ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10001674 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001675 {
1676 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1677 }
1678
Hanno Becker7390c712018-11-15 13:33:04 +00001679 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
1680 if( conf->psk_identity == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001681 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker6db455e2013-09-18 17:29:31 +02001682
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001683 conf->psk_identity_len = psk_identity_len;
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001684 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker5ad403f2013-09-18 21:21:30 +02001685
1686 return( 0 );
Paul Bakker6db455e2013-09-18 17:29:31 +02001687}
1688
Hanno Becker7390c712018-11-15 13:33:04 +00001689int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
1690 const unsigned char *psk, size_t psk_len,
1691 const unsigned char *psk_identity, size_t psk_identity_len )
1692{
Janos Follath865b3eb2019-12-16 11:46:15 +00001693 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001694
1695 /* We currently only support one PSK, raw or opaque. */
Ronald Crond29e13e2022-10-19 10:33:48 +02001696 if( mbedtls_ssl_conf_has_static_psk( conf ) )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001697 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Becker7390c712018-11-15 13:33:04 +00001698
1699 /* Check and set raw PSK */
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001700 if( psk == NULL )
Hanno Becker7390c712018-11-15 13:33:04 +00001701 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001702 if( psk_len == 0 )
1703 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1704 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1705 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1706
Hanno Becker7390c712018-11-15 13:33:04 +00001707 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
1708 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1709 conf->psk_len = psk_len;
1710 memcpy( conf->psk, psk, conf->psk_len );
1711
1712 /* Check and set PSK Identity */
1713 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
1714 if( ret != 0 )
1715 ssl_conf_remove_psk( conf );
1716
1717 return( ret );
1718}
1719
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001720static void ssl_remove_psk( mbedtls_ssl_context *ssl )
1721{
1722#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001723 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001724 {
Neil Armstrong501c9322022-05-03 09:35:09 +02001725 /* The maintenance of the external PSK key slot is the
1726 * user's responsibility. */
1727 if( ssl->handshake->psk_opaque_is_internal )
1728 {
1729 psa_destroy_key( ssl->handshake->psk_opaque );
1730 ssl->handshake->psk_opaque_is_internal = 0;
1731 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02001732 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001733 }
Neil Armstronge952a302022-05-03 10:22:14 +02001734#else
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001735 if( ssl->handshake->psk != NULL )
1736 {
1737 mbedtls_platform_zeroize( ssl->handshake->psk,
1738 ssl->handshake->psk_len );
1739 mbedtls_free( ssl->handshake->psk );
1740 ssl->handshake->psk_len = 0;
1741 }
Neil Armstronge952a302022-05-03 10:22:14 +02001742#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001743}
1744
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001745int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
1746 const unsigned char *psk, size_t psk_len )
1747{
Neil Armstrong501c9322022-05-03 09:35:09 +02001748#if defined(MBEDTLS_USE_PSA_CRYPTO)
1749 psa_key_attributes_t key_attributes = psa_key_attributes_init();
Jerry Yu5d01c052022-08-17 10:18:10 +08001750 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Jerry Yu24b8c812022-08-20 19:06:56 +08001751 psa_algorithm_t alg = PSA_ALG_NONE;
Jerry Yu5d01c052022-08-17 10:18:10 +08001752 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrong501c9322022-05-03 09:35:09 +02001753#endif /* MBEDTLS_USE_PSA_CRYPTO */
1754
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001755 if( psk == NULL || ssl->handshake == NULL )
1756 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1757
1758 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1759 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1760
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001761 ssl_remove_psk( ssl );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001762
Neil Armstrong501c9322022-05-03 09:35:09 +02001763#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yuccc68a42022-07-26 16:39:20 +08001764#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1765 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
1766 {
Jerry Yu6cf6b472022-08-16 14:50:28 +08001767 if( ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Jerry Yuccc68a42022-07-26 16:39:20 +08001768 alg = PSA_ALG_TLS12_PSK_TO_MS( PSA_ALG_SHA_384 );
1769 else
1770 alg = PSA_ALG_TLS12_PSK_TO_MS( PSA_ALG_SHA_256 );
1771 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
1772 }
1773#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Neil Armstrong501c9322022-05-03 09:35:09 +02001774
Jerry Yu568ec252022-07-22 21:27:34 +08001775#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yuccc68a42022-07-26 16:39:20 +08001776 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
1777 {
1778 alg = PSA_ALG_HKDF_EXTRACT( PSA_ALG_ANY_HASH );
1779 psa_set_key_usage_flags( &key_attributes,
1780 PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_EXPORT );
1781 }
1782#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1783
Neil Armstrong501c9322022-05-03 09:35:09 +02001784 psa_set_key_algorithm( &key_attributes, alg );
1785 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
1786
1787 status = psa_import_key( &key_attributes, psk, psk_len, &key );
1788 if( status != PSA_SUCCESS )
1789 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1790
1791 /* Allow calling psa_destroy_key() on psk remove */
1792 ssl->handshake->psk_opaque_is_internal = 1;
1793 return mbedtls_ssl_set_hs_psk_opaque( ssl, key );
1794#else
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02001795 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001796 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001797
1798 ssl->handshake->psk_len = psk_len;
1799 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
1800
1801 return( 0 );
Neil Armstrong501c9322022-05-03 09:35:09 +02001802#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001803}
1804
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001805#if defined(MBEDTLS_USE_PSA_CRYPTO)
1806int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
Andrzej Kurek03e01462022-01-03 12:53:24 +01001807 mbedtls_svc_key_id_t psk,
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001808 const unsigned char *psk_identity,
1809 size_t psk_identity_len )
1810{
Janos Follath865b3eb2019-12-16 11:46:15 +00001811 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001812
1813 /* We currently only support one PSK, raw or opaque. */
Ronald Crond29e13e2022-10-19 10:33:48 +02001814 if( mbedtls_ssl_conf_has_static_psk( conf ) )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001815 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001816
Hanno Becker7390c712018-11-15 13:33:04 +00001817 /* Check and set opaque PSK */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001818 if( mbedtls_svc_key_id_is_null( psk ) )
Hanno Becker7390c712018-11-15 13:33:04 +00001819 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ronald Croncf56a0a2020-08-04 09:51:30 +02001820 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00001821
1822 /* Check and set PSK Identity */
1823 ret = ssl_conf_set_psk_identity( conf, psk_identity,
1824 psk_identity_len );
1825 if( ret != 0 )
1826 ssl_conf_remove_psk( conf );
1827
1828 return( ret );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001829}
1830
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01001831int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
1832 mbedtls_svc_key_id_t psk )
1833{
1834 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
1835 ( ssl->handshake == NULL ) )
1836 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1837
1838 ssl_remove_psk( ssl );
1839 ssl->handshake->psk_opaque = psk;
1840 return( 0 );
1841}
1842#endif /* MBEDTLS_USE_PSA_CRYPTO */
1843
Jerry Yu8897c072022-08-12 13:56:53 +08001844#if defined(MBEDTLS_SSL_SRV_C)
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01001845void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
1846 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
1847 size_t),
1848 void *p_psk )
1849{
1850 conf->f_psk = f_psk;
1851 conf->p_psk = p_psk;
1852}
Jerry Yu8897c072022-08-12 13:56:53 +08001853#endif /* MBEDTLS_SSL_SRV_C */
1854
Ronald Cron73fe8df2022-10-05 14:31:43 +02001855#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01001856
1857#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine301711e2022-04-26 16:57:05 +02001858static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
1859 psa_algorithm_t alg )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001860{
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001861#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001862 if( alg == PSA_ALG_CBC_NO_PADDING )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001863 return( MBEDTLS_SSL_MODE_CBC );
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001864#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001865 if( PSA_ALG_IS_AEAD( alg ) )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001866 return( MBEDTLS_SSL_MODE_AEAD );
Gilles Peskine301711e2022-04-26 16:57:05 +02001867 return( MBEDTLS_SSL_MODE_STREAM );
1868}
1869
1870#else /* MBEDTLS_USE_PSA_CRYPTO */
1871
1872static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
1873 mbedtls_cipher_mode_t mode )
1874{
1875#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
1876 if( mode == MBEDTLS_MODE_CBC )
1877 return( MBEDTLS_SSL_MODE_CBC );
1878#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
1879
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001880#if defined(MBEDTLS_GCM_C) || \
1881 defined(MBEDTLS_CCM_C) || \
1882 defined(MBEDTLS_CHACHAPOLY_C)
1883 if( mode == MBEDTLS_MODE_GCM ||
1884 mode == MBEDTLS_MODE_CCM ||
1885 mode == MBEDTLS_MODE_CHACHAPOLY )
1886 return( MBEDTLS_SSL_MODE_AEAD );
1887#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001888
1889 return( MBEDTLS_SSL_MODE_STREAM );
1890}
Gilles Peskine301711e2022-04-26 16:57:05 +02001891#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001892
Gilles Peskinee108d982022-04-26 16:50:40 +02001893static mbedtls_ssl_mode_t mbedtls_ssl_get_actual_mode(
1894 mbedtls_ssl_mode_t base_mode,
1895 int encrypt_then_mac )
1896{
1897#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
1898 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
1899 base_mode == MBEDTLS_SSL_MODE_CBC )
1900 {
1901 return( MBEDTLS_SSL_MODE_CBC_ETM );
1902 }
1903#else
1904 (void) encrypt_then_mac;
1905#endif
1906 return( base_mode );
1907}
1908
Neil Armstrongab555e02022-04-04 11:07:59 +02001909mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001910 const mbedtls_ssl_transform *transform )
1911{
Gilles Peskinee108d982022-04-26 16:50:40 +02001912 mbedtls_ssl_mode_t base_mode = mbedtls_ssl_get_base_mode(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001913#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskinee108d982022-04-26 16:50:40 +02001914 transform->psa_alg
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001915#else
Gilles Peskinee108d982022-04-26 16:50:40 +02001916 mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc )
1917#endif
1918 );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001919
Gilles Peskinee108d982022-04-26 16:50:40 +02001920 int encrypt_then_mac = 0;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001921#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskinee108d982022-04-26 16:50:40 +02001922 encrypt_then_mac = transform->encrypt_then_mac;
1923#endif
1924 return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001925}
1926
Neil Armstrongab555e02022-04-04 11:07:59 +02001927mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001928#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001929 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001930#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001931 const mbedtls_ssl_ciphersuite_t *suite )
1932{
Gilles Peskinee108d982022-04-26 16:50:40 +02001933 mbedtls_ssl_mode_t base_mode = MBEDTLS_SSL_MODE_STREAM;
1934
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001935#if defined(MBEDTLS_USE_PSA_CRYPTO)
1936 psa_status_t status;
1937 psa_algorithm_t alg;
1938 psa_key_type_t type;
1939 size_t size;
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001940 status = mbedtls_ssl_cipher_to_psa( suite->cipher, 0, &alg, &type, &size );
1941 if( status == PSA_SUCCESS )
Gilles Peskinee108d982022-04-26 16:50:40 +02001942 base_mode = mbedtls_ssl_get_base_mode( alg );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001943#else
1944 const mbedtls_cipher_info_t *cipher =
1945 mbedtls_cipher_info_from_type( suite->cipher );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001946 if( cipher != NULL )
Gilles Peskinee108d982022-04-26 16:50:40 +02001947 {
1948 base_mode =
1949 mbedtls_ssl_get_base_mode(
1950 mbedtls_cipher_info_get_mode( cipher ) );
1951 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001952#endif /* MBEDTLS_USE_PSA_CRYPTO */
1953
Gilles Peskinee108d982022-04-26 16:50:40 +02001954#if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
1955 int encrypt_then_mac = 0;
1956#endif
1957 return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001958}
1959
Neil Armstrong8395d7a2022-05-18 11:44:56 +02001960#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu251a12e2022-07-13 15:15:48 +08001961
1962#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu438ddd82022-07-07 06:55:50 +00001963/* Serialization of TLS 1.3 sessions:
1964 *
1965 * struct {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00001966 * opaque hostname<0..2^16-1>;
Jerry Yu438ddd82022-07-07 06:55:50 +00001967 * uint64 ticket_received;
1968 * uint32 ticket_lifetime;
Jerry Yu34191072022-08-18 10:32:09 +08001969 * opaque ticket<1..2^16-1>;
Jerry Yu438ddd82022-07-07 06:55:50 +00001970 * } ClientOnlyData;
1971 *
1972 * struct {
1973 * uint8 endpoint;
1974 * uint8 ciphersuite[2];
1975 * uint32 ticket_age_add;
1976 * uint8 ticket_flags;
1977 * opaque resumption_key<0..255>;
1978 * select ( endpoint ) {
1979 * case client: ClientOnlyData;
1980 * case server: uint64 start_time;
1981 * };
1982 * } serialized_session_tls13;
1983 *
1984 */
1985#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yue36fdd62022-08-17 21:31:36 +08001986MBEDTLS_CHECK_RETURN_CRITICAL
1987static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
1988 unsigned char *buf,
1989 size_t buf_len,
1990 size_t *olen )
Jerry Yu438ddd82022-07-07 06:55:50 +00001991{
1992 unsigned char *p = buf;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00001993#if defined(MBEDTLS_SSL_CLI_C) && \
1994 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1995 size_t hostname_len = ( session->hostname == NULL ) ?
Xiaokang Qianed0620c2022-10-12 06:58:13 +00001996 0 : strlen( session->hostname ) + 1;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00001997#endif
Jerry Yubc7c1a42022-07-21 22:57:37 +08001998 size_t needed = 1 /* endpoint */
1999 + 2 /* ciphersuite */
2000 + 4 /* ticket_age_add */
Jerry Yu34191072022-08-18 10:32:09 +08002001 + 1 /* ticket_flags */
2002 + 1; /* resumption_key length */
Jerry Yue36fdd62022-08-17 21:31:36 +08002003 *olen = 0;
Jerry Yu34191072022-08-18 10:32:09 +08002004
2005 if( session->resumption_key_len > MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN )
2006 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2007 needed += session->resumption_key_len; /* resumption_key */
2008
Jerry Yu438ddd82022-07-07 06:55:50 +00002009#if defined(MBEDTLS_HAVE_TIME)
2010 needed += 8; /* start_time or ticket_received */
2011#endif
2012
2013#if defined(MBEDTLS_SSL_CLI_C)
2014 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
2015 {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002016#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00002017 needed += 2 /* hostname_len */
Xiaokang Qian2f9efd32022-10-10 11:24:08 +00002018 + hostname_len; /* hostname */
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00002019#endif
2020
Jerry Yu438ddd82022-07-07 06:55:50 +00002021 needed += 4 /* ticket_lifetime */
Jerry Yue36fdd62022-08-17 21:31:36 +08002022 + 2; /* ticket_len */
Jerry Yu34191072022-08-18 10:32:09 +08002023
2024 /* Check size_t overflow */
Jerry Yue36fdd62022-08-17 21:31:36 +08002025 if( session->ticket_len > SIZE_MAX - needed )
2026 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yu34191072022-08-18 10:32:09 +08002027
Jerry Yue28d9742022-08-18 15:44:03 +08002028 needed += session->ticket_len; /* ticket */
Jerry Yu438ddd82022-07-07 06:55:50 +00002029 }
2030#endif /* MBEDTLS_SSL_CLI_C */
2031
Jerry Yue36fdd62022-08-17 21:31:36 +08002032 *olen = needed;
Jerry Yu438ddd82022-07-07 06:55:50 +00002033 if( needed > buf_len )
Jerry Yue36fdd62022-08-17 21:31:36 +08002034 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Jerry Yu438ddd82022-07-07 06:55:50 +00002035
2036 p[0] = session->endpoint;
2037 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 1 );
2038 MBEDTLS_PUT_UINT32_BE( session->ticket_age_add, p, 3 );
2039 p[7] = session->ticket_flags;
2040
2041 /* save resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002042 p[8] = session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002043 p += 9;
Jerry Yubc7c1a42022-07-21 22:57:37 +08002044 memcpy( p, session->resumption_key, session->resumption_key_len );
2045 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002046
2047#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
2048 if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
2049 {
2050 MBEDTLS_PUT_UINT64_BE( (uint64_t) session->start, p, 0 );
2051 p += 8;
2052 }
2053#endif /* MBEDTLS_HAVE_TIME */
2054
2055#if defined(MBEDTLS_SSL_CLI_C)
2056 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
2057 {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002058#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2059 MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 );
2060 p += 2;
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002061 if( hostname_len > 0 )
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002062 {
2063 /* save host name */
2064 memcpy( p, session->hostname, hostname_len );
2065 p += hostname_len;
2066 }
2067#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
2068
Jerry Yu438ddd82022-07-07 06:55:50 +00002069#if defined(MBEDTLS_HAVE_TIME)
2070 MBEDTLS_PUT_UINT64_BE( (uint64_t) session->ticket_received, p, 0 );
2071 p += 8;
2072#endif
2073 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
2074 p += 4;
2075
2076 MBEDTLS_PUT_UINT16_BE( session->ticket_len, p, 0 );
2077 p += 2;
Jerry Yu34191072022-08-18 10:32:09 +08002078
2079 if( session->ticket != NULL && session->ticket_len > 0 )
Jerry Yu438ddd82022-07-07 06:55:50 +00002080 {
2081 memcpy( p, session->ticket, session->ticket_len );
2082 p += session->ticket_len;
2083 }
2084 }
2085#endif /* MBEDTLS_SSL_CLI_C */
Jerry Yue36fdd62022-08-17 21:31:36 +08002086 return( 0 );
Jerry Yu438ddd82022-07-07 06:55:50 +00002087}
2088
2089MBEDTLS_CHECK_RETURN_CRITICAL
2090static int ssl_tls13_session_load( mbedtls_ssl_session *session,
2091 const unsigned char *buf,
2092 size_t len )
2093{
2094 const unsigned char *p = buf;
2095 const unsigned char *end = buf + len;
2096
2097 if( end - p < 9 )
2098 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2099 session->endpoint = p[0];
2100 session->ciphersuite = MBEDTLS_GET_UINT16_BE( p, 1 );
2101 session->ticket_age_add = MBEDTLS_GET_UINT32_BE( p, 3 );
2102 session->ticket_flags = p[7];
2103
2104 /* load resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002105 session->resumption_key_len = p[8];
Jerry Yu438ddd82022-07-07 06:55:50 +00002106 p += 9;
2107
Jerry Yubc7c1a42022-07-21 22:57:37 +08002108 if( end - p < session->resumption_key_len )
Jerry Yu438ddd82022-07-07 06:55:50 +00002109 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2110
Jerry Yubc7c1a42022-07-21 22:57:37 +08002111 if( sizeof( session->resumption_key ) < session->resumption_key_len )
Jerry Yu438ddd82022-07-07 06:55:50 +00002112 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yubc7c1a42022-07-21 22:57:37 +08002113 memcpy( session->resumption_key, p, session->resumption_key_len );
2114 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002115
2116#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
2117 if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
2118 {
2119 if( end - p < 8 )
2120 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2121 session->start = MBEDTLS_GET_UINT64_BE( p, 0 );
2122 p += 8;
2123 }
2124#endif /* MBEDTLS_HAVE_TIME */
2125
2126#if defined(MBEDTLS_SSL_CLI_C)
2127 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
2128 {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002129#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
2130 defined(MBEDTLS_SSL_SESSION_TICKETS)
2131 size_t hostname_len;
2132 /* load host name */
2133 if( end - p < 2 )
2134 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2135 hostname_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2136 p += 2;
2137
2138 if( end - p < ( long int )hostname_len )
2139 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2140 if( hostname_len > 0 )
2141 {
2142 session->hostname = mbedtls_calloc( 1, hostname_len );
2143 if( session->hostname == NULL )
2144 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2145 memcpy( session->hostname, p, hostname_len );
2146 p += hostname_len;
2147 }
2148#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION &&
2149 MBEDTLS_SSL_SESSION_TICKETS */
2150
Jerry Yu438ddd82022-07-07 06:55:50 +00002151#if defined(MBEDTLS_HAVE_TIME)
2152 if( end - p < 8 )
2153 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2154 session->ticket_received = MBEDTLS_GET_UINT64_BE( p, 0 );
2155 p += 8;
2156#endif
2157 if( end - p < 4 )
2158 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2159 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE( p, 0 );
2160 p += 4;
2161
2162 if( end - p < 2 )
2163 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2164 session->ticket_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2165 p += 2;
2166
2167 if( end - p < ( long int )session->ticket_len )
2168 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2169 if( session->ticket_len > 0 )
2170 {
2171 session->ticket = mbedtls_calloc( 1, session->ticket_len );
2172 if( session->ticket == NULL )
2173 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2174 memcpy( session->ticket, p, session->ticket_len );
2175 p += session->ticket_len;
2176 }
2177 }
2178#endif /* MBEDTLS_SSL_CLI_C */
2179
2180 return( 0 );
2181
2182}
2183#else /* MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yue36fdd62022-08-17 21:31:36 +08002184MBEDTLS_CHECK_RETURN_CRITICAL
2185static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
2186 unsigned char *buf,
2187 size_t buf_len,
2188 size_t *olen )
Jerry Yu251a12e2022-07-13 15:15:48 +08002189{
2190 ((void) session);
2191 ((void) buf);
2192 ((void) buf_len);
Jerry Yue36fdd62022-08-17 21:31:36 +08002193 *olen = 0;
2194 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Jerry Yu251a12e2022-07-13 15:15:48 +08002195}
Jerry Yu438ddd82022-07-07 06:55:50 +00002196
2197static int ssl_tls13_session_load( const mbedtls_ssl_session *session,
2198 unsigned char *buf,
2199 size_t buf_len )
2200{
2201 ((void) session);
2202 ((void) buf);
2203 ((void) buf_len);
2204 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2205}
2206#endif /* !MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yu251a12e2022-07-13 15:15:48 +08002207#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2208
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01002209psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002210 size_t taglen,
2211 psa_algorithm_t *alg,
2212 psa_key_type_t *key_type,
2213 size_t *key_size )
2214{
2215 switch ( mbedtls_cipher_type )
2216 {
2217 case MBEDTLS_CIPHER_AES_128_CBC:
2218 *alg = PSA_ALG_CBC_NO_PADDING;
2219 *key_type = PSA_KEY_TYPE_AES;
2220 *key_size = 128;
2221 break;
2222 case MBEDTLS_CIPHER_AES_128_CCM:
2223 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2224 *key_type = PSA_KEY_TYPE_AES;
2225 *key_size = 128;
2226 break;
2227 case MBEDTLS_CIPHER_AES_128_GCM:
2228 *alg = PSA_ALG_GCM;
2229 *key_type = PSA_KEY_TYPE_AES;
2230 *key_size = 128;
2231 break;
2232 case MBEDTLS_CIPHER_AES_192_CCM:
2233 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2234 *key_type = PSA_KEY_TYPE_AES;
2235 *key_size = 192;
2236 break;
2237 case MBEDTLS_CIPHER_AES_192_GCM:
2238 *alg = PSA_ALG_GCM;
2239 *key_type = PSA_KEY_TYPE_AES;
2240 *key_size = 192;
2241 break;
2242 case MBEDTLS_CIPHER_AES_256_CBC:
2243 *alg = PSA_ALG_CBC_NO_PADDING;
2244 *key_type = PSA_KEY_TYPE_AES;
2245 *key_size = 256;
2246 break;
2247 case MBEDTLS_CIPHER_AES_256_CCM:
2248 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2249 *key_type = PSA_KEY_TYPE_AES;
2250 *key_size = 256;
2251 break;
2252 case MBEDTLS_CIPHER_AES_256_GCM:
2253 *alg = PSA_ALG_GCM;
2254 *key_type = PSA_KEY_TYPE_AES;
2255 *key_size = 256;
2256 break;
2257 case MBEDTLS_CIPHER_ARIA_128_CBC:
2258 *alg = PSA_ALG_CBC_NO_PADDING;
2259 *key_type = PSA_KEY_TYPE_ARIA;
2260 *key_size = 128;
2261 break;
2262 case MBEDTLS_CIPHER_ARIA_128_CCM:
2263 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2264 *key_type = PSA_KEY_TYPE_ARIA;
2265 *key_size = 128;
2266 break;
2267 case MBEDTLS_CIPHER_ARIA_128_GCM:
2268 *alg = PSA_ALG_GCM;
2269 *key_type = PSA_KEY_TYPE_ARIA;
2270 *key_size = 128;
2271 break;
2272 case MBEDTLS_CIPHER_ARIA_192_CCM:
2273 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2274 *key_type = PSA_KEY_TYPE_ARIA;
2275 *key_size = 192;
2276 break;
2277 case MBEDTLS_CIPHER_ARIA_192_GCM:
2278 *alg = PSA_ALG_GCM;
2279 *key_type = PSA_KEY_TYPE_ARIA;
2280 *key_size = 192;
2281 break;
2282 case MBEDTLS_CIPHER_ARIA_256_CBC:
2283 *alg = PSA_ALG_CBC_NO_PADDING;
2284 *key_type = PSA_KEY_TYPE_ARIA;
2285 *key_size = 256;
2286 break;
2287 case MBEDTLS_CIPHER_ARIA_256_CCM:
2288 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2289 *key_type = PSA_KEY_TYPE_ARIA;
2290 *key_size = 256;
2291 break;
2292 case MBEDTLS_CIPHER_ARIA_256_GCM:
2293 *alg = PSA_ALG_GCM;
2294 *key_type = PSA_KEY_TYPE_ARIA;
2295 *key_size = 256;
2296 break;
2297 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
2298 *alg = PSA_ALG_CBC_NO_PADDING;
2299 *key_type = PSA_KEY_TYPE_CAMELLIA;
2300 *key_size = 128;
2301 break;
2302 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
2303 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2304 *key_type = PSA_KEY_TYPE_CAMELLIA;
2305 *key_size = 128;
2306 break;
2307 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
2308 *alg = PSA_ALG_GCM;
2309 *key_type = PSA_KEY_TYPE_CAMELLIA;
2310 *key_size = 128;
2311 break;
2312 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
2313 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2314 *key_type = PSA_KEY_TYPE_CAMELLIA;
2315 *key_size = 192;
2316 break;
2317 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
2318 *alg = PSA_ALG_GCM;
2319 *key_type = PSA_KEY_TYPE_CAMELLIA;
2320 *key_size = 192;
2321 break;
2322 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
2323 *alg = PSA_ALG_CBC_NO_PADDING;
2324 *key_type = PSA_KEY_TYPE_CAMELLIA;
2325 *key_size = 256;
2326 break;
2327 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
2328 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2329 *key_type = PSA_KEY_TYPE_CAMELLIA;
2330 *key_size = 256;
2331 break;
2332 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
2333 *alg = PSA_ALG_GCM;
2334 *key_type = PSA_KEY_TYPE_CAMELLIA;
2335 *key_size = 256;
2336 break;
2337 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
2338 *alg = PSA_ALG_CHACHA20_POLY1305;
2339 *key_type = PSA_KEY_TYPE_CHACHA20;
2340 *key_size = 256;
2341 break;
2342 case MBEDTLS_CIPHER_NULL:
2343 *alg = MBEDTLS_SSL_NULL_CIPHER;
2344 *key_type = 0;
2345 *key_size = 0;
2346 break;
2347 default:
2348 return PSA_ERROR_NOT_SUPPORTED;
2349 }
2350
2351 return PSA_SUCCESS;
2352}
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002353#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002354
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002355#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckera90658f2017-10-04 15:29:08 +01002356int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
2357 const unsigned char *dhm_P, size_t P_len,
2358 const unsigned char *dhm_G, size_t G_len )
2359{
Janos Follath865b3eb2019-12-16 11:46:15 +00002360 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01002361
Glenn Strausscee11292021-12-20 01:43:17 -05002362 mbedtls_mpi_free( &conf->dhm_P );
2363 mbedtls_mpi_free( &conf->dhm_G );
2364
Hanno Beckera90658f2017-10-04 15:29:08 +01002365 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
2366 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
2367 {
2368 mbedtls_mpi_free( &conf->dhm_P );
2369 mbedtls_mpi_free( &conf->dhm_G );
2370 return( ret );
2371 }
2372
2373 return( 0 );
2374}
Paul Bakker5121ce52009-01-03 21:22:43 +00002375
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002376int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00002377{
Janos Follath865b3eb2019-12-16 11:46:15 +00002378 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00002379
Glenn Strausscee11292021-12-20 01:43:17 -05002380 mbedtls_mpi_free( &conf->dhm_P );
2381 mbedtls_mpi_free( &conf->dhm_G );
2382
Gilles Peskinee5702482021-06-11 21:59:08 +02002383 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
2384 &conf->dhm_P ) ) != 0 ||
2385 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
2386 &conf->dhm_G ) ) != 0 )
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002387 {
2388 mbedtls_mpi_free( &conf->dhm_P );
2389 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00002390 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002391 }
Paul Bakker1b57b062011-01-06 15:48:19 +00002392
2393 return( 0 );
2394}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002395#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00002396
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002397#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
2398/*
2399 * Set the minimum length for Diffie-Hellman parameters
2400 */
2401void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
2402 unsigned int bitlen )
2403{
2404 conf->dhm_min_bitlen = bitlen;
2405}
2406#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
2407
Ronald Crone68ab4f2022-10-05 12:46:29 +02002408#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002409#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002410/*
2411 * Set allowed/preferred hashes for handshake signatures
2412 */
2413void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
2414 const int *hashes )
2415{
2416 conf->sig_hashes = hashes;
2417}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002418#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002419
Jerry Yuf017ee42022-01-12 15:49:48 +08002420/* Configure allowed signature algorithms for handshake */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002421void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
2422 const uint16_t* sig_algs )
2423{
Jerry Yuf017ee42022-01-12 15:49:48 +08002424#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2425 conf->sig_hashes = NULL;
2426#endif /* !MBEDTLS_DEPRECATED_REMOVED */
2427 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01002428}
Ronald Crone68ab4f2022-10-05 12:46:29 +02002429#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002430
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02002431#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01002432#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002433/*
2434 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01002435 *
2436 * mbedtls_ssl_setup() takes the provided list
2437 * and translates it to a list of IANA TLS group identifiers,
2438 * stored in ssl->handshake->group_list.
2439 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002440 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002441void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002442 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002443{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002444 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01002445 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002446}
Brett Warrene0edc842021-08-17 09:53:13 +01002447#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01002448#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002449
Brett Warrene0edc842021-08-17 09:53:13 +01002450/*
2451 * Set the allowed groups
2452 */
2453void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
2454 const uint16_t *group_list )
2455{
2456#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
2457 conf->curve_list = NULL;
2458#endif
2459 conf->group_list = group_list;
2460}
2461
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002462#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002463int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00002464{
Hanno Becker947194e2017-04-07 13:25:49 +01002465 /* Initialize to suppress unnecessary compiler warning */
2466 size_t hostname_len = 0;
2467
2468 /* Check if new hostname is valid before
2469 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01002470 if( hostname != NULL )
2471 {
2472 hostname_len = strlen( hostname );
2473
2474 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
2475 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2476 }
2477
2478 /* Now it's clear that we will overwrite the old hostname,
2479 * so we can free it safely */
2480
2481 if( ssl->hostname != NULL )
2482 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002483 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01002484 mbedtls_free( ssl->hostname );
2485 }
2486
2487 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01002488
Paul Bakker5121ce52009-01-03 21:22:43 +00002489 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01002490 {
2491 ssl->hostname = NULL;
2492 }
2493 else
2494 {
2495 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01002496 if( ssl->hostname == NULL )
2497 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002498
Hanno Becker947194e2017-04-07 13:25:49 +01002499 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002500
Hanno Becker947194e2017-04-07 13:25:49 +01002501 ssl->hostname[hostname_len] = '\0';
2502 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002503
2504 return( 0 );
2505}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01002506#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002507
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002508#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002509void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002510 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00002511 const unsigned char *, size_t),
2512 void *p_sni )
2513{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002514 conf->f_sni = f_sni;
2515 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00002516}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002517#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00002518
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002519#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002520int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002521{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002522 size_t cur_len, tot_len;
2523 const char **p;
2524
2525 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08002526 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
2527 * MUST NOT be truncated."
2528 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002529 */
2530 tot_len = 0;
2531 for( p = protos; *p != NULL; p++ )
2532 {
2533 cur_len = strlen( *p );
2534 tot_len += cur_len;
2535
Ronald Cron8216dd32020-04-23 16:41:44 +02002536 if( ( cur_len == 0 ) ||
2537 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
2538 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002539 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002540 }
2541
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002542 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002543
2544 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002545}
2546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002547const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002548{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002549 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002550}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002551#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002552
Johan Pascalb62bb512015-12-03 21:56:45 +01002553#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldoref72faf2018-07-12 11:54:20 +03002554void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
2555 int support_mki_value )
Ron Eldor591f1622018-01-22 12:30:04 +02002556{
2557 conf->dtls_srtp_mki_support = support_mki_value;
2558}
2559
Ron Eldoref72faf2018-07-12 11:54:20 +03002560int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
2561 unsigned char *mki_value,
Johan Pascalf6417ec2020-09-22 15:15:19 +02002562 uint16_t mki_len )
Ron Eldor591f1622018-01-22 12:30:04 +02002563{
Johan Pascal5ef72d22020-10-28 17:05:47 +01002564 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
Ron Eldora9788042018-12-05 11:04:31 +02002565 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002566 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ron Eldora9788042018-12-05 11:04:31 +02002567 }
Ron Eldor591f1622018-01-22 12:30:04 +02002568
2569 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
Ron Eldora9788042018-12-05 11:04:31 +02002570 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002571 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ron Eldora9788042018-12-05 11:04:31 +02002572 }
Ron Eldor591f1622018-01-22 12:30:04 +02002573
2574 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
2575 ssl->dtls_srtp_info.mki_len = mki_len;
Ron Eldora9788042018-12-05 11:04:31 +02002576 return( 0 );
Ron Eldor591f1622018-01-22 12:30:04 +02002577}
2578
Ron Eldoref72faf2018-07-12 11:54:20 +03002579int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
Johan Pascal253d0262020-09-22 13:04:45 +02002580 const mbedtls_ssl_srtp_profile *profiles )
Johan Pascalb62bb512015-12-03 21:56:45 +01002581{
Johan Pascal253d0262020-09-22 13:04:45 +02002582 const mbedtls_ssl_srtp_profile *p;
2583 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002584
Johan Pascal253d0262020-09-22 13:04:45 +02002585 /* check the profiles list: all entry must be valid,
2586 * its size cannot be more than the total number of supported profiles, currently 4 */
Johan Pascald387aa02020-09-23 18:47:56 +02002587 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
2588 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
2589 p++ )
Johan Pascald576fdb2020-09-22 10:39:53 +02002590 {
Johan Pascal5ef72d22020-10-28 17:05:47 +01002591 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
Johan Pascald576fdb2020-09-22 10:39:53 +02002592 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002593 list_size++;
2594 }
2595 else
2596 {
2597 /* unsupported value, stop parsing and set the size to an error value */
2598 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01002599 }
2600 }
2601
Johan Pascal5ef72d22020-10-28 17:05:47 +01002602 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
Johan Pascald387aa02020-09-23 18:47:56 +02002603 {
Johan Pascal253d0262020-09-22 13:04:45 +02002604 conf->dtls_srtp_profile_list = NULL;
2605 conf->dtls_srtp_profile_list_len = 0;
2606 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2607 }
2608
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002609 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02002610 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01002611
2612 return( 0 );
2613}
2614
Johan Pascal5ef72d22020-10-28 17:05:47 +01002615void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
2616 mbedtls_dtls_srtp_info *dtls_srtp_info )
Johan Pascalb62bb512015-12-03 21:56:45 +01002617{
Johan Pascal2258a4f2020-10-28 13:53:09 +01002618 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
2619 /* do not copy the mki value if there is no chosen profile */
Johan Pascal5ef72d22020-10-28 17:05:47 +01002620 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002621 {
Johan Pascal2258a4f2020-10-28 13:53:09 +01002622 dtls_srtp_info->mki_len = 0;
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002623 }
Johan Pascal2258a4f2020-10-28 13:53:09 +01002624 else
2625 {
2626 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Johan Pascal5ef72d22020-10-28 17:05:47 +01002627 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
2628 ssl->dtls_srtp_info.mki_len );
Johan Pascal2258a4f2020-10-28 13:53:09 +01002629 }
Johan Pascalb62bb512015-12-03 21:56:45 +01002630}
Johan Pascalb62bb512015-12-03 21:56:45 +01002631#endif /* MBEDTLS_SSL_DTLS_SRTP */
2632
Aditya Patwardhan3096f332022-07-26 14:31:46 +05302633#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002634void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00002635{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04002636 conf->max_tls_version = (major << 8) | minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00002637}
2638
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002639void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00002640{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04002641 conf->min_tls_version = (major << 8) | minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00002642}
Aditya Patwardhan3096f332022-07-26 14:31:46 +05302643#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker1d29fb52012-09-28 13:28:45 +00002644
Janos Follath088ce432017-04-10 12:42:31 +01002645#if defined(MBEDTLS_SSL_SRV_C)
2646void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
2647 char cert_req_ca_list )
2648{
2649 conf->cert_req_ca_list = cert_req_ca_list;
2650}
2651#endif
2652
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002653#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002654void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002655{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002656 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002657}
2658#endif
2659
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002660#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002661void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002662{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002663 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002664}
2665#endif
2666
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002667#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002668int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002669{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002670 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10002671 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002672 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002673 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002674 }
2675
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01002676 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002677
2678 return( 0 );
2679}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002680#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002681
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002682void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00002683{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002684 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00002685}
2686
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002687#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002688void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002689{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002690 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002691}
2692
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002693void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002694{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002695 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002696}
2697
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002698void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002699 const unsigned char period[8] )
2700{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002701 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002702}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002703#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002704
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002705#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002706#if defined(MBEDTLS_SSL_CLI_C)
2707void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002708{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01002709 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002710}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002711#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02002712
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002713#if defined(MBEDTLS_SSL_SRV_C)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08002714
Jerry Yud0766ec2022-09-22 10:46:57 +08002715#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08002716void mbedtls_ssl_conf_new_session_tickets( mbedtls_ssl_config *conf,
2717 uint16_t num_tickets )
2718{
Jerry Yud0766ec2022-09-22 10:46:57 +08002719 conf->new_session_tickets_count = num_tickets;
Jerry Yu1ad7ace2022-08-09 13:28:39 +08002720}
2721#endif
2722
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002723void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
2724 mbedtls_ssl_ticket_write_t *f_ticket_write,
2725 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
2726 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02002727{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002728 conf->f_ticket_write = f_ticket_write;
2729 conf->f_ticket_parse = f_ticket_parse;
2730 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02002731}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002732#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002733#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002734
Hanno Becker7e6c1782021-06-08 09:24:55 +01002735void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
2736 mbedtls_ssl_export_keys_t *f_export_keys,
2737 void *p_export_keys )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002738{
Hanno Becker7e6c1782021-06-08 09:24:55 +01002739 ssl->f_export_keys = f_export_keys;
2740 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03002741}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002742
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002743#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002744void mbedtls_ssl_conf_async_private_cb(
2745 mbedtls_ssl_config *conf,
2746 mbedtls_ssl_async_sign_t *f_async_sign,
2747 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
2748 mbedtls_ssl_async_resume_t *f_async_resume,
2749 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002750 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002751{
2752 conf->f_async_sign_start = f_async_sign;
2753 conf->f_async_decrypt_start = f_async_decrypt;
2754 conf->f_async_resume = f_async_resume;
2755 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002756 conf->p_async_config_data = async_config_data;
2757}
2758
Gilles Peskine8f97af72018-04-26 11:46:10 +02002759void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
2760{
2761 return( conf->p_async_config_data );
2762}
2763
Gilles Peskine1febfef2018-04-30 11:54:39 +02002764void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002765{
2766 if( ssl->handshake == NULL )
2767 return( NULL );
2768 else
2769 return( ssl->handshake->user_async_ctx );
2770}
2771
Gilles Peskine1febfef2018-04-30 11:54:39 +02002772void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002773 void *ctx )
2774{
2775 if( ssl->handshake != NULL )
2776 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002777}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002778#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002779
Paul Bakker5121ce52009-01-03 21:22:43 +00002780/*
2781 * SSL get accessors
2782 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02002783uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002784{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00002785 if( ssl->session != NULL )
2786 return( ssl->session->verify_result );
2787
2788 if( ssl->session_negotiate != NULL )
2789 return( ssl->session_negotiate->verify_result );
2790
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02002791 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00002792}
2793
Glenn Strauss8f526902022-01-13 00:04:49 -05002794int mbedtls_ssl_get_ciphersuite_id_from_ssl( const mbedtls_ssl_context *ssl )
2795{
2796 if( ssl == NULL || ssl->session == NULL )
2797 return( 0 );
2798
2799 return( ssl->session->ciphersuite );
2800}
2801
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002802const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00002803{
Paul Bakker926c8e42013-03-06 10:23:34 +01002804 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002805 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01002806
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002807 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00002808}
2809
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002810const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00002811{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002812#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002813 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002814 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002815 switch( ssl->tls_version )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002816 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002817 case MBEDTLS_SSL_VERSION_TLS1_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002818 return( "DTLSv1.2" );
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002819 default:
2820 return( "unknown (DTLS)" );
2821 }
2822 }
2823#endif
2824
Glenn Strauss60bfe602022-03-14 19:04:24 -04002825 switch( ssl->tls_version )
Paul Bakker43ca69c2011-01-15 17:35:19 +00002826 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002827 case MBEDTLS_SSL_VERSION_TLS1_2:
Paul Bakker1ef83d62012-04-11 12:09:53 +00002828 return( "TLSv1.2" );
Glenn Strauss60bfe602022-03-14 19:04:24 -04002829 case MBEDTLS_SSL_VERSION_TLS1_3:
Gilles Peskinec63a1e02022-01-13 01:10:24 +01002830 return( "TLSv1.3" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002831 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002832 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002833 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00002834}
2835
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002836#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002837size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
2838{
David Horstmann95d516f2021-05-04 18:36:56 +01002839 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002840 size_t read_mfl;
2841
2842 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
2843 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2844 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
2845 {
2846 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
2847 }
2848
2849 /* Check if a smaller max length was negotiated */
2850 if( ssl->session_out != NULL )
2851 {
2852 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
2853 if( read_mfl < max_len )
2854 {
2855 max_len = read_mfl;
2856 }
2857 }
2858
2859 // During a handshake, use the value being negotiated
2860 if( ssl->session_negotiate != NULL )
2861 {
2862 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2863 if( read_mfl < max_len )
2864 {
2865 max_len = read_mfl;
2866 }
2867 }
2868
2869 return( max_len );
2870}
2871
2872size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002873{
2874 size_t max_len;
2875
2876 /*
2877 * Assume mfl_code is correct since it was checked when set
2878 */
Angus Grattond8213d02016-05-25 20:56:48 +10002879 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002880
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002881 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002882 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10002883 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002884 {
Angus Grattond8213d02016-05-25 20:56:48 +10002885 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002886 }
2887
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002888 /* During a handshake, use the value being negotiated */
2889 if( ssl->session_negotiate != NULL &&
2890 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
2891 {
2892 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2893 }
2894
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002895 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002896}
2897#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2898
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002899#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002900size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002901{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04002902 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
2903 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2904 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
2905 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
2906 return ( 0 );
2907
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002908 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
2909 return( ssl->mtu );
2910
2911 if( ssl->mtu == 0 )
2912 return( ssl->handshake->mtu );
2913
2914 return( ssl->mtu < ssl->handshake->mtu ?
2915 ssl->mtu : ssl->handshake->mtu );
2916}
2917#endif /* MBEDTLS_SSL_PROTO_DTLS */
2918
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002919int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
2920{
2921 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
2922
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02002923#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2924 !defined(MBEDTLS_SSL_PROTO_DTLS)
2925 (void) ssl;
2926#endif
2927
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002928#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002929 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002930
2931 if( max_len > mfl )
2932 max_len = mfl;
2933#endif
2934
2935#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002936 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002937 {
Hanno Becker89490712020-02-05 10:50:12 +00002938 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002939 const int ret = mbedtls_ssl_get_record_expansion( ssl );
2940 const size_t overhead = (size_t) ret;
2941
2942 if( ret < 0 )
2943 return( ret );
2944
2945 if( mtu <= overhead )
2946 {
2947 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
2948 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2949 }
2950
2951 if( max_len > mtu - overhead )
2952 max_len = mtu - overhead;
2953 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002954#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002955
Hanno Becker0defedb2018-08-10 12:35:02 +01002956#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2957 !defined(MBEDTLS_SSL_PROTO_DTLS)
2958 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002959#endif
2960
2961 return( (int) max_len );
2962}
2963
Hanno Becker2d8e99b2021-04-21 06:19:50 +01002964int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
2965{
2966 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
2967
2968#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2969 (void) ssl;
2970#endif
2971
2972#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2973 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
2974
2975 if( max_len > mfl )
2976 max_len = mfl;
2977#endif
2978
2979 return( (int) max_len );
2980}
2981
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002982#if defined(MBEDTLS_X509_CRT_PARSE_C)
2983const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00002984{
2985 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002986 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00002987
Hanno Beckere6824572019-02-07 13:18:46 +00002988#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002989 return( ssl->session->peer_cert );
Hanno Beckere6824572019-02-07 13:18:46 +00002990#else
2991 return( NULL );
2992#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002993}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002994#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002995
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002996#if defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerf852b1c2019-02-05 11:42:30 +00002997int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
2998 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002999{
Hanno Beckere810bbc2021-05-14 16:01:05 +01003000 int ret;
3001
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003002 if( ssl == NULL ||
3003 dst == NULL ||
3004 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003005 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003006 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003007 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003008 }
3009
Hanno Beckere810bbc2021-05-14 16:01:05 +01003010 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
3011 * idempotent: Each session can only be exported once.
3012 *
3013 * (This is in preparation for TLS 1.3 support where we will
3014 * need the ability to export multiple sessions (aka tickets),
3015 * which will be achieved by calling mbedtls_ssl_get_session()
3016 * multiple times until it fails.)
3017 *
3018 * Check whether we have already exported the current session,
3019 * and fail if so.
3020 */
3021 if( ssl->session->exported == 1 )
3022 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3023
3024 ret = mbedtls_ssl_session_copy( dst, ssl->session );
3025 if( ret != 0 )
3026 return( ret );
3027
3028 /* Remember that we've exported the session. */
3029 ssl->session->exported = 1;
3030 return( 0 );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003031}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003032#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003033
Paul Bakker5121ce52009-01-03 21:22:43 +00003034/*
Hanno Beckera835da52019-05-16 12:39:07 +01003035 * Define ticket header determining Mbed TLS version
3036 * and structure of the ticket.
3037 */
3038
Hanno Becker94ef3b32019-05-16 12:50:45 +01003039/*
Hanno Becker50b59662019-05-28 14:30:45 +01003040 * Define bitflag determining compile-time settings influencing
3041 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01003042 */
3043
Hanno Becker50b59662019-05-28 14:30:45 +01003044#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01003045#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01003046#else
Hanno Becker3e088662019-05-29 11:10:18 +01003047#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003048#endif /* MBEDTLS_HAVE_TIME */
3049
3050#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01003051#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003052#else
Hanno Becker3e088662019-05-29 11:10:18 +01003053#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003054#endif /* MBEDTLS_X509_CRT_PARSE_C */
3055
3056#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01003057#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003058#else
Hanno Becker3e088662019-05-29 11:10:18 +01003059#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003060#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
3061
3062#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01003063#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003064#else
Hanno Becker3e088662019-05-29 11:10:18 +01003065#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003066#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
3067
Hanno Becker94ef3b32019-05-16 12:50:45 +01003068#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01003069#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003070#else
Hanno Becker3e088662019-05-29 11:10:18 +01003071#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003072#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
3073
Hanno Becker94ef3b32019-05-16 12:50:45 +01003074#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3075#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
3076#else
3077#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
3078#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3079
Hanno Becker3e088662019-05-29 11:10:18 +01003080#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
3081#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
3082#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
3083#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01003084#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
3085#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01003086
Hanno Becker50b59662019-05-28 14:30:45 +01003087#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Becker3e088662019-05-29 11:10:18 +01003088 ( (uint16_t) ( \
3089 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
3090 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
3091 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
3092 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
Hanno Becker3e088662019-05-29 11:10:18 +01003093 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Beckerbe34e8e2019-06-04 09:43:16 +01003094 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
Hanno Becker94ef3b32019-05-16 12:50:45 +01003095
Hanno Beckerf8787072019-05-16 12:41:07 +01003096static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01003097 MBEDTLS_VERSION_MAJOR,
3098 MBEDTLS_VERSION_MINOR,
3099 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01003100 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3101 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
Hanno Beckerf8787072019-05-16 12:41:07 +01003102};
Hanno Beckera835da52019-05-16 12:39:07 +01003103
3104/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003105 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02003106 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003107 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003108 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01003109 *
Hanno Beckerdce50972021-08-01 05:39:23 +01003110 * opaque mbedtls_version[3]; // library version: major, minor, patch
3111 * opaque session_format[2]; // library-version specific 16-bit field
3112 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003113 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01003114 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003115 * Note: When updating the format, remember to keep
3116 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003117 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003118 * // In this version, `session_format` determines
3119 * // the setting of those compile-time
3120 * // configuration options which influence
3121 * // the structure of mbedtls_ssl_session.
3122 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003123 * uint8_t minor_ver; // Protocol minor version. Possible values:
3124 * // - TLS 1.2 (3)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003125 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003126 * select (serialized_session.tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003127 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003128 * case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003129 * serialized_session_tls12 data;
3130 *
3131 * };
3132 *
3133 * } serialized_session;
3134 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003135 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003136
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003137MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003138static int ssl_session_save( const mbedtls_ssl_session *session,
3139 unsigned char omit_header,
3140 unsigned char *buf,
3141 size_t buf_len,
3142 size_t *olen )
3143{
3144 unsigned char *p = buf;
3145 size_t used = 0;
Jerry Yu251a12e2022-07-13 15:15:48 +08003146 size_t remaining_len;
Jerry Yue36fdd62022-08-17 21:31:36 +08003147#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3148 size_t out_len;
3149 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3150#endif
Jerry Yu438ddd82022-07-07 06:55:50 +00003151 if( session == NULL )
3152 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3153
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003154 if( !omit_header )
3155 {
3156 /*
3157 * Add Mbed TLS version identifier
3158 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003159 used += sizeof( ssl_serialized_session_header );
3160
3161 if( used <= buf_len )
3162 {
3163 memcpy( p, ssl_serialized_session_header,
3164 sizeof( ssl_serialized_session_header ) );
3165 p += sizeof( ssl_serialized_session_header );
3166 }
3167 }
3168
3169 /*
3170 * TLS version identifier
3171 */
3172 used += 1;
3173 if( used <= buf_len )
3174 {
Glenn Straussda7851c2022-03-14 13:29:48 -04003175 *p++ = MBEDTLS_BYTE_0( session->tls_version );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003176 }
3177
3178 /* Forward to version-specific serialization routine. */
Jerry Yufca4d572022-07-21 10:37:48 +08003179 remaining_len = (buf_len >= used) ? buf_len - used : 0;
Glenn Straussda7851c2022-03-14 13:29:48 -04003180 switch( session->tls_version )
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003181 {
3182#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Glenn Straussda7851c2022-03-14 13:29:48 -04003183 case MBEDTLS_SSL_VERSION_TLS1_2:
Jerry Yu438ddd82022-07-07 06:55:50 +00003184 used += ssl_tls12_session_save( session, p, remaining_len );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003185 break;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003186#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3187
Jerry Yu251a12e2022-07-13 15:15:48 +08003188#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3189 case MBEDTLS_SSL_VERSION_TLS1_3:
Jerry Yue36fdd62022-08-17 21:31:36 +08003190 ret = ssl_tls13_session_save( session, p, remaining_len, &out_len );
3191 if( ret != 0 && ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
Jerry Yue36fdd62022-08-17 21:31:36 +08003192 return( ret );
Jerry Yue36fdd62022-08-17 21:31:36 +08003193 used += out_len;
Jerry Yu251a12e2022-07-13 15:15:48 +08003194 break;
Jerry Yu251a12e2022-07-13 15:15:48 +08003195#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3196
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003197 default:
3198 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3199 }
3200
3201 *olen = used;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02003202 if( used > buf_len )
3203 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003204
3205 return( 0 );
3206}
3207
3208/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003209 * Public wrapper for ssl_session_save()
3210 */
3211int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
3212 unsigned char *buf,
3213 size_t buf_len,
3214 size_t *olen )
3215{
3216 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
3217}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003218
Jerry Yuf1b23ca2022-02-18 11:48:47 +08003219/*
3220 * Deserialize session, see mbedtls_ssl_session_save() for format.
3221 *
3222 * This internal version is wrapped by a public function that cleans up in
3223 * case of error, and has an extra option omit_header.
3224 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003225MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003226static int ssl_session_load( mbedtls_ssl_session *session,
3227 unsigned char omit_header,
3228 const unsigned char *buf,
3229 size_t len )
3230{
3231 const unsigned char *p = buf;
3232 const unsigned char * const end = buf + len;
Jerry Yu438ddd82022-07-07 06:55:50 +00003233 size_t remaining_len;
3234
3235
3236 if( session == NULL )
3237 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003238
3239 if( !omit_header )
3240 {
3241 /*
3242 * Check Mbed TLS version identifier
3243 */
3244
3245 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
3246 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3247
3248 if( memcmp( p, ssl_serialized_session_header,
3249 sizeof( ssl_serialized_session_header ) ) != 0 )
3250 {
3251 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
3252 }
3253 p += sizeof( ssl_serialized_session_header );
3254 }
3255
3256 /*
3257 * TLS version identifier
3258 */
3259 if( 1 > (size_t)( end - p ) )
3260 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Glenn Straussda7851c2022-03-14 13:29:48 -04003261 session->tls_version = 0x0300 | *p++;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003262
3263 /* Dispatch according to TLS version. */
Jerry Yu438ddd82022-07-07 06:55:50 +00003264 remaining_len = ( end - p );
Glenn Straussda7851c2022-03-14 13:29:48 -04003265 switch( session->tls_version )
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003266 {
3267#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Glenn Straussda7851c2022-03-14 13:29:48 -04003268 case MBEDTLS_SSL_VERSION_TLS1_2:
Jerry Yu438ddd82022-07-07 06:55:50 +00003269 return( ssl_tls12_session_load( session, p, remaining_len ) );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003270#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3271
Jerry Yu438ddd82022-07-07 06:55:50 +00003272#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3273 case MBEDTLS_SSL_VERSION_TLS1_3:
3274 return( ssl_tls13_session_load( session, p, remaining_len ) );
3275#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3276
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003277 default:
3278 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3279 }
3280}
3281
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003282/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003283 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003284 */
3285int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
3286 const unsigned char *buf,
3287 size_t len )
3288{
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003289 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003290
3291 if( ret != 0 )
3292 mbedtls_ssl_session_free( session );
3293
3294 return( ret );
3295}
3296
3297/*
Paul Bakker1961b702013-01-25 14:49:24 +01003298 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00003299 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003300MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker41934dd2021-08-07 19:13:43 +01003301static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
3302{
3303 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3304
Ronald Cron66dbf912022-02-02 15:33:46 +01003305 /*
3306 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01003307 * that were written into the output buffer by the previous handshake step,
3308 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01003309 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
3310 * We proceed to the next handshake step only when all data from the
3311 * previous one have been sent to the peer, thus we make sure that this is
3312 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
3313 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
3314 * we have to wait before to go ahead.
3315 * In the case of TLS 1.3, handshake step handlers do not send data to the
3316 * peer. Data are only sent here and through
3317 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
Andrzej Kurek5c65c572022-04-13 14:28:52 -04003318 * alert occurred.
Ronald Cron66dbf912022-02-02 15:33:46 +01003319 */
Hanno Becker41934dd2021-08-07 19:13:43 +01003320 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3321 return( ret );
3322
3323#if defined(MBEDTLS_SSL_PROTO_DTLS)
3324 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3325 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
3326 {
3327 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3328 return( ret );
3329 }
3330#endif /* MBEDTLS_SSL_PROTO_DTLS */
3331
3332 return( ret );
3333}
3334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003335int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003336{
Hanno Becker41934dd2021-08-07 19:13:43 +01003337 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00003338
Hanno Becker41934dd2021-08-07 19:13:43 +01003339 if( ssl == NULL ||
3340 ssl->conf == NULL ||
3341 ssl->handshake == NULL ||
Paul Elliott27b0d942022-03-18 21:55:32 +00003342 mbedtls_ssl_is_handshake_over( ssl ) == 1 )
Hanno Becker41934dd2021-08-07 19:13:43 +01003343 {
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003344 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker41934dd2021-08-07 19:13:43 +01003345 }
3346
3347 ret = ssl_prepare_handshake_step( ssl );
3348 if( ret != 0 )
3349 return( ret );
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003350
Jerry Yue7047812021-09-13 19:26:39 +08003351 ret = mbedtls_ssl_handle_pending_alert( ssl );
3352 if( ret != 0 )
3353 goto cleanup;
3354
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003355#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003356 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Jerry Yub9930e72021-08-06 17:11:51 +08003357 {
Ronald Cron27c85e72022-03-08 11:37:55 +01003358 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %s",
3359 mbedtls_ssl_states_str( ssl->state ) ) );
Jerry Yub9930e72021-08-06 17:11:51 +08003360
Ronald Cron9f0fba32022-02-10 16:45:15 +01003361 switch( ssl->state )
3362 {
3363 case MBEDTLS_SSL_HELLO_REQUEST:
3364 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
3365 break;
Jerry Yub9930e72021-08-06 17:11:51 +08003366
Ronald Cron9f0fba32022-02-10 16:45:15 +01003367 case MBEDTLS_SSL_CLIENT_HELLO:
3368 ret = mbedtls_ssl_write_client_hello( ssl );
3369 break;
3370
3371 default:
3372#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Glenn Strauss60bfe602022-03-14 19:04:24 -04003373 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Ronald Cron9f0fba32022-02-10 16:45:15 +01003374 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
3375 else
3376 ret = mbedtls_ssl_handshake_client_step( ssl );
3377#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
3378 ret = mbedtls_ssl_handshake_client_step( ssl );
3379#else
3380 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
3381#endif
3382 }
Jerry Yub9930e72021-08-06 17:11:51 +08003383 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003384#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003385#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003386 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Jerry Yub9930e72021-08-06 17:11:51 +08003387 {
Ronald Cron6f135e12021-12-08 16:57:54 +01003388#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yub9930e72021-08-06 17:11:51 +08003389 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yu27561932021-08-27 17:07:38 +08003390 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
Ronald Cron6f135e12021-12-08 16:57:54 +01003391#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08003392
3393#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3394 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
3395 ret = mbedtls_ssl_handshake_server_step( ssl );
3396#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3397 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003398#endif
3399
Jerry Yue7047812021-09-13 19:26:39 +08003400 if( ret != 0 )
3401 {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08003402 /* handshake_step return error. And it is same
3403 * with alert_reason.
3404 */
Jerry Yu3bf1f972021-09-22 21:37:18 +08003405 if( ssl->send_alert )
Jerry Yue7047812021-09-13 19:26:39 +08003406 {
Jerry Yu3bf1f972021-09-22 21:37:18 +08003407 ret = mbedtls_ssl_handle_pending_alert( ssl );
Jerry Yue7047812021-09-13 19:26:39 +08003408 goto cleanup;
3409 }
3410 }
3411
3412cleanup:
Paul Bakker1961b702013-01-25 14:49:24 +01003413 return( ret );
3414}
3415
3416/*
3417 * Perform the SSL handshake
3418 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003419int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01003420{
3421 int ret = 0;
3422
Hanno Beckera817ea42020-10-20 15:20:23 +01003423 /* Sanity checks */
3424
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003425 if( ssl == NULL || ssl->conf == NULL )
3426 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3427
Hanno Beckera817ea42020-10-20 15:20:23 +01003428#if defined(MBEDTLS_SSL_PROTO_DTLS)
3429 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3430 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
3431 {
3432 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
3433 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
3434 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3435 }
3436#endif /* MBEDTLS_SSL_PROTO_DTLS */
3437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003438 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01003439
Hanno Beckera817ea42020-10-20 15:20:23 +01003440 /* Main handshake loop */
Paul Elliott27b0d942022-03-18 21:55:32 +00003441 while( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01003442 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003443 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003444
3445 if( ret != 0 )
3446 break;
3447 }
3448
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003449 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003450
3451 return( ret );
3452}
3453
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003454#if defined(MBEDTLS_SSL_RENEGOTIATION)
3455#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00003456/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003457 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00003458 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003459MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003460static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003461{
Janos Follath865b3eb2019-12-16 11:46:15 +00003462 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003463
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003464 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003465
3466 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003467 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3468 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003469
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003470 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003471 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003472 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003473 return( ret );
3474 }
3475
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003476 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003477
3478 return( 0 );
3479}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003480#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003481
3482/*
3483 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003484 * - any side: calling mbedtls_ssl_renegotiate(),
3485 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
3486 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02003487 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003488 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003489 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003490 */
Hanno Becker40cdaa12020-02-05 10:48:27 +00003491int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003492{
Janos Follath865b3eb2019-12-16 11:46:15 +00003493 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00003494
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003495 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003496
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003497 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3498 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003499
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003500 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
3501 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003502#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003503 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003504 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003505 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003506 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003507 ssl->handshake->out_msg_seq = 1;
3508 else
3509 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003510 }
3511#endif
3512
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003513 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3514 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00003515
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003516 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00003517 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003518 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003519 return( ret );
3520 }
3521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003522 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003523
3524 return( 0 );
3525}
3526
3527/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003528 * Renegotiate current connection on client,
3529 * or request renegotiation on server
3530 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003531int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003532{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003533 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003534
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003535 if( ssl == NULL || ssl->conf == NULL )
3536 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3537
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003538#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003539 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003540 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003541 {
Paul Elliott27b0d942022-03-18 21:55:32 +00003542 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003543 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003544
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003545 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003546
3547 /* Did we already try/start sending HelloRequest? */
3548 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003549 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003550
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003551 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003552 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003553#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003554
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003555#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003556 /*
3557 * On client, either start the renegotiation process or,
3558 * if already in progress, continue the handshake
3559 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003560 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003561 {
Paul Elliott27b0d942022-03-18 21:55:32 +00003562 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003563 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003564
Hanno Becker40cdaa12020-02-05 10:48:27 +00003565 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003566 {
Hanno Becker40cdaa12020-02-05 10:48:27 +00003567 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003568 return( ret );
3569 }
3570 }
3571 else
3572 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003573 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003574 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003575 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003576 return( ret );
3577 }
3578 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003579#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003580
Paul Bakker37ce0ff2013-10-31 14:32:04 +01003581 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003582}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003583#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003584
Gilles Peskine9b562d52018-04-25 20:32:43 +02003585void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003586{
Gilles Peskine9b562d52018-04-25 20:32:43 +02003587 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3588
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003589 if( handshake == NULL )
3590 return;
3591
Brett Warrene0edc842021-08-17 09:53:13 +01003592#if defined(MBEDTLS_ECP_C)
3593#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3594 if ( ssl->handshake->group_list_heap_allocated )
3595 mbedtls_free( (void*) handshake->group_list );
3596 handshake->group_list = NULL;
3597#endif /* MBEDTLS_DEPRECATED_REMOVED */
3598#endif /* MBEDTLS_ECP_C */
3599
Ronald Crone68ab4f2022-10-05 12:46:29 +02003600#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08003601#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3602 if ( ssl->handshake->sig_algs_heap_allocated )
3603 mbedtls_free( (void*) handshake->sig_algs );
3604 handshake->sig_algs = NULL;
3605#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00003606#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3607 if( ssl->handshake->certificate_request_context )
3608 {
3609 mbedtls_free( (void*) handshake->certificate_request_context );
3610 }
3611#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02003612#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yuf017ee42022-01-12 15:49:48 +08003613
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003614#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3615 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
3616 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003617 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003618 handshake->async_in_progress = 0;
3619 }
3620#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3621
Andrzej Kurek25f27152022-08-17 16:09:31 -04003622#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003623#if defined(MBEDTLS_USE_PSA_CRYPTO)
3624 psa_hash_abort( &handshake->fin_sha256_psa );
3625#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003626 mbedtls_sha256_free( &handshake->fin_sha256 );
3627#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003628#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04003629#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003630#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05003631 psa_hash_abort( &handshake->fin_sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05003632#else
Andrzej Kureka242e832022-08-11 10:03:14 -04003633 mbedtls_sha512_free( &handshake->fin_sha384 );
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003634#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003635#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003637#if defined(MBEDTLS_DHM_C)
3638 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00003639#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +02003640#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003641 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02003642#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003643#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003644 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02003645#if defined(MBEDTLS_SSL_CLI_C)
3646 mbedtls_free( handshake->ecjpake_cache );
3647 handshake->ecjpake_cache = NULL;
3648 handshake->ecjpake_cache_len = 0;
3649#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003650#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02003651
Janos Follath4ae5c292016-02-10 11:27:43 +00003652#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
3653 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02003654 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003655 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02003656#endif
3657
Ronald Cron73fe8df2022-10-05 14:31:43 +02003658#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02003659#if defined(MBEDTLS_USE_PSA_CRYPTO)
3660 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
3661 {
3662 /* The maintenance of the external PSK key slot is the
3663 * user's responsibility. */
3664 if( ssl->handshake->psk_opaque_is_internal )
3665 {
3666 psa_destroy_key( ssl->handshake->psk_opaque );
3667 ssl->handshake->psk_opaque_is_internal = 0;
3668 }
3669 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
3670 }
Neil Armstronge952a302022-05-03 10:22:14 +02003671#else
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003672 if( handshake->psk != NULL )
3673 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003674 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003675 mbedtls_free( handshake->psk );
3676 }
Neil Armstronge952a302022-05-03 10:22:14 +02003677#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Cron73fe8df2022-10-05 14:31:43 +02003678#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003679
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003680#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3681 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02003682 /*
3683 * Free only the linked list wrapper, not the keys themselves
3684 * since the belong to the SNI callback
3685 */
Glenn Strauss36872db2022-01-22 05:06:31 -05003686 ssl_key_cert_free( handshake->sni_key_cert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003687#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02003688
Gilles Peskineeccd8882020-03-10 12:19:08 +01003689#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02003690 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Becker3dad3112019-02-05 17:19:52 +00003691 if( handshake->ecrs_peer_cert != NULL )
3692 {
3693 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
3694 mbedtls_free( handshake->ecrs_peer_cert );
3695 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02003696#endif
3697
Hanno Becker75173122019-02-06 16:18:31 +00003698#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3699 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3700 mbedtls_pk_free( &handshake->peer_pubkey );
3701#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3702
XiaokangQian9b93c0d2022-02-09 06:02:25 +00003703#if defined(MBEDTLS_SSL_CLI_C) && \
3704 ( defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
3705 mbedtls_free( handshake->cookie );
3706#endif /* MBEDTLS_SSL_CLI_C &&
3707 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00003708
3709#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker533ab5f2020-02-05 10:49:13 +00003710 mbedtls_ssl_flight_free( handshake->flight );
3711 mbedtls_ssl_buffering_free( ssl );
XiaokangQian8499b6c2022-01-27 09:00:11 +00003712#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02003713
Ronald Cronf12b81d2022-03-15 10:42:41 +01003714#if defined(MBEDTLS_ECDH_C) && \
3715 ( defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
Neil Armstrongf716a702022-04-04 11:23:46 +02003716 if( handshake->ecdh_psa_privkey_is_external == 0 )
Neil Armstrong8113d252022-03-23 10:57:04 +01003717 psa_destroy_key( handshake->ecdh_psa_privkey );
Hanno Becker4a63ed42019-01-08 11:39:35 +00003718#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
3719
Ronald Cron6f135e12021-12-08 16:57:54 +01003720#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yua1a568c2021-11-09 10:17:21 +08003721 mbedtls_ssl_transform_free( handshake->transform_handshake );
3722 mbedtls_ssl_transform_free( handshake->transform_earlydata );
Jerry Yuba9c7272021-10-30 11:54:10 +08003723 mbedtls_free( handshake->transform_earlydata );
3724 mbedtls_free( handshake->transform_handshake );
Ronald Cron6f135e12021-12-08 16:57:54 +01003725#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08003726
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003727
3728#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3729 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
3730 * processes datagrams and the fact that a datagram is allowed to have
3731 * several records in it, it is possible that the I/O buffers are not
3732 * empty at this stage */
Andrzej Kurek4a063792020-10-21 15:08:44 +02003733 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
3734 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003735#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01003736
Jerry Yuba9c7272021-10-30 11:54:10 +08003737 /* mbedtls_platform_zeroize MUST be last one in this function */
3738 mbedtls_platform_zeroize( handshake,
3739 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003740}
3741
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003742void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00003743{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003744 if( session == NULL )
3745 return;
3746
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003747#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker1294a0b2019-02-05 12:38:15 +00003748 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +02003749#endif
Paul Bakker0a597072012-09-25 21:55:46 +00003750
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003751#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00003752#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
3753 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00003754 mbedtls_free( session->hostname );
3755#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003756 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02003757#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02003758
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003759 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003760}
3761
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02003762#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003763
3764#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3765#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
3766#else
3767#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
3768#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3769
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003770#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003771
3772#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3773#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
3774#else
3775#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
3776#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3777
3778#if defined(MBEDTLS_SSL_ALPN)
3779#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
3780#else
3781#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
3782#endif /* MBEDTLS_SSL_ALPN */
3783
3784#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
3785#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
3786#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
3787#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
3788
3789#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
3790 ( (uint32_t) ( \
3791 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
3792 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
3793 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
3794 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
3795 0u ) )
3796
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003797static unsigned char ssl_serialized_context_header[] = {
3798 MBEDTLS_VERSION_MAJOR,
3799 MBEDTLS_VERSION_MINOR,
3800 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01003801 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3802 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3803 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3804 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3805 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003806};
3807
Paul Bakker5121ce52009-01-03 21:22:43 +00003808/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003809 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003810 *
3811 * The format of the serialized data is:
3812 * (in the presentation language of TLS, RFC 8446 section 3)
3813 *
3814 * // header
3815 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003816 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003817 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003818 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003819 * Note: When updating the format, remember to keep these
3820 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003821 *
3822 * // session sub-structure
3823 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
3824 * // transform sub-structure
3825 * uint8 random[64]; // ServerHello.random+ClientHello.random
3826 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
3827 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
3828 * // fields from ssl_context
3829 * uint32 badmac_seen; // DTLS: number of records with failing MAC
3830 * uint64 in_window_top; // DTLS: last validated record seq_num
3831 * uint64 in_window; // DTLS: bitmask for replay protection
3832 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
3833 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
3834 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
3835 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
3836 *
3837 * Note that many fields of the ssl_context or sub-structures are not
3838 * serialized, as they fall in one of the following categories:
3839 *
3840 * 1. forced value (eg in_left must be 0)
3841 * 2. pointer to dynamically-allocated memory (eg session, transform)
3842 * 3. value can be re-derived from other data (eg session keys from MS)
3843 * 4. value was temporary (eg content of input buffer)
3844 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003845 */
3846int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
3847 unsigned char *buf,
3848 size_t buf_len,
3849 size_t *olen )
3850{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003851 unsigned char *p = buf;
3852 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003853 size_t session_len;
3854 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003855
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003856 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003857 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
3858 * this function's documentation.
3859 *
3860 * These are due to assumptions/limitations in the implementation. Some of
3861 * them are likely to stay (no handshake in progress) some might go away
3862 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003863 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003864 /* The initial handshake must be over */
Paul Elliott27b0d942022-03-18 21:55:32 +00003865 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003866 {
3867 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003868 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003869 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003870 if( ssl->handshake != NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003871 {
3872 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003873 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003874 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003875 /* Double-check that sub-structures are indeed ready */
3876 if( ssl->transform == NULL || ssl->session == NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003877 {
3878 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003879 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003880 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003881 /* There must be no pending incoming or outgoing data */
3882 if( mbedtls_ssl_check_pending( ssl ) != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003883 {
3884 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003885 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003886 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003887 if( ssl->out_left != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003888 {
3889 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003890 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003891 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003892 /* Protocol must be DLTS, not TLS */
3893 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003894 {
3895 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003896 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003897 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003898 /* Version must be 1.2 */
Glenn Strauss60bfe602022-03-14 19:04:24 -04003899 if( ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003900 {
3901 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003902 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003903 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003904 /* We must be using an AEAD ciphersuite */
3905 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003906 {
3907 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003908 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003909 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003910 /* Renegotiation must not be enabled */
3911#if defined(MBEDTLS_SSL_RENEGOTIATION)
3912 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003913 {
3914 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003915 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003916 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003917#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003918
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003919 /*
3920 * Version and format identifier
3921 */
3922 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003923
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003924 if( used <= buf_len )
3925 {
3926 memcpy( p, ssl_serialized_context_header,
3927 sizeof( ssl_serialized_context_header ) );
3928 p += sizeof( ssl_serialized_context_header );
3929 }
3930
3931 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003932 * Session (length + data)
3933 */
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003934 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003935 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
3936 return( ret );
3937
3938 used += 4 + session_len;
3939 if( used <= buf_len )
3940 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003941 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
3942 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003943
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003944 ret = ssl_session_save( ssl->session, 1,
3945 p, session_len, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003946 if( ret != 0 )
3947 return( ret );
3948
3949 p += session_len;
3950 }
3951
3952 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003953 * Transform
3954 */
3955 used += sizeof( ssl->transform->randbytes );
3956 if( used <= buf_len )
3957 {
3958 memcpy( p, ssl->transform->randbytes,
3959 sizeof( ssl->transform->randbytes ) );
3960 p += sizeof( ssl->transform->randbytes );
3961 }
3962
3963#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3964 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
3965 if( used <= buf_len )
3966 {
3967 *p++ = ssl->transform->in_cid_len;
3968 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
3969 p += ssl->transform->in_cid_len;
3970
3971 *p++ = ssl->transform->out_cid_len;
3972 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
3973 p += ssl->transform->out_cid_len;
3974 }
3975#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3976
3977 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003978 * Saved fields from top-level ssl_context structure
3979 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003980 used += 4;
3981 if( used <= buf_len )
3982 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003983 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
3984 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003985 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003986
3987#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3988 used += 16;
3989 if( used <= buf_len )
3990 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003991 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
3992 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003993
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003994 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
3995 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003996 }
3997#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3998
3999#if defined(MBEDTLS_SSL_PROTO_DTLS)
4000 used += 1;
4001 if( used <= buf_len )
4002 {
4003 *p++ = ssl->disable_datagram_packing;
4004 }
4005#endif /* MBEDTLS_SSL_PROTO_DTLS */
4006
Jerry Yuae0b2e22021-10-08 15:21:19 +08004007 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004008 if( used <= buf_len )
4009 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08004010 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
4011 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004012 }
4013
4014#if defined(MBEDTLS_SSL_PROTO_DTLS)
4015 used += 2;
4016 if( used <= buf_len )
4017 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004018 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
4019 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004020 }
4021#endif /* MBEDTLS_SSL_PROTO_DTLS */
4022
4023#if defined(MBEDTLS_SSL_ALPN)
4024 {
4025 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnardf041f4e2019-07-24 00:58:27 +02004026 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004027 : 0;
4028
4029 used += 1 + alpn_len;
4030 if( used <= buf_len )
4031 {
4032 *p++ = alpn_len;
4033
4034 if( ssl->alpn_chosen != NULL )
4035 {
4036 memcpy( p, ssl->alpn_chosen, alpn_len );
4037 p += alpn_len;
4038 }
4039 }
4040 }
4041#endif /* MBEDTLS_SSL_ALPN */
4042
4043 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004044 * Done
4045 */
4046 *olen = used;
4047
4048 if( used > buf_len )
4049 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004050
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004051 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
4052
Hanno Becker43aefe22020-02-05 10:44:56 +00004053 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004054}
4055
4056/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004057 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004058 *
4059 * This internal version is wrapped by a public function that cleans up in
4060 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004061 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004062MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004063static int ssl_context_load( mbedtls_ssl_context *ssl,
4064 const unsigned char *buf,
4065 size_t len )
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004066{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004067 const unsigned char *p = buf;
4068 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004069 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00004070 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004071#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek894edde2022-09-29 06:31:14 -04004072 tls_prf_fn prf_func = NULL;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004073#endif
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004074
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004075 /*
4076 * The context should have been freshly setup or reset.
4077 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02004078 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004079 * renegotiating, or if the user mistakenly loaded a session first.)
4080 */
4081 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
4082 ssl->session != NULL )
4083 {
4084 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4085 }
4086
4087 /*
4088 * We can't check that the config matches the initial one, but we can at
4089 * least check it matches the requirements for serializing.
4090 */
4091 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004092 ssl->conf->max_tls_version < MBEDTLS_SSL_VERSION_TLS1_2 ||
4093 ssl->conf->min_tls_version > MBEDTLS_SSL_VERSION_TLS1_2 ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004094#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02004095 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004096#endif
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02004097 0 )
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004098 {
4099 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4100 }
4101
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004102 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
4103
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004104 /*
4105 * Check version identifier
4106 */
4107 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
4108 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4109
4110 if( memcmp( p, ssl_serialized_context_header,
4111 sizeof( ssl_serialized_context_header ) ) != 0 )
4112 {
4113 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
4114 }
4115 p += sizeof( ssl_serialized_context_header );
4116
4117 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004118 * Session
4119 */
4120 if( (size_t)( end - p ) < 4 )
4121 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4122
4123 session_len = ( (size_t) p[0] << 24 ) |
4124 ( (size_t) p[1] << 16 ) |
4125 ( (size_t) p[2] << 8 ) |
4126 ( (size_t) p[3] );
4127 p += 4;
4128
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004129 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004130 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004131 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004132 ssl->session_in = ssl->session;
4133 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004134 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004135
4136 if( (size_t)( end - p ) < session_len )
4137 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4138
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004139 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004140 if( ret != 0 )
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004141 {
4142 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004143 return( ret );
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004144 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004145
4146 p += session_len;
4147
4148 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004149 * Transform
4150 */
4151
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004152 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004153 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004154 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004155 ssl->transform_in = ssl->transform;
4156 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004157 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004158
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004159#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek894edde2022-09-29 06:31:14 -04004160 prf_func = ssl_tls12prf_from_cs( ssl->session->ciphersuite );
4161 if( prf_func == NULL )
4162 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4163
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004164 /* Read random bytes and populate structure */
4165 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
4166 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004167
Hanno Beckerbd257552021-03-22 06:59:27 +00004168 ret = ssl_tls12_populate_transform( ssl->transform,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004169 ssl->session->ciphersuite,
4170 ssl->session->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004171#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004172 ssl->session->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004173#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Andrzej Kurek894edde2022-09-29 06:31:14 -04004174 prf_func,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004175 p, /* currently pointing to randbytes */
Glenn Strauss07c64162022-03-14 12:34:51 -04004176 MBEDTLS_SSL_VERSION_TLS1_2, /* (D)TLS 1.2 is forced */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004177 ssl->conf->endpoint,
4178 ssl );
4179 if( ret != 0 )
4180 return( ret );
Jerry Yu840fbb22022-02-17 14:59:29 +08004181#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004182 p += sizeof( ssl->transform->randbytes );
4183
4184#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4185 /* Read connection IDs and store them */
4186 if( (size_t)( end - p ) < 1 )
4187 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4188
4189 ssl->transform->in_cid_len = *p++;
4190
Manuel Pégourié-Gonnard5ea13b82019-07-23 15:02:54 +02004191 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004192 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4193
4194 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
4195 p += ssl->transform->in_cid_len;
4196
4197 ssl->transform->out_cid_len = *p++;
4198
4199 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
4200 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4201
4202 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
4203 p += ssl->transform->out_cid_len;
4204#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4205
4206 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004207 * Saved fields from top-level ssl_context structure
4208 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004209 if( (size_t)( end - p ) < 4 )
4210 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4211
4212 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
4213 ( (uint32_t) p[1] << 16 ) |
4214 ( (uint32_t) p[2] << 8 ) |
4215 ( (uint32_t) p[3] );
4216 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004217
4218#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4219 if( (size_t)( end - p ) < 16 )
4220 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4221
4222 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
4223 ( (uint64_t) p[1] << 48 ) |
4224 ( (uint64_t) p[2] << 40 ) |
4225 ( (uint64_t) p[3] << 32 ) |
4226 ( (uint64_t) p[4] << 24 ) |
4227 ( (uint64_t) p[5] << 16 ) |
4228 ( (uint64_t) p[6] << 8 ) |
4229 ( (uint64_t) p[7] );
4230 p += 8;
4231
4232 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
4233 ( (uint64_t) p[1] << 48 ) |
4234 ( (uint64_t) p[2] << 40 ) |
4235 ( (uint64_t) p[3] << 32 ) |
4236 ( (uint64_t) p[4] << 24 ) |
4237 ( (uint64_t) p[5] << 16 ) |
4238 ( (uint64_t) p[6] << 8 ) |
4239 ( (uint64_t) p[7] );
4240 p += 8;
4241#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4242
4243#if defined(MBEDTLS_SSL_PROTO_DTLS)
4244 if( (size_t)( end - p ) < 1 )
4245 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4246
4247 ssl->disable_datagram_packing = *p++;
4248#endif /* MBEDTLS_SSL_PROTO_DTLS */
4249
Jerry Yud9a94fe2021-09-28 18:58:59 +08004250 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004251 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yud9a94fe2021-09-28 18:58:59 +08004252 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
4253 p += sizeof( ssl->cur_out_ctr );
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004254
4255#if defined(MBEDTLS_SSL_PROTO_DTLS)
4256 if( (size_t)( end - p ) < 2 )
4257 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4258
4259 ssl->mtu = ( p[0] << 8 ) | p[1];
4260 p += 2;
4261#endif /* MBEDTLS_SSL_PROTO_DTLS */
4262
4263#if defined(MBEDTLS_SSL_ALPN)
4264 {
4265 uint8_t alpn_len;
4266 const char **cur;
4267
4268 if( (size_t)( end - p ) < 1 )
4269 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4270
4271 alpn_len = *p++;
4272
4273 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
4274 {
4275 /* alpn_chosen should point to an item in the configured list */
4276 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
4277 {
4278 if( strlen( *cur ) == alpn_len &&
4279 memcmp( p, cur, alpn_len ) == 0 )
4280 {
4281 ssl->alpn_chosen = *cur;
4282 break;
4283 }
4284 }
4285 }
4286
4287 /* can only happen on conf mismatch */
4288 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
4289 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4290
4291 p += alpn_len;
4292 }
4293#endif /* MBEDTLS_SSL_ALPN */
4294
4295 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004296 * Forced fields from top-level ssl_context structure
4297 *
4298 * Most of them already set to the correct value by mbedtls_ssl_init() and
4299 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
4300 */
4301 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Glenn Strauss60bfe602022-03-14 19:04:24 -04004302 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004303
Hanno Becker361b10d2019-08-30 10:42:49 +01004304 /* Adjust pointers for header fields of outgoing records to
4305 * the given transform, accounting for explicit IV and CID. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004306 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
Hanno Becker361b10d2019-08-30 10:42:49 +01004307
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004308#if defined(MBEDTLS_SSL_PROTO_DTLS)
4309 ssl->in_epoch = 1;
4310#endif
4311
4312 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
4313 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00004314 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
4315 * inappropriately. */
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004316 if( ssl->handshake != NULL )
4317 {
4318 mbedtls_ssl_handshake_free( ssl );
4319 mbedtls_free( ssl->handshake );
4320 ssl->handshake = NULL;
4321 }
4322
4323 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004324 * Done - should have consumed entire buffer
4325 */
4326 if( p != end )
4327 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004328
4329 return( 0 );
4330}
4331
4332/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004333 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004334 */
4335int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
4336 const unsigned char *buf,
4337 size_t len )
4338{
4339 int ret = ssl_context_load( context, buf, len );
4340
4341 if( ret != 0 )
4342 mbedtls_ssl_free( context );
4343
4344 return( ret );
4345}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004346#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004347
4348/*
Paul Bakker5121ce52009-01-03 21:22:43 +00004349 * Free an SSL context
4350 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004351void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004352{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004353 if( ssl == NULL )
4354 return;
4355
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004356 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004357
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01004358 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004359 {
sander-visserb8aa2072020-05-06 22:05:13 +02004360#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4361 size_t out_buf_len = ssl->out_buf_len;
4362#else
4363 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4364#endif
4365
Darryl Greenb33cc762019-11-28 14:29:44 +00004366 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004367 mbedtls_free( ssl->out_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004368 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004369 }
4370
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01004371 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004372 {
sander-visserb8aa2072020-05-06 22:05:13 +02004373#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4374 size_t in_buf_len = ssl->in_buf_len;
4375#else
4376 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4377#endif
4378
Darryl Greenb33cc762019-11-28 14:29:44 +00004379 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004380 mbedtls_free( ssl->in_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004381 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004382 }
4383
Paul Bakker48916f92012-09-16 19:57:18 +00004384 if( ssl->transform )
4385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004386 mbedtls_ssl_transform_free( ssl->transform );
4387 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00004388 }
4389
4390 if( ssl->handshake )
4391 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02004392 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004393 mbedtls_ssl_transform_free( ssl->transform_negotiate );
4394 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00004395
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004396 mbedtls_free( ssl->handshake );
4397 mbedtls_free( ssl->transform_negotiate );
4398 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00004399 }
4400
Ronald Cron6f135e12021-12-08 16:57:54 +01004401#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker3aa186f2021-08-10 09:24:19 +01004402 mbedtls_ssl_transform_free( ssl->transform_application );
4403 mbedtls_free( ssl->transform_application );
Ronald Cron6f135e12021-12-08 16:57:54 +01004404#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01004405
Paul Bakkerc0463502013-02-14 11:19:38 +01004406 if( ssl->session )
4407 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004408 mbedtls_ssl_session_free( ssl->session );
4409 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01004410 }
4411
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02004412#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02004413 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004414 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004415 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004416 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00004417 }
Paul Bakker0be444a2013-08-27 21:55:01 +02004418#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004419
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004420#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004421 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02004422#endif
4423
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004424 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00004425
Paul Bakker86f04f42013-02-14 11:20:09 +01004426 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004427 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004428}
4429
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004430/*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08004431 * Initialize mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004432 */
4433void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
4434{
4435 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
4436}
4437
Gilles Peskineae270bf2021-06-02 00:05:29 +02004438/* The selection should be the same as mbedtls_x509_crt_profile_default in
4439 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02004440 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02004441 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02004442 * about this list.
4443 */
Brett Warrene0edc842021-08-17 09:53:13 +01004444static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02004445#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004446 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004447#endif
4448#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004449 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004450#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004451#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004452 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004453#endif
4454#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004455 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004456#endif
4457#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004458 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004459#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02004460#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004461 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004462#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004463#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004464 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004465#endif
4466#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004467 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004468#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004469 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02004470};
Gilles Peskineae270bf2021-06-02 00:05:29 +02004471
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004472static int ssl_preset_suiteb_ciphersuites[] = {
4473 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
4474 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
4475 0
4476};
4477
Ronald Crone68ab4f2022-10-05 12:46:29 +02004478#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004479
Jerry Yu909df7b2022-01-22 11:56:27 +08004480/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08004481 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08004482 * rules SHOULD be upheld.
4483 * - No duplicate entries.
4484 * - But if there is a good reason, do not change the order of the algorithms.
Jerry Yu09a99fc2022-07-28 14:22:17 +08004485 * - ssl_tls12_preset* is for TLS 1.2 use only.
Jerry Yu370e1462022-01-25 10:36:53 +08004486 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08004487 */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004488static uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08004489
Andrzej Kurek25f27152022-08-17 16:09:31 -04004490#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yued5e9f42022-01-26 11:21:34 +08004491 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4492 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004493#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA &&
Jerry Yued5e9f42022-01-26 11:21:34 +08004494 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004495
Andrzej Kurek25f27152022-08-17 16:09:31 -04004496#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu909df7b2022-01-22 11:56:27 +08004497 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4498 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004499#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu909df7b2022-01-22 11:56:27 +08004500 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
4501
Andrzej Kurek25f27152022-08-17 16:09:31 -04004502#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yued5e9f42022-01-26 11:21:34 +08004503 defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
4504 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004505#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yued5e9f42022-01-26 11:21:34 +08004506 MBEDTLS_ECP_DP_SECP521R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004507
Andrzej Kurek25f27152022-08-17 16:09:31 -04004508#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004509 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
Andrzej Kurek25f27152022-08-17 16:09:31 -04004510#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004511
Andrzej Kurek25f27152022-08-17 16:09:31 -04004512#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004513 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
Andrzej Kurek25f27152022-08-17 16:09:31 -04004514#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004515
Andrzej Kurek25f27152022-08-17 16:09:31 -04004516#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004517 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Andrzej Kurek25f27152022-08-17 16:09:31 -04004518#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004519
Andrzej Kurek25f27152022-08-17 16:09:31 -04004520#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004521 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
4522#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */
4523
Andrzej Kurek25f27152022-08-17 16:09:31 -04004524#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004525 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
4526#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */
4527
Andrzej Kurek25f27152022-08-17 16:09:31 -04004528#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004529 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4530#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4531
Gabor Mezei15b95a62022-05-09 16:37:58 +02004532 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004533};
4534
4535/* NOTICE: see above */
4536#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4537static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Andrzej Kurek25f27152022-08-17 16:09:31 -04004538#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004539#if defined(MBEDTLS_ECDSA_C)
4540 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512 ),
Jerry Yu713013f2022-01-17 18:16:35 +08004541#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004542#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4543 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
4544#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004545#if defined(MBEDTLS_RSA_C)
4546 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512 ),
4547#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004548#endif /* MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04004549#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004550#if defined(MBEDTLS_ECDSA_C)
4551 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004552#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004553#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4554 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
4555#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004556#if defined(MBEDTLS_RSA_C)
4557 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
4558#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004559#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04004560#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004561#if defined(MBEDTLS_ECDSA_C)
4562 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004563#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004564#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4565 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4566#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004567#if defined(MBEDTLS_RSA_C)
4568 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
4569#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004570#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Gabor Mezei15b95a62022-05-09 16:37:58 +02004571 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004572};
4573#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4574/* NOTICE: see above */
4575static uint16_t ssl_preset_suiteb_sig_algs[] = {
4576
Andrzej Kurek25f27152022-08-17 16:09:31 -04004577#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu909df7b2022-01-22 11:56:27 +08004578 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4579 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004580#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu909df7b2022-01-22 11:56:27 +08004581 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
4582
Andrzej Kurek25f27152022-08-17 16:09:31 -04004583#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu53037892022-01-25 11:02:06 +08004584 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4585 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004586#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu53037892022-01-25 11:02:06 +08004587 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004588
Andrzej Kurek25f27152022-08-17 16:09:31 -04004589#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu909df7b2022-01-22 11:56:27 +08004590 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004591#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu1a8b4812022-01-20 17:56:50 +08004592
Andrzej Kurek25f27152022-08-17 16:09:31 -04004593#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu53037892022-01-25 11:02:06 +08004594 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004595#endif /* MBEDTLS_RSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu53037892022-01-25 11:02:06 +08004596
Gabor Mezei15b95a62022-05-09 16:37:58 +02004597 MBEDTLS_TLS_SIG_NONE
Jerry Yu713013f2022-01-17 18:16:35 +08004598};
Jerry Yu6106fdc2022-01-12 16:36:14 +08004599
Jerry Yu909df7b2022-01-22 11:56:27 +08004600/* NOTICE: see above */
4601#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4602static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Andrzej Kurek25f27152022-08-17 16:09:31 -04004603#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004604#if defined(MBEDTLS_ECDSA_C)
4605 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
Jerry Yu713013f2022-01-17 18:16:35 +08004606#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004607#if defined(MBEDTLS_RSA_C)
4608 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
4609#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004610#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04004611#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004612#if defined(MBEDTLS_ECDSA_C)
4613 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
Jerry Yu18c833e2022-01-25 10:55:47 +08004614#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004615#if defined(MBEDTLS_RSA_C)
4616 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
4617#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004618#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Gabor Mezei15b95a62022-05-09 16:37:58 +02004619 MBEDTLS_TLS_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004620};
Jerry Yu909df7b2022-01-22 11:56:27 +08004621#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4622
Ronald Crone68ab4f2022-10-05 12:46:29 +02004623#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004624
Brett Warrene0edc842021-08-17 09:53:13 +01004625static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01004626#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004627 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004628#endif
4629#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004630 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004631#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004632 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004633};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004634
Ronald Crone68ab4f2022-10-05 12:46:29 +02004635#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004636/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08004637 * to make sure there are no duplicated signature algorithm entries. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004638MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf377d642022-01-25 10:43:59 +08004639static int ssl_check_no_sig_alg_duplication( uint16_t * sig_algs )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004640{
4641 size_t i, j;
4642 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08004643
Gabor Mezei15b95a62022-05-09 16:37:58 +02004644 for( i = 0; sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004645 {
Jerry Yuf377d642022-01-25 10:43:59 +08004646 for( j = 0; j < i; j++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004647 {
Jerry Yuf377d642022-01-25 10:43:59 +08004648 if( sig_algs[i] != sig_algs[j] )
4649 continue;
4650 mbedtls_printf( " entry(%04x,%" MBEDTLS_PRINTF_SIZET
4651 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
4652 sig_algs[i], j, i );
4653 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08004654 }
4655 }
4656 return( ret );
4657}
4658
Ronald Crone68ab4f2022-10-05 12:46:29 +02004659#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004660
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004661/*
Tillmann Karras588ad502015-09-25 04:27:22 +02004662 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004663 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004664int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004665 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004666{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004667#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00004668 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004669#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004670
Ronald Crone68ab4f2022-10-05 12:46:29 +02004671#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf377d642022-01-25 10:43:59 +08004672 if( ssl_check_no_sig_alg_duplication( ssl_preset_suiteb_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004673 {
4674 mbedtls_printf( "ssl_preset_suiteb_sig_algs has duplicated entries\n" );
4675 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4676 }
4677
Jerry Yuf377d642022-01-25 10:43:59 +08004678 if( ssl_check_no_sig_alg_duplication( ssl_preset_default_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004679 {
4680 mbedtls_printf( "ssl_preset_default_sig_algs has duplicated entries\n" );
4681 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4682 }
Jerry Yu909df7b2022-01-22 11:56:27 +08004683
4684#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yuf377d642022-01-25 10:43:59 +08004685 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_suiteb_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004686 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004687 mbedtls_printf( "ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004688 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4689 }
4690
Jerry Yuf377d642022-01-25 10:43:59 +08004691 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_default_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004692 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004693 mbedtls_printf( "ssl_tls12_preset_default_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004694 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4695 }
4696#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02004697#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004698
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02004699 /* Use the functions here so that they are covered in tests,
4700 * but otherwise access member directly for efficiency */
4701 mbedtls_ssl_conf_endpoint( conf, endpoint );
4702 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004703
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004704 /*
4705 * Things that are common to all presets
4706 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004707#if defined(MBEDTLS_SSL_CLI_C)
4708 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
4709 {
4710 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
4711#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4712 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
4713#endif
4714 }
4715#endif
4716
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004717#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4718 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
4719#endif
4720
4721#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
4722 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
4723#endif
4724
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004725#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004726 conf->f_cookie_write = ssl_cookie_write_dummy;
4727 conf->f_cookie_check = ssl_cookie_check_dummy;
4728#endif
4729
4730#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4731 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
4732#endif
4733
Janos Follath088ce432017-04-10 12:42:31 +01004734#if defined(MBEDTLS_SSL_SRV_C)
4735 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02004736 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01004737#endif
4738
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004739#if defined(MBEDTLS_SSL_PROTO_DTLS)
4740 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
4741 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
4742#endif
4743
4744#if defined(MBEDTLS_SSL_RENEGOTIATION)
4745 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00004746 memset( conf->renego_period, 0x00, 2 );
4747 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004748#endif
4749
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004750#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckere2defad2021-07-24 05:59:17 +01004751 if( endpoint == MBEDTLS_SSL_IS_SERVER )
4752 {
4753 const unsigned char dhm_p[] =
4754 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
4755 const unsigned char dhm_g[] =
4756 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01004757
Hanno Beckere2defad2021-07-24 05:59:17 +01004758 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
4759 dhm_p, sizeof( dhm_p ),
4760 dhm_g, sizeof( dhm_g ) ) ) != 0 )
4761 {
4762 return( ret );
4763 }
4764 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02004765#endif
4766
Ronald Cron6f135e12021-12-08 16:57:54 +01004767#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yud0766ec2022-09-22 10:46:57 +08004768#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08004769 mbedtls_ssl_conf_new_session_tickets(
4770 conf, MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS );
4771#endif
Hanno Becker71f1ed62021-07-24 06:01:47 +01004772 /*
4773 * Allow all TLS 1.3 key exchange modes by default.
4774 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00004775 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01004776#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01004777
XiaokangQian4d3a6042022-04-21 13:46:17 +00004778 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4779 {
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004780#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
XiaokangQian4d3a6042022-04-21 13:46:17 +00004781 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian060d8672022-04-21 09:24:56 +00004782 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian4d3a6042022-04-21 13:46:17 +00004783#else
XiaokangQian060d8672022-04-21 09:24:56 +00004784 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
XiaokangQian060d8672022-04-21 09:24:56 +00004785#endif
XiaokangQian4d3a6042022-04-21 13:46:17 +00004786 }
4787 else
4788 {
4789#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
4790 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
4791 {
4792 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4793 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4794 }
4795 else
4796 /* Hybrid TLS 1.2 / 1.3 is not supported on server side yet */
4797 {
4798 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4799 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4800 }
4801#elif defined(MBEDTLS_SSL_PROTO_TLS1_3)
4802 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4803 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4804#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
4805 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4806 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4807#else
4808 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4809#endif
4810 }
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004811
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004812 /*
4813 * Preset-specific defaults
4814 */
4815 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004816 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004817 /*
4818 * NSA Suite B
4819 */
4820 case MBEDTLS_SSL_PRESET_SUITEB:
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004821
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004822 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004823
4824#if defined(MBEDTLS_X509_CRT_PARSE_C)
4825 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004826#endif
4827
Ronald Crone68ab4f2022-10-05 12:46:29 +02004828#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004829#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4830 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4831 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
4832 else
4833#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4834 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02004835#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004836
Brett Warrene0edc842021-08-17 09:53:13 +01004837#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4838 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004839#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004840 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02004841 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004842
4843 /*
4844 * Default
4845 */
4846 default:
Ronald Cronf6606552022-03-15 11:23:25 +01004847
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004848 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004849
4850#if defined(MBEDTLS_X509_CRT_PARSE_C)
4851 conf->cert_profile = &mbedtls_x509_crt_profile_default;
4852#endif
4853
Ronald Crone68ab4f2022-10-05 12:46:29 +02004854#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004855#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4856 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4857 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
4858 else
4859#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4860 conf->sig_algs = ssl_preset_default_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02004861#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004862
Brett Warrene0edc842021-08-17 09:53:13 +01004863#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4864 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004865#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004866 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004867
4868#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
4869 conf->dhm_min_bitlen = 1024;
4870#endif
4871 }
4872
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004873 return( 0 );
4874}
4875
4876/*
4877 * Free mbedtls_ssl_config
4878 */
4879void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
4880{
4881#if defined(MBEDTLS_DHM_C)
4882 mbedtls_mpi_free( &conf->dhm_P );
4883 mbedtls_mpi_free( &conf->dhm_G );
4884#endif
4885
Ronald Cron73fe8df2022-10-05 14:31:43 +02004886#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02004887#if defined(MBEDTLS_USE_PSA_CRYPTO)
4888 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
4889 {
Neil Armstrong501c9322022-05-03 09:35:09 +02004890 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4891 }
Neil Armstrong8ecd6682022-05-05 11:40:35 +02004892#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004893 if( conf->psk != NULL )
4894 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004895 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004896 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00004897 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004898 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09004899 }
4900
4901 if( conf->psk_identity != NULL )
4902 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004903 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09004904 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00004905 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004906 conf->psk_identity_len = 0;
4907 }
Ronald Cron73fe8df2022-10-05 14:31:43 +02004908#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004909
4910#if defined(MBEDTLS_X509_CRT_PARSE_C)
4911 ssl_key_cert_free( conf->key_cert );
4912#endif
4913
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004914 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004915}
4916
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004917#if defined(MBEDTLS_PK_C) && \
4918 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004919/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004920 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004921 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004922unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004923{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004924#if defined(MBEDTLS_RSA_C)
4925 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
4926 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004927#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004928#if defined(MBEDTLS_ECDSA_C)
4929 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
4930 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004931#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004932 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004933}
4934
Hanno Becker7e5437a2017-04-28 17:15:26 +01004935unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
4936{
4937 switch( type ) {
4938 case MBEDTLS_PK_RSA:
4939 return( MBEDTLS_SSL_SIG_RSA );
4940 case MBEDTLS_PK_ECDSA:
4941 case MBEDTLS_PK_ECKEY:
4942 return( MBEDTLS_SSL_SIG_ECDSA );
4943 default:
4944 return( MBEDTLS_SSL_SIG_ANON );
4945 }
4946}
4947
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004948mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004949{
4950 switch( sig )
4951 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004952#if defined(MBEDTLS_RSA_C)
4953 case MBEDTLS_SSL_SIG_RSA:
4954 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004955#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004956#if defined(MBEDTLS_ECDSA_C)
4957 case MBEDTLS_SSL_SIG_ECDSA:
4958 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004959#endif
4960 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004961 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004962 }
4963}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004964#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004965
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004966/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004967 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004968 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004969mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004970{
4971 switch( hash )
4972 {
Andrzej Kurek25f27152022-08-17 16:09:31 -04004973#if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004974 case MBEDTLS_SSL_HASH_MD5:
4975 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004976#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04004977#if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004978 case MBEDTLS_SSL_HASH_SHA1:
4979 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004980#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04004981#if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004982 case MBEDTLS_SSL_HASH_SHA224:
4983 return( MBEDTLS_MD_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004984#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04004985#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004986 case MBEDTLS_SSL_HASH_SHA256:
4987 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004988#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04004989#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004990 case MBEDTLS_SSL_HASH_SHA384:
4991 return( MBEDTLS_MD_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004992#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04004993#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004994 case MBEDTLS_SSL_HASH_SHA512:
4995 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004996#endif
4997 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004998 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004999 }
5000}
5001
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005002/*
5003 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
5004 */
5005unsigned char mbedtls_ssl_hash_from_md_alg( int md )
5006{
5007 switch( md )
5008 {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005009#if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005010 case MBEDTLS_MD_MD5:
5011 return( MBEDTLS_SSL_HASH_MD5 );
5012#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005013#if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005014 case MBEDTLS_MD_SHA1:
5015 return( MBEDTLS_SSL_HASH_SHA1 );
5016#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005017#if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005018 case MBEDTLS_MD_SHA224:
5019 return( MBEDTLS_SSL_HASH_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02005020#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005021#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005022 case MBEDTLS_MD_SHA256:
5023 return( MBEDTLS_SSL_HASH_SHA256 );
5024#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005025#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005026 case MBEDTLS_MD_SHA384:
5027 return( MBEDTLS_SSL_HASH_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02005028#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005029#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005030 case MBEDTLS_MD_SHA512:
5031 return( MBEDTLS_SSL_HASH_SHA512 );
5032#endif
5033 default:
5034 return( MBEDTLS_SSL_HASH_NONE );
5035 }
5036}
5037
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005038/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005039 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005040 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005041 */
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005042int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005043{
Brett Warrene0edc842021-08-17 09:53:13 +01005044 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005045
Brett Warrene0edc842021-08-17 09:53:13 +01005046 if( group_list == NULL )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005047 return( -1 );
5048
Brett Warrene0edc842021-08-17 09:53:13 +01005049 for( ; *group_list != 0; group_list++ )
5050 {
5051 if( *group_list == tls_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005052 return( 0 );
Brett Warrene0edc842021-08-17 09:53:13 +01005053 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005054
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005055 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005056}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005057
5058#if defined(MBEDTLS_ECP_C)
5059/*
5060 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
5061 */
5062int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
5063{
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005064 const mbedtls_ecp_curve_info *grp_info =
Tom Cosgrovebcc13c92022-08-24 15:08:16 +01005065 mbedtls_ecp_curve_info_from_grp_id( grp_id );
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005066
Tom Cosgrovebcc13c92022-08-24 15:08:16 +01005067 if ( grp_info == NULL )
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005068 return -1;
5069
5070 uint16_t tls_id = grp_info->tls_id;
5071
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005072 return mbedtls_ssl_check_curve_tls_id( ssl, tls_id );
5073}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02005074#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005075
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005076#if defined(MBEDTLS_X509_CRT_PARSE_C)
5077int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
5078 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005079 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02005080 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005081{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005082 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005083 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005084 const char *ext_oid;
5085 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005086
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005087 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005088 {
5089 /* Server part of the key exchange */
5090 switch( ciphersuite->key_exchange )
5091 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005092 case MBEDTLS_KEY_EXCHANGE_RSA:
5093 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005094 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005095 break;
5096
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005097 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
5098 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
5099 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
5100 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005101 break;
5102
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005103 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
5104 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005105 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005106 break;
5107
5108 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005109 case MBEDTLS_KEY_EXCHANGE_NONE:
5110 case MBEDTLS_KEY_EXCHANGE_PSK:
5111 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
5112 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02005113 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005114 usage = 0;
5115 }
5116 }
5117 else
5118 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005119 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
5120 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005121 }
5122
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005123 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005124 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005125 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005126 ret = -1;
5127 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005129 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005130 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005131 ext_oid = MBEDTLS_OID_SERVER_AUTH;
5132 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005133 }
5134 else
5135 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005136 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
5137 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005138 }
5139
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005140 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005141 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005142 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005143 ret = -1;
5144 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005145
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005146 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005147}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005148#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02005149
Jerry Yu148165c2021-09-24 23:20:59 +08005150#if defined(MBEDTLS_USE_PSA_CRYPTO)
5151int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
5152 const mbedtls_md_type_t md,
5153 unsigned char *dst,
5154 size_t dst_len,
5155 size_t *olen )
5156{
Ronald Cronf6893e12022-01-07 22:09:01 +01005157 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5158 psa_hash_operation_t *hash_operation_to_clone;
5159 psa_hash_operation_t hash_operation = psa_hash_operation_init();
5160
Jerry Yu148165c2021-09-24 23:20:59 +08005161 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01005162
5163 switch( md )
5164 {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005165#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cronf6893e12022-01-07 22:09:01 +01005166 case MBEDTLS_MD_SHA384:
5167 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
5168 break;
5169#endif
5170
Andrzej Kurek25f27152022-08-17 16:09:31 -04005171#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cronf6893e12022-01-07 22:09:01 +01005172 case MBEDTLS_MD_SHA256:
5173 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
5174 break;
5175#endif
5176
5177 default:
5178 goto exit;
5179 }
5180
5181 status = psa_hash_clone( hash_operation_to_clone, &hash_operation );
5182 if( status != PSA_SUCCESS )
5183 goto exit;
5184
5185 status = psa_hash_finish( &hash_operation, dst, dst_len, olen );
5186 if( status != PSA_SUCCESS )
5187 goto exit;
5188
5189exit:
Andrzej Kurekeabeb302022-10-17 07:52:51 -04005190#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
5191 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
5192 (void) ssl;
5193#endif
Ronald Cronb788c042022-02-15 09:14:15 +01005194 return( psa_ssl_status_to_mbedtls( status ) );
Jerry Yu148165c2021-09-24 23:20:59 +08005195}
5196#else /* MBEDTLS_USE_PSA_CRYPTO */
5197
Andrzej Kurek25f27152022-08-17 16:09:31 -04005198#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005199MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu000f9762021-09-14 11:12:51 +08005200static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
5201 unsigned char *dst,
5202 size_t dst_len,
5203 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005204{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005205 int ret;
5206 mbedtls_sha512_context sha512;
5207
5208 if( dst_len < 48 )
5209 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5210
5211 mbedtls_sha512_init( &sha512 );
Andrzej Kureka242e832022-08-11 10:03:14 -04005212 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005213
5214 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
5215 {
5216 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
5217 goto exit;
5218 }
5219
5220 *olen = 48;
5221
5222exit:
5223
5224 mbedtls_sha512_free( &sha512 );
5225 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005226}
Andrzej Kurek25f27152022-08-17 16:09:31 -04005227#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005228
Andrzej Kurek25f27152022-08-17 16:09:31 -04005229#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005230MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu000f9762021-09-14 11:12:51 +08005231static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
5232 unsigned char *dst,
5233 size_t dst_len,
5234 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005235{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005236 int ret;
5237 mbedtls_sha256_context sha256;
5238
5239 if( dst_len < 32 )
5240 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5241
5242 mbedtls_sha256_init( &sha256 );
5243 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Jerry Yuc5aef882021-12-23 20:15:02 +08005244
Jerry Yu24c0ec32021-09-09 14:21:07 +08005245 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
5246 {
5247 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
5248 goto exit;
5249 }
5250
5251 *olen = 32;
5252
5253exit:
5254
5255 mbedtls_sha256_free( &sha256 );
5256 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005257}
Andrzej Kurek25f27152022-08-17 16:09:31 -04005258#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005259
Jerry Yu000f9762021-09-14 11:12:51 +08005260int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
5261 const mbedtls_md_type_t md,
5262 unsigned char *dst,
5263 size_t dst_len,
5264 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005265{
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005266 switch( md )
5267 {
5268
Andrzej Kurek25f27152022-08-17 16:09:31 -04005269#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005270 case MBEDTLS_MD_SHA384:
Jerry Yuc5aef882021-12-23 20:15:02 +08005271 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005272#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005273
Andrzej Kurek25f27152022-08-17 16:09:31 -04005274#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005275 case MBEDTLS_MD_SHA256:
Jerry Yuc5aef882021-12-23 20:15:02 +08005276 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005277#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005278
5279 default:
Andrzej Kurek409248a2022-10-24 10:33:21 -04005280#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
5281 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
5282 (void) ssl;
5283 (void) dst;
5284 (void) dst_len;
5285 (void) olen;
5286#endif
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005287 break;
5288 }
Jerry Yuc5aef882021-12-23 20:15:02 +08005289 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005290}
XiaokangQian647719a2021-12-07 09:16:29 +00005291
Jerry Yu148165c2021-09-24 23:20:59 +08005292#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005293
Ronald Crone68ab4f2022-10-05 12:46:29 +02005294#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Gabor Mezei078e8032022-04-27 21:17:56 +02005295/* mbedtls_ssl_parse_sig_alg_ext()
5296 *
5297 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
5298 * value (TLS 1.3 RFC8446):
5299 * enum {
5300 * ....
5301 * ecdsa_secp256r1_sha256( 0x0403 ),
5302 * ecdsa_secp384r1_sha384( 0x0503 ),
5303 * ecdsa_secp521r1_sha512( 0x0603 ),
5304 * ....
5305 * } SignatureScheme;
5306 *
5307 * struct {
5308 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
5309 * } SignatureSchemeList;
5310 *
5311 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
5312 * value (TLS 1.2 RFC5246):
5313 * enum {
5314 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
5315 * sha512(6), (255)
5316 * } HashAlgorithm;
5317 *
5318 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
5319 * SignatureAlgorithm;
5320 *
5321 * struct {
5322 * HashAlgorithm hash;
5323 * SignatureAlgorithm signature;
5324 * } SignatureAndHashAlgorithm;
5325 *
5326 * SignatureAndHashAlgorithm
5327 * supported_signature_algorithms<2..2^16-2>;
5328 *
5329 * The TLS 1.3 signature algorithm extension was defined to be a compatible
5330 * generalization of the TLS 1.2 signature algorithm extension.
5331 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
5332 * `SignatureScheme` field of TLS 1.3
5333 *
5334 */
5335int mbedtls_ssl_parse_sig_alg_ext( mbedtls_ssl_context *ssl,
5336 const unsigned char *buf,
5337 const unsigned char *end )
5338{
5339 const unsigned char *p = buf;
5340 size_t supported_sig_algs_len = 0;
5341 const unsigned char *supported_sig_algs_end;
5342 uint16_t sig_alg;
5343 uint32_t common_idx = 0;
5344
5345 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
5346 supported_sig_algs_len = MBEDTLS_GET_UINT16_BE( p, 0 );
5347 p += 2;
5348
5349 memset( ssl->handshake->received_sig_algs, 0,
5350 sizeof(ssl->handshake->received_sig_algs) );
5351
5352 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, supported_sig_algs_len );
5353 supported_sig_algs_end = p + supported_sig_algs_len;
5354 while( p < supported_sig_algs_end )
5355 {
5356 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, supported_sig_algs_end, 2 );
5357 sig_alg = MBEDTLS_GET_UINT16_BE( p, 0 );
5358 p += 2;
Jerry Yuf3b46b52022-06-19 16:52:27 +08005359 MBEDTLS_SSL_DEBUG_MSG( 4, ( "received signature algorithm: 0x%x %s",
5360 sig_alg,
5361 mbedtls_ssl_sig_alg_to_str( sig_alg ) ) );
Jerry Yu2fe6c632022-06-29 10:02:38 +08005362#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu52b7d922022-07-01 18:03:31 +08005363 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
Jerry Yu2fe6c632022-06-29 10:02:38 +08005364 ( ! ( mbedtls_ssl_sig_alg_is_supported( ssl, sig_alg ) &&
5365 mbedtls_ssl_sig_alg_is_offered( ssl, sig_alg ) ) ) )
5366 {
Gabor Mezei078e8032022-04-27 21:17:56 +02005367 continue;
Jerry Yu2fe6c632022-06-29 10:02:38 +08005368 }
5369#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gabor Mezei078e8032022-04-27 21:17:56 +02005370
Jerry Yuf3b46b52022-06-19 16:52:27 +08005371 MBEDTLS_SSL_DEBUG_MSG( 4, ( "valid signature algorithm: %s",
5372 mbedtls_ssl_sig_alg_to_str( sig_alg ) ) );
Gabor Mezei078e8032022-04-27 21:17:56 +02005373
5374 if( common_idx + 1 < MBEDTLS_RECEIVED_SIG_ALGS_SIZE )
5375 {
5376 ssl->handshake->received_sig_algs[common_idx] = sig_alg;
5377 common_idx += 1;
5378 }
5379 }
5380 /* Check that we consumed all the message. */
5381 if( p != end )
5382 {
5383 MBEDTLS_SSL_DEBUG_MSG( 1,
5384 ( "Signature algorithms extension length misaligned" ) );
5385 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
5386 MBEDTLS_ERR_SSL_DECODE_ERROR );
5387 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5388 }
5389
5390 if( common_idx == 0 )
5391 {
5392 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature algorithm in common" ) );
5393 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
5394 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
5395 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
5396 }
5397
Gabor Mezei15b95a62022-05-09 16:37:58 +02005398 ssl->handshake->received_sig_algs[common_idx] = MBEDTLS_TLS_SIG_NONE;
Gabor Mezei078e8032022-04-27 21:17:56 +02005399 return( 0 );
5400}
5401
Ronald Crone68ab4f2022-10-05 12:46:29 +02005402#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Gabor Mezei078e8032022-04-27 21:17:56 +02005403
Jerry Yudc7bd172022-02-17 13:44:15 +08005404#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5405
5406#if defined(MBEDTLS_USE_PSA_CRYPTO)
5407
5408static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
5409 mbedtls_svc_key_id_t key,
5410 psa_algorithm_t alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005411 const unsigned char* raw_psk, size_t raw_psk_length,
Jerry Yudc7bd172022-02-17 13:44:15 +08005412 const unsigned char* seed, size_t seed_length,
5413 const unsigned char* label, size_t label_length,
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005414 const unsigned char* other_secret,
5415 size_t other_secret_length,
Jerry Yudc7bd172022-02-17 13:44:15 +08005416 size_t capacity )
5417{
5418 psa_status_t status;
5419
5420 status = psa_key_derivation_setup( derivation, alg );
5421 if( status != PSA_SUCCESS )
5422 return( status );
5423
5424 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
5425 {
5426 status = psa_key_derivation_input_bytes( derivation,
5427 PSA_KEY_DERIVATION_INPUT_SEED,
5428 seed, seed_length );
5429 if( status != PSA_SUCCESS )
5430 return( status );
5431
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005432 if ( other_secret != NULL )
Przemek Stekiel1f027032022-04-05 17:12:11 +02005433 {
5434 status = psa_key_derivation_input_bytes( derivation,
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005435 PSA_KEY_DERIVATION_INPUT_OTHER_SECRET,
5436 other_secret, other_secret_length );
Przemek Stekiel1f027032022-04-05 17:12:11 +02005437 if( status != PSA_SUCCESS )
5438 return( status );
5439 }
5440
Jerry Yudc7bd172022-02-17 13:44:15 +08005441 if( mbedtls_svc_key_id_is_null( key ) )
5442 {
5443 status = psa_key_derivation_input_bytes(
5444 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005445 raw_psk, raw_psk_length );
Jerry Yudc7bd172022-02-17 13:44:15 +08005446 }
5447 else
5448 {
5449 status = psa_key_derivation_input_key(
5450 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
5451 }
5452 if( status != PSA_SUCCESS )
5453 return( status );
5454
5455 status = psa_key_derivation_input_bytes( derivation,
5456 PSA_KEY_DERIVATION_INPUT_LABEL,
5457 label, label_length );
5458 if( status != PSA_SUCCESS )
5459 return( status );
5460 }
5461 else
5462 {
5463 return( PSA_ERROR_NOT_SUPPORTED );
5464 }
5465
5466 status = psa_key_derivation_set_capacity( derivation, capacity );
5467 if( status != PSA_SUCCESS )
5468 return( status );
5469
5470 return( PSA_SUCCESS );
5471}
5472
Andrzej Kurek57d10632022-10-24 10:32:01 -04005473#if defined(PSA_WANT_ALG_SHA_384) || \
5474 defined(PSA_WANT_ALG_SHA_256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005475MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005476static int tls_prf_generic( mbedtls_md_type_t md_type,
5477 const unsigned char *secret, size_t slen,
5478 const char *label,
5479 const unsigned char *random, size_t rlen,
5480 unsigned char *dstbuf, size_t dlen )
5481{
5482 psa_status_t status;
5483 psa_algorithm_t alg;
5484 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
5485 psa_key_derivation_operation_t derivation =
5486 PSA_KEY_DERIVATION_OPERATION_INIT;
5487
5488 if( md_type == MBEDTLS_MD_SHA384 )
5489 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
5490 else
5491 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
5492
5493 /* Normally a "secret" should be long enough to be impossible to
5494 * find by brute force, and in particular should not be empty. But
5495 * this PRF is also used to derive an IV, in particular in EAP-TLS,
5496 * and for this use case it makes sense to have a 0-length "secret".
5497 * Since the key API doesn't allow importing a key of length 0,
5498 * keep master_key=0, which setup_psa_key_derivation() understands
5499 * to mean a 0-length "secret" input. */
5500 if( slen != 0 )
5501 {
5502 psa_key_attributes_t key_attributes = psa_key_attributes_init();
5503 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
5504 psa_set_key_algorithm( &key_attributes, alg );
5505 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
5506
5507 status = psa_import_key( &key_attributes, secret, slen, &master_key );
5508 if( status != PSA_SUCCESS )
5509 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5510 }
5511
5512 status = setup_psa_key_derivation( &derivation,
5513 master_key, alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005514 NULL, 0,
Jerry Yudc7bd172022-02-17 13:44:15 +08005515 random, rlen,
5516 (unsigned char const *) label,
5517 (size_t) strlen( label ),
Przemek Stekiel1f027032022-04-05 17:12:11 +02005518 NULL, 0,
Jerry Yudc7bd172022-02-17 13:44:15 +08005519 dlen );
5520 if( status != PSA_SUCCESS )
5521 {
5522 psa_key_derivation_abort( &derivation );
5523 psa_destroy_key( master_key );
5524 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5525 }
5526
5527 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
5528 if( status != PSA_SUCCESS )
5529 {
5530 psa_key_derivation_abort( &derivation );
5531 psa_destroy_key( master_key );
5532 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5533 }
5534
5535 status = psa_key_derivation_abort( &derivation );
5536 if( status != PSA_SUCCESS )
5537 {
5538 psa_destroy_key( master_key );
5539 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5540 }
5541
5542 if( ! mbedtls_svc_key_id_is_null( master_key ) )
5543 status = psa_destroy_key( master_key );
5544 if( status != PSA_SUCCESS )
5545 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5546
5547 return( 0 );
5548}
Andrzej Kurek57d10632022-10-24 10:32:01 -04005549#endif /* PSA_WANT_ALG_SHA_256 || PSA_WANT_ALG_SHA_384 */
Jerry Yudc7bd172022-02-17 13:44:15 +08005550#else /* MBEDTLS_USE_PSA_CRYPTO */
5551
Andrzej Kurek57d10632022-10-24 10:32:01 -04005552#if defined(MBEDTLS_MD_C) && \
5553 ( defined(MBEDTLS_SHA256_C) || \
5554 defined(MBEDTLS_SHA384_C) )
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005555MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005556static int tls_prf_generic( mbedtls_md_type_t md_type,
5557 const unsigned char *secret, size_t slen,
5558 const char *label,
5559 const unsigned char *random, size_t rlen,
5560 unsigned char *dstbuf, size_t dlen )
5561{
5562 size_t nb;
5563 size_t i, j, k, md_len;
5564 unsigned char *tmp;
5565 size_t tmp_len = 0;
5566 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
5567 const mbedtls_md_info_t *md_info;
5568 mbedtls_md_context_t md_ctx;
5569 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5570
5571 mbedtls_md_init( &md_ctx );
5572
5573 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
5574 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5575
5576 md_len = mbedtls_md_get_size( md_info );
5577
5578 tmp_len = md_len + strlen( label ) + rlen;
5579 tmp = mbedtls_calloc( 1, tmp_len );
5580 if( tmp == NULL )
5581 {
5582 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
5583 goto exit;
5584 }
5585
5586 nb = strlen( label );
5587 memcpy( tmp + md_len, label, nb );
5588 memcpy( tmp + md_len + nb, random, rlen );
5589 nb += rlen;
5590
5591 /*
5592 * Compute P_<hash>(secret, label + random)[0..dlen]
5593 */
5594 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
5595 goto exit;
5596
5597 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
5598 if( ret != 0 )
5599 goto exit;
5600 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
5601 if( ret != 0 )
5602 goto exit;
5603 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
5604 if( ret != 0 )
5605 goto exit;
5606
5607 for( i = 0; i < dlen; i += md_len )
5608 {
5609 ret = mbedtls_md_hmac_reset ( &md_ctx );
5610 if( ret != 0 )
5611 goto exit;
5612 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
5613 if( ret != 0 )
5614 goto exit;
5615 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
5616 if( ret != 0 )
5617 goto exit;
5618
5619 ret = mbedtls_md_hmac_reset ( &md_ctx );
5620 if( ret != 0 )
5621 goto exit;
5622 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
5623 if( ret != 0 )
5624 goto exit;
5625 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
5626 if( ret != 0 )
5627 goto exit;
5628
5629 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
5630
5631 for( j = 0; j < k; j++ )
5632 dstbuf[i + j] = h_i[j];
5633 }
5634
5635exit:
5636 mbedtls_md_free( &md_ctx );
5637
Dave Rodgman29b9b2b2022-11-01 16:08:14 +00005638 if ( tmp != NULL )
5639 mbedtls_platform_zeroize( tmp, tmp_len );
5640
Jerry Yudc7bd172022-02-17 13:44:15 +08005641 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
5642
5643 mbedtls_free( tmp );
5644
5645 return( ret );
5646}
Andrzej Kurek57d10632022-10-24 10:32:01 -04005647#endif /* MBEDTLS_MD_C && ( MBEDTLS_SHA256_C || MBEDTLS_SHA384_C ) */
Jerry Yudc7bd172022-02-17 13:44:15 +08005648#endif /* MBEDTLS_USE_PSA_CRYPTO */
5649
Andrzej Kurek25f27152022-08-17 16:09:31 -04005650#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005651MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005652static int tls_prf_sha256( const unsigned char *secret, size_t slen,
5653 const char *label,
5654 const unsigned char *random, size_t rlen,
5655 unsigned char *dstbuf, size_t dlen )
5656{
5657 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
5658 label, random, rlen, dstbuf, dlen ) );
5659}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005660#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yudc7bd172022-02-17 13:44:15 +08005661
Andrzej Kurek25f27152022-08-17 16:09:31 -04005662#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005663MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005664static int tls_prf_sha384( const unsigned char *secret, size_t slen,
5665 const char *label,
5666 const unsigned char *random, size_t rlen,
5667 unsigned char *dstbuf, size_t dlen )
5668{
5669 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
5670 label, random, rlen, dstbuf, dlen ) );
5671}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005672#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yudc7bd172022-02-17 13:44:15 +08005673
Jerry Yuf009d862022-02-17 14:01:37 +08005674/*
5675 * Set appropriate PRF function and other SSL / TLS1.2 functions
5676 *
5677 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08005678 * - hash associated with the ciphersuite (only used by TLS 1.2)
5679 *
5680 * Outputs:
5681 * - the tls_prf, calc_verify and calc_finished members of handshake structure
5682 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005683MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf009d862022-02-17 14:01:37 +08005684static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
Jerry Yuf009d862022-02-17 14:01:37 +08005685 mbedtls_md_type_t hash )
5686{
Andrzej Kurek25f27152022-08-17 16:09:31 -04005687#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cron81591aa2022-03-07 09:05:51 +01005688 if( hash == MBEDTLS_MD_SHA384 )
Jerry Yuf009d862022-02-17 14:01:37 +08005689 {
5690 handshake->tls_prf = tls_prf_sha384;
5691 handshake->calc_verify = ssl_calc_verify_tls_sha384;
5692 handshake->calc_finished = ssl_calc_finished_tls_sha384;
5693 }
5694 else
5695#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005696#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuf009d862022-02-17 14:01:37 +08005697 {
Ronald Cron81591aa2022-03-07 09:05:51 +01005698 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005699 handshake->tls_prf = tls_prf_sha256;
5700 handshake->calc_verify = ssl_calc_verify_tls_sha256;
5701 handshake->calc_finished = ssl_calc_finished_tls_sha256;
5702 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005703#else
Jerry Yuf009d862022-02-17 14:01:37 +08005704 {
Jerry Yuf009d862022-02-17 14:01:37 +08005705 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01005706 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005707 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5708 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005709#endif
Jerry Yuf009d862022-02-17 14:01:37 +08005710
5711 return( 0 );
5712}
Jerry Yud6ab2352022-02-17 14:03:43 +08005713
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005714/*
5715 * Compute master secret if needed
5716 *
5717 * Parameters:
5718 * [in/out] handshake
5719 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
5720 * (PSA-PSK) ciphersuite_info, psk_opaque
5721 * [out] premaster (cleared)
5722 * [out] master
5723 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
5724 * debug: conf->f_dbg, conf->p_dbg
5725 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01005726 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005727 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005728MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005729static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
5730 unsigned char *master,
5731 const mbedtls_ssl_context *ssl )
5732{
5733 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5734
5735 /* cf. RFC 5246, Section 8.1:
5736 * "The master secret is always exactly 48 bytes in length." */
5737 size_t const master_secret_len = 48;
5738
5739#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5740 unsigned char session_hash[48];
5741#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
5742
5743 /* The label for the KDF used for key expansion.
5744 * This is either "master secret" or "extended master secret"
5745 * depending on whether the Extended Master Secret extension
5746 * is used. */
5747 char const *lbl = "master secret";
5748
Przemek Stekielae4ed302022-04-05 17:15:55 +02005749 /* The seed for the KDF used for key expansion.
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005750 * - If the Extended Master Secret extension is not used,
5751 * this is ClientHello.Random + ServerHello.Random
5752 * (see Sect. 8.1 in RFC 5246).
5753 * - If the Extended Master Secret extension is used,
5754 * this is the transcript of the handshake so far.
5755 * (see Sect. 4 in RFC 7627). */
Przemek Stekielae4ed302022-04-05 17:15:55 +02005756 unsigned char const *seed = handshake->randbytes;
5757 size_t seed_len = 64;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005758
5759#if !defined(MBEDTLS_DEBUG_C) && \
5760 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
5761 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
5762 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
5763 ssl = NULL; /* make sure we don't use it except for those cases */
5764 (void) ssl;
5765#endif
5766
5767 if( handshake->resume != 0 )
5768 {
5769 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
5770 return( 0 );
5771 }
5772
5773#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5774 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
5775 {
5776 lbl = "extended master secret";
Przemek Stekielae4ed302022-04-05 17:15:55 +02005777 seed = session_hash;
5778 handshake->calc_verify( ssl, session_hash, &seed_len );
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005779
5780 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
Przemek Stekielae4ed302022-04-05 17:15:55 +02005781 session_hash, seed_len );
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005782 }
Przemek Stekiel169bf0b2022-04-29 07:53:29 +02005783#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005784
Przemek Stekiel99114f32022-04-22 11:20:09 +02005785#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Przemek Stekiel8a4b7fd2022-04-28 09:22:22 +02005786 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Neil Armstronge952a302022-05-03 10:22:14 +02005787 if( mbedtls_ssl_ciphersuite_uses_psk( handshake->ciphersuite_info ) == 1 )
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005788 {
5789 /* Perform PSK-to-MS expansion in a single step. */
5790 psa_status_t status;
5791 psa_algorithm_t alg;
5792 mbedtls_svc_key_id_t psk;
5793 psa_key_derivation_operation_t derivation =
5794 PSA_KEY_DERIVATION_OPERATION_INIT;
5795 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
5796
5797 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
5798
5799 psk = mbedtls_ssl_get_opaque_psk( ssl );
5800
5801 if( hash_alg == MBEDTLS_MD_SHA384 )
5802 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
5803 else
5804 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
5805
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005806 size_t other_secret_len = 0;
5807 unsigned char* other_secret = NULL;
Przemek Stekielc2033402022-04-05 17:19:41 +02005808
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005809 switch( handshake->ciphersuite_info->key_exchange )
Przemek Stekielc2033402022-04-05 17:19:41 +02005810 {
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005811 /* Provide other secret.
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005812 * Other secret is stored in premaster, where first 2 bytes hold the
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005813 * length of the other key.
Przemek Stekielc2033402022-04-05 17:19:41 +02005814 */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005815 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Przemek Stekiel8abcee92022-04-28 09:16:28 +02005816 /* For RSA-PSK other key length is always 48 bytes. */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005817 other_secret_len = 48;
5818 other_secret = handshake->premaster + 2;
5819 break;
5820 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005821 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005822 other_secret_len = MBEDTLS_GET_UINT16_BE(handshake->premaster, 0);
5823 other_secret = handshake->premaster + 2;
5824 break;
5825 default:
5826 break;
Przemek Stekielc2033402022-04-05 17:19:41 +02005827 }
5828
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005829 status = setup_psa_key_derivation( &derivation, psk, alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005830 ssl->conf->psk, ssl->conf->psk_len,
Przemek Stekielae4ed302022-04-05 17:15:55 +02005831 seed, seed_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005832 (unsigned char const *) lbl,
5833 (size_t) strlen( lbl ),
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005834 other_secret, other_secret_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005835 master_secret_len );
5836 if( status != PSA_SUCCESS )
5837 {
5838 psa_key_derivation_abort( &derivation );
5839 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5840 }
5841
5842 status = psa_key_derivation_output_bytes( &derivation,
5843 master,
5844 master_secret_len );
5845 if( status != PSA_SUCCESS )
5846 {
5847 psa_key_derivation_abort( &derivation );
5848 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5849 }
5850
5851 status = psa_key_derivation_abort( &derivation );
5852 if( status != PSA_SUCCESS )
5853 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5854 }
5855 else
5856#endif
5857 {
5858 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
Przemek Stekielae4ed302022-04-05 17:15:55 +02005859 lbl, seed, seed_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005860 master,
5861 master_secret_len );
5862 if( ret != 0 )
5863 {
5864 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
5865 return( ret );
5866 }
5867
5868 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
5869 handshake->premaster,
5870 handshake->pmslen );
5871
5872 mbedtls_platform_zeroize( handshake->premaster,
5873 sizeof(handshake->premaster) );
5874 }
5875
5876 return( 0 );
5877}
5878
Jerry Yud62f87e2022-02-17 14:09:02 +08005879int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
5880{
5881 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5882 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5883 ssl->handshake->ciphersuite_info;
5884
5885 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
5886
5887 /* Set PRF, calc_verify and calc_finished function pointers */
5888 ret = ssl_set_handshake_prfs( ssl->handshake,
Jerry Yud62f87e2022-02-17 14:09:02 +08005889 ciphersuite_info->mac );
5890 if( ret != 0 )
5891 {
5892 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
5893 return( ret );
5894 }
5895
5896 /* Compute master secret if needed */
5897 ret = ssl_compute_master( ssl->handshake,
5898 ssl->session_negotiate->master,
5899 ssl );
5900 if( ret != 0 )
5901 {
5902 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
5903 return( ret );
5904 }
5905
5906 /* Swap the client and server random values:
5907 * - MS derivation wanted client+server (RFC 5246 8.1)
5908 * - key derivation wants server+client (RFC 5246 6.3) */
5909 {
5910 unsigned char tmp[64];
5911 memcpy( tmp, ssl->handshake->randbytes, 64 );
5912 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
5913 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
5914 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
5915 }
5916
5917 /* Populate transform structure */
5918 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
5919 ssl->session_negotiate->ciphersuite,
5920 ssl->session_negotiate->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02005921#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yud62f87e2022-02-17 14:09:02 +08005922 ssl->session_negotiate->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02005923#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yud62f87e2022-02-17 14:09:02 +08005924 ssl->handshake->tls_prf,
5925 ssl->handshake->randbytes,
Glenn Strauss60bfe602022-03-14 19:04:24 -04005926 ssl->tls_version,
Jerry Yud62f87e2022-02-17 14:09:02 +08005927 ssl->conf->endpoint,
5928 ssl );
5929 if( ret != 0 )
5930 {
5931 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
5932 return( ret );
5933 }
5934
5935 /* We no longer need Server/ClientHello.random values */
5936 mbedtls_platform_zeroize( ssl->handshake->randbytes,
5937 sizeof( ssl->handshake->randbytes ) );
5938
5939 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
5940
5941 return( 0 );
5942}
Jerry Yu8392e0d2022-02-17 14:10:24 +08005943
Ronald Cron4dcbca92022-03-07 10:21:40 +01005944int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
5945{
Ronald Cron4dcbca92022-03-07 10:21:40 +01005946 switch( md )
5947 {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005948#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cron4dcbca92022-03-07 10:21:40 +01005949 case MBEDTLS_SSL_HASH_SHA384:
5950 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
5951 break;
5952#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005953#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cron4dcbca92022-03-07 10:21:40 +01005954 case MBEDTLS_SSL_HASH_SHA256:
5955 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
5956 break;
5957#endif
5958 default:
5959 return( -1 );
5960 }
Andrzej Kurekeabeb302022-10-17 07:52:51 -04005961#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
5962 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
5963 (void) ssl;
5964#endif
Ronald Cronc2f13a02022-03-07 10:25:24 +01005965 return( 0 );
Ronald Cron4dcbca92022-03-07 10:21:40 +01005966}
5967
Andrzej Kurek25f27152022-08-17 16:09:31 -04005968#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu8392e0d2022-02-17 14:10:24 +08005969void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
5970 unsigned char *hash,
5971 size_t *hlen )
5972{
5973#if defined(MBEDTLS_USE_PSA_CRYPTO)
5974 size_t hash_size;
5975 psa_status_t status;
5976 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
5977
5978 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
5979 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
5980 if( status != PSA_SUCCESS )
5981 {
5982 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5983 return;
5984 }
5985
5986 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
5987 if( status != PSA_SUCCESS )
5988 {
5989 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5990 return;
5991 }
5992
5993 *hlen = 32;
5994 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5995 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5996#else
5997 mbedtls_sha256_context sha256;
5998
5999 mbedtls_sha256_init( &sha256 );
6000
6001 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
6002
6003 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
6004 mbedtls_sha256_finish( &sha256, hash );
6005
6006 *hlen = 32;
6007
6008 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
6009 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
6010
6011 mbedtls_sha256_free( &sha256 );
6012#endif /* MBEDTLS_USE_PSA_CRYPTO */
6013 return;
6014}
Andrzej Kurek25f27152022-08-17 16:09:31 -04006015#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu8392e0d2022-02-17 14:10:24 +08006016
Andrzej Kurek25f27152022-08-17 16:09:31 -04006017#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc1cb3842022-02-17 14:13:48 +08006018void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
6019 unsigned char *hash,
6020 size_t *hlen )
6021{
6022#if defined(MBEDTLS_USE_PSA_CRYPTO)
6023 size_t hash_size;
6024 psa_status_t status;
6025 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
6026
6027 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
6028 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
6029 if( status != PSA_SUCCESS )
6030 {
6031 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6032 return;
6033 }
6034
6035 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
6036 if( status != PSA_SUCCESS )
6037 {
6038 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6039 return;
6040 }
6041
6042 *hlen = 48;
6043 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
6044 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
6045#else
6046 mbedtls_sha512_context sha512;
6047
6048 mbedtls_sha512_init( &sha512 );
6049
6050 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
6051
Andrzej Kureka242e832022-08-11 10:03:14 -04006052 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
Jerry Yuc1cb3842022-02-17 14:13:48 +08006053 mbedtls_sha512_finish( &sha512, hash );
6054
6055 *hlen = 48;
6056
6057 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
6058 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
6059
6060 mbedtls_sha512_free( &sha512 );
6061#endif /* MBEDTLS_USE_PSA_CRYPTO */
6062 return;
6063}
Andrzej Kurek25f27152022-08-17 16:09:31 -04006064#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yuc1cb3842022-02-17 14:13:48 +08006065
Neil Armstrong80f6f322022-05-03 17:56:38 +02006066#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
6067 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Jerry Yuce3dca42022-02-17 14:16:37 +08006068int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
6069{
6070 unsigned char *p = ssl->handshake->premaster;
6071 unsigned char *end = p + sizeof( ssl->handshake->premaster );
6072 const unsigned char *psk = NULL;
6073 size_t psk_len = 0;
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006074 int psk_ret = mbedtls_ssl_get_psk( ssl, &psk, &psk_len );
Jerry Yuce3dca42022-02-17 14:16:37 +08006075
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006076 if( psk_ret == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
Jerry Yuce3dca42022-02-17 14:16:37 +08006077 {
6078 /*
6079 * This should never happen because the existence of a PSK is always
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006080 * checked before calling this function.
6081 *
6082 * The exception is opaque DHE-PSK. For DHE-PSK fill premaster with
Przemek Stekiel8abcee92022-04-28 09:16:28 +02006083 * the shared secret without PSK.
Jerry Yuce3dca42022-02-17 14:16:37 +08006084 */
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006085 if ( key_ex != MBEDTLS_KEY_EXCHANGE_DHE_PSK )
6086 {
6087 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6088 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6089 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006090 }
6091
6092 /*
6093 * PMS = struct {
6094 * opaque other_secret<0..2^16-1>;
6095 * opaque psk<0..2^16-1>;
6096 * };
6097 * with "other_secret" depending on the particular key exchange
6098 */
6099#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
6100 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
6101 {
6102 if( end - p < 2 )
6103 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6104
6105 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
6106 p += 2;
6107
6108 if( end < p || (size_t)( end - p ) < psk_len )
6109 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6110
6111 memset( p, 0, psk_len );
6112 p += psk_len;
6113 }
6114 else
6115#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
6116#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
6117 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
6118 {
6119 /*
6120 * other_secret already set by the ClientKeyExchange message,
6121 * and is 48 bytes long
6122 */
6123 if( end - p < 2 )
6124 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6125
6126 *p++ = 0;
6127 *p++ = 48;
6128 p += 48;
6129 }
6130 else
6131#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
6132#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
6133 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
6134 {
6135 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6136 size_t len;
6137
6138 /* Write length only when we know the actual value */
6139 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
6140 p + 2, end - ( p + 2 ), &len,
6141 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
6142 {
6143 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
6144 return( ret );
6145 }
6146 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
6147 p += 2 + len;
6148
6149 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
6150 }
6151 else
6152#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Neil Armstrong80f6f322022-05-03 17:56:38 +02006153#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Jerry Yuce3dca42022-02-17 14:16:37 +08006154 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
6155 {
6156 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6157 size_t zlen;
6158
6159 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
6160 p + 2, end - ( p + 2 ),
6161 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
6162 {
6163 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
6164 return( ret );
6165 }
6166
6167 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
6168 p += 2 + zlen;
6169
6170 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
6171 MBEDTLS_DEBUG_ECDH_Z );
6172 }
6173 else
Neil Armstrong80f6f322022-05-03 17:56:38 +02006174#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Jerry Yuce3dca42022-02-17 14:16:37 +08006175 {
6176 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6177 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6178 }
6179
6180 /* opaque psk<0..2^16-1>; */
6181 if( end - p < 2 )
6182 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6183
6184 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
6185 p += 2;
6186
6187 if( end < p || (size_t)( end - p ) < psk_len )
6188 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6189
6190 memcpy( p, psk, psk_len );
6191 p += psk_len;
6192
6193 ssl->handshake->pmslen = p - ssl->handshake->premaster;
6194
6195 return( 0 );
6196}
Neil Armstrong80f6f322022-05-03 17:56:38 +02006197#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08006198
6199#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006200MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuc2c673d2022-02-17 14:20:39 +08006201static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
6202
6203#if defined(MBEDTLS_SSL_PROTO_DTLS)
6204int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
6205{
6206 /* If renegotiation is not enforced, retransmit until we would reach max
6207 * timeout if we were using the usual handshake doubling scheme */
6208 if( ssl->conf->renego_max_records < 0 )
6209 {
6210 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
6211 unsigned char doublings = 1;
6212
6213 while( ratio != 0 )
6214 {
6215 ++doublings;
6216 ratio >>= 1;
6217 }
6218
6219 if( ++ssl->renego_records_seen > doublings )
6220 {
6221 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
6222 return( 0 );
6223 }
6224 }
6225
6226 return( ssl_write_hello_request( ssl ) );
6227}
6228#endif
6229#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08006230
Jerry Yud9526692022-02-17 14:23:47 +08006231/*
6232 * Handshake functions
6233 */
6234#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6235/* No certificate support -> dummy functions */
6236int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
6237{
6238 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6239 ssl->handshake->ciphersuite_info;
6240
6241 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
6242
6243 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6244 {
6245 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6246 ssl->state++;
6247 return( 0 );
6248 }
6249
6250 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6251 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6252}
6253
6254int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6255{
6256 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6257 ssl->handshake->ciphersuite_info;
6258
6259 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6260
6261 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6262 {
6263 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6264 ssl->state++;
6265 return( 0 );
6266 }
6267
6268 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6269 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6270}
6271
6272#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6273/* Some certificate support -> implement write and parse */
6274
6275int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
6276{
6277 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
6278 size_t i, n;
6279 const mbedtls_x509_crt *crt;
6280 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6281 ssl->handshake->ciphersuite_info;
6282
6283 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
6284
6285 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6286 {
6287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6288 ssl->state++;
6289 return( 0 );
6290 }
6291
6292#if defined(MBEDTLS_SSL_CLI_C)
6293 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6294 {
6295 if( ssl->handshake->client_auth == 0 )
6296 {
6297 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6298 ssl->state++;
6299 return( 0 );
6300 }
6301 }
6302#endif /* MBEDTLS_SSL_CLI_C */
6303#if defined(MBEDTLS_SSL_SRV_C)
6304 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6305 {
6306 if( mbedtls_ssl_own_cert( ssl ) == NULL )
6307 {
6308 /* Should never happen because we shouldn't have picked the
6309 * ciphersuite if we don't have a certificate. */
6310 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6311 }
6312 }
6313#endif
6314
6315 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
6316
6317 /*
6318 * 0 . 0 handshake type
6319 * 1 . 3 handshake length
6320 * 4 . 6 length of all certs
6321 * 7 . 9 length of cert. 1
6322 * 10 . n-1 peer certificate
6323 * n . n+2 length of cert. 2
6324 * n+3 . ... upper level cert, etc.
6325 */
6326 i = 7;
6327 crt = mbedtls_ssl_own_cert( ssl );
6328
6329 while( crt != NULL )
6330 {
6331 n = crt->raw.len;
6332 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
6333 {
6334 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
6335 " > %" MBEDTLS_PRINTF_SIZET,
6336 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
6337 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
6338 }
6339
6340 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
6341 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
6342 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
6343
6344 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
6345 i += n; crt = crt->next;
6346 }
6347
6348 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
6349 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
6350 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
6351
6352 ssl->out_msglen = i;
6353 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6354 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
6355
6356 ssl->state++;
6357
6358 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
6359 {
6360 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
6361 return( ret );
6362 }
6363
6364 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
6365
6366 return( ret );
6367}
6368
6369#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6370
6371#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006372MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006373static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
6374 unsigned char *crt_buf,
6375 size_t crt_buf_len )
6376{
6377 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
6378
6379 if( peer_crt == NULL )
6380 return( -1 );
6381
6382 if( peer_crt->raw.len != crt_buf_len )
6383 return( -1 );
6384
6385 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
6386}
6387#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006388MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006389static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
6390 unsigned char *crt_buf,
6391 size_t crt_buf_len )
6392{
6393 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6394 unsigned char const * const peer_cert_digest =
6395 ssl->session->peer_cert_digest;
6396 mbedtls_md_type_t const peer_cert_digest_type =
6397 ssl->session->peer_cert_digest_type;
6398 mbedtls_md_info_t const * const digest_info =
6399 mbedtls_md_info_from_type( peer_cert_digest_type );
6400 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
6401 size_t digest_len;
6402
6403 if( peer_cert_digest == NULL || digest_info == NULL )
6404 return( -1 );
6405
6406 digest_len = mbedtls_md_get_size( digest_info );
6407 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
6408 return( -1 );
6409
6410 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
6411 if( ret != 0 )
6412 return( -1 );
6413
6414 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
6415}
6416#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6417#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6418
6419/*
6420 * Once the certificate message is read, parse it into a cert chain and
6421 * perform basic checks, but leave actual verification to the caller
6422 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006423MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006424static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
6425 mbedtls_x509_crt *chain )
6426{
6427 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6428#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6429 int crt_cnt=0;
6430#endif
6431 size_t i, n;
6432 uint8_t alert;
6433
6434 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
6435 {
6436 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6437 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6438 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6439 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
6440 }
6441
6442 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
6443 {
6444 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6445 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6446 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
6447 }
6448
6449 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
6450 {
6451 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6452 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6453 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6454 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6455 }
6456
6457 i = mbedtls_ssl_hs_hdr_len( ssl );
6458
6459 /*
6460 * Same message structure as in mbedtls_ssl_write_certificate()
6461 */
6462 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
6463
6464 if( ssl->in_msg[i] != 0 ||
6465 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
6466 {
6467 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6468 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6469 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6470 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6471 }
6472
6473 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
6474 i += 3;
6475
6476 /* Iterate through and parse the CRTs in the provided chain. */
6477 while( i < ssl->in_hslen )
6478 {
6479 /* Check that there's room for the next CRT's length fields. */
6480 if ( i + 3 > ssl->in_hslen ) {
6481 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6482 mbedtls_ssl_send_alert_message( ssl,
6483 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6484 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6485 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6486 }
6487 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
6488 * anything beyond 2**16 ~ 64K. */
6489 if( ssl->in_msg[i] != 0 )
6490 {
6491 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6492 mbedtls_ssl_send_alert_message( ssl,
6493 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6494 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
6495 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
6496 }
6497
6498 /* Read length of the next CRT in the chain. */
6499 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
6500 | (unsigned int) ssl->in_msg[i + 2];
6501 i += 3;
6502
6503 if( n < 128 || i + n > ssl->in_hslen )
6504 {
6505 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6506 mbedtls_ssl_send_alert_message( ssl,
6507 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6508 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6509 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6510 }
6511
6512 /* Check if we're handling the first CRT in the chain. */
6513#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6514 if( crt_cnt++ == 0 &&
6515 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
6516 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
6517 {
6518 /* During client-side renegotiation, check that the server's
6519 * end-CRTs hasn't changed compared to the initial handshake,
6520 * mitigating the triple handshake attack. On success, reuse
6521 * the original end-CRT instead of parsing it again. */
6522 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
6523 if( ssl_check_peer_crt_unchanged( ssl,
6524 &ssl->in_msg[i],
6525 n ) != 0 )
6526 {
6527 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
6528 mbedtls_ssl_send_alert_message( ssl,
6529 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6530 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
6531 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
6532 }
6533
6534 /* Now we can safely free the original chain. */
6535 ssl_clear_peer_cert( ssl->session );
6536 }
6537#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6538
6539 /* Parse the next certificate in the chain. */
6540#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6541 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
6542#else
6543 /* If we don't need to store the CRT chain permanently, parse
6544 * it in-place from the input buffer instead of making a copy. */
6545 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
6546#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6547 switch( ret )
6548 {
6549 case 0: /*ok*/
6550 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
6551 /* Ignore certificate with an unknown algorithm: maybe a
6552 prior certificate was already trusted. */
6553 break;
6554
6555 case MBEDTLS_ERR_X509_ALLOC_FAILED:
6556 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
6557 goto crt_parse_der_failed;
6558
6559 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
6560 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6561 goto crt_parse_der_failed;
6562
6563 default:
6564 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6565 crt_parse_der_failed:
6566 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
6567 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
6568 return( ret );
6569 }
6570
6571 i += n;
6572 }
6573
6574 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
6575 return( 0 );
6576}
6577
6578#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006579MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006580static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
6581{
6582 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6583 return( -1 );
6584
6585 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
6586 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
6587 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
6588 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
6589 {
Ronald Cron19385882022-06-15 16:26:13 +02006590 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer has no certificate" ) );
Jerry Yud9526692022-02-17 14:23:47 +08006591 return( 0 );
6592 }
6593 return( -1 );
6594}
6595#endif /* MBEDTLS_SSL_SRV_C */
6596
6597/* Check if a certificate message is expected.
6598 * Return either
6599 * - SSL_CERTIFICATE_EXPECTED, or
6600 * - SSL_CERTIFICATE_SKIP
6601 * indicating whether a Certificate message is expected or not.
6602 */
6603#define SSL_CERTIFICATE_EXPECTED 0
6604#define SSL_CERTIFICATE_SKIP 1
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006605MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006606static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
6607 int authmode )
6608{
6609 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6610 ssl->handshake->ciphersuite_info;
6611
6612 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6613 return( SSL_CERTIFICATE_SKIP );
6614
6615#if defined(MBEDTLS_SSL_SRV_C)
6616 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6617 {
6618 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
6619 return( SSL_CERTIFICATE_SKIP );
6620
6621 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
6622 {
6623 ssl->session_negotiate->verify_result =
6624 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
6625 return( SSL_CERTIFICATE_SKIP );
6626 }
6627 }
6628#else
6629 ((void) authmode);
6630#endif /* MBEDTLS_SSL_SRV_C */
6631
6632 return( SSL_CERTIFICATE_EXPECTED );
6633}
6634
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006635MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006636static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
6637 int authmode,
6638 mbedtls_x509_crt *chain,
6639 void *rs_ctx )
6640{
6641 int ret = 0;
6642 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6643 ssl->handshake->ciphersuite_info;
6644 int have_ca_chain = 0;
6645
6646 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
6647 void *p_vrfy;
6648
6649 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
6650 return( 0 );
6651
6652 if( ssl->f_vrfy != NULL )
6653 {
6654 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
6655 f_vrfy = ssl->f_vrfy;
6656 p_vrfy = ssl->p_vrfy;
6657 }
6658 else
6659 {
6660 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
6661 f_vrfy = ssl->conf->f_vrfy;
6662 p_vrfy = ssl->conf->p_vrfy;
6663 }
6664
6665 /*
6666 * Main check: verify certificate
6667 */
6668#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
6669 if( ssl->conf->f_ca_cb != NULL )
6670 {
6671 ((void) rs_ctx);
6672 have_ca_chain = 1;
6673
6674 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
6675 ret = mbedtls_x509_crt_verify_with_ca_cb(
6676 chain,
6677 ssl->conf->f_ca_cb,
6678 ssl->conf->p_ca_cb,
6679 ssl->conf->cert_profile,
6680 ssl->hostname,
6681 &ssl->session_negotiate->verify_result,
6682 f_vrfy, p_vrfy );
6683 }
6684 else
6685#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
6686 {
6687 mbedtls_x509_crt *ca_chain;
6688 mbedtls_x509_crl *ca_crl;
6689
6690#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6691 if( ssl->handshake->sni_ca_chain != NULL )
6692 {
6693 ca_chain = ssl->handshake->sni_ca_chain;
6694 ca_crl = ssl->handshake->sni_ca_crl;
6695 }
6696 else
6697#endif
6698 {
6699 ca_chain = ssl->conf->ca_chain;
6700 ca_crl = ssl->conf->ca_crl;
6701 }
6702
6703 if( ca_chain != NULL )
6704 have_ca_chain = 1;
6705
6706 ret = mbedtls_x509_crt_verify_restartable(
6707 chain,
6708 ca_chain, ca_crl,
6709 ssl->conf->cert_profile,
6710 ssl->hostname,
6711 &ssl->session_negotiate->verify_result,
6712 f_vrfy, p_vrfy, rs_ctx );
6713 }
6714
6715 if( ret != 0 )
6716 {
6717 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
6718 }
6719
6720#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6721 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
6722 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
6723#endif
6724
6725 /*
6726 * Secondary checks: always done, but change 'ret' only if it was 0
6727 */
6728
6729#if defined(MBEDTLS_ECP_C)
6730 {
6731 const mbedtls_pk_context *pk = &chain->pk;
6732
Manuel Pégourié-Gonnard66b0d612022-06-17 10:49:29 +02006733 /* If certificate uses an EC key, make sure the curve is OK.
6734 * This is a public key, so it can't be opaque, so can_do() is a good
6735 * enough check to ensure pk_ec() is safe to use here. */
Leonid Rozenboim19e59732022-08-08 16:52:38 -07006736 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) )
Jerry Yud9526692022-02-17 14:23:47 +08006737 {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07006738 /* and in the unlikely case the above assumption no longer holds
6739 * we are making sure that pk_ec() here does not return a NULL
6740 */
6741 const mbedtls_ecp_keypair *ec = mbedtls_pk_ec( *pk );
6742 if( ec == NULL )
6743 {
Tom Cosgrove20c11372022-08-24 15:06:13 +01006744 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_pk_ec() returned NULL" ) );
Leonid Rozenboim19e59732022-08-08 16:52:38 -07006745 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6746 }
Jerry Yud9526692022-02-17 14:23:47 +08006747
Leonid Rozenboim19e59732022-08-08 16:52:38 -07006748 if( mbedtls_ssl_check_curve( ssl, ec->grp.id ) != 0 )
6749 {
6750 ssl->session_negotiate->verify_result |=
6751 MBEDTLS_X509_BADCERT_BAD_KEY;
6752
6753 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
6754 if( ret == 0 )
6755 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6756 }
Jerry Yud9526692022-02-17 14:23:47 +08006757 }
6758 }
6759#endif /* MBEDTLS_ECP_C */
6760
6761 if( mbedtls_ssl_check_cert_usage( chain,
6762 ciphersuite_info,
6763 ! ssl->conf->endpoint,
6764 &ssl->session_negotiate->verify_result ) != 0 )
6765 {
6766 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
6767 if( ret == 0 )
6768 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6769 }
6770
6771 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
6772 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
6773 * with details encoded in the verification flags. All other kinds
6774 * of error codes, including those from the user provided f_vrfy
6775 * functions, are treated as fatal and lead to a failure of
6776 * ssl_parse_certificate even if verification was optional. */
6777 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
6778 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
6779 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
6780 {
6781 ret = 0;
6782 }
6783
6784 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
6785 {
6786 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
6787 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
6788 }
6789
6790 if( ret != 0 )
6791 {
6792 uint8_t alert;
6793
6794 /* The certificate may have been rejected for several reasons.
6795 Pick one and send the corresponding alert. Which alert to send
6796 may be a subject of debate in some cases. */
6797 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
6798 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
6799 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
6800 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6801 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
6802 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6803 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
6804 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6805 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
6806 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6807 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
6808 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6809 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
6810 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6811 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
6812 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
6813 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
6814 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
6815 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
6816 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
6817 else
6818 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
6819 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6820 alert );
6821 }
6822
6823#if defined(MBEDTLS_DEBUG_C)
6824 if( ssl->session_negotiate->verify_result != 0 )
6825 {
6826 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
6827 (unsigned int) ssl->session_negotiate->verify_result ) );
6828 }
6829 else
6830 {
6831 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
6832 }
6833#endif /* MBEDTLS_DEBUG_C */
6834
6835 return( ret );
6836}
6837
6838#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006839MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006840static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
6841 unsigned char *start, size_t len )
6842{
6843 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6844 /* Remember digest of the peer's end-CRT. */
6845 ssl->session_negotiate->peer_cert_digest =
6846 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
6847 if( ssl->session_negotiate->peer_cert_digest == NULL )
6848 {
6849 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
6850 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
6851 mbedtls_ssl_send_alert_message( ssl,
6852 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6853 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6854
6855 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
6856 }
6857
6858 ret = mbedtls_md( mbedtls_md_info_from_type(
6859 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
6860 start, len,
6861 ssl->session_negotiate->peer_cert_digest );
6862
6863 ssl->session_negotiate->peer_cert_digest_type =
6864 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
6865 ssl->session_negotiate->peer_cert_digest_len =
6866 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
6867
6868 return( ret );
6869}
6870
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006871MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006872static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
6873 unsigned char *start, size_t len )
6874{
6875 unsigned char *end = start + len;
6876 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6877
6878 /* Make a copy of the peer's raw public key. */
6879 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
6880 ret = mbedtls_pk_parse_subpubkey( &start, end,
6881 &ssl->handshake->peer_pubkey );
6882 if( ret != 0 )
6883 {
6884 /* We should have parsed the public key before. */
6885 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6886 }
6887
6888 return( 0 );
6889}
6890#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6891
6892int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6893{
6894 int ret = 0;
6895 int crt_expected;
6896#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6897 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
6898 ? ssl->handshake->sni_authmode
6899 : ssl->conf->authmode;
6900#else
6901 const int authmode = ssl->conf->authmode;
6902#endif
6903 void *rs_ctx = NULL;
6904 mbedtls_x509_crt *chain = NULL;
6905
6906 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6907
6908 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
6909 if( crt_expected == SSL_CERTIFICATE_SKIP )
6910 {
6911 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6912 goto exit;
6913 }
6914
6915#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6916 if( ssl->handshake->ecrs_enabled &&
6917 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
6918 {
6919 chain = ssl->handshake->ecrs_peer_cert;
6920 ssl->handshake->ecrs_peer_cert = NULL;
6921 goto crt_verify;
6922 }
6923#endif
6924
6925 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
6926 {
6927 /* mbedtls_ssl_read_record may have sent an alert already. We
6928 let it decide whether to alert. */
6929 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6930 goto exit;
6931 }
6932
6933#if defined(MBEDTLS_SSL_SRV_C)
6934 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
6935 {
6936 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
6937
6938 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
6939 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
6940
6941 goto exit;
6942 }
6943#endif /* MBEDTLS_SSL_SRV_C */
6944
6945 /* Clear existing peer CRT structure in case we tried to
6946 * reuse a session but it failed, and allocate a new one. */
6947 ssl_clear_peer_cert( ssl->session_negotiate );
6948
6949 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
6950 if( chain == NULL )
6951 {
6952 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
6953 sizeof( mbedtls_x509_crt ) ) );
6954 mbedtls_ssl_send_alert_message( ssl,
6955 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6956 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6957
6958 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
6959 goto exit;
6960 }
6961 mbedtls_x509_crt_init( chain );
6962
6963 ret = ssl_parse_certificate_chain( ssl, chain );
6964 if( ret != 0 )
6965 goto exit;
6966
6967#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6968 if( ssl->handshake->ecrs_enabled)
6969 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
6970
6971crt_verify:
6972 if( ssl->handshake->ecrs_enabled)
6973 rs_ctx = &ssl->handshake->ecrs_ctx;
6974#endif
6975
6976 ret = ssl_parse_certificate_verify( ssl, authmode,
6977 chain, rs_ctx );
6978 if( ret != 0 )
6979 goto exit;
6980
6981#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6982 {
6983 unsigned char *crt_start, *pk_start;
6984 size_t crt_len, pk_len;
6985
6986 /* We parse the CRT chain without copying, so
6987 * these pointers point into the input buffer,
6988 * and are hence still valid after freeing the
6989 * CRT chain. */
6990
6991 crt_start = chain->raw.p;
6992 crt_len = chain->raw.len;
6993
6994 pk_start = chain->pk_raw.p;
6995 pk_len = chain->pk_raw.len;
6996
6997 /* Free the CRT structures before computing
6998 * digest and copying the peer's public key. */
6999 mbedtls_x509_crt_free( chain );
7000 mbedtls_free( chain );
7001 chain = NULL;
7002
7003 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
7004 if( ret != 0 )
7005 goto exit;
7006
7007 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
7008 if( ret != 0 )
7009 goto exit;
7010 }
7011#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7012 /* Pass ownership to session structure. */
7013 ssl->session_negotiate->peer_cert = chain;
7014 chain = NULL;
7015#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7016
7017 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
7018
7019exit:
7020
7021 if( ret == 0 )
7022 ssl->state++;
7023
7024#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
7025 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
7026 {
7027 ssl->handshake->ecrs_peer_cert = chain;
7028 chain = NULL;
7029 }
7030#endif
7031
7032 if( chain != NULL )
7033 {
7034 mbedtls_x509_crt_free( chain );
7035 mbedtls_free( chain );
7036 }
7037
7038 return( ret );
7039}
7040#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7041
Andrzej Kurek25f27152022-08-17 16:09:31 -04007042#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu615bd6f2022-02-17 14:25:15 +08007043static void ssl_calc_finished_tls_sha256(
7044 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
7045{
7046 int len = 12;
7047 const char *sender;
7048 unsigned char padbuf[32];
7049#if defined(MBEDTLS_USE_PSA_CRYPTO)
7050 size_t hash_size;
7051 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
7052 psa_status_t status;
7053#else
7054 mbedtls_sha256_context sha256;
7055#endif
7056
7057 mbedtls_ssl_session *session = ssl->session_negotiate;
7058 if( !session )
7059 session = ssl->session;
7060
7061 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
7062 ? "client finished"
7063 : "server finished";
7064
7065#if defined(MBEDTLS_USE_PSA_CRYPTO)
7066 sha256_psa = psa_hash_operation_init();
7067
7068 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
7069
7070 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
7071 if( status != PSA_SUCCESS )
7072 {
7073 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
7074 return;
7075 }
7076
7077 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
7078 if( status != PSA_SUCCESS )
7079 {
7080 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
7081 return;
7082 }
7083 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
7084#else
7085
7086 mbedtls_sha256_init( &sha256 );
7087
7088 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
7089
7090 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
7091
7092 /*
7093 * TLSv1.2:
7094 * hash = PRF( master, finished_label,
7095 * Hash( handshake ) )[0.11]
7096 */
7097
7098#if !defined(MBEDTLS_SHA256_ALT)
7099 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
7100 sha256.state, sizeof( sha256.state ) );
7101#endif
7102
7103 mbedtls_sha256_finish( &sha256, padbuf );
7104 mbedtls_sha256_free( &sha256 );
7105#endif /* MBEDTLS_USE_PSA_CRYPTO */
7106
7107 ssl->handshake->tls_prf( session->master, 48, sender,
7108 padbuf, 32, buf, len );
7109
7110 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
7111
7112 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
7113
7114 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
7115}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04007116#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu615bd6f2022-02-17 14:25:15 +08007117
Jerry Yub7ba49e2022-02-17 14:25:53 +08007118
Andrzej Kurek25f27152022-08-17 16:09:31 -04007119#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yub7ba49e2022-02-17 14:25:53 +08007120static void ssl_calc_finished_tls_sha384(
7121 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
7122{
7123 int len = 12;
7124 const char *sender;
7125 unsigned char padbuf[48];
7126#if defined(MBEDTLS_USE_PSA_CRYPTO)
7127 size_t hash_size;
7128 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
7129 psa_status_t status;
7130#else
7131 mbedtls_sha512_context sha512;
7132#endif
7133
7134 mbedtls_ssl_session *session = ssl->session_negotiate;
7135 if( !session )
7136 session = ssl->session;
7137
7138 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
7139 ? "client finished"
7140 : "server finished";
7141
7142#if defined(MBEDTLS_USE_PSA_CRYPTO)
7143 sha384_psa = psa_hash_operation_init();
7144
7145 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
7146
7147 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
7148 if( status != PSA_SUCCESS )
7149 {
7150 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
7151 return;
7152 }
7153
7154 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
7155 if( status != PSA_SUCCESS )
7156 {
7157 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
7158 return;
7159 }
7160 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
7161#else
7162 mbedtls_sha512_init( &sha512 );
7163
7164 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
7165
Andrzej Kureka242e832022-08-11 10:03:14 -04007166 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
Jerry Yub7ba49e2022-02-17 14:25:53 +08007167
7168 /*
7169 * TLSv1.2:
7170 * hash = PRF( master, finished_label,
7171 * Hash( handshake ) )[0.11]
7172 */
7173
7174#if !defined(MBEDTLS_SHA512_ALT)
7175 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
7176 sha512.state, sizeof( sha512.state ) );
7177#endif
7178 mbedtls_sha512_finish( &sha512, padbuf );
7179
7180 mbedtls_sha512_free( &sha512 );
7181#endif
7182
7183 ssl->handshake->tls_prf( session->master, 48, sender,
7184 padbuf, 48, buf, len );
7185
7186 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
7187
7188 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
7189
7190 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
7191}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04007192#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yub7ba49e2022-02-17 14:25:53 +08007193
Jerry Yuaef00152022-02-17 14:27:31 +08007194void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
7195{
7196 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
7197
7198 /*
7199 * Free our handshake params
7200 */
7201 mbedtls_ssl_handshake_free( ssl );
7202 mbedtls_free( ssl->handshake );
7203 ssl->handshake = NULL;
7204
7205 /*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08007206 * Free the previous transform and switch in the current one
Jerry Yuaef00152022-02-17 14:27:31 +08007207 */
7208 if( ssl->transform )
7209 {
7210 mbedtls_ssl_transform_free( ssl->transform );
7211 mbedtls_free( ssl->transform );
7212 }
7213 ssl->transform = ssl->transform_negotiate;
7214 ssl->transform_negotiate = NULL;
7215
7216 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
7217}
7218
Jerry Yu2a9fff52022-02-17 14:28:51 +08007219void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
7220{
7221 int resume = ssl->handshake->resume;
7222
7223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
7224
7225#if defined(MBEDTLS_SSL_RENEGOTIATION)
7226 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
7227 {
7228 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
7229 ssl->renego_records_seen = 0;
7230 }
7231#endif
7232
7233 /*
7234 * Free the previous session and switch in the current one
7235 */
7236 if( ssl->session )
7237 {
7238#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7239 /* RFC 7366 3.1: keep the EtM state */
7240 ssl->session_negotiate->encrypt_then_mac =
7241 ssl->session->encrypt_then_mac;
7242#endif
7243
7244 mbedtls_ssl_session_free( ssl->session );
7245 mbedtls_free( ssl->session );
7246 }
7247 ssl->session = ssl->session_negotiate;
7248 ssl->session_negotiate = NULL;
7249
7250 /*
7251 * Add cache entry
7252 */
7253 if( ssl->conf->f_set_cache != NULL &&
7254 ssl->session->id_len != 0 &&
7255 resume == 0 )
7256 {
7257 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
7258 ssl->session->id,
7259 ssl->session->id_len,
7260 ssl->session ) != 0 )
7261 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
7262 }
7263
7264#if defined(MBEDTLS_SSL_PROTO_DTLS)
7265 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7266 ssl->handshake->flight != NULL )
7267 {
7268 /* Cancel handshake timer */
7269 mbedtls_ssl_set_timer( ssl, 0 );
7270
7271 /* Keep last flight around in case we need to resend it:
7272 * we need the handshake and transform structures for that */
7273 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
7274 }
7275 else
7276#endif
7277 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
7278
7279 ssl->state++;
7280
7281 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
7282}
7283
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007284int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
7285{
7286 int ret, hash_len;
7287
7288 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
7289
7290 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
7291
7292 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
7293
7294 /*
7295 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
7296 * may define some other value. Currently (early 2016), no defined
7297 * ciphersuite does this (and this is unlikely to change as activity has
7298 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
7299 */
7300 hash_len = 12;
7301
7302#if defined(MBEDTLS_SSL_RENEGOTIATION)
7303 ssl->verify_data_len = hash_len;
7304 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
7305#endif
7306
7307 ssl->out_msglen = 4 + hash_len;
7308 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7309 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
7310
7311 /*
7312 * In case of session resuming, invert the client and server
7313 * ChangeCipherSpec messages order.
7314 */
7315 if( ssl->handshake->resume != 0 )
7316 {
7317#if defined(MBEDTLS_SSL_CLI_C)
7318 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7319 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
7320#endif
7321#if defined(MBEDTLS_SSL_SRV_C)
7322 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7323 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
7324#endif
7325 }
7326 else
7327 ssl->state++;
7328
7329 /*
7330 * Switch to our negotiated transform and session parameters for outbound
7331 * data.
7332 */
7333 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
7334
7335#if defined(MBEDTLS_SSL_PROTO_DTLS)
7336 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7337 {
7338 unsigned char i;
7339
7340 /* Remember current epoch settings for resending */
7341 ssl->handshake->alt_transform_out = ssl->transform_out;
7342 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
7343 sizeof( ssl->handshake->alt_out_ctr ) );
7344
7345 /* Set sequence_number to zero */
7346 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
7347
7348
7349 /* Increment epoch */
7350 for( i = 2; i > 0; i-- )
7351 if( ++ssl->cur_out_ctr[i - 1] != 0 )
7352 break;
7353
7354 /* The loop goes to its end iff the counter is wrapping */
7355 if( i == 0 )
7356 {
7357 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
7358 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
7359 }
7360 }
7361 else
7362#endif /* MBEDTLS_SSL_PROTO_DTLS */
7363 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
7364
7365 ssl->transform_out = ssl->transform_negotiate;
7366 ssl->session_out = ssl->session_negotiate;
7367
7368#if defined(MBEDTLS_SSL_PROTO_DTLS)
7369 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7370 mbedtls_ssl_send_flight_completed( ssl );
7371#endif
7372
7373 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
7374 {
7375 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
7376 return( ret );
7377 }
7378
7379#if defined(MBEDTLS_SSL_PROTO_DTLS)
7380 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7381 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
7382 {
7383 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
7384 return( ret );
7385 }
7386#endif
7387
7388 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
7389
7390 return( 0 );
7391}
7392
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007393#define SSL_MAX_HASH_LEN 12
7394
7395int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
7396{
7397 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7398 unsigned int hash_len = 12;
7399 unsigned char buf[SSL_MAX_HASH_LEN];
7400
7401 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
7402
7403 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
7404
7405 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
7406 {
7407 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
7408 goto exit;
7409 }
7410
7411 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
7412 {
7413 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7414 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7415 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
7416 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
7417 goto exit;
7418 }
7419
7420 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
7421 {
7422 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7423 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
7424 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
7425 goto exit;
7426 }
7427
7428 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
7429 {
7430 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7431 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7432 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
7433 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
7434 goto exit;
7435 }
7436
7437 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
7438 buf, hash_len ) != 0 )
7439 {
7440 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7441 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7442 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
7443 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
7444 goto exit;
7445 }
7446
7447#if defined(MBEDTLS_SSL_RENEGOTIATION)
7448 ssl->verify_data_len = hash_len;
7449 memcpy( ssl->peer_verify_data, buf, hash_len );
7450#endif
7451
7452 if( ssl->handshake->resume != 0 )
7453 {
7454#if defined(MBEDTLS_SSL_CLI_C)
7455 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7456 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
7457#endif
7458#if defined(MBEDTLS_SSL_SRV_C)
7459 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7460 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
7461#endif
7462 }
7463 else
7464 ssl->state++;
7465
7466#if defined(MBEDTLS_SSL_PROTO_DTLS)
7467 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7468 mbedtls_ssl_recv_flight_completed( ssl );
7469#endif
7470
7471 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
7472
7473exit:
7474 mbedtls_platform_zeroize( buf, hash_len );
7475 return( ret );
7476}
7477
Jerry Yu392112c2022-02-17 14:34:10 +08007478#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
7479/*
7480 * Helper to get TLS 1.2 PRF from ciphersuite
7481 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
7482 */
7483static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
7484{
Jerry Yu392112c2022-02-17 14:34:10 +08007485 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
Andrzej Kurek68327742022-10-03 06:18:18 -04007486 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
7487#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Leonid Rozenboime9d8dcd2022-08-08 15:57:48 -07007488 if( ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Jerry Yu392112c2022-02-17 14:34:10 +08007489 return( tls_prf_sha384 );
Andrzej Kurek894edde2022-09-29 06:31:14 -04007490 else
Jerry Yu392112c2022-02-17 14:34:10 +08007491#endif
Andrzej Kurek894edde2022-09-29 06:31:14 -04007492#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
7493 {
7494 if( ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA256 )
7495 return( tls_prf_sha256 );
7496 }
7497#endif
7498#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
7499 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
7500 (void) ciphersuite_info;
7501#endif
Andrzej Kurekeabeb302022-10-17 07:52:51 -04007502
Andrzej Kurek894edde2022-09-29 06:31:14 -04007503 return( NULL );
Jerry Yu392112c2022-02-17 14:34:10 +08007504}
7505#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08007506
7507static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
7508{
7509 ((void) tls_prf);
Andrzej Kurek25f27152022-08-17 16:09:31 -04007510#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yue93ffcd2022-02-17 14:37:06 +08007511 if( tls_prf == tls_prf_sha384 )
7512 {
7513 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
7514 }
7515 else
7516#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04007517#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yue93ffcd2022-02-17 14:37:06 +08007518 if( tls_prf == tls_prf_sha256 )
7519 {
7520 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
7521 }
7522 else
7523#endif
7524 return( MBEDTLS_SSL_TLS_PRF_NONE );
7525}
7526
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007527/*
7528 * Populate a transform structure with session keys and all the other
7529 * necessary information.
7530 *
7531 * Parameters:
7532 * - [in/out]: transform: structure to populate
7533 * [in] must be just initialised with mbedtls_ssl_transform_init()
7534 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
7535 * - [in] ciphersuite
7536 * - [in] master
7537 * - [in] encrypt_then_mac
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007538 * - [in] tls_prf: pointer to PRF to use for key derivation
7539 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Glenn Strauss07c64162022-03-14 12:34:51 -04007540 * - [in] tls_version: TLS version
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007541 * - [in] endpoint: client or server
7542 * - [in] ssl: used for:
7543 * - ssl->conf->{f,p}_export_keys
7544 * [in] optionally used for:
7545 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
7546 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007547MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007548static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
7549 int ciphersuite,
7550 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007551#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007552 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007553#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007554 ssl_tls_prf_t tls_prf,
7555 const unsigned char randbytes[64],
Glenn Strauss07c64162022-03-14 12:34:51 -04007556 mbedtls_ssl_protocol_version tls_version,
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007557 unsigned endpoint,
7558 const mbedtls_ssl_context *ssl )
7559{
7560 int ret = 0;
7561 unsigned char keyblk[256];
7562 unsigned char *key1;
7563 unsigned char *key2;
7564 unsigned char *mac_enc;
7565 unsigned char *mac_dec;
7566 size_t mac_key_len = 0;
7567 size_t iv_copy_len;
7568 size_t keylen;
7569 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007570 mbedtls_ssl_mode_t ssl_mode;
Neil Armstronge4512952022-03-08 09:08:22 +01007571#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007572 const mbedtls_cipher_info_t *cipher_info;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007573 const mbedtls_md_info_t *md_info;
Neil Armstronge4512952022-03-08 09:08:22 +01007574#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007575
7576#if defined(MBEDTLS_USE_PSA_CRYPTO)
7577 psa_key_type_t key_type;
7578 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
7579 psa_algorithm_t alg;
Neil Armstronge4512952022-03-08 09:08:22 +01007580 psa_algorithm_t mac_alg = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007581 size_t key_bits;
7582 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
7583#endif
7584
7585#if !defined(MBEDTLS_DEBUG_C) && \
7586 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
7587 if( ssl->f_export_keys == NULL )
7588 {
7589 ssl = NULL; /* make sure we don't use it except for these cases */
7590 (void) ssl;
7591 }
7592#endif
7593
7594 /*
7595 * Some data just needs copying into the structure
7596 */
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007597#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007598 transform->encrypt_then_mac = encrypt_then_mac;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007599#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Glenn Strauss07c64162022-03-14 12:34:51 -04007600 transform->tls_version = tls_version;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007601
7602#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
7603 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
7604#endif
7605
7606#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Glenn Strauss07c64162022-03-14 12:34:51 -04007607 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007608 {
7609 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
7610 * generation separate. This should never happen. */
7611 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7612 }
7613#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
7614
7615 /*
7616 * Get various info structures
7617 */
7618 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
7619 if( ciphersuite_info == NULL )
7620 {
7621 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
7622 ciphersuite ) );
7623 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7624 }
7625
Neil Armstrongab555e02022-04-04 11:07:59 +02007626 ssl_mode = mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007627#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007628 encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007629#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007630 ciphersuite_info );
7631
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007632 if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
7633 transform->taglen =
7634 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
7635
7636#if defined(MBEDTLS_USE_PSA_CRYPTO)
7637 if( ( status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher,
7638 transform->taglen,
7639 &alg,
7640 &key_type,
7641 &key_bits ) ) != PSA_SUCCESS )
7642 {
7643 ret = psa_ssl_status_to_mbedtls( status );
7644 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", ret );
7645 goto end;
7646 }
7647#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007648 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
7649 if( cipher_info == NULL )
7650 {
7651 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
7652 ciphersuite_info->cipher ) );
7653 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7654 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007655#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007656
Neil Armstronge4512952022-03-08 09:08:22 +01007657#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02007658 mac_alg = mbedtls_hash_info_psa_from_md( ciphersuite_info->mac );
Neil Armstronge4512952022-03-08 09:08:22 +01007659 if( mac_alg == 0 )
7660 {
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02007661 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_hash_info_psa_from_md for %u not found",
Neil Armstronge4512952022-03-08 09:08:22 +01007662 (unsigned) ciphersuite_info->mac ) );
7663 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7664 }
7665#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007666 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
7667 if( md_info == NULL )
7668 {
7669 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
7670 (unsigned) ciphersuite_info->mac ) );
7671 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7672 }
Neil Armstronge4512952022-03-08 09:08:22 +01007673#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007674
7675#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
7676 /* Copy own and peer's CID if the use of the CID
7677 * extension has been negotiated. */
7678 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
7679 {
7680 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
7681
7682 transform->in_cid_len = ssl->own_cid_len;
7683 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
7684 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
7685 transform->in_cid_len );
7686
7687 transform->out_cid_len = ssl->handshake->peer_cid_len;
7688 memcpy( transform->out_cid, ssl->handshake->peer_cid,
7689 ssl->handshake->peer_cid_len );
7690 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
7691 transform->out_cid_len );
7692 }
7693#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
7694
7695 /*
7696 * Compute key block using the PRF
7697 */
7698 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
7699 if( ret != 0 )
7700 {
7701 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
7702 return( ret );
7703 }
7704
7705 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
7706 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
7707 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
7708 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
7709 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
7710
7711 /*
7712 * Determine the appropriate key, IV and MAC length.
7713 */
7714
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007715#if defined(MBEDTLS_USE_PSA_CRYPTO)
7716 keylen = PSA_BITS_TO_BYTES(key_bits);
7717#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007718 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007719#endif
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007720
7721#if defined(MBEDTLS_GCM_C) || \
7722 defined(MBEDTLS_CCM_C) || \
7723 defined(MBEDTLS_CHACHAPOLY_C)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007724 if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007725 {
7726 size_t explicit_ivlen;
7727
7728 transform->maclen = 0;
7729 mac_key_len = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007730
7731 /* All modes haves 96-bit IVs, but the length of the static parts vary
7732 * with mode and version:
7733 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
7734 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
7735 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
7736 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
7737 * sequence number).
7738 */
7739 transform->ivlen = 12;
David Horstmann3b2276a2022-10-06 14:49:08 +01007740
7741 int is_chachapoly = 0;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007742#if defined(MBEDTLS_USE_PSA_CRYPTO)
David Horstmann3b2276a2022-10-06 14:49:08 +01007743 is_chachapoly = ( key_type == PSA_KEY_TYPE_CHACHA20 );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007744#else
David Horstmann3b2276a2022-10-06 14:49:08 +01007745 is_chachapoly = ( mbedtls_cipher_info_get_mode( cipher_info )
7746 == MBEDTLS_MODE_CHACHAPOLY );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007747#endif /* MBEDTLS_USE_PSA_CRYPTO */
David Horstmann3b2276a2022-10-06 14:49:08 +01007748
7749 if( is_chachapoly )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007750 transform->fixed_ivlen = 12;
7751 else
7752 transform->fixed_ivlen = 4;
7753
7754 /* Minimum length of encrypted record */
7755 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
7756 transform->minlen = explicit_ivlen + transform->taglen;
7757 }
7758 else
7759#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
7760#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007761 if( ssl_mode == MBEDTLS_SSL_MODE_STREAM ||
7762 ssl_mode == MBEDTLS_SSL_MODE_CBC ||
7763 ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007764 {
Neil Armstronge4512952022-03-08 09:08:22 +01007765#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstrongd1be7672022-04-04 11:21:41 +02007766 size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007767#else
7768 size_t block_size = cipher_info->block_size;
7769#endif /* MBEDTLS_USE_PSA_CRYPTO */
7770
7771#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01007772 /* Get MAC length */
7773 mac_key_len = PSA_HASH_LENGTH(mac_alg);
7774#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007775 /* Initialize HMAC contexts */
7776 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
7777 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
7778 {
7779 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7780 goto end;
7781 }
7782
7783 /* Get MAC length */
7784 mac_key_len = mbedtls_md_get_size( md_info );
Neil Armstronge4512952022-03-08 09:08:22 +01007785#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007786 transform->maclen = mac_key_len;
7787
7788 /* IV length */
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007789#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstrong2230e6c2022-04-27 10:36:14 +02007790 transform->ivlen = PSA_CIPHER_IV_LENGTH( key_type, alg );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007791#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007792 transform->ivlen = cipher_info->iv_size;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007793#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007794
7795 /* Minimum length */
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007796 if( ssl_mode == MBEDTLS_SSL_MODE_STREAM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007797 transform->minlen = transform->maclen;
7798 else
7799 {
7800 /*
7801 * GenericBlockCipher:
7802 * 1. if EtM is in use: one block plus MAC
7803 * otherwise: * first multiple of blocklen greater than maclen
7804 * 2. IV
7805 */
7806#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007807 if( ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007808 {
7809 transform->minlen = transform->maclen
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007810 + block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007811 }
7812 else
7813#endif
7814 {
7815 transform->minlen = transform->maclen
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007816 + block_size
7817 - transform->maclen % block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007818 }
7819
Glenn Strauss07c64162022-03-14 12:34:51 -04007820 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007821 {
7822 transform->minlen += transform->ivlen;
7823 }
7824 else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007825 {
7826 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7827 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7828 goto end;
7829 }
7830 }
7831 }
7832 else
7833#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7834 {
7835 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7836 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7837 }
7838
7839 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
7840 (unsigned) keylen,
7841 (unsigned) transform->minlen,
7842 (unsigned) transform->ivlen,
7843 (unsigned) transform->maclen ) );
7844
7845 /*
7846 * Finally setup the cipher contexts, IVs and MAC secrets.
7847 */
7848#if defined(MBEDTLS_SSL_CLI_C)
7849 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
7850 {
7851 key1 = keyblk + mac_key_len * 2;
7852 key2 = keyblk + mac_key_len * 2 + keylen;
7853
7854 mac_enc = keyblk;
7855 mac_dec = keyblk + mac_key_len;
7856
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007857 iv_copy_len = ( transform->fixed_ivlen ) ?
7858 transform->fixed_ivlen : transform->ivlen;
7859 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
7860 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
7861 iv_copy_len );
7862 }
7863 else
7864#endif /* MBEDTLS_SSL_CLI_C */
7865#if defined(MBEDTLS_SSL_SRV_C)
7866 if( endpoint == MBEDTLS_SSL_IS_SERVER )
7867 {
7868 key1 = keyblk + mac_key_len * 2 + keylen;
7869 key2 = keyblk + mac_key_len * 2;
7870
7871 mac_enc = keyblk + mac_key_len;
7872 mac_dec = keyblk;
7873
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007874 iv_copy_len = ( transform->fixed_ivlen ) ?
7875 transform->fixed_ivlen : transform->ivlen;
7876 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
7877 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
7878 iv_copy_len );
7879 }
7880 else
7881#endif /* MBEDTLS_SSL_SRV_C */
7882 {
7883 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7884 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7885 goto end;
7886 }
7887
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007888 if( ssl != NULL && ssl->f_export_keys != NULL )
7889 {
7890 ssl->f_export_keys( ssl->p_export_keys,
7891 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
7892 master, 48,
7893 randbytes + 32,
7894 randbytes,
7895 tls_prf_get_type( tls_prf ) );
7896 }
7897
7898#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007899 transform->psa_alg = alg;
7900
7901 if ( alg != MBEDTLS_SSL_NULL_CIPHER )
7902 {
7903 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
7904 psa_set_key_algorithm( &attributes, alg );
7905 psa_set_key_type( &attributes, key_type );
7906
7907 if( ( status = psa_import_key( &attributes,
7908 key1,
7909 PSA_BITS_TO_BYTES( key_bits ),
7910 &transform->psa_key_enc ) ) != PSA_SUCCESS )
7911 {
7912 MBEDTLS_SSL_DEBUG_RET( 3, "psa_import_key", (int)status );
7913 ret = psa_ssl_status_to_mbedtls( status );
7914 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7915 goto end;
7916 }
7917
7918 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
7919
7920 if( ( status = psa_import_key( &attributes,
7921 key2,
7922 PSA_BITS_TO_BYTES( key_bits ),
7923 &transform->psa_key_dec ) ) != PSA_SUCCESS )
7924 {
7925 ret = psa_ssl_status_to_mbedtls( status );
7926 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7927 goto end;
7928 }
7929 }
7930#else
7931 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
7932 cipher_info ) ) != 0 )
7933 {
7934 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7935 goto end;
7936 }
7937
7938 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
7939 cipher_info ) ) != 0 )
7940 {
7941 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7942 goto end;
7943 }
7944
7945 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
7946 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7947 MBEDTLS_ENCRYPT ) ) != 0 )
7948 {
7949 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7950 goto end;
7951 }
7952
7953 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
7954 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7955 MBEDTLS_DECRYPT ) ) != 0 )
7956 {
7957 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7958 goto end;
7959 }
7960
7961#if defined(MBEDTLS_CIPHER_MODE_CBC)
7962 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
7963 {
7964 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
7965 MBEDTLS_PADDING_NONE ) ) != 0 )
7966 {
7967 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7968 goto end;
7969 }
7970
7971 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
7972 MBEDTLS_PADDING_NONE ) ) != 0 )
7973 {
7974 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7975 goto end;
7976 }
7977 }
7978#endif /* MBEDTLS_CIPHER_MODE_CBC */
7979#endif /* MBEDTLS_USE_PSA_CRYPTO */
7980
Neil Armstrong29c0c042022-03-17 17:47:28 +01007981#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
7982 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
7983 For AEAD-based ciphersuites, there is nothing to do here. */
7984 if( mac_key_len != 0 )
7985 {
7986#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01007987 transform->psa_mac_alg = PSA_ALG_HMAC( mac_alg );
Neil Armstrong29c0c042022-03-17 17:47:28 +01007988
7989 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
Neil Armstronge4512952022-03-08 09:08:22 +01007990 psa_set_key_algorithm( &attributes, PSA_ALG_HMAC( mac_alg ) );
Neil Armstrong29c0c042022-03-17 17:47:28 +01007991 psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
7992
7993 if( ( status = psa_import_key( &attributes,
7994 mac_enc, mac_key_len,
7995 &transform->psa_mac_enc ) ) != PSA_SUCCESS )
7996 {
7997 ret = psa_ssl_status_to_mbedtls( status );
7998 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7999 goto end;
8000 }
8001
Ronald Cronfb39f152022-03-25 14:36:28 +01008002 if( ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ) ||
Andrzej Kurek8c95ac42022-08-17 16:17:00 -04008003 ( ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING )
8004#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
8005 && ( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED )
8006#endif
8007 ) )
Neil Armstrong29c0c042022-03-17 17:47:28 +01008008 /* mbedtls_ct_hmac() requires the key to be exportable */
8009 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT |
8010 PSA_KEY_USAGE_VERIFY_HASH );
8011 else
8012 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
8013
8014 if( ( status = psa_import_key( &attributes,
8015 mac_dec, mac_key_len,
8016 &transform->psa_mac_dec ) ) != PSA_SUCCESS )
8017 {
8018 ret = psa_ssl_status_to_mbedtls( status );
8019 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
8020 goto end;
8021 }
8022#else
8023 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
8024 if( ret != 0 )
8025 goto end;
8026 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
8027 if( ret != 0 )
8028 goto end;
8029#endif /* MBEDTLS_USE_PSA_CRYPTO */
8030 }
8031#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
8032
8033 ((void) mac_dec);
8034 ((void) mac_enc);
8035
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008036end:
8037 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
8038 return( ret );
8039}
8040
Jerry Yuee40f9d2022-02-17 14:55:16 +08008041#if defined(MBEDTLS_USE_PSA_CRYPTO)
8042int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
8043 unsigned char *hash, size_t *hashlen,
8044 unsigned char *data, size_t data_len,
8045 mbedtls_md_type_t md_alg )
8046{
8047 psa_status_t status;
8048 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02008049 psa_algorithm_t hash_alg = mbedtls_hash_info_psa_from_md( md_alg );
Jerry Yuee40f9d2022-02-17 14:55:16 +08008050
8051 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
8052
8053 if( ( status = psa_hash_setup( &hash_operation,
8054 hash_alg ) ) != PSA_SUCCESS )
8055 {
8056 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
8057 goto exit;
8058 }
8059
8060 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
8061 64 ) ) != PSA_SUCCESS )
8062 {
8063 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
8064 goto exit;
8065 }
8066
8067 if( ( status = psa_hash_update( &hash_operation,
8068 data, data_len ) ) != PSA_SUCCESS )
8069 {
8070 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
8071 goto exit;
8072 }
8073
8074 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
8075 hashlen ) ) != PSA_SUCCESS )
8076 {
8077 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
8078 goto exit;
8079 }
8080
8081exit:
8082 if( status != PSA_SUCCESS )
8083 {
8084 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8085 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
8086 switch( status )
8087 {
8088 case PSA_ERROR_NOT_SUPPORTED:
8089 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
8090 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
8091 case PSA_ERROR_BUFFER_TOO_SMALL:
8092 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
8093 case PSA_ERROR_INSUFFICIENT_MEMORY:
8094 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
8095 default:
8096 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
8097 }
8098 }
8099 return( 0 );
8100}
8101
8102#else
8103
8104int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
8105 unsigned char *hash, size_t *hashlen,
8106 unsigned char *data, size_t data_len,
8107 mbedtls_md_type_t md_alg )
8108{
8109 int ret = 0;
8110 mbedtls_md_context_t ctx;
8111 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
8112 *hashlen = mbedtls_md_get_size( md_info );
8113
8114 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
8115
8116 mbedtls_md_init( &ctx );
8117
8118 /*
8119 * digitally-signed struct {
8120 * opaque client_random[32];
8121 * opaque server_random[32];
8122 * ServerDHParams params;
8123 * };
8124 */
8125 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
8126 {
8127 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
8128 goto exit;
8129 }
8130 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
8131 {
8132 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
8133 goto exit;
8134 }
8135 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
8136 {
8137 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
8138 goto exit;
8139 }
8140 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
8141 {
8142 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
8143 goto exit;
8144 }
8145 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
8146 {
8147 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
8148 goto exit;
8149 }
8150
8151exit:
8152 mbedtls_md_free( &ctx );
8153
8154 if( ret != 0 )
8155 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8156 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
8157
8158 return( ret );
8159}
8160#endif /* MBEDTLS_USE_PSA_CRYPTO */
8161
Jerry Yud9d91da2022-02-17 14:57:06 +08008162#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
8163
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008164/* Find the preferred hash for a given signature algorithm. */
8165unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
8166 mbedtls_ssl_context *ssl,
8167 unsigned int sig_alg )
Jerry Yud9d91da2022-02-17 14:57:06 +08008168{
Gabor Mezei078e8032022-04-27 21:17:56 +02008169 unsigned int i;
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008170 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
Gabor Mezei078e8032022-04-27 21:17:56 +02008171
8172 if( sig_alg == MBEDTLS_SSL_SIG_ANON )
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008173 return( MBEDTLS_SSL_HASH_NONE );
Gabor Mezei078e8032022-04-27 21:17:56 +02008174
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008175 for( i = 0; received_sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++ )
Jerry Yud9d91da2022-02-17 14:57:06 +08008176 {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008177 unsigned int hash_alg_received =
8178 MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(
8179 received_sig_algs[i] );
8180 unsigned int sig_alg_received =
8181 MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(
8182 received_sig_algs[i] );
8183
8184 if( sig_alg == sig_alg_received )
8185 {
8186#if defined(MBEDTLS_USE_PSA_CRYPTO)
8187 if( ssl->handshake->key_cert && ssl->handshake->key_cert->key )
8188 {
Neil Armstrong96eceb82022-06-30 18:05:05 +02008189 psa_algorithm_t psa_hash_alg =
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02008190 mbedtls_hash_info_psa_from_md( hash_alg_received );
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008191
Neil Armstrong96eceb82022-06-30 18:05:05 +02008192 if( sig_alg_received == MBEDTLS_SSL_SIG_ECDSA &&
8193 ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key,
8194 PSA_ALG_ECDSA( psa_hash_alg ),
8195 PSA_KEY_USAGE_SIGN_HASH ) )
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008196 continue;
8197
Neil Armstrong96eceb82022-06-30 18:05:05 +02008198 if( sig_alg_received == MBEDTLS_SSL_SIG_RSA &&
Neil Armstrong971f30d2022-07-01 16:23:50 +02008199 ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key,
8200 PSA_ALG_RSA_PKCS1V15_SIGN(
8201 psa_hash_alg ),
8202 PSA_KEY_USAGE_SIGN_HASH ) )
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008203 continue;
8204 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008205#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong96eceb82022-06-30 18:05:05 +02008206
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008207 return( hash_alg_received );
8208 }
Jerry Yud9d91da2022-02-17 14:57:06 +08008209 }
Jerry Yud9d91da2022-02-17 14:57:06 +08008210
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008211 return( MBEDTLS_SSL_HASH_NONE );
Jerry Yud9d91da2022-02-17 14:57:06 +08008212}
8213
8214#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
8215
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008216/* Serialization of TLS 1.2 sessions:
8217 *
8218 * struct {
8219 * uint64 start_time;
8220 * uint8 ciphersuite[2]; // defined by the standard
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008221 * uint8 session_id_len; // at most 32
8222 * opaque session_id[32];
8223 * opaque master[48]; // fixed length in the standard
8224 * uint32 verify_result;
8225 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
8226 * opaque ticket<0..2^24-1>; // length 0 means no ticket
8227 * uint32 ticket_lifetime;
8228 * uint8 mfl_code; // up to 255 according to standard
8229 * uint8 encrypt_then_mac; // 0 or 1
8230 * } serialized_session_tls12;
8231 *
8232 */
Jerry Yu438ddd82022-07-07 06:55:50 +00008233static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008234 unsigned char *buf,
8235 size_t buf_len )
8236{
8237 unsigned char *p = buf;
8238 size_t used = 0;
8239
8240#if defined(MBEDTLS_HAVE_TIME)
8241 uint64_t start;
8242#endif
8243#if defined(MBEDTLS_X509_CRT_PARSE_C)
8244#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8245 size_t cert_len;
8246#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8247#endif /* MBEDTLS_X509_CRT_PARSE_C */
8248
8249 /*
8250 * Time
8251 */
8252#if defined(MBEDTLS_HAVE_TIME)
8253 used += 8;
8254
8255 if( used <= buf_len )
8256 {
8257 start = (uint64_t) session->start;
8258
8259 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
8260 p += 8;
8261 }
8262#endif /* MBEDTLS_HAVE_TIME */
8263
8264 /*
8265 * Basic mandatory fields
8266 */
8267 used += 2 /* ciphersuite */
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008268 + 1 /* id_len */
8269 + sizeof( session->id )
8270 + sizeof( session->master )
8271 + 4; /* verify_result */
8272
8273 if( used <= buf_len )
8274 {
8275 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
8276 p += 2;
8277
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008278 *p++ = MBEDTLS_BYTE_0( session->id_len );
8279 memcpy( p, session->id, 32 );
8280 p += 32;
8281
8282 memcpy( p, session->master, 48 );
8283 p += 48;
8284
8285 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
8286 p += 4;
8287 }
8288
8289 /*
8290 * Peer's end-entity certificate
8291 */
8292#if defined(MBEDTLS_X509_CRT_PARSE_C)
8293#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8294 if( session->peer_cert == NULL )
8295 cert_len = 0;
8296 else
8297 cert_len = session->peer_cert->raw.len;
8298
8299 used += 3 + cert_len;
8300
8301 if( used <= buf_len )
8302 {
8303 *p++ = MBEDTLS_BYTE_2( cert_len );
8304 *p++ = MBEDTLS_BYTE_1( cert_len );
8305 *p++ = MBEDTLS_BYTE_0( cert_len );
8306
8307 if( session->peer_cert != NULL )
8308 {
8309 memcpy( p, session->peer_cert->raw.p, cert_len );
8310 p += cert_len;
8311 }
8312 }
8313#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8314 if( session->peer_cert_digest != NULL )
8315 {
8316 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
8317 if( used <= buf_len )
8318 {
8319 *p++ = (unsigned char) session->peer_cert_digest_type;
8320 *p++ = (unsigned char) session->peer_cert_digest_len;
8321 memcpy( p, session->peer_cert_digest,
8322 session->peer_cert_digest_len );
8323 p += session->peer_cert_digest_len;
8324 }
8325 }
8326 else
8327 {
8328 used += 2;
8329 if( used <= buf_len )
8330 {
8331 *p++ = (unsigned char) MBEDTLS_MD_NONE;
8332 *p++ = 0;
8333 }
8334 }
8335#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8336#endif /* MBEDTLS_X509_CRT_PARSE_C */
8337
8338 /*
8339 * Session ticket if any, plus associated data
8340 */
8341#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8342 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
8343
8344 if( used <= buf_len )
8345 {
8346 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
8347 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
8348 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
8349
8350 if( session->ticket != NULL )
8351 {
8352 memcpy( p, session->ticket, session->ticket_len );
8353 p += session->ticket_len;
8354 }
8355
8356 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
8357 p += 4;
8358 }
8359#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8360
8361 /*
8362 * Misc extension-related info
8363 */
8364#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8365 used += 1;
8366
8367 if( used <= buf_len )
8368 *p++ = session->mfl_code;
8369#endif
8370
8371#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
8372 used += 1;
8373
8374 if( used <= buf_len )
8375 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
8376#endif
8377
8378 return( used );
8379}
8380
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008381MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu438ddd82022-07-07 06:55:50 +00008382static int ssl_tls12_session_load( mbedtls_ssl_session *session,
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008383 const unsigned char *buf,
8384 size_t len )
8385{
8386#if defined(MBEDTLS_HAVE_TIME)
8387 uint64_t start;
8388#endif
8389#if defined(MBEDTLS_X509_CRT_PARSE_C)
8390#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8391 size_t cert_len;
8392#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8393#endif /* MBEDTLS_X509_CRT_PARSE_C */
8394
8395 const unsigned char *p = buf;
8396 const unsigned char * const end = buf + len;
8397
8398 /*
8399 * Time
8400 */
8401#if defined(MBEDTLS_HAVE_TIME)
8402 if( 8 > (size_t)( end - p ) )
8403 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8404
8405 start = ( (uint64_t) p[0] << 56 ) |
8406 ( (uint64_t) p[1] << 48 ) |
8407 ( (uint64_t) p[2] << 40 ) |
8408 ( (uint64_t) p[3] << 32 ) |
8409 ( (uint64_t) p[4] << 24 ) |
8410 ( (uint64_t) p[5] << 16 ) |
8411 ( (uint64_t) p[6] << 8 ) |
8412 ( (uint64_t) p[7] );
8413 p += 8;
8414
8415 session->start = (time_t) start;
8416#endif /* MBEDTLS_HAVE_TIME */
8417
8418 /*
8419 * Basic mandatory fields
8420 */
Thomas Daubney20f89a92022-06-20 15:12:19 +01008421 if( 2 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008422 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8423
8424 session->ciphersuite = ( p[0] << 8 ) | p[1];
8425 p += 2;
8426
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008427 session->id_len = *p++;
8428 memcpy( session->id, p, 32 );
8429 p += 32;
8430
8431 memcpy( session->master, p, 48 );
8432 p += 48;
8433
8434 session->verify_result = ( (uint32_t) p[0] << 24 ) |
8435 ( (uint32_t) p[1] << 16 ) |
8436 ( (uint32_t) p[2] << 8 ) |
8437 ( (uint32_t) p[3] );
8438 p += 4;
8439
8440 /* Immediately clear invalid pointer values that have been read, in case
8441 * we exit early before we replaced them with valid ones. */
8442#if defined(MBEDTLS_X509_CRT_PARSE_C)
8443#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8444 session->peer_cert = NULL;
8445#else
8446 session->peer_cert_digest = NULL;
8447#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8448#endif /* MBEDTLS_X509_CRT_PARSE_C */
8449#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8450 session->ticket = NULL;
8451#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8452
8453 /*
8454 * Peer certificate
8455 */
8456#if defined(MBEDTLS_X509_CRT_PARSE_C)
8457#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8458 /* Deserialize CRT from the end of the ticket. */
8459 if( 3 > (size_t)( end - p ) )
8460 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8461
8462 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
8463 p += 3;
8464
8465 if( cert_len != 0 )
8466 {
8467 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8468
8469 if( cert_len > (size_t)( end - p ) )
8470 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8471
8472 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
8473
8474 if( session->peer_cert == NULL )
8475 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8476
8477 mbedtls_x509_crt_init( session->peer_cert );
8478
8479 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
8480 p, cert_len ) ) != 0 )
8481 {
8482 mbedtls_x509_crt_free( session->peer_cert );
8483 mbedtls_free( session->peer_cert );
8484 session->peer_cert = NULL;
8485 return( ret );
8486 }
8487
8488 p += cert_len;
8489 }
8490#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8491 /* Deserialize CRT digest from the end of the ticket. */
8492 if( 2 > (size_t)( end - p ) )
8493 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8494
8495 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
8496 session->peer_cert_digest_len = (size_t) *p++;
8497
8498 if( session->peer_cert_digest_len != 0 )
8499 {
8500 const mbedtls_md_info_t *md_info =
8501 mbedtls_md_info_from_type( session->peer_cert_digest_type );
8502 if( md_info == NULL )
8503 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8504 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
8505 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8506
8507 if( session->peer_cert_digest_len > (size_t)( end - p ) )
8508 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8509
8510 session->peer_cert_digest =
8511 mbedtls_calloc( 1, session->peer_cert_digest_len );
8512 if( session->peer_cert_digest == NULL )
8513 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8514
8515 memcpy( session->peer_cert_digest, p,
8516 session->peer_cert_digest_len );
8517 p += session->peer_cert_digest_len;
8518 }
8519#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8520#endif /* MBEDTLS_X509_CRT_PARSE_C */
8521
8522 /*
8523 * Session ticket and associated data
8524 */
8525#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8526 if( 3 > (size_t)( end - p ) )
8527 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8528
8529 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
8530 p += 3;
8531
8532 if( session->ticket_len != 0 )
8533 {
8534 if( session->ticket_len > (size_t)( end - p ) )
8535 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8536
8537 session->ticket = mbedtls_calloc( 1, session->ticket_len );
8538 if( session->ticket == NULL )
8539 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8540
8541 memcpy( session->ticket, p, session->ticket_len );
8542 p += session->ticket_len;
8543 }
8544
8545 if( 4 > (size_t)( end - p ) )
8546 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8547
8548 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
8549 ( (uint32_t) p[1] << 16 ) |
8550 ( (uint32_t) p[2] << 8 ) |
8551 ( (uint32_t) p[3] );
8552 p += 4;
8553#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8554
8555 /*
8556 * Misc extension-related info
8557 */
8558#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8559 if( 1 > (size_t)( end - p ) )
8560 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8561
8562 session->mfl_code = *p++;
8563#endif
8564
8565#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
8566 if( 1 > (size_t)( end - p ) )
8567 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8568
8569 session->encrypt_then_mac = *p++;
8570#endif
8571
8572 /* Done, should have consumed entire buffer */
8573 if( p != end )
8574 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8575
8576 return( 0 );
8577}
Jerry Yudc7bd172022-02-17 13:44:15 +08008578#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8579
XiaokangQian75d40ef2022-04-20 11:05:24 +00008580int mbedtls_ssl_validate_ciphersuite(
8581 const mbedtls_ssl_context *ssl,
8582 const mbedtls_ssl_ciphersuite_t *suite_info,
8583 mbedtls_ssl_protocol_version min_tls_version,
8584 mbedtls_ssl_protocol_version max_tls_version )
8585{
8586 (void) ssl;
8587
8588 if( suite_info == NULL )
8589 return( -1 );
8590
8591 if( ( suite_info->min_tls_version > max_tls_version ) ||
8592 ( suite_info->max_tls_version < min_tls_version ) )
8593 {
8594 return( -1 );
8595 }
8596
XiaokangQian060d8672022-04-21 09:24:56 +00008597#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_CLI_C)
XiaokangQian75d40ef2022-04-20 11:05:24 +00008598#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
8599 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
8600 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
8601 {
8602 return( -1 );
8603 }
8604#endif
8605
8606 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
8607#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
8608 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
8609 mbedtls_ssl_conf_has_static_psk( ssl->conf ) == 0 )
8610 {
8611 return( -1 );
8612 }
8613#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
8614#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8615
8616 return( 0 );
8617}
8618
Ronald Crone68ab4f2022-10-05 12:46:29 +02008619#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
XiaokangQianeaf36512022-04-24 09:07:44 +00008620/*
8621 * Function for writing a signature algorithm extension.
8622 *
8623 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
8624 * value (TLS 1.3 RFC8446):
8625 * enum {
8626 * ....
8627 * ecdsa_secp256r1_sha256( 0x0403 ),
8628 * ecdsa_secp384r1_sha384( 0x0503 ),
8629 * ecdsa_secp521r1_sha512( 0x0603 ),
8630 * ....
8631 * } SignatureScheme;
8632 *
8633 * struct {
8634 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
8635 * } SignatureSchemeList;
8636 *
8637 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
8638 * value (TLS 1.2 RFC5246):
8639 * enum {
8640 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
8641 * sha512(6), (255)
8642 * } HashAlgorithm;
8643 *
8644 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
8645 * SignatureAlgorithm;
8646 *
8647 * struct {
8648 * HashAlgorithm hash;
8649 * SignatureAlgorithm signature;
8650 * } SignatureAndHashAlgorithm;
8651 *
8652 * SignatureAndHashAlgorithm
8653 * supported_signature_algorithms<2..2^16-2>;
8654 *
8655 * The TLS 1.3 signature algorithm extension was defined to be a compatible
8656 * generalization of the TLS 1.2 signature algorithm extension.
8657 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
8658 * `SignatureScheme` field of TLS 1.3
8659 *
8660 */
8661int mbedtls_ssl_write_sig_alg_ext( mbedtls_ssl_context *ssl, unsigned char *buf,
8662 const unsigned char *end, size_t *out_len )
8663{
8664 unsigned char *p = buf;
8665 unsigned char *supported_sig_alg; /* Start of supported_signature_algorithms */
8666 size_t supported_sig_alg_len = 0; /* Length of supported_signature_algorithms */
8667
8668 *out_len = 0;
8669
8670 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding signature_algorithms extension" ) );
8671
8672 /* Check if we have space for header and length field:
8673 * - extension_type (2 bytes)
8674 * - extension_data_length (2 bytes)
8675 * - supported_signature_algorithms_length (2 bytes)
8676 */
8677 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
8678 p += 6;
8679
8680 /*
8681 * Write supported_signature_algorithms
8682 */
8683 supported_sig_alg = p;
8684 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs( ssl );
8685 if( sig_alg == NULL )
8686 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
8687
8688 for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ )
8689 {
Jerry Yu53f5c152022-06-22 20:24:38 +08008690 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got signature scheme [%x] %s",
8691 *sig_alg,
8692 mbedtls_ssl_sig_alg_to_str( *sig_alg ) ) );
XiaokangQianeaf36512022-04-24 09:07:44 +00008693 if( ! mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg ) )
8694 continue;
8695 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
8696 MBEDTLS_PUT_UINT16_BE( *sig_alg, p, 0 );
8697 p += 2;
Jerry Yu80dd5db2022-06-22 19:30:32 +08008698 MBEDTLS_SSL_DEBUG_MSG( 3, ( "sent signature scheme [%x] %s",
Jerry Yuf3b46b52022-06-19 16:52:27 +08008699 *sig_alg,
8700 mbedtls_ssl_sig_alg_to_str( *sig_alg ) ) );
XiaokangQianeaf36512022-04-24 09:07:44 +00008701 }
8702
8703 /* Length of supported_signature_algorithms */
8704 supported_sig_alg_len = p - supported_sig_alg;
8705 if( supported_sig_alg_len == 0 )
8706 {
8707 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No signature algorithms defined." ) );
8708 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
8709 }
8710
XiaokangQianeaf36512022-04-24 09:07:44 +00008711 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SIG_ALG, buf, 0 );
XiaokangQianeaf36512022-04-24 09:07:44 +00008712 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len + 2, buf, 2 );
XiaokangQianeaf36512022-04-24 09:07:44 +00008713 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len, buf, 4 );
8714
XiaokangQianeaf36512022-04-24 09:07:44 +00008715 *out_len = p - buf;
8716
8717#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
8718 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SIG_ALG;
8719#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
8720 return( 0 );
8721}
Ronald Crone68ab4f2022-10-05 12:46:29 +02008722#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
XiaokangQianeaf36512022-04-24 09:07:44 +00008723
XiaokangQian40a35232022-05-07 09:02:40 +00008724#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
XiaokangQian9b2b7712022-05-17 02:57:00 +00008725/*
8726 * mbedtls_ssl_parse_server_name_ext
8727 *
8728 * Structure of server_name extension:
8729 *
8730 * enum {
8731 * host_name(0), (255)
8732 * } NameType;
8733 * opaque HostName<1..2^16-1>;
8734 *
8735 * struct {
8736 * NameType name_type;
8737 * select (name_type) {
8738 * case host_name: HostName;
8739 * } name;
8740 * } ServerName;
8741 * struct {
8742 * ServerName server_name_list<1..2^16-1>
8743 * } ServerNameList;
8744 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02008745MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian9b2b7712022-05-17 02:57:00 +00008746int mbedtls_ssl_parse_server_name_ext( mbedtls_ssl_context *ssl,
8747 const unsigned char *buf,
8748 const unsigned char *end )
XiaokangQian40a35232022-05-07 09:02:40 +00008749{
8750 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8751 const unsigned char *p = buf;
XiaokangQian9b2b7712022-05-17 02:57:00 +00008752 size_t server_name_list_len, hostname_len;
8753 const unsigned char *server_name_list_end;
XiaokangQian40a35232022-05-07 09:02:40 +00008754
XiaokangQianf2a94202022-05-20 06:44:24 +00008755 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
XiaokangQian40a35232022-05-07 09:02:40 +00008756
8757 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQian9b2b7712022-05-17 02:57:00 +00008758 server_name_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian40a35232022-05-07 09:02:40 +00008759 p += 2;
8760
XiaokangQian9b2b7712022-05-17 02:57:00 +00008761 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, server_name_list_len );
8762 server_name_list_end = p + server_name_list_len;
XiaokangQian75fe8c72022-06-15 09:42:45 +00008763 while( p < server_name_list_end )
XiaokangQian40a35232022-05-07 09:02:40 +00008764 {
XiaokangQian9b2b7712022-05-17 02:57:00 +00008765 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, server_name_list_end, 3 );
XiaokangQian40a35232022-05-07 09:02:40 +00008766 hostname_len = MBEDTLS_GET_UINT16_BE( p, 1 );
XiaokangQian9b2b7712022-05-17 02:57:00 +00008767 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, server_name_list_end,
8768 hostname_len + 3 );
XiaokangQian40a35232022-05-07 09:02:40 +00008769
8770 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
8771 {
XiaokangQian75fe8c72022-06-15 09:42:45 +00008772 /* sni_name is intended to be used only during the parsing of the
8773 * ClientHello message (it is reset to NULL before the end of
8774 * the message parsing). Thus it is ok to just point to the
8775 * reception buffer and not make a copy of it.
8776 */
XiaokangQianf2a94202022-05-20 06:44:24 +00008777 ssl->handshake->sni_name = p + 3;
8778 ssl->handshake->sni_name_len = hostname_len;
8779 if( ssl->conf->f_sni == NULL )
8780 return( 0 );
XiaokangQian40a35232022-05-07 09:02:40 +00008781 ret = ssl->conf->f_sni( ssl->conf->p_sni,
XiaokangQian9b2b7712022-05-17 02:57:00 +00008782 ssl, p + 3, hostname_len );
XiaokangQian40a35232022-05-07 09:02:40 +00008783 if( ret != 0 )
8784 {
XiaokangQianf2a94202022-05-20 06:44:24 +00008785 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
XiaokangQian129aeb92022-06-02 09:29:18 +00008786 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME,
8787 MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME );
XiaokangQian40a35232022-05-07 09:02:40 +00008788 return( MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME );
8789 }
8790 return( 0 );
8791 }
8792
8793 p += hostname_len + 3;
8794 }
8795
8796 return( 0 );
8797}
8798#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
8799
XiaokangQianacb39922022-06-17 10:18:48 +00008800#if defined(MBEDTLS_SSL_ALPN)
Ronald Cronce7d76e2022-07-08 18:56:49 +02008801MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianacb39922022-06-17 10:18:48 +00008802int mbedtls_ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
8803 const unsigned char *buf,
8804 const unsigned char *end )
8805{
8806 const unsigned char *p = buf;
XiaokangQianc7403452022-06-23 03:24:12 +00008807 size_t protocol_name_list_len;
XiaokangQian95d5f542022-06-24 02:29:26 +00008808 const unsigned char *protocol_name_list;
8809 const unsigned char *protocol_name_list_end;
XiaokangQianc7403452022-06-23 03:24:12 +00008810 size_t protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008811
8812 /* If ALPN not configured, just ignore the extension */
8813 if( ssl->conf->alpn_list == NULL )
8814 return( 0 );
8815
8816 /*
XiaokangQianc7403452022-06-23 03:24:12 +00008817 * RFC7301, section 3.1
8818 * opaque ProtocolName<1..2^8-1>;
XiaokangQianacb39922022-06-17 10:18:48 +00008819 *
XiaokangQianc7403452022-06-23 03:24:12 +00008820 * struct {
8821 * ProtocolName protocol_name_list<2..2^16-1>
8822 * } ProtocolNameList;
XiaokangQianacb39922022-06-17 10:18:48 +00008823 */
8824
XiaokangQianc7403452022-06-23 03:24:12 +00008825 /*
XiaokangQian0b776e22022-06-24 09:04:59 +00008826 * protocol_name_list_len 2 bytes
8827 * protocol_name_len 1 bytes
8828 * protocol_name >=1 byte
XiaokangQianc7403452022-06-23 03:24:12 +00008829 */
XiaokangQianacb39922022-06-17 10:18:48 +00008830 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 4 );
8831
XiaokangQianc7403452022-06-23 03:24:12 +00008832 protocol_name_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQianacb39922022-06-17 10:18:48 +00008833 p += 2;
XiaokangQianc7403452022-06-23 03:24:12 +00008834 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, protocol_name_list_len );
XiaokangQian95d5f542022-06-24 02:29:26 +00008835 protocol_name_list = p;
8836 protocol_name_list_end = p + protocol_name_list_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008837
8838 /* Validate peer's list (lengths) */
XiaokangQian95d5f542022-06-24 02:29:26 +00008839 while( p < protocol_name_list_end )
XiaokangQianacb39922022-06-17 10:18:48 +00008840 {
XiaokangQian95d5f542022-06-24 02:29:26 +00008841 protocol_name_len = *p++;
8842 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, protocol_name_list_end,
8843 protocol_name_len );
XiaokangQianc7403452022-06-23 03:24:12 +00008844 if( protocol_name_len == 0 )
XiaokangQian95d5f542022-06-24 02:29:26 +00008845 {
8846 MBEDTLS_SSL_PEND_FATAL_ALERT(
8847 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
8848 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
XiaokangQianacb39922022-06-17 10:18:48 +00008849 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
XiaokangQian95d5f542022-06-24 02:29:26 +00008850 }
8851
8852 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008853 }
8854
8855 /* Use our order of preference */
8856 for( const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++ )
8857 {
8858 size_t const alpn_len = strlen( *alpn );
XiaokangQian95d5f542022-06-24 02:29:26 +00008859 p = protocol_name_list;
8860 while( p < protocol_name_list_end )
XiaokangQianacb39922022-06-17 10:18:48 +00008861 {
XiaokangQian95d5f542022-06-24 02:29:26 +00008862 protocol_name_len = *p++;
XiaokangQianc7403452022-06-23 03:24:12 +00008863 if( protocol_name_len == alpn_len &&
XiaokangQian95d5f542022-06-24 02:29:26 +00008864 memcmp( p, *alpn, alpn_len ) == 0 )
XiaokangQianacb39922022-06-17 10:18:48 +00008865 {
8866 ssl->alpn_chosen = *alpn;
8867 return( 0 );
8868 }
XiaokangQian95d5f542022-06-24 02:29:26 +00008869
8870 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008871 }
8872 }
8873
XiaokangQian95d5f542022-06-24 02:29:26 +00008874 /* If we get here, no match was found */
XiaokangQianacb39922022-06-17 10:18:48 +00008875 MBEDTLS_SSL_PEND_FATAL_ALERT(
8876 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL,
8877 MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
8878 return( MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
8879}
8880
8881int mbedtls_ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
8882 unsigned char *buf,
8883 unsigned char *end,
XiaokangQianc7403452022-06-23 03:24:12 +00008884 size_t *out_len )
XiaokangQianacb39922022-06-17 10:18:48 +00008885{
8886 unsigned char *p = buf;
XiaokangQian95d5f542022-06-24 02:29:26 +00008887 size_t protocol_name_len;
XiaokangQianc7403452022-06-23 03:24:12 +00008888 *out_len = 0;
XiaokangQianacb39922022-06-17 10:18:48 +00008889
8890 if( ssl->alpn_chosen == NULL )
8891 {
8892 return( 0 );
8893 }
8894
XiaokangQian95d5f542022-06-24 02:29:26 +00008895 protocol_name_len = strlen( ssl->alpn_chosen );
8896 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 + protocol_name_len );
XiaokangQianacb39922022-06-17 10:18:48 +00008897
8898 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server side, adding alpn extension" ) );
8899 /*
8900 * 0 . 1 ext identifier
8901 * 2 . 3 ext length
8902 * 4 . 5 protocol list length
8903 * 6 . 6 protocol name length
8904 * 7 . 7+n protocol name
8905 */
8906 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ALPN, p, 0 );
8907
XiaokangQian95d5f542022-06-24 02:29:26 +00008908 *out_len = 7 + protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008909
XiaokangQian95d5f542022-06-24 02:29:26 +00008910 MBEDTLS_PUT_UINT16_BE( protocol_name_len + 3, p, 2 );
8911 MBEDTLS_PUT_UINT16_BE( protocol_name_len + 1, p, 4 );
XiaokangQian0b776e22022-06-24 09:04:59 +00008912 /* Note: the length of the chosen protocol has been checked to be less
8913 * than 255 bytes in `mbedtls_ssl_conf_alpn_protocols`.
8914 */
XiaokangQian95d5f542022-06-24 02:29:26 +00008915 p[6] = MBEDTLS_BYTE_0( protocol_name_len );
XiaokangQianacb39922022-06-17 10:18:48 +00008916
XiaokangQian95d5f542022-06-24 02:29:26 +00008917 memcpy( p + 7, ssl->alpn_chosen, protocol_name_len );
XiaokangQianacb39922022-06-17 10:18:48 +00008918 return ( 0 );
8919}
8920#endif /* MBEDTLS_SSL_ALPN */
8921
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00008922#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
Xiaokang Qian03409292022-10-12 02:49:52 +00008923 defined(MBEDTLS_SSL_SESSION_TICKETS) && \
Xiaokang Qianed0620c2022-10-12 06:58:13 +00008924 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00008925 defined(MBEDTLS_SSL_CLI_C)
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00008926int mbedtls_ssl_session_set_hostname( mbedtls_ssl_session *session,
8927 const char *hostname )
8928{
8929 /* Initialize to suppress unnecessary compiler warning */
8930 size_t hostname_len = 0;
8931
8932 /* Check if new hostname is valid before
8933 * making any change to current one */
8934 if( hostname != NULL )
8935 {
8936 hostname_len = strlen( hostname );
8937
8938 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
8939 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8940 }
8941
8942 /* Now it's clear that we will overwrite the old hostname,
8943 * so we can free it safely */
8944 if( session->hostname != NULL )
8945 {
8946 mbedtls_platform_zeroize( session->hostname,
8947 strlen( session->hostname ) );
8948 mbedtls_free( session->hostname );
8949 }
8950
8951 /* Passing NULL as hostname shall clear the old one */
8952 if( hostname == NULL )
8953 {
8954 session->hostname = NULL;
8955 }
8956 else
8957 {
8958 session->hostname = mbedtls_calloc( 1, hostname_len + 1 );
8959 if( session->hostname == NULL )
8960 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8961
8962 memcpy( session->hostname, hostname, hostname_len );
8963 }
8964
8965 return( 0 );
8966}
Xiaokang Qian03409292022-10-12 02:49:52 +00008967#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
8968 MBEDTLS_SSL_SESSION_TICKETS &&
Xiaokang Qianed0620c2022-10-12 06:58:13 +00008969 MBEDTLS_SSL_SERVER_NAME_INDICATION &&
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00008970 MBEDTLS_SSL_CLI_C */
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00008971
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008972#endif /* MBEDTLS_SSL_TLS_C */