blob: eb212d2ca0962cb305178ebfaec95450ade0bd08 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 shared functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21/*
22 * The SSL 3.0 specification was drafted by Netscape in 1996,
23 * and became an IETF standard in 1999.
24 *
25 * http://wp.netscape.com/eng/ssl3/
26 * http://www.ietf.org/rfc/rfc2246.txt
27 * http://www.ietf.org/rfc/rfc4346.txt
28 */
29
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020030#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000031#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020032#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020034#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000037
SimonBd5800b72016-04-26 07:43:27 +010038#if defined(MBEDTLS_PLATFORM_C)
39#include "mbedtls/platform.h"
40#else
41#include <stdlib.h>
42#define mbedtls_calloc calloc
43#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010044#endif
45
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/debug.h"
47#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020048#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050049#include "mbedtls/platform_util.h"
Hanno Beckerb5352f02019-05-16 12:39:07 +010050#include "mbedtls/version.h"
Jarno Lamsaaf60cd72019-12-19 16:45:23 +020051#include "mbedtls/platform.h"
52
Rich Evans00ab4702015-02-06 13:43:58 +000053#include <string.h>
54
Janos Follath23bdca02016-10-07 14:47:14 +010055#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000056#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020057#endif
58
Andrzej Kurekf7df0d32020-09-19 12:00:57 +020059#define PROPER_HS_FRAGMENT 0x75
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -040060
Andrzej Kureka7932372020-09-19 07:56:06 +020061#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
62static int mbedtls_ssl_switch_key( mbedtls_ssl_transform *transform,
63 const mbedtls_operation_t operation )
64{
65 unsigned char * key;
Andrzej Kurek69bafce2020-09-19 12:45:20 +020066 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
67 int flow_ctrl = 0;
Andrzej Kureka7932372020-09-19 07:56:06 +020068#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
69 uint32_t hash;
70#endif
71 if( operation == MBEDTLS_ENCRYPT )
72 {
Andrzej Kurek69bafce2020-09-19 12:45:20 +020073 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +020074 key = transform->key_enc;
75#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
76 hash = transform->key_enc_hash;
77#endif
78 }
79 else if ( operation == MBEDTLS_DECRYPT )
80 {
Andrzej Kurek69bafce2020-09-19 12:45:20 +020081 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +020082 key = transform->key_dec;
83#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
84 hash = transform->key_dec_hash;
85#endif
86 }
87 else
88 {
89 return ( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
90 }
91#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
92 /* Check hash */
93 if( hash != mbedtls_hash( key, transform->key_bitlen >> 3 ) )
94 {
95 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
96 }
Andrzej Kurek69bafce2020-09-19 12:45:20 +020097 else
98 {
99 flow_ctrl++;
100 }
101#else
102 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +0200103#endif
104 if( operation != transform->cipher_ctx.operation )
105 {
106 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx,
107 key,
108 transform->key_bitlen,
109 operation ) ) != 0 )
110 {
111 return( ret );
112 }
113 }
Andrzej Kurek69bafce2020-09-19 12:45:20 +0200114 if( flow_ctrl == 2 )
115 {
116 return( 0 );
117 }
118 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Andrzej Kureka7932372020-09-19 07:56:06 +0200119}
120#endif
121
Hanno Beckeref982d52019-07-23 15:56:18 +0100122#if defined(MBEDTLS_USE_TINYCRYPT)
123static int uecc_rng_wrapper( uint8_t *dest, unsigned int size )
124{
Hanno Beckerd089fad2019-07-24 09:05:05 +0100125 int ret;
126 ret = mbedtls_ssl_conf_rng_func( NULL, dest, size );
127 if( ret == 0 )
128 return( (int) size );
129
130 return( 0 );
Hanno Beckeref982d52019-07-23 15:56:18 +0100131}
Hanno Becker75f12d12019-07-23 16:16:15 +0100132
133int mbedtls_ssl_ecdh_read_peerkey( mbedtls_ssl_context *ssl,
134 unsigned char **p, unsigned char *end )
135{
136 size_t const secp256r1_uncompressed_point_length =
137 1 /* length */ + 1 /* length */ + 2 * NUM_ECC_BYTES /* data */;
138
139 if( (size_t)( end - *p ) < secp256r1_uncompressed_point_length )
140 {
141 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Bad ECDH peer pubkey (too short)" ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +0100142 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +0100143 }
144
145 if( (*p)[0] != 2 * NUM_ECC_BYTES + 1 ||
146 (*p)[1] != 0x04 )
147 {
148 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Unexpected ECDH peer pubkey header - expected { %#02x, %#02x }, got { %#02x, %#02x }",
149 2 * NUM_ECC_BYTES + 1,
150 0x04,
151 (unsigned) (*p)[0],
152 (unsigned) (*p)[1] ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +0100153 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +0100154 }
155
Piotr Nowicki305a5ec2020-08-10 17:42:18 +0200156 if( mbedtls_platform_memcpy( ssl->handshake->ecdh_peerkey, *p + 2, 2 * NUM_ECC_BYTES ) !=
157 ssl->handshake->ecdh_peerkey )
158 {
159 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
160 }
Hanno Becker75f12d12019-07-23 16:16:15 +0100161
162 *p += secp256r1_uncompressed_point_length;
163 return( 0 );
164}
Hanno Beckeref982d52019-07-23 15:56:18 +0100165#endif /* MBEDTLS_USE_TINYCRYPT */
166
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100167static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl );
Hanno Beckercd9dcda2018-08-28 17:18:56 +0100168static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100169
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100170/* Length of the "epoch" field in the record header */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200171static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100172{
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200173#if !defined(MBEDTLS_SSL_TRANSPORT__BOTH)
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +0100174 ((void) ssl);
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100175#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200176
177#if defined(MBEDTLS_SSL_PROTO_DTLS)
178 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
179 return( 2 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200180 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200181#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200182#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100183 return( 0 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200184#endif
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100185}
186
Hanno Beckerb82350b2019-07-26 07:24:05 +0100187static void ssl_send_pending_fatal_alert( mbedtls_ssl_context *ssl )
188{
189 if( ssl->pending_fatal_alert_msg == MBEDTLS_SSL_ALERT_MSG_NONE )
190 return;
191
192 mbedtls_ssl_send_alert_message( ssl,
193 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
194 ssl->pending_fatal_alert_msg );
195 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
196}
197
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200198/*
199 * Start a timer.
200 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200201 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200203{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100204 if( mbedtls_ssl_get_set_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200205 return;
206
207 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
Hanno Becker0ae6b242019-06-13 16:45:36 +0100208 mbedtls_ssl_get_set_timer( ssl )( ssl->p_timer,
209 millisecs / 4,
210 millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200211}
212
213/*
214 * Return -1 is timer is expired, 0 if it isn't.
215 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200216static int ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200217{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100218 if( mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +0200219 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200220
Hanno Becker0ae6b242019-06-13 16:45:36 +0100221 if( mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200222 {
223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200224 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200225 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200226
227 return( 0 );
228}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200229
Hanno Becker5aa4e2c2018-08-06 09:26:08 +0100230static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
231 mbedtls_ssl_transform *transform );
Hanno Beckerf5970a02019-05-08 09:38:41 +0100232static void ssl_update_in_pointers( mbedtls_ssl_context *ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100233
Hanno Becker02f26092019-07-03 16:13:00 +0100234#if defined(MBEDTLS_SSL_RECORD_CHECKING)
Hanno Becker03e2db62019-07-12 14:40:00 +0100235static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
236 unsigned char *buf,
237 size_t len,
238 mbedtls_record *rec );
239
Hanno Becker02f26092019-07-03 16:13:00 +0100240int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl,
241 unsigned char *buf,
242 size_t buflen )
243{
Andrzej Kurekfd56f402020-05-25 11:52:05 -0400244 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker03e2db62019-07-12 14:40:00 +0100245 mbedtls_record rec;
246 MBEDTLS_SSL_DEBUG_MSG( 1, ( "=> mbedtls_ssl_check_record" ) );
247 MBEDTLS_SSL_DEBUG_BUF( 3, "record buffer", buf, buflen );
248
249 /* We don't support record checking in TLS because
250 * (a) there doesn't seem to be a usecase for it, and
251 * (b) In SSLv3 and TLS 1.0, CBC record decryption has state
252 * and we'd need to backup the transform here.
253 */
254#if defined(MBEDTLS_SSL_PROTO_TLS)
255 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
256 {
257 ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
258 goto exit;
259 }
260 MBEDTLS_SSL_TRANSPORT_ELSE
261#endif /* MBEDTLS_SSL_PROTO_TLS */
262#if defined(MBEDTLS_SSL_PROTO_DTLS)
263 {
264 ret = ssl_parse_record_header( ssl, buf, buflen, &rec );
265 if( ret != 0 )
266 {
267 MBEDTLS_SSL_DEBUG_RET( 3, "ssl_parse_record_header", ret );
268 goto exit;
269 }
270
271 if( ssl->transform_in != NULL )
272 {
273 ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in, &rec );
274 if( ret != 0 )
275 {
276 MBEDTLS_SSL_DEBUG_RET( 3, "mbedtls_ssl_decrypt_buf", ret );
277 goto exit;
278 }
279 }
280 }
281#endif /* MBEDTLS_SSL_PROTO_DTLS */
282
283exit:
284 /* On success, we have decrypted the buffer in-place, so make
285 * sure we don't leak any plaintext data. */
286 mbedtls_platform_zeroize( buf, buflen );
287
288 /* For the purpose of this API, treat messages with unexpected CID
289 * as well as such from future epochs as unexpected. */
290 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID ||
291 ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
292 {
293 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
294 }
295
296 MBEDTLS_SSL_DEBUG_MSG( 1, ( "<= mbedtls_ssl_check_record" ) );
297 return( ret );
Hanno Becker02f26092019-07-03 16:13:00 +0100298}
299#endif /* MBEDTLS_SSL_RECORD_CHECKING */
300
Hanno Becker67bc7c32018-08-06 11:33:50 +0100301#define SSL_DONT_FORCE_FLUSH 0
302#define SSL_FORCE_FLUSH 1
303
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200304#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +0100305
Hanno Beckera5a2b082019-05-15 14:03:01 +0100306#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100307/* Top-level Connection ID API */
308
Hanno Beckere0200da2019-06-13 09:23:43 +0100309#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
310 !defined(MBEDTLS_SSL_CONF_CID_LEN) && \
311 !defined(MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +0100312int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
313 size_t len,
314 int ignore_other_cid )
Hanno Beckereec2be92019-05-03 13:06:44 +0100315{
316 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
317 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
318
Hanno Becker791ec6b2019-05-14 11:45:26 +0100319 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
320 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
321 {
322 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
323 }
324
325 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckereec2be92019-05-03 13:06:44 +0100326 conf->cid_len = len;
327 return( 0 );
328}
Hanno Beckere0200da2019-06-13 09:23:43 +0100329#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
330 !MBEDTLS_SSL_CONF_CID_LEN &&
331 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
332
333#if MBEDTLS_SSL_CONF_CID_LEN > MBEDTLS_SSL_CID_IN_LEN_MAX
334#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_CID_LEN"
335#endif
336#if MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE && \
337 MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_FAIL
338#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID"
339#endif
340
341#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
342 !MBEDTLS_SSL_CONF_CID_LEN &&
343 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
Hanno Beckereec2be92019-05-03 13:06:44 +0100344
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100345int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
346 int enable,
347 unsigned char const *own_cid,
348 size_t own_cid_len )
349{
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200350 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker78c43022019-05-03 14:38:32 +0100351 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
352
Hanno Becker07489862019-04-25 16:01:49 +0100353 ssl->negotiate_cid = enable;
354 if( enable == MBEDTLS_SSL_CID_DISABLED )
355 {
356 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
357 return( 0 );
358 }
359 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckereec2be92019-05-03 13:06:44 +0100360 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Becker07489862019-04-25 16:01:49 +0100361
Hanno Beckere0200da2019-06-13 09:23:43 +0100362 if( own_cid_len != mbedtls_ssl_conf_get_cid_len( ssl->conf ) )
Hanno Becker07489862019-04-25 16:01:49 +0100363 {
Hanno Beckereec2be92019-05-03 13:06:44 +0100364 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
365 (unsigned) own_cid_len,
Hanno Beckere0200da2019-06-13 09:23:43 +0100366 (unsigned) mbedtls_ssl_conf_get_cid_len( ssl->conf ) ) );
Hanno Becker07489862019-04-25 16:01:49 +0100367 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
368 }
369
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300370 /* Not using more secure mbedtls_platform_memcpy as cid is public */
371 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb4a56062019-04-30 14:07:31 +0100372 /* Truncation is not an issue here because
373 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
374 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Becker07489862019-04-25 16:01:49 +0100375
Andrzej Kurekafec8852020-07-15 16:31:27 -0400376 return( 0 );
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100377}
378
379int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
380 int *enabled,
381 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
382 size_t *peer_cid_len )
383{
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100384 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Becker2de89fa2019-04-26 17:08:02 +0100385
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200386 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker78c43022019-05-03 14:38:32 +0100387 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
388 {
Hanno Becker2de89fa2019-04-26 17:08:02 +0100389 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker78c43022019-05-03 14:38:32 +0100390 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100391
Hanno Beckercb063f52019-05-03 12:54:52 +0100392 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
393 * were used, but client and server requested the empty CID.
394 * This is indistinguishable from not using the CID extension
395 * in the first place. */
Hanno Becker2de89fa2019-04-26 17:08:02 +0100396 if( ssl->transform_in->in_cid_len == 0 &&
397 ssl->transform_in->out_cid_len == 0 )
398 {
399 return( 0 );
400 }
401
Hanno Becker633d6042019-05-22 16:50:35 +0100402 if( peer_cid_len != NULL )
403 {
404 *peer_cid_len = ssl->transform_in->out_cid_len;
405 if( peer_cid != NULL )
406 {
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300407 /* Not using more secure mbedtls_platform_memcpy as cid is public */
408 memcpy( peer_cid, ssl->transform_in->out_cid,
Hanno Becker633d6042019-05-22 16:50:35 +0100409 ssl->transform_in->out_cid_len );
410 }
411 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100412
413 *enabled = MBEDTLS_SSL_CID_ENABLED;
414
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100415 return( 0 );
416}
Hanno Beckera5a2b082019-05-15 14:03:01 +0100417#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100418
Hanno Beckerd5847772018-08-28 10:09:23 +0100419/* Forward declarations for functions related to message buffering. */
420static void ssl_buffering_free( mbedtls_ssl_context *ssl );
421static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
422 uint8_t slot );
423static void ssl_free_buffered_record( mbedtls_ssl_context *ssl );
424static int ssl_load_buffered_message( mbedtls_ssl_context *ssl );
425static int ssl_load_buffered_record( mbedtls_ssl_context *ssl );
426static int ssl_buffer_message( mbedtls_ssl_context *ssl );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +0100427static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
428 mbedtls_record const *rec );
Hanno Beckeref7afdf2018-08-28 17:16:31 +0100429static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl );
Hanno Beckerd5847772018-08-28 10:09:23 +0100430
Hanno Beckera67dee22018-08-22 10:05:20 +0100431static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl );
Hanno Becker11682cc2018-08-22 14:41:02 +0100432static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context const *ssl )
Hanno Becker2b1e3542018-08-06 11:19:13 +0100433{
Hanno Becker11682cc2018-08-22 14:41:02 +0100434 size_t mtu = ssl_get_current_mtu( ssl );
Andrzej Kurekf3844952020-10-16 23:03:01 +0200435#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
436 size_t out_buf_len = ssl->out_buf_len;
437#else
438 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
439#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +0100440
Andrzej Kurekf3844952020-10-16 23:03:01 +0200441 if( mtu != 0 && mtu < out_buf_len )
Hanno Becker11682cc2018-08-22 14:41:02 +0100442 return( mtu );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100443
Andrzej Kurekf3844952020-10-16 23:03:01 +0200444 return( out_buf_len );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100445}
446
Hanno Becker67bc7c32018-08-06 11:33:50 +0100447static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
448{
Hanno Becker11682cc2018-08-22 14:41:02 +0100449 size_t const bytes_written = ssl->out_left;
450 size_t const mtu = ssl_get_maximum_datagram_size( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100451
452 /* Double-check that the write-index hasn't gone
453 * past what we can transmit in a single datagram. */
Hanno Becker11682cc2018-08-22 14:41:02 +0100454 if( bytes_written > mtu )
Hanno Becker67bc7c32018-08-06 11:33:50 +0100455 {
456 /* Should never happen... */
457 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
458 }
459
460 return( (int) ( mtu - bytes_written ) );
461}
462
463static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl )
464{
465 int ret;
466 size_t remaining, expansion;
Andrzej Kurek748face2018-10-11 07:20:19 -0400467 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100468
469#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +0200470 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100471
472 if( max_len > mfl )
473 max_len = mfl;
Hanno Beckerf4b010e2018-08-24 10:47:29 +0100474
475 /* By the standard (RFC 6066 Sect. 4), the MFL extension
476 * only limits the maximum record payload size, so in theory
477 * we would be allowed to pack multiple records of payload size
478 * MFL into a single datagram. However, this would mean that there's
479 * no way to explicitly communicate MTU restrictions to the peer.
480 *
481 * The following reduction of max_len makes sure that we never
482 * write datagrams larger than MFL + Record Expansion Overhead.
483 */
484 if( max_len <= ssl->out_left )
485 return( 0 );
486
487 max_len -= ssl->out_left;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100488#endif
489
490 ret = ssl_get_remaining_space_in_datagram( ssl );
491 if( ret < 0 )
492 return( ret );
493 remaining = (size_t) ret;
494
495 ret = mbedtls_ssl_get_record_expansion( ssl );
496 if( ret < 0 )
497 return( ret );
498 expansion = (size_t) ret;
499
500 if( remaining <= expansion )
501 return( 0 );
502
503 remaining -= expansion;
504 if( remaining >= max_len )
505 remaining = max_len;
506
507 return( (int) remaining );
508}
509
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200510/*
511 * Double the retransmit timeout value, within the allowed range,
512 * returning -1 if the maximum value has already been reached.
513 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200514static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200515{
516 uint32_t new_timeout;
517
Hanno Becker1f835fa2019-06-13 10:14:59 +0100518 if( ssl->handshake->retransmit_timeout >=
519 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
520 {
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200521 return( -1 );
Hanno Becker1f835fa2019-06-13 10:14:59 +0100522 }
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200523
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200524 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
525 * in the following way: after the initial transmission and a first
526 * retransmission, back off to a temporary estimated MTU of 508 bytes.
527 * This value is guaranteed to be deliverable (if not guaranteed to be
528 * delivered) of any compliant IPv4 (and IPv6) network, and should work
529 * on most non-IP stacks too. */
Hanno Becker1f835fa2019-06-13 10:14:59 +0100530 if( ssl->handshake->retransmit_timeout !=
531 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) )
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400532 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200533 ssl->handshake->mtu = 508;
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400534 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl->handshake->mtu ) );
535 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200536
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200537 new_timeout = 2 * ssl->handshake->retransmit_timeout;
538
539 /* Avoid arithmetic overflow and range overflow */
540 if( new_timeout < ssl->handshake->retransmit_timeout ||
Hanno Becker1f835fa2019-06-13 10:14:59 +0100541 new_timeout > mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200542 {
Hanno Becker1f835fa2019-06-13 10:14:59 +0100543 new_timeout = mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200544 }
545
546 ssl->handshake->retransmit_timeout = new_timeout;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200547 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200548 ssl->handshake->retransmit_timeout ) );
549
550 return( 0 );
551}
552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200553static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200554{
Hanno Becker1f835fa2019-06-13 10:14:59 +0100555 ssl->handshake->retransmit_timeout = mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200556 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200557 ssl->handshake->retransmit_timeout ) );
558}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200559#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200560
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200561#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200562/*
563 * Convert max_fragment_length codes to length.
564 * RFC 6066 says:
565 * enum{
566 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
567 * } MaxFragmentLength;
568 * and we add 0 -> extension unused
569 */
Angus Grattond8213d02016-05-25 20:56:48 +1000570static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200571{
Angus Grattond8213d02016-05-25 20:56:48 +1000572 switch( mfl )
573 {
574 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300575 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000576 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
577 return 512;
578 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
579 return 1024;
580 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
581 return 2048;
582 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
583 return 4096;
584 default:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300585 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000586 }
587}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200588#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200589
Hanno Becker58fccf22019-02-06 14:30:46 +0000590int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
591 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200592{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200593 mbedtls_ssl_session_free( dst );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300594 mbedtls_platform_memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200595
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerd5258fa2019-02-07 12:27:42 +0000597
598#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200599 if( src->peer_cert != NULL )
600 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200601 int ret;
602
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200603 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200604 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200605 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200607 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200608
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200609 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200610 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200611 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200612 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200613 dst->peer_cert = NULL;
614 return( ret );
615 }
616 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100617#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000618 if( src->peer_cert_digest != NULL )
619 {
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000620 dst->peer_cert_digest =
Hanno Becker9d64b782019-02-25 10:06:59 +0000621 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000622 if( dst->peer_cert_digest == NULL )
623 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
624
Teppo Järvelin91d79382019-10-02 09:09:31 +0300625 mbedtls_platform_memcpy( dst->peer_cert_digest, src->peer_cert_digest,
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000626 src->peer_cert_digest_len );
627 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Becker9d64b782019-02-25 10:06:59 +0000628 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000629 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100630#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200632#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200633
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200634#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200635 if( src->ticket != NULL )
636 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200637 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200638 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200639 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200640
Teppo Järvelin91d79382019-10-02 09:09:31 +0300641 mbedtls_platform_memcpy( dst->ticket, src->ticket, src->ticket_len );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200642 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200643#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200644
645 return( 0 );
646}
647
Andrzej Kurekf3844952020-10-16 23:03:01 +0200648#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
649static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
650{
651 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
652 if( resized_buffer == NULL )
653 return -1;
654
655 /* We want to copy len_new bytes when downsizing the buffer, and
656 * len_old bytes when upsizing, so we choose the smaller of two sizes,
657 * to fit one buffer into another. Size checks, ensuring that no data is
658 * lost, are done outside of this function. */
659 memcpy( resized_buffer, *buffer,
660 ( len_new < *len_old ) ? len_new : *len_old );
661 mbedtls_platform_zeroize( *buffer, *len_old );
662 mbedtls_free( *buffer );
663
664 *buffer = resized_buffer;
665 *len_old = len_new;
666
667 return 0;
668}
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200669
Andrzej Kurekcd9a6ff2020-10-22 11:12:07 +0200670#define BUFFER_UPSIZING 0
671#define BUFFER_DOWNSIZING 1
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200672static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
673 uint32_t in_buf_new_len,
674 uint32_t out_buf_new_len )
675{
676 int modified = 0;
677 size_t written_in = 0, len_offset_in = 0;
678 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
679 if( ssl->in_buf != NULL )
680 {
681 written_in = ssl->in_msg - ssl->in_buf;
682 len_offset_in = ssl->in_len - ssl->in_buf;
683 if( ( downsizing && ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len ) ||
684 ( !downsizing && ssl->in_buf_len < in_buf_new_len ) )
685 {
686 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
687 {
Andrzej Kurek2e49d072020-10-22 11:16:25 +0200688 /* No need to return an error here; The buffer will remain as
689 * is with no negative impact on the flow. */
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200690 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
691 }
692 else
693 {
694 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %d", in_buf_new_len ) );
695 modified = 1;
696 }
697 }
698 }
699
700 if( ssl->out_buf != NULL )
701 {
702 written_out = ssl->out_msg - ssl->out_buf;
703 iv_offset_out = ssl->out_iv - ssl->out_buf;
704 len_offset_out = ssl->out_len - ssl->out_buf;
705 if( ( downsizing && ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len ) ||
706 ( !downsizing && ssl->out_buf_len < out_buf_new_len ) )
707 {
708 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
709 {
Andrzej Kurek2e49d072020-10-22 11:16:25 +0200710 /* No need to return an error here; The buffer will remain as
711 * is with no negative impact on the flow. */
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200712 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
713 }
714 else
715 {
716 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %d", out_buf_new_len ) );
717 modified = 1;
718 }
719 }
720 }
721 if( modified )
722 {
723 /* Update pointers here to avoid doing it twice. */
724 ssl_reset_in_out_pointers( ssl );
725 /* Fields below might not be properly updated with record
726 * splitting or with CID, so they are manually updated here. */
727 ssl->out_msg = ssl->out_buf + written_out;
728 ssl->out_len = ssl->out_buf + len_offset_out;
729 ssl->out_iv = ssl->out_buf + iv_offset_out;
730
731 ssl->in_msg = ssl->in_buf + written_in;
732 ssl->in_len = ssl->in_buf + len_offset_in;
733 }
734}
Andrzej Kurekf3844952020-10-16 23:03:01 +0200735#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
736
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
738int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
Paul Bakker9af723c2014-05-01 13:03:14 +0200739 const unsigned char *key_enc, const unsigned char *key_dec,
740 size_t keylen,
741 const unsigned char *iv_enc, const unsigned char *iv_dec,
742 size_t ivlen,
743 const unsigned char *mac_enc, const unsigned char *mac_dec,
Paul Bakker66d5d072014-06-17 16:39:18 +0200744 size_t maclen ) = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200745int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
746int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
747int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
748int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
749int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
750#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000751
Paul Bakker5121ce52009-01-03 21:22:43 +0000752/*
753 * Key material generation
754 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200755#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +0100756MBEDTLS_NO_INLINE static int ssl3_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200757 const char *label,
758 const unsigned char *random, size_t rlen,
Paul Bakker5f70b252012-09-13 14:23:06 +0000759 unsigned char *dstbuf, size_t dlen )
760{
Andres Amaya Garcia33952502017-07-20 16:29:16 +0100761 int ret = 0;
Paul Bakker5f70b252012-09-13 14:23:06 +0000762 size_t i;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200763 mbedtls_md5_context md5;
764 mbedtls_sha1_context sha1;
Paul Bakker5f70b252012-09-13 14:23:06 +0000765 unsigned char padding[16];
766 unsigned char sha1sum[20];
Andrzej Kurekafec8852020-07-15 16:31:27 -0400767 ((void)label);
Paul Bakker5f70b252012-09-13 14:23:06 +0000768
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200769 mbedtls_md5_init( &md5 );
770 mbedtls_sha1_init( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +0200771
Paul Bakker5f70b252012-09-13 14:23:06 +0000772 /*
773 * SSLv3:
774 * block =
775 * MD5( secret + SHA1( 'A' + secret + random ) ) +
776 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
777 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
778 * ...
779 */
780 for( i = 0; i < dlen / 16; i++ )
781 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200782 mbedtls_platform_memset( padding, (unsigned char) ('A' + i), 1 + i );
Paul Bakker5f70b252012-09-13 14:23:06 +0000783
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100784 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100785 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100786 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100787 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100788 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100789 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100790 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100791 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100792 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100793 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000794
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100795 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100796 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100797 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100798 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100799 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100800 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100801 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100802 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000803 }
804
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100805exit:
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200806 mbedtls_md5_free( &md5 );
807 mbedtls_sha1_free( &sha1 );
Paul Bakker5f70b252012-09-13 14:23:06 +0000808
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500809 mbedtls_platform_zeroize( padding, sizeof( padding ) );
810 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5f70b252012-09-13 14:23:06 +0000811
Andrzej Kurekafec8852020-07-15 16:31:27 -0400812 return( ret );
Paul Bakker5f70b252012-09-13 14:23:06 +0000813}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200814#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +0000815
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200816#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +0100817MBEDTLS_NO_INLINE static int tls1_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200818 const char *label,
819 const unsigned char *random, size_t rlen,
Paul Bakker23986e52011-04-24 08:57:21 +0000820 unsigned char *dstbuf, size_t dlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000821{
Paul Bakker23986e52011-04-24 08:57:21 +0000822 size_t nb, hs;
823 size_t i, j, k;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200824 const unsigned char *S1, *S2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000825 unsigned char tmp[128];
826 unsigned char h_i[20];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100827 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200828 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100829 int ret;
830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200831 mbedtls_md_init( &md_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +0000832
833 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200834 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000835
836 hs = ( slen + 1 ) / 2;
837 S1 = secret;
838 S2 = secret + slen - hs;
839
840 nb = strlen( label );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300841 mbedtls_platform_memcpy( tmp + 20, label, nb );
842 mbedtls_platform_memcpy( tmp + 20 + nb, random, rlen );
Paul Bakker5121ce52009-01-03 21:22:43 +0000843 nb += rlen;
844
845 /*
846 * First compute P_md5(secret,label+random)[0..dlen]
847 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100848 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) ==
849 MBEDTLS_MD_INVALID_HANDLE )
850 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200851 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100852 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100853
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200854 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100855 return( ret );
856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200857 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
858 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
859 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000860
861 for( i = 0; i < dlen; i += 16 )
862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200863 mbedtls_md_hmac_reset ( &md_ctx );
864 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
865 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200867 mbedtls_md_hmac_reset ( &md_ctx );
868 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
869 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000870
871 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
872
873 for( j = 0; j < k; j++ )
874 dstbuf[i + j] = h_i[j];
875 }
876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200877 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100878
Paul Bakker5121ce52009-01-03 21:22:43 +0000879 /*
880 * XOR out with P_sha1(secret,label+random)[0..dlen]
881 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100882 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) ==
883 MBEDTLS_MD_INVALID_HANDLE )
884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200885 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100886 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100887
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200888 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100889 return( ret );
890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200891 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
892 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
893 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000894
895 for( i = 0; i < dlen; i += 20 )
896 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200897 mbedtls_md_hmac_reset ( &md_ctx );
898 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
899 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100900
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200901 mbedtls_md_hmac_reset ( &md_ctx );
902 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
903 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000904
905 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
906
907 for( j = 0; j < k; j++ )
908 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
909 }
910
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200911 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100912
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500913 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
914 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000915
Andrzej Kurekafec8852020-07-15 16:31:27 -0400916 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000917}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200918#endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000919
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200920#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerf6cc7422019-08-16 14:34:52 +0100921#if !( defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_SHA512_C) )
922MBEDTLS_ALWAYS_INLINE static inline
923#else
924static
925#endif
926int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100927 const unsigned char *secret, size_t slen,
928 const char *label,
929 const unsigned char *random, size_t rlen,
930 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000931{
932 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100933 size_t i, j, k, md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000934 unsigned char tmp[128];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200935 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100936 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200937 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100938 int ret;
939
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200940 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000941
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100942 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) ==
943 MBEDTLS_MD_INVALID_HANDLE )
944 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100946 }
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100947
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200948 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100949
950 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200951 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000952
953 nb = strlen( label );
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200954 (void)mbedtls_platform_memcpy( tmp + md_len, label, nb );
955 (void)mbedtls_platform_memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000956 nb += rlen;
957
958 /*
959 * Compute P_<hash>(secret, label + random)[0..dlen]
960 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200961 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100962 return( ret );
963
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200964 if ( ( ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen ) ) != 0 )
965 return( ret );
966 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb ) ) != 0 )
967 return( ret );
968 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
969 return( ret );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100970
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100971 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000972 {
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200973 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
974 return( ret );
975 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb ) ) != 0 )
976 return( ret );
977 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, h_i ) ) != 0 )
978 return( ret );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100979
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200980 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
981 return( ret );
982 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len ) ) != 0 )
983 return( ret );
984 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
985 return( ret );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000986
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100987 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000988
989 for( j = 0; j < k; j++ )
990 dstbuf[i + j] = h_i[j];
991 }
992
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200993 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100994
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200995 (void)mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
996 (void)mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000997
Andrzej Kurekafec8852020-07-15 16:31:27 -0400998 return( 0 );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000999}
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001000
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001001#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001002MBEDTLS_NO_INLINE static int tls_prf_sha256(
1003 const unsigned char *secret, size_t slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001004 const char *label,
1005 const unsigned char *random, size_t rlen,
1006 unsigned char *dstbuf, size_t dlen )
1007{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001008 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001009 label, random, rlen, dstbuf, dlen ) );
1010}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001011#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +00001012
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001013#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001014MBEDTLS_NO_INLINE static int tls_prf_sha384(
1015 const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02001016 const char *label,
1017 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001018 unsigned char *dstbuf, size_t dlen )
1019{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001020 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001021 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001022}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001023#endif /* MBEDTLS_SHA512_C */
1024#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +00001025
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001026/*
1027 * Call the appropriate PRF function
1028 */
Hanno Becker2793f742019-08-16 14:28:43 +01001029MBEDTLS_ALWAYS_INLINE static inline int ssl_prf( int minor_ver,
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001030 mbedtls_md_type_t hash,
1031 const unsigned char *secret, size_t slen,
1032 const char *label,
1033 const unsigned char *random, size_t rlen,
1034 unsigned char *dstbuf, size_t dlen )
1035{
1036#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1037 (void) hash;
1038#endif
1039
1040#if defined(MBEDTLS_SSL_PROTO_SSL3)
1041 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1042 return( ssl3_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
1043 else
1044#endif
1045#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001046 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001047 return( tls1_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
1048 else
1049#endif
1050#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1051#if defined(MBEDTLS_SHA512_C)
1052 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1053 hash == MBEDTLS_MD_SHA384 )
1054 {
1055 return( tls_prf_sha384( secret, slen, label, random, rlen,
1056 dstbuf, dlen ) );
1057 }
1058 else
1059#endif
1060#if defined(MBEDTLS_SHA256_C)
1061 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1062 {
1063 return( tls_prf_sha256( secret, slen, label, random, rlen,
1064 dstbuf, dlen ) );
1065 }
1066#endif
1067#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1068
1069 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1070}
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001071
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001072#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +01001073MBEDTLS_NO_INLINE static void ssl_calc_finished_ssl(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001074 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1075{
1076 const char *sender;
1077 mbedtls_md5_context md5;
1078 mbedtls_sha1_context sha1;
1079
1080 unsigned char padbuf[48];
1081 unsigned char md5sum[16];
1082 unsigned char sha1sum[20];
1083
1084 mbedtls_ssl_session *session = ssl->session_negotiate;
1085 if( !session )
1086 session = ssl->session;
1087
1088 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
1089
1090 mbedtls_md5_init( &md5 );
1091 mbedtls_sha1_init( &sha1 );
1092
1093 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1094 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1095
1096 /*
1097 * SSLv3:
1098 * hash =
1099 * MD5( master + pad2 +
1100 * MD5( handshake + sender + master + pad1 ) )
1101 * + SHA1( master + pad2 +
1102 * SHA1( handshake + sender + master + pad1 ) )
1103 */
1104
1105#if !defined(MBEDTLS_MD5_ALT)
1106 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1107 md5.state, sizeof( md5.state ) );
1108#endif
1109
1110#if !defined(MBEDTLS_SHA1_ALT)
1111 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1112 sha1.state, sizeof( sha1.state ) );
1113#endif
1114
1115 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
1116 : "SRVR";
1117
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001118 mbedtls_platform_memset( padbuf, 0x36, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001119
1120 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
1121 mbedtls_md5_update_ret( &md5, session->master, 48 );
1122 mbedtls_md5_update_ret( &md5, padbuf, 48 );
1123 mbedtls_md5_finish_ret( &md5, md5sum );
1124
1125 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
1126 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
1127 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
1128 mbedtls_sha1_finish_ret( &sha1, sha1sum );
1129
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001130 mbedtls_platform_memset( padbuf, 0x5C, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001131
1132 mbedtls_md5_starts_ret( &md5 );
1133 mbedtls_md5_update_ret( &md5, session->master, 48 );
1134 mbedtls_md5_update_ret( &md5, padbuf, 48 );
1135 mbedtls_md5_update_ret( &md5, md5sum, 16 );
1136 mbedtls_md5_finish_ret( &md5, buf );
1137
1138 mbedtls_sha1_starts_ret( &sha1 );
1139 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
1140 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
1141 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
1142 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
1143
1144 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
1145
1146 mbedtls_md5_free( &md5 );
1147 mbedtls_sha1_free( &sha1 );
1148
1149 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1150 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
1151 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
1152
1153 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1154}
1155#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1156
1157#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +01001158MBEDTLS_NO_INLINE static void ssl_calc_finished_tls(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001159 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1160{
1161 int len = 12;
1162 const char *sender;
1163 mbedtls_md5_context md5;
1164 mbedtls_sha1_context sha1;
1165 unsigned char padbuf[36];
1166
1167 mbedtls_ssl_session *session = ssl->session_negotiate;
1168 if( !session )
1169 session = ssl->session;
1170
1171 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
1172
1173 mbedtls_md5_init( &md5 );
1174 mbedtls_sha1_init( &sha1 );
1175
1176 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1177 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1178
1179 /*
1180 * TLSv1:
1181 * hash = PRF( master, finished_label,
1182 * MD5( handshake ) + SHA1( handshake ) )[0..11]
1183 */
1184
1185#if !defined(MBEDTLS_MD5_ALT)
1186 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1187 md5.state, sizeof( md5.state ) );
1188#endif
1189
1190#if !defined(MBEDTLS_SHA1_ALT)
1191 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1192 sha1.state, sizeof( sha1.state ) );
1193#endif
1194
1195 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1196 ? "client finished"
1197 : "server finished";
1198
1199 mbedtls_md5_finish_ret( &md5, padbuf );
1200 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
1201
1202 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1203 mbedtls_ssl_suite_get_mac(
1204 mbedtls_ssl_ciphersuite_from_id(
1205 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1206 session->master, 48, sender,
1207 padbuf, 36, buf, len );
1208
1209 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1210
1211 mbedtls_md5_free( &md5 );
1212 mbedtls_sha1_free( &sha1 );
1213
1214 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1215
1216 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1217}
1218#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1219
1220#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1221#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001222MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha256(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001223 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1224{
1225 int len = 12;
1226 const char *sender;
1227 mbedtls_sha256_context sha256;
1228 unsigned char padbuf[32];
1229
1230 mbedtls_ssl_session *session = ssl->session_negotiate;
1231 if( !session )
1232 session = ssl->session;
1233
1234 mbedtls_sha256_init( &sha256 );
1235
1236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
1237
1238 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1239
1240 /*
1241 * TLSv1.2:
1242 * hash = PRF( master, finished_label,
1243 * Hash( handshake ) )[0.11]
1244 */
1245
1246#if !defined(MBEDTLS_SHA256_ALT)
1247 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
1248 sha256.state, sizeof( sha256.state ) );
1249#endif
1250
1251 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1252 ? "client finished"
1253 : "server finished";
1254
1255 mbedtls_sha256_finish_ret( &sha256, padbuf );
1256
1257 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1258 mbedtls_ssl_suite_get_mac(
1259 mbedtls_ssl_ciphersuite_from_id(
1260 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1261 session->master, 48, sender,
1262 padbuf, 32, buf, len );
1263
1264 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1265
1266 mbedtls_sha256_free( &sha256 );
1267
1268 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1269
1270 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1271}
1272#endif /* MBEDTLS_SHA256_C */
1273
1274#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001275MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha384(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001276 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1277{
1278 int len = 12;
1279 const char *sender;
1280 mbedtls_sha512_context sha512;
1281 unsigned char padbuf[48];
1282
1283 mbedtls_ssl_session *session = ssl->session_negotiate;
1284 if( !session )
1285 session = ssl->session;
1286
1287 mbedtls_sha512_init( &sha512 );
1288
1289 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
1290
1291 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1292
1293 /*
1294 * TLSv1.2:
1295 * hash = PRF( master, finished_label,
1296 * Hash( handshake ) )[0.11]
1297 */
1298
1299#if !defined(MBEDTLS_SHA512_ALT)
1300 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
1301 sha512.state, sizeof( sha512.state ) );
1302#endif
1303
1304 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1305 ? "client finished"
1306 : "server finished";
1307
1308 mbedtls_sha512_finish_ret( &sha512, padbuf );
1309
1310 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1311 mbedtls_ssl_suite_get_mac(
1312 mbedtls_ssl_ciphersuite_from_id(
1313 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1314 session->master, 48, sender,
1315 padbuf, 48, buf, len );
1316
1317 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1318
1319 mbedtls_sha512_free( &sha512 );
1320
1321 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1322
1323 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1324}
1325#endif /* MBEDTLS_SHA512_C */
1326#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1327
Hanno Becker2793f742019-08-16 14:28:43 +01001328MBEDTLS_ALWAYS_INLINE static inline int ssl_calc_finished(
1329 int minor_ver,
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001330 mbedtls_md_type_t hash,
1331 mbedtls_ssl_context *ssl,
1332 unsigned char *buf,
1333 int from )
1334{
1335#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1336 (void) hash;
1337#endif
1338
1339#if defined(MBEDTLS_SSL_PROTO_SSL3)
1340 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1341 ssl_calc_finished_ssl( ssl, buf, from );
1342 else
1343#endif
1344#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001345 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001346 ssl_calc_finished_tls( ssl, buf, from );
1347 else
1348#endif
1349#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1350#if defined(MBEDTLS_SHA512_C)
1351 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1352 hash == MBEDTLS_MD_SHA384 )
1353 {
1354 ssl_calc_finished_tls_sha384( ssl, buf, from );
1355 }
1356 else
1357#endif
1358#if defined(MBEDTLS_SHA256_C)
1359 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1360 ssl_calc_finished_tls_sha256( ssl, buf, from );
1361 else
1362#endif
1363#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1364 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1365
1366 return( 0 );
1367}
1368
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001369/*
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001370 * Populate a transform structure with session keys and all the other
1371 * necessary information.
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001372 *
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001373 * Parameters:
1374 * - [in/out]: transform: structure to populate
1375 * [in] must be just initialised with mbedtls_ssl_transform_init()
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001376 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001377 * - [in] ciphersuite
1378 * - [in] master
1379 * - [in] encrypt_then_mac
1380 * - [in] trunc_hmac
1381 * - [in] compression
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001382 * - [in] tls_prf: pointer to PRF to use for key derivation
1383 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001384 * - [in] minor_ver: SSL/TLS minor version
1385 * - [in] endpoint: client or server
1386 * - [in] ssl: optionally used for:
1387 * - MBEDTLS_SSL_HW_RECORD_ACCEL: whole context
1388 * - MBEDTLS_SSL_EXPORT_KEYS: ssl->conf->{f,p}_export_keys
1389 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001390 */
Hanno Becker298a4702019-08-16 10:21:32 +01001391/* Force compilers to inline this function if it's used only
1392 * from one place, because at least ARMC5 doesn't do that
1393 * automatically. */
1394#if !defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
1395MBEDTLS_ALWAYS_INLINE static inline
1396#else
1397static
1398#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
1399int ssl_populate_transform( mbedtls_ssl_transform *transform,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001400 int ciphersuite,
1401 const unsigned char master[48],
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001402#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001403#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1404 int encrypt_then_mac,
1405#endif
1406#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1407 int trunc_hmac,
1408#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001409#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001410#if defined(MBEDTLS_ZLIB_SUPPORT)
1411 int compression,
1412#endif
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001413 const unsigned char randbytes[64],
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001414 int minor_ver,
1415 unsigned endpoint,
Manuel Pégourié-Gonnard13bebd02020-03-13 11:28:19 +01001416#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1417 const
1418#endif
1419 mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001420{
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001421 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001422 unsigned char keyblk[256];
1423 unsigned char *key1;
1424 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +01001425 unsigned char *mac_enc;
1426 unsigned char *mac_dec;
Hanno Becker81c7b182017-11-09 18:39:33 +00001427 size_t mac_key_len;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001428 size_t iv_copy_len;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001429 unsigned keylen;
Hanno Becker473f98f2019-06-26 10:27:32 +01001430 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001431 const mbedtls_cipher_info_t *cipher_info;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001432 mbedtls_md_handle_t md_info;
Paul Bakker68884e32013-01-07 18:20:04 +01001433
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001434#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \
1435 !defined(MBEDTLS_SSL_EXPORT_KEYS) && \
1436 !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02001437 ssl = NULL; /* make sure we don't use it except for those cases */
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001438 (void) ssl;
Hanno Becker3307b532017-12-27 21:37:21 +00001439#endif
Hanno Becker3307b532017-12-27 21:37:21 +00001440
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001441 /*
1442 * Some data just needs copying into the structure
1443 */
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001444#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
1445 defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001446 transform->encrypt_then_mac = encrypt_then_mac;
Paul Bakker5121ce52009-01-03 21:22:43 +00001447#endif
Hanno Becker0a92b812019-06-24 15:46:40 +01001448
1449#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001450 transform->minor_ver = minor_ver;
Hanno Becker0a92b812019-06-24 15:46:40 +01001451#else
1452 ((void) minor_ver);
1453#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Paul Bakker5121ce52009-01-03 21:22:43 +00001454
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001455#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Teppo Järvelin91d79382019-10-02 09:09:31 +03001456 mbedtls_platform_memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001457#endif
1458
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001459 /*
1460 * Get various info structures
1461 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001462 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
Hanno Becker473f98f2019-06-26 10:27:32 +01001463 if( ciphersuite_info == MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE )
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001464 {
1465 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001466 ciphersuite ) );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001467 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1468 }
1469
Hanno Becker473f98f2019-06-26 10:27:32 +01001470 cipher_info = mbedtls_cipher_info_from_type(
1471 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) );
Paul Bakker68884e32013-01-07 18:20:04 +01001472 if( cipher_info == NULL )
1473 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001474 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001475 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001476 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001477 }
1478
Hanno Becker473f98f2019-06-26 10:27:32 +01001479 md_info = mbedtls_md_info_from_type(
1480 mbedtls_ssl_suite_get_mac( ciphersuite_info ) );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001481 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Paul Bakker68884e32013-01-07 18:20:04 +01001482 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001484 mbedtls_ssl_suite_get_mac( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001485 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001486 }
1487
Hanno Beckera5a2b082019-05-15 14:03:01 +01001488#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001489 /* Copy own and peer's CID if the use of the CID
1490 * extension has been negotiated. */
1491 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
1492 {
1493 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
Hanno Beckerd91dc372019-04-30 13:52:29 +01001494
Hanno Becker4932f9f2019-05-03 15:23:51 +01001495 transform->in_cid_len = ssl->own_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001496 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1497 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
Hanno Becker8013b272019-05-03 12:55:51 +01001498 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001499 transform->in_cid_len );
Hanno Beckere582d122019-05-15 10:21:55 +01001500
1501 transform->out_cid_len = ssl->handshake->peer_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001502 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1503 memcpy( transform->out_cid, ssl->handshake->peer_cid,
Hanno Beckere582d122019-05-15 10:21:55 +01001504 ssl->handshake->peer_cid_len );
1505 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
1506 transform->out_cid_len );
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001507 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01001508#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001509
Paul Bakker5121ce52009-01-03 21:22:43 +00001510 /*
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001511 * Compute key block using the PRF
Paul Bakker1ef83d62012-04-11 12:09:53 +00001512 */
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001513 ret = ssl_prf( minor_ver,
1514 mbedtls_ssl_suite_get_mac( ciphersuite_info ),
1515 master, 48, "key expansion", randbytes, 64,
1516 keyblk, 256 );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001517 if( ret != 0 )
1518 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001519 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001520 return( ret );
1521 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001523 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02001524 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001525 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001526 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001527 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001528
Paul Bakker5121ce52009-01-03 21:22:43 +00001529 /*
1530 * Determine the appropriate key, IV and MAC length.
1531 */
Paul Bakker68884e32013-01-07 18:20:04 +01001532
Hanno Beckere7f2df02017-12-27 08:17:40 +00001533 keylen = cipher_info->key_bitlen / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001534
Hanno Beckerf1229442018-01-03 15:32:31 +00001535#if defined(MBEDTLS_GCM_C) || \
1536 defined(MBEDTLS_CCM_C) || \
1537 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001538 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001539 cipher_info->mode == MBEDTLS_MODE_CCM ||
1540 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +00001541 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001542 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +00001543 mac_key_len = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01001544 transform->taglen = mbedtls_ssl_suite_get_flags( ciphersuite_info ) &
1545 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001546
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001547 /* All modes haves 96-bit IVs;
1548 * GCM and CCM has 4 implicit and 8 explicit bytes
1549 * ChachaPoly has all 12 bytes implicit
1550 */
Paul Bakker68884e32013-01-07 18:20:04 +01001551 transform->ivlen = 12;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001552 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
1553 transform->fixed_ivlen = 12;
1554 else
1555 transform->fixed_ivlen = 4;
Paul Bakker68884e32013-01-07 18:20:04 +01001556 }
1557 else
Hanno Beckerf1229442018-01-03 15:32:31 +00001558#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
1559#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1560 if( cipher_info->mode == MBEDTLS_MODE_STREAM ||
1561 cipher_info->mode == MBEDTLS_MODE_CBC )
Paul Bakker68884e32013-01-07 18:20:04 +01001562 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001563 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001564 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
1565 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001566 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001567 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001568 return( ret );
Paul Bakker68884e32013-01-07 18:20:04 +01001569 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001570
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001571 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +00001572 mac_key_len = mbedtls_md_get_size( md_info );
1573 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001575#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001576 /*
1577 * If HMAC is to be truncated, we shall keep the leftmost bytes,
1578 * (rfc 6066 page 13 or rfc 2104 section 4),
1579 * so we only need to adjust the length here.
1580 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001581 if( trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Hanno Beckere89353a2017-11-20 16:36:41 +00001582 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001583 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
Hanno Beckere89353a2017-11-20 16:36:41 +00001584
1585#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
1586 /* Fall back to old, non-compliant version of the truncated
Hanno Becker563423f2017-11-21 17:20:17 +00001587 * HMAC implementation which also truncates the key
1588 * (Mbed TLS versions from 1.3 to 2.6.0) */
Hanno Beckere89353a2017-11-20 16:36:41 +00001589 mac_key_len = transform->maclen;
1590#endif
1591 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001592#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001593
1594 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +01001595 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001596 }
Hanno Beckerf1229442018-01-03 15:32:31 +00001597 else
1598#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1599 {
1600 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1601 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1602 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001603
Hanno Beckera9d5c452019-07-25 16:47:12 +01001604 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, ivlen: %u, maclen: %u",
Hanno Beckere7f2df02017-12-27 08:17:40 +00001605 (unsigned) keylen,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001606 (unsigned) transform->ivlen,
1607 (unsigned) transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001608
1609 /*
1610 * Finally setup the cipher contexts, IVs and MAC secrets.
1611 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001612#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001613 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00001614 {
Hanno Becker81c7b182017-11-09 18:39:33 +00001615 key1 = keyblk + mac_key_len * 2;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001616 key2 = keyblk + mac_key_len * 2 + keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +00001617
Paul Bakker68884e32013-01-07 18:20:04 +01001618 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +00001619 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001620
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001621 /*
1622 * This is not used in TLS v1.1.
1623 */
Paul Bakker48916f92012-09-16 19:57:18 +00001624 iv_copy_len = ( transform->fixed_ivlen ) ?
1625 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001626 mbedtls_platform_memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
1627 mbedtls_platform_memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001628 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001629 }
1630 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001631#endif /* MBEDTLS_SSL_CLI_C */
1632#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001633 if( endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00001634 {
Hanno Beckere7f2df02017-12-27 08:17:40 +00001635 key1 = keyblk + mac_key_len * 2 + keylen;
Hanno Becker81c7b182017-11-09 18:39:33 +00001636 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00001637
Hanno Becker81c7b182017-11-09 18:39:33 +00001638 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +01001639 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +00001640
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001641 /*
1642 * This is not used in TLS v1.1.
1643 */
Paul Bakker48916f92012-09-16 19:57:18 +00001644 iv_copy_len = ( transform->fixed_ivlen ) ?
1645 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001646 mbedtls_platform_memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
1647 mbedtls_platform_memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001648 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001649 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001650 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001651#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001652 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001653 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1654 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001655 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001656
Hanno Becker92231322018-01-03 15:32:51 +00001657#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001658#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001659 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001660 {
Hanno Becker92231322018-01-03 15:32:51 +00001661 if( mac_key_len > sizeof( transform->mac_enc ) )
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001662 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001663 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1664 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001665 }
1666
Teppo Järvelin91d79382019-10-02 09:09:31 +03001667 mbedtls_platform_memcpy( transform->mac_enc, mac_enc, mac_key_len );
1668 mbedtls_platform_memcpy( transform->mac_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +01001669 }
1670 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001671#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1672#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1673 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001674 if( mbedtls_ssl_ver_geq( minor_ver, MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakker68884e32013-01-07 18:20:04 +01001675 {
Gilles Peskine039fd122018-03-19 19:06:08 +01001676 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1677 For AEAD-based ciphersuites, there is nothing to do here. */
1678 if( mac_key_len != 0 )
1679 {
1680 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
1681 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
1682 }
Paul Bakker68884e32013-01-07 18:20:04 +01001683 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001684 else
1685#endif
Paul Bakker577e0062013-08-28 11:57:20 +02001686 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001687 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1688 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02001689 }
Hanno Becker92231322018-01-03 15:32:51 +00001690#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker68884e32013-01-07 18:20:04 +01001691
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001692#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1693 if( mbedtls_ssl_hw_record_init != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00001694 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00001696
Hanno Beckere7f2df02017-12-27 08:17:40 +00001697 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen,
Paul Bakker07eb38b2012-12-19 14:42:06 +01001698 transform->iv_enc, transform->iv_dec,
1699 iv_copy_len,
Paul Bakker68884e32013-01-07 18:20:04 +01001700 mac_enc, mac_dec,
Hanno Becker81c7b182017-11-09 18:39:33 +00001701 mac_key_len ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00001702 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001703 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1704 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00001705 }
1706 }
Hanno Becker92231322018-01-03 15:32:51 +00001707#else
1708 ((void) mac_dec);
1709 ((void) mac_enc);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001710#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00001711
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001712#if defined(MBEDTLS_SSL_EXPORT_KEYS)
1713 if( ssl->conf->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001714 {
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001715 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001716 master, keyblk,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001717 mac_key_len, keylen,
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001718 iv_copy_len );
1719 }
1720#endif
Andrzej Kurek11750442020-09-17 07:12:06 -04001721#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
1722 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx,
1723 cipher_info ) ) != 0 )
1724 {
1725 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1726 return( ret );
1727 }
1728 transform->key_enc = mbedtls_calloc( 1, cipher_info->key_bitlen >> 3 );
1729 transform->key_dec = mbedtls_calloc( 1, cipher_info->key_bitlen >> 3 );
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001730
Andrzej Kurek11750442020-09-17 07:12:06 -04001731 memcpy( transform->key_enc, key1, cipher_info->key_bitlen >> 3 );
1732 memcpy( transform->key_dec, key2, cipher_info->key_bitlen >> 3 );
1733
1734 transform->key_bitlen = cipher_info->key_bitlen;
Andrzej Kureka7932372020-09-19 07:56:06 +02001735#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
1736 transform->key_enc_hash = mbedtls_hash( transform->key_enc, transform->key_bitlen >> 3 );
1737 transform->key_dec_hash = mbedtls_hash( transform->key_dec, transform->key_bitlen >> 3 );
1738#endif
1739
Andrzej Kurek11750442020-09-17 07:12:06 -04001740#else
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001741 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001742 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001743 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001744 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001745 return( ret );
1746 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001747
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001748 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001749 cipher_info ) ) != 0 )
1750 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001751 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001752 return( ret );
1753 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001754
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001755 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001756 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001757 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001758 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001759 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001760 return( ret );
1761 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001762
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001763 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001764 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001765 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001766 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001767 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001768 return( ret );
1769 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001770#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001771#if defined(MBEDTLS_CIPHER_MODE_CBC)
1772 if( cipher_info->mode == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001773 {
Andrzej Kurek11750442020-09-17 07:12:06 -04001774#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
1775 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx,
1776 MBEDTLS_PADDING_NONE ) ) != 0 )
1777 {
1778 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1779 return( ret );
1780 }
1781#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001782 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1783 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001784 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001785 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001786 return( ret );
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001787 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001789 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1790 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001791 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001792 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001793 return( ret );
1794 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001795#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001796 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001797#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001798
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001799 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001800
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02001801 /* Initialize Zlib contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001802#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001803 if( compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001804 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001805 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001806
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001807 mbedtls_platform_memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1808 mbedtls_platform_memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001809
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001810 if( deflateInit( &transform->ctx_deflate,
1811 Z_DEFAULT_COMPRESSION ) != Z_OK ||
Paul Bakker48916f92012-09-16 19:57:18 +00001812 inflateInit( &transform->ctx_inflate ) != Z_OK )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001813 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001814 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1815 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001816 }
1817 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001818#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00001819
Paul Bakker5121ce52009-01-03 21:22:43 +00001820 return( 0 );
1821}
1822
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001823#if defined(MBEDTLS_SSL_PROTO_SSL3)
1824static inline void ssl_calc_verify_ssl( const mbedtls_ssl_context *ssl,
1825 unsigned char hash[36],
1826 size_t *hlen )
1827{
1828 mbedtls_md5_context md5;
1829 mbedtls_sha1_context sha1;
1830 unsigned char pad_1[48];
1831 unsigned char pad_2[48];
1832
1833 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
1834
1835 mbedtls_md5_init( &md5 );
1836 mbedtls_sha1_init( &sha1 );
1837
1838 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1839 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1840
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001841 mbedtls_platform_memset( pad_1, 0x36, 48 );
1842 mbedtls_platform_memset( pad_2, 0x5C, 48 );
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001843
1844 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1845 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1846 mbedtls_md5_finish_ret( &md5, hash );
1847
1848 mbedtls_md5_starts_ret( &md5 );
1849 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1850 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1851 mbedtls_md5_update_ret( &md5, hash, 16 );
1852 mbedtls_md5_finish_ret( &md5, hash );
1853
1854 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1855 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1856 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1857
1858 mbedtls_sha1_starts_ret( &sha1 );
1859 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1860 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1861 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1862 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1863
1864 *hlen = 36;
1865
1866 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1867 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1868
1869 mbedtls_md5_free( &md5 );
1870 mbedtls_sha1_free( &sha1 );
1871
1872 return;
1873}
1874#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1875
1876#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1877static inline void ssl_calc_verify_tls( const mbedtls_ssl_context *ssl,
1878 unsigned char hash[36],
1879 size_t *hlen )
1880{
1881 mbedtls_md5_context md5;
1882 mbedtls_sha1_context sha1;
1883
1884 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
1885
1886 mbedtls_md5_init( &md5 );
1887 mbedtls_sha1_init( &sha1 );
1888
1889 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1890 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1891
1892 mbedtls_md5_finish_ret( &md5, hash );
1893 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1894
1895 *hlen = 36;
1896
1897 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1898 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1899
1900 mbedtls_md5_free( &md5 );
1901 mbedtls_sha1_free( &sha1 );
1902
1903 return;
1904}
1905#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1906
1907#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1908#if defined(MBEDTLS_SHA256_C)
1909static inline void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1910 unsigned char hash[32],
1911 size_t *hlen )
1912{
1913 mbedtls_sha256_context sha256;
1914
1915 mbedtls_sha256_init( &sha256 );
1916
1917 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1918
1919 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1920 mbedtls_sha256_finish_ret( &sha256, hash );
1921
1922 *hlen = 32;
1923
1924 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1925 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1926
1927 mbedtls_sha256_free( &sha256 );
1928
1929 return;
1930}
1931#endif /* MBEDTLS_SHA256_C */
1932
1933#if defined(MBEDTLS_SHA512_C)
1934static inline void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1935 unsigned char hash[48],
1936 size_t *hlen )
1937{
1938 mbedtls_sha512_context sha512;
1939
1940 mbedtls_sha512_init( &sha512 );
1941
1942 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1943
1944 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1945 mbedtls_sha512_finish_ret( &sha512, hash );
1946
1947 *hlen = 48;
1948
1949 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1950 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1951
1952 mbedtls_sha512_free( &sha512 );
1953
1954 return;
1955}
1956#endif /* MBEDTLS_SHA512_C */
1957#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1958
Hanno Becker2f41b242019-08-15 17:29:43 +01001959int mbedtls_ssl_calc_verify( int minor_ver,
1960 mbedtls_md_type_t hash,
1961 mbedtls_ssl_context const *ssl,
1962 unsigned char *dst,
1963 size_t *hlen )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001964{
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001965#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1966 (void) hash;
1967#endif
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001968
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001969#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001970 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker2f41b242019-08-15 17:29:43 +01001971 ssl_calc_verify_ssl( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001972 else
1973#endif
1974#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001975 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker2f41b242019-08-15 17:29:43 +01001976 ssl_calc_verify_tls( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001977 else
1978#endif
1979#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1980#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001981 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1982 hash == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001983 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001984 ssl_calc_verify_tls_sha384( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001985 }
1986 else
1987#endif
1988#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001989 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001990 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001991 ssl_calc_verify_tls_sha256( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001992 }
1993 else
1994#endif
1995#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1996 {
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001997 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1998 }
1999
2000 return( 0 );
2001}
2002
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002003/*
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002004 * Compute master secret if needed
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002005 *
2006 * Parameters:
2007 * [in/out] handshake
2008 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
2009 * [out] premaster (cleared)
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002010 * [out] master
2011 * [in] ssl: optionally used for debugging and calc_verify
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002012 */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002013static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002014 unsigned char *master,
Manuel Pégourié-Gonnarded3b7a92019-05-03 09:58:33 +02002015 const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002016{
2017 int ret;
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002018
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002019/* #if !defined(MBEDTLS_DEBUG_C) && !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) */
2020/* ssl = NULL; /\* make sure we don't use it except for debug and EMS *\/ */
2021/* (void) ssl; */
2022/* #endif */
2023
2024 mbedtls_ssl_ciphersuite_handle_t const ciphersuite =
2025 mbedtls_ssl_handshake_get_ciphersuite( handshake );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002026
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002027#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02002028 if( handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002029 {
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002030 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
2031 return( 0 );
2032 }
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002033#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002034
2035 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
2036 handshake->pmslen );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002037
2038#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckera49ec562019-06-11 14:47:55 +01002039 if( mbedtls_ssl_hs_get_extended_ms( handshake )
2040 == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002041 {
2042 unsigned char session_hash[48];
2043 size_t hash_len;
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002044
Hanno Becker2f41b242019-08-15 17:29:43 +01002045 mbedtls_ssl_calc_verify(
2046 mbedtls_ssl_get_minor_ver( ssl ),
2047 mbedtls_ssl_suite_get_mac( ciphersuite ),
2048 ssl, session_hash, &hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002049
Manuel Pégourié-Gonnard9c5bcc92019-05-20 12:09:50 +02002050 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
2051 session_hash, hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002052
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002053 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
2054 mbedtls_ssl_suite_get_mac( ciphersuite ),
2055 handshake->premaster, handshake->pmslen,
2056 "extended master secret",
2057 session_hash, hash_len,
2058 master, 48 );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002059 }
2060 else
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002061#endif
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02002062 {
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002063 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
2064 mbedtls_ssl_suite_get_mac( ciphersuite ),
2065 handshake->premaster, handshake->pmslen,
2066 "master secret",
2067 handshake->randbytes, 64,
2068 master, 48 );
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02002069 }
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002070 if( ret != 0 )
2071 {
2072 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
2073 return( ret );
2074 }
2075
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02002076 if( handshake->premaster == mbedtls_platform_zeroize(
Piotr Nowickia6348ed2020-06-29 15:03:56 +02002077 handshake->premaster, sizeof(handshake->premaster) ) )
2078 {
2079 return( 0 );
2080 }
2081
2082 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002083}
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002084
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02002085int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
2086{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04002087 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002088
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002089 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
Jarno Lamsa4031a452019-12-19 08:11:12 +02002090 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_UNSET;
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002091 /* Compute master secret if needed */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002092 ret = ssl_compute_master( ssl->handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002093 ssl->session_negotiate->master,
2094 ssl );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002095 if( ret != 0 )
2096 {
2097 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
2098 return( ret );
2099 }
2100
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002101 /* Swap the client and server random values:
2102 * - MS derivation wanted client+server (RFC 5246 8.1)
2103 * - key derivation wants server+client (RFC 5246 6.3) */
2104 {
2105 unsigned char tmp[64];
Teppo Järvelin91d79382019-10-02 09:09:31 +03002106 mbedtls_platform_memcpy( tmp, ssl->handshake->randbytes, 64 );
2107 mbedtls_platform_memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
2108 mbedtls_platform_memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002109 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
2110 }
2111
2112 /* Populate transform structure */
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02002113 ret = ssl_populate_transform( ssl->transform_negotiate,
Hanno Beckere02758c2019-06-26 15:31:31 +01002114 mbedtls_ssl_session_get_ciphersuite( ssl->session_negotiate ),
2115 ssl->session_negotiate->master,
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01002116#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002117#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01002118 ssl->session_negotiate->encrypt_then_mac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002119#endif
2120#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01002121 ssl->session_negotiate->trunc_hmac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002122#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01002123#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002124#if defined(MBEDTLS_ZLIB_SUPPORT)
Hanno Beckere02758c2019-06-26 15:31:31 +01002125 ssl->session_negotiate->compression,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002126#endif
Hanno Beckere02758c2019-06-26 15:31:31 +01002127 ssl->handshake->randbytes,
Hanno Becker2881d802019-05-22 14:44:53 +01002128 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Beckere02758c2019-06-26 15:31:31 +01002129 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
2130 ssl );
Jarno Lamsa4031a452019-12-19 08:11:12 +02002131 if( ret == 0 )
2132 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002133 mbedtls_platform_random_delay();
Jarno Lamsa4031a452019-12-19 08:11:12 +02002134 if( ret == 0 )
2135 {
2136 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_SET;
2137 }
2138 else
2139 {
2140 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2141 }
2142 }
2143 else
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002144 {
2145 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
2146 return( ret );
2147 }
2148
2149 /* We no longer need Server/ClientHello.random values */
2150 mbedtls_platform_zeroize( ssl->handshake->randbytes,
2151 sizeof( ssl->handshake->randbytes ) );
2152
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002153 /* Allocate compression buffer */
2154#if defined(MBEDTLS_ZLIB_SUPPORT)
jiblime92af9a92019-12-18 21:40:01 -08002155 if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002156 ssl->compress_buf == NULL )
2157 {
2158 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
2159 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
2160 if( ssl->compress_buf == NULL )
2161 {
2162 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02002163 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002164 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2165 }
2166 }
2167#endif
2168
Paul Bakker5121ce52009-01-03 21:22:43 +00002169 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
2170
2171 return( 0 );
2172}
2173
Hanno Becker09d23642019-07-22 17:18:18 +01002174int mbedtls_ssl_build_pms( mbedtls_ssl_context *ssl )
2175{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04002176 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker09d23642019-07-22 17:18:18 +01002177
2178 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
2179 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Beckera3c2c172019-07-23 16:51:57 +01002180#if defined(MBEDTLS_USE_TINYCRYPT)
2181 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01002182 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
Hanno Beckera3c2c172019-07-23 16:51:57 +01002183 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01002184 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2185 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2186 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2187 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2188 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002189 {
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002190 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2191 ssl->handshake->ecdh_privkey,
2192 ssl->handshake->premaster );
2193 if( ret == UECC_FAULT_DETECTED )
2194 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2195 if( ret != UECC_SUCCESS )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002196 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002197 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Hanno Beckera3c2c172019-07-23 16:51:57 +01002198
2199 ssl->handshake->pmslen = NUM_ECC_BYTES;
2200 }
2201 else
2202#endif
Hanno Becker09d23642019-07-22 17:18:18 +01002203#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
2204 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2205 == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
2206 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002207 ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002208 ssl->handshake->premaster,
2209 MBEDTLS_PREMASTER_SIZE,
2210 &ssl->handshake->pmslen,
2211 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002212 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2213 if( ret == 0 )
2214 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002215 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002216 if( ret == 0 )
2217 {
2218 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2219 }
2220 else
2221 {
Piotr Nowickie048b912020-06-05 17:59:28 +02002222 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret",
2223 MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2224 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002225 }
2226 }
2227 else
Hanno Becker09d23642019-07-22 17:18:18 +01002228 {
2229 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
2230 return( ret );
2231 }
2232
2233 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
2234 }
2235 else
2236#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
Hanno Becker29d16552019-07-24 11:11:45 +01002237#if defined(MBEDTLS_ECDH_C) && \
2238 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2239 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2240 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2241 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) )
Hanno Becker09d23642019-07-22 17:18:18 +01002242 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2243 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2244 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2245 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2246 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2247 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2248 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2249 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2250 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002251 ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002252 &ssl->handshake->pmslen,
2253 ssl->handshake->premaster,
2254 MBEDTLS_MPI_MAX_SIZE,
2255 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002256 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2257 if( ret == 0 )
2258 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002259 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002260 if( ret == 0 )
2261 {
2262 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2263 }
2264 else
2265 {
2266 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002267 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002268 }
2269 }
2270 else
Hanno Becker09d23642019-07-22 17:18:18 +01002271 {
2272 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
2273 return( ret );
2274 }
2275
2276 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
2277 }
2278 else
2279#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2280 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2281 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2282 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2283#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2284 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
2285 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002286 ret = mbedtls_ssl_psk_derive_premaster( ssl,
2287 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) );
2288 if( ret == 0 )
2289 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002290 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002291 if( ret == 0 )
2292 {
2293 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2294 }
2295 else
2296 {
2297 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002298 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002299 }
2300 }
2301 else
Hanno Becker09d23642019-07-22 17:18:18 +01002302 {
2303 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
2304 return( ret );
2305 }
2306 }
2307 else
2308#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2309#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2310 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
2311 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2312 {
2313 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
2314 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
2315 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002316 mbedtls_ssl_conf_get_prng( ssl->conf ) );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002317 if( ret == 0 )
2318 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002319 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002320 if( ret == 0 )
2321 {
2322 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2323 }
2324 else
2325 {
2326 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002327 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002328 }
2329 }
2330 else
Hanno Becker09d23642019-07-22 17:18:18 +01002331 {
2332 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
2333 return( ret );
2334 }
2335 }
2336 else
2337#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2338#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
2339 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2340 == MBEDTLS_KEY_EXCHANGE_RSA )
2341 {
2342 ((void) ret);
Manuel Pégourié-Gonnard8793fab2019-08-01 10:44:07 +02002343 /* The premaster secret has already been set by
Hanno Becker09d23642019-07-22 17:18:18 +01002344 * ssl_rsa_generate_partial_pms(). Only the
2345 * PMS length needs to be set. */
2346 ssl->handshake->pmslen = 48;
2347 }
2348 else
2349#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2350 {
2351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2352 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2353 }
2354
2355 return( 0 );
2356}
2357
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002358#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2359int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002360{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002361 unsigned char *p = ssl->handshake->premaster;
2362 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002363 const unsigned char *psk = ssl->conf->psk;
2364 size_t psk_len = ssl->conf->psk_len;
2365
2366 /* If the psk callback was called, use its result */
2367 if( ssl->handshake->psk != NULL )
2368 {
2369 psk = ssl->handshake->psk;
2370 psk_len = ssl->handshake->psk_len;
2371 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002372
2373 /*
2374 * PMS = struct {
2375 * opaque other_secret<0..2^16-1>;
2376 * opaque psk<0..2^16-1>;
2377 * };
2378 * with "other_secret" depending on the particular key exchange
2379 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002380#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
2381 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002382 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002383 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002384 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002385
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002386 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002387
2388 if( end < p || (size_t)( end - p ) < psk_len )
2389 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2390
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002391 mbedtls_platform_memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002392 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002393 }
2394 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002395#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
2396#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2397 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002398 {
2399 /*
2400 * other_secret already set by the ClientKeyExchange message,
2401 * and is 48 bytes long
2402 */
Philippe Antoine747fd532018-05-30 09:13:21 +02002403 if( end - p < 2 )
2404 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2405
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002406 *p++ = 0;
2407 *p++ = 48;
2408 p += 48;
2409 }
2410 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002411#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2412#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2413 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002414 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002415 int ret;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002416 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002417
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02002418 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002419 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002420 p + 2, end - ( p + 2 ), &len,
Hanno Beckerece325c2019-06-13 15:39:27 +01002421 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002422 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002423 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002424 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002425 return( ret );
2426 }
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002427 p = mbedtls_platform_put_uint16_be( p, len );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002428 p += len;
2429
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002430 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002431 }
2432 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002433#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2434#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2435 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002436 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002437 int ret;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002438 size_t zlen;
2439
Hanno Becker982da7e2019-09-02 09:47:39 +01002440#if defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002441 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2442 ssl->handshake->ecdh_privkey,
2443 p + 2 );
2444 if( ret == UECC_FAULT_DETECTED )
2445 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2446 if( ret != UECC_SUCCESS )
Hanno Becker982da7e2019-09-02 09:47:39 +01002447 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Hanno Becker982da7e2019-09-02 09:47:39 +01002448
2449 zlen = NUM_ECC_BYTES;
2450#else /* MBEDTLS_USE_TINYCRYPT */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002451 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02002452 p + 2, end - ( p + 2 ),
Hanno Beckerece325c2019-06-13 15:39:27 +01002453 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002454 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002455 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002456 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002457 return( ret );
2458 }
2459
Hanno Becker982da7e2019-09-02 09:47:39 +01002460 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2461 MBEDTLS_DEBUG_ECDH_Z );
2462#endif /* MBEDTLS_USE_TINYCRYPT */
2463
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002464 p = mbedtls_platform_put_uint16_be( p, zlen );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002465 p += zlen;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002466 }
2467 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002468#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002469 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002470 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2471 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002472 }
2473
2474 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002475 if( end - p < 2 )
2476 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01002477
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002478 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002479
2480 if( end < p || (size_t)( end - p ) < psk_len )
2481 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2482
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02002483 if( mbedtls_platform_memcpy( p, psk, psk_len ) != p )
2484 {
2485 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2486 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002487 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002488
2489 ssl->handshake->pmslen = p - ssl->handshake->premaster;
2490
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002491 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2492
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002493 return( 0 );
2494}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002495#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002496
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002497#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00002498/*
2499 * SSLv3.0 MAC functions
2500 */
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002501#define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002502static void ssl_mac( mbedtls_md_context_t *md_ctx,
2503 const unsigned char *secret,
2504 const unsigned char *buf, size_t len,
2505 const unsigned char *ctr, int type,
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002506 unsigned char out[SSL_MAC_MAX_BYTES] )
Paul Bakker5121ce52009-01-03 21:22:43 +00002507{
2508 unsigned char header[11];
2509 unsigned char padding[48];
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002510 int padlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002511 int md_size = mbedtls_md_get_size( md_ctx->md_info );
2512 int md_type = mbedtls_md_get_type( md_ctx->md_info );
Paul Bakker68884e32013-01-07 18:20:04 +01002513
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002514 /* Only MD5 and SHA-1 supported */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002515 if( md_type == MBEDTLS_MD_MD5 )
Paul Bakker68884e32013-01-07 18:20:04 +01002516 padlen = 48;
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002517 else
Paul Bakker68884e32013-01-07 18:20:04 +01002518 padlen = 40;
Paul Bakker5121ce52009-01-03 21:22:43 +00002519
Teppo Järvelin91d79382019-10-02 09:09:31 +03002520 mbedtls_platform_memcpy( header, ctr, 8 );
Arto Kinnunen6e3f09b2019-09-06 17:37:01 +03002521 header[8] = (unsigned char) type;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002522 (void)mbedtls_platform_put_uint16_be( &header[9], len );
Paul Bakker5121ce52009-01-03 21:22:43 +00002523
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002524 mbedtls_platform_memset( padding, 0x36, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002525 mbedtls_md_starts( md_ctx );
2526 mbedtls_md_update( md_ctx, secret, md_size );
2527 mbedtls_md_update( md_ctx, padding, padlen );
2528 mbedtls_md_update( md_ctx, header, 11 );
2529 mbedtls_md_update( md_ctx, buf, len );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002530 mbedtls_md_finish( md_ctx, out );
Paul Bakker5121ce52009-01-03 21:22:43 +00002531
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002532 mbedtls_platform_memset( padding, 0x5C, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002533 mbedtls_md_starts( md_ctx );
2534 mbedtls_md_update( md_ctx, secret, md_size );
2535 mbedtls_md_update( md_ctx, padding, padlen );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002536 mbedtls_md_update( md_ctx, out, md_size );
2537 mbedtls_md_finish( md_ctx, out );
Paul Bakker5f70b252012-09-13 14:23:06 +00002538}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002539#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +00002540
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002541/* The function below is only used in the Lucky 13 counter-measure in
Hanno Becker30d02cd2018-10-18 15:43:13 +01002542 * mbedtls_ssl_decrypt_buf(). These are the defines that guard the call site. */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002543#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) && \
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002544 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
2545 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2546 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
2547/* This function makes sure every byte in the memory region is accessed
2548 * (in ascending addresses order) */
2549static void ssl_read_memory( unsigned char *p, size_t len )
2550{
2551 unsigned char acc = 0;
2552 volatile unsigned char force;
2553
2554 for( ; len != 0; p++, len-- )
2555 acc ^= *p;
2556
2557 force = acc;
2558 (void) force;
2559}
2560#endif /* SSL_SOME_MODES_USE_MAC && ( TLS1 || TLS1_1 || TLS1_2 ) */
2561
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002562/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002563 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +02002564 */
Hanno Becker3307b532017-12-27 21:37:21 +00002565
Hanno Beckera5a2b082019-05-15 14:03:01 +01002566#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker89693692019-05-20 15:06:12 +01002567/* This functions transforms a DTLS plaintext fragment and a record content
2568 * type into an instance of the DTLSInnerPlaintext structure:
Hanno Becker92c930f2019-04-29 17:31:37 +01002569 *
2570 * struct {
2571 * opaque content[DTLSPlaintext.length];
2572 * ContentType real_type;
2573 * uint8 zeros[length_of_padding];
2574 * } DTLSInnerPlaintext;
2575 *
2576 * Input:
2577 * - `content`: The beginning of the buffer holding the
2578 * plaintext to be wrapped.
2579 * - `*content_size`: The length of the plaintext in Bytes.
2580 * - `max_len`: The number of Bytes available starting from
2581 * `content`. This must be `>= *content_size`.
2582 * - `rec_type`: The desired record content type.
2583 *
2584 * Output:
2585 * - `content`: The beginning of the resulting DTLSInnerPlaintext structure.
2586 * - `*content_size`: The length of the resulting DTLSInnerPlaintext structure.
2587 *
2588 * Returns:
2589 * - `0` on success.
2590 * - A negative error code if `max_len` didn't offer enough space
2591 * for the expansion.
2592 */
2593static int ssl_cid_build_inner_plaintext( unsigned char *content,
2594 size_t *content_size,
2595 size_t remaining,
2596 uint8_t rec_type )
2597{
2598 size_t len = *content_size;
Hanno Becker78426092019-05-13 15:31:17 +01002599 size_t pad = ( MBEDTLS_SSL_CID_PADDING_GRANULARITY -
2600 ( len + 1 ) % MBEDTLS_SSL_CID_PADDING_GRANULARITY ) %
2601 MBEDTLS_SSL_CID_PADDING_GRANULARITY;
Hanno Becker92c930f2019-04-29 17:31:37 +01002602
2603 /* Write real content type */
2604 if( remaining == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002605 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Hanno Becker92c930f2019-04-29 17:31:37 +01002606 content[ len ] = rec_type;
2607 len++;
2608 remaining--;
2609
2610 if( remaining < pad )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002611 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002612 mbedtls_platform_memset( content + len, 0, pad );
Hanno Becker92c930f2019-04-29 17:31:37 +01002613 len += pad;
2614 remaining -= pad;
2615
2616 *content_size = len;
Andrzej Kurekafec8852020-07-15 16:31:27 -04002617 return( 0 );
Hanno Becker92c930f2019-04-29 17:31:37 +01002618}
2619
Hanno Becker7dc25772019-05-20 15:08:01 +01002620/* This function parses a DTLSInnerPlaintext structure.
2621 * See ssl_cid_build_inner_plaintext() for details. */
Hanno Becker92c930f2019-04-29 17:31:37 +01002622static int ssl_cid_parse_inner_plaintext( unsigned char const *content,
2623 size_t *content_size,
2624 uint8_t *rec_type )
2625{
2626 size_t remaining = *content_size;
2627
2628 /* Determine length of padding by skipping zeroes from the back. */
2629 do
2630 {
2631 if( remaining == 0 )
2632 return( -1 );
2633 remaining--;
2634 } while( content[ remaining ] == 0 );
2635
2636 *content_size = remaining;
2637 *rec_type = content[ remaining ];
2638
2639 return( 0 );
2640}
Hanno Beckera5a2b082019-05-15 14:03:01 +01002641#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01002642
Hanno Becker99abf512019-05-20 14:50:53 +01002643/* `add_data` must have size 13 Bytes if the CID extension is disabled,
Hanno Beckeracadb0a2019-05-08 18:15:21 +01002644 * and 13 + 1 + CID-length Bytes if the CID extension is enabled. */
Hanno Becker3307b532017-12-27 21:37:21 +00002645static void ssl_extract_add_data_from_record( unsigned char* add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002646 size_t *add_data_len,
Hanno Becker3307b532017-12-27 21:37:21 +00002647 mbedtls_record *rec )
2648{
Hanno Becker99abf512019-05-20 14:50:53 +01002649 /* Quoting RFC 5246 (TLS 1.2):
Hanno Beckere83efe62019-04-29 13:52:53 +01002650 *
2651 * additional_data = seq_num + TLSCompressed.type +
2652 * TLSCompressed.version + TLSCompressed.length;
2653 *
Hanno Becker99abf512019-05-20 14:50:53 +01002654 * For the CID extension, this is extended as follows
2655 * (quoting draft-ietf-tls-dtls-connection-id-05,
2656 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05):
Hanno Beckere83efe62019-04-29 13:52:53 +01002657 *
2658 * additional_data = seq_num + DTLSPlaintext.type +
2659 * DTLSPlaintext.version +
Hanno Becker99abf512019-05-20 14:50:53 +01002660 * cid +
2661 * cid_length +
Hanno Beckere83efe62019-04-29 13:52:53 +01002662 * length_of_DTLSInnerPlaintext;
2663 */
2664
Teppo Järvelin91d79382019-10-02 09:09:31 +03002665 mbedtls_platform_memcpy( add_data, rec->ctr, sizeof( rec->ctr ) );
Hanno Becker3307b532017-12-27 21:37:21 +00002666 add_data[8] = rec->type;
Teppo Järvelin91d79382019-10-02 09:09:31 +03002667 mbedtls_platform_memcpy( add_data + 9, rec->ver, sizeof( rec->ver ) );
Hanno Beckere83efe62019-04-29 13:52:53 +01002668
Hanno Beckera5a2b082019-05-15 14:03:01 +01002669#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker1f02f052019-05-09 11:38:24 +01002670 if( rec->cid_len != 0 )
2671 {
Teppo Järvelin91d79382019-10-02 09:09:31 +03002672 mbedtls_platform_memcpy( add_data + 11, rec->cid, rec->cid_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002673 add_data[11 + rec->cid_len + 0] = rec->cid_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002674 (void)mbedtls_platform_put_uint16_be( &add_data[11 + rec->cid_len + 1],
2675 rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002676 *add_data_len = 13 + 1 + rec->cid_len;
2677 }
2678 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01002679#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker1f02f052019-05-09 11:38:24 +01002680 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002681 (void)mbedtls_platform_put_uint16_be( &add_data[11], rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002682 *add_data_len = 13;
2683 }
Hanno Becker3307b532017-12-27 21:37:21 +00002684}
2685
Hanno Becker611a83b2018-01-03 14:27:32 +00002686int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl,
2687 mbedtls_ssl_transform *transform,
2688 mbedtls_record *rec,
2689 int (*f_rng)(void *, unsigned char *, size_t),
2690 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +00002691{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002692 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002693 int auth_done = 0;
Hanno Becker3307b532017-12-27 21:37:21 +00002694 unsigned char * data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01002695 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_OUT_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01002696 size_t add_data_len;
Hanno Becker3307b532017-12-27 21:37:21 +00002697 size_t post_avail;
Andrzej Kurekff517212020-08-10 07:10:35 -04002698 int encryption_status = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker3307b532017-12-27 21:37:21 +00002699
2700 /* The SSL context is only used for debugging purposes! */
Hanno Becker611a83b2018-01-03 14:27:32 +00002701#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02002702 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker3307b532017-12-27 21:37:21 +00002703 ((void) ssl);
2704#endif
2705
2706 /* The PRNG is used for dynamic IV generation that's used
2707 * for CBC transformations in TLS 1.1 and TLS 1.2. */
2708#if !( defined(MBEDTLS_CIPHER_MODE_CBC) && \
2709 ( defined(MBEDTLS_AES_C) || \
2710 defined(MBEDTLS_ARIA_C) || \
2711 defined(MBEDTLS_CAMELLIA_C) ) && \
2712 ( defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) ) )
2713 ((void) f_rng);
2714 ((void) p_rng);
2715#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002716
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002717 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002718
Hanno Becker3307b532017-12-27 21:37:21 +00002719 if( transform == NULL )
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002720 {
Hanno Becker3307b532017-12-27 21:37:21 +00002721 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to encrypt_buf" ) );
2722 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2723 }
Hanno Becker505089d2019-05-01 09:45:57 +01002724 if( rec == NULL
2725 || rec->buf == NULL
2726 || rec->buf_len < rec->data_offset
2727 || rec->buf_len - rec->data_offset < rec->data_len
Hanno Beckera5a2b082019-05-15 14:03:01 +01002728#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01002729 || rec->cid_len != 0
2730#endif
2731 )
Hanno Becker3307b532017-12-27 21:37:21 +00002732 {
2733 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to encrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002734 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002735 }
2736
Hanno Becker3307b532017-12-27 21:37:21 +00002737 data = rec->buf + rec->data_offset;
Hanno Becker92c930f2019-04-29 17:31:37 +01002738 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002739 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Hanno Becker3307b532017-12-27 21:37:21 +00002740 data, rec->data_len );
Andrzej Kurek11750442020-09-17 07:12:06 -04002741#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
2742 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx );
2743#else
Hanno Becker3307b532017-12-27 21:37:21 +00002744 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc );
Andrzej Kurek11750442020-09-17 07:12:06 -04002745#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002746 if( rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
2747 {
2748 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record content %u too large, maximum %d",
2749 (unsigned) rec->data_len,
2750 MBEDTLS_SSL_OUT_CONTENT_LEN ) );
2751 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2752 }
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +01002753
Hanno Beckera5a2b082019-05-15 14:03:01 +01002754#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01002755 /*
2756 * Add CID information
2757 */
2758 rec->cid_len = transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03002759 /* Not using more secure mbedtls_platform_memcpy as cid is public */
2760 memcpy( rec->cid, transform->out_cid, transform->out_cid_len );
Hanno Beckere83efe62019-04-29 13:52:53 +01002761 MBEDTLS_SSL_DEBUG_BUF( 3, "CID", rec->cid, rec->cid_len );
Hanno Becker92c930f2019-04-29 17:31:37 +01002762 if( rec->cid_len != 0 )
2763 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002764 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker92c930f2019-04-29 17:31:37 +01002765 /*
Hanno Becker7dc25772019-05-20 15:08:01 +01002766 * Wrap plaintext into DTLSInnerPlaintext structure.
2767 * See ssl_cid_build_inner_plaintext() for more information.
Hanno Becker92c930f2019-04-29 17:31:37 +01002768 *
Hanno Becker7dc25772019-05-20 15:08:01 +01002769 * Note that this changes `rec->data_len`, and hence
2770 * `post_avail` needs to be recalculated afterwards.
Hanno Becker92c930f2019-04-29 17:31:37 +01002771 */
Andrzej Kurek84bde412020-07-06 15:27:34 -04002772 if( ( ret = ssl_cid_build_inner_plaintext( data,
2773 &rec->data_len,
2774 post_avail,
2775 rec->type ) ) != 0 )
Hanno Becker92c930f2019-04-29 17:31:37 +01002776 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002777 return( ret );
Hanno Becker92c930f2019-04-29 17:31:37 +01002778 }
2779
2780 rec->type = MBEDTLS_SSL_MSG_CID;
2781 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01002782#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01002783
Hanno Becker92c930f2019-04-29 17:31:37 +01002784 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
2785
Paul Bakker5121ce52009-01-03 21:22:43 +00002786 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002787 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +00002788 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002789#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002790 if( mode == MBEDTLS_MODE_STREAM ||
2791 ( mode == MBEDTLS_MODE_CBC
2792#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3307b532017-12-27 21:37:21 +00002793 && transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002794#endif
2795 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00002796 {
Hanno Becker3307b532017-12-27 21:37:21 +00002797 if( post_avail < transform->maclen )
2798 {
2799 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2800 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2801 }
2802
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002803#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01002804 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
2805 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002806 {
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002807 unsigned char mac[SSL_MAC_MAX_BYTES];
Hanno Becker3307b532017-12-27 21:37:21 +00002808 ssl_mac( &transform->md_ctx_enc, transform->mac_enc,
2809 data, rec->data_len, rec->ctr, rec->type, mac );
Teppo Järvelin91d79382019-10-02 09:09:31 +03002810 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002811 }
2812 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002813#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002814#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2815 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01002816 if( mbedtls_ssl_ver_geq(
2817 mbedtls_ssl_transform_get_minor_ver( transform ),
2818 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002819 {
Hanno Becker992b6872017-11-09 18:57:39 +00002820 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
2821
Hanno Beckere83efe62019-04-29 13:52:53 +01002822 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker992b6872017-11-09 18:57:39 +00002823
Hanno Becker3307b532017-12-27 21:37:21 +00002824 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002825 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00002826 mbedtls_md_hmac_update( &transform->md_ctx_enc,
2827 data, rec->data_len );
2828 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
2829 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
2830
Teppo Järvelin91d79382019-10-02 09:09:31 +03002831 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002832 }
2833 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002834#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002835 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002836 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2837 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002838 }
2839
Hanno Becker3307b532017-12-27 21:37:21 +00002840 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", data + rec->data_len,
2841 transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002842
Hanno Becker3307b532017-12-27 21:37:21 +00002843 rec->data_len += transform->maclen;
2844 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002845 auth_done++;
Paul Bakker577e0062013-08-28 11:57:20 +02002846 }
Hanno Becker5cc04d52018-01-03 15:24:20 +00002847#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00002848
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002849 /*
2850 * Encrypt
2851 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002852#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
2853 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00002854 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002855 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00002856 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002857 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Hanno Becker3307b532017-12-27 21:37:21 +00002858 "including %d bytes of padding",
2859 rec->data_len, 0 ) );
Andrzej Kurek11750442020-09-17 07:12:06 -04002860#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02002861 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
2862 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04002863 {
Andrzej Kureka7932372020-09-19 07:56:06 +02002864 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04002865 return( ret );
2866 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002867
Andrzej Kurekff517212020-08-10 07:10:35 -04002868 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04002869 transform->iv_enc, transform->ivlen,
2870 data, rec->data_len,
2871 data, &olen ) ) != 0 )
2872 {
2873 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
2874 return( ret );
2875 }
2876#else
Andrzej Kurekff517212020-08-10 07:10:35 -04002877 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002878 transform->iv_enc, transform->ivlen,
2879 data, rec->data_len,
2880 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002881 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002882 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002883 return( ret );
2884 }
Andrzej Kurek11750442020-09-17 07:12:06 -04002885#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002886 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002887 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002888 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2889 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002890 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002891 }
Paul Bakker68884e32013-01-07 18:20:04 +01002892 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002893#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002894
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002895#if defined(MBEDTLS_GCM_C) || \
2896 defined(MBEDTLS_CCM_C) || \
2897 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002898 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002899 mode == MBEDTLS_MODE_CCM ||
2900 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002901 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02002902 int ret;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002903 unsigned char iv[12];
Hanno Becker3307b532017-12-27 21:37:21 +00002904 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002905
Hanno Becker3307b532017-12-27 21:37:21 +00002906 /* Check that there's space for both the authentication tag
2907 * and the explicit IV before and after the record content. */
2908 if( post_avail < transform->taglen ||
2909 rec->data_offset < explicit_iv_len )
2910 {
2911 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2912 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2913 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00002914
Paul Bakker68884e32013-01-07 18:20:04 +01002915 /*
2916 * Generate IV
2917 */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002918 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
2919 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002920 /* GCM and CCM: fixed || explicit (=seqnum) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002921 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
2922 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, rec->ctr,
Hanno Becker3307b532017-12-27 21:37:21 +00002923 explicit_iv_len );
2924 /* Prefix record content with explicit IV. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002925 mbedtls_platform_memcpy( data - explicit_iv_len, rec->ctr, explicit_iv_len );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002926 }
2927 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
2928 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002929 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002930 unsigned char i;
2931
Teppo Järvelin91d79382019-10-02 09:09:31 +03002932 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002933
2934 for( i = 0; i < 8; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00002935 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002936 }
2937 else
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002938 {
2939 /* Reminder if we ever add an AEAD mode with a different size */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002940 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2941 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002942 }
2943
Hanno Beckere83efe62019-04-29 13:52:53 +01002944 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker08885812019-04-26 13:34:37 +01002945
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002946 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
2947 iv, transform->ivlen );
2948 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
Hanno Becker3307b532017-12-27 21:37:21 +00002949 data - explicit_iv_len, explicit_iv_len );
2950 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01002951 add_data, add_data_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002952 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002953 "including 0 bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00002954 rec->data_len ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002955
Paul Bakker68884e32013-01-07 18:20:04 +01002956 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02002957 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002958 */
Andrzej Kurek11750442020-09-17 07:12:06 -04002959#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02002960 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
2961 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04002962 {
Andrzej Kureka7932372020-09-19 07:56:06 +02002963 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04002964 return( ret );
2965 }
Hanno Becker3307b532017-12-27 21:37:21 +00002966
Andrzej Kurekff517212020-08-10 07:10:35 -04002967 if( ( ret = encryption_status = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04002968 iv, transform->ivlen,
2969 add_data, add_data_len, /* add data */
2970 data, rec->data_len, /* source */
2971 data, &rec->data_len, /* destination */
2972 data + rec->data_len, transform->taglen ) ) != 0 )
2973 {
2974 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
2975 return( ret );
2976 }
2977#else
Andrzej Kurekff517212020-08-10 07:10:35 -04002978 if( ( ret = encryption_status = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002979 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01002980 add_data, add_data_len, /* add data */
Hanno Becker3307b532017-12-27 21:37:21 +00002981 data, rec->data_len, /* source */
2982 data, &rec->data_len, /* destination */
2983 data + rec->data_len, transform->taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002984 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002985 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002986 return( ret );
2987 }
Andrzej Kurek11750442020-09-17 07:12:06 -04002988#endif
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04002989
Hanno Becker3307b532017-12-27 21:37:21 +00002990 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag",
2991 data + rec->data_len, transform->taglen );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002992
Hanno Becker3307b532017-12-27 21:37:21 +00002993 rec->data_len += transform->taglen + explicit_iv_len;
2994 rec->data_offset -= explicit_iv_len;
2995 post_avail -= transform->taglen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002996 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002997 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002998 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002999#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3000#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003001 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003002 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00003003 {
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003004 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00003005 size_t padlen, i;
3006 size_t olen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003007
Hanno Becker3307b532017-12-27 21:37:21 +00003008 /* Currently we're always using minimal padding
3009 * (up to 255 bytes would be allowed). */
3010 padlen = transform->ivlen - ( rec->data_len + 1 ) % transform->ivlen;
3011 if( padlen == transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003012 padlen = 0;
3013
Hanno Becker3307b532017-12-27 21:37:21 +00003014 /* Check there's enough space in the buffer for the padding. */
3015 if( post_avail < padlen + 1 )
3016 {
3017 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3018 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3019 }
3020
Paul Bakker5121ce52009-01-03 21:22:43 +00003021 for( i = 0; i <= padlen; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00003022 data[rec->data_len + i] = (unsigned char) padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00003023
Hanno Becker3307b532017-12-27 21:37:21 +00003024 rec->data_len += padlen + 1;
3025 post_avail -= padlen + 1;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003026
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003027#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003028 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00003029 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
3030 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003031 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003032 if( mbedtls_ssl_ver_geq(
3033 mbedtls_ssl_transform_get_minor_ver( transform ),
3034 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003035 {
Hanno Becker3307b532017-12-27 21:37:21 +00003036 if( f_rng == NULL )
3037 {
3038 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No PRNG provided to encrypt_record routine" ) );
3039 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3040 }
3041
3042 if( rec->data_offset < transform->ivlen )
3043 {
3044 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3045 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3046 }
3047
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003048 /*
3049 * Generate IV
3050 */
Hanno Becker3307b532017-12-27 21:37:21 +00003051 ret = f_rng( p_rng, transform->iv_enc, transform->ivlen );
Paul Bakkera3d195c2011-11-27 21:07:34 +00003052 if( ret != 0 )
3053 return( ret );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003054
Teppo Järvelin91d79382019-10-02 09:09:31 +03003055 mbedtls_platform_memcpy( data - transform->ivlen, transform->iv_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00003056 transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003057
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003058 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003059#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003060
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003061 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003062 "including %d bytes of IV and %d bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00003063 rec->data_len, transform->ivlen,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02003064 padlen + 1 ) );
Andrzej Kurek11750442020-09-17 07:12:06 -04003065#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003066 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
3067 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003068 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003069 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003070 return( ret );
3071 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003072
Andrzej Kurekff517212020-08-10 07:10:35 -04003073 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04003074 transform->iv_enc,
3075 transform->ivlen,
3076 data, rec->data_len,
3077 data, &olen ) ) != 0 )
3078 {
3079 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3080 return( ret );
3081 }
3082#else
Andrzej Kurekff517212020-08-10 07:10:35 -04003083 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00003084 transform->iv_enc,
3085 transform->ivlen,
3086 data, rec->data_len,
3087 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003088 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003089 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003090 return( ret );
3091 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003092#endif
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04003093
Hanno Becker3307b532017-12-27 21:37:21 +00003094 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003095 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003096 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3097 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003098 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003099
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003100#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003101 if( mbedtls_ssl_ver_lt(
3102 mbedtls_ssl_transform_get_minor_ver( transform ),
3103 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003104 {
3105 /*
3106 * Save IV in SSL3 and TLS1
3107 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003108#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3109 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx.iv,
3110 transform->ivlen );
3111#else
Teppo Järvelin91d79382019-10-02 09:09:31 +03003112 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx_enc.iv,
Hanno Becker3307b532017-12-27 21:37:21 +00003113 transform->ivlen );
Andrzej Kurek11750442020-09-17 07:12:06 -04003114#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003115 }
Hanno Becker3307b532017-12-27 21:37:21 +00003116 else
Paul Bakkercca5b812013-08-31 17:40:26 +02003117#endif
Hanno Becker3307b532017-12-27 21:37:21 +00003118 {
3119 data -= transform->ivlen;
3120 rec->data_offset -= transform->ivlen;
3121 rec->data_len += transform->ivlen;
3122 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003123
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003124#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003125 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003126 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00003127 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
3128
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003129 /*
3130 * MAC(MAC_write_key, seq_num +
3131 * TLSCipherText.type +
3132 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003133 * length_of( (IV +) ENC(...) ) +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003134 * IV + // except for TLS 1.0
3135 * ENC(content + padding + padding_length));
3136 */
Hanno Becker3307b532017-12-27 21:37:21 +00003137
3138 if( post_avail < transform->maclen)
3139 {
3140 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3141 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3142 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003143
Hanno Beckere83efe62019-04-29 13:52:53 +01003144 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003146 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Hanno Becker3307b532017-12-27 21:37:21 +00003147 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01003148 add_data_len );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003149
Hanno Becker3307b532017-12-27 21:37:21 +00003150 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01003151 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00003152 mbedtls_md_hmac_update( &transform->md_ctx_enc,
3153 data, rec->data_len );
3154 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
3155 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003156
Teppo Järvelin91d79382019-10-02 09:09:31 +03003157 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003158
Hanno Becker3307b532017-12-27 21:37:21 +00003159 rec->data_len += transform->maclen;
3160 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003161 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003162 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003163#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00003164 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003165 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003166#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003167 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003168 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003169 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3170 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003171 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003172
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003173 /* Make extra sure authentication was performed, exactly once */
3174 if( auth_done != 1 )
3175 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003176 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3177 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003178 }
3179
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003180 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003181
Andrzej Kurekff517212020-08-10 07:10:35 -04003182 if( encryption_status == 0 )
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04003183 {
3184 return( 0 );
3185 }
3186 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +00003187}
3188
Hanno Becker40478be2019-07-12 08:23:59 +01003189int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
Hanno Becker611a83b2018-01-03 14:27:32 +00003190 mbedtls_ssl_transform *transform,
3191 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00003192{
Hanno Becker4c6876b2017-12-27 21:28:58 +00003193 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003194 mbedtls_cipher_mode_t mode;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003195 int ret, auth_done = 0;
Hanno Becker5cc04d52018-01-03 15:24:20 +00003196#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01003197 size_t padlen = 0, correct = 1;
3198#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003199 unsigned char* data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01003200 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_IN_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01003201 size_t add_data_len;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003202
Hanno Becker611a83b2018-01-03 14:27:32 +00003203#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02003204 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003205 ((void) ssl);
3206#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003208 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003209 if( rec == NULL ||
3210 rec->buf == NULL ||
3211 rec->buf_len < rec->data_offset ||
3212 rec->buf_len - rec->data_offset < rec->data_len )
3213 {
3214 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to decrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003215 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003216 }
3217
Hanno Becker4c6876b2017-12-27 21:28:58 +00003218 data = rec->buf + rec->data_offset;
Andrzej Kurek11750442020-09-17 07:12:06 -04003219#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3220 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx );
3221#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003222 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -04003223#endif
Hanno Beckera5a2b082019-05-15 14:03:01 +01003224#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01003225 /*
3226 * Match record's CID with incoming CID.
3227 */
Hanno Beckerabd7c892019-05-08 13:02:22 +01003228 if( rec->cid_len != transform->in_cid_len ||
Teppo Järvelin0efac532019-10-04 13:21:08 +03003229 memcmp( rec->cid, transform->in_cid, rec->cid_len ) != 0 ) // use regular memcmp as CID is public
Hanno Beckerabd7c892019-05-08 13:02:22 +01003230 {
Hanno Beckere8eff9a2019-05-14 11:30:10 +01003231 return( MBEDTLS_ERR_SSL_UNEXPECTED_CID );
Hanno Beckerabd7c892019-05-08 13:02:22 +01003232 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003233#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01003234
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003235#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
3236 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker68884e32013-01-07 18:20:04 +01003237 {
3238 padlen = 0;
Andrzej Kurek11750442020-09-17 07:12:06 -04003239#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003240 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3241 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003242 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003243 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003244 return( ret );
3245 }
3246 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx,
3247 transform->iv_dec,
3248 transform->ivlen,
3249 data, rec->data_len,
3250 data, &olen ) ) != 0 )
3251 {
3252 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3253 return( ret );
3254 }
3255#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003256 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3257 transform->iv_dec,
3258 transform->ivlen,
3259 data, rec->data_len,
3260 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003261 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003262 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003263 return( ret );
3264 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003265#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003266 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003267 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003268 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3269 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003270 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003271 }
Paul Bakker68884e32013-01-07 18:20:04 +01003272 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003273#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003274#if defined(MBEDTLS_GCM_C) || \
3275 defined(MBEDTLS_CCM_C) || \
3276 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003277 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003278 mode == MBEDTLS_MODE_CCM ||
3279 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003280 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003281 unsigned char iv[12];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003282 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003283
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003284 /*
3285 * Prepare IV from explicit and implicit data.
3286 */
3287
3288 /* Check that there's enough space for the explicit IV
3289 * (at the beginning of the record) and the MAC (at the
3290 * end of the record). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003291 if( rec->data_len < explicit_iv_len + transform->taglen )
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003292 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003293 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003294 "+ taglen (%d)", rec->data_len,
3295 explicit_iv_len, transform->taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003296 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003297 }
Paul Bakker68884e32013-01-07 18:20:04 +01003298
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003299#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003300 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
3301 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003302 /* GCM and CCM: fixed || explicit */
Paul Bakker68884e32013-01-07 18:20:04 +01003303
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003304 /* Fixed */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003305 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003306 /* Explicit */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003307 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, data, 8 );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003308 }
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003309 else
3310#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3311#if defined(MBEDTLS_CHACHAPOLY_C)
3312 if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003313 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02003314 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003315 unsigned char i;
3316
Teppo Järvelin91d79382019-10-02 09:09:31 +03003317 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003318
3319 for( i = 0; i < 8; i++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003320 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003321 }
3322 else
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003323#endif /* MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003324 {
3325 /* Reminder if we ever add an AEAD mode with a different size */
3326 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3327 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3328 }
3329
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003330 /* Group changes to data, data_len, and add_data, because
3331 * add_data depends on data_len. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003332 data += explicit_iv_len;
3333 rec->data_offset += explicit_iv_len;
3334 rec->data_len -= explicit_iv_len + transform->taglen;
3335
Hanno Beckere83efe62019-04-29 13:52:53 +01003336 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003337 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01003338 add_data, add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003339
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003340 /* Because of the check above, we know that there are
3341 * explicit_iv_len Bytes preceeding data, and taglen
3342 * bytes following data + data_len. This justifies
Hanno Becker07d420d2019-07-10 11:44:13 +01003343 * the debug message and the invocation of
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003344 * mbedtls_cipher_auth_decrypt() below. */
3345
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003346 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv, transform->ivlen );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003347 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", data + rec->data_len,
Hanno Becker8759e162017-12-27 21:34:08 +00003348 transform->taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01003349
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003350 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003351 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003352 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003353#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003354 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3355 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003356 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003357 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003358 return( ret );
3359 }
3360 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx,
3361 iv, transform->ivlen,
3362 add_data, add_data_len,
3363 data, rec->data_len,
3364 data, &olen,
3365 data + rec->data_len,
3366 transform->taglen ) ) != 0 )
3367 {
3368 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
3369
3370 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3371 return( MBEDTLS_ERR_SSL_INVALID_MAC );
3372
3373 return( ret );
3374 }
3375#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003376 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx_dec,
3377 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01003378 add_data, add_data_len,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003379 data, rec->data_len,
3380 data, &olen,
3381 data + rec->data_len,
3382 transform->taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003383 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003384 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003385
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003386 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3387 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003388
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003389 return( ret );
3390 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003391#endif
3392
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003393 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003394
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003395 /* Double-check that AEAD decryption doesn't change content length. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003396 if( olen != rec->data_len )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003397 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003398 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3399 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003400 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00003401 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003402 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003403#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3404#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003405 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003406 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00003407 {
Paul Bakkere47b34b2013-02-27 14:48:00 +01003408 size_t minlen = 0;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003409
Paul Bakker5121ce52009-01-03 21:22:43 +00003410 /*
Paul Bakker45829992013-01-03 14:52:21 +01003411 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00003412 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003413#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003414 if( mbedtls_ssl_ver_geq(
3415 mbedtls_ssl_transform_get_minor_ver( transform ),
3416 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003417 {
3418 /* The ciphertext is prefixed with the CBC IV. */
3419 minlen += transform->ivlen;
3420 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003421#endif
Paul Bakker45829992013-01-03 14:52:21 +01003422
Hanno Becker4c6876b2017-12-27 21:28:58 +00003423 /* Size considerations:
3424 *
3425 * - The CBC cipher text must not be empty and hence
3426 * at least of size transform->ivlen.
3427 *
3428 * Together with the potential IV-prefix, this explains
3429 * the first of the two checks below.
3430 *
3431 * - The record must contain a MAC, either in plain or
3432 * encrypted, depending on whether Encrypt-then-MAC
3433 * is used or not.
3434 * - If it is, the message contains the IV-prefix,
3435 * the CBC ciphertext, and the MAC.
3436 * - If it is not, the padded plaintext, and hence
3437 * the CBC ciphertext, has at least length maclen + 1
3438 * because there is at least the padding length byte.
3439 *
3440 * As the CBC ciphertext is not empty, both cases give the
3441 * lower bound minlen + maclen + 1 on the record size, which
3442 * we test for in the second check below.
3443 */
3444 if( rec->data_len < minlen + transform->ivlen ||
3445 rec->data_len < minlen + transform->maclen + 1 )
Paul Bakker45829992013-01-03 14:52:21 +01003446 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003447 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003448 "+ 1 ) ( + expl IV )", rec->data_len,
3449 transform->ivlen,
3450 transform->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003451 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01003452 }
3453
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003454 /*
3455 * Authenticate before decrypt if enabled
3456 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003457#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003458 if( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003459 {
Hanno Becker992b6872017-11-09 18:57:39 +00003460 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003461
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003462 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003463
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003464 /* Update data_len in tandem with add_data.
3465 *
3466 * The subtraction is safe because of the previous check
3467 * data_len >= minlen + maclen + 1.
3468 *
3469 * Afterwards, we know that data + data_len is followed by at
3470 * least maclen Bytes, which justifies the call to
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003471 * mbedtls_platform_memequal() below.
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003472 *
3473 * Further, we still know that data_len > minlen */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003474 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003475 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003476
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003477 /* Calculate expected MAC. */
Hanno Beckere83efe62019-04-29 13:52:53 +01003478 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
3479 add_data_len );
3480 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3481 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003482 mbedtls_md_hmac_update( &transform->md_ctx_dec,
3483 data, rec->data_len );
3484 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
3485 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003486
Hanno Becker4c6876b2017-12-27 21:28:58 +00003487 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len,
3488 transform->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00003489 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003490 transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003491
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003492 /* Compare expected MAC with MAC at the end of the record. */
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003493 if( mbedtls_platform_memequal( data + rec->data_len, mac_expect,
3494 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003495 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003496 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003497 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003498 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003499 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003500 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003501#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003502
3503 /*
3504 * Check length sanity
3505 */
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003506
3507 /* We know from above that data_len > minlen >= 0,
3508 * so the following check in particular implies that
3509 * data_len >= minlen + ivlen ( = minlen or 2 * minlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003510 if( rec->data_len % transform->ivlen != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003511 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003512 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003513 rec->data_len, transform->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003514 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003515 }
3516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003517#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003518 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00003519 * Initialize for prepended IV for block cipher in TLS v1.1 and up
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003520 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003521 if( mbedtls_ssl_ver_geq(
3522 mbedtls_ssl_transform_get_minor_ver( transform ),
3523 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003524 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003525 /* Safe because data_len >= minlen + ivlen = 2 * ivlen. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003526 mbedtls_platform_memcpy( transform->iv_dec, data, transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003527
Hanno Becker4c6876b2017-12-27 21:28:58 +00003528 data += transform->ivlen;
3529 rec->data_offset += transform->ivlen;
3530 rec->data_len -= transform->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003531 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003532#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003533
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003534 /* We still have data_len % ivlen == 0 and data_len >= ivlen here. */
Andrzej Kurek11750442020-09-17 07:12:06 -04003535#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003536 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3537 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003538 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003539 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003540 return( ret );
3541 }
Andrzej Kureka7932372020-09-19 07:56:06 +02003542
Andrzej Kurek11750442020-09-17 07:12:06 -04003543 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx,
3544 transform->iv_dec, transform->ivlen,
3545 data, rec->data_len, data, &olen ) ) != 0 )
3546 {
3547 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3548 return( ret );
3549 }
3550#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003551 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3552 transform->iv_dec, transform->ivlen,
3553 data, rec->data_len, data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003555 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003556 return( ret );
3557 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003558#endif
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003559 /* Double-check that length hasn't changed during decryption. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003560 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003561 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003562 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3563 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003564 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003565
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003566#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003567 if( mbedtls_ssl_ver_lt(
3568 mbedtls_ssl_transform_get_minor_ver( transform ),
3569 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003570 {
3571 /*
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003572 * Save IV in SSL3 and TLS1, where CBC decryption of consecutive
3573 * records is equivalent to CBC decryption of the concatenation
3574 * of the records; in other words, IVs are maintained across
3575 * record decryptions.
Paul Bakkercca5b812013-08-31 17:40:26 +02003576 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003577#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3578 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx.iv,
3579 transform->ivlen );
3580#else
Teppo Järvelin91d79382019-10-02 09:09:31 +03003581 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx_dec.iv,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003582 transform->ivlen );
Andrzej Kurek11750442020-09-17 07:12:06 -04003583#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003584 }
Paul Bakkercca5b812013-08-31 17:40:26 +02003585#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003586
Hanno Becker4c6876b2017-12-27 21:28:58 +00003587 /* Safe since data_len >= minlen + maclen + 1, so after having
3588 * subtracted at most minlen and maclen up to this point,
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003589 * data_len > 0 (because of data_len % ivlen == 0, it's actually
3590 * >= ivlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003591 padlen = data[rec->data_len - 1];
Paul Bakker45829992013-01-03 14:52:21 +01003592
Hanno Becker4c6876b2017-12-27 21:28:58 +00003593 if( auth_done == 1 )
3594 {
3595 correct *= ( rec->data_len >= padlen + 1 );
3596 padlen *= ( rec->data_len >= padlen + 1 );
3597 }
3598 else
Paul Bakker45829992013-01-03 14:52:21 +01003599 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003600#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003601 if( rec->data_len < transform->maclen + padlen + 1 )
3602 {
3603 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
3604 rec->data_len,
3605 transform->maclen,
3606 padlen + 1 ) );
3607 }
Paul Bakkerd66f0702013-01-31 16:57:45 +01003608#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003609
3610 correct *= ( rec->data_len >= transform->maclen + padlen + 1 );
3611 padlen *= ( rec->data_len >= transform->maclen + padlen + 1 );
Paul Bakker45829992013-01-03 14:52:21 +01003612 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003613
Hanno Becker4c6876b2017-12-27 21:28:58 +00003614 padlen++;
3615
3616 /* Regardless of the validity of the padding,
3617 * we have data_len >= padlen here. */
3618
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003619#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003620 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3621 MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003622 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003623 if( padlen > transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003624 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003625#if defined(MBEDTLS_SSL_DEBUG_ALL)
3626 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003627 "should be no more than %d",
3628 padlen, transform->ivlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003629#endif
Paul Bakker45829992013-01-03 14:52:21 +01003630 correct = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00003631 }
3632 }
3633 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003634#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3635#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3636 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003637 if( mbedtls_ssl_ver_gt(
3638 mbedtls_ssl_transform_get_minor_ver( transform ),
3639 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003640 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003641 /* The padding check involves a series of up to 256
3642 * consecutive memory reads at the end of the record
3643 * plaintext buffer. In order to hide the length and
3644 * validity of the padding, always perform exactly
3645 * `min(256,plaintext_len)` reads (but take into account
3646 * only the last `padlen` bytes for the padding check). */
3647 size_t pad_count = 0;
3648 size_t real_count = 0;
3649 volatile unsigned char* const check = data;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003650
Hanno Becker4c6876b2017-12-27 21:28:58 +00003651 /* Index of first padding byte; it has been ensured above
3652 * that the subtraction is safe. */
3653 size_t const padding_idx = rec->data_len - padlen;
3654 size_t const num_checks = rec->data_len <= 256 ? rec->data_len : 256;
3655 size_t const start_idx = rec->data_len - num_checks;
3656 size_t idx;
Paul Bakker956c9e02013-12-19 14:42:28 +01003657
Hanno Becker4c6876b2017-12-27 21:28:58 +00003658 for( idx = start_idx; idx < rec->data_len; idx++ )
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003659 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003660 real_count |= ( idx >= padding_idx );
3661 pad_count += real_count * ( check[idx] == padlen - 1 );
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003662 }
Hanno Becker4c6876b2017-12-27 21:28:58 +00003663 correct &= ( pad_count == padlen );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003664
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003665#if defined(MBEDTLS_SSL_DEBUG_ALL)
Paul Bakker66d5d072014-06-17 16:39:18 +02003666 if( padlen > 0 && correct == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003667 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003668#endif
Paul Bakkere47b34b2013-02-27 14:48:00 +01003669 padlen &= correct * 0x1FF;
Paul Bakker5121ce52009-01-03 21:22:43 +00003670 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003671 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003672#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3673 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003674 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003675 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3676 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003677 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003678
Hanno Becker4c6876b2017-12-27 21:28:58 +00003679 /* If the padding was found to be invalid, padlen == 0
3680 * and the subtraction is safe. If the padding was found valid,
3681 * padlen hasn't been changed and the previous assertion
3682 * data_len >= padlen still holds. */
3683 rec->data_len -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00003684 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003685 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003686#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003687 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003688 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003689 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3690 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003691 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003692
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003693#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003694 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003695 data, rec->data_len );
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003696#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003697
3698 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003699 * Authenticate if not done yet.
3700 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00003701 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00003702#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003703 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003704 {
Hanno Becker992b6872017-11-09 18:57:39 +00003705 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01003706
Hanno Becker4c6876b2017-12-27 21:28:58 +00003707 /* If the initial value of padlen was such that
3708 * data_len < maclen + padlen + 1, then padlen
3709 * got reset to 1, and the initial check
3710 * data_len >= minlen + maclen + 1
3711 * guarantees that at this point we still
3712 * have at least data_len >= maclen.
3713 *
3714 * If the initial value of padlen was such that
3715 * data_len >= maclen + padlen + 1, then we have
3716 * subtracted either padlen + 1 (if the padding was correct)
3717 * or 0 (if the padding was incorrect) since then,
3718 * hence data_len >= maclen in any case.
3719 */
3720 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003721 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Paul Bakker5121ce52009-01-03 21:22:43 +00003722
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003723#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003724 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3725 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003726 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003727 ssl_mac( &transform->md_ctx_dec,
3728 transform->mac_dec,
3729 data, rec->data_len,
3730 rec->ctr, rec->type,
3731 mac_expect );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003732 }
3733 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003734#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3735#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3736 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003737 if( mbedtls_ssl_ver_gt(
3738 mbedtls_ssl_transform_get_minor_ver( transform ),
3739 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003740 {
3741 /*
3742 * Process MAC and always update for padlen afterwards to make
Gilles Peskine20b44082018-05-29 14:06:49 +02003743 * total time independent of padlen.
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003744 *
3745 * Known timing attacks:
3746 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
3747 *
Gilles Peskine20b44082018-05-29 14:06:49 +02003748 * To compensate for different timings for the MAC calculation
3749 * depending on how much padding was removed (which is determined
3750 * by padlen), process extra_run more blocks through the hash
3751 * function.
3752 *
3753 * The formula in the paper is
3754 * extra_run = ceil( (L1-55) / 64 ) - ceil( (L2-55) / 64 )
3755 * where L1 is the size of the header plus the decrypted message
3756 * plus CBC padding and L2 is the size of the header plus the
3757 * decrypted message. This is for an underlying hash function
3758 * with 64-byte blocks.
3759 * We use ( (Lx+8) / 64 ) to handle 'negative Lx' values
3760 * correctly. We round down instead of up, so -56 is the correct
3761 * value for our calculations instead of -55.
3762 *
Gilles Peskine1bd9d582018-06-04 11:58:44 +02003763 * Repeat the formula rather than defining a block_size variable.
3764 * This avoids requiring division by a variable at runtime
3765 * (which would be marginally less efficient and would require
3766 * linking an extra division function in some builds).
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003767 */
3768 size_t j, extra_run = 0;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003769 unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003770
3771 /*
3772 * The next two sizes are the minimum and maximum values of
3773 * in_msglen over all padlen values.
3774 *
3775 * They're independent of padlen, since we previously did
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003776 * data_len -= padlen.
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003777 *
3778 * Note that max_len + maclen is never more than the buffer
3779 * length, as we previously did in_msglen -= maclen too.
3780 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003781 const size_t max_len = rec->data_len + padlen;
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003782 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
3783
Hanno Becker4c6876b2017-12-27 21:28:58 +00003784 memset( tmp, 0, sizeof( tmp ) );
3785
Hanno Beckera5cedbc2019-07-17 11:21:02 +01003786 switch( mbedtls_md_get_type(
3787 mbedtls_md_get_handle( &transform->md_ctx_dec ) ) )
Gilles Peskine20b44082018-05-29 14:06:49 +02003788 {
Gilles Peskined0e55a42018-06-04 12:03:30 +02003789#if defined(MBEDTLS_MD5_C) || defined(MBEDTLS_SHA1_C) || \
3790 defined(MBEDTLS_SHA256_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003791 case MBEDTLS_MD_MD5:
3792 case MBEDTLS_MD_SHA1:
Gilles Peskine20b44082018-05-29 14:06:49 +02003793 case MBEDTLS_MD_SHA256:
Gilles Peskine20b44082018-05-29 14:06:49 +02003794 /* 8 bytes of message size, 64-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003795 extra_run =
3796 ( add_data_len + rec->data_len + padlen + 8 ) / 64 -
3797 ( add_data_len + rec->data_len + 8 ) / 64;
Gilles Peskine20b44082018-05-29 14:06:49 +02003798 break;
3799#endif
Gilles Peskinea7fe25d2018-06-04 12:01:18 +02003800#if defined(MBEDTLS_SHA512_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003801 case MBEDTLS_MD_SHA384:
Gilles Peskine20b44082018-05-29 14:06:49 +02003802 /* 16 bytes of message size, 128-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003803 extra_run =
3804 ( add_data_len + rec->data_len + padlen + 16 ) / 128 -
3805 ( add_data_len + rec->data_len + 16 ) / 128;
Gilles Peskine20b44082018-05-29 14:06:49 +02003806 break;
3807#endif
3808 default:
Gilles Peskine5c389842018-06-04 12:02:43 +02003809 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Gilles Peskine20b44082018-05-29 14:06:49 +02003810 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3811 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01003812
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003813 extra_run &= correct * 0xFF;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003814
Hanno Beckere83efe62019-04-29 13:52:53 +01003815 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3816 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003817 mbedtls_md_hmac_update( &transform->md_ctx_dec, data,
3818 rec->data_len );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003819 /* Make sure we access everything even when padlen > 0. This
3820 * makes the synchronisation requirements for just-in-time
3821 * Prime+Probe attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003822 ssl_read_memory( data + rec->data_len, padlen );
3823 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003824
3825 /* Call mbedtls_md_process at least once due to cache attacks
3826 * that observe whether md_process() was called of not */
Manuel Pégourié-Gonnard47fede02015-04-29 01:35:48 +02003827 for( j = 0; j < extra_run + 1; j++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003828 mbedtls_md_process( &transform->md_ctx_dec, tmp );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003829
Hanno Becker4c6876b2017-12-27 21:28:58 +00003830 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003831
3832 /* Make sure we access all the memory that could contain the MAC,
3833 * before we check it in the next code block. This makes the
3834 * synchronisation requirements for just-in-time Prime+Probe
3835 * attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003836 ssl_read_memory( data + min_len,
3837 max_len - min_len + transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003838 }
3839 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003840#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3841 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003842 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003843 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3844 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003845 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003846
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003847#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003848 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, transform->maclen );
3849 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len, transform->maclen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003850#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003851
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003852 if( mbedtls_platform_memequal( data + rec->data_len, mac_expect,
3853 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003854 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003855#if defined(MBEDTLS_SSL_DEBUG_ALL)
3856 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003857#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003858 correct = 0;
3859 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003860 auth_done++;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003861 }
Hanno Beckerdd3ab132018-10-17 14:43:14 +01003862
3863 /*
3864 * Finally check the correct flag
3865 */
3866 if( correct == 0 )
3867 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Hanno Becker5cc04d52018-01-03 15:24:20 +00003868#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003869
3870 /* Make extra sure authentication was performed, exactly once */
3871 if( auth_done != 1 )
3872 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003873 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3874 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003875 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003876
Hanno Beckera5a2b082019-05-15 14:03:01 +01003877#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker92c930f2019-04-29 17:31:37 +01003878 if( rec->cid_len != 0 )
3879 {
3880 ret = ssl_cid_parse_inner_plaintext( data, &rec->data_len,
3881 &rec->type );
3882 if( ret != 0 )
3883 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3884 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003885#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01003886
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003887 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003888
3889 return( 0 );
3890}
3891
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01003892#undef MAC_NONE
3893#undef MAC_PLAINTEXT
3894#undef MAC_CIPHERTEXT
3895
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003896#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00003897/*
3898 * Compression/decompression functions
3899 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003900static int ssl_compress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003901{
3902 int ret;
3903 unsigned char *msg_post = ssl->out_msg;
Andrzej Kurek5462e022018-04-20 07:58:53 -04003904 ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003905 size_t len_pre = ssl->out_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003906 unsigned char *msg_pre = ssl->compress_buf;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003907#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3908 size_t out_buf_len = ssl->out_buf_len;
3909#else
3910 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3911#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00003912
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003913 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003914
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003915 if( len_pre == 0 )
3916 return( 0 );
3917
Teppo Järvelin91d79382019-10-02 09:09:31 +03003918 mbedtls_platform_memcpy( msg_pre, ssl->out_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003919
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003920 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003921 ssl->out_msglen ) );
3922
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003923 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003924 ssl->out_msg, ssl->out_msglen );
3925
Paul Bakker48916f92012-09-16 19:57:18 +00003926 ssl->transform_out->ctx_deflate.next_in = msg_pre;
3927 ssl->transform_out->ctx_deflate.avail_in = len_pre;
3928 ssl->transform_out->ctx_deflate.next_out = msg_post;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003929 ssl->transform_out->ctx_deflate.avail_out = out_buf_len - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003930
Paul Bakker48916f92012-09-16 19:57:18 +00003931 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003932 if( ret != Z_OK )
3933 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003934 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
3935 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003936 }
3937
Andrzej Kurekf3844952020-10-16 23:03:01 +02003938 ssl->out_msglen = out_buf_len -
Andrzej Kurek5462e022018-04-20 07:58:53 -04003939 ssl->transform_out->ctx_deflate.avail_out - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003940
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003941 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003942 ssl->out_msglen ) );
3943
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003944 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003945 ssl->out_msg, ssl->out_msglen );
3946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003947 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003948
3949 return( 0 );
3950}
3951
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003952static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003953{
3954 int ret;
3955 unsigned char *msg_post = ssl->in_msg;
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003956 ptrdiff_t header_bytes = ssl->in_msg - ssl->in_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003957 size_t len_pre = ssl->in_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003958 unsigned char *msg_pre = ssl->compress_buf;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003959#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3960 size_t in_buf_len = ssl->in_buf_len;
3961#else
3962 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3963#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00003964
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003965 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003966
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003967 if( len_pre == 0 )
3968 return( 0 );
3969
Teppo Järvelin91d79382019-10-02 09:09:31 +03003970 mbedtls_platform_memcpy( msg_pre, ssl->in_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003971
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003972 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003973 ssl->in_msglen ) );
3974
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003975 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003976 ssl->in_msg, ssl->in_msglen );
3977
Paul Bakker48916f92012-09-16 19:57:18 +00003978 ssl->transform_in->ctx_inflate.next_in = msg_pre;
3979 ssl->transform_in->ctx_inflate.avail_in = len_pre;
3980 ssl->transform_in->ctx_inflate.next_out = msg_post;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003981 ssl->transform_in->ctx_inflate.avail_out = in_buf_len -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003982 header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003983
Paul Bakker48916f92012-09-16 19:57:18 +00003984 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003985 if( ret != Z_OK )
3986 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003987 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
3988 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003989 }
3990
Andrzej Kurekf3844952020-10-16 23:03:01 +02003991 ssl->in_msglen = in_buf_len -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003992 ssl->transform_in->ctx_inflate.avail_out - header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003994 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003995 ssl->in_msglen ) );
3996
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003997 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003998 ssl->in_msg, ssl->in_msglen );
3999
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004000 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004001
4002 return( 0 );
4003}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004004#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004005
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004006#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
4007static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004008
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004009#if defined(MBEDTLS_SSL_PROTO_DTLS)
4010static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004011{
4012 /* If renegotiation is not enforced, retransmit until we would reach max
4013 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004014 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004015 {
Hanno Becker1f835fa2019-06-13 10:14:59 +01004016 uint32_t ratio =
4017 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) /
4018 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004019 unsigned char doublings = 1;
4020
4021 while( ratio != 0 )
4022 {
4023 ++doublings;
4024 ratio >>= 1;
4025 }
4026
4027 if( ++ssl->renego_records_seen > doublings )
4028 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02004029 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004030 return( 0 );
4031 }
4032 }
4033
4034 return( ssl_write_hello_request( ssl ) );
4035}
4036#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004037#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004038
Paul Bakker5121ce52009-01-03 21:22:43 +00004039/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004040 * Fill the input message buffer by appending data to it.
4041 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004042 *
4043 * If we return 0, is it guaranteed that (at least) nb_want bytes are
4044 * available (from this read and/or a previous one). Otherwise, an error code
4045 * is returned (possibly EOF or WANT_READ).
4046 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004047 * With stream transport (TLS) on success ssl->in_left == nb_want, but
4048 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
4049 * since we always read a whole datagram at once.
4050 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02004051 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004052 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00004053 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004054int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00004055{
Paul Bakker23986e52011-04-24 08:57:21 +00004056 int ret;
4057 size_t len;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004058#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4059 size_t in_buf_len = ssl->in_buf_len;
4060#else
4061 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4062#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004063
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004064 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004065
Hanno Beckera58a8962019-06-13 16:11:15 +01004066 if( mbedtls_ssl_get_recv( ssl ) == NULL &&
4067 mbedtls_ssl_get_recv_timeout( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004068 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004069 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01004070 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004071 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004072 }
4073
Andrzej Kurekf3844952020-10-16 23:03:01 +02004074 if( nb_want > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004075 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004076 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
4077 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004078 }
4079
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004080#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004081 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004082 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004083 uint32_t timeout;
4084
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02004085 /* Just to be sure */
Hanno Becker0ae6b242019-06-13 16:45:36 +01004086 if( mbedtls_ssl_get_set_timer( ssl ) == NULL ||
4087 mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02004088 {
4089 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
4090 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
4091 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4092 }
4093
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004094 /*
4095 * The point is, we need to always read a full datagram at once, so we
4096 * sometimes read more then requested, and handle the additional data.
4097 * It could be the rest of the current record (while fetching the
4098 * header) and/or some other records in the same datagram.
4099 */
4100
4101 /*
4102 * Move to the next record in the already read datagram if applicable
4103 */
4104 if( ssl->next_record_offset != 0 )
4105 {
4106 if( ssl->in_left < ssl->next_record_offset )
4107 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004108 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4109 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004110 }
4111
4112 ssl->in_left -= ssl->next_record_offset;
4113
4114 if( ssl->in_left != 0 )
4115 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004116 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004117 ssl->next_record_offset ) );
4118 memmove( ssl->in_hdr,
4119 ssl->in_hdr + ssl->next_record_offset,
4120 ssl->in_left );
4121 }
4122
4123 ssl->next_record_offset = 0;
4124 }
4125
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004126 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Paul Bakker5121ce52009-01-03 21:22:43 +00004127 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004128
4129 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004130 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004131 */
4132 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004133 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004134 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004135 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004136 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004137
4138 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01004139 * A record can't be split across datagrams. If we need to read but
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004140 * are not at the beginning of a new record, the caller did something
4141 * wrong.
4142 */
4143 if( ssl->in_left != 0 )
4144 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004145 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4146 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004147 }
4148
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004149 /*
4150 * Don't even try to read if time's out already.
4151 * This avoids by-passing the timer when repeatedly receiving messages
4152 * that will end up being dropped.
4153 */
4154 if( ssl_check_timer( ssl ) != 0 )
Hanno Beckere65ce782017-05-22 14:47:48 +01004155 {
4156 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004157 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Hanno Beckere65ce782017-05-22 14:47:48 +01004158 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004159 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004160 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02004161 len = in_buf_len - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004162
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004163 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004164 timeout = ssl->handshake->retransmit_timeout;
4165 else
Hanno Becker1f835fa2019-06-13 10:14:59 +01004166 timeout = mbedtls_ssl_conf_get_read_timeout( ssl->conf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004167
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004168 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004169
Hanno Beckera58a8962019-06-13 16:11:15 +01004170 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
4171 {
4172 ret = mbedtls_ssl_get_recv_timeout( ssl )
4173 ( ssl->p_bio, ssl->in_hdr, len, timeout );
4174 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004175 else
Hanno Beckera58a8962019-06-13 16:11:15 +01004176 {
4177 ret = mbedtls_ssl_get_recv( ssl )
4178 ( ssl->p_bio, ssl->in_hdr, len );
4179 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004180
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004181 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004182
4183 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004184 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004185 }
4186
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004187 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004188 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004189 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004190 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004191
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004192 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004193 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004194 if( ssl_double_retransmit_timeout( ssl ) != 0 )
4195 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004196 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004197 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004198 }
4199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004200 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004201 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004202 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004203 return( ret );
4204 }
4205
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004206 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004207 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004208#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +01004209 else if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4210 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004211 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004212 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004213 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004214 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004215 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004216 return( ret );
4217 }
4218
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004219 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004220 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004221#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004222 }
4223
Paul Bakker5121ce52009-01-03 21:22:43 +00004224 if( ret < 0 )
4225 return( ret );
4226
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004227 ssl->in_left = ret;
4228 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004229 MBEDTLS_SSL_TRANSPORT_ELSE
4230#endif /* MBEDTLS_SSL_PROTO_DTLS */
4231#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004232 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004233 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004234 ssl->in_left, nb_want ) );
4235
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004236 while( ssl->in_left < nb_want )
4237 {
4238 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02004239
4240 if( ssl_check_timer( ssl ) != 0 )
4241 ret = MBEDTLS_ERR_SSL_TIMEOUT;
4242 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004243 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004244 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004245 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004246 ret = mbedtls_ssl_get_recv_timeout( ssl )( ssl->p_bio,
4247 ssl->in_hdr + ssl->in_left, len,
4248 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004249 }
4250 else
4251 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004252 ret = mbedtls_ssl_get_recv( ssl )( ssl->p_bio,
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004253 ssl->in_hdr + ssl->in_left, len );
4254 }
4255 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004257 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004258 ssl->in_left, nb_want ) );
4259 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004260
4261 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004262 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004263
4264 if( ret < 0 )
4265 return( ret );
4266
mohammad160352aecb92018-03-28 23:41:40 -07004267 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16035bd15cb2018-02-28 04:30:59 -08004268 {
Darryl Green11999bb2018-03-13 15:22:58 +00004269 MBEDTLS_SSL_DEBUG_MSG( 1,
4270 ( "f_recv returned %d bytes but only %lu were requested",
mohammad160319d392b2018-04-02 07:25:26 -07004271 ret, (unsigned long)len ) );
mohammad16035bd15cb2018-02-28 04:30:59 -08004272 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4273 }
4274
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004275 ssl->in_left += ret;
4276 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004277 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004278#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00004279
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004280 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004281
4282 return( 0 );
4283}
4284
4285/*
4286 * Flush any data not yet written
4287 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004288int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004289{
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01004290 int ret;
Hanno Becker04484622018-08-06 09:49:38 +01004291 unsigned char *buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00004292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004293 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004294
Hanno Beckera58a8962019-06-13 16:11:15 +01004295 if( mbedtls_ssl_get_send( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004296 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004297 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01004298 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004299 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004300 }
4301
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004302 /* Avoid incrementing counter if data is flushed */
4303 if( ssl->out_left == 0 )
4304 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004305 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004306 return( 0 );
4307 }
4308
Paul Bakker5121ce52009-01-03 21:22:43 +00004309 while( ssl->out_left > 0 )
4310 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004311 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
Hanno Becker43395762019-05-03 14:46:38 +01004312 mbedtls_ssl_out_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004313
Hanno Becker2b1e3542018-08-06 11:19:13 +01004314 buf = ssl->out_hdr - ssl->out_left;
Hanno Beckera58a8962019-06-13 16:11:15 +01004315 ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00004316
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004317 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004318
4319 if( ret <= 0 )
4320 return( ret );
4321
mohammad160352aecb92018-03-28 23:41:40 -07004322 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16034bbaeb42018-02-22 04:29:04 -08004323 {
Darryl Green11999bb2018-03-13 15:22:58 +00004324 MBEDTLS_SSL_DEBUG_MSG( 1,
4325 ( "f_send returned %d bytes but only %lu bytes were sent",
mohammad160319d392b2018-04-02 07:25:26 -07004326 ret, (unsigned long)ssl->out_left ) );
mohammad16034bbaeb42018-02-22 04:29:04 -08004327 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4328 }
4329
Paul Bakker5121ce52009-01-03 21:22:43 +00004330 ssl->out_left -= ret;
4331 }
4332
Hanno Becker2b1e3542018-08-06 11:19:13 +01004333#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004334 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004335 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004336 ssl->out_hdr = ssl->out_buf;
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004337 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004338 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2b1e3542018-08-06 11:19:13 +01004339#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004340#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +01004341 {
4342 ssl->out_hdr = ssl->out_buf + 8;
4343 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004344#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004345 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004347 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004348
4349 return( 0 );
4350}
4351
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004352/*
4353 * Functions to handle the DTLS retransmission state machine
4354 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004355#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004356/*
4357 * Append current handshake message to current outgoing flight
4358 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004359static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004360{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004361 mbedtls_ssl_flight_item *msg;
Hanno Becker3b235902018-08-06 09:54:53 +01004362 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
4363 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
4364 ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004365
4366 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004367 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004368 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004369 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004370 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004371 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004372 }
4373
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004374 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004375 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004376 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004377 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004378 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004379 }
4380
4381 /* Copy current handshake message with headers */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004382 mbedtls_platform_memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004383 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004384 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004385 msg->next = NULL;
4386
4387 /* Append to the current flight */
4388 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004389 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004390 else
4391 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004392 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004393 while( cur->next != NULL )
4394 cur = cur->next;
4395 cur->next = msg;
4396 }
4397
Hanno Becker3b235902018-08-06 09:54:53 +01004398 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004399 return( 0 );
4400}
4401
4402/*
4403 * Free the current flight of handshake messages
4404 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004405static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004406{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004407 mbedtls_ssl_flight_item *cur = flight;
4408 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004409
4410 while( cur != NULL )
4411 {
4412 next = cur->next;
4413
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004414 mbedtls_free( cur->p );
4415 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004416
4417 cur = next;
4418 }
4419}
4420
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004421#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4422static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004423#endif
4424
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004425/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004426 * Swap transform_out and out_ctr with the alternative ones
4427 */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004428static int ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004429{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004430 mbedtls_ssl_transform *tmp_transform;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004431 unsigned char tmp_out_ctr[8];
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004432#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4433 int ret;
4434#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004435
4436 if( ssl->transform_out == ssl->handshake->alt_transform_out )
4437 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004438 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004439 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004440 }
4441
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004442 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004443
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004444 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004445 tmp_transform = ssl->transform_out;
4446 ssl->transform_out = ssl->handshake->alt_transform_out;
4447 ssl->handshake->alt_transform_out = tmp_transform;
4448
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004449 /* Swap epoch + sequence_number */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004450 mbedtls_platform_memcpy( tmp_out_ctr, ssl->cur_out_ctr, 8 );
4451 mbedtls_platform_memcpy( ssl->cur_out_ctr, ssl->handshake->alt_out_ctr, 8 );
4452 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004453
4454 /* Adjust to the newly activated transform */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004455 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004456
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004457#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4458 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004459 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004460 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004462 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
4463 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004464 }
4465 }
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004466#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
4467
4468 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004469}
4470
4471/*
4472 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004473 */
4474int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
4475{
4476 int ret = 0;
4477
4478 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
4479
4480 ret = mbedtls_ssl_flight_transmit( ssl );
4481
4482 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
4483
4484 return( ret );
4485}
4486
4487/*
4488 * Transmit or retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004489 *
4490 * Need to remember the current message in case flush_output returns
4491 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004492 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004493 */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004494int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004495{
Hanno Becker67bc7c32018-08-06 11:33:50 +01004496 int ret;
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004497 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004498
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004499 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004500 {
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004501 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004502
4503 ssl->handshake->cur_msg = ssl->handshake->flight;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004504 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004505 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4506 return( ret );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004507
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004508 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004509 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004510
4511 while( ssl->handshake->cur_msg != NULL )
4512 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004513 size_t max_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004514 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004515
Hanno Beckere1dcb032018-08-17 16:47:58 +01004516 int const is_finished =
4517 ( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
4518 cur->p[0] == MBEDTLS_SSL_HS_FINISHED );
4519
Hanno Becker04da1892018-08-14 13:22:10 +01004520 uint8_t const force_flush = ssl->disable_datagram_packing == 1 ?
4521 SSL_FORCE_FLUSH : SSL_DONT_FORCE_FLUSH;
4522
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004523 /* Swap epochs before sending Finished: we can't do it after
4524 * sending ChangeCipherSpec, in case write returns WANT_READ.
4525 * Must be done before copying, may change out_msg pointer */
Hanno Beckere1dcb032018-08-17 16:47:58 +01004526 if( is_finished && ssl->handshake->cur_msg_p == ( cur->p + 12 ) )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004527 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004528 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004529 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4530 return( ret );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004531 }
4532
Hanno Becker67bc7c32018-08-06 11:33:50 +01004533 ret = ssl_get_remaining_payload_in_datagram( ssl );
4534 if( ret < 0 )
4535 return( ret );
4536 max_frag_len = (size_t) ret;
4537
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004538 /* CCS is copied as is, while HS messages may need fragmentation */
4539 if( cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4540 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004541 if( max_frag_len == 0 )
4542 {
4543 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4544 return( ret );
4545
4546 continue;
4547 }
4548
Teppo Järvelin91d79382019-10-02 09:09:31 +03004549 mbedtls_platform_memcpy( ssl->out_msg, cur->p, cur->len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004550 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004551 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004552
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004553 /* Update position inside current message */
4554 ssl->handshake->cur_msg_p += cur->len;
4555 }
4556 else
4557 {
4558 const unsigned char * const p = ssl->handshake->cur_msg_p;
4559 const size_t hs_len = cur->len - 12;
4560 const size_t frag_off = p - ( cur->p + 12 );
4561 const size_t rem_len = hs_len - frag_off;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004562 size_t cur_hs_frag_len, max_hs_frag_len;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004563
Hanno Beckere1dcb032018-08-17 16:47:58 +01004564 if( ( max_frag_len < 12 ) || ( max_frag_len == 12 && hs_len != 0 ) )
Manuel Pégourié-Gonnarda1071a52018-08-20 11:56:14 +02004565 {
Hanno Beckere1dcb032018-08-17 16:47:58 +01004566 if( is_finished )
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004567 {
4568 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4569 return( ret );
4570 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004571
Hanno Becker67bc7c32018-08-06 11:33:50 +01004572 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4573 return( ret );
4574
4575 continue;
4576 }
4577 max_hs_frag_len = max_frag_len - 12;
4578
4579 cur_hs_frag_len = rem_len > max_hs_frag_len ?
4580 max_hs_frag_len : rem_len;
4581
4582 if( frag_off == 0 && cur_hs_frag_len != hs_len )
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004583 {
4584 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
Hanno Becker67bc7c32018-08-06 11:33:50 +01004585 (unsigned) cur_hs_frag_len,
4586 (unsigned) max_hs_frag_len ) );
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004587 }
Manuel Pégourié-Gonnardb747c6c2018-08-12 13:28:53 +02004588
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004589 /* Messages are stored with handshake headers as if not fragmented,
4590 * copy beginning of headers then fill fragmentation fields.
4591 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004592 mbedtls_platform_memcpy( ssl->out_msg, cur->p, 6 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004593
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004594 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[6], frag_off );
4595 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[9],
4596 cur_hs_frag_len );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004597
4598 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl->out_msg, 12 );
4599
Hanno Becker3f7b9732018-08-28 09:53:25 +01004600 /* Copy the handshake message content and set records fields */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004601 mbedtls_platform_memcpy( ssl->out_msg + 12, p, cur_hs_frag_len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004602 ssl->out_msglen = cur_hs_frag_len + 12;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004603 ssl->out_msgtype = cur->type;
4604
4605 /* Update position inside current message */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004606 ssl->handshake->cur_msg_p += cur_hs_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004607 }
4608
4609 /* If done with the current message move to the next one if any */
4610 if( ssl->handshake->cur_msg_p >= cur->p + cur->len )
4611 {
4612 if( cur->next != NULL )
4613 {
4614 ssl->handshake->cur_msg = cur->next;
4615 ssl->handshake->cur_msg_p = cur->next->p + 12;
4616 }
4617 else
4618 {
4619 ssl->handshake->cur_msg = NULL;
4620 ssl->handshake->cur_msg_p = NULL;
4621 }
4622 }
4623
4624 /* Actually send the message out */
Hanno Becker04da1892018-08-14 13:22:10 +01004625 if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004626 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004627 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004628 return( ret );
4629 }
4630 }
4631
Hanno Becker67bc7c32018-08-06 11:33:50 +01004632 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4633 return( ret );
4634
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004635 /* Update state and set timer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004636 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
4637 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02004638 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004639 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004640 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004641 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
4642 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004643
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004644 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004645
4646 return( 0 );
4647}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004648
4649/*
4650 * To be called when the last message of an incoming flight is received.
4651 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004652void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004653{
4654 /* We won't need to resend that one any more */
4655 ssl_flight_free( ssl->handshake->flight );
4656 ssl->handshake->flight = NULL;
4657 ssl->handshake->cur_msg = NULL;
4658
4659 /* The next incoming flight will start with this msg_seq */
4660 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
4661
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004662 /* We don't want to remember CCS's across flight boundaries. */
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004663 ssl->handshake->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004664
Hanno Becker0271f962018-08-16 13:23:47 +01004665 /* Clear future message buffering structure. */
4666 ssl_buffering_free( ssl );
4667
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004668 /* Cancel timer */
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004669 ssl_set_timer( ssl, 0 );
4670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004671 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4672 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004673 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004674 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004675 }
4676 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004677 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004678}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004679
4680/*
4681 * To be called when the last message of an outgoing flight is send.
4682 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004683void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004684{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004685 ssl_reset_retransmit_timeout( ssl );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004686 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004687
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004688 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4689 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004690 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004691 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004692 }
4693 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004694 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004695}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004696#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004697
Paul Bakker5121ce52009-01-03 21:22:43 +00004698/*
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004699 * Handshake layer functions
Paul Bakker5121ce52009-01-03 21:22:43 +00004700 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004701
4702/*
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004703 * Write (DTLS: or queue) current handshake (including CCS) message.
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004704 *
4705 * - fill in handshake headers
4706 * - update handshake checksum
4707 * - DTLS: save message for resending
4708 * - then pass to the record layer
4709 *
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004710 * DTLS: except for HelloRequest, messages are only queued, and will only be
4711 * actually sent when calling flight_transmit() or resend().
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004712 *
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004713 * Inputs:
4714 * - ssl->out_msglen: 4 + actual handshake message len
4715 * (4 is the size of handshake headers for TLS)
4716 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
4717 * - ssl->out_msg + 4: the handshake message body
4718 *
Manuel Pégourié-Gonnard065a2a32018-08-20 11:09:26 +02004719 * Outputs, ie state before passing to flight_append() or write_record():
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004720 * - ssl->out_msglen: the length of the record contents
4721 * (including handshake headers but excluding record headers)
4722 * - ssl->out_msg: the record contents (handshake headers + content)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004723 */
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004724int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004725{
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004726 int ret;
4727 const size_t hs_len = ssl->out_msglen - 4;
4728 const unsigned char hs_type = ssl->out_msg[0];
Paul Bakker5121ce52009-01-03 21:22:43 +00004729
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004730 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
4731
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004732 /*
4733 * Sanity checks
4734 */
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004735 if( ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004736 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4737 {
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004738 /* In SSLv3, the client might send a NoCertificate alert. */
4739#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2881d802019-05-22 14:44:53 +01004740 if( ! ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004741 ssl->out_msgtype == MBEDTLS_SSL_MSG_ALERT &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01004742 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4743 MBEDTLS_SSL_IS_CLIENT ) )
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004744#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
4745 {
4746 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4747 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4748 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004749 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004750
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004751 /* Whenever we send anything different from a
4752 * HelloRequest we should be in a handshake - double check. */
4753 if( ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4754 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) &&
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004755 ssl->handshake == NULL )
4756 {
4757 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4758 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4759 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004760
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004761#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004762 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004763 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004764 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004765 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004766 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4767 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004768 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004769#endif
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004770
Hanno Beckerb50a2532018-08-06 11:52:54 +01004771 /* Double-check that we did not exceed the bounds
4772 * of the outgoing record buffer.
4773 * This should never fail as the various message
4774 * writing functions must obey the bounds of the
4775 * outgoing record buffer, but better be safe.
4776 *
4777 * Note: We deliberately do not check for the MTU or MFL here.
4778 */
4779 if( ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN )
4780 {
4781 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
4782 "size %u, maximum %u",
4783 (unsigned) ssl->out_msglen,
4784 (unsigned) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
4785 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4786 }
4787
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004788 /*
4789 * Fill handshake headers
4790 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004791 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004792 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004793 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[1], hs_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00004794
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004795 /*
4796 * DTLS has additional fields in the Handshake layer,
4797 * between the length field and the actual payload:
4798 * uint16 message_seq;
4799 * uint24 fragment_offset;
4800 * uint24 fragment_length;
4801 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004802#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004803 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004804 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004805 /* Make room for the additional DTLS fields */
Angus Grattond8213d02016-05-25 20:56:48 +10004806 if( MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8 )
Hanno Becker9648f8b2017-09-18 10:55:54 +01004807 {
4808 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
4809 "size %u, maximum %u",
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004810 (unsigned) ( hs_len ),
Angus Grattond8213d02016-05-25 20:56:48 +10004811 (unsigned) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
Hanno Becker9648f8b2017-09-18 10:55:54 +01004812 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4813 }
4814
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004815 memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004816 ssl->out_msglen += 8;
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004817
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004818 /* Write message_seq and update it, except for HelloRequest */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004819 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004820 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004821 (void)mbedtls_platform_put_uint16_be( &ssl->out_msg[4],
4822 ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02004823 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004824 }
4825 else
4826 {
4827 ssl->out_msg[4] = 0;
4828 ssl->out_msg[5] = 0;
4829 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004830
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004831 /* Handshake hashes are computed without fragmentation,
4832 * so set frag_offset = 0 and frag_len = hs_len for now */
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02004833 if( mbedtls_platform_memset( ssl->out_msg + 6, 0x00, 3 ) !=
4834 ssl->out_msg + 6 )
4835 {
4836 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
4837 }
4838 if( mbedtls_platform_memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 ) !=
4839 ssl->out_msg + 9 )
4840 {
4841 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
4842 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004843 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004844#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004845
Hanno Becker0207e532018-08-28 10:28:28 +01004846 /* Update running hashes of handshake messages seen */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004847 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Hanno Becker8a4b5902019-08-15 17:04:57 +01004848 mbedtls_ssl_update_checksum( ssl, ssl->out_msg, ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00004849 }
4850
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004851 /* Either send now, or just save to be sent (and resent) later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004852#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004853 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004854 ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4855 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004856 {
4857 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
4858 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004859 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004860 return( ret );
4861 }
4862 }
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004863 else
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004864#endif
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004865 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004866 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004867 {
4868 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
4869 return( ret );
4870 }
4871 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004872
4873 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
4874
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004875 return( 0 );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004876}
4877
4878/*
4879 * Record layer functions
4880 */
4881
4882/*
4883 * Write current record.
4884 *
4885 * Uses:
4886 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
4887 * - ssl->out_msglen: length of the record content (excl headers)
4888 * - ssl->out_msg: record content
4889 */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004890int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush )
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004891{
4892 int ret, done = 0;
4893 size_t len = ssl->out_msglen;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004894 uint8_t flush = force_flush;
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004895
4896 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004897
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004898#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00004899 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004900 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00004901 {
4902 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
4903 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004904 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004905 return( ret );
4906 }
4907
4908 len = ssl->out_msglen;
4909 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004910#endif /*MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004911
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004912#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4913 if( mbedtls_ssl_hw_record_write != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004914 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004915 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004916
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004917 ret = mbedtls_ssl_hw_record_write( ssl );
4918 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00004919 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004920 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
4921 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004922 }
Paul Bakkerc7878112012-12-19 14:41:14 +01004923
4924 if( ret == 0 )
4925 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00004926 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004927#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00004928 if( !done )
4929 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004930 unsigned i;
4931 size_t protected_record_size;
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004932 volatile int encrypted_fi = 0;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004933#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4934 size_t out_buf_len = ssl->out_buf_len;
4935#else
4936 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4937#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004938
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004939 /* Skip writing the record content type to after the encryption,
4940 * as it may change when using the CID extension. */
4941
Hanno Becker2881d802019-05-22 14:44:53 +01004942 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4943 mbedtls_ssl_get_minor_ver( ssl ),
4944 ssl->conf->transport, ssl->out_hdr + 1 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01004945
Teppo Järvelin91d79382019-10-02 09:09:31 +03004946 mbedtls_platform_memcpy( ssl->out_ctr, ssl->cur_out_ctr, 8 );
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004947 (void)mbedtls_platform_put_uint16_be( ssl->out_len, len );
Paul Bakker05ef8352012-05-08 09:17:57 +00004948
Paul Bakker48916f92012-09-16 19:57:18 +00004949 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00004950 {
Hanno Becker3307b532017-12-27 21:37:21 +00004951 mbedtls_record rec;
4952
4953 rec.buf = ssl->out_iv;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004954 rec.buf_len = out_buf_len - ( ssl->out_iv - ssl->out_buf );
Hanno Becker3307b532017-12-27 21:37:21 +00004955 rec.data_len = ssl->out_msglen;
4956 rec.data_offset = ssl->out_msg - rec.buf;
4957
Teppo Järvelin91d79382019-10-02 09:09:31 +03004958 mbedtls_platform_memcpy( &rec.ctr[0], ssl->out_ctr, 8 );
Hanno Becker2881d802019-05-22 14:44:53 +01004959 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4960 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Becker3307b532017-12-27 21:37:21 +00004961 ssl->conf->transport, rec.ver );
4962 rec.type = ssl->out_msgtype;
4963
Hanno Beckera5a2b082019-05-15 14:03:01 +01004964#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01004965 /* The CID is set by mbedtls_ssl_encrypt_buf(). */
Hanno Beckere83efe62019-04-29 13:52:53 +01004966 rec.cid_len = 0;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004967#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01004968
Hanno Becker611a83b2018-01-03 14:27:32 +00004969 if( ( ret = mbedtls_ssl_encrypt_buf( ssl, ssl->transform_out, &rec,
Hanno Beckerece325c2019-06-13 15:39:27 +01004970 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01004971 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00004972 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004973 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00004974 return( ret );
4975 }
4976
Hanno Becker3307b532017-12-27 21:37:21 +00004977 if( rec.data_offset != 0 )
4978 {
4979 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4980 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4981 }
4982
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004983 /* Update the record content type and CID. */
4984 ssl->out_msgtype = rec.type;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004985#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID )
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03004986 /* Not using more secure mbedtls_platform_memcpy as cid is public */
4987 memcpy( ssl->out_cid, rec.cid, rec.cid_len );
Hanno Beckera5a2b082019-05-15 14:03:01 +01004988#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc5aee962019-03-14 12:56:23 +00004989 ssl->out_msglen = len = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004990 (void)mbedtls_platform_put_uint16_be( ssl->out_len, rec.data_len );
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004991 encrypted_fi = 1;
4992 }
4993
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004994 /* Double check to ensure the encryption has been done */
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004995 if( ssl->transform_out != NULL && encrypted_fi == 0 )
4996 {
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004997 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004998 }
4999
Hanno Becker43395762019-05-03 14:46:38 +01005000 protected_record_size = len + mbedtls_ssl_out_hdr_len( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01005001
5002#if defined(MBEDTLS_SSL_PROTO_DTLS)
5003 /* In case of DTLS, double-check that we don't exceed
5004 * the remaining space in the datagram. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005005 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2b1e3542018-08-06 11:19:13 +01005006 {
Hanno Becker554b0af2018-08-22 20:33:41 +01005007 ret = ssl_get_remaining_space_in_datagram( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01005008 if( ret < 0 )
5009 return( ret );
5010
5011 if( protected_record_size > (size_t) ret )
5012 {
5013 /* Should never happen */
5014 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5015 }
5016 }
5017#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker05ef8352012-05-08 09:17:57 +00005018
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005019 /* Now write the potentially updated record content type. */
5020 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
5021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005022 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01005023 "version = [%d:%d], msglen = %d",
5024 ssl->out_hdr[0], ssl->out_hdr[1],
5025 ssl->out_hdr[2], len ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00005026
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005027 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01005028 ssl->out_hdr, protected_record_size );
Hanno Becker2b1e3542018-08-06 11:19:13 +01005029
5030 ssl->out_left += protected_record_size;
5031 ssl->out_hdr += protected_record_size;
5032 ssl_update_out_pointers( ssl, ssl->transform_out );
5033
Hanno Becker04484622018-08-06 09:49:38 +01005034 for( i = 8; i > ssl_ep_len( ssl ); i-- )
5035 if( ++ssl->cur_out_ctr[i - 1] != 0 )
5036 break;
5037
5038 /* The loop goes to its end iff the counter is wrapping */
5039 if( i == ssl_ep_len( ssl ) )
5040 {
5041 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
5042 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
5043 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005044 }
5045
Hanno Becker67bc7c32018-08-06 11:33:50 +01005046#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005047 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker47db8772018-08-21 13:32:13 +01005048 flush == SSL_DONT_FORCE_FLUSH )
Hanno Becker67bc7c32018-08-06 11:33:50 +01005049 {
Hanno Becker1f5a15d2018-08-21 13:31:31 +01005050 size_t remaining;
5051 ret = ssl_get_remaining_payload_in_datagram( ssl );
5052 if( ret < 0 )
5053 {
5054 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
5055 ret );
5056 return( ret );
5057 }
5058
5059 remaining = (size_t) ret;
Hanno Becker67bc7c32018-08-06 11:33:50 +01005060 if( remaining == 0 )
Hanno Beckerf0da6672018-08-28 09:55:10 +01005061 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01005062 flush = SSL_FORCE_FLUSH;
Hanno Beckerf0da6672018-08-28 09:55:10 +01005063 }
Hanno Becker67bc7c32018-08-06 11:33:50 +01005064 else
5065 {
Hanno Becker513815a2018-08-20 11:56:09 +01005066 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining ) );
Hanno Becker67bc7c32018-08-06 11:33:50 +01005067 }
5068 }
5069#endif /* MBEDTLS_SSL_PROTO_DTLS */
5070
5071 if( ( flush == SSL_FORCE_FLUSH ) &&
5072 ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005073 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005074 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005075 return( ret );
5076 }
5077
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005078 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005079
5080 return( 0 );
5081}
5082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005083#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckere25e3b72018-08-16 09:30:53 +01005084
5085static int ssl_hs_is_proper_fragment( mbedtls_ssl_context *ssl )
5086{
5087 if( ssl->in_msglen < ssl->in_hslen ||
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02005088 mbedtls_platform_memequal( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
5089 mbedtls_platform_memequal( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
Hanno Beckere25e3b72018-08-16 09:30:53 +01005090 {
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04005091 return( PROPER_HS_FRAGMENT );
Hanno Beckere25e3b72018-08-16 09:30:53 +01005092 }
5093 return( 0 );
5094}
Hanno Becker44650b72018-08-16 12:51:11 +01005095
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005096static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005097{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005098 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[9] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01005099}
5100
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005101static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005102{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005103 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[6] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01005104}
5105
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005106static int ssl_check_hs_header( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005107{
5108 uint32_t msg_len, frag_off, frag_len;
5109
5110 msg_len = ssl_get_hs_total_len( ssl );
5111 frag_off = ssl_get_hs_frag_off( ssl );
5112 frag_len = ssl_get_hs_frag_len( ssl );
5113
5114 if( frag_off > msg_len )
5115 return( -1 );
5116
5117 if( frag_len > msg_len - frag_off )
5118 return( -1 );
5119
5120 if( frag_len + 12 > ssl->in_msglen )
5121 return( -1 );
5122
5123 return( 0 );
5124}
5125
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005126/*
5127 * Mark bits in bitmask (used for DTLS HS reassembly)
5128 */
5129static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
5130{
5131 unsigned int start_bits, end_bits;
5132
5133 start_bits = 8 - ( offset % 8 );
5134 if( start_bits != 8 )
5135 {
5136 size_t first_byte_idx = offset / 8;
5137
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02005138 /* Special case */
5139 if( len <= start_bits )
5140 {
5141 for( ; len != 0; len-- )
5142 mask[first_byte_idx] |= 1 << ( start_bits - len );
5143
5144 /* Avoid potential issues with offset or len becoming invalid */
5145 return;
5146 }
5147
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005148 offset += start_bits; /* Now offset % 8 == 0 */
5149 len -= start_bits;
5150
5151 for( ; start_bits != 0; start_bits-- )
5152 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
5153 }
5154
5155 end_bits = len % 8;
5156 if( end_bits != 0 )
5157 {
5158 size_t last_byte_idx = ( offset + len ) / 8;
5159
5160 len -= end_bits; /* Now len % 8 == 0 */
5161
5162 for( ; end_bits != 0; end_bits-- )
5163 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
5164 }
5165
5166 memset( mask + offset / 8, 0xFF, len / 8 );
5167}
5168
Andrzej Kurek0919b142020-07-06 15:28:59 -04005169#define BITMASK_CHECK_FAILED 0x75555555
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005170/*
5171 * Check that bitmask is full
5172 */
5173static int ssl_bitmask_check( unsigned char *mask, size_t len )
5174{
5175 size_t i;
5176
5177 for( i = 0; i < len / 8; i++ )
5178 if( mask[i] != 0xFF )
Andrzej Kurek0919b142020-07-06 15:28:59 -04005179 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005180
5181 for( i = 0; i < len % 8; i++ )
5182 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04005183 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005184
5185 return( 0 );
5186}
5187
Hanno Becker56e205e2018-08-16 09:06:12 +01005188/* msg_len does not include the handshake header */
Hanno Becker65dc8852018-08-23 09:40:49 +01005189static size_t ssl_get_reassembly_buffer_size( size_t msg_len,
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005190 unsigned add_bitmap )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005191{
Hanno Becker56e205e2018-08-16 09:06:12 +01005192 size_t alloc_len;
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005193
Hanno Becker56e205e2018-08-16 09:06:12 +01005194 alloc_len = 12; /* Handshake header */
5195 alloc_len += msg_len; /* Content buffer */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005196
Hanno Beckerd07df862018-08-16 09:14:58 +01005197 if( add_bitmap )
5198 alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap */
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005199
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005200 return( alloc_len );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005201}
Hanno Becker56e205e2018-08-16 09:06:12 +01005202
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005203#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005204
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005205static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl )
Hanno Becker12555c62018-08-16 12:47:53 +01005206{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005207 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[1] ) );
Hanno Becker12555c62018-08-16 12:47:53 +01005208}
Hanno Beckere25e3b72018-08-16 09:30:53 +01005209
Simon Butcher99000142016-10-13 17:21:01 +01005210int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005211{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005212 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005213 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005214 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005215 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005216 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005217 }
5218
Hanno Becker12555c62018-08-16 12:47:53 +01005219 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005221 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005222 " %d, type = %d, hslen = %d",
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01005223 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005225#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005226 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005227 {
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005228 int ret;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005229 unsigned int recv_msg_seq = (unsigned int)
5230 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005231
Hanno Becker44650b72018-08-16 12:51:11 +01005232 if( ssl_check_hs_header( ssl ) != 0 )
5233 {
5234 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
5235 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5236 }
5237
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005238 if( ssl->handshake != NULL &&
Hanno Beckerc76c6192017-06-06 10:03:17 +01005239 ( ( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
5240 recv_msg_seq != ssl->handshake->in_msg_seq ) ||
5241 ( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5242 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) ) )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005243 {
Hanno Becker9e1ec222018-08-15 15:54:43 +01005244 if( recv_msg_seq > ssl->handshake->in_msg_seq )
5245 {
5246 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
5247 recv_msg_seq,
5248 ssl->handshake->in_msg_seq ) );
5249 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5250 }
5251
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02005252 /* Retransmit only on last message from previous flight, to avoid
5253 * too many retransmissions.
5254 * Besides, No sane server ever retransmits HelloVerifyRequest */
5255 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005256 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005257 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005258 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005259 "message_seq = %d, start_of_flight = %d",
5260 recv_msg_seq,
5261 ssl->handshake->in_flight_start_seq ) );
5262
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005263 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005265 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005266 return( ret );
5267 }
5268 }
5269 else
5270 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005271 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005272 "message_seq = %d, expected = %d",
5273 recv_msg_seq,
5274 ssl->handshake->in_msg_seq ) );
5275 }
5276
Hanno Becker90333da2017-10-10 11:27:13 +01005277 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005278 }
5279 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005280
Hanno Becker6d97ef52018-08-16 13:09:04 +01005281 /* Message reassembly is handled alongside buffering of future
5282 * messages; the commonality is that both handshake fragments and
Hanno Becker83ab41c2018-08-28 17:19:38 +01005283 * future messages cannot be forwarded immediately to the
Hanno Becker6d97ef52018-08-16 13:09:04 +01005284 * handshake logic layer. */
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04005285 if( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005286 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Hanno Becker6d97ef52018-08-16 13:09:04 +01005288 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005289 }
5290 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005291 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005292#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005293#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005294 {
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005295 /* With TLS we don't handle fragmentation (for now) */
5296 if( ssl->in_msglen < ssl->in_hslen )
5297 {
5298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
5299 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
5300 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005301 }
Manuel Pégourié-Gonnardec1c2222019-06-12 10:18:26 +02005302#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005303
Simon Butcher99000142016-10-13 17:21:01 +01005304 return( 0 );
5305}
5306
5307void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
5308{
Hanno Becker0271f962018-08-16 13:23:47 +01005309 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Simon Butcher99000142016-10-13 17:21:01 +01005310
Hanno Becker0271f962018-08-16 13:23:47 +01005311 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && hs != NULL )
Hanno Becker8a4b5902019-08-15 17:04:57 +01005312 mbedtls_ssl_update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005313
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005314 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005315#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005316 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005317 ssl->handshake != NULL )
5318 {
Hanno Becker0271f962018-08-16 13:23:47 +01005319 unsigned offset;
5320 mbedtls_ssl_hs_buffer *hs_buf;
Hanno Beckere25e3b72018-08-16 09:30:53 +01005321
Hanno Becker0271f962018-08-16 13:23:47 +01005322 /* Increment handshake sequence number */
5323 hs->in_msg_seq++;
5324
5325 /*
5326 * Clear up handshake buffering and reassembly structure.
5327 */
5328
5329 /* Free first entry */
Hanno Beckere605b192018-08-21 15:59:07 +01005330 ssl_buffering_free_slot( ssl, 0 );
Hanno Becker0271f962018-08-16 13:23:47 +01005331
5332 /* Shift all other entries */
Hanno Beckere605b192018-08-21 15:59:07 +01005333 for( offset = 0, hs_buf = &hs->buffering.hs[0];
5334 offset + 1 < MBEDTLS_SSL_MAX_BUFFERED_HS;
Hanno Becker0271f962018-08-16 13:23:47 +01005335 offset++, hs_buf++ )
5336 {
5337 *hs_buf = *(hs_buf + 1);
5338 }
5339
5340 /* Create a fresh last entry */
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02005341 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005342 }
5343#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005344}
5345
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005346/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005347 * DTLS anti-replay: RFC 6347 4.1.2.6
5348 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005349 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
5350 * Bit n is set iff record number in_window_top - n has been seen.
5351 *
5352 * Usually, in_window_top is the last record number seen and the lsb of
5353 * in_window is set. The only exception is the initial state (record number 0
5354 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005355 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005356#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5357static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005358{
5359 ssl->in_window_top = 0;
5360 ssl->in_window = 0;
5361}
5362
5363static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
5364{
5365 return( ( (uint64_t) buf[0] << 40 ) |
5366 ( (uint64_t) buf[1] << 32 ) |
5367 ( (uint64_t) buf[2] << 24 ) |
5368 ( (uint64_t) buf[3] << 16 ) |
5369 ( (uint64_t) buf[4] << 8 ) |
5370 ( (uint64_t) buf[5] ) );
5371}
5372
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005373static int mbedtls_ssl_dtls_record_replay_check( mbedtls_ssl_context *ssl, uint8_t *record_in_ctr )
5374{
5375 int ret;
5376 unsigned char *original_in_ctr;
5377
5378 // save original in_ctr
5379 original_in_ctr = ssl->in_ctr;
5380
5381 // use counter from record
5382 ssl->in_ctr = record_in_ctr;
5383
5384 ret = mbedtls_ssl_dtls_replay_check( (mbedtls_ssl_context const *) ssl );
5385
5386 // restore the counter
5387 ssl->in_ctr = original_in_ctr;
5388
5389 return ret;
5390}
5391
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005392/*
5393 * Return 0 if sequence number is acceptable, -1 otherwise
5394 */
Hanno Beckerfc551722019-07-12 08:50:37 +01005395int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context const *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005396{
5397 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5398 uint64_t bit;
5399
Hanno Becker7f376f42019-06-12 16:20:48 +01005400 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5401 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5402 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005403 return( 0 );
Hanno Becker7f376f42019-06-12 16:20:48 +01005404 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005405
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005406 if( rec_seqnum > ssl->in_window_top )
5407 return( 0 );
5408
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005409 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005410
5411 if( bit >= 64 )
5412 return( -1 );
5413
5414 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
5415 return( -1 );
5416
5417 return( 0 );
5418}
5419
5420/*
5421 * Update replay window on new validated record
5422 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005423void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005424{
5425 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5426
Hanno Becker7f376f42019-06-12 16:20:48 +01005427 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5428 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5429 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005430 return;
Hanno Becker7f376f42019-06-12 16:20:48 +01005431 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005432
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005433 if( rec_seqnum > ssl->in_window_top )
5434 {
5435 /* Update window_top and the contents of the window */
5436 uint64_t shift = rec_seqnum - ssl->in_window_top;
5437
5438 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005439 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005440 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005441 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005442 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005443 ssl->in_window |= 1;
5444 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005445
5446 ssl->in_window_top = rec_seqnum;
5447 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005448 else
5449 {
5450 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005451 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005452
5453 if( bit < 64 ) /* Always true, but be extra sure */
5454 ssl->in_window |= (uint64_t) 1 << bit;
5455 }
5456}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005457#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005458
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005459#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005460/* Forward declaration */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005461static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
5462
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005463/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005464 * Without any SSL context, check if a datagram looks like a ClientHello with
5465 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01005466 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005467 *
5468 * - if cookie is valid, return 0
5469 * - if ClientHello looks superficially valid but cookie is not,
5470 * fill obuf and set olen, then
5471 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
5472 * - otherwise return a specific error code
5473 */
5474static int ssl_check_dtls_clihlo_cookie(
5475 mbedtls_ssl_cookie_write_t *f_cookie_write,
5476 mbedtls_ssl_cookie_check_t *f_cookie_check,
5477 void *p_cookie,
5478 const unsigned char *cli_id, size_t cli_id_len,
5479 const unsigned char *in, size_t in_len,
5480 unsigned char *obuf, size_t buf_len, size_t *olen )
5481{
5482 size_t sid_len, cookie_len;
5483 unsigned char *p;
5484
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005485 /*
5486 * Structure of ClientHello with record and handshake headers,
5487 * and expected values. We don't need to check a lot, more checks will be
5488 * done when actually parsing the ClientHello - skipping those checks
5489 * avoids code duplication and does not make cookie forging any easier.
5490 *
5491 * 0-0 ContentType type; copied, must be handshake
5492 * 1-2 ProtocolVersion version; copied
5493 * 3-4 uint16 epoch; copied, must be 0
5494 * 5-10 uint48 sequence_number; copied
5495 * 11-12 uint16 length; (ignored)
5496 *
5497 * 13-13 HandshakeType msg_type; (ignored)
5498 * 14-16 uint24 length; (ignored)
5499 * 17-18 uint16 message_seq; copied
5500 * 19-21 uint24 fragment_offset; copied, must be 0
5501 * 22-24 uint24 fragment_length; (ignored)
5502 *
5503 * 25-26 ProtocolVersion client_version; (ignored)
5504 * 27-58 Random random; (ignored)
5505 * 59-xx SessionID session_id; 1 byte len + sid_len content
5506 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
5507 * ...
5508 *
5509 * Minimum length is 61 bytes.
5510 */
5511 if( in_len < 61 ||
5512 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
5513 in[3] != 0 || in[4] != 0 ||
5514 in[19] != 0 || in[20] != 0 || in[21] != 0 )
5515 {
5516 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5517 }
5518
5519 sid_len = in[59];
5520 if( sid_len > in_len - 61 )
5521 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5522
5523 cookie_len = in[60 + sid_len];
5524 if( cookie_len > in_len - 60 )
5525 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5526
5527 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
5528 cli_id, cli_id_len ) == 0 )
5529 {
5530 /* Valid cookie */
5531 return( 0 );
5532 }
5533
5534 /*
5535 * If we get here, we've got an invalid cookie, let's prepare HVR.
5536 *
5537 * 0-0 ContentType type; copied
5538 * 1-2 ProtocolVersion version; copied
5539 * 3-4 uint16 epoch; copied
5540 * 5-10 uint48 sequence_number; copied
5541 * 11-12 uint16 length; olen - 13
5542 *
5543 * 13-13 HandshakeType msg_type; hello_verify_request
5544 * 14-16 uint24 length; olen - 25
5545 * 17-18 uint16 message_seq; copied
5546 * 19-21 uint24 fragment_offset; copied
5547 * 22-24 uint24 fragment_length; olen - 25
5548 *
5549 * 25-26 ProtocolVersion server_version; 0xfe 0xff
5550 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
5551 *
5552 * Minimum length is 28.
5553 */
5554 if( buf_len < 28 )
5555 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5556
5557 /* Copy most fields and adapt others */
Teppo Järvelin91d79382019-10-02 09:09:31 +03005558 mbedtls_platform_memcpy( obuf, in, 25 );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005559 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
5560 obuf[25] = 0xfe;
5561 obuf[26] = 0xff;
5562
5563 /* Generate and write actual cookie */
5564 p = obuf + 28;
5565 if( f_cookie_write( p_cookie,
5566 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
5567 {
5568 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5569 }
5570
5571 *olen = p - obuf;
5572
5573 /* Go back and fill length fields */
5574 obuf[27] = (unsigned char)( *olen - 28 );
5575
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005576 (void)mbedtls_platform_put_uint24_be( &obuf[14], ( *olen - 25 ) );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005577 obuf[22] = obuf[14];
5578 obuf[23] = obuf[15];
5579 obuf[24] = obuf[16];
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005580
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005581 (void)mbedtls_platform_put_uint16_be( &obuf[11], ( *olen - 13 ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005582
5583 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
5584}
5585
5586/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005587 * Handle possible client reconnect with the same UDP quadruplet
5588 * (RFC 6347 Section 4.2.8).
5589 *
5590 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
5591 * that looks like a ClientHello.
5592 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005593 * - if the input looks like a ClientHello without cookies,
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005594 * send back HelloVerifyRequest, then return 0
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005595 * - if the input looks like a ClientHello with a valid cookie,
5596 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02005597 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005598 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005599 *
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005600 * This function is called (through ssl_check_client_reconnect()) when an
5601 * unexpected record is found in ssl_get_next_record(), which will discard the
5602 * record if we return 0, and bubble up the return value otherwise (this
5603 * includes the case of MBEDTLS_ERR_SSL_CLIENT_RECONNECT and of unexpected
5604 * errors, and is the right thing to do in both cases).
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005605 */
5606static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
5607{
5608 int ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005609 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005610
Hanno Becker87b56262019-07-10 14:37:41 +01005611 if( ssl->conf->f_cookie_write == NULL ||
5612 ssl->conf->f_cookie_check == NULL )
5613 {
5614 /* If we can't use cookies to verify reachability of the peer,
5615 * drop the record. */
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005616 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no cookie callbacks, "
5617 "can't check reconnect validity" ) );
Hanno Becker87b56262019-07-10 14:37:41 +01005618 return( 0 );
5619 }
5620
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005621 ret = ssl_check_dtls_clihlo_cookie(
5622 ssl->conf->f_cookie_write,
5623 ssl->conf->f_cookie_check,
5624 ssl->conf->p_cookie,
5625 ssl->cli_id, ssl->cli_id_len,
5626 ssl->in_buf, ssl->in_left,
Angus Grattond8213d02016-05-25 20:56:48 +10005627 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005628
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005629 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
5630
5631 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005632 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005633 int send_ret;
5634 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
5635 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
5636 ssl->out_buf, len );
Brian J Murray1903fb32016-11-06 04:45:15 -08005637 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005638 * If the error is permanent we'll catch it later,
5639 * if it's not, then hopefully it'll work next time. */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005640 send_ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, ssl->out_buf, len );
5641 MBEDTLS_SSL_DEBUG_RET( 2, "mbedtls_ssl_get_send", send_ret );
5642 (void) send_ret;
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005643 return( 0 );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005644 }
5645
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005646 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005647 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005648 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005649 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
5650 {
5651 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
5652 return( ret );
5653 }
5654
5655 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005656 }
5657
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005658 return( ret );
5659}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005660#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005661
Hanno Becker46483f12019-05-03 13:25:54 +01005662static int ssl_check_record_type( uint8_t record_type )
5663{
5664 if( record_type != MBEDTLS_SSL_MSG_HANDSHAKE &&
5665 record_type != MBEDTLS_SSL_MSG_ALERT &&
5666 record_type != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
5667 record_type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
5668 {
5669 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5670 }
5671
5672 return( 0 );
5673}
5674
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005675/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005676 * ContentType type;
5677 * ProtocolVersion version;
5678 * uint16 epoch; // DTLS only
5679 * uint48 sequence_number; // DTLS only
5680 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005681 *
5682 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00005683 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005684 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
5685 *
5686 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00005687 * 1. proceed with the record if this function returns 0
5688 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
5689 * 3. return CLIENT_RECONNECT if this function return that value
5690 * 4. drop the whole datagram if this function returns anything else.
5691 * Point 2 is needed when the peer is resending, and we have already received
5692 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005693 */
Hanno Becker21fc61c2019-07-12 11:10:16 +01005694static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005695 unsigned char *buf,
5696 size_t len,
5697 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00005698{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005699 int major_ver, minor_ver;
Paul Bakker5121ce52009-01-03 21:22:43 +00005700
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005701 size_t const rec_hdr_type_offset = 0;
5702 size_t const rec_hdr_type_len = 1;
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02005703
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005704 size_t const rec_hdr_version_offset = rec_hdr_type_offset +
5705 rec_hdr_type_len;
5706 size_t const rec_hdr_version_len = 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00005707
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005708 size_t const rec_hdr_ctr_len = 8;
5709#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker61817612019-07-25 10:13:02 +01005710 uint32_t rec_epoch;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005711 size_t const rec_hdr_ctr_offset = rec_hdr_version_offset +
5712 rec_hdr_version_len;
5713
Hanno Beckera5a2b082019-05-15 14:03:01 +01005714#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005715 size_t const rec_hdr_cid_offset = rec_hdr_ctr_offset +
5716 rec_hdr_ctr_len;
Hanno Becker61817612019-07-25 10:13:02 +01005717 size_t rec_hdr_cid_len = 0;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005718#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5719#endif /* MBEDTLS_SSL_PROTO_DTLS */
5720
5721 size_t rec_hdr_len_offset; /* To be determined */
5722 size_t const rec_hdr_len_len = 2;
5723
5724 /*
5725 * Check minimum lengths for record header.
5726 */
5727
5728#if defined(MBEDTLS_SSL_PROTO_DTLS)
5729 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5730 {
5731 rec_hdr_len_offset = rec_hdr_ctr_offset + rec_hdr_ctr_len;
5732 }
5733 MBEDTLS_SSL_TRANSPORT_ELSE
5734#endif /* MBEDTLS_SSL_PROTO_DTLS */
5735#if defined(MBEDTLS_SSL_PROTO_TLS)
5736 {
5737 rec_hdr_len_offset = rec_hdr_version_offset + rec_hdr_version_len;
5738 }
5739#endif /* MBEDTLS_SSL_PROTO_DTLS */
5740
5741 if( len < rec_hdr_len_offset + rec_hdr_len_len )
5742 {
5743 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header of length %u",
5744 (unsigned) len,
5745 (unsigned)( rec_hdr_len_len + rec_hdr_len_len ) ) );
5746 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5747 }
5748
5749 /*
5750 * Parse and validate record content type
5751 */
5752
5753 rec->type = buf[ rec_hdr_type_offset ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005754
5755 /* Check record content type */
5756#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5757 rec->cid_len = 0;
5758
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005759 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005760 mbedtls_ssl_conf_get_cid_len( ssl->conf ) != 0 &&
5761 rec->type == MBEDTLS_SSL_MSG_CID )
Hanno Becker8b09b732019-05-08 12:03:28 +01005762 {
5763 /* Shift pointers to account for record header including CID
5764 * struct {
5765 * ContentType special_type = tls12_cid;
5766 * ProtocolVersion version;
5767 * uint16 epoch;
5768 * uint48 sequence_number;
Hanno Becker3b2bf5b2019-05-23 17:03:19 +01005769 * opaque cid[cid_length]; // Additional field compared to
5770 * // default DTLS record format
Hanno Becker8b09b732019-05-08 12:03:28 +01005771 * uint16 length;
5772 * opaque enc_content[DTLSCiphertext.length];
5773 * } DTLSCiphertext;
5774 */
5775
5776 /* So far, we only support static CID lengths
5777 * fixed in the configuration. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005778 rec_hdr_cid_len = mbedtls_ssl_conf_get_cid_len( ssl->conf );
5779 rec_hdr_len_offset += rec_hdr_cid_len;
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005780
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005781 if( len < rec_hdr_len_offset + rec_hdr_len_len )
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005782 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005783 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header including CID, length %u",
5784 (unsigned) len,
5785 (unsigned)( rec_hdr_len_offset + rec_hdr_len_len ) ) );
Hanno Becker29823462019-07-10 14:53:43 +01005786 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005787 }
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005788
Manuel Pégourié-Gonnardf3a15b32019-08-02 10:17:15 +02005789 /* configured CID len is guaranteed at most 255, see
5790 * MBEDTLS_SSL_CID_OUT_LEN_MAX in check_config.h */
5791 rec->cid_len = (uint8_t) rec_hdr_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005792 /* Not using more secure mbedtls_platform_memcpy as cid is public */
5793 memcpy( rec->cid, buf + rec_hdr_cid_offset, rec_hdr_cid_len );
Hanno Becker8b09b732019-05-08 12:03:28 +01005794 }
5795 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01005796#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005797 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005798 if( ssl_check_record_type( rec->type ) )
5799 {
Hanno Becker03e2db62019-07-12 14:40:00 +01005800 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type %u",
5801 (unsigned) rec->type ) );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005802 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5803 }
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005804 }
5805
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005806 /*
5807 * Parse and validate record version
5808 */
5809
Hanno Becker8061c6e2019-07-26 08:07:03 +01005810 rec->ver[0] = buf[ rec_hdr_version_offset + 0 ];
5811 rec->ver[1] = buf[ rec_hdr_version_offset + 1 ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005812 mbedtls_ssl_read_version( &major_ver, &minor_ver,
5813 ssl->conf->transport,
Hanno Becker8061c6e2019-07-26 08:07:03 +01005814 &rec->ver[0] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005815
Hanno Becker2881d802019-05-22 14:44:53 +01005816 if( major_ver != mbedtls_ssl_get_major_ver( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005817 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005818 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
5819 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005820 }
5821
Hanno Becker7bcf2b52019-07-26 09:02:40 +01005822 if( mbedtls_ssl_ver_gt( minor_ver,
5823 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ) ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005824 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005825 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
5826 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005827 }
5828
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005829 /*
5830 * Parse/Copy record sequence number.
5831 */
Hanno Becker8b09b732019-05-08 12:03:28 +01005832
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005833#if defined(MBEDTLS_SSL_PROTO_DTLS)
5834 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5835 {
5836 /* Copy explicit record sequence number from input buffer. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005837 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5838 memcpy( &rec->ctr[0], buf + rec_hdr_ctr_offset,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005839 rec_hdr_ctr_len );
5840 }
5841 MBEDTLS_SSL_TRANSPORT_ELSE
5842#endif /* MBEDTLS_SSL_PROTO_DTLS */
5843#if defined(MBEDTLS_SSL_PROTO_TLS)
5844 {
5845 /* Copy implicit record sequence number from SSL context structure. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005846 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5847 memcpy( &rec->ctr[0], ssl->in_ctr, rec_hdr_ctr_len );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005848 }
5849#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker8b09b732019-05-08 12:03:28 +01005850
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005851 /*
5852 * Parse record length.
5853 */
5854
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005855 rec->data_offset = rec_hdr_len_offset + rec_hdr_len_len;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005856 rec->data_len = mbedtls_platform_get_uint16_be( &buf[rec_hdr_len_offset] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005857 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", buf, rec->data_offset );
5858
Hanno Becker8b09b732019-05-08 12:03:28 +01005859 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
Hanno Beckerd8f7c4a2019-05-23 17:03:44 +01005860 "version = [%d:%d], msglen = %d",
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005861 rec->type,
5862 major_ver, minor_ver, rec->data_len ) );
5863
5864 rec->buf = buf;
5865 rec->buf_len = rec->data_offset + rec->data_len;
Hanno Becker8b09b732019-05-08 12:03:28 +01005866
Hanno Beckerec014082019-07-26 08:20:27 +01005867 if( rec->data_len == 0 )
5868 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5869
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005870 /*
Hanno Becker52c6dc62017-05-26 16:07:36 +01005871 * DTLS-related tests.
5872 * Check epoch before checking length constraint because
5873 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
5874 * message gets duplicated before the corresponding Finished message,
5875 * the second ChangeCipherSpec should be discarded because it belongs
5876 * to an old epoch, but not because its length is shorter than
5877 * the minimum record length for packets using the new record transform.
5878 * Note that these two kinds of failures are handled differently,
5879 * as an unexpected record is silently skipped but an invalid
5880 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005881 */
5882#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005883 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005884 {
Arto Kinnunena3fa06e2019-09-09 12:22:51 +03005885 rec_epoch = (uint32_t)mbedtls_platform_get_uint16_be( rec->ctr );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005886
Hanno Beckere0452772019-07-10 17:12:07 +01005887 /* Check that the datagram is large enough to contain a record
5888 * of the advertised length. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005889 if( len < rec->data_offset + rec->data_len )
Hanno Beckere0452772019-07-10 17:12:07 +01005890 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005891 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Datagram of length %u too small to contain record of advertised length %u.",
5892 (unsigned) len,
5893 (unsigned)( rec->data_offset + rec->data_len ) ) );
Hanno Beckere0452772019-07-10 17:12:07 +01005894 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5895 }
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005896
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005897 /* Records from other, non-matching epochs are silently discarded.
5898 * (The case of same-port Client reconnects must be considered in
5899 * the caller). */
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005900 if( rec_epoch != ssl->in_epoch )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005901 {
5902 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
5903 "expected %d, received %d",
5904 ssl->in_epoch, rec_epoch ) );
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005905
5906 /* Records from the next epoch are considered for buffering
5907 * (concretely: early Finished messages). */
5908 if( rec_epoch == (unsigned) ssl->in_epoch + 1 )
5909 {
5910 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
5911 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5912 }
5913
Hanno Becker87b56262019-07-10 14:37:41 +01005914 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005915 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005916#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005917 /* For records from the correct epoch, check whether their
5918 * sequence number has been seen before. */
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005919 else if( mbedtls_ssl_dtls_record_replay_check( (mbedtls_ssl_context *) ssl,
5920 &rec->ctr[0] ) != 0 )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005921 {
5922 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
5923 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
5924 }
5925#endif
5926 }
5927#endif /* MBEDTLS_SSL_PROTO_DTLS */
5928
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005929 return( 0 );
5930}
Paul Bakker5121ce52009-01-03 21:22:43 +00005931
Hanno Becker87b56262019-07-10 14:37:41 +01005932
5933#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
5934static int ssl_check_client_reconnect( mbedtls_ssl_context *ssl )
5935{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005936 unsigned int rec_epoch = (unsigned int)
5937 mbedtls_platform_get_uint16_be( &ssl->in_ctr[0] );
Hanno Becker87b56262019-07-10 14:37:41 +01005938
5939 /*
5940 * Check for an epoch 0 ClientHello. We can't use in_msg here to
5941 * access the first byte of record content (handshake type), as we
5942 * have an active transform (possibly iv_len != 0), so use the
5943 * fact that the record header len is 13 instead.
5944 */
5945 if( rec_epoch == 0 &&
5946 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
5947 MBEDTLS_SSL_IS_SERVER &&
5948 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5949 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
5950 ssl->in_left > 13 &&
5951 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
5952 {
5953 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
5954 "from the same port" ) );
5955 return( ssl_handle_possible_reconnect( ssl ) );
5956 }
5957
5958 return( 0 );
5959}
5960#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
5961
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005962/*
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01005963 * If applicable, decrypt record content
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005964 */
Hanno Beckera89610a2019-07-11 13:07:45 +01005965static int ssl_prepare_record_content( mbedtls_ssl_context *ssl,
5966 mbedtls_record *rec )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005967{
5968 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02005969
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005970 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
Hanno Beckera89610a2019-07-11 13:07:45 +01005971 rec->buf, rec->buf_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00005972
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005973#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
5974 if( mbedtls_ssl_hw_record_read != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00005975 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005976 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00005977
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005978 ret = mbedtls_ssl_hw_record_read( ssl );
5979 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00005980 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005981 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
5982 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00005983 }
Paul Bakkerc7878112012-12-19 14:41:14 +01005984
5985 if( ret == 0 )
5986 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00005987 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005988#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker48916f92012-09-16 19:57:18 +00005989 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005990 {
Hanno Becker106f3da2019-07-12 09:35:58 +01005991 unsigned char const old_msg_type = rec->type;
5992
Hanno Becker611a83b2018-01-03 14:27:32 +00005993 if( ( ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in,
Hanno Beckera89610a2019-07-11 13:07:45 +01005994 rec ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005995 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005996 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005997
Hanno Beckera5a2b082019-05-15 14:03:01 +01005998#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005999 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID &&
Hanno Beckere0200da2019-06-13 09:23:43 +01006000 mbedtls_ssl_conf_get_ignore_unexpected_cid( ssl->conf )
6001 == MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
Hanno Beckere8eff9a2019-05-14 11:30:10 +01006002 {
Hanno Becker675c4d62019-05-24 10:11:06 +01006003 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ignoring unexpected CID" ) );
Hanno Becker687e0fb2019-05-08 13:02:55 +01006004 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
Hanno Beckere8eff9a2019-05-14 11:30:10 +01006005 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01006006#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker687e0fb2019-05-08 13:02:55 +01006007
Paul Bakker5121ce52009-01-03 21:22:43 +00006008 return( ret );
6009 }
6010
Hanno Becker106f3da2019-07-12 09:35:58 +01006011 if( old_msg_type != rec->type )
Hanno Becker93012fe2018-08-07 14:30:18 +01006012 {
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006013 MBEDTLS_SSL_DEBUG_MSG( 4, ( "record type after decrypt (before %d): %d",
Hanno Becker106f3da2019-07-12 09:35:58 +01006014 old_msg_type, rec->type ) );
Hanno Becker93012fe2018-08-07 14:30:18 +01006015 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006016
Paul Bakker5121ce52009-01-03 21:22:43 +00006017 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Hanno Becker106f3da2019-07-12 09:35:58 +01006018 rec->buf + rec->data_offset, rec->data_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00006019
Hanno Beckera5a2b082019-05-15 14:03:01 +01006020#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006021 /* We have already checked the record content type
6022 * in ssl_parse_record_header(), failing or silently
6023 * dropping the record in the case of an unknown type.
6024 *
6025 * Since with the use of CIDs, the record content type
6026 * might change during decryption, re-check the record
6027 * content type, but treat a failure as fatal this time. */
Hanno Becker106f3da2019-07-12 09:35:58 +01006028 if( ssl_check_record_type( rec->type ) )
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006029 {
6030 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
6031 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6032 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01006033#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006034
Hanno Becker106f3da2019-07-12 09:35:58 +01006035 if( rec->data_len == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006036 {
6037#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker2881d802019-05-22 14:44:53 +01006038 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_3
Hanno Becker106f3da2019-07-12 09:35:58 +01006039 && rec->type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006040 {
6041 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
6042 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
6043 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6044 }
6045#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6046
6047 ssl->nb_zero++;
6048
6049 /*
6050 * Three or more empty messages may be a DoS attack
6051 * (excessive CPU consumption).
6052 */
6053 if( ssl->nb_zero > 3 )
6054 {
6055 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Hanno Becker70463db2019-05-08 10:38:32 +01006056 "messages, possible DoS attack" ) );
6057 /* Treat the records as if they were not properly authenticated,
6058 * thereby failing the connection if we see more than allowed
6059 * by the configured bad MAC threshold. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00006060 return( MBEDTLS_ERR_SSL_INVALID_MAC );
6061 }
6062 }
6063 else
6064 ssl->nb_zero = 0;
6065
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006066 /* Only needed for TLS, as with DTLS in_ctr is read from the header */
6067#if defined(MBEDTLS_SSL_PROTO_TLS)
6068 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006069 {
6070 unsigned i;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006071 for( i = 8; i > 0; i-- )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006072 if( ++ssl->in_ctr[i - 1] != 0 )
6073 break;
6074
Manuel Pégourié-Gonnard8794a422019-06-11 10:04:57 +02006075 /* The loop goes to its end only if the counter is wrapping around */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006076 if( i == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006077 {
6078 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
6079 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
6080 }
6081 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006082#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker4c6876b2017-12-27 21:28:58 +00006083
Paul Bakker5121ce52009-01-03 21:22:43 +00006084 }
6085
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006086#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006087 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02006088 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006089 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02006090 }
6091#endif
6092
Hanno Beckerf0242852019-07-09 17:30:02 +01006093 /* Check actual (decrypted) record content length against
6094 * configured maximum. */
6095 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
6096 {
6097 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
6098 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6099 }
6100
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006101 return( 0 );
6102}
6103
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006104static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006105
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006106/*
6107 * Read a record.
6108 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02006109 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
6110 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
6111 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006112 */
Hanno Becker1097b342018-08-15 14:09:41 +01006113
6114/* Helper functions for mbedtls_ssl_read_record(). */
6115static int ssl_consume_current_message( mbedtls_ssl_context *ssl );
Hanno Beckere74d5562018-08-15 14:26:08 +01006116static int ssl_get_next_record( mbedtls_ssl_context *ssl );
6117static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl );
Hanno Becker4162b112018-08-15 14:05:04 +01006118
Hanno Becker327c93b2018-08-15 13:56:18 +01006119int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
Hanno Becker3a0aad12018-08-20 09:44:02 +01006120 unsigned update_hs_digest )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006121{
6122 int ret;
6123
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006124 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006125
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006126 if( ssl->keep_current_message == 0 )
6127 {
6128 do {
Simon Butcher99000142016-10-13 17:21:01 +01006129
Hanno Becker26994592018-08-15 14:14:59 +01006130 ret = ssl_consume_current_message( ssl );
Hanno Becker90333da2017-10-10 11:27:13 +01006131 if( ret != 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006132 return( ret );
Hanno Becker26994592018-08-15 14:14:59 +01006133
Hanno Beckere74d5562018-08-15 14:26:08 +01006134 if( ssl_record_is_in_progress( ssl ) == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006135 {
Hanno Becker40f50842018-08-15 14:48:01 +01006136#if defined(MBEDTLS_SSL_PROTO_DTLS)
6137 int have_buffered = 0;
Hanno Beckere74d5562018-08-15 14:26:08 +01006138
Hanno Becker40f50842018-08-15 14:48:01 +01006139 /* We only check for buffered messages if the
6140 * current datagram is fully consumed. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006141 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006142 ssl_next_record_is_in_datagram( ssl ) == 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006143 {
Hanno Becker40f50842018-08-15 14:48:01 +01006144 if( ssl_load_buffered_message( ssl ) == 0 )
6145 have_buffered = 1;
6146 }
6147
6148 if( have_buffered == 0 )
6149#endif /* MBEDTLS_SSL_PROTO_DTLS */
6150 {
6151 ret = ssl_get_next_record( ssl );
6152 if( ret == MBEDTLS_ERR_SSL_CONTINUE_PROCESSING )
6153 continue;
6154
6155 if( ret != 0 )
6156 {
Hanno Beckerc573ac32018-08-28 17:15:25 +01006157 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
Hanno Becker42a6b042019-07-26 07:25:20 +01006158 ssl_send_pending_fatal_alert( ssl );
Hanno Becker40f50842018-08-15 14:48:01 +01006159 return( ret );
6160 }
Hanno Beckere74d5562018-08-15 14:26:08 +01006161 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006162 }
6163
6164 ret = mbedtls_ssl_handle_message_type( ssl );
6165
Hanno Becker40f50842018-08-15 14:48:01 +01006166#if defined(MBEDTLS_SSL_PROTO_DTLS)
6167 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6168 {
6169 /* Buffer future message */
6170 ret = ssl_buffer_message( ssl );
6171 if( ret != 0 )
6172 return( ret );
6173
6174 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
6175 }
6176#endif /* MBEDTLS_SSL_PROTO_DTLS */
6177
Hanno Becker90333da2017-10-10 11:27:13 +01006178 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret ||
6179 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING == ret );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006180
6181 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01006182 {
Hanno Becker05c4fc82017-11-09 14:34:06 +00006183 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
Simon Butcher99000142016-10-13 17:21:01 +01006184 return( ret );
6185 }
6186
Hanno Becker327c93b2018-08-15 13:56:18 +01006187 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
Hanno Becker3a0aad12018-08-20 09:44:02 +01006188 update_hs_digest == 1 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006189 {
6190 mbedtls_ssl_update_handshake_status( ssl );
6191 }
Simon Butcher99000142016-10-13 17:21:01 +01006192 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006193 else
Simon Butcher99000142016-10-13 17:21:01 +01006194 {
Hanno Becker02f59072018-08-15 14:00:24 +01006195 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006196 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01006197 }
6198
6199 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
6200
6201 return( 0 );
6202}
6203
Hanno Becker40f50842018-08-15 14:48:01 +01006204#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006205static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
Simon Butcher99000142016-10-13 17:21:01 +01006206{
Hanno Becker40f50842018-08-15 14:48:01 +01006207 if( ssl->in_left > ssl->next_record_offset )
6208 return( 1 );
Simon Butcher99000142016-10-13 17:21:01 +01006209
Hanno Becker40f50842018-08-15 14:48:01 +01006210 return( 0 );
6211}
6212
6213static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
6214{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006215 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker37f95322018-08-16 13:55:32 +01006216 mbedtls_ssl_hs_buffer * hs_buf;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006217 int ret = 0;
6218
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006219 if( hs == NULL )
6220 return( -1 );
6221
Hanno Beckere00ae372018-08-20 09:39:42 +01006222 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
6223
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006224 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC ||
6225 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
6226 {
6227 /* Check if we have seen a ChangeCipherSpec before.
6228 * If yes, synthesize a CCS record. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006229 if( !hs->buffering.seen_ccs )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006230 {
6231 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
6232 ret = -1;
Hanno Becker0d4b3762018-08-20 09:36:59 +01006233 goto exit;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006234 }
6235
Hanno Becker39b8bc92018-08-28 17:17:13 +01006236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006237 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
6238 ssl->in_msglen = 1;
6239 ssl->in_msg[0] = 1;
6240
6241 /* As long as they are equal, the exact value doesn't matter. */
6242 ssl->in_left = 0;
6243 ssl->next_record_offset = 0;
6244
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006245 hs->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006246 goto exit;
6247 }
Hanno Becker37f95322018-08-16 13:55:32 +01006248
Hanno Beckerb8f50142018-08-28 10:01:34 +01006249#if defined(MBEDTLS_DEBUG_C)
Hanno Becker37f95322018-08-16 13:55:32 +01006250 /* Debug only */
6251 {
6252 unsigned offset;
6253 for( offset = 1; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
6254 {
6255 hs_buf = &hs->buffering.hs[offset];
6256 if( hs_buf->is_valid == 1 )
6257 {
6258 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
6259 hs->in_msg_seq + offset,
Hanno Beckera591c482018-08-28 17:20:00 +01006260 hs_buf->is_complete ? "fully" : "partially" ) );
Hanno Becker37f95322018-08-16 13:55:32 +01006261 }
6262 }
6263 }
Hanno Beckerb8f50142018-08-28 10:01:34 +01006264#endif /* MBEDTLS_DEBUG_C */
Hanno Becker37f95322018-08-16 13:55:32 +01006265
6266 /* Check if we have buffered and/or fully reassembled the
6267 * next handshake message. */
6268 hs_buf = &hs->buffering.hs[0];
6269 if( ( hs_buf->is_valid == 1 ) && ( hs_buf->is_complete == 1 ) )
6270 {
6271 /* Synthesize a record containing the buffered HS message. */
Arto Kinnunen84eeb4f2019-09-10 10:32:30 +03006272 size_t msg_len = mbedtls_platform_get_uint24_be( &hs_buf->data[1] );
Hanno Becker37f95322018-08-16 13:55:32 +01006273
6274 /* Double-check that we haven't accidentally buffered
6275 * a message that doesn't fit into the input buffer. */
6276 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
6277 {
6278 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6279 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6280 }
6281
6282 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
6283 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
6284 hs_buf->data, msg_len + 12 );
6285
6286 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6287 ssl->in_hslen = msg_len + 12;
6288 ssl->in_msglen = msg_len + 12;
Teppo Järvelin91d79382019-10-02 09:09:31 +03006289 mbedtls_platform_memcpy( ssl->in_msg, hs_buf->data, ssl->in_hslen );
Hanno Becker37f95322018-08-16 13:55:32 +01006290
6291 ret = 0;
6292 goto exit;
6293 }
6294 else
6295 {
6296 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
6297 hs->in_msg_seq ) );
6298 }
6299
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006300 ret = -1;
6301
6302exit:
6303
6304 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
6305 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006306}
6307
Hanno Beckera02b0b42018-08-21 17:20:27 +01006308static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
6309 size_t desired )
6310{
6311 int offset;
6312 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
6314 (unsigned) desired ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006315
Hanno Becker01315ea2018-08-21 17:22:17 +01006316 /* Get rid of future records epoch first, if such exist. */
6317 ssl_free_buffered_record( ssl );
6318
6319 /* Check if we have enough space available now. */
6320 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6321 hs->buffering.total_bytes_buffered ) )
6322 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006323 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
Hanno Becker01315ea2018-08-21 17:22:17 +01006324 return( 0 );
6325 }
Hanno Beckera02b0b42018-08-21 17:20:27 +01006326
Hanno Becker4f432ad2018-08-28 10:02:32 +01006327 /* We don't have enough space to buffer the next expected handshake
6328 * message. Remove buffers used for future messages to gain space,
6329 * starting with the most distant one. */
Hanno Beckera02b0b42018-08-21 17:20:27 +01006330 for( offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1;
6331 offset >= 0; offset-- )
6332 {
6333 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
6334 offset ) );
6335
Hanno Beckerb309b922018-08-23 13:18:05 +01006336 ssl_buffering_free_slot( ssl, (uint8_t) offset );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006337
6338 /* Check if we have enough space available now. */
6339 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6340 hs->buffering.total_bytes_buffered ) )
6341 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006342 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006343 return( 0 );
6344 }
6345 }
6346
6347 return( -1 );
6348}
6349
Hanno Becker40f50842018-08-15 14:48:01 +01006350static int ssl_buffer_message( mbedtls_ssl_context *ssl )
6351{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006352 int ret = 0;
6353 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6354
6355 if( hs == NULL )
6356 return( 0 );
6357
6358 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
6359
6360 switch( ssl->in_msgtype )
6361 {
6362 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC:
6363 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
Hanno Beckere678eaa2018-08-21 14:57:46 +01006364
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006365 hs->buffering.seen_ccs = 1;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006366 break;
6367
6368 case MBEDTLS_SSL_MSG_HANDSHAKE:
Hanno Becker37f95322018-08-16 13:55:32 +01006369 {
6370 unsigned recv_msg_seq_offset;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03006371 unsigned recv_msg_seq = (unsigned)
6372 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03006373
Hanno Becker37f95322018-08-16 13:55:32 +01006374 mbedtls_ssl_hs_buffer *hs_buf;
6375 size_t msg_len = ssl->in_hslen - 12;
6376
6377 /* We should never receive an old handshake
6378 * message - double-check nonetheless. */
6379 if( recv_msg_seq < ssl->handshake->in_msg_seq )
6380 {
6381 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6382 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6383 }
6384
6385 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
6386 if( recv_msg_seq_offset >= MBEDTLS_SSL_MAX_BUFFERED_HS )
6387 {
6388 /* Silently ignore -- message too far in the future */
6389 MBEDTLS_SSL_DEBUG_MSG( 2,
6390 ( "Ignore future HS message with sequence number %u, "
6391 "buffering window %u - %u",
6392 recv_msg_seq, ssl->handshake->in_msg_seq,
6393 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - 1 ) );
6394
6395 goto exit;
6396 }
6397
6398 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
6399 recv_msg_seq, recv_msg_seq_offset ) );
6400
6401 hs_buf = &hs->buffering.hs[ recv_msg_seq_offset ];
6402
6403 /* Check if the buffering for this seq nr has already commenced. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006404 if( !hs_buf->is_valid )
Hanno Becker37f95322018-08-16 13:55:32 +01006405 {
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006406 size_t reassembly_buf_sz;
6407
Hanno Becker37f95322018-08-16 13:55:32 +01006408 hs_buf->is_fragmented =
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04006409 ( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT );
Hanno Becker37f95322018-08-16 13:55:32 +01006410
6411 /* We copy the message back into the input buffer
6412 * after reassembly, so check that it's not too large.
6413 * This is an implementation-specific limitation
6414 * and not one from the standard, hence it is not
6415 * checked in ssl_check_hs_header(). */
Hanno Becker96a6c692018-08-21 15:56:03 +01006416 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker37f95322018-08-16 13:55:32 +01006417 {
6418 /* Ignore message */
6419 goto exit;
6420 }
6421
Hanno Beckere0b150f2018-08-21 15:51:03 +01006422 /* Check if we have enough space to buffer the message. */
6423 if( hs->buffering.total_bytes_buffered >
6424 MBEDTLS_SSL_DTLS_MAX_BUFFERING )
6425 {
6426 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6427 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6428 }
6429
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006430 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
6431 hs_buf->is_fragmented );
Hanno Beckere0b150f2018-08-21 15:51:03 +01006432
6433 if( reassembly_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6434 hs->buffering.total_bytes_buffered ) )
6435 {
6436 if( recv_msg_seq_offset > 0 )
6437 {
6438 /* If we can't buffer a future message because
6439 * of space limitations -- ignore. */
6440 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
6441 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6442 (unsigned) hs->buffering.total_bytes_buffered ) );
6443 goto exit;
6444 }
Hanno Beckere1801392018-08-21 16:51:05 +01006445 else
6446 {
6447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- attempt to make space by freeing buffered future messages\n",
6448 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6449 (unsigned) hs->buffering.total_bytes_buffered ) );
6450 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006451
Hanno Beckera02b0b42018-08-21 17:20:27 +01006452 if( ssl_buffer_make_space( ssl, reassembly_buf_sz ) != 0 )
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006453 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006454 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %u (%u with bitmap) would exceed the compile-time limit %u (already %u bytes buffered) -- fail\n",
6455 (unsigned) msg_len,
6456 (unsigned) reassembly_buf_sz,
6457 MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Beckere0b150f2018-08-21 15:51:03 +01006458 (unsigned) hs->buffering.total_bytes_buffered ) );
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006459 ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
6460 goto exit;
6461 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006462 }
6463
6464 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
6465 msg_len ) );
6466
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006467 hs_buf->data = mbedtls_calloc( 1, reassembly_buf_sz );
6468 if( hs_buf->data == NULL )
Hanno Becker37f95322018-08-16 13:55:32 +01006469 {
Hanno Beckere0b150f2018-08-21 15:51:03 +01006470 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
Hanno Becker37f95322018-08-16 13:55:32 +01006471 goto exit;
6472 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006473 hs_buf->data_len = reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006474
6475 /* Prepare final header: copy msg_type, length and message_seq,
6476 * then add standardised fragment_offset and fragment_length */
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02006477 if( mbedtls_platform_memcpy( hs_buf->data, ssl->in_msg, 6 ) !=
6478 hs_buf->data )
6479 {
6480 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6481 goto exit;
6482 }
6483 if( mbedtls_platform_memset( hs_buf->data + 6, 0, 3 ) !=
6484 hs_buf->data + 6 )
6485 {
6486 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6487 goto exit;
6488 }
6489 if( mbedtls_platform_memcpy( hs_buf->data + 9, hs_buf->data + 1, 3 ) !=
6490 hs_buf->data + 9 )
6491 {
6492 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6493 goto exit;
6494 }
Hanno Becker37f95322018-08-16 13:55:32 +01006495
6496 hs_buf->is_valid = 1;
Hanno Beckere0b150f2018-08-21 15:51:03 +01006497
6498 hs->buffering.total_bytes_buffered += reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006499 }
6500 else
6501 {
6502 /* Make sure msg_type and length are consistent */
Teppo Järvelin0efac532019-10-04 13:21:08 +03006503 if( memcmp( hs_buf->data, ssl->in_msg, 4 ) != 0 ) // use regular memcmp as msg type is public
Hanno Becker37f95322018-08-16 13:55:32 +01006504 {
6505 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
6506 /* Ignore */
6507 goto exit;
6508 }
6509 }
6510
Hanno Becker4422bbb2018-08-20 09:40:19 +01006511 if( !hs_buf->is_complete )
Hanno Becker37f95322018-08-16 13:55:32 +01006512 {
6513 size_t frag_len, frag_off;
6514 unsigned char * const msg = hs_buf->data + 12;
6515
6516 /*
6517 * Check and copy current fragment
6518 */
6519
6520 /* Validation of header fields already done in
6521 * mbedtls_ssl_prepare_handshake_record(). */
6522 frag_off = ssl_get_hs_frag_off( ssl );
6523 frag_len = ssl_get_hs_frag_len( ssl );
6524
6525 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
6526 frag_off, frag_len ) );
Teppo Järvelin91d79382019-10-02 09:09:31 +03006527 mbedtls_platform_memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
Hanno Becker37f95322018-08-16 13:55:32 +01006528
6529 if( hs_buf->is_fragmented )
6530 {
6531 unsigned char * const bitmask = msg + msg_len;
6532 ssl_bitmask_set( bitmask, frag_off, frag_len );
6533 hs_buf->is_complete = ( ssl_bitmask_check( bitmask,
6534 msg_len ) == 0 );
6535 }
6536 else
6537 {
6538 hs_buf->is_complete = 1;
6539 }
6540
6541 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
6542 hs_buf->is_complete ? "" : "not yet " ) );
6543 }
6544
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006545 break;
Hanno Becker37f95322018-08-16 13:55:32 +01006546 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006547
6548 default:
Hanno Becker360bef32018-08-28 10:04:33 +01006549 /* We don't buffer other types of messages. */
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006550 break;
6551 }
6552
6553exit:
6554
6555 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
6556 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006557}
6558#endif /* MBEDTLS_SSL_PROTO_DTLS */
6559
Hanno Becker1097b342018-08-15 14:09:41 +01006560static int ssl_consume_current_message( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006561{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006562 /*
Hanno Becker4a810fb2017-05-24 16:27:30 +01006563 * Consume last content-layer message and potentially
6564 * update in_msglen which keeps track of the contents'
6565 * consumption state.
6566 *
6567 * (1) Handshake messages:
6568 * Remove last handshake message, move content
6569 * and adapt in_msglen.
6570 *
6571 * (2) Alert messages:
6572 * Consume whole record content, in_msglen = 0.
6573 *
Hanno Becker4a810fb2017-05-24 16:27:30 +01006574 * (3) Change cipher spec:
6575 * Consume whole record content, in_msglen = 0.
6576 *
6577 * (4) Application data:
6578 * Don't do anything - the record layer provides
6579 * the application data as a stream transport
6580 * and consumes through mbedtls_ssl_read only.
6581 *
6582 */
6583
6584 /* Case (1): Handshake messages */
6585 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006586 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006587 /* Hard assertion to be sure that no application data
6588 * is in flight, as corrupting ssl->in_msglen during
6589 * ssl->in_offt != NULL is fatal. */
6590 if( ssl->in_offt != NULL )
6591 {
6592 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6593 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6594 }
6595
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006596 /*
6597 * Get next Handshake message in the current record
6598 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006599
Hanno Becker4a810fb2017-05-24 16:27:30 +01006600 /* Notes:
Hanno Beckere72489d2017-10-23 13:23:50 +01006601 * (1) in_hslen is not necessarily the size of the
Hanno Becker4a810fb2017-05-24 16:27:30 +01006602 * current handshake content: If DTLS handshake
6603 * fragmentation is used, that's the fragment
6604 * size instead. Using the total handshake message
Hanno Beckere72489d2017-10-23 13:23:50 +01006605 * size here is faulty and should be changed at
6606 * some point.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006607 * (2) While it doesn't seem to cause problems, one
6608 * has to be very careful not to assume that in_hslen
6609 * is always <= in_msglen in a sensible communication.
6610 * Again, it's wrong for DTLS handshake fragmentation.
6611 * The following check is therefore mandatory, and
6612 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006613 * Additionally, ssl->in_hslen might be arbitrarily out of
6614 * bounds after handling a DTLS message with an unexpected
6615 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006616 */
6617 if( ssl->in_hslen < ssl->in_msglen )
6618 {
6619 ssl->in_msglen -= ssl->in_hslen;
6620 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
6621 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006622
Hanno Becker4a810fb2017-05-24 16:27:30 +01006623 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
6624 ssl->in_msg, ssl->in_msglen );
6625 }
6626 else
6627 {
6628 ssl->in_msglen = 0;
6629 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02006630
Hanno Becker4a810fb2017-05-24 16:27:30 +01006631 ssl->in_hslen = 0;
6632 }
6633 /* Case (4): Application data */
6634 else if( ssl->in_offt != NULL )
6635 {
6636 return( 0 );
6637 }
6638 /* Everything else (CCS & Alerts) */
6639 else
6640 {
6641 ssl->in_msglen = 0;
6642 }
6643
Hanno Becker1097b342018-08-15 14:09:41 +01006644 return( 0 );
6645}
Hanno Becker4a810fb2017-05-24 16:27:30 +01006646
Hanno Beckere74d5562018-08-15 14:26:08 +01006647static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
6648{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006649 if( ssl->in_msglen > 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006650 return( 1 );
6651
6652 return( 0 );
6653}
6654
Hanno Becker5f066e72018-08-16 14:56:31 +01006655#if defined(MBEDTLS_SSL_PROTO_DTLS)
6656
6657static void ssl_free_buffered_record( mbedtls_ssl_context *ssl )
6658{
6659 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6660 if( hs == NULL )
6661 return;
6662
Hanno Becker01315ea2018-08-21 17:22:17 +01006663 if( hs->buffering.future_record.data != NULL )
Hanno Becker4a810fb2017-05-24 16:27:30 +01006664 {
Hanno Becker01315ea2018-08-21 17:22:17 +01006665 hs->buffering.total_bytes_buffered -=
6666 hs->buffering.future_record.len;
6667
6668 mbedtls_free( hs->buffering.future_record.data );
6669 hs->buffering.future_record.data = NULL;
6670 }
Hanno Becker5f066e72018-08-16 14:56:31 +01006671}
6672
6673static int ssl_load_buffered_record( mbedtls_ssl_context *ssl )
6674{
6675 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6676 unsigned char * rec;
6677 size_t rec_len;
6678 unsigned rec_epoch;
Andrzej Kurekf3844952020-10-16 23:03:01 +02006679#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6680 size_t in_buf_len = ssl->in_buf_len;
6681#else
6682 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6683#endif
Hanno Becker5f066e72018-08-16 14:56:31 +01006684
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006685 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006686 return( 0 );
6687
6688 if( hs == NULL )
6689 return( 0 );
6690
Hanno Becker5f066e72018-08-16 14:56:31 +01006691 rec = hs->buffering.future_record.data;
6692 rec_len = hs->buffering.future_record.len;
6693 rec_epoch = hs->buffering.future_record.epoch;
6694
6695 if( rec == NULL )
6696 return( 0 );
6697
Hanno Becker4cb782d2018-08-20 11:19:05 +01006698 /* Only consider loading future records if the
6699 * input buffer is empty. */
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006700 if( ssl_next_record_is_in_datagram( ssl ) == 1 )
Hanno Becker4cb782d2018-08-20 11:19:05 +01006701 return( 0 );
6702
Hanno Becker5f066e72018-08-16 14:56:31 +01006703 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
6704
6705 if( rec_epoch != ssl->in_epoch )
6706 {
6707 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
6708 goto exit;
6709 }
6710
6711 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
6712
6713 /* Double-check that the record is not too large */
Andrzej Kurekf3844952020-10-16 23:03:01 +02006714 if( rec_len > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006715 {
6716 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6717 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6718 }
6719
Teppo Järvelin91d79382019-10-02 09:09:31 +03006720 mbedtls_platform_memcpy( ssl->in_hdr, rec, rec_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006721 ssl->in_left = rec_len;
6722 ssl->next_record_offset = 0;
6723
6724 ssl_free_buffered_record( ssl );
6725
6726exit:
6727 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
6728 return( 0 );
6729}
6730
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006731static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
6732 mbedtls_record const *rec )
Hanno Becker5f066e72018-08-16 14:56:31 +01006733{
6734 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker5f066e72018-08-16 14:56:31 +01006735
6736 /* Don't buffer future records outside handshakes. */
6737 if( hs == NULL )
6738 return( 0 );
6739
6740 /* Only buffer handshake records (we are only interested
6741 * in Finished messages). */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006742 if( rec->type != MBEDTLS_SSL_MSG_HANDSHAKE )
Hanno Becker5f066e72018-08-16 14:56:31 +01006743 return( 0 );
6744
6745 /* Don't buffer more than one future epoch record. */
6746 if( hs->buffering.future_record.data != NULL )
6747 return( 0 );
6748
Hanno Becker01315ea2018-08-21 17:22:17 +01006749 /* Don't buffer record if there's not enough buffering space remaining. */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006750 if( rec->buf_len > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
Hanno Becker01315ea2018-08-21 17:22:17 +01006751 hs->buffering.total_bytes_buffered ) )
6752 {
6753 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006754 (unsigned) rec->buf_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Becker01315ea2018-08-21 17:22:17 +01006755 (unsigned) hs->buffering.total_bytes_buffered ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006756 return( 0 );
6757 }
6758
Hanno Becker5f066e72018-08-16 14:56:31 +01006759 /* Buffer record */
6760 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
6761 ssl->in_epoch + 1 ) );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006762 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006763
6764 /* ssl_parse_record_header() only considers records
6765 * of the next epoch as candidates for buffering. */
6766 hs->buffering.future_record.epoch = ssl->in_epoch + 1;
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006767 hs->buffering.future_record.len = rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006768
6769 hs->buffering.future_record.data =
6770 mbedtls_calloc( 1, hs->buffering.future_record.len );
6771 if( hs->buffering.future_record.data == NULL )
6772 {
6773 /* If we run out of RAM trying to buffer a
6774 * record from the next epoch, just ignore. */
6775 return( 0 );
6776 }
6777
Teppo Järvelin91d79382019-10-02 09:09:31 +03006778 mbedtls_platform_memcpy( hs->buffering.future_record.data, rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006779
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006780 hs->buffering.total_bytes_buffered += rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006781 return( 0 );
6782}
6783
6784#endif /* MBEDTLS_SSL_PROTO_DTLS */
6785
Hanno Beckere74d5562018-08-15 14:26:08 +01006786static int ssl_get_next_record( mbedtls_ssl_context *ssl )
Hanno Becker1097b342018-08-15 14:09:41 +01006787{
6788 int ret;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006789 mbedtls_record rec;
Hanno Becker1097b342018-08-15 14:09:41 +01006790
Hanno Becker5f066e72018-08-16 14:56:31 +01006791#if defined(MBEDTLS_SSL_PROTO_DTLS)
6792 /* We might have buffered a future record; if so,
6793 * and if the epoch matches now, load it.
6794 * On success, this call will set ssl->in_left to
6795 * the length of the buffered record, so that
6796 * the calls to ssl_fetch_input() below will
6797 * essentially be no-ops. */
6798 ret = ssl_load_buffered_record( ssl );
6799 if( ret != 0 )
6800 return( ret );
6801#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker4a810fb2017-05-24 16:27:30 +01006802
Hanno Becker8b09b732019-05-08 12:03:28 +01006803 /* Ensure that we have enough space available for the default form
6804 * of TLS / DTLS record headers (5 Bytes for TLS, 13 Bytes for DTLS,
6805 * with no space for CIDs counted in). */
6806 ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_in_hdr_len( ssl ) );
6807 if( ret != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006808 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006809 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006810 return( ret );
6811 }
6812
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006813 ret = ssl_parse_record_header( ssl, ssl->in_hdr, ssl->in_left, &rec );
6814 if( ret != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006815 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006816#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker87b56262019-07-10 14:37:41 +01006817 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006818 {
Hanno Becker5f066e72018-08-16 14:56:31 +01006819 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6820 {
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006821 ret = ssl_buffer_future_record( ssl, &rec );
Hanno Becker5f066e72018-08-16 14:56:31 +01006822 if( ret != 0 )
6823 return( ret );
6824
6825 /* Fall through to handling of unexpected records */
6826 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
6827 }
6828
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006829 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
6830 {
Hanno Becker87b56262019-07-10 14:37:41 +01006831#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker68379722019-07-12 09:23:47 +01006832 /* Reset in pointers to default state for TLS/DTLS records,
6833 * assuming no CID and no offset between record content and
6834 * record plaintext. */
6835 ssl_update_in_pointers( ssl );
6836
Hanno Becker69412452019-07-12 08:33:49 +01006837 /* Setup internal message pointers from record structure. */
6838 ssl->in_msgtype = rec.type;
6839#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6840 ssl->in_len = ssl->in_cid + rec.cid_len;
6841#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006842 ssl->in_msg = ssl->in_len + 2;
Hanno Becker69412452019-07-12 08:33:49 +01006843 ssl->in_msglen = rec.data_len;
6844
Hanno Becker87b56262019-07-10 14:37:41 +01006845 ret = ssl_check_client_reconnect( ssl );
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02006846 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_client_reconnect", ret );
Hanno Becker87b56262019-07-10 14:37:41 +01006847 if( ret != 0 )
6848 return( ret );
6849#endif
6850
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006851 /* Skip unexpected record (but not whole datagram) */
Hanno Becker2528ee02019-07-11 12:48:53 +01006852 ssl->next_record_offset = rec.buf_len;
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006853
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006854 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
6855 "(header)" ) );
6856 }
6857 else
6858 {
6859 /* Skip invalid record and the rest of the datagram */
6860 ssl->next_record_offset = 0;
6861 ssl->in_left = 0;
6862
6863 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
6864 "(header)" ) );
6865 }
6866
6867 /* Get next record */
Hanno Becker90333da2017-10-10 11:27:13 +01006868 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006869 }
Hanno Becker87b56262019-07-10 14:37:41 +01006870 else
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006871#endif
Hanno Becker87b56262019-07-10 14:37:41 +01006872 {
6873 return( ret );
6874 }
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006875 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006877#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006878 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckere65ce782017-05-22 14:47:48 +01006879 {
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006880 /* Remember offset of next record within datagram. */
Hanno Becker2720f4c2019-07-11 12:50:10 +01006881 ssl->next_record_offset = rec.buf_len;
Hanno Beckere65ce782017-05-22 14:47:48 +01006882 if( ssl->next_record_offset < ssl->in_left )
6883 {
6884 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
6885 }
6886 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006887 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006888#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006889#if defined(MBEDTLS_SSL_PROTO_TLS)
6890 {
Hanno Beckere0452772019-07-10 17:12:07 +01006891 /*
6892 * Fetch record contents from underlying transport.
6893 */
Hanno Becker9babbf72019-07-11 12:50:29 +01006894 ret = mbedtls_ssl_fetch_input( ssl, rec.buf_len );
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006895 if( ret != 0 )
6896 {
6897 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
6898 return( ret );
6899 }
6900
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006901 ssl->in_left = 0;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006902 }
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006903#endif /* MBEDTLS_SSL_PROTO_TLS */
6904
6905 /*
6906 * Decrypt record contents.
6907 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006908
Hanno Beckera89610a2019-07-11 13:07:45 +01006909 if( ( ret = ssl_prepare_record_content( ssl, &rec ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006910 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006911#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006912 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006913 {
6914 /* Silently discard invalid records */
Hanno Becker16e9ae22019-05-03 16:36:59 +01006915 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006916 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006917 /* Except when waiting for Finished as a bad mac here
6918 * probably means something went wrong in the handshake
6919 * (eg wrong psk used, mitm downgrade attempt, etc.) */
6920 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
6921 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
6922 {
6923#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6924 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
6925 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006926 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006927 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
6928 }
6929#endif
6930 return( ret );
6931 }
6932
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006933#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Hanno Beckerde671542019-06-12 16:30:46 +01006934 if( mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) != 0 &&
6935 ++ssl->badmac_seen >= mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006936 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006937 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
6938 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006939 }
6940#endif
6941
Hanno Becker4a810fb2017-05-24 16:27:30 +01006942 /* As above, invalid records cause
6943 * dismissal of the whole datagram. */
6944
6945 ssl->next_record_offset = 0;
6946 ssl->in_left = 0;
6947
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006948 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Hanno Becker90333da2017-10-10 11:27:13 +01006949 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006950 }
6951
6952 return( ret );
6953 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006954 MBEDTLS_SSL_TRANSPORT_ELSE
6955#endif /* MBEDTLS_SSL_PROTO_DTLS */
6956#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006957 {
6958 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006959#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6960 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006961 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006962 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006963 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006964 }
6965#endif
6966 return( ret );
6967 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006968#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006969 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006970
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006971
6972 /* Reset in pointers to default state for TLS/DTLS records,
6973 * assuming no CID and no offset between record content and
6974 * record plaintext. */
6975 ssl_update_in_pointers( ssl );
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006976#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6977 ssl->in_len = ssl->in_cid + rec.cid_len;
6978#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006979 ssl->in_msg = ssl->in_len + 2;
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006980
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006981 /* The record content type may change during decryption,
6982 * so re-read it. */
6983 ssl->in_msgtype = rec.type;
6984 /* Also update the input buffer, because unfortunately
6985 * the server-side ssl_parse_client_hello() reparses the
6986 * record header when receiving a ClientHello initiating
6987 * a renegotiation. */
6988 ssl->in_hdr[0] = rec.type;
6989 ssl->in_msg = rec.buf + rec.data_offset;
6990 ssl->in_msglen = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03006991 (void)mbedtls_platform_put_uint16_be( ssl->in_len, rec.data_len );
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006992
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01006993#if defined(MBEDTLS_ZLIB_SUPPORT)
6994 if( ssl->transform_in != NULL &&
6995 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
6996 {
6997 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
6998 {
6999 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
7000 return( ret );
7001 }
7002
7003 /* Check actual (decompress) record content length against
7004 * configured maximum. */
7005 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
7006 {
7007 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
7008 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7009 }
7010 }
7011#endif /* MBEDTLS_ZLIB_SUPPORT */
7012
Simon Butcher99000142016-10-13 17:21:01 +01007013 return( 0 );
7014}
7015
7016int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
7017{
7018 int ret;
7019
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007020 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02007021 * Handle particular types of records
7022 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007023 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007024 {
Simon Butcher99000142016-10-13 17:21:01 +01007025 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
7026 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01007027 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01007028 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007029 }
7030
Hanno Beckere678eaa2018-08-21 14:57:46 +01007031 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007032 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01007033 if( ssl->in_msglen != 1 )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007034 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01007035 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %d",
7036 ssl->in_msglen ) );
7037 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007038 }
7039
Hanno Beckere678eaa2018-08-21 14:57:46 +01007040 if( ssl->in_msg[0] != 1 )
7041 {
7042 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
7043 ssl->in_msg[0] ) );
7044 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7045 }
7046
7047#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02007048 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckere678eaa2018-08-21 14:57:46 +01007049 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
7050 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
7051 {
7052 if( ssl->handshake == NULL )
7053 {
7054 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
7055 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
7056 }
7057
7058 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
7059 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
7060 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007061#endif
Hanno Beckere678eaa2018-08-21 14:57:46 +01007062 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007063
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007064 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00007065 {
Angus Gratton1a7a17e2018-06-20 15:43:50 +10007066 if( ssl->in_msglen != 2 )
7067 {
7068 /* Note: Standard allows for more than one 2 byte alert
7069 to be packed in a single message, but Mbed TLS doesn't
7070 currently support this. */
7071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
7072 ssl->in_msglen ) );
7073 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7074 }
7075
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007076 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00007077 ssl->in_msg[0], ssl->in_msg[1] ) );
7078
7079 /*
Simon Butcher459a9502015-10-27 16:09:03 +00007080 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00007081 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007082 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007083 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007084 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00007085 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007086 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007087 }
7088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007089 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7090 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00007091 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007092 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
7093 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00007094 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007095
7096#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
7097 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7098 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
7099 {
Hanno Becker90333da2017-10-10 11:27:13 +01007100 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no renegotiation alert" ) );
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007101 /* Will be handled when trying to parse ServerHello */
7102 return( 0 );
7103 }
7104#endif
7105
7106#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2881d802019-05-22 14:44:53 +01007107 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007108 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7109 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007110 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7111 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7112 {
7113 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
7114 /* Will be handled in mbedtls_ssl_parse_certificate() */
7115 return( 0 );
7116 }
7117#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
7118
7119 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01007120 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00007121 }
7122
Hanno Beckerc76c6192017-06-06 10:03:17 +01007123#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02007124 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckerc76c6192017-06-06 10:03:17 +01007125 {
Hanno Becker74dd3a72019-05-03 16:54:26 +01007126 /* Drop unexpected ApplicationData records,
7127 * except at the beginning of renegotiations */
7128 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
7129 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
7130#if defined(MBEDTLS_SSL_RENEGOTIATION)
7131 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
7132 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
Hanno Beckerc76c6192017-06-06 10:03:17 +01007133#endif
Hanno Becker74dd3a72019-05-03 16:54:26 +01007134 )
7135 {
7136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
7137 return( MBEDTLS_ERR_SSL_NON_FATAL );
7138 }
7139
7140 if( ssl->handshake != NULL &&
7141 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
7142 {
7143 ssl_handshake_wrapup_free_hs_transform( ssl );
7144 }
7145 }
Hanno Beckerf65ad822019-05-08 16:26:21 +01007146#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Beckerc76c6192017-06-06 10:03:17 +01007147
Paul Bakker5121ce52009-01-03 21:22:43 +00007148 return( 0 );
7149}
7150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007151int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007152{
7153 int ret;
7154
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007155 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
7156 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7157 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007158 {
7159 return( ret );
7160 }
7161
7162 return( 0 );
7163}
7164
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007165int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Hanno Becker1facd552019-07-03 13:57:23 +01007166 unsigned char level,
7167 unsigned char message )
Paul Bakker0a925182012-04-16 06:46:41 +00007168{
7169 int ret;
7170
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02007171 if( ssl == NULL || ssl->conf == NULL )
7172 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7173
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007174 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007175 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00007176
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007177 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00007178 ssl->out_msglen = 2;
7179 ssl->out_msg[0] = level;
7180 ssl->out_msg[1] = message;
7181
Hanno Becker67bc7c32018-08-06 11:33:50 +01007182 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00007183 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007184 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00007185 return( ret );
7186 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007187 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00007188
7189 return( 0 );
7190}
7191
Hanno Becker17572472019-02-08 07:19:04 +00007192#if defined(MBEDTLS_X509_CRT_PARSE_C)
7193static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
7194{
7195#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7196 if( session->peer_cert != NULL )
7197 {
7198 mbedtls_x509_crt_free( session->peer_cert );
7199 mbedtls_free( session->peer_cert );
7200 session->peer_cert = NULL;
7201 }
Hanno Becker5882dd02019-06-06 16:25:57 +01007202#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker17572472019-02-08 07:19:04 +00007203 if( session->peer_cert_digest != NULL )
7204 {
7205 /* Zeroization is not necessary. */
7206 mbedtls_free( session->peer_cert_digest );
7207 session->peer_cert_digest = NULL;
7208 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
7209 session->peer_cert_digest_len = 0;
7210 }
Hanno Becker5882dd02019-06-06 16:25:57 +01007211#else
7212 ((void) session);
7213#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker17572472019-02-08 07:19:04 +00007214}
7215#endif /* MBEDTLS_X509_CRT_PARSE_C */
7216
Paul Bakker5121ce52009-01-03 21:22:43 +00007217/*
7218 * Handshake functions
7219 */
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007220#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02007221/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007222int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007223{
Hanno Beckerdf645962019-06-26 13:02:22 +01007224 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7225 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker5121ce52009-01-03 21:22:43 +00007226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007227 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007228
Hanno Becker5097cba2019-02-05 13:36:46 +00007229 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007230 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007231 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007232 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7233 {
7234 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7235 }
7236 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7237 {
7238 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7239 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007240 else
7241 {
7242 ssl->state = MBEDTLS_SSL_INVALID;
7243 }
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007244 return( 0 );
7245 }
7246
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7248 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007249}
7250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007251int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007252{
Hanno Beckerdf645962019-06-26 13:02:22 +01007253 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7254 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007256 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007257
Hanno Becker5097cba2019-02-05 13:36:46 +00007258 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007259 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007260 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007261 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7262 {
7263 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7264 }
7265 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7266 {
7267 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7268 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007269 else
7270 {
7271 ssl->state = MBEDTLS_SSL_INVALID;
7272 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007273 return( 0 );
7274 }
7275
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007276 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7277 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007278}
Gilles Peskinef9828522017-05-03 12:28:43 +02007279
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007280#else /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Gilles Peskinef9828522017-05-03 12:28:43 +02007281/* Some certificate support -> implement write and parse */
7282
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007283int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007284{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007285 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007286 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007287 const mbedtls_x509_crt *crt;
Hanno Beckerdf645962019-06-26 13:02:22 +01007288 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7289 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007290
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007291 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007292
Hanno Becker5097cba2019-02-05 13:36:46 +00007293 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007294 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007295 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007296 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7297 {
7298 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7299 }
7300 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7301 {
7302 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7303 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007304 else
7305 {
7306 ssl->state = MBEDTLS_SSL_INVALID;
7307 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007308 return( 0 );
7309 }
7310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007311#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007312 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7313 MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00007314 {
7315 if( ssl->client_auth == 0 )
7316 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007317 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007318 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7319 {
7320 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7321 }
7322 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7323 {
7324 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7325 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007326 else
7327 {
7328 ssl->state = MBEDTLS_SSL_INVALID;
7329 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007330 return( 0 );
7331 }
7332
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007333#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00007334 /*
7335 * If using SSLv3 and got no cert, send an Alert message
7336 * (otherwise an empty Certificate message will be sent).
7337 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007338 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
Hanno Becker2881d802019-05-22 14:44:53 +01007339 mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007340 {
7341 ssl->out_msglen = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007342 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
7343 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
7344 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
Paul Bakker5121ce52009-01-03 21:22:43 +00007345
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007346 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007347 goto write_msg;
7348 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007349#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00007350 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007351#endif /* MBEDTLS_SSL_CLI_C */
7352#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007353 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00007354 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007355 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007356 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007357 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
7358 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00007359 }
7360 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01007361#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007362
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007363 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007364
7365 /*
7366 * 0 . 0 handshake type
7367 * 1 . 3 handshake length
7368 * 4 . 6 length of all certs
7369 * 7 . 9 length of cert. 1
7370 * 10 . n-1 peer certificate
7371 * n . n+2 length of cert. 2
7372 * n+3 . ... upper level cert, etc.
7373 */
7374 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007375 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00007376
Paul Bakker29087132010-03-21 21:03:34 +00007377 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007378 {
7379 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10007380 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00007381 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007382 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
Angus Grattond8213d02016-05-25 20:56:48 +10007383 i + 3 + n, MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007384 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007385 }
7386
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007387 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[i], n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007388
Teppo Järvelin91d79382019-10-02 09:09:31 +03007389 i += 3; mbedtls_platform_memcpy( ssl->out_msg + i, crt->raw.p, n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007390 i += n; crt = crt->next;
7391 }
7392
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007393 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[4], ( i - 7 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007394
7395 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007396 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7397 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00007398
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02007399#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00007400write_msg:
Paul Bakkerd2f068e2013-08-27 21:19:20 +02007401#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007402
Jarno Lamsa2b205162019-11-12 15:36:21 +02007403 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7404 {
7405 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7406 }
7407 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7408 {
7409 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7410 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007411 else
7412 {
7413 ssl->state = MBEDTLS_SSL_INVALID;
7414 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007415
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007416 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007417 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007418 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007419 return( ret );
7420 }
7421
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007422 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007423
Paul Bakkered27a042013-04-18 22:46:23 +02007424 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007425}
7426
Hanno Becker285ff0c2019-01-31 07:44:03 +00007427#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerdf759382019-02-05 17:02:46 +00007428
7429#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007430#define PEER_CRT_CHANGED 0x75555555
Hanno Becker33c3dc82019-01-30 14:46:46 +00007431static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7432 unsigned char *crt_buf,
7433 size_t crt_buf_len )
7434{
7435 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
7436
7437 if( peer_crt == NULL )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007438 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007439
7440 if( peer_crt->raw.len != crt_buf_len )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007441 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007442
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02007443 return( mbedtls_platform_memequal( peer_crt->raw.p, crt_buf, crt_buf_len ) );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007444}
Hanno Becker5882dd02019-06-06 16:25:57 +01007445#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007446#define PEER_CRT_CHANGED 0x75555555
Hanno Beckerdf759382019-02-05 17:02:46 +00007447static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7448 unsigned char *crt_buf,
7449 size_t crt_buf_len )
7450{
7451 int ret;
7452 unsigned char const * const peer_cert_digest =
7453 ssl->session->peer_cert_digest;
7454 mbedtls_md_type_t const peer_cert_digest_type =
7455 ssl->session->peer_cert_digest_type;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007456 mbedtls_md_handle_t digest_info =
Hanno Beckerdf759382019-02-05 17:02:46 +00007457 mbedtls_md_info_from_type( peer_cert_digest_type );
7458 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
7459 size_t digest_len;
7460
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007461 if( peer_cert_digest == NULL ||
7462 digest_info == MBEDTLS_MD_INVALID_HANDLE )
7463 {
Andrzej Kurek0919b142020-07-06 15:28:59 -04007464 return( PEER_CRT_CHANGED );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007465 }
Hanno Beckerdf759382019-02-05 17:02:46 +00007466
7467 digest_len = mbedtls_md_get_size( digest_info );
7468 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
Andrzej Kurek45e71992020-07-08 10:09:44 -04007469 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007470
7471 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
7472 if( ret != 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007473 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007474
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02007475 return( mbedtls_platform_memequal( tmp_digest, peer_cert_digest, digest_len ) );
Hanno Beckerdf759382019-02-05 17:02:46 +00007476}
Hanno Becker5882dd02019-06-06 16:25:57 +01007477#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker285ff0c2019-01-31 07:44:03 +00007478#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Hanno Becker33c3dc82019-01-30 14:46:46 +00007479
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007480/*
7481 * Once the certificate message is read, parse it into a cert chain and
7482 * perform basic checks, but leave actual verification to the caller
7483 */
Hanno Becker35e41772019-02-05 15:37:23 +00007484static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
7485 mbedtls_x509_crt *chain )
Paul Bakker5121ce52009-01-03 21:22:43 +00007486{
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007487 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker35e41772019-02-05 15:37:23 +00007488#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7489 int crt_cnt=0;
7490#endif
Paul Bakker23986e52011-04-24 08:57:21 +00007491 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02007492 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00007493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007494 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007495 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007496 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007497 mbedtls_ssl_pend_fatal_alert( ssl,
7498 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007499 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007500 }
7501
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007502 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
7503 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007504 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007505 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007506 mbedtls_ssl_pend_fatal_alert( ssl,
7507 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007508 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007509 }
7510
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007511 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007512
Paul Bakker5121ce52009-01-03 21:22:43 +00007513 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007514 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00007515 */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007516 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007517
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007518 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007519 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00007520 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007521 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007522 mbedtls_ssl_pend_fatal_alert( ssl,
7523 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007524 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007525 }
7526
Hanno Becker33c3dc82019-01-30 14:46:46 +00007527 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
7528 i += 3;
7529
Hanno Becker33c3dc82019-01-30 14:46:46 +00007530 /* Iterate through and parse the CRTs in the provided chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007531 while( i < ssl->in_hslen )
7532 {
Hanno Becker33c3dc82019-01-30 14:46:46 +00007533 /* Check that there's room for the next CRT's length fields. */
Philippe Antoine747fd532018-05-30 09:13:21 +02007534 if ( i + 3 > ssl->in_hslen ) {
7535 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007536 mbedtls_ssl_pend_fatal_alert( ssl,
7537 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +02007538 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
7539 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007540 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
7541 * anything beyond 2**16 ~ 64K. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007542 if( ssl->in_msg[i] != 0 )
7543 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007544 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007545 mbedtls_ssl_pend_fatal_alert( ssl,
7546 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007547 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007548 }
7549
Hanno Becker33c3dc82019-01-30 14:46:46 +00007550 /* Read length of the next CRT in the chain. */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007551 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007552 i += 3;
7553
7554 if( n < 128 || i + n > ssl->in_hslen )
7555 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007556 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007557 mbedtls_ssl_pend_fatal_alert( ssl,
7558 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007559 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007560 }
7561
Hanno Becker33c3dc82019-01-30 14:46:46 +00007562 /* Check if we're handling the first CRT in the chain. */
Hanno Becker35e41772019-02-05 15:37:23 +00007563#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7564 if( crt_cnt++ == 0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007565 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7566 MBEDTLS_SSL_IS_CLIENT &&
Hanno Becker35e41772019-02-05 15:37:23 +00007567 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007568 {
Hanno Becker68b856d2019-02-08 14:00:04 +00007569 /* During client-side renegotiation, check that the server's
7570 * end-CRTs hasn't changed compared to the initial handshake,
7571 * mitigating the triple handshake attack. On success, reuse
7572 * the original end-CRT instead of parsing it again. */
Hanno Becker35e41772019-02-05 15:37:23 +00007573 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
7574 if( ssl_check_peer_crt_unchanged( ssl,
7575 &ssl->in_msg[i],
7576 n ) != 0 )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007577 {
Hanno Becker35e41772019-02-05 15:37:23 +00007578 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007579 mbedtls_ssl_pend_fatal_alert( ssl,
7580 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Hanno Becker35e41772019-02-05 15:37:23 +00007581 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007582 }
Hanno Becker35e41772019-02-05 15:37:23 +00007583
7584 /* Now we can safely free the original chain. */
7585 ssl_clear_peer_cert( ssl->session );
7586 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007587#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7588
Hanno Becker33c3dc82019-01-30 14:46:46 +00007589 /* Parse the next certificate in the chain. */
Hanno Becker0cc7af52019-02-08 14:39:16 +00007590#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker35e41772019-02-05 15:37:23 +00007591 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
Hanno Becker0cc7af52019-02-08 14:39:16 +00007592#else
Hanno Becker42de8f82019-02-26 11:51:34 +00007593 /* If we don't need to store the CRT chain permanently, parse
Hanno Becker0cc7af52019-02-08 14:39:16 +00007594 * it in-place from the input buffer instead of making a copy. */
7595 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
7596#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007597 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00007598 {
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007599 case 0: /* ok */
7600 mbedtls_platform_random_delay();
7601 if( ret != 0 )
7602 {
7603 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7604 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7605 goto crt_parse_der_failed;
7606 }
7607 break;
Hanno Becker33c3dc82019-01-30 14:46:46 +00007608 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7609 /* Ignore certificate with an unknown algorithm: maybe a
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007610 * prior certificate was already trusted. */
7611 mbedtls_platform_random_delay();
7612 if( ret != MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND )
7613 {
7614 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7615 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7616 goto crt_parse_der_failed;
7617 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007618 break;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007619
Hanno Becker33c3dc82019-01-30 14:46:46 +00007620 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7621 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7622 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007623
Hanno Becker33c3dc82019-01-30 14:46:46 +00007624 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7625 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7626 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007627
Hanno Becker33c3dc82019-01-30 14:46:46 +00007628 default:
7629 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7630 crt_parse_der_failed:
Hanno Beckerde62da92019-07-24 13:23:50 +01007631 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007632 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
7633 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007634 }
7635
7636 i += n;
7637 }
7638
Hanno Becker35e41772019-02-05 15:37:23 +00007639 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007640 return( 0 );
7641}
7642
Hanno Beckerb8a08572019-02-05 12:49:06 +00007643#if defined(MBEDTLS_SSL_SRV_C)
7644static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
7645{
Hanno Becker2d9623f2019-06-13 12:07:05 +01007646 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007647 return( -1 );
7648
7649#if defined(MBEDTLS_SSL_PROTO_SSL3)
7650 /*
7651 * Check if the client sent an empty certificate
7652 */
Hanno Becker2881d802019-05-22 14:44:53 +01007653 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007654 {
7655 if( ssl->in_msglen == 2 &&
7656 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
7657 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7658 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7659 {
7660 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
7661 return( 0 );
7662 }
7663
7664 return( -1 );
7665 }
7666#endif /* MBEDTLS_SSL_PROTO_SSL3 */
7667
7668#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
7669 defined(MBEDTLS_SSL_PROTO_TLS1_2)
7670 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
7671 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7672 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
Teppo Järvelin0efac532019-10-04 13:21:08 +03007673 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 ) // use regular memcmp as comparing public data
Hanno Beckerb8a08572019-02-05 12:49:06 +00007674 {
7675 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
7676 return( 0 );
7677 }
7678
Hanno Beckerb8a08572019-02-05 12:49:06 +00007679#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
7680 MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker17daaa52019-06-18 12:31:45 +01007681
7682 return( -1 );
Hanno Beckerb8a08572019-02-05 12:49:06 +00007683}
7684#endif /* MBEDTLS_SSL_SRV_C */
7685
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007686/* Check if a certificate message is expected.
7687 * Return either
7688 * - SSL_CERTIFICATE_EXPECTED, or
7689 * - SSL_CERTIFICATE_SKIP
7690 * indicating whether a Certificate message is expected or not.
7691 */
7692#define SSL_CERTIFICATE_EXPECTED 0
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02007693#define SSL_CERTIFICATE_SKIP 0xff
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007694static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
7695 int authmode )
7696{
Hanno Becker473f98f2019-06-26 10:27:32 +01007697 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007698 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007699
7700 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
7701 return( SSL_CERTIFICATE_SKIP );
7702
7703#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007704 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007705 {
Hanno Becker473f98f2019-06-26 10:27:32 +01007706 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
7707 MBEDTLS_KEY_EXCHANGE_RSA_PSK )
7708 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007709 return( SSL_CERTIFICATE_SKIP );
Hanno Becker473f98f2019-06-26 10:27:32 +01007710 }
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007711
7712 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
7713 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007714 ssl->session_negotiate->verify_result =
7715 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
7716 return( SSL_CERTIFICATE_SKIP );
7717 }
7718 }
Hanno Beckerfd5dc8a2019-03-01 08:10:46 +00007719#else
7720 ((void) authmode);
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007721#endif /* MBEDTLS_SSL_SRV_C */
7722
7723 return( SSL_CERTIFICATE_EXPECTED );
7724}
7725
Hanno Becker3cf50612019-02-05 14:36:34 +00007726static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007727 volatile int authmode,
Hanno Becker3cf50612019-02-05 14:36:34 +00007728 mbedtls_x509_crt *chain,
7729 void *rs_ctx )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007730{
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007731 volatile int verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Andrzej Kurekfd56f402020-05-25 11:52:05 -04007732 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007733 volatile int flow_counter = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01007734 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007735 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker3cf50612019-02-05 14:36:34 +00007736 mbedtls_x509_crt *ca_chain;
7737 mbedtls_x509_crl *ca_crl;
7738
7739 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
Jarno Lamsae1621d42019-12-19 08:58:56 +02007740 {
Hanno Becker3cf50612019-02-05 14:36:34 +00007741 return( 0 );
Jarno Lamsae1621d42019-12-19 08:58:56 +02007742 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007743
Jarno Lamsae1621d42019-12-19 08:58:56 +02007744 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Hanno Becker3cf50612019-02-05 14:36:34 +00007745#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7746 if( ssl->handshake->sni_ca_chain != NULL )
7747 {
7748 ca_chain = ssl->handshake->sni_ca_chain;
7749 ca_crl = ssl->handshake->sni_ca_crl;
7750 }
7751 else
7752#endif
7753 {
7754 ca_chain = ssl->conf->ca_chain;
7755 ca_crl = ssl->conf->ca_crl;
7756 }
7757
7758 /*
7759 * Main check: verify certificate
7760 */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007761 verify_ret = mbedtls_x509_crt_verify_restartable(
Hanno Becker3cf50612019-02-05 14:36:34 +00007762 chain,
7763 ca_chain, ca_crl,
7764 ssl->conf->cert_profile,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007765#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Hanno Becker3cf50612019-02-05 14:36:34 +00007766 ssl->hostname,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007767#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Hanno Becker3cf50612019-02-05 14:36:34 +00007768 &ssl->session_negotiate->verify_result,
Hanno Becker9ec3fe02019-07-01 17:36:12 +01007769#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
7770 ssl->conf->f_vrfy, ssl->conf->p_vrfy,
7771#endif /* MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
7772 rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00007773
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007774 if( verify_ret == 0 )
7775 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007776 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007777 if( verify_ret == 0 )
7778 {
7779 flow_counter++;
7780 }
7781 else
7782 {
7783 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7784 }
7785 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007786 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007787 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007788 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", verify_ret );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007789 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007790 }
7791
7792#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Hanno Becker8c13ee62019-02-26 16:48:17 +00007793 if( verify_ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Hanno Becker3cf50612019-02-05 14:36:34 +00007794 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
7795#endif
7796
7797 /*
7798 * Secondary checks: always done, but change 'ret' only if it was 0
7799 */
7800
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007801#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
Hanno Becker3cf50612019-02-05 14:36:34 +00007802 {
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007803#if defined(MBEDTLS_USE_TINYCRYPT)
Hanno Beckeree902df2019-08-23 13:47:47 +01007804 ret = mbedtls_ssl_check_curve_uecc( ssl, MBEDTLS_UECC_DP_SECP256R1 );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007805#else /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007806 mbedtls_pk_context *pk;
7807 ret = mbedtls_x509_crt_pk_acquire( chain, &pk );
7808 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +01007809 {
7810 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007811 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +01007812 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007813
7814 /* If certificate uses an EC key, make sure the curve is OK */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007815 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) )
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007816 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007817 ret = mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007818 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007819
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00007820 mbedtls_x509_crt_pk_release( chain );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007821#endif /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007822
7823 if( ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007824 {
7825 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
7826
7827 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007828 if( verify_ret == 0 )
7829 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007830 flow_counter++;
7831 }
7832 if( ret == 0 )
7833 {
7834 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007835 }
7836 }
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007837#endif /* MBEDTLS_ECP_C || MEDTLS_USE_TINYCRYPT */
Hanno Becker3cf50612019-02-05 14:36:34 +00007838
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007839 ret = mbedtls_ssl_check_cert_usage( chain,
Hanno Becker3cf50612019-02-05 14:36:34 +00007840 ciphersuite_info,
Hanno Becker2d9623f2019-06-13 12:07:05 +01007841 ( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7842 MBEDTLS_SSL_IS_CLIENT ),
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007843 &ssl->session_negotiate->verify_result );
7844 if( ret == 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007845 {
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007846 flow_counter++;
7847 }
7848 else
7849 {
7850 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007851 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007852 if( verify_ret == 0 )
7853 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Hanno Becker3cf50612019-02-05 14:36:34 +00007854 }
7855
7856 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
7857 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
7858 * with details encoded in the verification flags. All other kinds
7859 * of error codes, including those from the user provided f_vrfy
7860 * functions, are treated as fatal and lead to a failure of
7861 * ssl_parse_certificate even if verification was optional. */
7862 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
Hanno Becker8c13ee62019-02-26 16:48:17 +00007863 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7864 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
Hanno Becker3cf50612019-02-05 14:36:34 +00007865 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007866 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007867 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
7868 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7869 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
7870 {
7871 verify_ret = 0;
7872 flow_counter++;
7873 }
7874 else
7875 {
7876 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7877 }
7878 } else {
7879 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007880 }
7881
7882 if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
7883 {
7884 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007885 verify_ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007886 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007887 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007888 else
7889 {
7890 flow_counter++;
7891 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007892
Hanno Becker8c13ee62019-02-26 16:48:17 +00007893 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007894 {
7895 uint8_t alert;
7896
7897 /* The certificate may have been rejected for several reasons.
7898 Pick one and send the corresponding alert. Which alert to send
7899 may be a subject of debate in some cases. */
7900 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
7901 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
7902 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
7903 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7904 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
7905 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7906 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
7907 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7908 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
7909 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7910 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
7911 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7912 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
7913 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7914 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
7915 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
7916 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
7917 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
7918 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
7919 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
7920 else
7921 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Hanno Beckerde62da92019-07-24 13:23:50 +01007922 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker3cf50612019-02-05 14:36:34 +00007923 }
7924
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007925 if( verify_ret == 0 &&
7926#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7927 flow_counter == 5 )
7928#else
7929 flow_counter == 4 )
7930#endif
7931 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007932 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007933 if( verify_ret == 0 &&
7934#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7935 flow_counter == 5 )
7936#else
7937 flow_counter == 4 )
7938#endif
7939 {
Jarno Lamsae1621d42019-12-19 08:58:56 +02007940 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER AUTHENTICATED" ) );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007941 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
7942 }
7943 else
7944 {
7945 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7946 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007947 } else {
7948 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER NOT AUTHENTICATED, %d", flow_counter));
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007949 }
7950
Hanno Becker3cf50612019-02-05 14:36:34 +00007951#if defined(MBEDTLS_DEBUG_C)
7952 if( ssl->session_negotiate->verify_result != 0 )
7953 {
7954 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
7955 ssl->session_negotiate->verify_result ) );
7956 }
7957 else
7958 {
7959 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
7960 }
7961#endif /* MBEDTLS_DEBUG_C */
7962
Hanno Becker8c13ee62019-02-26 16:48:17 +00007963 return( verify_ret );
Hanno Becker3cf50612019-02-05 14:36:34 +00007964}
7965
Hanno Becker34106f62019-02-08 14:59:05 +00007966#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker5882dd02019-06-06 16:25:57 +01007967
7968#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00007969static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
7970 unsigned char *start, size_t len )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007971{
7972 int ret;
Hanno Becker34106f62019-02-08 14:59:05 +00007973 /* Remember digest of the peer's end-CRT. */
7974 ssl->session_negotiate->peer_cert_digest =
7975 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
7976 if( ssl->session_negotiate->peer_cert_digest == NULL )
7977 {
7978 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
7979 sizeof( MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007980 mbedtls_ssl_pend_fatal_alert( ssl,
7981 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Becker34106f62019-02-08 14:59:05 +00007982
7983 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7984 }
7985
7986 ret = mbedtls_md( mbedtls_md_info_from_type(
7987 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
7988 start, len,
7989 ssl->session_negotiate->peer_cert_digest );
7990
7991 ssl->session_negotiate->peer_cert_digest_type =
7992 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
7993 ssl->session_negotiate->peer_cert_digest_len =
7994 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
7995
7996 return( ret );
7997}
Hanno Becker5882dd02019-06-06 16:25:57 +01007998#endif /* MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker34106f62019-02-08 14:59:05 +00007999
8000static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
8001 unsigned char *start, size_t len )
8002{
8003 unsigned char *end = start + len;
8004 int ret;
8005
8006 /* Make a copy of the peer's raw public key. */
8007 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
8008 ret = mbedtls_pk_parse_subpubkey( &start, end,
8009 &ssl->handshake->peer_pubkey );
8010 if( ret != 0 )
8011 {
8012 /* We should have parsed the public key before. */
8013 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
8014 }
8015
Manuel Pégourié-Gonnard2829bbf2019-09-19 10:45:14 +02008016 ssl->handshake->got_peer_pubkey = 1;
Hanno Becker34106f62019-02-08 14:59:05 +00008017 return( 0 );
8018}
8019#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8020
Hanno Becker3cf50612019-02-05 14:36:34 +00008021int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
8022{
8023 int ret = 0;
Hanno Becker6b9a6f32019-02-07 10:11:07 +00008024 int crt_expected;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008025#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8026 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
8027 ? ssl->handshake->sni_authmode
Hanno Beckeracd4fc02019-06-12 16:40:50 +01008028 : mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008029#else
Hanno Beckeracd4fc02019-06-12 16:40:50 +01008030 const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008031#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008032 void *rs_ctx = NULL;
Hanno Beckere4aeb762019-02-05 17:19:52 +00008033 mbedtls_x509_crt *chain = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008034
8035 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
8036
Hanno Becker6b9a6f32019-02-07 10:11:07 +00008037 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
8038 if( crt_expected == SSL_CERTIFICATE_SKIP )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008039 {
8040 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Hanno Becker613d4902019-02-05 13:11:17 +00008041 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008042 }
8043
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008044#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8045 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02008046 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008047 {
Hanno Beckere4aeb762019-02-05 17:19:52 +00008048 chain = ssl->handshake->ecrs_peer_cert;
8049 ssl->handshake->ecrs_peer_cert = NULL;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008050 goto crt_verify;
8051 }
8052#endif
8053
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02008054 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008055 {
8056 /* mbedtls_ssl_read_record may have sent an alert already. We
8057 let it decide whether to alert. */
8058 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Hanno Beckere4aeb762019-02-05 17:19:52 +00008059 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008060 }
8061
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008062#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerb8a08572019-02-05 12:49:06 +00008063 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
8064 {
8065 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008066
Hanno Beckerb8a08572019-02-05 12:49:06 +00008067 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
Hanno Becker613d4902019-02-05 13:11:17 +00008068 ret = 0;
8069 else
8070 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Hanno Beckerb8a08572019-02-05 12:49:06 +00008071
Hanno Becker613d4902019-02-05 13:11:17 +00008072 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008073 }
Hanno Beckerb8a08572019-02-05 12:49:06 +00008074#endif /* MBEDTLS_SSL_SRV_C */
8075
Hanno Becker35e41772019-02-05 15:37:23 +00008076 /* Clear existing peer CRT structure in case we tried to
8077 * reuse a session but it failed, and allocate a new one. */
Hanno Beckera46c2872019-02-05 13:08:01 +00008078 ssl_clear_peer_cert( ssl->session_negotiate );
Hanno Beckere4aeb762019-02-05 17:19:52 +00008079
8080 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
8081 if( chain == NULL )
Hanno Becker35e41772019-02-05 15:37:23 +00008082 {
8083 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
8084 sizeof( mbedtls_x509_crt ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008085 mbedtls_ssl_pend_fatal_alert( ssl,
8086 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Beckera46c2872019-02-05 13:08:01 +00008087
Hanno Beckere4aeb762019-02-05 17:19:52 +00008088 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
8089 goto exit;
8090 }
8091 mbedtls_x509_crt_init( chain );
8092
8093 ret = ssl_parse_certificate_chain( ssl, chain );
Hanno Becker35e41772019-02-05 15:37:23 +00008094 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00008095 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008096
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008097#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8098 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02008099 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008100
8101crt_verify:
8102 if( ssl->handshake->ecrs_enabled)
8103 rs_ctx = &ssl->handshake->ecrs_ctx;
8104#endif
8105
Hanno Becker3cf50612019-02-05 14:36:34 +00008106 ret = ssl_parse_certificate_verify( ssl, authmode,
Hanno Beckere4aeb762019-02-05 17:19:52 +00008107 chain, rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00008108 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00008109 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00008110
Hanno Becker3008d282019-02-05 17:02:28 +00008111#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakker5121ce52009-01-03 21:22:43 +00008112 {
Hanno Becker5882dd02019-06-06 16:25:57 +01008113 size_t pk_len;
8114 unsigned char *pk_start;
Paul Bakker5121ce52009-01-03 21:22:43 +00008115
Hanno Becker34106f62019-02-08 14:59:05 +00008116 /* We parse the CRT chain without copying, so
8117 * these pointers point into the input buffer,
8118 * and are hence still valid after freeing the
8119 * CRT chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00008120
Hanno Becker5882dd02019-06-06 16:25:57 +01008121#if defined(MBEDTLS_SSL_RENEGOTIATION)
8122 unsigned char *crt_start;
8123 size_t crt_len;
8124
Hanno Becker34106f62019-02-08 14:59:05 +00008125 crt_start = chain->raw.p;
8126 crt_len = chain->raw.len;
Hanno Becker5882dd02019-06-06 16:25:57 +01008127#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008128
Hanno Becker8c13ee62019-02-26 16:48:17 +00008129 pk_start = chain->cache->pk_raw.p;
8130 pk_len = chain->cache->pk_raw.len;
Hanno Becker34106f62019-02-08 14:59:05 +00008131
8132 /* Free the CRT structures before computing
8133 * digest and copying the peer's public key. */
8134 mbedtls_x509_crt_free( chain );
8135 mbedtls_free( chain );
8136 chain = NULL;
8137
Hanno Becker5882dd02019-06-06 16:25:57 +01008138#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00008139 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008140 if( ret != 0 )
Hanno Beckercf291d62019-02-06 16:19:04 +00008141 goto exit;
Hanno Becker5882dd02019-06-06 16:25:57 +01008142#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008143
Hanno Becker34106f62019-02-08 14:59:05 +00008144 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008145 if( ret != 0 )
Hanno Becker34106f62019-02-08 14:59:05 +00008146 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00008147 }
Hanno Becker34106f62019-02-08 14:59:05 +00008148#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8149 /* Pass ownership to session structure. */
Hanno Beckere4aeb762019-02-05 17:19:52 +00008150 ssl->session_negotiate->peer_cert = chain;
8151 chain = NULL;
Hanno Becker34106f62019-02-08 14:59:05 +00008152#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008153
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008154 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008155
Hanno Becker613d4902019-02-05 13:11:17 +00008156exit:
8157
Hanno Beckere4aeb762019-02-05 17:19:52 +00008158 if( ret == 0 )
Jarno Lamsa2b205162019-11-12 15:36:21 +02008159 {
8160 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
8161 {
8162 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
8163 }
8164 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
8165 {
8166 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
8167 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008168 else
8169 {
8170 ssl->state = MBEDTLS_SSL_INVALID;
8171 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008172 }
Hanno Beckere4aeb762019-02-05 17:19:52 +00008173
8174#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8175 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
8176 {
8177 ssl->handshake->ecrs_peer_cert = chain;
8178 chain = NULL;
8179 }
8180#endif
8181
8182 if( chain != NULL )
8183 {
8184 mbedtls_x509_crt_free( chain );
8185 mbedtls_free( chain );
8186 }
8187
Paul Bakker5121ce52009-01-03 21:22:43 +00008188 return( ret );
8189}
Hanno Beckerb71e90a2019-02-05 13:20:55 +00008190#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00008191
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008192int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008193{
8194 int ret;
8195
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008196 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008197
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008198 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00008199 ssl->out_msglen = 1;
8200 ssl->out_msg[0] = 1;
8201
Jarno Lamsa2b205162019-11-12 15:36:21 +02008202 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
8203 {
8204 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
8205 }
8206 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
8207 {
8208 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
8209 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008210 else
8211 {
8212 ssl->state = MBEDTLS_SSL_INVALID;
8213 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008214
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008215 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008216 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008217 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008218 return( ret );
8219 }
8220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008221 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008222
8223 return( 0 );
8224}
8225
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008226int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008227{
8228 int ret;
8229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008230 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008231
Hanno Becker327c93b2018-08-15 13:56:18 +01008232 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008233 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008234 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008235 return( ret );
8236 }
8237
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008238 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00008239 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008240 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008241 mbedtls_ssl_pend_fatal_alert( ssl,
8242 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008243 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008244 }
8245
Hanno Beckere678eaa2018-08-21 14:57:46 +01008246 /* CCS records are only accepted if they have length 1 and content '1',
8247 * so we don't need to check this here. */
Paul Bakker5121ce52009-01-03 21:22:43 +00008248
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008249 /*
8250 * Switch to our negotiated transform and session parameters for inbound
8251 * data.
8252 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008253 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008254 ssl->transform_in = ssl->transform_negotiate;
8255 ssl->session_in = ssl->session_negotiate;
8256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008257#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008258 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008259 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008260#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008261 ssl_dtls_replay_reset( ssl );
8262#endif
8263
8264 /* Increment epoch */
8265 if( ++ssl->in_epoch == 0 )
8266 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008267 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02008268 /* This is highly unlikely to happen for legitimate reasons, so
8269 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008270 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008271 }
8272 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008273 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008274#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008275#if defined(MBEDTLS_SSL_PROTO_TLS)
8276 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008277 mbedtls_platform_memset( ssl->in_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008278 }
8279#endif
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008280
Hanno Beckerf5970a02019-05-08 09:38:41 +01008281 ssl_update_in_pointers( ssl );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008282
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008283#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8284 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008285 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008286 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008287 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008288 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
Hanno Beckerde62da92019-07-24 13:23:50 +01008289 mbedtls_ssl_pend_fatal_alert( ssl,
8290 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008291 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008292 }
8293 }
8294#endif
8295
Jarno Lamsa2b205162019-11-12 15:36:21 +02008296 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
8297 {
8298 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
8299 }
8300 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
8301 {
8302 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
8303 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008304 else
8305 {
8306 ssl->state = MBEDTLS_SSL_INVALID;
8307 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008308
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008309 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008310
8311 return( 0 );
8312}
8313
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008314void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008315{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008316#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8317 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker533f5b12019-08-15 16:56:35 +01008318 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008319 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008320#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008321#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8322#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008323 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008324#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008325#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008326 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008327#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008328#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008329}
8330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008331static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008332{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008333 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008334
8335 /*
8336 * Free our handshake params
8337 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02008338 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008339 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00008340 ssl->handshake = NULL;
8341
8342 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008343 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00008344 */
8345 if( ssl->transform )
8346 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008347 mbedtls_ssl_transform_free( ssl->transform );
8348 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00008349 }
8350 ssl->transform = ssl->transform_negotiate;
8351 ssl->transform_negotiate = NULL;
8352
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008353 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008354}
8355
Jarno Lamsae1621d42019-12-19 08:58:56 +02008356int mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008357{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04008358 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008359
8360#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Jarno Lamsa015aa442019-12-20 12:09:37 +02008361 volatile const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008362 ? ssl->handshake->sni_authmode
8363 : mbedtls_ssl_conf_get_authmode( ssl->conf );
8364#else
Jarno Lamsa015aa442019-12-20 12:09:37 +02008365 volatile const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008366#endif
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008367#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8368 volatile int crt_expected = SSL_CERTIFICATE_EXPECTED;
8369 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
8370#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008371 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008372
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008373#if defined(MBEDTLS_SSL_RENEGOTIATION)
8374 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008375 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008376 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008377 ssl->renego_records_seen = 0;
8378 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008379#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008380
8381 /*
8382 * Free the previous session and switch in the current one
8383 */
Paul Bakker0a597072012-09-25 21:55:46 +00008384 if( ssl->session )
8385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008386#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01008387 /* RFC 7366 3.1: keep the EtM state */
8388 ssl->session_negotiate->encrypt_then_mac =
8389 ssl->session->encrypt_then_mac;
8390#endif
8391
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008392 mbedtls_ssl_session_free( ssl->session );
8393 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00008394 }
8395 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00008396 ssl->session_negotiate = NULL;
8397
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008398#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Paul Bakker0a597072012-09-25 21:55:46 +00008399 /*
8400 * Add cache entry
8401 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008402 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02008403 ssl->session->id_len != 0 &&
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008404 ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_UNSET )
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008405 {
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01008406 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008407 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008408 }
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008409#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker0a597072012-09-25 21:55:46 +00008410
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008411 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8412 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8413#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8414 crt_expected == SSL_CERTIFICATE_SKIP )
8415#else
8416 1 )
8417#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008418 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008419 mbedtls_platform_random_delay();
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008420 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8421 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8422#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8423 crt_expected == SSL_CERTIFICATE_SKIP )
8424#else
8425 1 )
8426#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008427 {
8428 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
8429 }
8430 else
8431 {
8432 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8433 goto cleanup;
8434 }
8435 }
8436
Jarno Lamsae1621d42019-12-19 08:58:56 +02008437#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008438 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008439 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008440 mbedtls_platform_random_delay();
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008441 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008442 {
Jarno Lamsa06164052019-12-19 14:40:36 +02008443 /* When doing session resume, no premaster or peer authentication */
Jarno Lamsae1621d42019-12-19 08:58:56 +02008444 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsa06164052019-12-19 14:40:36 +02008445 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008446 }
8447 else
8448 {
8449 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008450 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008451 }
8452 }
8453#endif
8454
8455 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8456 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008457 mbedtls_platform_random_delay();
Jarno Lamsae1621d42019-12-19 08:58:56 +02008458 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8459 {
8460 ret = 0;
8461 }
8462 else
8463 {
8464 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008465 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008466 }
8467 }
8468 else
8469 {
8470 ret = MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008471 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008472 }
8473
Jarno Lamsa06164052019-12-19 14:40:36 +02008474 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8475 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8476 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8477 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008478 mbedtls_platform_random_delay();
Jarno Lamsa06164052019-12-19 14:40:36 +02008479 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8480 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8481 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8482 {
8483 ret = 0;
8484 }
8485 else
8486 {
8487 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8488 goto cleanup;
8489 }
8490 }
8491 else
8492 {
8493 MBEDTLS_SSL_DEBUG_MSG( 3, ( "hello random %d", ssl->handshake->hello_random_set ) );
8494 MBEDTLS_SSL_DEBUG_MSG( 3, ( "key_derivation_done %d", ssl->handshake->key_derivation_done ) );
8495 MBEDTLS_SSL_DEBUG_MSG( 3, ( "premaster_generated %d", ssl->handshake->premaster_generated ) );
8496 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8497 }
8498
8499cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008500#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008501 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008502 ssl->handshake->flight != NULL )
8503 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008504 /* Cancel handshake timer */
8505 ssl_set_timer( ssl, 0 );
8506
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008507 /* Keep last flight around in case we need to resend it:
8508 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008509 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008510 }
8511 else
8512#endif
8513 ssl_handshake_wrapup_free_hs_transform( ssl );
8514
Jarno Lamsa2b205162019-11-12 15:36:21 +02008515 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Paul Bakker48916f92012-09-16 19:57:18 +00008516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008517 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Jarno Lamsae1621d42019-12-19 08:58:56 +02008518 return ret;
Paul Bakker48916f92012-09-16 19:57:18 +00008519}
8520
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008521int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00008522{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008523 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00008524
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008525 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008526
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008527 ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01008528
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008529 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8530 mbedtls_ssl_suite_get_mac(
8531 mbedtls_ssl_ciphersuite_from_id(
8532 mbedtls_ssl_session_get_ciphersuite(
8533 ssl->session_negotiate ) ) ),
8534 ssl, ssl->out_msg + 4,
8535 mbedtls_ssl_conf_get_endpoint( ssl->conf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008536
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01008537 /*
8538 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
8539 * may define some other value. Currently (early 2016), no defined
8540 * ciphersuite does this (and this is unlikely to change as activity has
8541 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
8542 */
Hanno Becker2881d802019-05-22 14:44:53 +01008543 hash_len = ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008544
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008545#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008546 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008547 mbedtls_platform_memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008548#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008549
Paul Bakker5121ce52009-01-03 21:22:43 +00008550 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008551 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8552 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00008553
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008554#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Paul Bakker5121ce52009-01-03 21:22:43 +00008555 /*
8556 * In case of session resuming, invert the client and server
8557 * ChangeCipherSpec messages order.
8558 */
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008559 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008560 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008561#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008562 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8563 MBEDTLS_SSL_IS_CLIENT )
8564 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008565 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008566 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008567#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008568#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008569 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8570 MBEDTLS_SSL_IS_SERVER )
8571 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008572 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008573 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008574#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008575 }
8576 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008577#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008578 {
8579 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8580 {
8581 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8582 }
8583 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8584 {
8585 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8586 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008587 else
8588 {
8589 ssl->state = MBEDTLS_SSL_INVALID;
8590 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008591 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008592
Paul Bakker48916f92012-09-16 19:57:18 +00008593 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02008594 * Switch to our negotiated transform and session parameters for outbound
8595 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00008596 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008597 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01008598
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008599#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008600 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008601 {
8602 unsigned char i;
8603
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008604 /* Remember current epoch settings for resending */
8605 ssl->handshake->alt_transform_out = ssl->transform_out;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008606 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008607
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008608 /* Set sequence_number to zero */
Hanno Becker19859472018-08-06 09:40:20 +01008609 memset( ssl->cur_out_ctr + 2, 0, 6 );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008610
8611 /* Increment epoch */
8612 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01008613 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008614 break;
8615
8616 /* The loop goes to its end iff the counter is wrapping */
8617 if( i == 0 )
8618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008619 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
8620 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008621 }
8622 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008623 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008624#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008625#if defined(MBEDTLS_SSL_PROTO_TLS)
8626 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008627 mbedtls_platform_memset( ssl->cur_out_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008628 }
8629#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008630
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008631 ssl->transform_out = ssl->transform_negotiate;
8632 ssl->session_out = ssl->session_negotiate;
8633
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008634#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8635 if( mbedtls_ssl_hw_record_activate != NULL )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008636 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008637 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008638 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008639 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
8640 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker07eb38b2012-12-19 14:42:06 +01008641 }
8642 }
8643#endif
8644
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008645#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008646 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008647 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02008648#endif
8649
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008650 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008651 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008652 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008653 return( ret );
8654 }
8655
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008656#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008657 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008658 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
8659 {
8660 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
8661 return( ret );
8662 }
8663#endif
8664
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008665 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008666
8667 return( 0 );
8668}
8669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008670#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008671#define SSL_MAX_HASH_LEN 36
8672#else
8673#define SSL_MAX_HASH_LEN 12
8674#endif
8675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008676int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008677{
Paul Bakker23986e52011-04-24 08:57:21 +00008678 int ret;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008679 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008680 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00008681
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008682 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008683
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008684 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8685 mbedtls_ssl_suite_get_mac(
8686 mbedtls_ssl_ciphersuite_from_id(
8687 mbedtls_ssl_session_get_ciphersuite(
8688 ssl->session_negotiate ) ) ),
8689 ssl, buf,
8690 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00008691
Hanno Becker327c93b2018-08-15 13:56:18 +01008692 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008693 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008694 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008695 return( ret );
8696 }
8697
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008698 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00008699 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008700 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008701 mbedtls_ssl_pend_fatal_alert( ssl,
8702 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008703 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008704 }
8705
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008706 /* There is currently no ciphersuite using another length with TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008707#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +01008708 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008709 hash_len = 36;
8710 else
8711#endif
8712 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008713
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008714 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
8715 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00008716 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008718 mbedtls_ssl_pend_fatal_alert( ssl,
8719 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008720 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008721 }
8722
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02008723 if( mbedtls_platform_memequal( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
8724 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008725 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008726 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008727 mbedtls_ssl_pend_fatal_alert( ssl,
8728 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008729 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008730 }
8731
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008732#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008733 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008734 mbedtls_platform_memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008735#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008736
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008737#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008738 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008739 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008740#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008741 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008742 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008743#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008744#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008745 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008746 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008747#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008748 }
8749 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008750#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008751 {
8752 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8753 {
8754 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8755 }
8756 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8757 {
8758 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8759 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008760 else
8761 {
8762 ssl->state = MBEDTLS_SSL_INVALID;
8763 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008764 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008765
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008766#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008767 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008768 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008769#endif
8770
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008771 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008772
8773 return( 0 );
8774}
8775
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008776static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008777{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008778 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008779
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008780#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8781 defined(MBEDTLS_SSL_PROTO_TLS1_1)
8782 mbedtls_md5_init( &handshake->fin_md5 );
8783 mbedtls_sha1_init( &handshake->fin_sha1 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008784 mbedtls_md5_starts_ret( &handshake->fin_md5 );
8785 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008786#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008787#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8788#if defined(MBEDTLS_SHA256_C)
8789 mbedtls_sha256_init( &handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008790 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008791#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008792#if defined(MBEDTLS_SHA512_C)
8793 mbedtls_sha512_init( &handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008794 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008795#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008796#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008797
Hanno Becker7e5437a2017-04-28 17:15:26 +01008798#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
8799 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8800 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
8801#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008802
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008803#if defined(MBEDTLS_DHM_C)
8804 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008805#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008806#if defined(MBEDTLS_ECDH_C)
8807 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008808#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02008809#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008810 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02008811#if defined(MBEDTLS_SSL_CLI_C)
8812 handshake->ecjpake_cache = NULL;
8813 handshake->ecjpake_cache_len = 0;
8814#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008815#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008816
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008817#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02008818 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008819#endif
8820
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008821#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8822 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
8823#endif
Hanno Becker3bf8cdf2019-02-06 16:18:31 +00008824
8825#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
8826 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8827 mbedtls_pk_init( &handshake->peer_pubkey );
8828#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008829}
8830
Hanno Becker611a83b2018-01-03 14:27:32 +00008831void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008832{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008833 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Andrzej Kurek11750442020-09-17 07:12:06 -04008834#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
8835 mbedtls_cipher_init( &transform->cipher_ctx );
8836#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008837 mbedtls_cipher_init( &transform->cipher_ctx_enc );
8838 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -04008839#endif
Paul Bakker84bbeb52014-07-01 14:53:22 +02008840
Hanno Becker92231322018-01-03 15:32:51 +00008841#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008842 mbedtls_md_init( &transform->md_ctx_enc );
8843 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +00008844#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008845}
8846
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008847void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008848{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008849 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008850}
8851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008852static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008853{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008854 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00008855 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008856 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008857 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008858 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008859 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02008860 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008861
8862 /*
8863 * Either the pointers are now NULL or cleared properly and can be freed.
8864 * Now allocate missing structures.
8865 */
8866 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008867 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008868 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008869 }
Paul Bakker48916f92012-09-16 19:57:18 +00008870
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008871 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008872 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008873 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008874 }
Paul Bakker48916f92012-09-16 19:57:18 +00008875
Paul Bakker82788fb2014-10-20 13:59:19 +02008876 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008877 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008878 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008879 }
Paul Bakker48916f92012-09-16 19:57:18 +00008880
Andrzej Kurekf3844952020-10-16 23:03:01 +02008881#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
8882 /* If the buffers are too small - reallocate */
Andrzej Kurekcd9a6ff2020-10-22 11:12:07 +02008883 handle_buffer_resizing( ssl, BUFFER_UPSIZING, MBEDTLS_SSL_IN_BUFFER_LEN,
8884 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurekf3844952020-10-16 23:03:01 +02008885#endif
8886
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008887 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00008888 if( ssl->handshake == NULL ||
8889 ssl->transform_negotiate == NULL ||
8890 ssl->session_negotiate == NULL )
8891 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02008892 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008893
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008894 mbedtls_free( ssl->handshake );
8895 mbedtls_free( ssl->transform_negotiate );
8896 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008897
8898 ssl->handshake = NULL;
8899 ssl->transform_negotiate = NULL;
8900 ssl->session_negotiate = NULL;
8901
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02008902 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00008903 }
8904
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008905 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008906 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Becker611a83b2018-01-03 14:27:32 +00008907 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02008908 ssl_handshake_params_init( ssl->handshake );
8909
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008910#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008911 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008912 {
8913 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008914
Hanno Becker2d9623f2019-06-13 12:07:05 +01008915 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008916 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
8917 else
8918 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
8919 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008920#endif
8921
Paul Bakker48916f92012-09-16 19:57:18 +00008922 return( 0 );
8923}
8924
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008925#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008926/* Dummy cookie callbacks for defaults */
8927static int ssl_cookie_write_dummy( void *ctx,
8928 unsigned char **p, unsigned char *end,
8929 const unsigned char *cli_id, size_t cli_id_len )
8930{
8931 ((void) ctx);
8932 ((void) p);
8933 ((void) end);
8934 ((void) cli_id);
8935 ((void) cli_id_len);
8936
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008937 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008938}
8939
8940static int ssl_cookie_check_dummy( void *ctx,
8941 const unsigned char *cookie, size_t cookie_len,
8942 const unsigned char *cli_id, size_t cli_id_len )
8943{
8944 ((void) ctx);
8945 ((void) cookie);
8946 ((void) cookie_len);
8947 ((void) cli_id);
8948 ((void) cli_id_len);
8949
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008950 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008951}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008952#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008953
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008954/* Once ssl->out_hdr as the address of the beginning of the
8955 * next outgoing record is set, deduce the other pointers.
8956 *
8957 * Note: For TLS, we save the implicit record sequence number
8958 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
8959 * and the caller has to make sure there's space for this.
8960 */
8961
8962static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
8963 mbedtls_ssl_transform *transform )
8964{
8965#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008966 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008967 {
8968 ssl->out_ctr = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008969#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01008970 ssl->out_cid = ssl->out_ctr + 8;
8971 ssl->out_len = ssl->out_cid;
8972 if( transform != NULL )
8973 ssl->out_len += transform->out_cid_len;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008974#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008975 ssl->out_len = ssl->out_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008976#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008977 ssl->out_iv = ssl->out_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008978 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008979 MBEDTLS_SSL_TRANSPORT_ELSE
8980#endif /* MBEDTLS_SSL_PROTO_DTLS */
8981#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008982 {
8983 ssl->out_ctr = ssl->out_hdr - 8;
8984 ssl->out_len = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008985#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01008986 ssl->out_cid = ssl->out_len;
8987#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008988 ssl->out_iv = ssl->out_hdr + 5;
8989 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008990#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008991
8992 /* Adjust out_msg to make space for explicit IV, if used. */
8993 if( transform != NULL &&
Hanno Becker7bcf2b52019-07-26 09:02:40 +01008994 mbedtls_ssl_ver_geq(
8995 mbedtls_ssl_get_minor_ver( ssl ),
8996 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008997 {
8998 ssl->out_msg = ssl->out_iv + transform->ivlen - transform->fixed_ivlen;
8999 }
9000 else
9001 ssl->out_msg = ssl->out_iv;
9002}
9003
9004/* Once ssl->in_hdr as the address of the beginning of the
9005 * next incoming record is set, deduce the other pointers.
9006 *
9007 * Note: For TLS, we save the implicit record sequence number
9008 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
9009 * and the caller has to make sure there's space for this.
9010 */
9011
Hanno Beckerf5970a02019-05-08 09:38:41 +01009012static void ssl_update_in_pointers( mbedtls_ssl_context *ssl )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009013{
Hanno Beckerf5970a02019-05-08 09:38:41 +01009014 /* This function sets the pointers to match the case
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009015 * of unprotected TLS/DTLS records, with ssl->in_msg
9016 * pointing to the beginning of the record content.
Hanno Beckerf5970a02019-05-08 09:38:41 +01009017 *
9018 * When decrypting a protected record, ssl->in_msg
9019 * will be shifted to point to the beginning of the
9020 * record plaintext.
9021 */
9022
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009023#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009024 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009025 {
Hanno Becker70e79282019-05-03 14:34:53 +01009026 /* This sets the header pointers to match records
9027 * without CID. When we receive a record containing
9028 * a CID, the fields are shifted accordingly in
9029 * ssl_parse_record_header(). */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009030 ssl->in_ctr = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009031#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01009032 ssl->in_cid = ssl->in_ctr + 8;
9033 ssl->in_len = ssl->in_cid; /* Default: no CID */
Hanno Beckera5a2b082019-05-15 14:03:01 +01009034#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01009035 ssl->in_len = ssl->in_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009036#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009037 ssl->in_msg = ssl->in_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009038 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009039 MBEDTLS_SSL_TRANSPORT_ELSE
9040#endif /* MBEDTLS_SSL_PROTO_DTLS */
9041#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009042 {
9043 ssl->in_ctr = ssl->in_hdr - 8;
9044 ssl->in_len = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009045#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01009046 ssl->in_cid = ssl->in_len;
9047#endif
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009048 ssl->in_msg = ssl->in_hdr + 5;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009049 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009050#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009051}
9052
Paul Bakker5121ce52009-01-03 21:22:43 +00009053/*
9054 * Initialize an SSL context
9055 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02009056void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
9057{
9058 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
9059}
9060
9061/*
9062 * Setup an SSL context
9063 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009064
9065static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl )
9066{
9067 /* Set the incoming and outgoing record pointers. */
9068#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009069 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009070 {
9071 ssl->out_hdr = ssl->out_buf;
9072 ssl->in_hdr = ssl->in_buf;
9073 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009074 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009075#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009076#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009077 {
9078 ssl->out_hdr = ssl->out_buf + 8;
9079 ssl->in_hdr = ssl->in_buf + 8;
9080 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009081#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009082
9083 /* Derive other internal pointers. */
9084 ssl_update_out_pointers( ssl, NULL /* no transform enabled */ );
Hanno Beckerf5970a02019-05-08 09:38:41 +01009085 ssl_update_in_pointers ( ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009086}
9087
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02009088int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02009089 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00009090{
Paul Bakker48916f92012-09-16 19:57:18 +00009091 int ret;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009092 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
9093 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00009094
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02009095 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00009096
Hanno Beckeref982d52019-07-23 15:56:18 +01009097#if defined(MBEDTLS_USE_TINYCRYPT)
9098 uECC_set_rng( &uecc_rng_wrapper );
9099#endif
9100
Paul Bakker62f2dee2012-09-28 07:31:51 +00009101 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01009102 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00009103 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02009104
9105 /* Set to NULL in case of an error condition */
9106 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02009107
Andrzej Kurekf3844952020-10-16 23:03:01 +02009108#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9109 ssl->in_buf_len = in_buf_len;
9110#endif
9111 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10009112 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009113 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02009114 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", in_buf_len) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02009115 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02009116 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10009117 }
9118
Andrzej Kurekf3844952020-10-16 23:03:01 +02009119#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9120 ssl->out_buf_len = out_buf_len;
9121#endif
9122
9123 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10009124 if( ssl->out_buf == NULL )
9125 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02009126 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", out_buf_len) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02009127 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02009128 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00009129 }
9130
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009131 ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02009132
Paul Bakker48916f92012-09-16 19:57:18 +00009133 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02009134 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00009135
Hanno Beckerc8f52992019-07-25 11:15:08 +01009136 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
Hanno Beckerf46e1ce2019-07-03 13:56:59 +01009137
Paul Bakker5121ce52009-01-03 21:22:43 +00009138 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02009139
9140error:
9141 mbedtls_free( ssl->in_buf );
9142 mbedtls_free( ssl->out_buf );
9143
9144 ssl->conf = NULL;
9145
Andrzej Kurekf3844952020-10-16 23:03:01 +02009146#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9147 ssl->in_buf_len = 0;
9148 ssl->out_buf_len = 0;
9149#endif
9150
k-stachowiaka47911c2018-07-04 17:41:58 +02009151 ssl->in_buf = NULL;
9152 ssl->out_buf = NULL;
9153
9154 ssl->in_hdr = NULL;
9155 ssl->in_ctr = NULL;
9156 ssl->in_len = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02009157 ssl->in_msg = NULL;
9158
9159 ssl->out_hdr = NULL;
9160 ssl->out_ctr = NULL;
9161 ssl->out_len = NULL;
9162 ssl->out_iv = NULL;
9163 ssl->out_msg = NULL;
9164
k-stachowiak9f7798e2018-07-31 16:52:32 +02009165 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00009166}
9167
9168/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00009169 * Reset an initialized and used SSL context for re-use while retaining
9170 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009171 *
9172 * If partial is non-zero, keep data in the input buffer and client ID.
9173 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00009174 */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009175static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00009176{
Paul Bakker48916f92012-09-16 19:57:18 +00009177 int ret;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009178#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9179 size_t in_buf_len = ssl->in_buf_len;
9180 size_t out_buf_len = ssl->out_buf_len;
9181#else
9182 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
9183 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
9184#endif
Paul Bakker48916f92012-09-16 19:57:18 +00009185
Hanno Becker7e772132018-08-10 12:38:21 +01009186#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
9187 !defined(MBEDTLS_SSL_SRV_C)
9188 ((void) partial);
9189#endif
9190
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009191 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009192
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009193 /* Cancel any possibly running timer */
9194 ssl_set_timer( ssl, 0 );
9195
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009196#if defined(MBEDTLS_SSL_RENEGOTIATION)
9197 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009198 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00009199
9200 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02009201 mbedtls_platform_memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
9202 mbedtls_platform_memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009203#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009204 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00009205
Paul Bakker7eb013f2011-10-06 12:37:39 +00009206 ssl->in_offt = NULL;
Hanno Beckerf29d4702018-08-10 11:31:15 +01009207 ssl_reset_in_out_pointers( ssl );
Paul Bakker7eb013f2011-10-06 12:37:39 +00009208
9209 ssl->in_msgtype = 0;
9210 ssl->in_msglen = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009211#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02009212 ssl->next_record_offset = 0;
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02009213 ssl->in_epoch = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02009214#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009215#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02009216 ssl_dtls_replay_reset( ssl );
9217#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00009218
9219 ssl->in_hslen = 0;
9220 ssl->nb_zero = 0;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01009221
9222 ssl->keep_current_message = 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00009223
9224 ssl->out_msgtype = 0;
9225 ssl->out_msglen = 0;
9226 ssl->out_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009227#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
9228 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009229 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009230#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00009231
Hanno Becker19859472018-08-06 09:40:20 +01009232 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
9233
Paul Bakker48916f92012-09-16 19:57:18 +00009234 ssl->transform_in = NULL;
9235 ssl->transform_out = NULL;
Paul Bakker7eb013f2011-10-06 12:37:39 +00009236
Hanno Becker78640902018-08-13 16:35:15 +01009237 ssl->session_in = NULL;
9238 ssl->session_out = NULL;
9239
Andrzej Kurekf3844952020-10-16 23:03:01 +02009240 mbedtls_platform_memset( ssl->out_buf, 0, out_buf_len );
Hanno Becker4ccbf062018-08-10 11:20:38 +01009241
9242#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009243 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01009244#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
9245 {
9246 ssl->in_left = 0;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009247 mbedtls_platform_memset( ssl->in_buf, 0, in_buf_len );
Hanno Becker4ccbf062018-08-10 11:20:38 +01009248 }
Paul Bakker05ef8352012-05-08 09:17:57 +00009249
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009250#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
9251 if( mbedtls_ssl_hw_record_reset != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00009252 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009253 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
9254 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
Paul Bakker2770fbd2012-07-03 13:30:23 +00009255 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009256 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
9257 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00009258 }
Paul Bakker05ef8352012-05-08 09:17:57 +00009259 }
9260#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00009261
Paul Bakker48916f92012-09-16 19:57:18 +00009262 if( ssl->transform )
Paul Bakker2770fbd2012-07-03 13:30:23 +00009263 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009264 mbedtls_ssl_transform_free( ssl->transform );
9265 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00009266 ssl->transform = NULL;
Paul Bakker2770fbd2012-07-03 13:30:23 +00009267 }
Paul Bakker48916f92012-09-16 19:57:18 +00009268
Paul Bakkerc0463502013-02-14 11:19:38 +01009269 if( ssl->session )
9270 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009271 mbedtls_ssl_session_free( ssl->session );
9272 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01009273 ssl->session = NULL;
9274 }
9275
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009276#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009277 ssl->alpn_chosen = NULL;
9278#endif
9279
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02009280#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01009281#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009282 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01009283#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009284 {
9285 mbedtls_free( ssl->cli_id );
9286 ssl->cli_id = NULL;
9287 ssl->cli_id_len = 0;
9288 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02009289#endif
9290
Paul Bakker48916f92012-09-16 19:57:18 +00009291 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
9292 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00009293
9294 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00009295}
9296
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02009297/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009298 * Reset an initialized and used SSL context for re-use while retaining
9299 * all application-set variables, function pointers and data.
9300 */
9301int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
9302{
9303 return( ssl_session_reset_int( ssl, 0 ) );
9304}
9305
9306/*
Paul Bakker5121ce52009-01-03 21:22:43 +00009307 * SSL set accessors
9308 */
Hanno Becker2d9623f2019-06-13 12:07:05 +01009309#if !defined(MBEDTLS_SSL_CONF_ENDPOINT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009310void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00009311{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009312 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00009313}
Hanno Becker2d9623f2019-06-13 12:07:05 +01009314#endif /* MBEDTLS_SSL_CONF_ENDPOINT */
Paul Bakker5121ce52009-01-03 21:22:43 +00009315
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009316void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01009317{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009318 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01009319}
9320
Hanno Becker7f376f42019-06-12 16:20:48 +01009321#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
9322 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009323void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009324{
Hanno Becker7f376f42019-06-12 16:20:48 +01009325 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009326}
Hanno Becker7f376f42019-06-12 16:20:48 +01009327#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY && !MBEDTLS_SSL_CONF_ANTI_REPLAY */
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009328
Hanno Beckerde671542019-06-12 16:30:46 +01009329#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
9330 !defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
9331void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf,
9332 unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009333{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009334 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009335}
Hanno Beckerde671542019-06-12 16:30:46 +01009336#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT && !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009337
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009338#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01009339
Hanno Becker1841b0a2018-08-24 11:13:57 +01009340void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
9341 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01009342{
9343 ssl->disable_datagram_packing = !allow_packing;
9344}
9345
Hanno Becker1f835fa2019-06-13 10:14:59 +01009346#if !( defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX) && \
9347 defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN) )
Hanno Becker04da1892018-08-14 13:22:10 +01009348void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
9349 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009350{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009351 conf->hs_timeout_min = min;
9352 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009353}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009354#else /* !( MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
9355 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX ) */
9356void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
9357 uint32_t min, uint32_t max )
9358{
9359 ((void) conf);
9360 ((void) min);
9361 ((void) max);
9362}
9363#endif /* MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
9364 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
9365
9366#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009367
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009368void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00009369{
Hanno Beckeracd4fc02019-06-12 16:40:50 +01009370#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
9371 conf->authmode = authmode;
9372#else
9373 ((void) conf);
9374 ((void) authmode);
9375#endif /* MBEDTLS_SSL_CONF_AUTHMODE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009376}
9377
Hanno Becker9ec3fe02019-07-01 17:36:12 +01009378#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
9379 !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009380void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02009381 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009382 void *p_vrfy )
9383{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009384 conf->f_vrfy = f_vrfy;
9385 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009386}
Hanno Becker9ec3fe02019-07-01 17:36:12 +01009387#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009388
Hanno Beckerece325c2019-06-13 15:39:27 +01009389#if !defined(MBEDTLS_SSL_CONF_RNG)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009390void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00009391 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00009392 void *p_rng )
9393{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01009394 conf->f_rng = f_rng;
9395 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00009396}
Hanno Beckerece325c2019-06-13 15:39:27 +01009397#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00009398
Hanno Becker14a4a442019-07-02 17:00:34 +01009399#if defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009400void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02009401 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00009402 void *p_dbg )
9403{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009404 conf->f_dbg = f_dbg;
9405 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00009406}
Hanno Becker14a4a442019-07-02 17:00:34 +01009407#endif /* MBEDTLS_DEBUG_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00009408
Hanno Beckera58a8962019-06-13 16:11:15 +01009409#if !defined(MBEDTLS_SSL_CONF_RECV) && \
9410 !defined(MBEDTLS_SSL_CONF_SEND) && \
9411 !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009412void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009413 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00009414 mbedtls_ssl_send_t *f_send,
9415 mbedtls_ssl_recv_t *f_recv,
9416 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009417{
Hanno Beckera58a8962019-06-13 16:11:15 +01009418 ssl->p_bio = p_bio;
9419 ssl->f_send = f_send;
9420 ssl->f_recv = f_recv;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009421 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009422}
Hanno Beckera58a8962019-06-13 16:11:15 +01009423#else
9424void mbedtls_ssl_set_bio_ctx( mbedtls_ssl_context *ssl,
9425 void *p_bio )
9426{
9427 ssl->p_bio = p_bio;
9428}
9429#endif
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009430
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02009431#if defined(MBEDTLS_SSL_PROTO_DTLS)
9432void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
9433{
9434 ssl->mtu = mtu;
9435}
9436#endif
9437
Hanno Becker1f835fa2019-06-13 10:14:59 +01009438#if !defined(MBEDTLS_SSL_CONF_READ_TIMEOUT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009439void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009440{
9441 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009442}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009443#endif /* MBEDTLS_SSL_CONF_READ_TIMEOUT */
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009444
Hanno Becker0ae6b242019-06-13 16:45:36 +01009445#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && \
9446 !defined(MBEDTLS_SSL_CONF_GET_TIMER)
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009447void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
9448 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00009449 mbedtls_ssl_set_timer_t *f_set_timer,
9450 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009451{
9452 ssl->p_timer = p_timer;
9453 ssl->f_set_timer = f_set_timer;
9454 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009455 /* Make sure we start with no timer running */
9456 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009457}
Hanno Becker0ae6b242019-06-13 16:45:36 +01009458#else
9459void mbedtls_ssl_set_timer_cb_ctx( mbedtls_ssl_context *ssl,
9460 void *p_timer )
9461{
9462 ssl->p_timer = p_timer;
9463 /* Make sure we start with no timer running */
9464 ssl_set_timer( ssl, 0 );
9465}
9466#endif
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009467
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009468#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009469void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009470 void *p_cache,
9471 int (*f_get_cache)(void *, mbedtls_ssl_session *),
9472 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
Paul Bakker5121ce52009-01-03 21:22:43 +00009473{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009474 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009475 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009476 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00009477}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009478#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009479
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009480#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009481int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00009482{
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009483 int ret;
9484
9485 if( ssl == NULL ||
9486 session == NULL ||
9487 ssl->session_negotiate == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +01009488 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009489 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009490 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009491 }
9492
Hanno Becker58fccf22019-02-06 14:30:46 +00009493 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
9494 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009495 return( ret );
9496
Jarno Lamsa8d09e572019-12-19 15:20:19 +02009497 ssl->handshake->resume = MBEDTLS_SSL_FI_FLAG_SET;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009498
9499 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00009500}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009501#endif /* MBEDTLS_SSL_CLI_C && !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009502
Hanno Becker73f4cb12019-06-27 13:51:07 +01009503#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009504void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009505 const int *ciphersuites )
Paul Bakker5121ce52009-01-03 21:22:43 +00009506{
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009507 conf->ciphersuite_list[0] = ciphersuites;
9508 conf->ciphersuite_list[1] = ciphersuites;
9509 conf->ciphersuite_list[2] = ciphersuites;
9510 conf->ciphersuite_list[3] = ciphersuites;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009511}
9512
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009513void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02009514 const int *ciphersuites,
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009515 int major, int minor )
9516{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009517 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009518 return;
9519
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009520 if( mbedtls_ssl_ver_lt( minor, MBEDTLS_SSL_MINOR_VERSION_0 ) ||
9521 mbedtls_ssl_ver_gt( minor, MBEDTLS_SSL_MINOR_VERSION_3 ) )
9522 {
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009523 return;
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009524 }
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009525
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009526 conf->ciphersuite_list[mbedtls_ssl_minor_ver_index( minor )] =
9527 ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00009528}
Hanno Becker73f4cb12019-06-27 13:51:07 +01009529#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009530
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009531#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009532void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01009533 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009534{
9535 conf->cert_profile = profile;
9536}
9537
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009538/* Append a new keycert entry to a (possibly empty) list */
9539static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
9540 mbedtls_x509_crt *cert,
9541 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009542{
niisato8ee24222018-06-25 19:05:48 +09009543 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009544
niisato8ee24222018-06-25 19:05:48 +09009545 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
9546 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009547 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009548
niisato8ee24222018-06-25 19:05:48 +09009549 new_cert->cert = cert;
9550 new_cert->key = key;
9551 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009552
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009553 /* Update head is the list was null, else add to the end */
9554 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01009555 {
niisato8ee24222018-06-25 19:05:48 +09009556 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01009557 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009558 else
9559 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009560 mbedtls_ssl_key_cert *cur = *head;
9561 while( cur->next != NULL )
9562 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09009563 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009564 }
9565
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009566 return( 0 );
9567}
9568
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009569int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009570 mbedtls_x509_crt *own_cert,
9571 mbedtls_pk_context *pk_key )
9572{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02009573 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009574}
9575
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009576void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009577 mbedtls_x509_crt *ca_chain,
9578 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009579{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009580 conf->ca_chain = ca_chain;
9581 conf->ca_crl = ca_crl;
Paul Bakker5121ce52009-01-03 21:22:43 +00009582}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009583#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00009584
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009585#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
9586int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
9587 mbedtls_x509_crt *own_cert,
9588 mbedtls_pk_context *pk_key )
9589{
9590 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
9591 own_cert, pk_key ) );
9592}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02009593
9594void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
9595 mbedtls_x509_crt *ca_chain,
9596 mbedtls_x509_crl *ca_crl )
9597{
9598 ssl->handshake->sni_ca_chain = ca_chain;
9599 ssl->handshake->sni_ca_crl = ca_crl;
9600}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02009601
9602void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
9603 int authmode )
9604{
9605 ssl->handshake->sni_authmode = authmode;
9606}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009607#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9608
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009609#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009610/*
9611 * Set EC J-PAKE password for current handshake
9612 */
9613int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
9614 const unsigned char *pw,
9615 size_t pw_len )
9616{
9617 mbedtls_ecjpake_role role;
9618
Janos Follath8eb64132016-06-03 15:40:57 +01009619 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009620 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9621
Hanno Becker2d9623f2019-06-13 12:07:05 +01009622 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009623 role = MBEDTLS_ECJPAKE_SERVER;
9624 else
9625 role = MBEDTLS_ECJPAKE_CLIENT;
9626
9627 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
9628 role,
9629 MBEDTLS_MD_SHA256,
9630 MBEDTLS_ECP_DP_SECP256R1,
9631 pw, pw_len ) );
9632}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009633#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009635#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009636int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009637 const unsigned char *psk, size_t psk_len,
9638 const unsigned char *psk_identity, size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009639{
Paul Bakker6db455e2013-09-18 17:29:31 +02009640 if( psk == NULL || psk_identity == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009641 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker6db455e2013-09-18 17:29:31 +02009642
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009643 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9644 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01009645
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009646 /* Identity len will be encoded on two bytes */
9647 if( ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10009648 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009649 {
9650 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9651 }
9652
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009653 if( conf->psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02009654 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009655 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009656
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009657 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009658 conf->psk = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009659 conf->psk_len = 0;
9660 }
9661 if( conf->psk_identity != NULL )
9662 {
9663 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009664 conf->psk_identity = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009665 conf->psk_identity_len = 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02009666 }
9667
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009668 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
9669 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
Mansour Moufidf81088b2015-02-17 13:10:21 -05009670 {
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009671 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009672 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009673 conf->psk = NULL;
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009674 conf->psk_identity = NULL;
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009675 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Mansour Moufidf81088b2015-02-17 13:10:21 -05009676 }
Paul Bakker6db455e2013-09-18 17:29:31 +02009677
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009678 conf->psk_len = psk_len;
9679 conf->psk_identity_len = psk_identity_len;
Paul Bakker6db455e2013-09-18 17:29:31 +02009680
Teppo Järvelin91d79382019-10-02 09:09:31 +03009681 mbedtls_platform_memcpy( conf->psk, psk, conf->psk_len );
9682 mbedtls_platform_memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker6db455e2013-09-18 17:29:31 +02009683
9684 return( 0 );
9685}
9686
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009687int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
9688 const unsigned char *psk, size_t psk_len )
9689{
9690 if( psk == NULL || ssl->handshake == NULL )
9691 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9692
9693 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9694 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9695
9696 if( ssl->handshake->psk != NULL )
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009697 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009698 mbedtls_platform_zeroize( ssl->handshake->psk,
9699 ssl->handshake->psk_len );
Simon Butcher5b8d1d62015-10-04 22:06:51 +01009700 mbedtls_free( ssl->handshake->psk );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009701 ssl->handshake->psk_len = 0;
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009702 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009703
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009704 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009705 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009706
9707 ssl->handshake->psk_len = psk_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03009708 mbedtls_platform_memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009709
9710 return( 0 );
9711}
9712
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009713void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009714 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02009715 size_t),
9716 void *p_psk )
9717{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009718 conf->f_psk = f_psk;
9719 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009720}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009721#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00009722
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009723#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker470a8c42017-10-04 15:28:46 +01009724
9725#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009726int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
Paul Bakker5121ce52009-01-03 21:22:43 +00009727{
9728 int ret;
9729
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009730 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
9731 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
9732 {
9733 mbedtls_mpi_free( &conf->dhm_P );
9734 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker5121ce52009-01-03 21:22:43 +00009735 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009736 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009737
9738 return( 0 );
9739}
Hanno Becker470a8c42017-10-04 15:28:46 +01009740#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker5121ce52009-01-03 21:22:43 +00009741
Hanno Beckera90658f2017-10-04 15:29:08 +01009742int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
9743 const unsigned char *dhm_P, size_t P_len,
9744 const unsigned char *dhm_G, size_t G_len )
9745{
9746 int ret;
9747
9748 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
9749 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
9750 {
9751 mbedtls_mpi_free( &conf->dhm_P );
9752 mbedtls_mpi_free( &conf->dhm_G );
9753 return( ret );
9754 }
9755
9756 return( 0 );
9757}
Paul Bakker5121ce52009-01-03 21:22:43 +00009758
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009759int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00009760{
9761 int ret;
9762
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009763 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
9764 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
9765 {
9766 mbedtls_mpi_free( &conf->dhm_P );
9767 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00009768 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009769 }
Paul Bakker1b57b062011-01-06 15:48:19 +00009770
9771 return( 0 );
9772}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009773#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00009774
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02009775#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
9776/*
9777 * Set the minimum length for Diffie-Hellman parameters
9778 */
9779void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
9780 unsigned int bitlen )
9781{
9782 conf->dhm_min_bitlen = bitlen;
9783}
9784#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
9785
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009786#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009787/*
9788 * Set allowed/preferred hashes for handshake signatures
9789 */
9790void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
9791 const int *hashes )
9792{
Hanno Becker56595f42019-06-19 16:31:38 +01009793#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009794 conf->sig_hashes = hashes;
Hanno Becker56595f42019-06-19 16:31:38 +01009795#else
9796 ((void) conf);
9797 ((void) hashes);
9798#endif /* MBEDTLS_SSL_CONF_SINGLE_SIG_HASH */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009799}
Hanno Becker947194e2017-04-07 13:25:49 +01009800#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009801
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02009802#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +01009803#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009804/*
9805 * Set the allowed elliptic curves
9806 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009807void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009808 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009809{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009810 conf->curve_list = curve_list;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009811}
Hanno Beckerc1096e72019-06-19 12:30:41 +01009812#endif /* MBEDTLS_SSL_CONF_SINGLE_EC */
Hanno Becker947194e2017-04-07 13:25:49 +01009813#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009814
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009815#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009816int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00009817{
Hanno Becker947194e2017-04-07 13:25:49 +01009818 /* Initialize to suppress unnecessary compiler warning */
9819 size_t hostname_len = 0;
9820
9821 /* Check if new hostname is valid before
9822 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01009823 if( hostname != NULL )
9824 {
9825 hostname_len = strlen( hostname );
9826
9827 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
9828 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9829 }
9830
9831 /* Now it's clear that we will overwrite the old hostname,
9832 * so we can free it safely */
9833
9834 if( ssl->hostname != NULL )
9835 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009836 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01009837 mbedtls_free( ssl->hostname );
9838 }
9839
9840 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01009841
Paul Bakker5121ce52009-01-03 21:22:43 +00009842 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01009843 {
9844 ssl->hostname = NULL;
9845 }
9846 else
9847 {
9848 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01009849 if( ssl->hostname == NULL )
9850 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009851
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03009852 /* Not using more secure mbedtls_platform_memcpy as hostname is public in initial handshake */
9853 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009854
Hanno Becker947194e2017-04-07 13:25:49 +01009855 ssl->hostname[hostname_len] = '\0';
9856 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009857
9858 return( 0 );
9859}
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009860#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009861
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009862#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009863void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009864 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00009865 const unsigned char *, size_t),
9866 void *p_sni )
9867{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009868 conf->f_sni = f_sni;
9869 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00009870}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009871#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00009872
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009873#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009874int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009875{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009876 size_t cur_len, tot_len;
9877 const char **p;
9878
9879 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08009880 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
9881 * MUST NOT be truncated."
9882 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009883 */
9884 tot_len = 0;
9885 for( p = protos; *p != NULL; p++ )
9886 {
9887 cur_len = strlen( *p );
9888 tot_len += cur_len;
9889
9890 if( cur_len == 0 || cur_len > 255 || tot_len > 65535 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009891 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009892 }
9893
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009894 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009895
9896 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009897}
9898
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009899const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009900{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02009901 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009902}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009903#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009904
Hanno Becker33b9b252019-07-05 11:23:25 +01009905#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || \
9906 !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
9907void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf,
9908 int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00009909{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009910 conf->max_major_ver = major;
9911 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00009912}
Hanno Becker33b9b252019-07-05 11:23:25 +01009913#endif /* MBEDTLS_SSL_CONF_MAX_MINOR_VER ||
9914 MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
Paul Bakker490ecc82011-10-06 13:04:09 +00009915
Hanno Becker33b9b252019-07-05 11:23:25 +01009916#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || \
9917 !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
9918void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf,
9919 int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00009920{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009921 conf->min_major_ver = major;
9922 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00009923}
Hanno Becker33b9b252019-07-05 11:23:25 +01009924#endif /* MBEDTLS_SSL_CONF_MIN_MINOR_VER ||
9925 MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
Paul Bakker1d29fb52012-09-28 13:28:45 +00009926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009927#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009928void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009929{
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01009930 conf->fallback = fallback;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009931}
9932#endif
9933
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +01009934#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +01009935void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
9936 char cert_req_ca_list )
9937{
9938 conf->cert_req_ca_list = cert_req_ca_list;
9939}
9940#endif
9941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009942#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009943void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009944{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009945 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009946}
9947#endif
9948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009949#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckerf765ce62019-06-21 13:17:14 +01009950#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009951void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009952{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009953 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009954}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009955#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
9956#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009957void mbedtls_ssl_conf_extended_master_secret_enforce( mbedtls_ssl_config *conf,
Jarno Lamsa842be162019-06-10 15:05:33 +03009958 char ems_enf )
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009959{
9960 conf->enforce_extended_master_secret = ems_enf;
9961}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009962#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Hanno Beckeraabbb582019-06-11 13:43:27 +01009963#endif /* !MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009964
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009965#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009966void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009967{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009968 conf->arc4_disabled = arc4;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009969}
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009970#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009971
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009972#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009973int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009974{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009975 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10009976 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009977 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009978 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009979 }
9980
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01009981 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009982
9983 return( 0 );
9984}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009985#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009986
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009987#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009988void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009989{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009990 conf->trunc_hmac = truncate;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009991}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009992#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009994#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009995void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009996{
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01009997 conf->cbc_record_splitting = split;
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009998}
9999#endif
10000
Hanno Beckerb0b2b672019-06-12 16:58:10 +010010001#if !defined(MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010002void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +000010003{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010004 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +000010005}
Hanno Beckerb0b2b672019-06-12 16:58:10 +010010006#endif /* !MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000010007
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010008#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010009void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +010010010{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010011 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +010010012}
10013
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010014void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020010015{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010016 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020010017}
10018
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010019void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +010010020 const unsigned char period[8] )
10021{
Teppo Järvelin91d79382019-10-02 09:09:31 +030010022 mbedtls_platform_memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +010010023}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010024#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000010025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010026#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010027#if defined(MBEDTLS_SSL_CLI_C)
10028void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010029{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +010010030 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010031}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010032#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +020010033
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010034#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +020010035void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
10036 mbedtls_ssl_ticket_write_t *f_ticket_write,
10037 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
10038 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +020010039{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +020010040 conf->f_ticket_write = f_ticket_write;
10041 conf->f_ticket_parse = f_ticket_parse;
10042 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +020010043}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010044#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010045#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010046
Robert Cragie4feb7ae2015-10-02 13:33:37 +010010047#if defined(MBEDTLS_SSL_EXPORT_KEYS)
10048void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
10049 mbedtls_ssl_export_keys_t *f_export_keys,
10050 void *p_export_keys )
10051{
10052 conf->f_export_keys = f_export_keys;
10053 conf->p_export_keys = p_export_keys;
10054}
10055#endif
10056
Gilles Peskineb74a1c72018-04-24 13:09:22 +020010057#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010058void mbedtls_ssl_conf_async_private_cb(
10059 mbedtls_ssl_config *conf,
10060 mbedtls_ssl_async_sign_t *f_async_sign,
10061 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
10062 mbedtls_ssl_async_resume_t *f_async_resume,
10063 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010064 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010065{
10066 conf->f_async_sign_start = f_async_sign;
10067 conf->f_async_decrypt_start = f_async_decrypt;
10068 conf->f_async_resume = f_async_resume;
10069 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010070 conf->p_async_config_data = async_config_data;
10071}
10072
Gilles Peskine8f97af72018-04-26 11:46:10 +020010073void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
10074{
10075 return( conf->p_async_config_data );
10076}
10077
Gilles Peskine1febfef2018-04-30 11:54:39 +020010078void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010079{
10080 if( ssl->handshake == NULL )
10081 return( NULL );
10082 else
10083 return( ssl->handshake->user_async_ctx );
10084}
10085
Gilles Peskine1febfef2018-04-30 11:54:39 +020010086void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010087 void *ctx )
10088{
10089 if( ssl->handshake != NULL )
10090 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010091}
Gilles Peskineb74a1c72018-04-24 13:09:22 +020010092#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010093
Paul Bakker5121ce52009-01-03 21:22:43 +000010094/*
10095 * SSL get accessors
10096 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010097size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010098{
10099 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
10100}
10101
Hanno Becker8b170a02017-10-10 11:51:19 +010010102int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
10103{
10104 /*
10105 * Case A: We're currently holding back
10106 * a message for further processing.
10107 */
10108
10109 if( ssl->keep_current_message == 1 )
10110 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010111 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010112 return( 1 );
10113 }
10114
10115 /*
10116 * Case B: Further records are pending in the current datagram.
10117 */
10118
10119#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010120 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker8b170a02017-10-10 11:51:19 +010010121 ssl->in_left > ssl->next_record_offset )
10122 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010123 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010124 return( 1 );
10125 }
10126#endif /* MBEDTLS_SSL_PROTO_DTLS */
10127
10128 /*
10129 * Case C: A handshake message is being processed.
10130 */
10131
Hanno Becker8b170a02017-10-10 11:51:19 +010010132 if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
10133 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010134 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010135 return( 1 );
10136 }
10137
10138 /*
10139 * Case D: An application data message is being processed
10140 */
10141 if( ssl->in_offt != NULL )
10142 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010143 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010144 return( 1 );
10145 }
10146
10147 /*
10148 * In all other cases, the rest of the message can be dropped.
Hanno Beckerc573ac32018-08-28 17:15:25 +010010149 * As in ssl_get_next_record, this needs to be adapted if
Hanno Becker8b170a02017-10-10 11:51:19 +010010150 * we implement support for multiple alerts in single records.
10151 */
10152
10153 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
10154 return( 0 );
10155}
10156
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020010157uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010158{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +000010159 if( ssl->session != NULL )
10160 return( ssl->session->verify_result );
10161
10162 if( ssl->session_negotiate != NULL )
10163 return( ssl->session_negotiate->verify_result );
10164
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +020010165 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +000010166}
10167
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010168const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +000010169{
Hanno Beckere02758c2019-06-26 15:31:31 +010010170 int suite;
10171
Paul Bakker926c8e42013-03-06 10:23:34 +010010172 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010173 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +010010174
Hanno Beckere02758c2019-06-26 15:31:31 +010010175 suite = mbedtls_ssl_session_get_ciphersuite( ssl->session );
10176 return( mbedtls_ssl_get_ciphersuite_name( suite ) );
Paul Bakker72f62662011-01-16 21:27:44 +000010177}
10178
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010179const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +000010180{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010181#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010182 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010183 {
Hanno Becker2881d802019-05-22 14:44:53 +010010184 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010185 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010186 case MBEDTLS_SSL_MINOR_VERSION_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010187 return( "DTLSv1.0" );
10188
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010189 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010190 return( "DTLSv1.2" );
10191
10192 default:
10193 return( "unknown (DTLS)" );
10194 }
10195 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010196 MBEDTLS_SSL_TRANSPORT_ELSE
10197#endif /* MBEDTLS_SSL_PROTO_DTLS */
10198#if defined(MBEDTLS_SSL_PROTO_TLS)
Paul Bakker43ca69c2011-01-15 17:35:19 +000010199 {
Hanno Becker2881d802019-05-22 14:44:53 +010010200 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010201 {
10202 case MBEDTLS_SSL_MINOR_VERSION_0:
10203 return( "SSLv3.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010204
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010205 case MBEDTLS_SSL_MINOR_VERSION_1:
10206 return( "TLSv1.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010207
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010208 case MBEDTLS_SSL_MINOR_VERSION_2:
10209 return( "TLSv1.1" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010210
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010211 case MBEDTLS_SSL_MINOR_VERSION_3:
10212 return( "TLSv1.2" );
Paul Bakker1ef83d62012-04-11 12:09:53 +000010213
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010214 default:
10215 return( "unknown" );
10216 }
Paul Bakker43ca69c2011-01-15 17:35:19 +000010217 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010218#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker43ca69c2011-01-15 17:35:19 +000010219}
10220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010221int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010222{
Hanno Becker3136ede2018-08-17 15:28:19 +010010223 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010224 const mbedtls_ssl_transform *transform = ssl->transform_out;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010225
Hanno Becker43395762019-05-03 14:46:38 +010010226 size_t out_hdr_len = mbedtls_ssl_out_hdr_len( ssl );
10227
Hanno Becker78640902018-08-13 16:35:15 +010010228 if( transform == NULL )
Hanno Becker43395762019-05-03 14:46:38 +010010229 return( (int) out_hdr_len );
Hanno Becker78640902018-08-13 16:35:15 +010010230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010231#if defined(MBEDTLS_ZLIB_SUPPORT)
10232 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
10233 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010234#endif
Andrzej Kurek11750442020-09-17 07:12:06 -040010235#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
10236 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx ) )
10237#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010238 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Andrzej Kurek11750442020-09-17 07:12:06 -040010239#endif
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010240 {
Hanno Beckera9d5c452019-07-25 16:47:12 +010010241#if defined(MBEDTLS_GCM_C) || \
10242 defined(MBEDTLS_CCM_C) || \
10243 defined(MBEDTLS_CHACHAPOLY_C)
10244#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010245 case MBEDTLS_MODE_GCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010246#endif
10247#if defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010248 case MBEDTLS_MODE_CCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010249#endif
10250#if defined(MBEDTLS_CHACHAPOLY_C)
Hanno Becker5b559ac2018-08-03 09:40:07 +010010251 case MBEDTLS_MODE_CHACHAPOLY:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010252#endif
10253 transform_expansion =
10254 transform->ivlen - transform->fixed_ivlen + transform->taglen;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010255 break;
10256
Hanno Beckera9d5c452019-07-25 16:47:12 +010010257#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C ||
10258 MBEDTLS_CHACHAPOLY_C */
10259
10260#if defined(MBEDTLS_CIPHER_MODE_STREAM)
10261 case MBEDTLS_MODE_STREAM:
10262 transform_expansion = transform->maclen;
10263 break;
10264#endif /* MBEDTLS_CIPHER_MODE_STREAM */
10265
10266#if defined(MBEDTLS_CIPHER_MODE_CBC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010267 case MBEDTLS_MODE_CBC:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010268 {
10269 size_t block_size;
Andrzej Kurek11750442020-09-17 07:12:06 -040010270#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
10271 block_size = mbedtls_cipher_get_block_size(
10272 &transform->cipher_ctx );
10273#else
Hanno Becker5b559ac2018-08-03 09:40:07 +010010274 block_size = mbedtls_cipher_get_block_size(
10275 &transform->cipher_ctx_enc );
Andrzej Kurek11750442020-09-17 07:12:06 -040010276#endif
Hanno Becker3136ede2018-08-17 15:28:19 +010010277 /* Expansion due to the addition of the MAC. */
10278 transform_expansion += transform->maclen;
10279
10280 /* Expansion due to the addition of CBC padding;
10281 * Theoretically up to 256 bytes, but we never use
10282 * more than the block size of the underlying cipher. */
10283 transform_expansion += block_size;
10284
10285 /* For TLS 1.1 or higher, an explicit IV is added
10286 * after the record header. */
Hanno Becker5b559ac2018-08-03 09:40:07 +010010287#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010010288 if( mbedtls_ssl_ver_geq(
10289 mbedtls_ssl_get_minor_ver( ssl ),
10290 MBEDTLS_SSL_MINOR_VERSION_2 ) )
10291 {
Hanno Becker3136ede2018-08-17 15:28:19 +010010292 transform_expansion += block_size;
Hanno Becker7bcf2b52019-07-26 09:02:40 +010010293 }
Hanno Becker5b559ac2018-08-03 09:40:07 +010010294#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker3136ede2018-08-17 15:28:19 +010010295
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010296 break;
Hanno Beckera9d5c452019-07-25 16:47:12 +010010297 }
10298#endif /* MBEDTLS_CIPHER_MODE_CBC */
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010299
10300 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020010301 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010302 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010303 }
10304
Hanno Beckera5a2b082019-05-15 14:03:01 +010010305#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckeradd01902019-05-08 15:40:11 +010010306 if( transform->out_cid_len != 0 )
10307 transform_expansion += MBEDTLS_SSL_MAX_CID_EXPANSION;
Hanno Beckera5a2b082019-05-15 14:03:01 +010010308#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckeradd01902019-05-08 15:40:11 +010010309
Hanno Becker43395762019-05-03 14:46:38 +010010310 return( (int)( out_hdr_len + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010311}
10312
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010313#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +020010314size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
10315{
10316 size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
10317 size_t read_mfl;
10318
10319 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
10320 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
10321 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
10322 {
10323 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
10324 }
10325
10326 /* Check if a smaller max length was negotiated */
10327 if( ssl->session_out != NULL )
10328 {
10329 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
10330 if( read_mfl < max_len )
10331 {
10332 max_len = read_mfl;
10333 }
10334 }
10335
10336 // During a handshake, use the value being negotiated
10337 if( ssl->session_negotiate != NULL )
10338 {
10339 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
10340 if( read_mfl < max_len )
10341 {
10342 max_len = read_mfl;
10343 }
10344 }
10345
10346 return( max_len );
10347}
10348
10349size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010350{
10351 size_t max_len;
10352
10353 /*
10354 * Assume mfl_code is correct since it was checked when set
10355 */
Angus Grattond8213d02016-05-25 20:56:48 +100010356 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010357
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +020010358 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010359 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +100010360 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010361 {
Angus Grattond8213d02016-05-25 20:56:48 +100010362 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010363 }
10364
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +020010365 /* During a handshake, use the value being negotiated */
10366 if( ssl->session_negotiate != NULL &&
10367 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
10368 {
10369 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
10370 }
10371
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010372 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010373}
Andrzej Kurekf3844952020-10-16 23:03:01 +020010374
10375#if !defined(MBEDTLS_DEPRECATED_REMOVED)
10376size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
10377{
10378 return mbedtls_ssl_get_output_max_frag_len( ssl );
10379}
10380#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010381#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10382
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010383#if defined(MBEDTLS_SSL_PROTO_DTLS)
10384static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
10385{
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010386 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
Hanno Becker2d9623f2019-06-13 12:07:05 +010010387 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT &&
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010388 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
10389 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010390 return( 0 );
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010391
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010392 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
10393 return( ssl->mtu );
10394
10395 if( ssl->mtu == 0 )
10396 return( ssl->handshake->mtu );
10397
10398 return( ssl->mtu < ssl->handshake->mtu ?
10399 ssl->mtu : ssl->handshake->mtu );
10400}
10401#endif /* MBEDTLS_SSL_PROTO_DTLS */
10402
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010403int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
10404{
10405 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
10406
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +020010407#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
10408 !defined(MBEDTLS_SSL_PROTO_DTLS)
10409 (void) ssl;
10410#endif
10411
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010412#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +020010413 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010414
10415 if( max_len > mfl )
10416 max_len = mfl;
10417#endif
10418
10419#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010420 if( ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010421 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010422 const size_t mtu = ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010423 const int ret = mbedtls_ssl_get_record_expansion( ssl );
10424 const size_t overhead = (size_t) ret;
10425
10426 if( ret < 0 )
10427 return( ret );
10428
10429 if( mtu <= overhead )
10430 {
10431 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
10432 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
10433 }
10434
10435 if( max_len > mtu - overhead )
10436 max_len = mtu - overhead;
10437 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010438#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010439
Hanno Becker0defedb2018-08-10 12:35:02 +010010440#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
10441 !defined(MBEDTLS_SSL_PROTO_DTLS)
10442 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010443#endif
10444
10445 return( (int) max_len );
10446}
10447
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010448#if defined(MBEDTLS_X509_CRT_PARSE_C)
10449const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +000010450{
10451 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010452 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +000010453
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010454#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010455 return( ssl->session->peer_cert );
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010456#else
10457 return( NULL );
10458#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010459}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010460#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010461
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010462#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker933b9fc2019-02-05 11:42:30 +000010463int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
10464 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010465{
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010466 if( ssl == NULL ||
10467 dst == NULL ||
10468 ssl->session == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +010010469 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010470 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010471 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010472 }
10473
Hanno Becker58fccf22019-02-06 14:30:46 +000010474 return( mbedtls_ssl_session_copy( dst, ssl->session ) );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010475}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010476#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010477
Manuel Pégourié-Gonnard37a53242019-05-20 11:12:28 +020010478const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl )
10479{
10480 if( ssl == NULL )
10481 return( NULL );
10482
10483 return( ssl->session );
10484}
10485
Paul Bakker5121ce52009-01-03 21:22:43 +000010486/*
Hanno Beckerb5352f02019-05-16 12:39:07 +010010487 * Define ticket header determining Mbed TLS version
10488 * and structure of the ticket.
10489 */
10490
Hanno Becker41527622019-05-16 12:50:45 +010010491/*
Hanno Becker26829e92019-05-28 14:30:45 +010010492 * Define bitflag determining compile-time settings influencing
10493 * structure of serialized SSL sessions.
Hanno Becker41527622019-05-16 12:50:45 +010010494 */
10495
Hanno Becker26829e92019-05-28 14:30:45 +010010496#if defined(MBEDTLS_HAVE_TIME)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010497#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker26829e92019-05-28 14:30:45 +010010498#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010499#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker41527622019-05-16 12:50:45 +010010500#endif /* MBEDTLS_HAVE_TIME */
10501
10502#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010503#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker41527622019-05-16 12:50:45 +010010504#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010505#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker41527622019-05-16 12:50:45 +010010506#endif /* MBEDTLS_X509_CRT_PARSE_C */
10507
10508#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010509#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker41527622019-05-16 12:50:45 +010010510#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010511#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker41527622019-05-16 12:50:45 +010010512#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
10513
10514#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010515#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker41527622019-05-16 12:50:45 +010010516#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010517#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker41527622019-05-16 12:50:45 +010010518#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10519
10520#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010521#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 1
Hanno Becker41527622019-05-16 12:50:45 +010010522#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010523#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 0
Hanno Becker41527622019-05-16 12:50:45 +010010524#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
10525
10526#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010527#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker41527622019-05-16 12:50:45 +010010528#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010529#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker41527622019-05-16 12:50:45 +010010530#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
10531
Hanno Becker41527622019-05-16 12:50:45 +010010532#if defined(MBEDTLS_SSL_SESSION_TICKETS)
10533#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
10534#else
10535#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
10536#endif /* MBEDTLS_SSL_SESSION_TICKETS */
10537
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010538#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
10539#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 1
10540#else
10541#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 0
10542#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10543
Hanno Becker88440552019-07-03 14:16:13 +010010544#if defined(MBEDTLS_ZLIB_SUPPORT)
10545#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 1
10546#else
10547#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 0
10548#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10549
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010550#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
10551#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
10552#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
10553#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
10554#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT 4
10555#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 5
10556#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 6
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010557#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT 7
Hanno Becker88440552019-07-03 14:16:13 +010010558#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT 8
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010559
Hanno Becker26829e92019-05-28 14:30:45 +010010560#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010561 ( (uint16_t) ( \
10562 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
10563 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
10564 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
10565 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
10566 ( SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC << SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT ) | \
10567 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010568 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) | \
Hanno Becker88440552019-07-03 14:16:13 +010010569 ( SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION << SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010570 ( SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT << SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT ) ) )
Hanno Becker41527622019-05-16 12:50:45 +010010571
Hanno Becker557fe9f2019-05-16 12:41:07 +010010572static unsigned char ssl_serialized_session_header[] = {
Hanno Becker41527622019-05-16 12:50:45 +010010573 MBEDTLS_VERSION_MAJOR,
10574 MBEDTLS_VERSION_MINOR,
10575 MBEDTLS_VERSION_PATCH,
Hanno Becker26829e92019-05-28 14:30:45 +010010576 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
10577 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Hanno Becker557fe9f2019-05-16 12:41:07 +010010578};
Hanno Beckerb5352f02019-05-16 12:39:07 +010010579
10580/*
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010581 * Serialize a session in the following format:
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010582 * (in the presentation language of TLS, RFC 8446 section 3)
10583 *
Hanno Becker26829e92019-05-28 14:30:45 +010010584 * opaque mbedtls_version[3]; // major, minor, patch
10585 * opaque session_format[2]; // version-specific 16-bit field determining
10586 * // the format of the remaining
10587 * // serialized data.
Hanno Beckerb36db4f2019-05-29 11:08:00 +010010588 *
10589 * Note: When updating the format, remember to keep
10590 * these version+format bytes.
10591 *
Hanno Becker7bf77102019-06-04 09:43:16 +010010592 * // In this version, `session_format` determines
10593 * // the setting of those compile-time
10594 * // configuration options which influence
Hanno Becker26829e92019-05-28 14:30:45 +010010595 * // the structure of mbedtls_ssl_session.
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010596 * uint64 start_time;
Hanno Becker26829e92019-05-28 14:30:45 +010010597 * uint8 ciphersuite[2]; // defined by the standard
10598 * uint8 compression; // 0 or 1
10599 * uint8 session_id_len; // at most 32
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010600 * opaque session_id[32];
Hanno Becker26829e92019-05-28 14:30:45 +010010601 * opaque master[48]; // fixed length in the standard
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010602 * uint32 verify_result;
Hanno Becker0528f822019-06-18 12:45:31 +010010603 * select (MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) {
10604 * case enabled: opaque peer_cert<0..2^24-1>; // length 0 means no cert
10605 * case disabled: uint8_t peer_cert_digest_type;
10606 * opaque peer_cert_digest<0..2^8-1>;
10607 * }
Hanno Becker26829e92019-05-28 14:30:45 +010010608 * opaque ticket<0..2^24-1>; // length 0 means no ticket
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010609 * uint32 ticket_lifetime;
Hanno Becker26829e92019-05-28 14:30:45 +010010610 * uint8 mfl_code; // up to 255 according to standard
10611 * uint8 trunc_hmac; // 0 or 1
10612 * uint8 encrypt_then_mac; // 0 or 1
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010613 *
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010614 * The order is the same as in the definition of the structure, except
10615 * verify_result is put before peer_cert so that all mandatory fields come
10616 * together in one block.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010617 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010618static int ssl_session_save( const mbedtls_ssl_session *session,
10619 unsigned char omit_header,
10620 unsigned char *buf,
10621 size_t buf_len,
10622 size_t *olen )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010623{
10624 unsigned char *p = buf;
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010625 size_t used = 0;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010626#if defined(MBEDTLS_HAVE_TIME)
10627 uint64_t start;
10628#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010629#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010630#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010631 size_t cert_len;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010632#endif
Hanno Becker2e6d3472019-02-06 15:40:27 +000010633#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010634
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010635 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010636 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010637 /*
10638 * Add version identifier
10639 */
10640
10641 used += sizeof( ssl_serialized_session_header );
10642
10643 if( used <= buf_len )
10644 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010645 mbedtls_platform_memcpy( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010646 sizeof( ssl_serialized_session_header ) );
10647 p += sizeof( ssl_serialized_session_header );
10648 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010649 }
10650
10651 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010652 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010653 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010654#if defined(MBEDTLS_HAVE_TIME)
10655 used += 8;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010656
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010657 if( used <= buf_len )
10658 {
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010659 start = (uint64_t) session->start;
10660
10661 *p++ = (unsigned char)( ( start >> 56 ) & 0xFF );
10662 *p++ = (unsigned char)( ( start >> 48 ) & 0xFF );
10663 *p++ = (unsigned char)( ( start >> 40 ) & 0xFF );
10664 *p++ = (unsigned char)( ( start >> 32 ) & 0xFF );
10665 *p++ = (unsigned char)( ( start >> 24 ) & 0xFF );
10666 *p++ = (unsigned char)( ( start >> 16 ) & 0xFF );
10667 *p++ = (unsigned char)( ( start >> 8 ) & 0xFF );
10668 *p++ = (unsigned char)( ( start ) & 0xFF );
10669 }
10670#endif /* MBEDTLS_HAVE_TIME */
10671
10672 /*
10673 * Basic mandatory fields
10674 */
Hanno Becker88440552019-07-03 14:16:13 +010010675 {
10676 size_t const ciphersuite_len = 2;
10677#if defined(MBEDTLS_ZLIB_SUPPORT)
10678 size_t const compression_len = 1;
10679#else
10680 size_t const compression_len = 0;
10681#endif
10682 size_t const id_len_len = 1;
10683 size_t const id_len = 32;
10684 size_t const master_len = 48;
10685 size_t const verif_result_len = 4;
10686
10687 size_t const basic_len =
10688 ciphersuite_len +
10689 compression_len +
10690 id_len_len +
10691 id_len +
10692 master_len +
10693 verif_result_len;
10694
10695 used += basic_len;
10696 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010697
10698 if( used <= buf_len )
10699 {
Hanno Beckere02758c2019-06-26 15:31:31 +010010700 const int ciphersuite =
10701 mbedtls_ssl_session_get_ciphersuite( session );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010702 p = mbedtls_platform_put_uint16_be( p, ciphersuite );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010703
Hanno Becker88440552019-07-03 14:16:13 +010010704#if defined(MBEDTLS_ZLIB_SUPPORT)
10705 *p++ = (unsigned char)(
10706 mbedtls_ssl_session_get_compression( session ) );
10707#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010708
10709 *p++ = (unsigned char)( session->id_len & 0xFF );
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010710 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10711 memcpy( p, session->id, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010712 p += 32;
10713
Teppo Järvelin91d79382019-10-02 09:09:31 +030010714 mbedtls_platform_memcpy( p, session->master, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010715 p += 48;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010716 p = mbedtls_platform_put_uint32_be( p, session->verify_result );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010717 }
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010718
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010719 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010720 * Peer's end-entity certificate
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010721 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010722#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010723#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010724 if( session->peer_cert == NULL )
10725 cert_len = 0;
10726 else
10727 cert_len = session->peer_cert->raw.len;
10728
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010729 used += 3 + cert_len;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010730
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010731 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010732 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010733 p = mbedtls_platform_put_uint24_be( p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010734
10735 if( session->peer_cert != NULL )
10736 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010737 mbedtls_platform_memcpy( p, session->peer_cert->raw.p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010738 p += cert_len;
10739 }
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010740 }
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010741
Hanno Becker5882dd02019-06-06 16:25:57 +010010742#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010743 /* Digest of peer certificate */
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010744 if( session->peer_cert_digest != NULL )
10745 {
10746 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
10747 if( used <= buf_len )
10748 {
10749 *p++ = (unsigned char) session->peer_cert_digest_type;
10750 *p++ = (unsigned char) session->peer_cert_digest_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +030010751 mbedtls_platform_memcpy( p, session->peer_cert_digest,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010752 session->peer_cert_digest_len );
10753 p += session->peer_cert_digest_len;
10754 }
10755 }
10756 else
10757 {
10758 used += 2;
10759 if( used <= buf_len )
10760 {
10761 *p++ = (unsigned char) MBEDTLS_MD_NONE;
10762 *p++ = 0;
10763 }
10764 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010765#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010766#endif /* MBEDTLS_X509_CRT_PARSE_C */
10767
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010768 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010769 * Session ticket if any, plus associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010770 */
10771#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010772 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010773
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010774 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010775 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010776 p = mbedtls_platform_put_uint24_be( p, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010777
10778 if( session->ticket != NULL )
10779 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010780 mbedtls_platform_memcpy( p, session->ticket, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010781 p += session->ticket_len;
10782 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010783
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010784 p = mbedtls_platform_put_uint32_be( p, session->ticket_lifetime );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010785 }
10786#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
10787
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010788 /*
10789 * Misc extension-related info
10790 */
10791#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
10792 used += 1;
10793
10794 if( used <= buf_len )
10795 *p++ = session->mfl_code;
10796#endif
10797
10798#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
10799 used += 1;
10800
10801 if( used <= buf_len )
10802 *p++ = (unsigned char)( ( session->trunc_hmac ) & 0xFF );
10803#endif
10804
10805#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
10806 used += 1;
10807
10808 if( used <= buf_len )
10809 *p++ = (unsigned char)( ( session->encrypt_then_mac ) & 0xFF );
10810#endif
10811
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010812 /* Done */
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010813 *olen = used;
10814
10815 if( used > buf_len )
10816 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010817
10818 return( 0 );
10819}
10820
10821/*
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010822 * Public wrapper for ssl_session_save()
10823 */
10824int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
10825 unsigned char *buf,
10826 size_t buf_len,
10827 size_t *olen )
10828{
10829 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
10830}
10831
10832/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020010833 * Deserialize session, see mbedtls_ssl_session_save() for format.
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010834 *
10835 * This internal version is wrapped by a public function that cleans up in
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010836 * case of error, and has an extra option omit_header.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010837 */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010838static int ssl_session_load( mbedtls_ssl_session *session,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010839 unsigned char omit_header,
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010840 const unsigned char *buf,
10841 size_t len )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010842{
10843 const unsigned char *p = buf;
10844 const unsigned char * const end = buf + len;
Hanno Beckere02758c2019-06-26 15:31:31 +010010845 int ciphersuite;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010846#if defined(MBEDTLS_HAVE_TIME)
10847 uint64_t start;
10848#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010849#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010850#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010851 size_t cert_len;
Hanno Becker2e6d3472019-02-06 15:40:27 +000010852#endif
10853#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010854
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010855 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010856 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010857 /*
10858 * Check version identifier
10859 */
10860
10861 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
10862 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10863
Teppo Järvelin0efac532019-10-04 13:21:08 +030010864 // use regular memcmp as session header is public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030010865 if( memcmp( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010866 sizeof( ssl_serialized_session_header ) ) != 0 )
10867 {
10868 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10869 }
10870 p += sizeof( ssl_serialized_session_header );
Hanno Beckerb5352f02019-05-16 12:39:07 +010010871 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010872
10873 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010874 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010875 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010876#if defined(MBEDTLS_HAVE_TIME)
10877 if( 8 > (size_t)( end - p ) )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010878 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10879
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010880 start = ( (uint64_t) p[0] << 56 ) |
10881 ( (uint64_t) p[1] << 48 ) |
10882 ( (uint64_t) p[2] << 40 ) |
10883 ( (uint64_t) p[3] << 32 ) |
10884 ( (uint64_t) p[4] << 24 ) |
10885 ( (uint64_t) p[5] << 16 ) |
10886 ( (uint64_t) p[6] << 8 ) |
10887 ( (uint64_t) p[7] );
10888 p += 8;
10889
10890 session->start = (time_t) start;
10891#endif /* MBEDTLS_HAVE_TIME */
10892
10893 /*
10894 * Basic mandatory fields
10895 */
Hanno Becker88440552019-07-03 14:16:13 +010010896 {
10897 size_t const ciphersuite_len = 2;
10898#if defined(MBEDTLS_ZLIB_SUPPORT)
10899 size_t const compression_len = 1;
10900#else
10901 size_t const compression_len = 0;
10902#endif
10903 size_t const id_len_len = 1;
10904 size_t const id_len = 32;
10905 size_t const master_len = 48;
10906 size_t const verif_result_len = 4;
Hanno Beckere02758c2019-06-26 15:31:31 +010010907
Hanno Becker88440552019-07-03 14:16:13 +010010908 size_t const basic_len =
10909 ciphersuite_len +
10910 compression_len +
10911 id_len_len +
10912 id_len +
10913 master_len +
10914 verif_result_len;
10915
10916 if( basic_len > (size_t)( end - p ) )
10917 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10918 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010919
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010920 ciphersuite = (int)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010921 p += 2;
10922
Hanno Becker73f4cb12019-06-27 13:51:07 +010010923#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Beckere02758c2019-06-26 15:31:31 +010010924 session->ciphersuite = ciphersuite;
10925#else
10926 if( ciphersuite !=
Hanno Becker73f4cb12019-06-27 13:51:07 +010010927 MBEDTLS_SSL_SUITE_ID( MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE ) )
Hanno Beckere02758c2019-06-26 15:31:31 +010010928 {
10929 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10930 }
10931#endif
10932
Hanno Becker88440552019-07-03 14:16:13 +010010933#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010934 session->compression = *p++;
Hanno Becker88440552019-07-03 14:16:13 +010010935#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010936
10937 session->id_len = *p++;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010938 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10939 memcpy( session->id, p, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010940 p += 32;
10941
Teppo Järvelin91d79382019-10-02 09:09:31 +030010942 mbedtls_platform_memcpy( session->master, p, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010943 p += 48;
10944
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010945 session->verify_result = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010946 p += 4;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010947
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010948 /* Immediately clear invalid pointer values that have been read, in case
10949 * we exit early before we replaced them with valid ones. */
10950#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010951#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010952 session->peer_cert = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010953#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010954 session->peer_cert_digest = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010955#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010956#endif
10957#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
10958 session->ticket = NULL;
10959#endif
10960
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010961 /*
10962 * Peer certificate
10963 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010964#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010965#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010966 if( 3 > (size_t)( end - p ) )
10967 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10968
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010969 cert_len = mbedtls_platform_get_uint24_be( &p[0] );
10970
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010971 p += 3;
10972
10973 if( cert_len == 0 )
10974 {
10975 session->peer_cert = NULL;
10976 }
10977 else
10978 {
10979 int ret;
10980
10981 if( cert_len > (size_t)( end - p ) )
10982 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10983
10984 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
10985
10986 if( session->peer_cert == NULL )
10987 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
10988
10989 mbedtls_x509_crt_init( session->peer_cert );
10990
10991 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
10992 p, cert_len ) ) != 0 )
10993 {
10994 mbedtls_x509_crt_free( session->peer_cert );
10995 mbedtls_free( session->peer_cert );
10996 session->peer_cert = NULL;
10997 return( ret );
10998 }
10999
11000 p += cert_len;
11001 }
Hanno Becker5882dd02019-06-06 16:25:57 +010011002#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011003 /* Deserialize CRT digest from the end of the ticket. */
11004 if( 2 > (size_t)( end - p ) )
11005 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11006
11007 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
11008 session->peer_cert_digest_len = (size_t) *p++;
11009
11010 if( session->peer_cert_digest_len != 0 )
11011 {
Hanno Beckera5cedbc2019-07-17 11:21:02 +010011012 mbedtls_md_handle_t md_info =
Hanno Becker2326d202019-06-06 14:54:55 +010011013 mbedtls_md_info_from_type( session->peer_cert_digest_type );
Hanno Beckera5cedbc2019-07-17 11:21:02 +010011014 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Hanno Becker2326d202019-06-06 14:54:55 +010011015 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11016 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
11017 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11018
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011019 if( session->peer_cert_digest_len > (size_t)( end - p ) )
11020 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11021
11022 session->peer_cert_digest =
11023 mbedtls_calloc( 1, session->peer_cert_digest_len );
11024 if( session->peer_cert_digest == NULL )
11025 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
11026
Teppo Järvelin91d79382019-10-02 09:09:31 +030011027 mbedtls_platform_memcpy( session->peer_cert_digest, p,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011028 session->peer_cert_digest_len );
11029 p += session->peer_cert_digest_len;
11030 }
Hanno Becker5882dd02019-06-06 16:25:57 +010011031#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020011032#endif /* MBEDTLS_X509_CRT_PARSE_C */
11033
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011034 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011035 * Session ticket and associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011036 */
11037#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
11038 if( 3 > (size_t)( end - p ) )
11039 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11040
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030011041 session->ticket_len = mbedtls_platform_get_uint24_be( &p[0] );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011042 p += 3;
11043
11044 if( session->ticket_len != 0 )
11045 {
11046 if( session->ticket_len > (size_t)( end - p ) )
11047 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11048
11049 session->ticket = mbedtls_calloc( 1, session->ticket_len );
11050 if( session->ticket == NULL )
11051 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
11052
Teppo Järvelin91d79382019-10-02 09:09:31 +030011053 mbedtls_platform_memcpy( session->ticket, p, session->ticket_len );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011054 p += session->ticket_len;
11055 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011056
11057 if( 4 > (size_t)( end - p ) )
11058 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11059
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030011060 session->ticket_lifetime = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011061 p += 4;
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011062#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
11063
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011064 /*
11065 * Misc extension-related info
11066 */
11067#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
11068 if( 1 > (size_t)( end - p ) )
11069 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11070
11071 session->mfl_code = *p++;
11072#endif
11073
11074#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
11075 if( 1 > (size_t)( end - p ) )
11076 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11077
11078 session->trunc_hmac = *p++;
11079#endif
11080
11081#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
11082 if( 1 > (size_t)( end - p ) )
11083 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11084
11085 session->encrypt_then_mac = *p++;
11086#endif
11087
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011088 /* Done, should have consumed entire buffer */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020011089 if( p != end )
11090 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11091
11092 return( 0 );
11093}
11094
11095/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020011096 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020011097 */
11098int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
11099 const unsigned char *buf,
11100 size_t len )
11101{
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011102 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020011103
11104 if( ret != 0 )
11105 mbedtls_ssl_session_free( session );
11106
11107 return( ret );
11108}
11109
11110/*
Paul Bakker1961b702013-01-25 14:49:24 +010011111 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +000011112 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011113int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011114{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011115 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker5121ce52009-01-03 21:22:43 +000011116
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011117 if( ssl == NULL || ssl->conf == NULL )
11118 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11119
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011120#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011121 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011122 ret = mbedtls_ssl_handshake_client_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000011123#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011124#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011125 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011126 ret = mbedtls_ssl_handshake_server_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000011127#endif
11128
Hanno Beckerb82350b2019-07-26 07:24:05 +010011129 ssl_send_pending_fatal_alert( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010011130 return( ret );
11131}
11132
11133/*
11134 * Perform the SSL handshake
11135 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011136int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +010011137{
11138 int ret = 0;
11139
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011140 if( ssl == NULL || ssl->conf == NULL )
11141 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11142
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011143 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +010011144
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011145 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +010011146 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011147 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010011148
11149 if( ret != 0 )
11150 break;
11151 }
11152
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011153 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011154
11155 return( ret );
11156}
11157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011158#if defined(MBEDTLS_SSL_RENEGOTIATION)
11159#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000011160/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011161 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +000011162 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011163static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011164{
11165 int ret;
11166
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011167 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011168
11169 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011170 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
11171 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011172
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020011173 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011174 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020011175 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011176 return( ret );
11177 }
11178
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011179 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011180
11181 return( 0 );
11182}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011183#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011184
11185/*
11186 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011187 * - any side: calling mbedtls_ssl_renegotiate(),
11188 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
11189 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +020011190 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011191 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011192 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011193 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011194static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011195{
11196 int ret;
11197
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011198 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011199
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011200 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
11201 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011202
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011203 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
11204 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011205#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011206 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011207 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011208 {
Hanno Becker2d9623f2019-06-13 12:07:05 +010011209 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11210 MBEDTLS_SSL_IS_SERVER )
11211 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011212 ssl->handshake->out_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010011213 }
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011214 else
Hanno Becker2d9623f2019-06-13 12:07:05 +010011215 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011216 ssl->handshake->in_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010011217 }
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011218 }
11219#endif
11220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011221 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
11222 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +000011223
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011224 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011225 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011226 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011227 return( ret );
11228 }
11229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011230 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011231
11232 return( 0 );
11233}
11234
11235/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011236 * Renegotiate current connection on client,
11237 * or request renegotiation on server
11238 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011239int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011240{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011241 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011242
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011243 if( ssl == NULL || ssl->conf == NULL )
11244 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11245
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011246#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011247 /* On server, just send the request */
Hanno Becker2d9623f2019-06-13 12:07:05 +010011248 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011249 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011250 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
11251 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011252
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011253 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020011254
11255 /* Did we already try/start sending HelloRequest? */
11256 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011257 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020011258
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011259 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011260 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011261#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011262
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011263#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011264 /*
11265 * On client, either start the renegotiation process or,
11266 * if already in progress, continue the handshake
11267 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011268 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011269 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011270 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
11271 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011272
11273 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
11274 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011275 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011276 return( ret );
11277 }
11278 }
11279 else
11280 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011281 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011282 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011283 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011284 return( ret );
11285 }
11286 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011287#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011288
Paul Bakker37ce0ff2013-10-31 14:32:04 +010011289 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011290}
11291
11292/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011293 * Check record counters and renegotiate if they're above the limit.
11294 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011295static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011296{
Andres AG2196c7f2016-12-15 17:01:16 +000011297 size_t ep_len = ssl_ep_len( ssl );
11298 int in_ctr_cmp;
11299 int out_ctr_cmp;
11300
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011301 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
11302 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020011303 ! mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011304 {
11305 return( 0 );
11306 }
11307
Teppo Järvelin0efac532019-10-04 13:21:08 +030011308 // use regular memcmp as counters are public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030011309 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000011310 ssl->conf->renego_period + ep_len, 8 - ep_len );
Teppo Järvelin650343c2019-10-03 15:36:59 +030011311 out_ctr_cmp = memcmp( ssl->cur_out_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000011312 ssl->conf->renego_period + ep_len, 8 - ep_len );
11313
11314 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011315 {
11316 return( 0 );
11317 }
11318
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020011319 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011320 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011321}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011322#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000011323
11324/*
11325 * Receive application data decrypted from the SSL layer
11326 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011327int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011328{
Hanno Becker4a810fb2017-05-24 16:27:30 +010011329 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +000011330 size_t n;
Andrzej Kurek84bde412020-07-06 15:27:34 -040011331 volatile unsigned char *buf_dup = buf;
11332 volatile size_t len_dup = len;
Paul Bakker5121ce52009-01-03 21:22:43 +000011333
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011334 if( ssl == NULL || ssl->conf == NULL )
11335 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11336
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011337 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011339#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011340 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011341 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011342 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011343 return( ret );
11344
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011345 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011346 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011347 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +020011348 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011349 return( ret );
11350 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011351 }
11352#endif
11353
Hanno Becker4a810fb2017-05-24 16:27:30 +010011354 /*
11355 * Check if renegotiation is necessary and/or handshake is
11356 * in process. If yes, perform/continue, and fall through
11357 * if an unexpected packet is received while the client
11358 * is waiting for the ServerHello.
11359 *
11360 * (There is no equivalent to the last condition on
11361 * the server-side as it is not treated as within
11362 * a handshake while waiting for the ClientHello
11363 * after a renegotiation request.)
11364 */
11365
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011366#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011367 ret = ssl_check_ctr_renegotiate( ssl );
11368 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11369 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011370 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011371 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011372 return( ret );
11373 }
11374#endif
11375
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011376 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011377 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011378 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +010011379 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11380 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011381 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011382 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011383 return( ret );
11384 }
11385 }
11386
Hanno Beckere41158b2017-10-23 13:30:32 +010011387 /* Loop as long as no application data record is available */
Hanno Becker90333da2017-10-10 11:27:13 +010011388 while( ssl->in_offt == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000011389 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011390 /* Start timer if not already running */
Hanno Becker0ae6b242019-06-13 16:45:36 +010011391 if( mbedtls_ssl_get_get_timer( ssl ) != NULL &&
11392 mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == -1 )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020011393 {
Hanno Becker1f835fa2019-06-13 10:14:59 +010011394 ssl_set_timer( ssl,
11395 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020011396 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011397
Hanno Becker327c93b2018-08-15 13:56:18 +010011398 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011399 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011400 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
11401 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +000011402
Hanno Becker4a810fb2017-05-24 16:27:30 +010011403 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
11404 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011405 }
11406
11407 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011408 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011409 {
11410 /*
11411 * OpenSSL sends empty messages to randomize the IV
11412 */
Hanno Becker327c93b2018-08-15 13:56:18 +010011413 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011414 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011415 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +000011416 return( 0 );
11417
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011418 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011419 return( ret );
11420 }
11421 }
11422
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011423 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +000011424 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011425 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011426
Hanno Becker4a810fb2017-05-24 16:27:30 +010011427 /*
11428 * - For client-side, expect SERVER_HELLO_REQUEST.
11429 * - For server-side, expect CLIENT_HELLO.
11430 * - Fail (TLS) or silently drop record (DTLS) in other cases.
11431 */
11432
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011433#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011434 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11435 MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011436 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
Hanno Becker4a810fb2017-05-24 16:27:30 +010011437 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
Paul Bakker48916f92012-09-16 19:57:18 +000011438 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011439 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011440
11441 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011442#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011443 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011444 {
11445 continue;
11446 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011447 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011448#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011449#if defined(MBEDTLS_SSL_PROTO_TLS)
11450 {
11451 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11452 }
11453#endif
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011454 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011455#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011456
Hanno Becker4a810fb2017-05-24 16:27:30 +010011457#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011458 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11459 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011460 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011462 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011463
11464 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011465#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011466 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011467 {
11468 continue;
11469 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011470 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011471#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011472#if defined(MBEDTLS_SSL_PROTO_TLS)
11473 {
11474 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11475 }
11476#endif
Paul Bakker48916f92012-09-16 19:57:18 +000011477 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011478#endif /* MBEDTLS_SSL_SRV_C */
11479
Hanno Becker21df7f92017-10-17 11:03:26 +010011480#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011481 /* Determine whether renegotiation attempt should be accepted */
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011482 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
11483 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +010011484 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011485 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
11486 {
11487 /*
11488 * Accept renegotiation request
11489 */
Paul Bakker48916f92012-09-16 19:57:18 +000011490
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011491 /* DTLS clients need to know renego is server-initiated */
11492#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011493 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker2d9623f2019-06-13 12:07:05 +010011494 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11495 MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011496 {
11497 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
11498 }
11499#endif
11500 ret = ssl_start_renegotiation( ssl );
11501 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11502 ret != 0 )
11503 {
11504 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
11505 return( ret );
11506 }
11507 }
11508 else
Hanno Becker21df7f92017-10-17 11:03:26 +010011509#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000011510 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011511 /*
11512 * Refuse renegotiation
11513 */
11514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011515 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011517#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +010011518 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011519 {
Gilles Peskine92e44262017-05-10 17:27:49 +020011520 /* SSLv3 does not have a "no_renegotiation" warning, so
11521 we send a fatal alert and abort the connection. */
11522 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
11523 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
11524 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011525 }
11526 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011527#endif /* MBEDTLS_SSL_PROTO_SSL3 */
11528#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
11529 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011530 if( mbedtls_ssl_ver_geq(
11531 mbedtls_ssl_get_minor_ver( ssl ),
11532 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011533 {
Hanno Becker2e8d1332019-07-25 10:27:36 +010011534 ret = mbedtls_ssl_send_alert_message( ssl,
11535 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11536 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION );
11537 if( ret != 0 )
11538 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011539 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +020011540 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011541#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
11542 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +020011543 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011544 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
11545 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +020011546 }
Paul Bakker48916f92012-09-16 19:57:18 +000011547 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011548
Hanno Becker90333da2017-10-10 11:27:13 +010011549 /* At this point, we don't know whether the renegotiation has been
11550 * completed or not. The cases to consider are the following:
11551 * 1) The renegotiation is complete. In this case, no new record
11552 * has been read yet.
11553 * 2) The renegotiation is incomplete because the client received
11554 * an application data record while awaiting the ServerHello.
11555 * 3) The renegotiation is incomplete because the client received
11556 * a non-handshake, non-application data message while awaiting
11557 * the ServerHello.
11558 * In each of these case, looping will be the proper action:
11559 * - For 1), the next iteration will read a new record and check
11560 * if it's application data.
11561 * - For 2), the loop condition isn't satisfied as application data
11562 * is present, hence continue is the same as break
11563 * - For 3), the loop condition is satisfied and read_record
11564 * will re-deliver the message that was held back by the client
11565 * when expecting the ServerHello.
11566 */
11567 continue;
Paul Bakker48916f92012-09-16 19:57:18 +000011568 }
Hanno Becker21df7f92017-10-17 11:03:26 +010011569#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011570 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011571 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011572 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011573 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011574 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011575 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011576 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011577 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011578 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011579 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011580 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011581 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011582#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011584 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
11585 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011586 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011587 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +010011588 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011589 }
11590
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011591 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011592 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011593 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
11594 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +000011595 }
11596
11597 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011598
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011599 /* We're going to return something now, cancel timer,
11600 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011601 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011602 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011603
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020011604#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011605 /* If we requested renego but received AppData, resend HelloRequest.
11606 * Do it now, after setting in_offt, to avoid taking this branch
11607 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011608#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011609 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11610 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011611 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011612 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011613 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011614 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011615 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011616 return( ret );
11617 }
11618 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011619#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +010011620#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +000011621 }
11622
11623 n = ( len < ssl->in_msglen )
11624 ? len : ssl->in_msglen;
11625
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011626 if( mbedtls_platform_memcpy( buf, ssl->in_offt, n ) !=
11627 buf )
11628 {
11629 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11630 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011631 ssl->in_msglen -= n;
11632
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011633 // clear incoming data after it's copied to buffer
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011634 if( mbedtls_platform_memset( ssl->in_offt, 0, n ) !=
11635 ssl->in_offt )
11636 {
11637 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11638 }
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011639
Paul Bakker5121ce52009-01-03 21:22:43 +000011640 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +010011641 {
11642 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +000011643 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +010011644 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011645 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011646 else
Hanno Becker4a810fb2017-05-24 16:27:30 +010011647 {
Paul Bakker5121ce52009-01-03 21:22:43 +000011648 /* more data available */
11649 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011650 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011651
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011652 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011653
Andrzej Kurek84bde412020-07-06 15:27:34 -040011654 /* Secure against buffer substitution */
11655 if( buf_dup == buf && len_dup == len )
11656 {
11657 return( (int) n );
11658 }
11659 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +000011660}
11661
11662/*
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011663 * Send application data to be encrypted by the SSL layer, taking care of max
11664 * fragment length and buffer size.
11665 *
11666 * According to RFC 5246 Section 6.2.1:
11667 *
11668 * Zero-length fragments of Application data MAY be sent as they are
11669 * potentially useful as a traffic analysis countermeasure.
11670 *
11671 * Therefore, it is possible that the input message length is 0 and the
11672 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +000011673 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011674static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011675 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011676{
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020011677 int ret = mbedtls_ssl_get_max_out_record_payload( ssl );
11678 const size_t max_len = (size_t) ret;
11679
11680 if( ret < 0 )
11681 {
11682 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
11683 return( ret );
11684 }
11685
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011686 if( len > max_len )
11687 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011688#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011689 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011690 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011691 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011692 "maximum fragment length: %d > %d",
11693 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011694 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011695 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011696 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011697#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011698#if defined(MBEDTLS_SSL_PROTO_TLS)
11699 {
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011700 len = max_len;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011701 }
11702#endif
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011703 }
Paul Bakker887bd502011-06-08 13:10:54 +000011704
Paul Bakker5121ce52009-01-03 21:22:43 +000011705 if( ssl->out_left != 0 )
11706 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011707 /*
11708 * The user has previously tried to send the data and
11709 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
11710 * written. In this case, we expect the high-level write function
11711 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
11712 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011713 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011714 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011715 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011716 return( ret );
11717 }
11718 }
Paul Bakker887bd502011-06-08 13:10:54 +000011719 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +000011720 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011721 /*
11722 * The user is trying to send a message the first time, so we need to
11723 * copy the data into the internal buffers and setup the data structure
11724 * to keep track of partial writes
11725 */
shelib014062d6c2020-07-21 11:54:52 +030011726 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011727 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011728 if( mbedtls_platform_memcpy( ssl->out_msg, buf, len ) != ssl->out_msg )
11729 {
11730 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11731 }
Paul Bakker887bd502011-06-08 13:10:54 +000011732
shelib014062d6c2020-07-21 11:54:52 +030011733#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011734 /*
11735 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11736 * After splitting pointers and data size will not be the same as initaly provides by user.
11737 */
shelib014062d6c2020-07-21 11:54:52 +030011738 /* Secure against buffer substitution */
Shelly Liberman3799fc12020-08-05 15:52:58 +030011739 if( buf == ssl->out_msg_dup &&
shelib014062d6c2020-07-21 11:54:52 +030011740 ssl->out_msglen == ssl->out_msglen_dup &&
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011741 ssl->out_msg_dup[0] == ssl->out_msg[0] )
shelib014062d6c2020-07-21 11:54:52 +030011742 {/*write record only if data was copied from correct user pointer */
11743#endif
Shelly Liberman3799fc12020-08-05 15:52:58 +030011744 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
shelib014062d6c2020-07-21 11:54:52 +030011745 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011746 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
11747 return( ret );
shelib014062d6c2020-07-21 11:54:52 +030011748 }
11749
11750#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Paul Bakker887bd502011-06-08 13:10:54 +000011751 }
shelib014062d6c2020-07-21 11:54:52 +030011752 else
11753 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011754 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011755 }
11756#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000011757 }
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011758 if ( ret == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -040011759 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011760 return( (int) len );
Andrzej Kurek84bde412020-07-06 15:27:34 -040011761 }
shelib014062d6c2020-07-21 11:54:52 +030011762 else
11763 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011764 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011765 }
11766
Paul Bakker5121ce52009-01-03 21:22:43 +000011767}
11768
11769/*
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011770 * Write application data, doing 1/n-1 splitting if necessary.
11771 *
11772 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011773 * then the caller will call us again with the same arguments, so
Hanno Becker2b187c42017-09-18 14:58:11 +010011774 * remember whether we already did the split or not.
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011775 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011776#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011777static int ssl_write_split( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011778 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011779{
11780 int ret;
11781
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010011782 if( ssl->conf->cbc_record_splitting ==
11783 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011784 len <= 1 ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011785 mbedtls_ssl_ver_gt(
11786 mbedtls_ssl_get_minor_ver( ssl ),
11787 MBEDTLS_SSL_MINOR_VERSION_1 ) ||
Andrzej Kurek11750442020-09-17 07:12:06 -040011788#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
11789 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx )
11790 != MBEDTLS_MODE_CBC )
11791#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011792 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
11793 != MBEDTLS_MODE_CBC )
Andrzej Kurek11750442020-09-17 07:12:06 -040011794#endif
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011795 {
11796 return( ssl_write_real( ssl, buf, len ) );
11797 }
11798
11799 if( ssl->split_done == 0 )
11800 {
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011801 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011802 return( ret );
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011803 ssl->split_done = 1;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011804 }
11805
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011806 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
11807 return( ret );
11808 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011809
11810 return( ret + 1 );
11811}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011812#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011813
11814/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011815 * Write application data (public-facing wrapper)
11816 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011817int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011818{
shelib014062d6c2020-07-21 11:54:52 +030011819 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
11820#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011821 /*
11822 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11823 * After splitting pointers and data size will not be the same as initaly provides by user.
11824 */
Andrzej Kurek84bde412020-07-06 15:27:34 -040011825 volatile const unsigned char *buf_dup = buf;
11826 volatile size_t len_dup = len;
shelib014062d6c2020-07-21 11:54:52 +030011827#endif
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011828 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011829
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011830 if( ssl == NULL || ssl->conf == NULL )
11831 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11832
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011833#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011834 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
11835 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011836 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011837 return( ret );
11838 }
11839#endif
11840
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011841 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011842 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011843 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011844 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +020011845 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011846 return( ret );
11847 }
11848 }
11849
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011850#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011851 ret = ssl_write_split( ssl, buf, len );
11852#else
shelib014062d6c2020-07-21 11:54:52 +030011853#if defined(MBEDTLS_FI_COUNTERMEASURES)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011854 /* Add const user pointers to context. We will be able to check its validity before copy to context */
shelib014062d6c2020-07-21 11:54:52 +030011855 ssl->out_msg_dup = (unsigned char*)buf_dup;
11856 ssl->out_msglen_dup = len_dup;
11857#endif //MBEDTLS_FI_COUNTERMEASURES
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011858 ret = ssl_write_real( ssl, buf, len );
11859#endif
11860
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011861 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011862
shelib014062d6c2020-07-21 11:54:52 +030011863
11864 return( ret );
11865
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011866}
11867
11868/*
Paul Bakker5121ce52009-01-03 21:22:43 +000011869 * Notify the peer that the connection is being closed
11870 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011871int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011872{
11873 int ret;
11874
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011875 if( ssl == NULL || ssl->conf == NULL )
11876 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11877
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011878 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011879
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011880 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011881 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011882
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011883 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011885 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
11886 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11887 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011888 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011889 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011890 return( ret );
11891 }
11892 }
11893
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011894 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011895
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011896 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +000011897}
11898
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011899void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +000011900{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011901 if( transform == NULL )
11902 return;
11903
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011904#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +000011905 deflateEnd( &transform->ctx_deflate );
11906 inflateEnd( &transform->ctx_inflate );
11907#endif
Andrzej Kurek11750442020-09-17 07:12:06 -040011908#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
11909 mbedtls_cipher_free( &transform->cipher_ctx );
11910 if( transform->key_dec != NULL )
11911 mbedtls_free( transform->key_dec );
11912 if( transform->key_enc != NULL )
11913 mbedtls_free( transform->key_enc );
11914#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011915 mbedtls_cipher_free( &transform->cipher_ctx_enc );
11916 mbedtls_cipher_free( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -040011917#endif
Hanno Becker92231322018-01-03 15:32:51 +000011918#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011919 mbedtls_md_free( &transform->md_ctx_enc );
11920 mbedtls_md_free( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +000011921#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020011922
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050011923 mbedtls_platform_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011924}
11925
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011926#if defined(MBEDTLS_X509_CRT_PARSE_C)
11927static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011928{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011929 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011930
11931 while( cur != NULL )
11932 {
11933 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011934 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011935 cur = next;
11936 }
11937}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011938#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011939
Hanno Becker0271f962018-08-16 13:23:47 +010011940#if defined(MBEDTLS_SSL_PROTO_DTLS)
11941
11942static void ssl_buffering_free( mbedtls_ssl_context *ssl )
11943{
11944 unsigned offset;
11945 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11946
11947 if( hs == NULL )
11948 return;
11949
Hanno Becker283f5ef2018-08-24 09:34:47 +010011950 ssl_free_buffered_record( ssl );
11951
Hanno Becker0271f962018-08-16 13:23:47 +010011952 for( offset = 0; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
Hanno Beckere605b192018-08-21 15:59:07 +010011953 ssl_buffering_free_slot( ssl, offset );
11954}
11955
11956static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
11957 uint8_t slot )
11958{
11959 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11960 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot];
Hanno Beckerb309b922018-08-23 13:18:05 +010011961
11962 if( slot >= MBEDTLS_SSL_MAX_BUFFERED_HS )
11963 return;
11964
Hanno Beckere605b192018-08-21 15:59:07 +010011965 if( hs_buf->is_valid == 1 )
Hanno Becker0271f962018-08-16 13:23:47 +010011966 {
Hanno Beckere605b192018-08-21 15:59:07 +010011967 hs->buffering.total_bytes_buffered -= hs_buf->data_len;
Hanno Becker805f2e12018-10-12 16:31:41 +010011968 mbedtls_platform_zeroize( hs_buf->data, hs_buf->data_len );
Hanno Beckere605b192018-08-21 15:59:07 +010011969 mbedtls_free( hs_buf->data );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020011970 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Hanno Becker0271f962018-08-16 13:23:47 +010011971 }
11972}
11973
11974#endif /* MBEDTLS_SSL_PROTO_DTLS */
11975
Gilles Peskine9b562d52018-04-25 20:32:43 +020011976void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011977{
Gilles Peskine9b562d52018-04-25 20:32:43 +020011978 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
11979
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011980 if( handshake == NULL )
11981 return;
11982
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011983#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
11984 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
11985 {
Gilles Peskine8f97af72018-04-26 11:46:10 +020011986 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011987 handshake->async_in_progress = 0;
11988 }
11989#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
11990
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +020011991#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
11992 defined(MBEDTLS_SSL_PROTO_TLS1_1)
11993 mbedtls_md5_free( &handshake->fin_md5 );
11994 mbedtls_sha1_free( &handshake->fin_sha1 );
11995#endif
11996#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
11997#if defined(MBEDTLS_SHA256_C)
11998 mbedtls_sha256_free( &handshake->fin_sha256 );
11999#endif
12000#if defined(MBEDTLS_SHA512_C)
12001 mbedtls_sha512_free( &handshake->fin_sha512 );
12002#endif
12003#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
12004
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012005#if defined(MBEDTLS_DHM_C)
12006 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +000012007#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012008#if defined(MBEDTLS_ECDH_C)
12009 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +020012010#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +020012011#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020012012 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +020012013#if defined(MBEDTLS_SSL_CLI_C)
12014 mbedtls_free( handshake->ecjpake_cache );
12015 handshake->ecjpake_cache = NULL;
12016 handshake->ecjpake_cache_len = 0;
12017#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020012018#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020012019
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010012020#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
12021 if( handshake->psk != NULL )
12022 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012023 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010012024 mbedtls_free( handshake->psk );
12025 }
12026#endif
12027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012028#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
12029 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012030 /*
12031 * Free only the linked list wrapper, not the keys themselves
12032 * since the belong to the SNI callback
12033 */
12034 if( handshake->sni_key_cert != NULL )
12035 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012036 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012037
12038 while( cur != NULL )
12039 {
12040 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012041 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012042 cur = next;
12043 }
12044 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012045#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020012046
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020012047#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +020012048 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Beckere4aeb762019-02-05 17:19:52 +000012049 if( handshake->ecrs_peer_cert != NULL )
12050 {
12051 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
12052 mbedtls_free( handshake->ecrs_peer_cert );
12053 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020012054#endif
12055
Hanno Becker3bf8cdf2019-02-06 16:18:31 +000012056#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
12057 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
12058 mbedtls_pk_free( &handshake->peer_pubkey );
12059#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
12060
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012061#if defined(MBEDTLS_SSL_PROTO_DTLS)
12062 mbedtls_free( handshake->verify_cookie );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +020012063 ssl_flight_free( handshake->flight );
Hanno Becker0271f962018-08-16 13:23:47 +010012064 ssl_buffering_free( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +020012065#endif
12066
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012067 mbedtls_platform_zeroize( handshake,
12068 sizeof( mbedtls_ssl_handshake_params ) );
Andrzej Kurekf3844952020-10-16 23:03:01 +020012069
12070#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12071 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
12072 * processes datagrams and the fact that a datagram is allowed to have
12073 * several records in it, it is possible that the I/O buffers are not
12074 * empty at this stage */
Andrzej Kurekcd9a6ff2020-10-22 11:12:07 +020012075 handle_buffer_resizing( ssl, BUFFER_DOWNSIZING,
12076 mbedtls_ssl_get_input_buflen( ssl ),
12077 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurekf3844952020-10-16 23:03:01 +020012078#endif
Paul Bakker48916f92012-09-16 19:57:18 +000012079}
12080
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012081void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +000012082{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012083 if( session == NULL )
12084 return;
12085
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012086#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker22141592019-02-05 12:38:15 +000012087 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +020012088#endif
Paul Bakker0a597072012-09-25 21:55:46 +000012089
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020012090#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012091 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +020012092#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +020012093
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012094 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +000012095}
12096
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012097#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012098
12099#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12100#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
12101#else
12102#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
12103#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12104
12105#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12106#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
12107#else
12108#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 0u
12109#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12110
12111#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12112#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
12113#else
12114#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
12115#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12116
12117#if defined(MBEDTLS_SSL_ALPN)
12118#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
12119#else
12120#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
12121#endif /* MBEDTLS_SSL_ALPN */
12122
12123#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
12124#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
12125#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
12126#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
12127
12128#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
12129 ( (uint32_t) ( \
12130 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
12131 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
12132 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
12133 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
12134 0u ) )
12135
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012136static unsigned char ssl_serialized_context_header[] = {
12137 MBEDTLS_VERSION_MAJOR,
12138 MBEDTLS_VERSION_MINOR,
12139 MBEDTLS_VERSION_PATCH,
12140 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
12141 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012142 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 16 ) & 0xFF,
12143 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 8 ) & 0xFF,
12144 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012145};
12146
Paul Bakker5121ce52009-01-03 21:22:43 +000012147/*
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012148 * Serialize a full SSL context
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012149 *
12150 * The format of the serialized data is:
12151 * (in the presentation language of TLS, RFC 8446 section 3)
12152 *
12153 * // header
12154 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012155 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012156 * // the format of the remaining
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012157 * // serialized data.
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012158 * Note: When updating the format, remember to keep these
12159 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012160 *
12161 * // session sub-structure
12162 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
12163 * // transform sub-structure
12164 * uint8 random[64]; // ServerHello.random+ClientHello.random
12165 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
12166 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
12167 * // fields from ssl_context
12168 * uint32 badmac_seen; // DTLS: number of records with failing MAC
12169 * uint64 in_window_top; // DTLS: last validated record seq_num
12170 * uint64 in_window; // DTLS: bitmask for replay protection
12171 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
12172 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
12173 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
12174 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
12175 *
12176 * Note that many fields of the ssl_context or sub-structures are not
12177 * serialized, as they fall in one of the following categories:
12178 *
12179 * 1. forced value (eg in_left must be 0)
12180 * 2. pointer to dynamically-allocated memory (eg session, transform)
12181 * 3. value can be re-derived from other data (eg session keys from MS)
12182 * 4. value was temporary (eg content of input buffer)
12183 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012184 */
12185int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
12186 unsigned char *buf,
12187 size_t buf_len,
12188 size_t *olen )
12189{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012190 unsigned char *p = buf;
12191 size_t used = 0;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012192 size_t session_len;
12193 int ret = 0;
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012194
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012195 /*
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012196 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
12197 * this function's documentation.
12198 *
12199 * These are due to assumptions/limitations in the implementation. Some of
12200 * them are likely to stay (no handshake in progress) some might go away
12201 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012202 */
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012203 /* The initial handshake must be over */
12204 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012205 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012206 if( ssl->handshake != NULL )
12207 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12208 /* Double-check that sub-structures are indeed ready */
12209 if( ssl->transform == NULL || ssl->session == NULL )
12210 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12211 /* There must be no pending incoming or outgoing data */
12212 if( mbedtls_ssl_check_pending( ssl ) != 0 )
12213 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12214 if( ssl->out_left != 0 )
12215 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12216 /* Protocol must be DLTS, not TLS */
12217 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
12218 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12219 /* Version must be 1.2 */
12220 if( mbedtls_ssl_get_major_ver( ssl ) != MBEDTLS_SSL_MAJOR_VERSION_3 )
12221 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12222 if( mbedtls_ssl_get_minor_ver( ssl ) != MBEDTLS_SSL_MINOR_VERSION_3 )
12223 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12224 /* We must be using an AEAD ciphersuite */
12225 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
12226 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12227 /* Renegotiation must not be enabled */
12228 if( mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
12229 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012230
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012231 /*
12232 * Version and format identifier
12233 */
12234 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012235
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012236 if( used <= buf_len )
12237 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012238 mbedtls_platform_memcpy( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012239 sizeof( ssl_serialized_context_header ) );
12240 p += sizeof( ssl_serialized_context_header );
12241 }
12242
12243 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012244 * Session (length + data)
12245 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012246 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012247 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
12248 return( ret );
12249
12250 used += 4 + session_len;
12251 if( used <= buf_len )
12252 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012253 p = mbedtls_platform_put_uint32_be( p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012254
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012255 ret = ssl_session_save( ssl->session, 1,
12256 p, session_len, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012257 if( ret != 0 )
12258 return( ret );
12259
12260 p += session_len;
12261 }
12262
12263 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012264 * Transform
12265 */
12266 used += sizeof( ssl->transform->randbytes );
12267 if( used <= buf_len )
12268 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012269 mbedtls_platform_memcpy( p, ssl->transform->randbytes,
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012270 sizeof( ssl->transform->randbytes ) );
12271 p += sizeof( ssl->transform->randbytes );
12272 }
12273
12274#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12275 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
12276 if( used <= buf_len )
12277 {
12278 *p++ = ssl->transform->in_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012279 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12280 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012281 p += ssl->transform->in_cid_len;
12282
12283 *p++ = ssl->transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012284 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12285 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012286 p += ssl->transform->out_cid_len;
12287 }
12288#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12289
12290 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012291 * Saved fields from top-level ssl_context structure
12292 */
12293#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12294 used += 4;
12295 if( used <= buf_len )
12296 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012297 p = mbedtls_platform_put_uint32_be( p, ssl->badmac_seen );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012298 }
12299#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12300
12301#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12302 used += 16;
12303 if( used <= buf_len )
12304 {
12305 *p++ = (unsigned char)( ( ssl->in_window_top >> 56 ) & 0xFF );
12306 *p++ = (unsigned char)( ( ssl->in_window_top >> 48 ) & 0xFF );
12307 *p++ = (unsigned char)( ( ssl->in_window_top >> 40 ) & 0xFF );
12308 *p++ = (unsigned char)( ( ssl->in_window_top >> 32 ) & 0xFF );
12309 *p++ = (unsigned char)( ( ssl->in_window_top >> 24 ) & 0xFF );
12310 *p++ = (unsigned char)( ( ssl->in_window_top >> 16 ) & 0xFF );
12311 *p++ = (unsigned char)( ( ssl->in_window_top >> 8 ) & 0xFF );
12312 *p++ = (unsigned char)( ( ssl->in_window_top ) & 0xFF );
12313
12314 *p++ = (unsigned char)( ( ssl->in_window >> 56 ) & 0xFF );
12315 *p++ = (unsigned char)( ( ssl->in_window >> 48 ) & 0xFF );
12316 *p++ = (unsigned char)( ( ssl->in_window >> 40 ) & 0xFF );
12317 *p++ = (unsigned char)( ( ssl->in_window >> 32 ) & 0xFF );
12318 *p++ = (unsigned char)( ( ssl->in_window >> 24 ) & 0xFF );
12319 *p++ = (unsigned char)( ( ssl->in_window >> 16 ) & 0xFF );
12320 *p++ = (unsigned char)( ( ssl->in_window >> 8 ) & 0xFF );
12321 *p++ = (unsigned char)( ( ssl->in_window ) & 0xFF );
12322 }
12323#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12324
12325#if defined(MBEDTLS_SSL_PROTO_DTLS)
12326 used += 1;
12327 if( used <= buf_len )
12328 {
12329 *p++ = ssl->disable_datagram_packing;
12330 }
12331#endif /* MBEDTLS_SSL_PROTO_DTLS */
12332
12333 used += 8;
12334 if( used <= buf_len )
12335 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012336 mbedtls_platform_memcpy( p, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012337 p += 8;
12338 }
12339
12340#if defined(MBEDTLS_SSL_PROTO_DTLS)
12341 used += 2;
12342 if( used <= buf_len )
12343 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012344 p = mbedtls_platform_put_uint16_be( p, ssl->mtu );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012345 }
12346#endif /* MBEDTLS_SSL_PROTO_DTLS */
12347
12348#if defined(MBEDTLS_SSL_ALPN)
12349 {
12350 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnard7af73752019-07-24 00:58:27 +020012351 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012352 : 0;
12353
12354 used += 1 + alpn_len;
12355 if( used <= buf_len )
12356 {
12357 *p++ = alpn_len;
12358
12359 if( ssl->alpn_chosen != NULL )
12360 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012361 mbedtls_platform_memcpy( p, ssl->alpn_chosen, alpn_len );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012362 p += alpn_len;
12363 }
12364 }
12365 }
12366#endif /* MBEDTLS_SSL_ALPN */
12367
12368 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012369 * Done
12370 */
12371 *olen = used;
12372
12373 if( used > buf_len )
12374 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012375
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012376 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
12377
Manuel Pégourié-Gonnardbc847ca2019-07-23 14:51:09 +020012378 return( ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012379}
12380
12381/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012382 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012383 *
12384 * This internal version is wrapped by a public function that cleans up in
12385 * case of error.
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012386 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012387static int ssl_context_load( mbedtls_ssl_context *ssl,
12388 const unsigned char *buf,
12389 size_t len )
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012390{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012391 const unsigned char *p = buf;
12392 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012393 size_t session_len;
12394 int ret;
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012395
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012396 /*
12397 * The context should have been freshly setup or reset.
12398 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard14e2a8a2019-07-26 16:31:53 +020012399 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012400 * renegotiating, or if the user mistakenly loaded a session first.)
12401 */
12402 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
12403 ssl->session != NULL )
12404 {
12405 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12406 }
12407
12408 /*
12409 * We can't check that the config matches the initial one, but we can at
12410 * least check it matches the requirements for serializing.
12411 */
12412 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012413 mbedtls_ssl_ver_lt(
12414 mbedtls_ssl_conf_get_max_major_ver( ssl->conf ),
12415 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
12416 mbedtls_ssl_ver_gt(
12417 mbedtls_ssl_conf_get_min_major_ver( ssl->conf ),
12418 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
12419 mbedtls_ssl_ver_lt(
12420 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ),
12421 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
12422 mbedtls_ssl_ver_gt(
12423 mbedtls_ssl_conf_get_min_minor_ver( ssl->conf ),
12424 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020012425 mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012426 {
12427 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12428 }
12429
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012430 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
12431
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012432 /*
12433 * Check version identifier
12434 */
12435 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
12436 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12437
Teppo Järvelin650343c2019-10-03 15:36:59 +030012438 // use regular memcmp as header is not that critical
12439 if( memcmp( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012440 sizeof( ssl_serialized_context_header ) ) != 0 )
12441 {
12442 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
12443 }
12444 p += sizeof( ssl_serialized_context_header );
12445
12446 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012447 * Session
12448 */
12449 if( (size_t)( end - p ) < 4 )
12450 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12451
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012452 session_len = mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012453 p += 4;
12454
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012455 /* This has been allocated by ssl_handshake_init(), called by
12456 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12457 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012458 ssl->session_in = ssl->session;
12459 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012460 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012461
12462 if( (size_t)( end - p ) < session_len )
12463 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12464
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012465 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012466 if( ret != 0 )
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012467 {
12468 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012469 return( ret );
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012470 }
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012471
12472 p += session_len;
12473
12474 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012475 * Transform
12476 */
12477
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012478 /* This has been allocated by ssl_handshake_init(), called by
12479 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12480 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012481 ssl->transform_in = ssl->transform;
12482 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012483 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012484
12485 /* Read random bytes and populate structure */
12486 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
12487 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12488
12489 ret = ssl_populate_transform( ssl->transform,
12490 mbedtls_ssl_session_get_ciphersuite( ssl->session ),
12491 ssl->session->master,
12492#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
12493#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12494 ssl->session->encrypt_then_mac,
12495#endif
12496#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
12497 ssl->session->trunc_hmac,
12498#endif
12499#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
12500#if defined(MBEDTLS_ZLIB_SUPPORT)
12501 ssl->session->compression,
12502#endif
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012503 p, /* currently pointing to randbytes */
12504 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
12505 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
12506 ssl );
12507 if( ret != 0 )
12508 return( ret );
12509
12510 p += sizeof( ssl->transform->randbytes );
12511
12512#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12513 /* Read connection IDs and store them */
12514 if( (size_t)( end - p ) < 1 )
12515 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12516
12517 ssl->transform->in_cid_len = *p++;
12518
Manuel Pégourié-Gonnard2f3fa622019-07-23 15:02:54 +020012519 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012520 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12521
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012522 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12523 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012524 p += ssl->transform->in_cid_len;
12525
12526 ssl->transform->out_cid_len = *p++;
12527
12528 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
12529 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12530
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012531 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12532 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012533 p += ssl->transform->out_cid_len;
12534#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12535
12536 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012537 * Saved fields from top-level ssl_context structure
12538 */
12539#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12540 if( (size_t)( end - p ) < 4 )
12541 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12542
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012543 ssl->badmac_seen = (unsigned)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012544 p += 4;
12545#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12546
12547#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12548 if( (size_t)( end - p ) < 16 )
12549 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12550
12551 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
12552 ( (uint64_t) p[1] << 48 ) |
12553 ( (uint64_t) p[2] << 40 ) |
12554 ( (uint64_t) p[3] << 32 ) |
12555 ( (uint64_t) p[4] << 24 ) |
12556 ( (uint64_t) p[5] << 16 ) |
12557 ( (uint64_t) p[6] << 8 ) |
12558 ( (uint64_t) p[7] );
12559 p += 8;
12560
12561 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
12562 ( (uint64_t) p[1] << 48 ) |
12563 ( (uint64_t) p[2] << 40 ) |
12564 ( (uint64_t) p[3] << 32 ) |
12565 ( (uint64_t) p[4] << 24 ) |
12566 ( (uint64_t) p[5] << 16 ) |
12567 ( (uint64_t) p[6] << 8 ) |
12568 ( (uint64_t) p[7] );
12569 p += 8;
12570#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12571
12572#if defined(MBEDTLS_SSL_PROTO_DTLS)
12573 if( (size_t)( end - p ) < 1 )
12574 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12575
12576 ssl->disable_datagram_packing = *p++;
12577#endif /* MBEDTLS_SSL_PROTO_DTLS */
12578
12579 if( (size_t)( end - p ) < 8 )
12580 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12581
Teppo Järvelin91d79382019-10-02 09:09:31 +030012582 mbedtls_platform_memcpy( ssl->cur_out_ctr, p, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012583 p += 8;
12584
12585#if defined(MBEDTLS_SSL_PROTO_DTLS)
12586 if( (size_t)( end - p ) < 2 )
12587 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012588 ssl->mtu = (uint16_t)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012589 p += 2;
12590#endif /* MBEDTLS_SSL_PROTO_DTLS */
12591
12592#if defined(MBEDTLS_SSL_ALPN)
12593 {
12594 uint8_t alpn_len;
12595 const char **cur;
12596
12597 if( (size_t)( end - p ) < 1 )
12598 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12599
12600 alpn_len = *p++;
12601
12602 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
12603 {
12604 /* alpn_chosen should point to an item in the configured list */
12605 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
12606 {
12607 if( strlen( *cur ) == alpn_len &&
Piotr Nowickie3c4ee52020-06-23 12:59:56 +020012608 mbedtls_platform_memequal( p, cur, alpn_len ) == 0 )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012609 {
12610 ssl->alpn_chosen = *cur;
12611 break;
12612 }
12613 }
12614 }
12615
12616 /* can only happen on conf mismatch */
12617 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
12618 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12619
12620 p += alpn_len;
12621 }
12622#endif /* MBEDTLS_SSL_ALPN */
12623
12624 /*
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012625 * Forced fields from top-level ssl_context structure
12626 *
12627 * Most of them already set to the correct value by mbedtls_ssl_init() and
12628 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
12629 */
12630 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
12631
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012632#if !defined(MBEDTLS_SSL_CONF_FIXED_MAJOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012633 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012634#endif /* !MBEDTLS_SSL_CONF_FIXED_MAJOR_VER */
12635#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012636 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012637#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012638
Hanno Becker83985822019-08-30 10:42:49 +010012639 /* Adjust pointers for header fields of outgoing records to
12640 * the given transform, accounting for explicit IV and CID. */
12641 ssl_update_out_pointers( ssl, ssl->transform );
12642
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012643#if defined(MBEDTLS_SSL_PROTO_DTLS)
12644 ssl->in_epoch = 1;
12645#endif
12646
12647 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
12648 * which we don't want - otherwise we'd end up freeing the wrong transform
12649 * by calling ssl_handshake_wrapup_free_hs_transform() inappropriately. */
12650 if( ssl->handshake != NULL )
12651 {
12652 mbedtls_ssl_handshake_free( ssl );
12653 mbedtls_free( ssl->handshake );
12654 ssl->handshake = NULL;
12655 }
12656
12657 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012658 * Done - should have consumed entire buffer
12659 */
12660 if( p != end )
12661 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012662
12663 return( 0 );
12664}
12665
12666/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012667 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012668 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012669int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012670 const unsigned char *buf,
12671 size_t len )
12672{
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012673 int ret = ssl_context_load( context, buf, len );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012674
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012675 if( ret != 0 )
12676 mbedtls_ssl_free( context );
12677
12678 return( ret );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012679}
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012680#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012681
12682/*
Paul Bakker5121ce52009-01-03 21:22:43 +000012683 * Free an SSL context
12684 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012685void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000012686{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012687 if( ssl == NULL )
12688 return;
12689
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012690 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012691
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012692 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012693 {
Andrzej Kurekf3844952020-10-16 23:03:01 +020012694#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12695 size_t out_buf_len = ssl->out_buf_len;
12696#else
12697 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
12698#endif
12699 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012700 mbedtls_free( ssl->out_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012701 }
12702
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012703 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012704 {
Andrzej Kurekf3844952020-10-16 23:03:01 +020012705#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12706 size_t in_buf_len = ssl->in_buf_len;
12707#else
12708 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
12709#endif
12710 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012711 mbedtls_free( ssl->in_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012712 }
12713
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012714#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker16770332013-10-11 09:59:44 +020012715 if( ssl->compress_buf != NULL )
12716 {
Angus Grattond8213d02016-05-25 20:56:48 +100012717 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012718 mbedtls_free( ssl->compress_buf );
Paul Bakker16770332013-10-11 09:59:44 +020012719 }
12720#endif
12721
Paul Bakker48916f92012-09-16 19:57:18 +000012722 if( ssl->transform )
12723 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012724 mbedtls_ssl_transform_free( ssl->transform );
12725 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +000012726 }
12727
12728 if( ssl->handshake )
12729 {
Gilles Peskine9b562d52018-04-25 20:32:43 +020012730 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012731 mbedtls_ssl_transform_free( ssl->transform_negotiate );
12732 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012733
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012734 mbedtls_free( ssl->handshake );
12735 mbedtls_free( ssl->transform_negotiate );
12736 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012737 }
12738
Paul Bakkerc0463502013-02-14 11:19:38 +010012739 if( ssl->session )
12740 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012741 mbedtls_ssl_session_free( ssl->session );
12742 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +010012743 }
12744
Teppo Järvelin4009d8f2019-08-19 14:48:09 +030012745#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Paul Bakker66d5d072014-06-17 16:39:18 +020012746 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012747 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012748 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012749 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +000012750 }
Paul Bakker0be444a2013-08-27 21:55:01 +020012751#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000012752
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012753#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
12754 if( mbedtls_ssl_hw_record_finish != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +000012755 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012756 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
12757 mbedtls_ssl_hw_record_finish( ssl );
Paul Bakker05ef8352012-05-08 09:17:57 +000012758 }
12759#endif
12760
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012761#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012762 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020012763#endif
12764
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012765 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +000012766
Paul Bakker86f04f42013-02-14 11:20:09 +010012767 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012768 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012769}
12770
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012771/*
12772 * Initialze mbedtls_ssl_config
12773 */
12774void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
12775{
12776 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnarde744eab2019-03-18 10:51:18 +010012777
12778#if !defined(MBEDTLS_SSL_PROTO_TLS)
12779 conf->transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
12780#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012781}
12782
Simon Butcherc97b6972015-12-27 23:48:17 +000012783#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012784#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012785static int ssl_preset_default_hashes[] = {
12786#if defined(MBEDTLS_SHA512_C)
12787 MBEDTLS_MD_SHA512,
12788 MBEDTLS_MD_SHA384,
12789#endif
12790#if defined(MBEDTLS_SHA256_C)
12791 MBEDTLS_MD_SHA256,
12792 MBEDTLS_MD_SHA224,
12793#endif
Gilles Peskine5d2511c2017-05-12 13:16:40 +020012794#if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012795 MBEDTLS_MD_SHA1,
12796#endif
12797 MBEDTLS_MD_NONE
12798};
Simon Butcherc97b6972015-12-27 23:48:17 +000012799#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012800#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012801
Hanno Becker73f4cb12019-06-27 13:51:07 +010012802#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012803static int ssl_preset_suiteb_ciphersuites[] = {
12804 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
12805 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
12806 0
12807};
Hanno Becker73f4cb12019-06-27 13:51:07 +010012808#endif /* !MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012809
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012810#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012811#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012812static int ssl_preset_suiteb_hashes[] = {
12813 MBEDTLS_MD_SHA256,
12814 MBEDTLS_MD_SHA384,
12815 MBEDTLS_MD_NONE
12816};
12817#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012818#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012819
Hanno Beckerc1096e72019-06-19 12:30:41 +010012820#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012821static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
Jaeden Amero16529b22019-06-03 08:27:16 +010012822#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012823 MBEDTLS_ECP_DP_SECP256R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012824#endif
12825#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012826 MBEDTLS_ECP_DP_SECP384R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012827#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012828 MBEDTLS_ECP_DP_NONE
12829};
12830#endif
12831
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012832/*
Tillmann Karras588ad502015-09-25 04:27:22 +020012833 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012834 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012835int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012836 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012837{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012838#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012839 int ret;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012840#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012841
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +020012842 /* Use the functions here so that they are covered in tests,
12843 * but otherwise access member directly for efficiency */
12844 mbedtls_ssl_conf_endpoint( conf, endpoint );
12845 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012846
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012847 /*
12848 * Things that are common to all presets
12849 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012850#if defined(MBEDTLS_SSL_CLI_C)
12851 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
12852 {
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012853#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012854 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012855#endif /* !MBEDTLS_SSL_CONF_AUTHMODE */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012856#if defined(MBEDTLS_SSL_SESSION_TICKETS)
12857 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
12858#endif
12859 }
12860#endif
12861
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012862#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012863 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012864#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012865
12866#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12867 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
12868#endif
12869
12870#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckeraabbb582019-06-11 13:43:27 +010012871#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012872 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012873#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
12874#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsad9382f82019-06-10 10:27:14 +030012875 conf->enforce_extended_master_secret =
Jarno Lamsa18b9a492019-06-10 15:23:29 +030012876 MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012877#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012878#endif
12879
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010012880#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
12881 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
12882#endif
12883
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012884#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012885 conf->f_cookie_write = ssl_cookie_write_dummy;
12886 conf->f_cookie_check = ssl_cookie_check_dummy;
12887#endif
12888
Hanno Becker7f376f42019-06-12 16:20:48 +010012889#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
12890 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012891 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
12892#endif
12893
Janos Follath088ce432017-04-10 12:42:31 +010012894#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012895#if !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +010012896 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012897#endif /* !MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST */
12898#endif /* MBEDTLS_SSL_SRV_C */
Janos Follath088ce432017-04-10 12:42:31 +010012899
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012900#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker1f835fa2019-06-13 10:14:59 +010012901#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012902 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012903#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN */
12904#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012905 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012906#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
12907#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012908
12909#if defined(MBEDTLS_SSL_RENEGOTIATION)
12910 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020012911 mbedtls_platform_memset( conf->renego_period, 0x00, 2 );
12912 mbedtls_platform_memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012913#endif
12914
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012915#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
12916 if( endpoint == MBEDTLS_SSL_IS_SERVER )
12917 {
Hanno Becker00d0a682017-10-04 13:14:29 +010012918 const unsigned char dhm_p[] =
12919 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
12920 const unsigned char dhm_g[] =
12921 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
12922
Hanno Beckera90658f2017-10-04 15:29:08 +010012923 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
12924 dhm_p, sizeof( dhm_p ),
12925 dhm_g, sizeof( dhm_g ) ) ) != 0 )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012926 {
12927 return( ret );
12928 }
12929 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +020012930#endif
12931
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012932 /*
12933 * Preset-specific defaults
12934 */
12935 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012936 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012937 /*
12938 * NSA Suite B
12939 */
12940 case MBEDTLS_SSL_PRESET_SUITEB:
Hanno Beckere965bd32019-06-12 14:04:34 +010012941#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012942 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Hanno Beckere965bd32019-06-12 14:04:34 +010012943#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12944#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012945 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
Hanno Beckere965bd32019-06-12 14:04:34 +010012946#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
12947#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012948 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012949#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
12950#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012951 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012952#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012953
Hanno Becker73f4cb12019-06-27 13:51:07 +010012954#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012955 conf->ciphersuite_list[0] =
12956 conf->ciphersuite_list[1] =
12957 conf->ciphersuite_list[2] =
12958 conf->ciphersuite_list[3] =
12959 ssl_preset_suiteb_ciphersuites;
Hanno Becker73f4cb12019-06-27 13:51:07 +010012960#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012961
12962#if defined(MBEDTLS_X509_CRT_PARSE_C)
12963 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012964#endif
12965
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012966#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012967#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012968 conf->sig_hashes = ssl_preset_suiteb_hashes;
12969#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012970#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012971
12972#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010012973#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012974 conf->curve_list = ssl_preset_suiteb_curves;
12975#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010012976#endif
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +020012977 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012978
12979 /*
12980 * Default
12981 */
12982 default:
Hanno Beckere965bd32019-06-12 14:04:34 +010012983#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030012984 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
12985 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
12986 MBEDTLS_SSL_MIN_MAJOR_VERSION :
12987 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012988#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12989#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030012990 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
12991 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
12992 MBEDTLS_SSL_MIN_MINOR_VERSION :
12993 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012994#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020012995 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( transport ) )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012996 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
12997#endif
Hanno Beckere965bd32019-06-12 14:04:34 +010012998#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
12999#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
13000 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
13001#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
13002#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
13003 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
13004#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013005
Hanno Becker73f4cb12019-06-27 13:51:07 +010013006#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010013007 conf->ciphersuite_list[0] =
13008 conf->ciphersuite_list[1] =
13009 conf->ciphersuite_list[2] =
13010 conf->ciphersuite_list[3] =
13011 mbedtls_ssl_list_ciphersuites();
Hanno Becker73f4cb12019-06-27 13:51:07 +010013012#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013013
13014#if defined(MBEDTLS_X509_CRT_PARSE_C)
13015 conf->cert_profile = &mbedtls_x509_crt_profile_default;
13016#endif
13017
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013018#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010013019#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010013020 conf->sig_hashes = ssl_preset_default_hashes;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013021#endif
Hanno Becker56595f42019-06-19 16:31:38 +010013022#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013023
13024#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010013025#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013026 conf->curve_list = mbedtls_ecp_grp_id_list();
13027#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010013028#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013029
13030#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
13031 conf->dhm_min_bitlen = 1024;
13032#endif
13033 }
13034
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013035 return( 0 );
13036}
13037
13038/*
13039 * Free mbedtls_ssl_config
13040 */
13041void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
13042{
13043#if defined(MBEDTLS_DHM_C)
13044 mbedtls_mpi_free( &conf->dhm_P );
13045 mbedtls_mpi_free( &conf->dhm_G );
13046#endif
13047
13048#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
13049 if( conf->psk != NULL )
13050 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013051 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013052 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +000013053 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013054 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +090013055 }
13056
13057 if( conf->psk_identity != NULL )
13058 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013059 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +090013060 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +000013061 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013062 conf->psk_identity_len = 0;
13063 }
13064#endif
13065
13066#if defined(MBEDTLS_X509_CRT_PARSE_C)
13067 ssl_key_cert_free( conf->key_cert );
13068#endif
13069
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013070 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013071}
13072
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020013073#if defined(MBEDTLS_PK_C) && \
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013074 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) ) || \
13075 ( defined(MBEDTLS_USE_TINYCRYPT) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013076/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013077 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013078 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013079unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013080{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013081#if defined(MBEDTLS_RSA_C)
13082 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
13083 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013084#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013085#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013086 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
13087 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013088#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013089 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013090}
13091
Hanno Becker7e5437a2017-04-28 17:15:26 +010013092unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
13093{
13094 switch( type ) {
13095 case MBEDTLS_PK_RSA:
13096 return( MBEDTLS_SSL_SIG_RSA );
13097 case MBEDTLS_PK_ECDSA:
13098 case MBEDTLS_PK_ECKEY:
13099 return( MBEDTLS_SSL_SIG_ECDSA );
13100 default:
13101 return( MBEDTLS_SSL_SIG_ANON );
13102 }
13103}
13104
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013105mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013106{
13107 switch( sig )
13108 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013109#if defined(MBEDTLS_RSA_C)
13110 case MBEDTLS_SSL_SIG_RSA:
13111 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013112#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013113#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013114 case MBEDTLS_SSL_SIG_ECDSA:
13115 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013116#endif
13117 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013118 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013119 }
13120}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020013121#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013122
Hanno Becker7e5437a2017-04-28 17:15:26 +010013123#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
13124 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
13125
13126/* Find an entry in a signature-hash set matching a given hash algorithm. */
13127mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
13128 mbedtls_pk_type_t sig_alg )
13129{
13130 switch( sig_alg )
13131 {
13132 case MBEDTLS_PK_RSA:
13133 return( set->rsa );
13134 case MBEDTLS_PK_ECDSA:
13135 return( set->ecdsa );
13136 default:
13137 return( MBEDTLS_MD_NONE );
13138 }
13139}
13140
13141/* Add a signature-hash-pair to a signature-hash set */
13142void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
13143 mbedtls_pk_type_t sig_alg,
13144 mbedtls_md_type_t md_alg )
13145{
13146 switch( sig_alg )
13147 {
13148 case MBEDTLS_PK_RSA:
13149 if( set->rsa == MBEDTLS_MD_NONE )
13150 set->rsa = md_alg;
13151 break;
13152
13153 case MBEDTLS_PK_ECDSA:
13154 if( set->ecdsa == MBEDTLS_MD_NONE )
13155 set->ecdsa = md_alg;
13156 break;
13157
13158 default:
13159 break;
13160 }
13161}
13162
13163/* Allow exactly one hash algorithm for each signature. */
13164void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
13165 mbedtls_md_type_t md_alg )
13166{
13167 set->rsa = md_alg;
13168 set->ecdsa = md_alg;
13169}
13170
13171#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
13172 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
13173
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020013174/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013175 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020013176 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013177mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013178{
13179 switch( hash )
13180 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013181#if defined(MBEDTLS_MD5_C)
13182 case MBEDTLS_SSL_HASH_MD5:
13183 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013184#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013185#if defined(MBEDTLS_SHA1_C)
13186 case MBEDTLS_SSL_HASH_SHA1:
13187 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013188#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013189#if defined(MBEDTLS_SHA256_C)
13190 case MBEDTLS_SSL_HASH_SHA224:
13191 return( MBEDTLS_MD_SHA224 );
13192 case MBEDTLS_SSL_HASH_SHA256:
13193 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013194#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013195#if defined(MBEDTLS_SHA512_C)
13196 case MBEDTLS_SSL_HASH_SHA384:
13197 return( MBEDTLS_MD_SHA384 );
13198 case MBEDTLS_SSL_HASH_SHA512:
13199 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013200#endif
13201 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013202 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013203 }
13204}
13205
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013206/*
13207 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
13208 */
13209unsigned char mbedtls_ssl_hash_from_md_alg( int md )
13210{
13211 switch( md )
13212 {
13213#if defined(MBEDTLS_MD5_C)
13214 case MBEDTLS_MD_MD5:
13215 return( MBEDTLS_SSL_HASH_MD5 );
13216#endif
13217#if defined(MBEDTLS_SHA1_C)
13218 case MBEDTLS_MD_SHA1:
13219 return( MBEDTLS_SSL_HASH_SHA1 );
13220#endif
13221#if defined(MBEDTLS_SHA256_C)
13222 case MBEDTLS_MD_SHA224:
13223 return( MBEDTLS_SSL_HASH_SHA224 );
13224 case MBEDTLS_MD_SHA256:
13225 return( MBEDTLS_SSL_HASH_SHA256 );
13226#endif
13227#if defined(MBEDTLS_SHA512_C)
13228 case MBEDTLS_MD_SHA384:
13229 return( MBEDTLS_SSL_HASH_SHA384 );
13230 case MBEDTLS_MD_SHA512:
13231 return( MBEDTLS_SSL_HASH_SHA512 );
13232#endif
13233 default:
13234 return( MBEDTLS_SSL_HASH_NONE );
13235 }
13236}
13237
Hanno Beckeree902df2019-08-23 13:47:47 +010013238#if defined(MBEDTLS_USE_TINYCRYPT)
13239/*
13240 * Check if a curve proposed by the peer is in our list.
13241 * Return 0 if we're willing to use it, -1 otherwise.
13242 */
13243int mbedtls_ssl_check_curve_uecc( const mbedtls_ssl_context *ssl,
13244 mbedtls_uecc_group_id grp_id )
13245{
13246 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_UECC_GRP_ID( own_ec_id )
13247 if( own_ec_id == grp_id )
13248 return( 0 );
13249 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_UECC_GRP_ID
13250
13251 return( -1 );
13252}
13253#endif /* MBEDTLS_USE_TINYCRYPT */
13254
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020013255#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013256/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013257 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020013258 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013259 */
Hanno Beckeree902df2019-08-23 13:47:47 +010013260int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl,
13261 mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013262{
Hanno Beckera4a9c692019-06-18 16:55:47 +010013263 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_EC_GRP_ID( own_ec_id )
13264 if( own_ec_id == grp_id )
13265 return( 0 );
13266 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_EC_GRP_ID
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013267
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020013268 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013269}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020013270#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013271
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013272#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013273/*
13274 * Check if a hash proposed by the peer is in our list.
13275 * Return 0 if we're willing to use it, -1 otherwise.
13276 */
13277int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
13278 mbedtls_md_type_t md )
13279{
Hanno Beckerf1bc9e12019-06-19 16:23:21 +010013280 MBEDTLS_SSL_BEGIN_FOR_EACH_SIG_HASH( md_alg )
13281 if( md_alg == md )
13282 return( 0 );
13283 MBEDTLS_SSL_END_FOR_EACH_SIG_HASH
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013284
13285 return( -1 );
13286}
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013287#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013288
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013289#if defined(MBEDTLS_X509_CRT_PARSE_C)
13290int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
Hanno Becker473f98f2019-06-26 10:27:32 +010013291 mbedtls_ssl_ciphersuite_handle_t ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013292 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020013293 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013294{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013295 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013296#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013297 int usage = 0;
13298#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013299#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013300 const char *ext_oid;
13301 size_t ext_len;
13302#endif
13303
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013304#if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
13305 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013306 ((void) cert);
13307 ((void) cert_endpoint);
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013308 ((void) flags);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013309#endif
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013311#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
13312 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013313 {
13314 /* Server part of the key exchange */
Hanno Becker473f98f2019-06-26 10:27:32 +010013315 switch( mbedtls_ssl_suite_get_key_exchange( ciphersuite ) )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013316 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013317 case MBEDTLS_KEY_EXCHANGE_RSA:
13318 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013319 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013320 break;
13321
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013322 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
13323 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
13324 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
13325 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013326 break;
13327
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013328 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
13329 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013330 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013331 break;
13332
13333 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013334 case MBEDTLS_KEY_EXCHANGE_NONE:
13335 case MBEDTLS_KEY_EXCHANGE_PSK:
13336 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
13337 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +020013338 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013339 usage = 0;
13340 }
13341 }
13342 else
13343 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013344 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
13345 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013346 }
13347
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013348 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013349 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013350 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013351 ret = -1;
13352 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013353#else
13354 ((void) ciphersuite);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013355#endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013357#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
13358 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013359 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013360 ext_oid = MBEDTLS_OID_SERVER_AUTH;
13361 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013362 }
13363 else
13364 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013365 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
13366 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013367 }
13368
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013369 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013370 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013371 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013372 ret = -1;
13373 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013374#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013375
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013376 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013377}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013378#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +020013379
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013380#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
13381 defined(MBEDTLS_SSL_PROTO_TLS1_1)
13382int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
13383 unsigned char *output,
13384 unsigned char *data, size_t data_len )
13385{
13386 int ret = 0;
13387 mbedtls_md5_context mbedtls_md5;
13388 mbedtls_sha1_context mbedtls_sha1;
13389
13390 mbedtls_md5_init( &mbedtls_md5 );
13391 mbedtls_sha1_init( &mbedtls_sha1 );
13392
13393 /*
13394 * digitally-signed struct {
13395 * opaque md5_hash[16];
13396 * opaque sha_hash[20];
13397 * };
13398 *
13399 * md5_hash
13400 * MD5(ClientHello.random + ServerHello.random
13401 * + ServerParams);
13402 * sha_hash
13403 * SHA(ClientHello.random + ServerHello.random
13404 * + ServerParams);
13405 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013406 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013407 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013408 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013409 goto exit;
13410 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013411 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013412 ssl->handshake->randbytes, 64 ) ) != 0 )
13413 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013414 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013415 goto exit;
13416 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013417 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013418 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013419 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013420 goto exit;
13421 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013422 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013423 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013424 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013425 goto exit;
13426 }
13427
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013428 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013429 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013430 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013431 goto exit;
13432 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013433 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013434 ssl->handshake->randbytes, 64 ) ) != 0 )
13435 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013436 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013437 goto exit;
13438 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013439 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013440 data_len ) ) != 0 )
13441 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013442 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013443 goto exit;
13444 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013445 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013446 output + 16 ) ) != 0 )
13447 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013448 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013449 goto exit;
13450 }
13451
13452exit:
13453 mbedtls_md5_free( &mbedtls_md5 );
13454 mbedtls_sha1_free( &mbedtls_sha1 );
13455
13456 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013457 mbedtls_ssl_pend_fatal_alert( ssl,
13458 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013459
13460 return( ret );
13461
13462}
13463#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
13464 MBEDTLS_SSL_PROTO_TLS1_1 */
13465
13466#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
13467 defined(MBEDTLS_SSL_PROTO_TLS1_2)
13468int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +020013469 unsigned char *hash, size_t *hashlen,
13470 unsigned char *data, size_t data_len,
13471 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013472{
13473 int ret = 0;
13474 mbedtls_md_context_t ctx;
Andrzej Kurek84bde412020-07-06 15:27:34 -040013475
Hanno Beckera5cedbc2019-07-17 11:21:02 +010013476 mbedtls_md_handle_t md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +020013477 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013478
13479 mbedtls_md_init( &ctx );
13480
13481 /*
13482 * digitally-signed struct {
13483 * opaque client_random[32];
13484 * opaque server_random[32];
13485 * ServerDHParams params;
13486 * };
13487 */
13488 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
13489 {
13490 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
13491 goto exit;
13492 }
13493 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
13494 {
13495 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
13496 goto exit;
13497 }
13498 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
13499 {
13500 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13501 goto exit;
13502 }
13503 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
13504 {
13505 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13506 goto exit;
13507 }
Gilles Peskineca1d7422018-04-24 11:53:22 +020013508 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013509 {
13510 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
13511 goto exit;
13512 }
13513
13514exit:
13515 mbedtls_md_free( &ctx );
13516
13517 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013518 mbedtls_ssl_pend_fatal_alert( ssl,
13519 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013520
Andrzej Kurekafec8852020-07-15 16:31:27 -040013521 return( ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013522}
13523#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
13524 MBEDTLS_SSL_PROTO_TLS1_2 */
13525
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013526#endif /* MBEDTLS_SSL_TLS_C */