blob: 44733fbb951e5e2ac20bbd1b8cd5e6c9d0d05262 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 shared functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Bence Szépkúti4e9f7122020-06-05 13:02:18 +02005 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 *
7 * This file is provided under the Apache License 2.0, or the
8 * GNU General Public License v2.0 or later.
9 *
10 * **********
11 * Apache License 2.0:
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +020012 *
13 * Licensed under the Apache License, Version 2.0 (the "License"); you may
14 * not use this file except in compliance with the License.
15 * You may obtain a copy of the License at
16 *
17 * http://www.apache.org/licenses/LICENSE-2.0
18 *
19 * Unless required by applicable law or agreed to in writing, software
20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
22 * See the License for the specific language governing permissions and
23 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000024 *
Bence Szépkúti4e9f7122020-06-05 13:02:18 +020025 * **********
26 *
27 * **********
28 * GNU General Public License v2.0 or later:
29 *
30 * This program is free software; you can redistribute it and/or modify
31 * it under the terms of the GNU General Public License as published by
32 * the Free Software Foundation; either version 2 of the License, or
33 * (at your option) any later version.
34 *
35 * This program is distributed in the hope that it will be useful,
36 * but WITHOUT ANY WARRANTY; without even the implied warranty of
37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38 * GNU General Public License for more details.
39 *
40 * You should have received a copy of the GNU General Public License along
41 * with this program; if not, write to the Free Software Foundation, Inc.,
42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
43 *
44 * **********
45 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000046 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000047 */
48/*
49 * The SSL 3.0 specification was drafted by Netscape in 1996,
50 * and became an IETF standard in 1999.
51 *
52 * http://wp.netscape.com/eng/ssl3/
53 * http://www.ietf.org/rfc/rfc2246.txt
54 * http://www.ietf.org/rfc/rfc4346.txt
55 */
56
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020057#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000058#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020059#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020060#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020061#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020063#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000064
SimonBd5800b72016-04-26 07:43:27 +010065#if defined(MBEDTLS_PLATFORM_C)
66#include "mbedtls/platform.h"
67#else
68#include <stdlib.h>
69#define mbedtls_calloc calloc
70#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010071#endif
72
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000073#include "mbedtls/debug.h"
74#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020075#include "mbedtls/ssl_internal.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020076
Rich Evans00ab4702015-02-06 13:43:58 +000077#include <string.h>
78
Janos Follath23bdca02016-10-07 14:47:14 +010079#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000080#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020081#endif
82
Paul Bakker34617722014-06-13 17:20:13 +020083/* Implementation that should never be optimized out by the compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020084static void mbedtls_zeroize( void *v, size_t n ) {
Paul Bakker34617722014-06-13 17:20:13 +020085 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
86}
87
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010088/* Length of the "epoch" field in the record header */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020089static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010090{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020091#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020092 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010093 return( 2 );
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +010094#else
95 ((void) ssl);
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010096#endif
97 return( 0 );
98}
99
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200100/*
101 * Start a timer.
102 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200103 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200104static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200105{
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200106 if( ssl->f_set_timer == NULL )
107 return;
108
109 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
110 ssl->f_set_timer( ssl->p_timer, millisecs / 4, millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200111}
112
113/*
114 * Return -1 is timer is expired, 0 if it isn't.
115 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200116static int ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200117{
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200118 if( ssl->f_get_timer == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +0200119 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200120
121 if( ssl->f_get_timer( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200122 {
123 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200124 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200125 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200126
127 return( 0 );
128}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200129
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200130#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200131/*
132 * Double the retransmit timeout value, within the allowed range,
133 * returning -1 if the maximum value has already been reached.
134 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200135static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200136{
137 uint32_t new_timeout;
138
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200139 if( ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200140 return( -1 );
141
142 new_timeout = 2 * ssl->handshake->retransmit_timeout;
143
144 /* Avoid arithmetic overflow and range overflow */
145 if( new_timeout < ssl->handshake->retransmit_timeout ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200146 new_timeout > ssl->conf->hs_timeout_max )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200147 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200148 new_timeout = ssl->conf->hs_timeout_max;
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200149 }
150
151 ssl->handshake->retransmit_timeout = new_timeout;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200152 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200153 ssl->handshake->retransmit_timeout ) );
154
155 return( 0 );
156}
157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200158static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200159{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200160 ssl->handshake->retransmit_timeout = ssl->conf->hs_timeout_min;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200161 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200162 ssl->handshake->retransmit_timeout ) );
163}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200164#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200165
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200166#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200167/*
168 * Convert max_fragment_length codes to length.
169 * RFC 6066 says:
170 * enum{
171 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
172 * } MaxFragmentLength;
173 * and we add 0 -> extension unused
174 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200175static unsigned int mfl_code_to_length[MBEDTLS_SSL_MAX_FRAG_LEN_INVALID] =
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200176{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200177 MBEDTLS_SSL_MAX_CONTENT_LEN, /* MBEDTLS_SSL_MAX_FRAG_LEN_NONE */
178 512, /* MBEDTLS_SSL_MAX_FRAG_LEN_512 */
179 1024, /* MBEDTLS_SSL_MAX_FRAG_LEN_1024 */
180 2048, /* MBEDTLS_SSL_MAX_FRAG_LEN_2048 */
181 4096, /* MBEDTLS_SSL_MAX_FRAG_LEN_4096 */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200182};
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200183#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200184
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +0200185#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200186static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200187{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188 mbedtls_ssl_session_free( dst );
189 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200190
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200191#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200192 if( src->peer_cert != NULL )
193 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200194 int ret;
195
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200196 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200197 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200198 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200200 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200203 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200204 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200205 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200206 dst->peer_cert = NULL;
207 return( ret );
208 }
209 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200210#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200211
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200212#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200213 if( src->ticket != NULL )
214 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200215 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200216 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200217 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200218
219 memcpy( dst->ticket, src->ticket, src->ticket_len );
220 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200221#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200222
223 return( 0 );
224}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +0200225#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
228int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
Paul Bakker9af723c2014-05-01 13:03:14 +0200229 const unsigned char *key_enc, const unsigned char *key_dec,
230 size_t keylen,
231 const unsigned char *iv_enc, const unsigned char *iv_dec,
232 size_t ivlen,
233 const unsigned char *mac_enc, const unsigned char *mac_dec,
Paul Bakker66d5d072014-06-17 16:39:18 +0200234 size_t maclen ) = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200235int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
236int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
237int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
238int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
239int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
240#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000241
Paul Bakker5121ce52009-01-03 21:22:43 +0000242/*
243 * Key material generation
244 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200245#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200246static int ssl3_prf( const unsigned char *secret, size_t slen,
247 const char *label,
248 const unsigned char *random, size_t rlen,
Paul Bakker5f70b252012-09-13 14:23:06 +0000249 unsigned char *dstbuf, size_t dlen )
250{
Andres Amaya Garcia33952502017-07-20 16:29:16 +0100251 int ret = 0;
Paul Bakker5f70b252012-09-13 14:23:06 +0000252 size_t i;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200253 mbedtls_md5_context md5;
254 mbedtls_sha1_context sha1;
Paul Bakker5f70b252012-09-13 14:23:06 +0000255 unsigned char padding[16];
256 unsigned char sha1sum[20];
257 ((void)label);
258
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200259 mbedtls_md5_init( &md5 );
260 mbedtls_sha1_init( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +0200261
Paul Bakker5f70b252012-09-13 14:23:06 +0000262 /*
263 * SSLv3:
264 * block =
265 * MD5( secret + SHA1( 'A' + secret + random ) ) +
266 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
267 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
268 * ...
269 */
270 for( i = 0; i < dlen / 16; i++ )
271 {
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200272 memset( padding, (unsigned char) ('A' + i), 1 + i );
Paul Bakker5f70b252012-09-13 14:23:06 +0000273
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100274 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100275 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100276 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100277 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100278 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100279 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100280 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100281 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100282 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100283 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000284
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100285 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100286 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100287 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100288 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100289 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100290 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100291 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100292 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000293 }
294
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100295exit:
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200296 mbedtls_md5_free( &md5 );
297 mbedtls_sha1_free( &sha1 );
Paul Bakker5f70b252012-09-13 14:23:06 +0000298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200299 mbedtls_zeroize( padding, sizeof( padding ) );
300 mbedtls_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5f70b252012-09-13 14:23:06 +0000301
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100302 return( ret );
Paul Bakker5f70b252012-09-13 14:23:06 +0000303}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200304#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +0000305
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200306#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200307static int tls1_prf( const unsigned char *secret, size_t slen,
308 const char *label,
309 const unsigned char *random, size_t rlen,
Paul Bakker23986e52011-04-24 08:57:21 +0000310 unsigned char *dstbuf, size_t dlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000311{
Paul Bakker23986e52011-04-24 08:57:21 +0000312 size_t nb, hs;
313 size_t i, j, k;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200314 const unsigned char *S1, *S2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000315 unsigned char tmp[128];
316 unsigned char h_i[20];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200317 const mbedtls_md_info_t *md_info;
318 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100319 int ret;
320
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200321 mbedtls_md_init( &md_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +0000322
323 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200324 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000325
326 hs = ( slen + 1 ) / 2;
327 S1 = secret;
328 S2 = secret + slen - hs;
329
330 nb = strlen( label );
331 memcpy( tmp + 20, label, nb );
332 memcpy( tmp + 20 + nb, random, rlen );
333 nb += rlen;
334
335 /*
336 * First compute P_md5(secret,label+random)[0..dlen]
337 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200338 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) == NULL )
339 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100340
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200341 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100342 return( ret );
343
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200344 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
345 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
346 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000347
348 for( i = 0; i < dlen; i += 16 )
349 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200350 mbedtls_md_hmac_reset ( &md_ctx );
351 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
352 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100353
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200354 mbedtls_md_hmac_reset ( &md_ctx );
355 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
356 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000357
358 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
359
360 for( j = 0; j < k; j++ )
361 dstbuf[i + j] = h_i[j];
362 }
363
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200364 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100365
Paul Bakker5121ce52009-01-03 21:22:43 +0000366 /*
367 * XOR out with P_sha1(secret,label+random)[0..dlen]
368 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200369 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) == NULL )
370 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200372 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100373 return( ret );
374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200375 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
376 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
377 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000378
379 for( i = 0; i < dlen; i += 20 )
380 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200381 mbedtls_md_hmac_reset ( &md_ctx );
382 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
383 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100384
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200385 mbedtls_md_hmac_reset ( &md_ctx );
386 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
387 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000388
389 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
390
391 for( j = 0; j < k; j++ )
392 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
393 }
394
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200395 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100396
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200397 mbedtls_zeroize( tmp, sizeof( tmp ) );
398 mbedtls_zeroize( h_i, sizeof( h_i ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000399
400 return( 0 );
401}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200402#endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000403
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200404#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
405static int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100406 const unsigned char *secret, size_t slen,
407 const char *label,
408 const unsigned char *random, size_t rlen,
409 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000410{
411 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100412 size_t i, j, k, md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000413 unsigned char tmp[128];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200414 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
415 const mbedtls_md_info_t *md_info;
416 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100417 int ret;
418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200419 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000420
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200421 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
422 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100423
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200424 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100425
426 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200427 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000428
429 nb = strlen( label );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100430 memcpy( tmp + md_len, label, nb );
431 memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000432 nb += rlen;
433
434 /*
435 * Compute P_<hash>(secret, label + random)[0..dlen]
436 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200437 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100438 return( ret );
439
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200440 mbedtls_md_hmac_starts( &md_ctx, secret, slen );
441 mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
442 mbedtls_md_hmac_finish( &md_ctx, tmp );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100443
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100444 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000445 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200446 mbedtls_md_hmac_reset ( &md_ctx );
447 mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
448 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100449
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200450 mbedtls_md_hmac_reset ( &md_ctx );
451 mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
452 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000453
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100454 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000455
456 for( j = 0; j < k; j++ )
457 dstbuf[i + j] = h_i[j];
458 }
459
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200460 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100461
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200462 mbedtls_zeroize( tmp, sizeof( tmp ) );
463 mbedtls_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000464
465 return( 0 );
466}
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200468#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100469static int tls_prf_sha256( const unsigned char *secret, size_t slen,
470 const char *label,
471 const unsigned char *random, size_t rlen,
472 unsigned char *dstbuf, size_t dlen )
473{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200474 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100475 label, random, rlen, dstbuf, dlen ) );
476}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200477#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000478
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200479#if defined(MBEDTLS_SHA512_C)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200480static int tls_prf_sha384( const unsigned char *secret, size_t slen,
481 const char *label,
482 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000483 unsigned char *dstbuf, size_t dlen )
484{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200485 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100486 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +0000487}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200488#endif /* MBEDTLS_SHA512_C */
489#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +0000490
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200491static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200492
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200493#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
494 defined(MBEDTLS_SSL_PROTO_TLS1_1)
495static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *, const unsigned char *, size_t );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200496#endif
Paul Bakker380da532012-04-18 16:10:25 +0000497
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200498#if defined(MBEDTLS_SSL_PROTO_SSL3)
499static void ssl_calc_verify_ssl( mbedtls_ssl_context *, unsigned char * );
500static void ssl_calc_finished_ssl( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200501#endif
502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200503#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
504static void ssl_calc_verify_tls( mbedtls_ssl_context *, unsigned char * );
505static void ssl_calc_finished_tls( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200506#endif
507
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200508#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
509#if defined(MBEDTLS_SHA256_C)
510static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
511static void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *,unsigned char * );
512static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200513#endif
Paul Bakker769075d2012-11-24 11:26:46 +0100514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200515#if defined(MBEDTLS_SHA512_C)
516static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
517static void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *, unsigned char * );
518static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakker769075d2012-11-24 11:26:46 +0100519#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200520#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200522int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +0000523{
Paul Bakkerda02a7f2013-08-31 17:25:14 +0200524 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +0000525 unsigned char tmp[64];
Paul Bakker5121ce52009-01-03 21:22:43 +0000526 unsigned char keyblk[256];
527 unsigned char *key1;
528 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +0100529 unsigned char *mac_enc;
530 unsigned char *mac_dec;
Hanno Becker81c7b182017-11-09 18:39:33 +0000531 size_t mac_key_len;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200532 size_t iv_copy_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200533 const mbedtls_cipher_info_t *cipher_info;
534 const mbedtls_md_info_t *md_info;
Paul Bakker68884e32013-01-07 18:20:04 +0100535
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200536 mbedtls_ssl_session *session = ssl->session_negotiate;
537 mbedtls_ssl_transform *transform = ssl->transform_negotiate;
538 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Paul Bakker5121ce52009-01-03 21:22:43 +0000539
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200540 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000541
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200542 cipher_info = mbedtls_cipher_info_from_type( transform->ciphersuite_info->cipher );
Paul Bakker68884e32013-01-07 18:20:04 +0100543 if( cipher_info == NULL )
544 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200545 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
Paul Bakker68884e32013-01-07 18:20:04 +0100546 transform->ciphersuite_info->cipher ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200547 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100548 }
549
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200550 md_info = mbedtls_md_info_from_type( transform->ciphersuite_info->mac );
Paul Bakker68884e32013-01-07 18:20:04 +0100551 if( md_info == NULL )
552 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200553 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
Paul Bakker68884e32013-01-07 18:20:04 +0100554 transform->ciphersuite_info->mac ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200555 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100556 }
557
Paul Bakker5121ce52009-01-03 21:22:43 +0000558 /*
Paul Bakkerca4ab492012-04-18 14:23:57 +0000559 * Set appropriate PRF function and other SSL / TLS / TLS1.2 functions
Paul Bakker1ef83d62012-04-11 12:09:53 +0000560 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200561#if defined(MBEDTLS_SSL_PROTO_SSL3)
562 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000563 {
Paul Bakker48916f92012-09-16 19:57:18 +0000564 handshake->tls_prf = ssl3_prf;
565 handshake->calc_verify = ssl_calc_verify_ssl;
566 handshake->calc_finished = ssl_calc_finished_ssl;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000567 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200568 else
569#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200570#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
571 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000572 {
Paul Bakker48916f92012-09-16 19:57:18 +0000573 handshake->tls_prf = tls1_prf;
574 handshake->calc_verify = ssl_calc_verify_tls;
575 handshake->calc_finished = ssl_calc_finished_tls;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000576 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200577 else
578#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200579#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
580#if defined(MBEDTLS_SHA512_C)
581 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
582 transform->ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000583 {
Paul Bakker48916f92012-09-16 19:57:18 +0000584 handshake->tls_prf = tls_prf_sha384;
585 handshake->calc_verify = ssl_calc_verify_tls_sha384;
586 handshake->calc_finished = ssl_calc_finished_tls_sha384;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000587 }
Paul Bakker1ef83d62012-04-11 12:09:53 +0000588 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200589#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200590#if defined(MBEDTLS_SHA256_C)
591 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000592 {
Paul Bakker48916f92012-09-16 19:57:18 +0000593 handshake->tls_prf = tls_prf_sha256;
594 handshake->calc_verify = ssl_calc_verify_tls_sha256;
595 handshake->calc_finished = ssl_calc_finished_tls_sha256;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000596 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200597 else
598#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200599#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +0200600 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200601 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
602 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +0200603 }
Paul Bakker1ef83d62012-04-11 12:09:53 +0000604
605 /*
Paul Bakker5121ce52009-01-03 21:22:43 +0000606 * SSLv3:
607 * master =
608 * MD5( premaster + SHA1( 'A' + premaster + randbytes ) ) +
609 * MD5( premaster + SHA1( 'BB' + premaster + randbytes ) ) +
610 * MD5( premaster + SHA1( 'CCC' + premaster + randbytes ) )
Paul Bakkerf7abd422013-04-16 13:15:56 +0200611 *
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200612 * TLSv1+:
Paul Bakker5121ce52009-01-03 21:22:43 +0000613 * master = PRF( premaster, "master secret", randbytes )[0..47]
614 */
Paul Bakker0a597072012-09-25 21:55:46 +0000615 if( handshake->resume == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000616 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200617 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
Paul Bakker48916f92012-09-16 19:57:18 +0000618 handshake->pmslen );
Paul Bakker5121ce52009-01-03 21:22:43 +0000619
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200620#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
621 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200622 {
623 unsigned char session_hash[48];
624 size_t hash_len;
625
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200626 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using extended master secret" ) );
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200627
628 ssl->handshake->calc_verify( ssl, session_hash );
629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200630#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
631 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200632 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200633#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200634 if( ssl->transform_negotiate->ciphersuite_info->mac ==
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200635 MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200636 {
637 hash_len = 48;
638 }
639 else
640#endif
641 hash_len = 32;
642 }
643 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200644#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200645 hash_len = 36;
646
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200647 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash", session_hash, hash_len );
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200648
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100649 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
650 "extended master secret",
651 session_hash, hash_len,
652 session->master, 48 );
653 if( ret != 0 )
654 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200655 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100656 return( ret );
657 }
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200658
659 }
660 else
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200661#endif
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100662 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
663 "master secret",
664 handshake->randbytes, 64,
665 session->master, 48 );
666 if( ret != 0 )
667 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200668 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100669 return( ret );
670 }
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200671
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200672 mbedtls_zeroize( handshake->premaster, sizeof(handshake->premaster) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000673 }
674 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200675 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000676
677 /*
678 * Swap the client and server random values.
679 */
Paul Bakker48916f92012-09-16 19:57:18 +0000680 memcpy( tmp, handshake->randbytes, 64 );
681 memcpy( handshake->randbytes, tmp + 32, 32 );
682 memcpy( handshake->randbytes + 32, tmp, 32 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200683 mbedtls_zeroize( tmp, sizeof( tmp ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000684
685 /*
686 * SSLv3:
687 * key block =
688 * MD5( master + SHA1( 'A' + master + randbytes ) ) +
689 * MD5( master + SHA1( 'BB' + master + randbytes ) ) +
690 * MD5( master + SHA1( 'CCC' + master + randbytes ) ) +
691 * MD5( master + SHA1( 'DDDD' + master + randbytes ) ) +
692 * ...
693 *
694 * TLSv1:
695 * key block = PRF( master, "key expansion", randbytes )
696 */
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100697 ret = handshake->tls_prf( session->master, 48, "key expansion",
698 handshake->randbytes, 64, keyblk, 256 );
699 if( ret != 0 )
700 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200701 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100702 return( ret );
703 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000704
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200705 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
706 mbedtls_ssl_get_ciphersuite_name( session->ciphersuite ) ) );
707 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", session->master, 48 );
708 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", handshake->randbytes, 64 );
709 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000710
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200711 mbedtls_zeroize( handshake->randbytes, sizeof( handshake->randbytes ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000712
713 /*
714 * Determine the appropriate key, IV and MAC length.
715 */
Paul Bakker68884e32013-01-07 18:20:04 +0100716
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +0200717 transform->keylen = cipher_info->key_bitlen / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200718
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200719 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
720 cipher_info->mode == MBEDTLS_MODE_CCM )
Paul Bakker5121ce52009-01-03 21:22:43 +0000721 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200722 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +0000723 mac_key_len = 0;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200724
Paul Bakker68884e32013-01-07 18:20:04 +0100725 transform->ivlen = 12;
726 transform->fixed_ivlen = 4;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200727
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200728 /* Minimum length is expicit IV + tag */
729 transform->minlen = transform->ivlen - transform->fixed_ivlen
730 + ( transform->ciphersuite_info->flags &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200731 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16 );
Paul Bakker68884e32013-01-07 18:20:04 +0100732 }
733 else
734 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200735 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200736 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
737 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +0100738 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200740 return( ret );
Paul Bakker68884e32013-01-07 18:20:04 +0100741 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000742
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200743 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +0000744 mac_key_len = mbedtls_md_get_size( md_info );
745 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200746
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200747#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200748 /*
749 * If HMAC is to be truncated, we shall keep the leftmost bytes,
750 * (rfc 6066 page 13 or rfc 2104 section 4),
751 * so we only need to adjust the length here.
752 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200753 if( session->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Hanno Beckere89353a2017-11-20 16:36:41 +0000754 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200755 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
Hanno Beckere89353a2017-11-20 16:36:41 +0000756
757#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
758 /* Fall back to old, non-compliant version of the truncated
Hanno Becker563423f2017-11-21 17:20:17 +0000759 * HMAC implementation which also truncates the key
760 * (Mbed TLS versions from 1.3 to 2.6.0) */
Hanno Beckere89353a2017-11-20 16:36:41 +0000761 mac_key_len = transform->maclen;
762#endif
763 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200764#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200765
766 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +0100767 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +0000768
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200769 /* Minimum length */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200770 if( cipher_info->mode == MBEDTLS_MODE_STREAM )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200771 transform->minlen = transform->maclen;
772 else
Paul Bakker68884e32013-01-07 18:20:04 +0100773 {
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200774 /*
775 * GenericBlockCipher:
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100776 * 1. if EtM is in use: one block plus MAC
777 * otherwise: * first multiple of blocklen greater than maclen
778 * 2. IV except for SSL3 and TLS 1.0
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200779 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200780#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
781 if( session->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100782 {
783 transform->minlen = transform->maclen
784 + cipher_info->block_size;
785 }
786 else
787#endif
788 {
789 transform->minlen = transform->maclen
790 + cipher_info->block_size
791 - transform->maclen % cipher_info->block_size;
792 }
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200793
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200794#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
795 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
796 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200797 ; /* No need to adjust minlen */
Paul Bakker68884e32013-01-07 18:20:04 +0100798 else
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200799#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200800#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
801 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_2 ||
802 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200803 {
804 transform->minlen += transform->ivlen;
805 }
806 else
807#endif
808 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200809 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
810 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200811 }
Paul Bakker68884e32013-01-07 18:20:04 +0100812 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000813 }
814
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200815 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %d, minlen: %d, ivlen: %d, maclen: %d",
Paul Bakker48916f92012-09-16 19:57:18 +0000816 transform->keylen, transform->minlen, transform->ivlen,
817 transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000818
819 /*
820 * Finally setup the cipher contexts, IVs and MAC secrets.
821 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200822#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200823 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +0000824 {
Hanno Becker81c7b182017-11-09 18:39:33 +0000825 key1 = keyblk + mac_key_len * 2;
826 key2 = keyblk + mac_key_len * 2 + transform->keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +0000827
Paul Bakker68884e32013-01-07 18:20:04 +0100828 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +0000829 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +0000830
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000831 /*
832 * This is not used in TLS v1.1.
833 */
Paul Bakker48916f92012-09-16 19:57:18 +0000834 iv_copy_len = ( transform->fixed_ivlen ) ?
835 transform->fixed_ivlen : transform->ivlen;
836 memcpy( transform->iv_enc, key2 + transform->keylen, iv_copy_len );
837 memcpy( transform->iv_dec, key2 + transform->keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000838 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +0000839 }
840 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200841#endif /* MBEDTLS_SSL_CLI_C */
842#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200843 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +0000844 {
Hanno Becker81c7b182017-11-09 18:39:33 +0000845 key1 = keyblk + mac_key_len * 2 + transform->keylen;
846 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000847
Hanno Becker81c7b182017-11-09 18:39:33 +0000848 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +0100849 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +0000850
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000851 /*
852 * This is not used in TLS v1.1.
853 */
Paul Bakker48916f92012-09-16 19:57:18 +0000854 iv_copy_len = ( transform->fixed_ivlen ) ?
855 transform->fixed_ivlen : transform->ivlen;
856 memcpy( transform->iv_dec, key1 + transform->keylen, iv_copy_len );
857 memcpy( transform->iv_enc, key1 + transform->keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000858 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +0000859 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100860 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200861#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200863 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
864 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100865 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200867#if defined(MBEDTLS_SSL_PROTO_SSL3)
868 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker68884e32013-01-07 18:20:04 +0100869 {
Hanno Becker81c7b182017-11-09 18:39:33 +0000870 if( mac_key_len > sizeof transform->mac_enc )
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +0100871 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200872 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
873 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +0100874 }
875
Hanno Becker81c7b182017-11-09 18:39:33 +0000876 memcpy( transform->mac_enc, mac_enc, mac_key_len );
877 memcpy( transform->mac_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +0100878 }
879 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200880#endif /* MBEDTLS_SSL_PROTO_SSL3 */
881#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
882 defined(MBEDTLS_SSL_PROTO_TLS1_2)
883 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Paul Bakker68884e32013-01-07 18:20:04 +0100884 {
Gilles Peskine21701302018-03-19 19:06:08 +0100885 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
886 For AEAD-based ciphersuites, there is nothing to do here. */
887 if( mac_key_len != 0 )
888 {
889 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
890 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
891 }
Paul Bakker68884e32013-01-07 18:20:04 +0100892 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200893 else
894#endif
Paul Bakker577e0062013-08-28 11:57:20 +0200895 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200896 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
897 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +0200898 }
Paul Bakker68884e32013-01-07 18:20:04 +0100899
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200900#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
901 if( mbedtls_ssl_hw_record_init != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +0000902 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200903 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +0000904
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200905 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, transform->keylen,
Paul Bakker07eb38b2012-12-19 14:42:06 +0100906 transform->iv_enc, transform->iv_dec,
907 iv_copy_len,
Paul Bakker68884e32013-01-07 18:20:04 +0100908 mac_enc, mac_dec,
Hanno Becker81c7b182017-11-09 18:39:33 +0000909 mac_key_len ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +0000910 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200911 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
912 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +0000913 }
914 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200915#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000916
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +0200917#if defined(MBEDTLS_SSL_EXPORT_KEYS)
918 if( ssl->conf->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +0100919 {
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +0200920 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
921 session->master, keyblk,
Hanno Becker81c7b182017-11-09 18:39:33 +0000922 mac_key_len, transform->keylen,
Robert Cragie4feb7ae2015-10-02 13:33:37 +0100923 iv_copy_len );
924 }
925#endif
926
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +0200927 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200928 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000929 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +0200930 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200931 return( ret );
932 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +0200933
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +0200934 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200935 cipher_info ) ) != 0 )
936 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +0200937 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200938 return( ret );
939 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +0200940
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200941 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +0200942 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200943 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200944 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200946 return( ret );
947 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +0200948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200949 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +0200950 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200951 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200952 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200953 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200954 return( ret );
955 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +0200956
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200957#if defined(MBEDTLS_CIPHER_MODE_CBC)
958 if( cipher_info->mode == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200959 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200960 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
961 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +0200962 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200963 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200964 return( ret );
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +0200965 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200966
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200967 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
968 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200969 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200970 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +0200971 return( ret );
972 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000973 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200974#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +0000975
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200976 mbedtls_zeroize( keyblk, sizeof( keyblk ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000977
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200978#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +0000979 // Initialize compression
980 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200981 if( session->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +0000982 {
Paul Bakker16770332013-10-11 09:59:44 +0200983 if( ssl->compress_buf == NULL )
984 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200985 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200986 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_BUFFER_LEN );
Paul Bakker16770332013-10-11 09:59:44 +0200987 if( ssl->compress_buf == NULL )
988 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +0200989 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200990 MBEDTLS_SSL_BUFFER_LEN ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200991 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker16770332013-10-11 09:59:44 +0200992 }
993 }
994
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200995 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +0000996
Paul Bakker48916f92012-09-16 19:57:18 +0000997 memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
998 memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +0000999
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001000 if( deflateInit( &transform->ctx_deflate,
1001 Z_DEFAULT_COMPRESSION ) != Z_OK ||
Paul Bakker48916f92012-09-16 19:57:18 +00001002 inflateInit( &transform->ctx_inflate ) != Z_OK )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001003 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001004 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1005 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001006 }
1007 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001008#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00001009
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001010 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001011
1012 return( 0 );
1013}
1014
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001015#if defined(MBEDTLS_SSL_PROTO_SSL3)
1016void ssl_calc_verify_ssl( mbedtls_ssl_context *ssl, unsigned char hash[36] )
Paul Bakker5121ce52009-01-03 21:22:43 +00001017{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001018 mbedtls_md5_context md5;
1019 mbedtls_sha1_context sha1;
Paul Bakker5121ce52009-01-03 21:22:43 +00001020 unsigned char pad_1[48];
1021 unsigned char pad_2[48];
1022
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001023 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001024
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001025 mbedtls_md5_init( &md5 );
1026 mbedtls_sha1_init( &sha1 );
1027
1028 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1029 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001030
Paul Bakker380da532012-04-18 16:10:25 +00001031 memset( pad_1, 0x36, 48 );
1032 memset( pad_2, 0x5C, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001033
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001034 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1035 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1036 mbedtls_md5_finish_ret( &md5, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001037
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001038 mbedtls_md5_starts_ret( &md5 );
1039 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1040 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1041 mbedtls_md5_update_ret( &md5, hash, 16 );
1042 mbedtls_md5_finish_ret( &md5, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001043
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001044 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1045 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1046 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001047
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001048 mbedtls_sha1_starts_ret( &sha1 );
1049 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1050 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1051 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1052 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001054 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
1055 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001056
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001057 mbedtls_md5_free( &md5 );
1058 mbedtls_sha1_free( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001059
Paul Bakker380da532012-04-18 16:10:25 +00001060 return;
1061}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001062#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker380da532012-04-18 16:10:25 +00001063
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001064#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1065void ssl_calc_verify_tls( mbedtls_ssl_context *ssl, unsigned char hash[36] )
Paul Bakker380da532012-04-18 16:10:25 +00001066{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001067 mbedtls_md5_context md5;
1068 mbedtls_sha1_context sha1;
Paul Bakker380da532012-04-18 16:10:25 +00001069
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001070 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001071
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001072 mbedtls_md5_init( &md5 );
1073 mbedtls_sha1_init( &sha1 );
1074
1075 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1076 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker380da532012-04-18 16:10:25 +00001077
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001078 mbedtls_md5_finish_ret( &md5, hash );
1079 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001080
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001081 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
1082 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001083
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001084 mbedtls_md5_free( &md5 );
1085 mbedtls_sha1_free( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001086
Paul Bakker380da532012-04-18 16:10:25 +00001087 return;
1088}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001089#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker380da532012-04-18 16:10:25 +00001090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001091#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1092#if defined(MBEDTLS_SHA256_C)
1093void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *ssl, unsigned char hash[32] )
Paul Bakker380da532012-04-18 16:10:25 +00001094{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001095 mbedtls_sha256_context sha256;
Paul Bakker380da532012-04-18 16:10:25 +00001096
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001097 mbedtls_sha256_init( &sha256 );
1098
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001099 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001100
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001101 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001102 mbedtls_sha256_finish_ret( &sha256, hash );
Paul Bakker380da532012-04-18 16:10:25 +00001103
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001104 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 32 );
1105 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001106
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001107 mbedtls_sha256_free( &sha256 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001108
Paul Bakker380da532012-04-18 16:10:25 +00001109 return;
1110}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001111#endif /* MBEDTLS_SHA256_C */
Paul Bakker380da532012-04-18 16:10:25 +00001112
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001113#if defined(MBEDTLS_SHA512_C)
1114void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *ssl, unsigned char hash[48] )
Paul Bakker380da532012-04-18 16:10:25 +00001115{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001116 mbedtls_sha512_context sha512;
Paul Bakker380da532012-04-18 16:10:25 +00001117
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001118 mbedtls_sha512_init( &sha512 );
1119
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001120 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001121
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001122 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001123 mbedtls_sha512_finish_ret( &sha512, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001124
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001125 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 48 );
1126 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001127
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001128 mbedtls_sha512_free( &sha512 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001129
Paul Bakker5121ce52009-01-03 21:22:43 +00001130 return;
1131}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001132#endif /* MBEDTLS_SHA512_C */
1133#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001135#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
1136int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001137{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001138 unsigned char *p = ssl->handshake->premaster;
1139 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001140 const unsigned char *psk = ssl->conf->psk;
1141 size_t psk_len = ssl->conf->psk_len;
1142
1143 /* If the psk callback was called, use its result */
1144 if( ssl->handshake->psk != NULL )
1145 {
1146 psk = ssl->handshake->psk;
1147 psk_len = ssl->handshake->psk_len;
1148 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001149
1150 /*
1151 * PMS = struct {
1152 * opaque other_secret<0..2^16-1>;
1153 * opaque psk<0..2^16-1>;
1154 * };
1155 * with "other_secret" depending on the particular key exchange
1156 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001157#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1158 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001159 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001160 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001161 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001162
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001163 *(p++) = (unsigned char)( psk_len >> 8 );
1164 *(p++) = (unsigned char)( psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001165
1166 if( end < p || (size_t)( end - p ) < psk_len )
1167 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1168
1169 memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001170 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001171 }
1172 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001173#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1174#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1175 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001176 {
1177 /*
1178 * other_secret already set by the ClientKeyExchange message,
1179 * and is 48 bytes long
1180 */
Philippe Antoine33e5c322018-07-09 10:39:02 +02001181 if( end - p < 2 )
1182 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1183
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001184 *p++ = 0;
1185 *p++ = 48;
1186 p += 48;
1187 }
1188 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001189#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1190#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1191 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001192 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02001193 int ret;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001194 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001195
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02001196 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001197 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001198 p + 2, end - ( p + 2 ), &len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001199 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001200 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001201 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001202 return( ret );
1203 }
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02001204 *(p++) = (unsigned char)( len >> 8 );
1205 *(p++) = (unsigned char)( len );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001206 p += len;
1207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001208 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001209 }
1210 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001211#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1212#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1213 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001214 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02001215 int ret;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001216 size_t zlen;
1217
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001218 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02001219 p + 2, end - ( p + 2 ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001220 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001221 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001222 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001223 return( ret );
1224 }
1225
1226 *(p++) = (unsigned char)( zlen >> 8 );
1227 *(p++) = (unsigned char)( zlen );
1228 p += zlen;
1229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001230 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001231 }
1232 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001233#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001234 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001235 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1236 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001237 }
1238
1239 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001240 if( end - p < 2 )
1241 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01001242
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001243 *(p++) = (unsigned char)( psk_len >> 8 );
1244 *(p++) = (unsigned char)( psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001245
1246 if( end < p || (size_t)( end - p ) < psk_len )
1247 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1248
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001249 memcpy( p, psk, psk_len );
1250 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001251
1252 ssl->handshake->pmslen = p - ssl->handshake->premaster;
1253
1254 return( 0 );
1255}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001256#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001257
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001258#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00001259/*
1260 * SSLv3.0 MAC functions
1261 */
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001262#define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001263static void ssl_mac( mbedtls_md_context_t *md_ctx,
1264 const unsigned char *secret,
1265 const unsigned char *buf, size_t len,
1266 const unsigned char *ctr, int type,
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001267 unsigned char out[SSL_MAC_MAX_BYTES] )
Paul Bakker5121ce52009-01-03 21:22:43 +00001268{
1269 unsigned char header[11];
1270 unsigned char padding[48];
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001271 int padlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001272 int md_size = mbedtls_md_get_size( md_ctx->md_info );
1273 int md_type = mbedtls_md_get_type( md_ctx->md_info );
Paul Bakker68884e32013-01-07 18:20:04 +01001274
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001275 /* Only MD5 and SHA-1 supported */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001276 if( md_type == MBEDTLS_MD_MD5 )
Paul Bakker68884e32013-01-07 18:20:04 +01001277 padlen = 48;
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001278 else
Paul Bakker68884e32013-01-07 18:20:04 +01001279 padlen = 40;
Paul Bakker5121ce52009-01-03 21:22:43 +00001280
1281 memcpy( header, ctr, 8 );
1282 header[ 8] = (unsigned char) type;
1283 header[ 9] = (unsigned char)( len >> 8 );
1284 header[10] = (unsigned char)( len );
1285
Paul Bakker68884e32013-01-07 18:20:04 +01001286 memset( padding, 0x36, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001287 mbedtls_md_starts( md_ctx );
1288 mbedtls_md_update( md_ctx, secret, md_size );
1289 mbedtls_md_update( md_ctx, padding, padlen );
1290 mbedtls_md_update( md_ctx, header, 11 );
1291 mbedtls_md_update( md_ctx, buf, len );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001292 mbedtls_md_finish( md_ctx, out );
Paul Bakker5121ce52009-01-03 21:22:43 +00001293
Paul Bakker68884e32013-01-07 18:20:04 +01001294 memset( padding, 0x5C, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001295 mbedtls_md_starts( md_ctx );
1296 mbedtls_md_update( md_ctx, secret, md_size );
1297 mbedtls_md_update( md_ctx, padding, padlen );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001298 mbedtls_md_update( md_ctx, out, md_size );
1299 mbedtls_md_finish( md_ctx, out );
Paul Bakker5f70b252012-09-13 14:23:06 +00001300}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001301#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +00001302
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001303#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \
1304 ( defined(MBEDTLS_CIPHER_MODE_CBC) && \
1305 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) ) )
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02001306#define SSL_SOME_MODES_USE_MAC
Manuel Pégourié-Gonnard8e4b3372014-11-17 15:06:13 +01001307#endif
1308
Manuel Pégourié-Gonnardaeeaaf22018-06-28 10:38:35 +02001309/* The function below is only used in the Lucky 13 counter-measure in
1310 * ssl_decrypt_buf(). These are the defines that guard the call site. */
1311#if defined(SSL_SOME_MODES_USE_MAC) && \
1312 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
1313 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1314 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
1315/* This function makes sure every byte in the memory region is accessed
1316 * (in ascending addresses order) */
1317static void ssl_read_memory( unsigned char *p, size_t len )
1318{
1319 unsigned char acc = 0;
1320 volatile unsigned char force;
1321
1322 for( ; len != 0; p++, len-- )
1323 acc ^= *p;
1324
1325 force = acc;
1326 (void) force;
1327}
1328#endif /* SSL_SOME_MODES_USE_MAC && ( TLS1 || TLS1_1 || TLS1_2 ) */
1329
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01001330/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001331 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +02001332 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001333static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001334{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001335 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001336 int auth_done = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001337
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001338 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001339
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001340 if( ssl->session_out == NULL || ssl->transform_out == NULL )
1341 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001342 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1343 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001344 }
1345
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001346 mode = mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001347
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001348 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +01001349 ssl->out_msg, ssl->out_msglen );
1350
Hanno Beckerd33f1ca2017-09-18 10:55:31 +01001351 if( ssl->out_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
1352 {
Hanno Becker184f6752017-10-04 13:47:33 +01001353 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record content %u too large, maximum %d",
1354 (unsigned) ssl->out_msglen,
Hanno Beckerd33f1ca2017-09-18 10:55:31 +01001355 MBEDTLS_SSL_MAX_CONTENT_LEN ) );
1356 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1357 }
1358
Paul Bakker5121ce52009-01-03 21:22:43 +00001359 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01001360 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +00001361 */
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02001362#if defined(SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001363 if( mode == MBEDTLS_MODE_STREAM ||
1364 ( mode == MBEDTLS_MODE_CBC
1365#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1366 && ssl->session_out->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001367#endif
1368 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00001369 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001370#if defined(MBEDTLS_SSL_PROTO_SSL3)
1371 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001372 {
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001373 unsigned char mac[SSL_MAC_MAX_BYTES];
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001374
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001375 ssl_mac( &ssl->transform_out->md_ctx_enc,
1376 ssl->transform_out->mac_enc,
1377 ssl->out_msg, ssl->out_msglen,
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001378 ssl->out_ctr, ssl->out_msgtype,
1379 mac );
1380
1381 memcpy( ssl->out_msg + ssl->out_msglen, mac, ssl->transform_out->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001382 }
1383 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001384#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001385#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1386 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1387 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001388 {
Hanno Becker992b6872017-11-09 18:57:39 +00001389 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
1390
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001391 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 8 );
1392 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_hdr, 3 );
1393 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_len, 2 );
1394 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc,
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001395 ssl->out_msg, ssl->out_msglen );
Hanno Becker992b6872017-11-09 18:57:39 +00001396 mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, mac );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001397 mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc );
Hanno Becker992b6872017-11-09 18:57:39 +00001398
1399 memcpy( ssl->out_msg + ssl->out_msglen, mac, ssl->transform_out->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001400 }
1401 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001402#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001403 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001404 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1405 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001406 }
1407
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001408 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac",
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001409 ssl->out_msg + ssl->out_msglen,
1410 ssl->transform_out->maclen );
1411
1412 ssl->out_msglen += ssl->transform_out->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001413 auth_done++;
Paul Bakker577e0062013-08-28 11:57:20 +02001414 }
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001415#endif /* AEAD not the only option */
Paul Bakker5121ce52009-01-03 21:22:43 +00001416
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001417 /*
1418 * Encrypt
1419 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001420#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
1421 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00001422 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001423 int ret;
1424 size_t olen = 0;
1425
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001426 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker5121ce52009-01-03 21:22:43 +00001427 "including %d bytes of padding",
1428 ssl->out_msglen, 0 ) );
1429
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001430 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_out->cipher_ctx_enc,
Paul Bakker45125bc2013-09-04 16:47:11 +02001431 ssl->transform_out->iv_enc,
Manuel Pégourié-Gonnard8764d272014-05-13 11:52:02 +02001432 ssl->transform_out->ivlen,
1433 ssl->out_msg, ssl->out_msglen,
1434 ssl->out_msg, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001435 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001436 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001437 return( ret );
1438 }
1439
1440 if( ssl->out_msglen != olen )
1441 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001442 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1443 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001444 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001445 }
Paul Bakker68884e32013-01-07 18:20:04 +01001446 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001447#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
1448#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
1449 if( mode == MBEDTLS_MODE_GCM ||
1450 mode == MBEDTLS_MODE_CCM )
Paul Bakkerca4ab492012-04-18 14:23:57 +00001451 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001452 int ret;
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001453 size_t enc_msglen, olen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001454 unsigned char *enc_msg;
1455 unsigned char add_data[13];
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001456 unsigned char taglen = ssl->transform_out->ciphersuite_info->flags &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001457 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001458
Paul Bakkerca4ab492012-04-18 14:23:57 +00001459 memcpy( add_data, ssl->out_ctr, 8 );
1460 add_data[8] = ssl->out_msgtype;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001461 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001462 ssl->conf->transport, add_data + 9 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001463 add_data[11] = ( ssl->out_msglen >> 8 ) & 0xFF;
1464 add_data[12] = ssl->out_msglen & 0xFF;
1465
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001466 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Paul Bakkerca4ab492012-04-18 14:23:57 +00001467 add_data, 13 );
1468
Paul Bakker68884e32013-01-07 18:20:04 +01001469 /*
1470 * Generate IV
1471 */
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01001472 if( ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen != 8 )
1473 {
1474 /* Reminder if we ever add an AEAD mode with a different size */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001475 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1476 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01001477 }
1478
1479 memcpy( ssl->transform_out->iv_enc + ssl->transform_out->fixed_ivlen,
1480 ssl->out_ctr, 8 );
1481 memcpy( ssl->out_iv, ssl->out_ctr, 8 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001482
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001483 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", ssl->out_iv,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001484 ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen );
Manuel Pégourié-Gonnard226d5da2013-09-05 13:19:22 +02001485
Paul Bakker68884e32013-01-07 18:20:04 +01001486 /*
1487 * Fix pointer positions and message length with added IV
1488 */
1489 enc_msg = ssl->out_msg;
1490 enc_msglen = ssl->out_msglen;
1491 ssl->out_msglen += ssl->transform_out->ivlen -
1492 ssl->transform_out->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001494 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker68884e32013-01-07 18:20:04 +01001495 "including %d bytes of padding",
1496 ssl->out_msglen, 0 ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001497
Paul Bakker68884e32013-01-07 18:20:04 +01001498 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001499 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001500 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001501 if( ( ret = mbedtls_cipher_auth_encrypt( &ssl->transform_out->cipher_ctx_enc,
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001502 ssl->transform_out->iv_enc,
1503 ssl->transform_out->ivlen,
1504 add_data, 13,
1505 enc_msg, enc_msglen,
1506 enc_msg, &olen,
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001507 enc_msg + enc_msglen, taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001508 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001509 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001510 return( ret );
1511 }
1512
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001513 if( olen != enc_msglen )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001514 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001515 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1516 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001517 }
1518
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001519 ssl->out_msglen += taglen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001520 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001522 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag", enc_msg + enc_msglen, taglen );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001523 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001524 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001525#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
1526#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
1527 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) )
1528 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00001529 {
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001530 int ret;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001531 unsigned char *enc_msg;
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01001532 size_t enc_msglen, padlen, olen = 0, i;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001533
Paul Bakker48916f92012-09-16 19:57:18 +00001534 padlen = ssl->transform_out->ivlen - ( ssl->out_msglen + 1 ) %
1535 ssl->transform_out->ivlen;
1536 if( padlen == ssl->transform_out->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00001537 padlen = 0;
1538
1539 for( i = 0; i <= padlen; i++ )
1540 ssl->out_msg[ssl->out_msglen + i] = (unsigned char) padlen;
1541
1542 ssl->out_msglen += padlen + 1;
1543
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001544 enc_msglen = ssl->out_msglen;
1545 enc_msg = ssl->out_msg;
1546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001547#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001548 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00001549 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
1550 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001551 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001552 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001553 {
1554 /*
1555 * Generate IV
1556 */
Manuel Pégourié-Gonnardea356662015-08-27 12:02:40 +02001557 ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->transform_out->iv_enc,
Paul Bakker48916f92012-09-16 19:57:18 +00001558 ssl->transform_out->ivlen );
Paul Bakkera3d195c2011-11-27 21:07:34 +00001559 if( ret != 0 )
1560 return( ret );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001561
Paul Bakker92be97b2013-01-02 17:30:03 +01001562 memcpy( ssl->out_iv, ssl->transform_out->iv_enc,
Paul Bakker48916f92012-09-16 19:57:18 +00001563 ssl->transform_out->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001564
1565 /*
1566 * Fix pointer positions and message length with added IV
1567 */
Paul Bakker92be97b2013-01-02 17:30:03 +01001568 enc_msg = ssl->out_msg;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001569 enc_msglen = ssl->out_msglen;
Paul Bakker48916f92012-09-16 19:57:18 +00001570 ssl->out_msglen += ssl->transform_out->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001571 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001572#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001573
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001574 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001575 "including %d bytes of IV and %d bytes of padding",
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001576 ssl->out_msglen, ssl->transform_out->ivlen,
1577 padlen + 1 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001578
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001579 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_out->cipher_ctx_enc,
Paul Bakker45125bc2013-09-04 16:47:11 +02001580 ssl->transform_out->iv_enc,
Manuel Pégourié-Gonnard8764d272014-05-13 11:52:02 +02001581 ssl->transform_out->ivlen,
1582 enc_msg, enc_msglen,
1583 enc_msg, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001584 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001585 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02001586 return( ret );
1587 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001588
Paul Bakkercca5b812013-08-31 17:40:26 +02001589 if( enc_msglen != olen )
1590 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001591 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1592 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02001593 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001594
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001595#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
1596 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakkercca5b812013-08-31 17:40:26 +02001597 {
1598 /*
1599 * Save IV in SSL3 and TLS1
1600 */
1601 memcpy( ssl->transform_out->iv_enc,
1602 ssl->transform_out->cipher_ctx_enc.iv,
1603 ssl->transform_out->ivlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00001604 }
Paul Bakkercca5b812013-08-31 17:40:26 +02001605#endif
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001607#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001608 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001609 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00001610 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
1611
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001612 /*
1613 * MAC(MAC_write_key, seq_num +
1614 * TLSCipherText.type +
1615 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001616 * length_of( (IV +) ENC(...) ) +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001617 * IV + // except for TLS 1.0
1618 * ENC(content + padding + padding_length));
1619 */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001620 unsigned char pseudo_hdr[13];
1621
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001622 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001623
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001624 memcpy( pseudo_hdr + 0, ssl->out_ctr, 8 );
1625 memcpy( pseudo_hdr + 8, ssl->out_hdr, 3 );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001626 pseudo_hdr[11] = (unsigned char)( ( ssl->out_msglen >> 8 ) & 0xFF );
1627 pseudo_hdr[12] = (unsigned char)( ( ssl->out_msglen ) & 0xFF );
1628
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001629 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr, 13 );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001630
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001631 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, pseudo_hdr, 13 );
1632 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc,
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001633 ssl->out_iv, ssl->out_msglen );
Hanno Becker3d8c9072018-01-05 16:24:22 +00001634 mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, mac );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001635 mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001636
Hanno Becker3d8c9072018-01-05 16:24:22 +00001637 memcpy( ssl->out_iv + ssl->out_msglen, mac,
1638 ssl->transform_out->maclen );
1639
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001640 ssl->out_msglen += ssl->transform_out->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001641 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001642 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001643#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001644 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001645 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001646#endif /* MBEDTLS_CIPHER_MODE_CBC &&
1647 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001648 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001649 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1650 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001651 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001652
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001653 /* Make extra sure authentication was performed, exactly once */
1654 if( auth_done != 1 )
1655 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001656 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1657 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001658 }
1659
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001660 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001661
1662 return( 0 );
1663}
1664
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001665static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001666{
Paul Bakker1e5369c2013-12-19 16:40:57 +01001667 size_t i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001668 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001669 int auth_done = 0;
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02001670#if defined(SSL_SOME_MODES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01001671 size_t padlen = 0, correct = 1;
1672#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001673
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001674 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001675
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001676 if( ssl->session_in == NULL || ssl->transform_in == NULL )
1677 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001678 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1679 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001680 }
1681
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001682 mode = mbedtls_cipher_get_cipher_mode( &ssl->transform_in->cipher_ctx_dec );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001683
Paul Bakker48916f92012-09-16 19:57:18 +00001684 if( ssl->in_msglen < ssl->transform_in->minlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00001685 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001686 MBEDTLS_SSL_DEBUG_MSG( 1, ( "in_msglen (%d) < minlen (%d)",
Paul Bakker48916f92012-09-16 19:57:18 +00001687 ssl->in_msglen, ssl->transform_in->minlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001688 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker5121ce52009-01-03 21:22:43 +00001689 }
1690
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001691#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
1692 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker68884e32013-01-07 18:20:04 +01001693 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001694 int ret;
1695 size_t olen = 0;
1696
Paul Bakker68884e32013-01-07 18:20:04 +01001697 padlen = 0;
1698
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001699 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_in->cipher_ctx_dec,
Paul Bakker45125bc2013-09-04 16:47:11 +02001700 ssl->transform_in->iv_dec,
Manuel Pégourié-Gonnard8764d272014-05-13 11:52:02 +02001701 ssl->transform_in->ivlen,
1702 ssl->in_msg, ssl->in_msglen,
1703 ssl->in_msg, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001704 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001705 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001706 return( ret );
1707 }
1708
1709 if( ssl->in_msglen != olen )
1710 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001711 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1712 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001713 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001714 }
Paul Bakker68884e32013-01-07 18:20:04 +01001715 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001716#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
1717#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
1718 if( mode == MBEDTLS_MODE_GCM ||
1719 mode == MBEDTLS_MODE_CCM )
Paul Bakkerca4ab492012-04-18 14:23:57 +00001720 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001721 int ret;
1722 size_t dec_msglen, olen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001723 unsigned char *dec_msg;
1724 unsigned char *dec_msg_result;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001725 unsigned char add_data[13];
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001726 unsigned char taglen = ssl->transform_in->ciphersuite_info->flags &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001727 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001728 size_t explicit_iv_len = ssl->transform_in->ivlen -
1729 ssl->transform_in->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001730
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001731 if( ssl->in_msglen < explicit_iv_len + taglen )
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02001732 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001733 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02001734 "+ taglen (%d)", ssl->in_msglen,
1735 explicit_iv_len, taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001736 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02001737 }
1738 dec_msglen = ssl->in_msglen - explicit_iv_len - taglen;
1739
Paul Bakker68884e32013-01-07 18:20:04 +01001740 dec_msg = ssl->in_msg;
1741 dec_msg_result = ssl->in_msg;
1742 ssl->in_msglen = dec_msglen;
1743
1744 memcpy( add_data, ssl->in_ctr, 8 );
1745 add_data[8] = ssl->in_msgtype;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001746 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001747 ssl->conf->transport, add_data + 9 );
Paul Bakker68884e32013-01-07 18:20:04 +01001748 add_data[11] = ( ssl->in_msglen >> 8 ) & 0xFF;
1749 add_data[12] = ssl->in_msglen & 0xFF;
1750
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001751 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Paul Bakker68884e32013-01-07 18:20:04 +01001752 add_data, 13 );
1753
1754 memcpy( ssl->transform_in->iv_dec + ssl->transform_in->fixed_ivlen,
1755 ssl->in_iv,
1756 ssl->transform_in->ivlen - ssl->transform_in->fixed_ivlen );
1757
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001758 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", ssl->transform_in->iv_dec,
Paul Bakker68884e32013-01-07 18:20:04 +01001759 ssl->transform_in->ivlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001760 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", dec_msg + dec_msglen, taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01001761
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001762 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001763 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001764 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001765 if( ( ret = mbedtls_cipher_auth_decrypt( &ssl->transform_in->cipher_ctx_dec,
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001766 ssl->transform_in->iv_dec,
1767 ssl->transform_in->ivlen,
1768 add_data, 13,
1769 dec_msg, dec_msglen,
1770 dec_msg_result, &olen,
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001771 dec_msg + dec_msglen, taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00001772 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001773 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001774
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001775 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
1776 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001777
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001778 return( ret );
1779 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001780 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001781
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001782 if( olen != dec_msglen )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001783 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001784 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1785 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001786 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00001787 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001788 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001789#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
1790#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
1791 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) )
1792 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00001793 {
Paul Bakker45829992013-01-03 14:52:21 +01001794 /*
1795 * Decrypt and check the padding
1796 */
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001797 int ret;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001798 unsigned char *dec_msg;
1799 unsigned char *dec_msg_result;
Paul Bakker23986e52011-04-24 08:57:21 +00001800 size_t dec_msglen;
Paul Bakkere47b34b2013-02-27 14:48:00 +01001801 size_t minlen = 0;
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001802 size_t olen = 0;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001803
Paul Bakker5121ce52009-01-03 21:22:43 +00001804 /*
Paul Bakker45829992013-01-03 14:52:21 +01001805 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00001806 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001807#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
1808 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker45829992013-01-03 14:52:21 +01001809 minlen += ssl->transform_in->ivlen;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001810#endif
Paul Bakker45829992013-01-03 14:52:21 +01001811
1812 if( ssl->in_msglen < minlen + ssl->transform_in->ivlen ||
1813 ssl->in_msglen < minlen + ssl->transform_in->maclen + 1 )
1814 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001815 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001816 "+ 1 ) ( + expl IV )", ssl->in_msglen,
1817 ssl->transform_in->ivlen,
1818 ssl->transform_in->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001819 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01001820 }
1821
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001822 dec_msglen = ssl->in_msglen;
1823 dec_msg = ssl->in_msg;
1824 dec_msg_result = ssl->in_msg;
1825
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001826 /*
1827 * Authenticate before decrypt if enabled
1828 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001829#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1830 if( ssl->session_in->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001831 {
Hanno Becker992b6872017-11-09 18:57:39 +00001832 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001833 unsigned char pseudo_hdr[13];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001834
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001835 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001836
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001837 dec_msglen -= ssl->transform_in->maclen;
1838 ssl->in_msglen -= ssl->transform_in->maclen;
1839
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001840 memcpy( pseudo_hdr + 0, ssl->in_ctr, 8 );
1841 memcpy( pseudo_hdr + 8, ssl->in_hdr, 3 );
1842 pseudo_hdr[11] = (unsigned char)( ( ssl->in_msglen >> 8 ) & 0xFF );
1843 pseudo_hdr[12] = (unsigned char)( ( ssl->in_msglen ) & 0xFF );
1844
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001845 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr, 13 );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001846
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001847 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, pseudo_hdr, 13 );
1848 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec,
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001849 ssl->in_iv, ssl->in_msglen );
Hanno Becker992b6872017-11-09 18:57:39 +00001850 mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001851 mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001852
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001853 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_iv + ssl->in_msglen,
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001854 ssl->transform_in->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00001855 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001856 ssl->transform_in->maclen );
1857
Hanno Becker992b6872017-11-09 18:57:39 +00001858 if( mbedtls_ssl_safer_memcmp( ssl->in_iv + ssl->in_msglen, mac_expect,
1859 ssl->transform_in->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001860 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001861 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001862
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001863 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001864 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001865 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001866 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001867#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001868
1869 /*
1870 * Check length sanity
1871 */
1872 if( ssl->in_msglen % ssl->transform_in->ivlen != 0 )
1873 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001874 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001875 ssl->in_msglen, ssl->transform_in->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001876 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001877 }
1878
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001879#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001880 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00001881 * Initialize for prepended IV for block cipher in TLS v1.1 and up
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001882 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001883 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001884 {
Paul Bakker48916f92012-09-16 19:57:18 +00001885 dec_msglen -= ssl->transform_in->ivlen;
1886 ssl->in_msglen -= ssl->transform_in->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001887
Paul Bakker48916f92012-09-16 19:57:18 +00001888 for( i = 0; i < ssl->transform_in->ivlen; i++ )
Paul Bakker92be97b2013-01-02 17:30:03 +01001889 ssl->transform_in->iv_dec[i] = ssl->in_iv[i];
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001890 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001891#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001892
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001893 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_in->cipher_ctx_dec,
Paul Bakker45125bc2013-09-04 16:47:11 +02001894 ssl->transform_in->iv_dec,
Manuel Pégourié-Gonnard8764d272014-05-13 11:52:02 +02001895 ssl->transform_in->ivlen,
1896 dec_msg, dec_msglen,
1897 dec_msg_result, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001898 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001899 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02001900 return( ret );
1901 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001902
Paul Bakkercca5b812013-08-31 17:40:26 +02001903 if( dec_msglen != olen )
1904 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001905 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1906 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02001907 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001908
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001909#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
1910 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakkercca5b812013-08-31 17:40:26 +02001911 {
1912 /*
1913 * Save IV in SSL3 and TLS1
1914 */
1915 memcpy( ssl->transform_in->iv_dec,
1916 ssl->transform_in->cipher_ctx_dec.iv,
1917 ssl->transform_in->ivlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00001918 }
Paul Bakkercca5b812013-08-31 17:40:26 +02001919#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001920
1921 padlen = 1 + ssl->in_msg[ssl->in_msglen - 1];
Paul Bakker45829992013-01-03 14:52:21 +01001922
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001923 if( ssl->in_msglen < ssl->transform_in->maclen + padlen &&
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001924 auth_done == 0 )
Paul Bakker45829992013-01-03 14:52:21 +01001925 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001926#if defined(MBEDTLS_SSL_DEBUG_ALL)
1927 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
Paul Bakker45829992013-01-03 14:52:21 +01001928 ssl->in_msglen, ssl->transform_in->maclen, padlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01001929#endif
Paul Bakker45829992013-01-03 14:52:21 +01001930 padlen = 0;
Paul Bakker45829992013-01-03 14:52:21 +01001931 correct = 0;
1932 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001933
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001934#if defined(MBEDTLS_SSL_PROTO_SSL3)
1935 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001936 {
Paul Bakker48916f92012-09-16 19:57:18 +00001937 if( padlen > ssl->transform_in->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00001938 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001939#if defined(MBEDTLS_SSL_DEBUG_ALL)
1940 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
Paul Bakker5121ce52009-01-03 21:22:43 +00001941 "should be no more than %d",
Paul Bakker48916f92012-09-16 19:57:18 +00001942 padlen, ssl->transform_in->ivlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01001943#endif
Paul Bakker45829992013-01-03 14:52:21 +01001944 correct = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001945 }
1946 }
1947 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001948#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1949#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1950 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1951 if( ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001952 {
1953 /*
Paul Bakker45829992013-01-03 14:52:21 +01001954 * TLSv1+: always check the padding up to the first failure
1955 * and fake check up to 256 bytes of padding
Paul Bakker5121ce52009-01-03 21:22:43 +00001956 */
Paul Bakkerca9c87e2013-09-25 18:52:37 +02001957 size_t pad_count = 0, real_count = 1;
Angus Gratton1ba8e912018-06-19 15:57:50 +10001958 size_t padding_idx = ssl->in_msglen - padlen;
Paul Bakkere47b34b2013-02-27 14:48:00 +01001959
Paul Bakker956c9e02013-12-19 14:42:28 +01001960 /*
1961 * Padding is guaranteed to be incorrect if:
Angus Gratton1ba8e912018-06-19 15:57:50 +10001962 * 1. padlen > ssl->in_msglen
Paul Bakker956c9e02013-12-19 14:42:28 +01001963 *
Angus Gratton1ba8e912018-06-19 15:57:50 +10001964 * 2. padding_idx > MBEDTLS_SSL_MAX_CONTENT_LEN +
Paul Bakker61885c72014-04-25 12:59:03 +02001965 * ssl->transform_in->maclen
Paul Bakker956c9e02013-12-19 14:42:28 +01001966 *
1967 * In both cases we reset padding_idx to a safe value (0) to
1968 * prevent out-of-buffer reads.
1969 */
Angus Gratton1ba8e912018-06-19 15:57:50 +10001970 correct &= ( padlen <= ssl->in_msglen );
1971 correct &= ( padding_idx <= MBEDTLS_SSL_MAX_CONTENT_LEN +
Paul Bakker61885c72014-04-25 12:59:03 +02001972 ssl->transform_in->maclen );
Paul Bakker956c9e02013-12-19 14:42:28 +01001973
1974 padding_idx *= correct;
1975
Angus Gratton1ba8e912018-06-19 15:57:50 +10001976 for( i = 0; i < 256; i++ )
Paul Bakkerca9c87e2013-09-25 18:52:37 +02001977 {
Angus Gratton1ba8e912018-06-19 15:57:50 +10001978 real_count &= ( i < padlen );
Paul Bakkerca9c87e2013-09-25 18:52:37 +02001979 pad_count += real_count *
1980 ( ssl->in_msg[padding_idx + i] == padlen - 1 );
1981 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01001982
1983 correct &= ( pad_count == padlen ); /* Only 1 on correct padding */
Paul Bakkere47b34b2013-02-27 14:48:00 +01001984
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001985#if defined(MBEDTLS_SSL_DEBUG_ALL)
Paul Bakker66d5d072014-06-17 16:39:18 +02001986 if( padlen > 0 && correct == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001987 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01001988#endif
Paul Bakkere47b34b2013-02-27 14:48:00 +01001989 padlen &= correct * 0x1FF;
Paul Bakker5121ce52009-01-03 21:22:43 +00001990 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001991 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001992#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
1993 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02001994 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001995 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1996 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02001997 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001998
1999 ssl->in_msglen -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002000 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002001 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002002#endif /* MBEDTLS_CIPHER_MODE_CBC &&
2003 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002004 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002005 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2006 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002007 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002008
Manuel Pégourié-Gonnard7c344322018-07-10 11:15:36 +02002009#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002010 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Paul Bakker5121ce52009-01-03 21:22:43 +00002011 ssl->in_msg, ssl->in_msglen );
Manuel Pégourié-Gonnard7c344322018-07-10 11:15:36 +02002012#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002013
2014 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002015 * Authenticate if not done yet.
2016 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00002017 */
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02002018#if defined(SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002019 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002020 {
Hanno Becker992b6872017-11-09 18:57:39 +00002021 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01002022
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002023 ssl->in_msglen -= ssl->transform_in->maclen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002024
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01002025 ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 );
2026 ssl->in_len[1] = (unsigned char)( ssl->in_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00002027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002028#if defined(MBEDTLS_SSL_PROTO_SSL3)
2029 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002030 {
2031 ssl_mac( &ssl->transform_in->md_ctx_dec,
2032 ssl->transform_in->mac_dec,
2033 ssl->in_msg, ssl->in_msglen,
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002034 ssl->in_ctr, ssl->in_msgtype,
2035 mac_expect );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002036 }
2037 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002038#endif /* MBEDTLS_SSL_PROTO_SSL3 */
2039#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2040 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2041 if( ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002042 {
2043 /*
2044 * Process MAC and always update for padlen afterwards to make
Gilles Peskinebb07ca02018-06-06 17:23:31 +02002045 * total time independent of padlen.
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002046 *
2047 * Known timing attacks:
2048 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
2049 *
Gilles Peskinebb07ca02018-06-06 17:23:31 +02002050 * To compensate for different timings for the MAC calculation
2051 * depending on how much padding was removed (which is determined
2052 * by padlen), process extra_run more blocks through the hash
2053 * function.
2054 *
2055 * The formula in the paper is
2056 * extra_run = ceil( (L1-55) / 64 ) - ceil( (L2-55) / 64 )
2057 * where L1 is the size of the header plus the decrypted message
2058 * plus CBC padding and L2 is the size of the header plus the
2059 * decrypted message. This is for an underlying hash function
2060 * with 64-byte blocks.
2061 * We use ( (Lx+8) / 64 ) to handle 'negative Lx' values
2062 * correctly. We round down instead of up, so -56 is the correct
2063 * value for our calculations instead of -55.
2064 *
2065 * Repeat the formula rather than defining a block_size variable.
2066 * This avoids requiring division by a variable at runtime
2067 * (which would be marginally less efficient and would require
2068 * linking an extra division function in some builds).
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002069 */
2070 size_t j, extra_run = 0;
Manuel Pégourié-Gonnardaeeaaf22018-06-28 10:38:35 +02002071
2072 /*
2073 * The next two sizes are the minimum and maximum values of
2074 * in_msglen over all padlen values.
2075 *
2076 * They're independent of padlen, since we previously did
2077 * in_msglen -= padlen.
2078 *
2079 * Note that max_len + maclen is never more than the buffer
2080 * length, as we previously did in_msglen -= maclen too.
2081 */
2082 const size_t max_len = ssl->in_msglen + padlen;
2083 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
2084
Gilles Peskinebb07ca02018-06-06 17:23:31 +02002085 switch( ssl->transform_in->ciphersuite_info->mac )
2086 {
2087#if defined(MBEDTLS_MD5_C) || defined(MBEDTLS_SHA1_C) || \
2088 defined(MBEDTLS_SHA256_C)
2089 case MBEDTLS_MD_MD5:
2090 case MBEDTLS_MD_SHA1:
2091 case MBEDTLS_MD_SHA256:
2092 /* 8 bytes of message size, 64-byte compression blocks */
2093 extra_run = ( 13 + ssl->in_msglen + padlen + 8 ) / 64 -
2094 ( 13 + ssl->in_msglen + 8 ) / 64;
2095 break;
2096#endif
2097#if defined(MBEDTLS_SHA512_C)
2098 case MBEDTLS_MD_SHA384:
2099 /* 16 bytes of message size, 128-byte compression blocks */
2100 extra_run = ( 13 + ssl->in_msglen + padlen + 16 ) / 128 -
2101 ( 13 + ssl->in_msglen + 16 ) / 128;
2102 break;
2103#endif
2104 default:
2105 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2106 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2107 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01002108
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002109 extra_run &= correct * 0xFF;
Paul Bakkere47b34b2013-02-27 14:48:00 +01002110
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002111 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_ctr, 8 );
2112 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_hdr, 3 );
2113 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_len, 2 );
2114 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_msg,
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002115 ssl->in_msglen );
Manuel Pégourié-Gonnardaeeaaf22018-06-28 10:38:35 +02002116 /* Make sure we access everything even when padlen > 0. This
2117 * makes the synchronisation requirements for just-in-time
2118 * Prime+Probe attacks much tighter and hopefully impractical. */
2119 ssl_read_memory( ssl->in_msg + ssl->in_msglen, padlen );
Hanno Becker992b6872017-11-09 18:57:39 +00002120 mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnardaeeaaf22018-06-28 10:38:35 +02002121
2122 /* Call mbedtls_md_process at least once due to cache attacks
2123 * that observe whether md_process() was called of not */
Manuel Pégourié-Gonnard47fede02015-04-29 01:35:48 +02002124 for( j = 0; j < extra_run + 1; j++ )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002125 mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg );
Paul Bakkere47b34b2013-02-27 14:48:00 +01002126
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002127 mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );
Manuel Pégourié-Gonnardaeeaaf22018-06-28 10:38:35 +02002128
2129 /* Make sure we access all the memory that could contain the MAC,
2130 * before we check it in the next code block. This makes the
2131 * synchronisation requirements for just-in-time Prime+Probe
2132 * attacks much tighter and hopefully impractical. */
2133 ssl_read_memory( ssl->in_msg + min_len,
2134 max_len - min_len + ssl->transform_in->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002135 }
2136 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002137#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2138 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002139 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002140 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2141 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002142 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002143
Manuel Pégourié-Gonnardaeeaaf22018-06-28 10:38:35 +02002144#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker992b6872017-11-09 18:57:39 +00002145 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, ssl->transform_in->maclen );
2146 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_msg + ssl->in_msglen,
2147 ssl->transform_in->maclen );
Manuel Pégourié-Gonnardaeeaaf22018-06-28 10:38:35 +02002148#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002149
Hanno Becker992b6872017-11-09 18:57:39 +00002150 if( mbedtls_ssl_safer_memcmp( ssl->in_msg + ssl->in_msglen, mac_expect,
2151 ssl->transform_in->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002152 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002153#if defined(MBEDTLS_SSL_DEBUG_ALL)
2154 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01002155#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002156 correct = 0;
2157 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002158 auth_done++;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002159 }
Hanno Beckerca31b472018-10-17 14:43:14 +01002160
2161 /*
2162 * Finally check the correct flag
2163 */
2164 if( correct == 0 )
2165 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02002166#endif /* SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002167
2168 /* Make extra sure authentication was performed, exactly once */
2169 if( auth_done != 1 )
2170 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002171 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2172 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002173 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002174
2175 if( ssl->in_msglen == 0 )
2176 {
Angus Grattonb91cb6e2018-06-19 15:58:22 +10002177#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2178 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3
2179 && ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
2180 {
2181 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
2182 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
2183 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
2184 }
2185#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2186
Paul Bakker5121ce52009-01-03 21:22:43 +00002187 ssl->nb_zero++;
2188
2189 /*
2190 * Three or more empty messages may be a DoS attack
2191 * (excessive CPU consumption).
2192 */
2193 if( ssl->nb_zero > 3 )
2194 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002195 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Paul Bakker5121ce52009-01-03 21:22:43 +00002196 "messages, possible DoS attack" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002197 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker5121ce52009-01-03 21:22:43 +00002198 }
2199 }
2200 else
2201 ssl->nb_zero = 0;
Paul Bakkerf7abd422013-04-16 13:15:56 +02002202
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002203#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002204 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01002205 {
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02002206 ; /* in_ctr read from peer, not maintained internally */
Manuel Pégourié-Gonnardea22ce52014-09-24 09:46:10 +02002207 }
2208 else
2209#endif
2210 {
2211 for( i = 8; i > ssl_ep_len( ssl ); i-- )
2212 if( ++ssl->in_ctr[i - 1] != 0 )
2213 break;
2214
2215 /* The loop goes to its end iff the counter is wrapping */
2216 if( i == ssl_ep_len( ssl ) )
2217 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002218 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
2219 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnardea22ce52014-09-24 09:46:10 +02002220 }
Manuel Pégourié-Gonnard83cdffc2014-03-10 21:20:29 +01002221 }
2222
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002223 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002224
2225 return( 0 );
2226}
2227
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002228#undef MAC_NONE
2229#undef MAC_PLAINTEXT
2230#undef MAC_CIPHERTEXT
2231
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002232#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00002233/*
2234 * Compression/decompression functions
2235 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002236static int ssl_compress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00002237{
2238 int ret;
2239 unsigned char *msg_post = ssl->out_msg;
Andrzej Kurekc3a3e2d2018-04-23 08:39:13 -04002240 ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002241 size_t len_pre = ssl->out_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02002242 unsigned char *msg_pre = ssl->compress_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002244 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002245
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02002246 if( len_pre == 0 )
2247 return( 0 );
2248
Paul Bakker2770fbd2012-07-03 13:30:23 +00002249 memcpy( msg_pre, ssl->out_msg, len_pre );
2250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002251 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002252 ssl->out_msglen ) );
2253
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002254 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002255 ssl->out_msg, ssl->out_msglen );
2256
Paul Bakker48916f92012-09-16 19:57:18 +00002257 ssl->transform_out->ctx_deflate.next_in = msg_pre;
2258 ssl->transform_out->ctx_deflate.avail_in = len_pre;
2259 ssl->transform_out->ctx_deflate.next_out = msg_post;
Andrzej Kurekc3a3e2d2018-04-23 08:39:13 -04002260 ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_BUFFER_LEN - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002261
Paul Bakker48916f92012-09-16 19:57:18 +00002262 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002263 if( ret != Z_OK )
2264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002265 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
2266 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002267 }
2268
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002269 ssl->out_msglen = MBEDTLS_SSL_BUFFER_LEN -
Andrzej Kurekc3a3e2d2018-04-23 08:39:13 -04002270 ssl->transform_out->ctx_deflate.avail_out - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002271
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002272 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002273 ssl->out_msglen ) );
2274
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002275 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002276 ssl->out_msg, ssl->out_msglen );
2277
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002278 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002279
2280 return( 0 );
2281}
2282
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002283static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00002284{
2285 int ret;
2286 unsigned char *msg_post = ssl->in_msg;
Andrzej Kurek149f3a42018-04-24 06:32:44 -04002287 ptrdiff_t header_bytes = ssl->in_msg - ssl->in_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002288 size_t len_pre = ssl->in_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02002289 unsigned char *msg_pre = ssl->compress_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002290
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002291 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002292
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02002293 if( len_pre == 0 )
2294 return( 0 );
2295
Paul Bakker2770fbd2012-07-03 13:30:23 +00002296 memcpy( msg_pre, ssl->in_msg, len_pre );
2297
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002298 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002299 ssl->in_msglen ) );
2300
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002301 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002302 ssl->in_msg, ssl->in_msglen );
2303
Paul Bakker48916f92012-09-16 19:57:18 +00002304 ssl->transform_in->ctx_inflate.next_in = msg_pre;
2305 ssl->transform_in->ctx_inflate.avail_in = len_pre;
2306 ssl->transform_in->ctx_inflate.next_out = msg_post;
Andrzej Kurekc3a3e2d2018-04-23 08:39:13 -04002307 ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_BUFFER_LEN -
Andrzej Kurek149f3a42018-04-24 06:32:44 -04002308 header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002309
Paul Bakker48916f92012-09-16 19:57:18 +00002310 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002311 if( ret != Z_OK )
2312 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002313 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
2314 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002315 }
2316
Andrzej Kurekc3a3e2d2018-04-23 08:39:13 -04002317 ssl->in_msglen = MBEDTLS_SSL_BUFFER_LEN -
Andrzej Kurek149f3a42018-04-24 06:32:44 -04002318 ssl->transform_in->ctx_inflate.avail_out - header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002319
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002320 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002321 ssl->in_msglen ) );
2322
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002323 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002324 ssl->in_msg, ssl->in_msglen );
2325
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002326 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002327
2328 return( 0 );
2329}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002330#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00002331
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002332#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
2333static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002335#if defined(MBEDTLS_SSL_PROTO_DTLS)
2336static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002337{
2338 /* If renegotiation is not enforced, retransmit until we would reach max
2339 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002340 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002341 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002342 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002343 unsigned char doublings = 1;
2344
2345 while( ratio != 0 )
2346 {
2347 ++doublings;
2348 ratio >>= 1;
2349 }
2350
2351 if( ++ssl->renego_records_seen > doublings )
2352 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02002353 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002354 return( 0 );
2355 }
2356 }
2357
2358 return( ssl_write_hello_request( ssl ) );
2359}
2360#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002361#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002362
Paul Bakker5121ce52009-01-03 21:22:43 +00002363/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002364 * Fill the input message buffer by appending data to it.
2365 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002366 *
2367 * If we return 0, is it guaranteed that (at least) nb_want bytes are
2368 * available (from this read and/or a previous one). Otherwise, an error code
2369 * is returned (possibly EOF or WANT_READ).
2370 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002371 * With stream transport (TLS) on success ssl->in_left == nb_want, but
2372 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
2373 * since we always read a whole datagram at once.
2374 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02002375 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002376 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00002377 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002378int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00002379{
Paul Bakker23986e52011-04-24 08:57:21 +00002380 int ret;
2381 size_t len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002382
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002383 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002384
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002385 if( ssl->f_recv == NULL && ssl->f_recv_timeout == NULL )
2386 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002387 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01002388 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002389 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002390 }
2391
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002392 if( nb_want > MBEDTLS_SSL_BUFFER_LEN - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02002393 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002394 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
2395 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02002396 }
2397
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002398#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002399 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00002400 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002401 uint32_t timeout;
2402
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02002403 /* Just to be sure */
2404 if( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL )
2405 {
2406 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
2407 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
2408 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2409 }
2410
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002411 /*
2412 * The point is, we need to always read a full datagram at once, so we
2413 * sometimes read more then requested, and handle the additional data.
2414 * It could be the rest of the current record (while fetching the
2415 * header) and/or some other records in the same datagram.
2416 */
2417
2418 /*
2419 * Move to the next record in the already read datagram if applicable
2420 */
2421 if( ssl->next_record_offset != 0 )
2422 {
2423 if( ssl->in_left < ssl->next_record_offset )
2424 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002425 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2426 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002427 }
2428
2429 ssl->in_left -= ssl->next_record_offset;
2430
2431 if( ssl->in_left != 0 )
2432 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002433 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002434 ssl->next_record_offset ) );
2435 memmove( ssl->in_hdr,
2436 ssl->in_hdr + ssl->next_record_offset,
2437 ssl->in_left );
2438 }
2439
2440 ssl->next_record_offset = 0;
2441 }
2442
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002443 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Paul Bakker5121ce52009-01-03 21:22:43 +00002444 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002445
2446 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002447 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002448 */
2449 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002450 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002451 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002452 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002453 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002454
2455 /*
Antonin Décimo8fd91562019-01-23 15:24:37 +01002456 * A record can't be split across datagrams. If we need to read but
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002457 * are not at the beginning of a new record, the caller did something
2458 * wrong.
2459 */
2460 if( ssl->in_left != 0 )
2461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002462 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2463 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002464 }
2465
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002466 /*
2467 * Don't even try to read if time's out already.
2468 * This avoids by-passing the timer when repeatedly receiving messages
2469 * that will end up being dropped.
2470 */
2471 if( ssl_check_timer( ssl ) != 0 )
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002472 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002473 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002474 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002475 len = MBEDTLS_SSL_BUFFER_LEN - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002476
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002477 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002478 timeout = ssl->handshake->retransmit_timeout;
2479 else
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002480 timeout = ssl->conf->read_timeout;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002481
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002482 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002483
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02002484 if( ssl->f_recv_timeout != NULL )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002485 ret = ssl->f_recv_timeout( ssl->p_bio, ssl->in_hdr, len,
2486 timeout );
2487 else
2488 ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr, len );
2489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002490 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002491
2492 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002493 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002494 }
2495
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002496 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002497 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002498 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002499 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002500
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002501 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02002502 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002503 if( ssl_double_retransmit_timeout( ssl ) != 0 )
2504 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002505 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002506 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002507 }
2508
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002509 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002510 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002511 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002512 return( ret );
2513 }
2514
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002515 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02002516 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002517#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002518 else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002519 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002520 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002521 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002522 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002523 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002524 return( ret );
2525 }
2526
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002527 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002528 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002529#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002530 }
2531
Paul Bakker5121ce52009-01-03 21:22:43 +00002532 if( ret < 0 )
2533 return( ret );
2534
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002535 ssl->in_left = ret;
2536 }
2537 else
2538#endif
2539 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002540 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002541 ssl->in_left, nb_want ) );
2542
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002543 while( ssl->in_left < nb_want )
2544 {
2545 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02002546
2547 if( ssl_check_timer( ssl ) != 0 )
2548 ret = MBEDTLS_ERR_SSL_TIMEOUT;
2549 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02002550 {
2551 if( ssl->f_recv_timeout != NULL )
2552 {
2553 ret = ssl->f_recv_timeout( ssl->p_bio,
2554 ssl->in_hdr + ssl->in_left, len,
2555 ssl->conf->read_timeout );
2556 }
2557 else
2558 {
2559 ret = ssl->f_recv( ssl->p_bio,
2560 ssl->in_hdr + ssl->in_left, len );
2561 }
2562 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002563
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002564 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02002565 ssl->in_left, nb_want ) );
2566 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002567
2568 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002569 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002570
2571 if( ret < 0 )
2572 return( ret );
2573
mohammad160344a6a682018-03-28 23:45:33 -07002574 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad1603b11af862018-03-19 07:18:13 -07002575 {
Jaeden Amerob5f53b12018-04-03 12:09:45 +01002576 MBEDTLS_SSL_DEBUG_MSG( 1,
2577 ( "f_recv returned %d bytes but only %lu were requested",
mohammad160329ed80f2018-04-02 07:34:26 -07002578 ret, (unsigned long)len ) );
mohammad1603b11af862018-03-19 07:18:13 -07002579 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2580 }
2581
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002582 ssl->in_left += ret;
2583 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002584 }
2585
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002586 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002587
2588 return( 0 );
2589}
2590
2591/*
2592 * Flush any data not yet written
2593 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002594int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002595{
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01002596 int ret;
2597 unsigned char *buf, i;
Paul Bakker5121ce52009-01-03 21:22:43 +00002598
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002599 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002600
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002601 if( ssl->f_send == NULL )
2602 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002603 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01002604 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002605 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002606 }
2607
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002608 /* Avoid incrementing counter if data is flushed */
2609 if( ssl->out_left == 0 )
2610 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002611 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002612 return( 0 );
2613 }
2614
Paul Bakker5121ce52009-01-03 21:22:43 +00002615 while( ssl->out_left > 0 )
2616 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002617 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
2618 mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002619
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002620 buf = ssl->out_hdr + mbedtls_ssl_hdr_len( ssl ) +
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002621 ssl->out_msglen - ssl->out_left;
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002622 ret = ssl->f_send( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00002623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002624 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002625
2626 if( ret <= 0 )
2627 return( ret );
2628
mohammad160344a6a682018-03-28 23:45:33 -07002629 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16036085c722018-02-22 04:29:04 -08002630 {
Jaeden Amerob5f53b12018-04-03 12:09:45 +01002631 MBEDTLS_SSL_DEBUG_MSG( 1,
2632 ( "f_send returned %d bytes but only %lu bytes were sent",
mohammad160329ed80f2018-04-02 07:34:26 -07002633 ret, (unsigned long)ssl->out_left ) );
mohammad16036085c722018-02-22 04:29:04 -08002634 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2635 }
2636
Paul Bakker5121ce52009-01-03 21:22:43 +00002637 ssl->out_left -= ret;
2638 }
2639
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01002640 for( i = 8; i > ssl_ep_len( ssl ); i-- )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002641 if( ++ssl->out_ctr[i - 1] != 0 )
2642 break;
2643
2644 /* The loop goes to its end iff the counter is wrapping */
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01002645 if( i == ssl_ep_len( ssl ) )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002646 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002647 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
2648 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002649 }
2650
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002651 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002652
2653 return( 0 );
2654}
2655
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002656/*
2657 * Functions to handle the DTLS retransmission state machine
2658 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002659#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002660/*
2661 * Append current handshake message to current outgoing flight
2662 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002663static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002664{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002665 mbedtls_ssl_flight_item *msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002666
2667 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02002668 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002669 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02002670 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002671 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002672 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002673 }
2674
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02002675 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002676 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02002677 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002678 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002679 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002680 }
2681
2682 /* Copy current handshake message with headers */
2683 memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
2684 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002685 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002686 msg->next = NULL;
2687
2688 /* Append to the current flight */
2689 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002690 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002691 else
2692 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002693 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002694 while( cur->next != NULL )
2695 cur = cur->next;
2696 cur->next = msg;
2697 }
2698
2699 return( 0 );
2700}
2701
2702/*
2703 * Free the current flight of handshake messages
2704 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002705static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002706{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002707 mbedtls_ssl_flight_item *cur = flight;
2708 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002709
2710 while( cur != NULL )
2711 {
2712 next = cur->next;
2713
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002714 mbedtls_free( cur->p );
2715 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002716
2717 cur = next;
2718 }
2719}
2720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002721#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
2722static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02002723#endif
2724
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002725/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002726 * Swap transform_out and out_ctr with the alternative ones
2727 */
Andres Amaya Garcia87580532018-12-05 21:57:57 +00002728static int ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002729{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002730 mbedtls_ssl_transform *tmp_transform;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002731 unsigned char tmp_out_ctr[8];
Andres Amaya Garcia87580532018-12-05 21:57:57 +00002732#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
2733 int ret;
2734#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002735
2736 if( ssl->transform_out == ssl->handshake->alt_transform_out )
2737 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002738 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Andres Amaya Garcia87580532018-12-05 21:57:57 +00002739 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002740 }
2741
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002742 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002743
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002744 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002745 tmp_transform = ssl->transform_out;
2746 ssl->transform_out = ssl->handshake->alt_transform_out;
2747 ssl->handshake->alt_transform_out = tmp_transform;
2748
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002749 /* Swap epoch + sequence_number */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002750 memcpy( tmp_out_ctr, ssl->out_ctr, 8 );
2751 memcpy( ssl->out_ctr, ssl->handshake->alt_out_ctr, 8 );
2752 memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002753
2754 /* Adjust to the newly activated transform */
2755 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002756 ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002757 {
2758 ssl->out_msg = ssl->out_iv + ssl->transform_out->ivlen -
2759 ssl->transform_out->fixed_ivlen;
2760 }
2761 else
2762 ssl->out_msg = ssl->out_iv;
2763
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002764#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
2765 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002766 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002767 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002768 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002769 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
2770 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002771 }
2772 }
Andres Amaya Garcia87580532018-12-05 21:57:57 +00002773#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
2774
2775 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002776}
2777
2778/*
2779 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002780 *
2781 * Need to remember the current message in case flush_output returns
2782 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002783 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002784 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002785int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002786{
Andres Amaya Garcia87580532018-12-05 21:57:57 +00002787 int ret;
2788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002789 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002791 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002792 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002793 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise resending" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002794
2795 ssl->handshake->cur_msg = ssl->handshake->flight;
Andres Amaya Garcia87580532018-12-05 21:57:57 +00002796 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
2797 return( ret );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002798
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002799 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002800 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002801
2802 while( ssl->handshake->cur_msg != NULL )
2803 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002804 mbedtls_ssl_flight_item *cur = ssl->handshake->cur_msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002805
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002806 /* Swap epochs before sending Finished: we can't do it after
2807 * sending ChangeCipherSpec, in case write returns WANT_READ.
2808 * Must be done before copying, may change out_msg pointer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002809 if( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
2810 cur->p[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002811 {
Andres Amaya Garcia87580532018-12-05 21:57:57 +00002812 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
2813 return( ret );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002814 }
2815
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002816 memcpy( ssl->out_msg, cur->p, cur->len );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002817 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002818 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002819
2820 ssl->handshake->cur_msg = cur->next;
2821
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002822 MBEDTLS_SSL_DEBUG_BUF( 3, "resent handshake message header", ssl->out_msg, 12 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002823
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002824 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002825 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002826 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002827 return( ret );
2828 }
2829 }
2830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002831 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
2832 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02002833 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002834 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002835 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002836 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
2837 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002838
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002839 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002840
2841 return( 0 );
2842}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002843
2844/*
2845 * To be called when the last message of an incoming flight is received.
2846 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002847void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002848{
2849 /* We won't need to resend that one any more */
2850 ssl_flight_free( ssl->handshake->flight );
2851 ssl->handshake->flight = NULL;
2852 ssl->handshake->cur_msg = NULL;
2853
2854 /* The next incoming flight will start with this msg_seq */
2855 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
2856
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02002857 /* Cancel timer */
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002858 ssl_set_timer( ssl, 0 );
2859
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002860 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2861 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002863 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002864 }
2865 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002866 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002867}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002868
2869/*
2870 * To be called when the last message of an outgoing flight is send.
2871 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002872void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002873{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02002874 ssl_reset_retransmit_timeout( ssl );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02002875 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002877 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2878 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002879 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002880 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002881 }
2882 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002883 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002884}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002885#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002886
Paul Bakker5121ce52009-01-03 21:22:43 +00002887/*
2888 * Record layer functions
2889 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002890
2891/*
2892 * Write current record.
2893 * Uses ssl->out_msgtype, ssl->out_msglen and bytes at ssl->out_msg.
2894 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002895int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002896{
Nicholas Wilsonf0021642016-04-13 11:51:05 +01002897 int ret, done = 0, out_msg_type;
Paul Bakker23986e52011-04-24 08:57:21 +00002898 size_t len = ssl->out_msglen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002899
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002900 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002901
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002902#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002903 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002904 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002905 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002906 {
2907 ; /* Skip special handshake treatment when resending */
2908 }
2909 else
2910#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002911 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002912 {
Nicholas Wilsonf0021642016-04-13 11:51:05 +01002913 out_msg_type = ssl->out_msg[0];
2914
2915 if( out_msg_type != MBEDTLS_SSL_HS_HELLO_REQUEST &&
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02002916 ssl->handshake == NULL )
2917 {
2918 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2919 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2920 }
2921
Paul Bakker5121ce52009-01-03 21:22:43 +00002922 ssl->out_msg[1] = (unsigned char)( ( len - 4 ) >> 16 );
2923 ssl->out_msg[2] = (unsigned char)( ( len - 4 ) >> 8 );
2924 ssl->out_msg[3] = (unsigned char)( ( len - 4 ) );
2925
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002926 /*
2927 * DTLS has additional fields in the Handshake layer,
2928 * between the length field and the actual payload:
2929 * uint16 message_seq;
2930 * uint24 fragment_offset;
2931 * uint24 fragment_length;
2932 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002933#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002934 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002935 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01002936 /* Make room for the additional DTLS fields */
Hanno Becker9648f8b2017-09-18 10:55:54 +01002937 if( MBEDTLS_SSL_MAX_CONTENT_LEN - ssl->out_msglen < 8 )
2938 {
2939 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
2940 "size %u, maximum %u",
2941 (unsigned) ( ssl->in_hslen - 4 ),
2942 (unsigned) ( MBEDTLS_SSL_MAX_CONTENT_LEN - 12 ) ) );
2943 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2944 }
2945
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01002946 memmove( ssl->out_msg + 12, ssl->out_msg + 4, len - 4 );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002947 ssl->out_msglen += 8;
2948 len += 8;
2949
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02002950 /* Write message_seq and update it, except for HelloRequest */
Nicholas Wilsonf0021642016-04-13 11:51:05 +01002951 if( out_msg_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02002952 {
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02002953 ssl->out_msg[4] = ( ssl->handshake->out_msg_seq >> 8 ) & 0xFF;
2954 ssl->out_msg[5] = ( ssl->handshake->out_msg_seq ) & 0xFF;
2955 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02002956 }
2957 else
2958 {
2959 ssl->out_msg[4] = 0;
2960 ssl->out_msg[5] = 0;
2961 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01002962
2963 /* We don't fragment, so frag_offset = 0 and frag_len = len */
2964 memset( ssl->out_msg + 6, 0x00, 3 );
2965 memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002966 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002967#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002968
Nicholas Wilsonf0021642016-04-13 11:51:05 +01002969 if( out_msg_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardf3dc2f62013-10-29 18:17:41 +01002970 ssl->handshake->update_checksum( ssl, ssl->out_msg, len );
Paul Bakker5121ce52009-01-03 21:22:43 +00002971 }
2972
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002973 /* Save handshake and CCS messages for resending */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002974#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002975 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002976 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002977 ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING &&
2978 ( ssl->out_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC ||
2979 ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002980 {
2981 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
2982 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002983 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002984 return( ret );
2985 }
2986 }
2987#endif
2988
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002989#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00002990 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002991 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00002992 {
2993 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
2994 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002995 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002996 return( ret );
2997 }
2998
2999 len = ssl->out_msglen;
3000 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003001#endif /*MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00003002
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003003#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3004 if( mbedtls_ssl_hw_record_write != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003005 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003006 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003007
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003008 ret = mbedtls_ssl_hw_record_write( ssl );
3009 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00003010 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003011 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
3012 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00003013 }
Paul Bakkerc7878112012-12-19 14:41:14 +01003014
3015 if( ret == 0 )
3016 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00003017 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003018#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00003019 if( !done )
3020 {
3021 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003022 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003023 ssl->conf->transport, ssl->out_hdr + 1 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003024
3025 ssl->out_len[0] = (unsigned char)( len >> 8 );
3026 ssl->out_len[1] = (unsigned char)( len );
Paul Bakker05ef8352012-05-08 09:17:57 +00003027
Paul Bakker48916f92012-09-16 19:57:18 +00003028 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00003029 {
3030 if( ( ret = ssl_encrypt_buf( ssl ) ) != 0 )
3031 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003032 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00003033 return( ret );
3034 }
3035
3036 len = ssl->out_msglen;
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003037 ssl->out_len[0] = (unsigned char)( len >> 8 );
3038 ssl->out_len[1] = (unsigned char)( len );
Paul Bakker05ef8352012-05-08 09:17:57 +00003039 }
3040
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003041 ssl->out_left = mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen;
Paul Bakker05ef8352012-05-08 09:17:57 +00003042
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003043 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
Paul Bakker05ef8352012-05-08 09:17:57 +00003044 "version = [%d:%d], msglen = %d",
3045 ssl->out_hdr[0], ssl->out_hdr[1], ssl->out_hdr[2],
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003046 ( ssl->out_len[0] << 8 ) | ssl->out_len[1] ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00003047
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003048 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
3049 ssl->out_hdr, mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00003050 }
3051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003052 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003053 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003054 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003055 return( ret );
3056 }
3057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003058 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003059
3060 return( 0 );
3061}
3062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003063#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003064/*
3065 * Mark bits in bitmask (used for DTLS HS reassembly)
3066 */
3067static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
3068{
3069 unsigned int start_bits, end_bits;
3070
3071 start_bits = 8 - ( offset % 8 );
3072 if( start_bits != 8 )
3073 {
3074 size_t first_byte_idx = offset / 8;
3075
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02003076 /* Special case */
3077 if( len <= start_bits )
3078 {
3079 for( ; len != 0; len-- )
3080 mask[first_byte_idx] |= 1 << ( start_bits - len );
3081
3082 /* Avoid potential issues with offset or len becoming invalid */
3083 return;
3084 }
3085
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003086 offset += start_bits; /* Now offset % 8 == 0 */
3087 len -= start_bits;
3088
3089 for( ; start_bits != 0; start_bits-- )
3090 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
3091 }
3092
3093 end_bits = len % 8;
3094 if( end_bits != 0 )
3095 {
3096 size_t last_byte_idx = ( offset + len ) / 8;
3097
3098 len -= end_bits; /* Now len % 8 == 0 */
3099
3100 for( ; end_bits != 0; end_bits-- )
3101 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
3102 }
3103
3104 memset( mask + offset / 8, 0xFF, len / 8 );
3105}
3106
3107/*
3108 * Check that bitmask is full
3109 */
3110static int ssl_bitmask_check( unsigned char *mask, size_t len )
3111{
3112 size_t i;
3113
3114 for( i = 0; i < len / 8; i++ )
3115 if( mask[i] != 0xFF )
3116 return( -1 );
3117
3118 for( i = 0; i < len % 8; i++ )
3119 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
3120 return( -1 );
3121
3122 return( 0 );
3123}
3124
3125/*
3126 * Reassemble fragmented DTLS handshake messages.
3127 *
3128 * Use a temporary buffer for reassembly, divided in two parts:
3129 * - the first holds the reassembled message (including handshake header),
3130 * - the second holds a bitmask indicating which parts of the message
3131 * (excluding headers) have been received so far.
3132 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003133static int ssl_reassemble_dtls_handshake( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003134{
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003135 unsigned char *msg, *bitmask;
3136 size_t frag_len, frag_off;
3137 size_t msg_len = ssl->in_hslen - 12; /* Without headers */
3138
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003139 if( ssl->handshake == NULL )
3140 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003141 MBEDTLS_SSL_DEBUG_MSG( 1, ( "not supported outside handshake (for now)" ) );
3142 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003143 }
3144
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003145 /*
3146 * For first fragment, check size and allocate buffer
3147 */
3148 if( ssl->handshake->hs_msg == NULL )
3149 {
3150 size_t alloc_len;
3151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003152 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003153 msg_len ) );
3154
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003155 if( ssl->in_hslen > MBEDTLS_SSL_MAX_CONTENT_LEN )
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003156 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003157 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too large" ) );
3158 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003159 }
3160
3161 /* The bitmask needs one bit per byte of message excluding header */
3162 alloc_len = 12 + msg_len + msg_len / 8 + ( msg_len % 8 != 0 );
3163
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003164 ssl->handshake->hs_msg = mbedtls_calloc( 1, alloc_len );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003165 if( ssl->handshake->hs_msg == NULL )
3166 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02003167 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", alloc_len ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003168 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003169 }
3170
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003171 /* Prepare final header: copy msg_type, length and message_seq,
3172 * then add standardised fragment_offset and fragment_length */
3173 memcpy( ssl->handshake->hs_msg, ssl->in_msg, 6 );
3174 memset( ssl->handshake->hs_msg + 6, 0, 3 );
3175 memcpy( ssl->handshake->hs_msg + 9,
3176 ssl->handshake->hs_msg + 1, 3 );
3177 }
3178 else
3179 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003180 /* Make sure msg_type and length are consistent */
3181 if( memcmp( ssl->handshake->hs_msg, ssl->in_msg, 4 ) != 0 )
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003182 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003183 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment header mismatch" ) );
3184 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003185 }
3186 }
3187
3188 msg = ssl->handshake->hs_msg + 12;
3189 bitmask = msg + msg_len;
3190
3191 /*
3192 * Check and copy current fragment
3193 */
3194 frag_off = ( ssl->in_msg[6] << 16 ) |
3195 ( ssl->in_msg[7] << 8 ) |
3196 ssl->in_msg[8];
3197 frag_len = ( ssl->in_msg[9] << 16 ) |
3198 ( ssl->in_msg[10] << 8 ) |
3199 ssl->in_msg[11];
3200
3201 if( frag_off + frag_len > msg_len )
3202 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003203 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid fragment offset/len: %d + %d > %d",
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003204 frag_off, frag_len, msg_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003205 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003206 }
3207
3208 if( frag_len + 12 > ssl->in_msglen )
3209 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003210 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid fragment length: %d + 12 > %d",
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003211 frag_len, ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003212 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003213 }
3214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003215 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003216 frag_off, frag_len ) );
3217
3218 memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
3219 ssl_bitmask_set( bitmask, frag_off, frag_len );
3220
3221 /*
3222 * Do we have the complete message by now?
3223 * If yes, finalize it, else ask to read the next record.
3224 */
3225 if( ssl_bitmask_check( bitmask, msg_len ) != 0 )
3226 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003227 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message is not complete yet" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003228 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003229 }
3230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003231 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake message completed" ) );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003232
Manuel Pégourié-Gonnard23cad332014-10-13 17:06:41 +02003233 if( frag_len + 12 < ssl->in_msglen )
3234 {
3235 /*
3236 * We'got more handshake messages in the same record.
3237 * This case is not handled now because no know implementation does
3238 * that and it's hard to test, so we prefer to fail cleanly for now.
3239 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003240 MBEDTLS_SSL_DEBUG_MSG( 1, ( "last fragment not alone in its record" ) );
3241 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard23cad332014-10-13 17:06:41 +02003242 }
3243
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003244 if( ssl->in_left > ssl->next_record_offset )
3245 {
3246 /*
3247 * We've got more data in the buffer after the current record,
3248 * that we don't want to overwrite. Move it before writing the
3249 * reassembled message, and adjust in_left and next_record_offset.
3250 */
3251 unsigned char *cur_remain = ssl->in_hdr + ssl->next_record_offset;
3252 unsigned char *new_remain = ssl->in_msg + ssl->in_hslen;
3253 size_t remain_len = ssl->in_left - ssl->next_record_offset;
3254
3255 /* First compute and check new lengths */
3256 ssl->next_record_offset = new_remain - ssl->in_hdr;
3257 ssl->in_left = ssl->next_record_offset + remain_len;
3258
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003259 if( ssl->in_left > MBEDTLS_SSL_BUFFER_LEN -
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003260 (size_t)( ssl->in_hdr - ssl->in_buf ) )
3261 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003262 MBEDTLS_SSL_DEBUG_MSG( 1, ( "reassembled message too large for buffer" ) );
3263 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003264 }
3265
3266 memmove( new_remain, cur_remain, remain_len );
3267 }
3268
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003269 memcpy( ssl->in_msg, ssl->handshake->hs_msg, ssl->in_hslen );
3270
Hanno Beckerd82e0c02018-10-15 13:22:22 +01003271 mbedtls_zeroize( ssl->handshake->hs_msg, ssl->in_hslen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003272 mbedtls_free( ssl->handshake->hs_msg );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003273 ssl->handshake->hs_msg = NULL;
3274
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003275 MBEDTLS_SSL_DEBUG_BUF( 3, "reassembled handshake message",
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003276 ssl->in_msg, ssl->in_hslen );
3277
3278 return( 0 );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003279}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003280#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003281
Simon Butcher99000142016-10-13 17:21:01 +01003282int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003283{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003284 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003285 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003286 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003287 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003288 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003289 }
3290
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003291 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + (
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003292 ( ssl->in_msg[1] << 16 ) |
3293 ( ssl->in_msg[2] << 8 ) |
3294 ssl->in_msg[3] );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003295
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003296 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003297 " %d, type = %d, hslen = %d",
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003298 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003299
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003300#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003301 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003302 {
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003303 int ret;
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003304 unsigned int recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003305
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003306 /* ssl->handshake is NULL when receiving ClientHello for renego */
3307 if( ssl->handshake != NULL &&
3308 recv_msg_seq != ssl->handshake->in_msg_seq )
3309 {
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02003310 /* Retransmit only on last message from previous flight, to avoid
3311 * too many retransmissions.
3312 * Besides, No sane server ever retransmits HelloVerifyRequest */
3313 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003314 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003315 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003316 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003317 "message_seq = %d, start_of_flight = %d",
3318 recv_msg_seq,
3319 ssl->handshake->in_flight_start_seq ) );
3320
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003321 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003322 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003323 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003324 return( ret );
3325 }
3326 }
3327 else
3328 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003329 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003330 "message_seq = %d, expected = %d",
3331 recv_msg_seq,
3332 ssl->handshake->in_msg_seq ) );
3333 }
3334
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003335 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003336 }
3337 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003338
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003339 /* Reassemble if current message is fragmented or reassembly is
3340 * already in progress */
3341 if( ssl->in_msglen < ssl->in_hslen ||
3342 memcmp( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
3343 memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 ||
3344 ( ssl->handshake != NULL && ssl->handshake->hs_msg != NULL ) )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003345 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003346 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003347
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003348 if( ( ret = ssl_reassemble_dtls_handshake( ssl ) ) != 0 )
3349 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003350 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_reassemble_dtls_handshake", ret );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003351 return( ret );
3352 }
3353 }
3354 }
3355 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003356#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003357 /* With TLS we don't handle fragmentation (for now) */
3358 if( ssl->in_msglen < ssl->in_hslen )
3359 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003360 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
3361 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003362 }
3363
Simon Butcher99000142016-10-13 17:21:01 +01003364 return( 0 );
3365}
3366
3367void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
3368{
3369
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02003370 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
3371 ssl->handshake != NULL )
3372 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003373 ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02003374 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003375
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003376 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003377#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003378 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003379 ssl->handshake != NULL )
3380 {
3381 ssl->handshake->in_msg_seq++;
3382 }
3383#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003384}
3385
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003386/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003387 * DTLS anti-replay: RFC 6347 4.1.2.6
3388 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003389 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
3390 * Bit n is set iff record number in_window_top - n has been seen.
3391 *
3392 * Usually, in_window_top is the last record number seen and the lsb of
3393 * in_window is set. The only exception is the initial state (record number 0
3394 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003395 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003396#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3397static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003398{
3399 ssl->in_window_top = 0;
3400 ssl->in_window = 0;
3401}
3402
3403static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
3404{
3405 return( ( (uint64_t) buf[0] << 40 ) |
3406 ( (uint64_t) buf[1] << 32 ) |
3407 ( (uint64_t) buf[2] << 24 ) |
3408 ( (uint64_t) buf[3] << 16 ) |
3409 ( (uint64_t) buf[4] << 8 ) |
3410 ( (uint64_t) buf[5] ) );
3411}
3412
3413/*
3414 * Return 0 if sequence number is acceptable, -1 otherwise
3415 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003416int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003417{
3418 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
3419 uint64_t bit;
3420
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003421 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003422 return( 0 );
3423
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003424 if( rec_seqnum > ssl->in_window_top )
3425 return( 0 );
3426
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003427 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003428
3429 if( bit >= 64 )
3430 return( -1 );
3431
3432 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
3433 return( -1 );
3434
3435 return( 0 );
3436}
3437
3438/*
3439 * Update replay window on new validated record
3440 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003441void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003442{
3443 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
3444
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003445 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003446 return;
3447
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003448 if( rec_seqnum > ssl->in_window_top )
3449 {
3450 /* Update window_top and the contents of the window */
3451 uint64_t shift = rec_seqnum - ssl->in_window_top;
3452
3453 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003454 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003455 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003456 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003457 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003458 ssl->in_window |= 1;
3459 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003460
3461 ssl->in_window_top = rec_seqnum;
3462 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003463 else
3464 {
3465 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003466 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003467
3468 if( bit < 64 ) /* Always true, but be extra sure */
3469 ssl->in_window |= (uint64_t) 1 << bit;
3470 }
3471}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003472#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003473
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02003474#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003475/* Forward declaration */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003476static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
3477
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003478/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003479 * Without any SSL context, check if a datagram looks like a ClientHello with
3480 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01003481 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003482 *
3483 * - if cookie is valid, return 0
3484 * - if ClientHello looks superficially valid but cookie is not,
3485 * fill obuf and set olen, then
3486 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
3487 * - otherwise return a specific error code
3488 */
3489static int ssl_check_dtls_clihlo_cookie(
3490 mbedtls_ssl_cookie_write_t *f_cookie_write,
3491 mbedtls_ssl_cookie_check_t *f_cookie_check,
3492 void *p_cookie,
3493 const unsigned char *cli_id, size_t cli_id_len,
3494 const unsigned char *in, size_t in_len,
3495 unsigned char *obuf, size_t buf_len, size_t *olen )
3496{
3497 size_t sid_len, cookie_len;
3498 unsigned char *p;
3499
3500 if( f_cookie_write == NULL || f_cookie_check == NULL )
3501 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3502
3503 /*
3504 * Structure of ClientHello with record and handshake headers,
3505 * and expected values. We don't need to check a lot, more checks will be
3506 * done when actually parsing the ClientHello - skipping those checks
3507 * avoids code duplication and does not make cookie forging any easier.
3508 *
3509 * 0-0 ContentType type; copied, must be handshake
3510 * 1-2 ProtocolVersion version; copied
3511 * 3-4 uint16 epoch; copied, must be 0
3512 * 5-10 uint48 sequence_number; copied
3513 * 11-12 uint16 length; (ignored)
3514 *
3515 * 13-13 HandshakeType msg_type; (ignored)
3516 * 14-16 uint24 length; (ignored)
3517 * 17-18 uint16 message_seq; copied
3518 * 19-21 uint24 fragment_offset; copied, must be 0
3519 * 22-24 uint24 fragment_length; (ignored)
3520 *
3521 * 25-26 ProtocolVersion client_version; (ignored)
3522 * 27-58 Random random; (ignored)
3523 * 59-xx SessionID session_id; 1 byte len + sid_len content
3524 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
3525 * ...
3526 *
3527 * Minimum length is 61 bytes.
3528 */
3529 if( in_len < 61 ||
3530 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
3531 in[3] != 0 || in[4] != 0 ||
3532 in[19] != 0 || in[20] != 0 || in[21] != 0 )
3533 {
3534 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
3535 }
3536
3537 sid_len = in[59];
3538 if( sid_len > in_len - 61 )
3539 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
3540
3541 cookie_len = in[60 + sid_len];
3542 if( cookie_len > in_len - 60 )
3543 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
3544
3545 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
3546 cli_id, cli_id_len ) == 0 )
3547 {
3548 /* Valid cookie */
3549 return( 0 );
3550 }
3551
3552 /*
3553 * If we get here, we've got an invalid cookie, let's prepare HVR.
3554 *
3555 * 0-0 ContentType type; copied
3556 * 1-2 ProtocolVersion version; copied
3557 * 3-4 uint16 epoch; copied
3558 * 5-10 uint48 sequence_number; copied
3559 * 11-12 uint16 length; olen - 13
3560 *
3561 * 13-13 HandshakeType msg_type; hello_verify_request
3562 * 14-16 uint24 length; olen - 25
3563 * 17-18 uint16 message_seq; copied
3564 * 19-21 uint24 fragment_offset; copied
3565 * 22-24 uint24 fragment_length; olen - 25
3566 *
3567 * 25-26 ProtocolVersion server_version; 0xfe 0xff
3568 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
3569 *
3570 * Minimum length is 28.
3571 */
3572 if( buf_len < 28 )
3573 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3574
3575 /* Copy most fields and adapt others */
3576 memcpy( obuf, in, 25 );
3577 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
3578 obuf[25] = 0xfe;
3579 obuf[26] = 0xff;
3580
3581 /* Generate and write actual cookie */
3582 p = obuf + 28;
3583 if( f_cookie_write( p_cookie,
3584 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
3585 {
3586 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3587 }
3588
3589 *olen = p - obuf;
3590
3591 /* Go back and fill length fields */
3592 obuf[27] = (unsigned char)( *olen - 28 );
3593
3594 obuf[14] = obuf[22] = (unsigned char)( ( *olen - 25 ) >> 16 );
3595 obuf[15] = obuf[23] = (unsigned char)( ( *olen - 25 ) >> 8 );
3596 obuf[16] = obuf[24] = (unsigned char)( ( *olen - 25 ) );
3597
3598 obuf[11] = (unsigned char)( ( *olen - 13 ) >> 8 );
3599 obuf[12] = (unsigned char)( ( *olen - 13 ) );
3600
3601 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
3602}
3603
3604/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003605 * Handle possible client reconnect with the same UDP quadruplet
3606 * (RFC 6347 Section 4.2.8).
3607 *
3608 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
3609 * that looks like a ClientHello.
3610 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003611 * - if the input looks like a ClientHello without cookies,
3612 * send back HelloVerifyRequest, then
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003613 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003614 * - if the input looks like a ClientHello with a valid cookie,
3615 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02003616 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003617 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003618 *
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003619 * mbedtls_ssl_read_record() will ignore the record if anything else than
Simon Butcherd0bf6a32015-09-11 17:34:49 +01003620 * MBEDTLS_ERR_SSL_CLIENT_RECONNECT or 0 is returned, although this function
3621 * cannot not return 0.
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003622 */
3623static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
3624{
3625 int ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003626 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003627
Manuel Pégourié-Gonnard6062b492020-03-31 12:49:27 +02003628 /* Use out_msg as temporary buffer for writing out HelloVerifyRequest,
3629 * because the output buffer's already around. Don't use out_buf though,
3630 * as we don't want to overwrite out_ctr. */
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003631 ret = ssl_check_dtls_clihlo_cookie(
3632 ssl->conf->f_cookie_write,
3633 ssl->conf->f_cookie_check,
3634 ssl->conf->p_cookie,
3635 ssl->cli_id, ssl->cli_id_len,
3636 ssl->in_buf, ssl->in_left,
Manuel Pégourié-Gonnard6062b492020-03-31 12:49:27 +02003637 ssl->out_msg, MBEDTLS_SSL_MAX_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003638
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003639 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
3640
3641 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003642 {
Manuel Pégourié-Gonnard4bbbdc32020-03-31 12:31:24 +02003643 int send_ret;
3644 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
3645 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Manuel Pégourié-Gonnard6062b492020-03-31 12:49:27 +02003646 ssl->out_msg, len );
Brian J Murray1903fb32016-11-06 04:45:15 -08003647 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003648 * If the error is permanent we'll catch it later,
3649 * if it's not, then hopefully it'll work next time. */
Manuel Pégourié-Gonnard6062b492020-03-31 12:49:27 +02003650 send_ret = ssl->f_send( ssl->p_bio, ssl->out_msg, len );
Manuel Pégourié-Gonnard4bbbdc32020-03-31 12:31:24 +02003651 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", send_ret );
3652 (void) send_ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003653
3654 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003655 }
3656
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003657 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003658 {
Manuel Pégourié-Gonnard4bbbdc32020-03-31 12:31:24 +02003659 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003660 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
3661 {
3662 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
3663 return( ret );
3664 }
3665
3666 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003667 }
3668
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003669 return( ret );
3670}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02003671#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003672
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003673/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003674 * ContentType type;
3675 * ProtocolVersion version;
3676 * uint16 epoch; // DTLS only
3677 * uint48 sequence_number; // DTLS only
3678 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003679 *
3680 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00003681 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003682 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
3683 *
3684 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00003685 * 1. proceed with the record if this function returns 0
3686 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
3687 * 3. return CLIENT_RECONNECT if this function return that value
3688 * 4. drop the whole datagram if this function returns anything else.
3689 * Point 2 is needed when the peer is resending, and we have already received
3690 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003691 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003692static int ssl_parse_record_header( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003693{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01003694 int major_ver, minor_ver;
Paul Bakker5121ce52009-01-03 21:22:43 +00003695
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003696 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", ssl->in_hdr, mbedtls_ssl_hdr_len( ssl ) );
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003697
Paul Bakker5121ce52009-01-03 21:22:43 +00003698 ssl->in_msgtype = ssl->in_hdr[0];
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003699 ssl->in_msglen = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003700 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, ssl->in_hdr + 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003701
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003702 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
Paul Bakker5121ce52009-01-03 21:22:43 +00003703 "version = [%d:%d], msglen = %d",
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02003704 ssl->in_msgtype,
3705 major_ver, minor_ver, ssl->in_msglen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003706
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02003707 /* Check record type */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003708 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
3709 ssl->in_msgtype != MBEDTLS_SSL_MSG_ALERT &&
3710 ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
3711 ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02003712 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003713 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
Andres Amaya Garcia2fad94b2017-06-26 15:11:59 +01003714
3715#if defined(MBEDTLS_SSL_PROTO_DTLS)
Andres Amaya Garcia01692532017-06-28 09:26:46 +01003716 /* Silently ignore invalid DTLS records as recommended by RFC 6347
3717 * Section 4.1.2.7 */
Andres Amaya Garcia2fad94b2017-06-26 15:11:59 +01003718 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3719#endif /* MBEDTLS_SSL_PROTO_DTLS */
3720 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3721 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
3722
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003723 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02003724 }
3725
3726 /* Check version */
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01003727 if( major_ver != ssl->major_ver )
Paul Bakker5121ce52009-01-03 21:22:43 +00003728 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003729 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
3730 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00003731 }
3732
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003733 if( minor_ver > ssl->conf->max_minor_ver )
Paul Bakker5121ce52009-01-03 21:22:43 +00003734 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003735 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
3736 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00003737 }
3738
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02003739 /* Check length against the size of our buffer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003740 if( ssl->in_msglen > MBEDTLS_SSL_BUFFER_LEN
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02003741 - (size_t)( ssl->in_msg - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02003742 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003743 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
3744 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02003745 }
3746
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003747 /*
Hanno Beckera34cc6b2017-05-26 16:07:36 +01003748 * DTLS-related tests.
3749 * Check epoch before checking length constraint because
3750 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
3751 * message gets duplicated before the corresponding Finished message,
3752 * the second ChangeCipherSpec should be discarded because it belongs
3753 * to an old epoch, but not because its length is shorter than
3754 * the minimum record length for packets using the new record transform.
3755 * Note that these two kinds of failures are handled differently,
3756 * as an unexpected record is silently skipped but an invalid
3757 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003758 */
3759#if defined(MBEDTLS_SSL_PROTO_DTLS)
3760 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3761 {
3762 unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
3763
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003764 /* Check epoch (and sequence number) with DTLS */
3765 if( rec_epoch != ssl->in_epoch )
3766 {
3767 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
3768 "expected %d, received %d",
3769 ssl->in_epoch, rec_epoch ) );
3770
3771#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
3772 /*
3773 * Check for an epoch 0 ClientHello. We can't use in_msg here to
3774 * access the first byte of record content (handshake type), as we
3775 * have an active transform (possibly iv_len != 0), so use the
3776 * fact that the record header len is 13 instead.
3777 */
3778 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
3779 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
3780 rec_epoch == 0 &&
3781 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3782 ssl->in_left > 13 &&
3783 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
3784 {
3785 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
3786 "from the same port" ) );
3787 return( ssl_handle_possible_reconnect( ssl ) );
3788 }
3789 else
3790#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
3791 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
3792 }
3793
3794#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3795 /* Replay detection only works for the current epoch */
3796 if( rec_epoch == ssl->in_epoch &&
3797 mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
3798 {
3799 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
3800 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
3801 }
3802#endif
Hanno Beckera34cc6b2017-05-26 16:07:36 +01003803
3804 /* Drop unexpected ChangeCipherSpec messages */
3805 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
3806 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
3807 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
3808 {
3809 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ChangeCipherSpec" ) );
3810 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
3811 }
3812
3813 /* Drop unexpected ApplicationData records,
3814 * except at the beginning of renegotiations */
3815 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
3816 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
3817#if defined(MBEDTLS_SSL_RENEGOTIATION)
3818 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
3819 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
3820#endif
3821 )
3822 {
3823 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
3824 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
3825 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003826 }
3827#endif /* MBEDTLS_SSL_PROTO_DTLS */
3828
Hanno Beckera34cc6b2017-05-26 16:07:36 +01003829
3830 /* Check length against bounds of the current transform and version */
3831 if( ssl->transform_in == NULL )
3832 {
3833 if( ssl->in_msglen < 1 ||
3834 ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
3835 {
3836 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
3837 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3838 }
3839 }
3840 else
3841 {
3842 if( ssl->in_msglen < ssl->transform_in->minlen )
3843 {
3844 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
3845 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3846 }
3847
3848#if defined(MBEDTLS_SSL_PROTO_SSL3)
3849 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
3850 ssl->in_msglen > ssl->transform_in->minlen + MBEDTLS_SSL_MAX_CONTENT_LEN )
3851 {
3852 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
3853 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3854 }
3855#endif
3856#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3857 defined(MBEDTLS_SSL_PROTO_TLS1_2)
3858 /*
3859 * TLS encrypted messages can have up to 256 bytes of padding
3860 */
3861 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 &&
3862 ssl->in_msglen > ssl->transform_in->minlen +
3863 MBEDTLS_SSL_MAX_CONTENT_LEN + 256 )
3864 {
3865 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
3866 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3867 }
3868#endif
3869 }
3870
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003871 return( 0 );
3872}
Paul Bakker5121ce52009-01-03 21:22:43 +00003873
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003874/*
3875 * If applicable, decrypt (and decompress) record content
3876 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003877static int ssl_prepare_record_content( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003878{
3879 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003880
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003881 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
3882 ssl->in_hdr, mbedtls_ssl_hdr_len( ssl ) + ssl->in_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00003883
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003884#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3885 if( mbedtls_ssl_hw_record_read != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00003886 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003887 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00003888
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003889 ret = mbedtls_ssl_hw_record_read( ssl );
3890 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00003891 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003892 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
3893 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00003894 }
Paul Bakkerc7878112012-12-19 14:41:14 +01003895
3896 if( ret == 0 )
3897 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00003898 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003899#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker48916f92012-09-16 19:57:18 +00003900 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003901 {
3902 if( ( ret = ssl_decrypt_buf( ssl ) ) != 0 )
3903 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003904 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003905 return( ret );
3906 }
3907
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003908 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Paul Bakker5121ce52009-01-03 21:22:43 +00003909 ssl->in_msg, ssl->in_msglen );
3910
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003911 if( ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
Paul Bakker5121ce52009-01-03 21:22:43 +00003912 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003913 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
3914 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00003915 }
3916 }
3917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003918#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00003919 if( ssl->transform_in != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003920 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003921 {
3922 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
3923 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003924 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003925 return( ret );
3926 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00003927 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003928#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00003929
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003930#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003931 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02003932 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003933 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02003934 }
3935#endif
3936
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003937 return( 0 );
3938}
3939
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003940static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02003941
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02003942/*
3943 * Read a record.
3944 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02003945 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
3946 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
3947 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02003948 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003949int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003950{
3951 int ret;
3952
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003953 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003954
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003955 if( ssl->keep_current_message == 0 )
3956 {
3957 do {
Simon Butcher99000142016-10-13 17:21:01 +01003958
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003959 if( ( ret = mbedtls_ssl_read_record_layer( ssl ) ) != 0 )
3960 {
3961 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record_layer" ), ret );
3962 return( ret );
3963 }
3964
3965 ret = mbedtls_ssl_handle_message_type( ssl );
3966
3967 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret );
3968
3969 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01003970 {
3971 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record_layer" ), ret );
3972 return( ret );
3973 }
3974
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003975 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
3976 {
3977 mbedtls_ssl_update_handshake_status( ssl );
3978 }
Simon Butcher99000142016-10-13 17:21:01 +01003979 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003980 else
Simon Butcher99000142016-10-13 17:21:01 +01003981 {
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003982 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= reuse previously read message" ) );
3983 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01003984 }
3985
3986 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
3987
3988 return( 0 );
3989}
3990
3991int mbedtls_ssl_read_record_layer( mbedtls_ssl_context *ssl )
3992{
3993 int ret;
3994
Hanno Becker4a810fb2017-05-24 16:27:30 +01003995 /*
3996 * Step A
3997 *
3998 * Consume last content-layer message and potentially
3999 * update in_msglen which keeps track of the contents'
4000 * consumption state.
4001 *
4002 * (1) Handshake messages:
4003 * Remove last handshake message, move content
4004 * and adapt in_msglen.
4005 *
4006 * (2) Alert messages:
4007 * Consume whole record content, in_msglen = 0.
4008 *
4009 * NOTE: This needs to be fixed, since like for
4010 * handshake messages it is allowed to have
4011 * multiple alerts witin a single record.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01004012 * Internal reference IOTSSL-1321.
Hanno Becker4a810fb2017-05-24 16:27:30 +01004013 *
4014 * (3) Change cipher spec:
4015 * Consume whole record content, in_msglen = 0.
4016 *
4017 * (4) Application data:
4018 * Don't do anything - the record layer provides
4019 * the application data as a stream transport
4020 * and consumes through mbedtls_ssl_read only.
4021 *
4022 */
4023
4024 /* Case (1): Handshake messages */
4025 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004026 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01004027 /* Hard assertion to be sure that no application data
4028 * is in flight, as corrupting ssl->in_msglen during
4029 * ssl->in_offt != NULL is fatal. */
4030 if( ssl->in_offt != NULL )
4031 {
4032 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4033 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4034 }
4035
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004036 /*
4037 * Get next Handshake message in the current record
4038 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004039
Hanno Becker4a810fb2017-05-24 16:27:30 +01004040 /* Notes:
4041 * (1) in_hslen is *NOT* necessarily the size of the
4042 * current handshake content: If DTLS handshake
4043 * fragmentation is used, that's the fragment
4044 * size instead. Using the total handshake message
4045 * size here is FAULTY and should be changed at
4046 * some point. Internal reference IOTSSL-1414.
4047 * (2) While it doesn't seem to cause problems, one
4048 * has to be very careful not to assume that in_hslen
4049 * is always <= in_msglen in a sensible communication.
4050 * Again, it's wrong for DTLS handshake fragmentation.
4051 * The following check is therefore mandatory, and
4052 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01004053 * Additionally, ssl->in_hslen might be arbitrarily out of
4054 * bounds after handling a DTLS message with an unexpected
4055 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01004056 */
4057 if( ssl->in_hslen < ssl->in_msglen )
4058 {
4059 ssl->in_msglen -= ssl->in_hslen;
4060 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
4061 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004062
Hanno Becker4a810fb2017-05-24 16:27:30 +01004063 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
4064 ssl->in_msg, ssl->in_msglen );
4065 }
4066 else
4067 {
4068 ssl->in_msglen = 0;
4069 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02004070
Hanno Becker4a810fb2017-05-24 16:27:30 +01004071 ssl->in_hslen = 0;
4072 }
4073 /* Case (4): Application data */
4074 else if( ssl->in_offt != NULL )
4075 {
4076 return( 0 );
4077 }
4078 /* Everything else (CCS & Alerts) */
4079 else
4080 {
4081 ssl->in_msglen = 0;
4082 }
4083
4084 /*
4085 * Step B
4086 *
4087 * Fetch and decode new record if current one is fully consumed.
4088 *
4089 */
4090
4091 if( ssl->in_msglen > 0 )
4092 {
4093 /* There's something left to be processed in the current record. */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004094 return( 0 );
4095 }
4096
Hanno Becker4a810fb2017-05-24 16:27:30 +01004097 /* Need to fetch a new record */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004098
Simon Butcher99000142016-10-13 17:21:01 +01004099#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004100read_record_header:
Simon Butcher99000142016-10-13 17:21:01 +01004101#endif
4102
Hanno Becker4a810fb2017-05-24 16:27:30 +01004103 /* Current record either fully processed or to be discarded. */
4104
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004105 if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) ) ) != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004106 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004107 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004108 return( ret );
4109 }
4110
4111 if( ( ret = ssl_parse_record_header( ssl ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004112 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004113#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02004114 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4115 ret != MBEDTLS_ERR_SSL_CLIENT_RECONNECT )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004116 {
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004117 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
4118 {
4119 /* Skip unexpected record (but not whole datagram) */
4120 ssl->next_record_offset = ssl->in_msglen
4121 + mbedtls_ssl_hdr_len( ssl );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004122
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004123 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
4124 "(header)" ) );
4125 }
4126 else
4127 {
4128 /* Skip invalid record and the rest of the datagram */
4129 ssl->next_record_offset = 0;
4130 ssl->in_left = 0;
4131
4132 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
4133 "(header)" ) );
4134 }
4135
4136 /* Get next record */
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004137 goto read_record_header;
4138 }
4139#endif
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004140 return( ret );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004141 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004142
4143 /*
4144 * Read and optionally decrypt the message contents
4145 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004146 if( ( ret = mbedtls_ssl_fetch_input( ssl,
4147 mbedtls_ssl_hdr_len( ssl ) + ssl->in_msglen ) ) != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004148 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004149 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004150 return( ret );
4151 }
4152
4153 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004154#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004155 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004156 ssl->next_record_offset = ssl->in_msglen + mbedtls_ssl_hdr_len( ssl );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004157 else
4158#endif
4159 ssl->in_left = 0;
4160
4161 if( ( ret = ssl_prepare_record_content( ssl ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004162 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004163#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004164 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004165 {
4166 /* Silently discard invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004167 if( ret == MBEDTLS_ERR_SSL_INVALID_RECORD ||
4168 ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004169 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02004170 /* Except when waiting for Finished as a bad mac here
4171 * probably means something went wrong in the handshake
4172 * (eg wrong psk used, mitm downgrade attempt, etc.) */
4173 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
4174 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
4175 {
4176#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
4177 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
4178 {
4179 mbedtls_ssl_send_alert_message( ssl,
4180 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4181 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
4182 }
4183#endif
4184 return( ret );
4185 }
4186
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004187#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004188 if( ssl->conf->badmac_limit != 0 &&
4189 ++ssl->badmac_seen >= ssl->conf->badmac_limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02004190 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004191 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
4192 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02004193 }
4194#endif
4195
Hanno Becker4a810fb2017-05-24 16:27:30 +01004196 /* As above, invalid records cause
4197 * dismissal of the whole datagram. */
4198
4199 ssl->next_record_offset = 0;
4200 ssl->in_left = 0;
4201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004202 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004203 goto read_record_header;
4204 }
4205
4206 return( ret );
4207 }
4208 else
4209#endif
4210 {
4211 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004212#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
4213 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004214 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004215 mbedtls_ssl_send_alert_message( ssl,
4216 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4217 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004218 }
4219#endif
4220 return( ret );
4221 }
4222 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004223
4224 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004225 * When we sent the last flight of the handshake, we MUST respond to a
4226 * retransmit of the peer's previous flight with a retransmit. (In
4227 * practice, only the Finished message will make it, other messages
4228 * including CCS use the old transform so they're dropped as invalid.)
4229 *
4230 * If the record we received is not a handshake message, however, it
4231 * means the peer received our last flight so we can clean up
4232 * handshake info.
4233 *
4234 * This check needs to be done before prepare_handshake() due to an edge
4235 * case: if the client immediately requests renegotiation, this
4236 * finishes the current handshake first, avoiding the new ClientHello
4237 * being mistaken for an ancient message in the current handshake.
4238 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004239#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004240 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004241 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004242 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004243 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004244 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4245 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004246 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004247 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received retransmit of last flight" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004248
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004249 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004250 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004251 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004252 return( ret );
4253 }
4254
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004255 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004256 }
4257 else
4258 {
4259 ssl_handshake_wrapup_free_hs_transform( ssl );
4260 }
4261 }
4262#endif
4263
Simon Butcher99000142016-10-13 17:21:01 +01004264 return( 0 );
4265}
4266
4267int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
4268{
4269 int ret;
4270
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004271 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004272 * Handle particular types of records
4273 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004274 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004275 {
Simon Butcher99000142016-10-13 17:21:01 +01004276 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
4277 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004278 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01004279 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004280 }
4281
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004282 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00004283 {
Angus Gratton8946b0d2018-06-20 15:43:50 +10004284 if( ssl->in_msglen != 2 )
4285 {
4286 /* Note: Standard allows for more than one 2 byte alert
4287 to be packed in a single message, but Mbed TLS doesn't
4288 currently support this. */
4289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
4290 ssl->in_msglen ) );
4291 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4292 }
4293
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004294 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00004295 ssl->in_msg[0], ssl->in_msg[1] ) );
4296
4297 /*
Simon Butcher459a9502015-10-27 16:09:03 +00004298 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00004299 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004300 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004301 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004302 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00004303 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004304 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004305 }
4306
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004307 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
4308 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00004309 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004310 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
4311 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00004312 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02004313
4314#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
4315 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
4316 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
4317 {
4318 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
4319 /* Will be handled when trying to parse ServerHello */
4320 return( 0 );
4321 }
4322#endif
4323
4324#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
4325 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
4326 ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
4327 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
4328 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
4329 {
4330 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
4331 /* Will be handled in mbedtls_ssl_parse_certificate() */
4332 return( 0 );
4333 }
4334#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
4335
4336 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01004337 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004338 }
4339
Paul Bakker5121ce52009-01-03 21:22:43 +00004340 return( 0 );
4341}
4342
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004343int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00004344{
4345 int ret;
4346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004347 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
4348 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4349 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00004350 {
4351 return( ret );
4352 }
4353
4354 return( 0 );
4355}
4356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004357int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Paul Bakker0a925182012-04-16 06:46:41 +00004358 unsigned char level,
4359 unsigned char message )
4360{
4361 int ret;
4362
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02004363 if( ssl == NULL || ssl->conf == NULL )
4364 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4365
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004366 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004367 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00004368
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004369 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00004370 ssl->out_msglen = 2;
4371 ssl->out_msg[0] = level;
4372 ssl->out_msg[1] = message;
4373
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004374 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00004375 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004376 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00004377 return( ret );
4378 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004379 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00004380
4381 return( 0 );
4382}
4383
Paul Bakker5121ce52009-01-03 21:22:43 +00004384/*
4385 * Handshake functions
4386 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004387#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
4388 !defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \
4389 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
4390 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
4391 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
4392 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
4393 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02004394/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004395int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004396{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004397 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00004398
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004399 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004400
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004401 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
4402 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02004403 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
4404 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02004405 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004406 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02004407 ssl->state++;
4408 return( 0 );
4409 }
4410
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004411 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4412 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004413}
4414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004415int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004416{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004417 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004419 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004420
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004421 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
4422 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02004423 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
4424 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004425 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004426 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004427 ssl->state++;
4428 return( 0 );
4429 }
4430
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004431 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4432 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004433}
Gilles Peskinef9828522017-05-03 12:28:43 +02004434
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004435#else
Gilles Peskinef9828522017-05-03 12:28:43 +02004436/* Some certificate support -> implement write and parse */
4437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004438int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004439{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004440 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004441 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004442 const mbedtls_x509_crt *crt;
4443 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004444
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004445 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004446
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004447 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
4448 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02004449 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
4450 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004451 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004452 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004453 ssl->state++;
4454 return( 0 );
4455 }
4456
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004457#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004458 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00004459 {
4460 if( ssl->client_auth == 0 )
4461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004462 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004463 ssl->state++;
4464 return( 0 );
4465 }
4466
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004467#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00004468 /*
4469 * If using SSLv3 and got no cert, send an Alert message
4470 * (otherwise an empty Certificate message will be sent).
4471 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004472 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
4473 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004474 {
4475 ssl->out_msglen = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004476 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
4477 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
4478 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
Paul Bakker5121ce52009-01-03 21:22:43 +00004479
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004480 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004481 goto write_msg;
4482 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004483#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00004484 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004485#endif /* MBEDTLS_SSL_CLI_C */
4486#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004487 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00004488 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004489 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004490 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004491 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
4492 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00004493 }
4494 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01004495#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004496
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004497 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004498
4499 /*
4500 * 0 . 0 handshake type
4501 * 1 . 3 handshake length
4502 * 4 . 6 length of all certs
4503 * 7 . 9 length of cert. 1
4504 * 10 . n-1 peer certificate
4505 * n . n+2 length of cert. 2
4506 * n+3 . ... upper level cert, etc.
4507 */
4508 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004509 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004510
Paul Bakker29087132010-03-21 21:03:34 +00004511 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004512 {
4513 n = crt->raw.len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004514 if( n > MBEDTLS_SSL_MAX_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00004515 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004516 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
4517 i + 3 + n, MBEDTLS_SSL_MAX_CONTENT_LEN ) );
4518 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004519 }
4520
4521 ssl->out_msg[i ] = (unsigned char)( n >> 16 );
4522 ssl->out_msg[i + 1] = (unsigned char)( n >> 8 );
4523 ssl->out_msg[i + 2] = (unsigned char)( n );
4524
4525 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
4526 i += n; crt = crt->next;
4527 }
4528
4529 ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 );
4530 ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 );
4531 ssl->out_msg[6] = (unsigned char)( ( i - 7 ) );
4532
4533 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004534 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4535 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00004536
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02004537#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00004538write_msg:
Paul Bakkerd2f068e2013-08-27 21:19:20 +02004539#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004540
4541 ssl->state++;
4542
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004543 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004544 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004545 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004546 return( ret );
4547 }
4548
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004549 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004550
Paul Bakkered27a042013-04-18 22:46:23 +02004551 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004552}
4553
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004554int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004555{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004556 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker23986e52011-04-24 08:57:21 +00004557 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004558 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02004559 int authmode = ssl->conf->authmode;
Gilles Peskine064a85c2017-05-10 10:46:40 +02004560 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00004561
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004562 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004563
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004564 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
4565 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02004566 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
4567 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02004568 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004569 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02004570 ssl->state++;
4571 return( 0 );
4572 }
4573
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004574#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004575 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02004576 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
4577 {
4578 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
4579 ssl->state++;
4580 return( 0 );
4581 }
4582
4583#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
4584 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
4585 authmode = ssl->handshake->sni_authmode;
4586#endif
4587
4588 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
4589 authmode == MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004590 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004591 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004592 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004593 ssl->state++;
4594 return( 0 );
4595 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01004596#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004598 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004599 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004600 /* mbedtls_ssl_read_record may have sent an alert already. We
4601 let it decide whether to alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004602 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004603 return( ret );
4604 }
4605
4606 ssl->state++;
4607
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004608#if defined(MBEDTLS_SSL_SRV_C)
4609#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00004610 /*
4611 * Check if the client sent an empty certificate
4612 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004613 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004614 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004615 {
Paul Bakker2e11f7d2010-07-25 14:24:53 +00004616 if( ssl->in_msglen == 2 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004617 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
4618 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
4619 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00004620 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004621 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004622
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004623 /* The client was asked for a certificate but didn't send
4624 one. The client should know what's going on, so we
4625 don't send an alert. */
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004626 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02004627 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004628 return( 0 );
4629 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004630 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004631 }
4632 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004633#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00004634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004635#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
4636 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004637 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004638 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004639 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004640 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
4641 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4642 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
4643 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004644 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004645 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004646
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004647 /* The client was asked for a certificate but didn't send
4648 one. The client should know what's going on, so we
4649 don't send an alert. */
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004650 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02004651 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004652 return( 0 );
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02004653 else
4654 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004655 }
4656 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004657#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
4658 MBEDTLS_SSL_PROTO_TLS1_2 */
4659#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00004660
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004661 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004662 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004663 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004664 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4665 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004666 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004667 }
4668
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004669 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
4670 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004671 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004672 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004673 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4674 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004675 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004676 }
4677
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004678 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00004679
Paul Bakker5121ce52009-01-03 21:22:43 +00004680 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004681 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00004682 */
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00004683 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
Paul Bakker5121ce52009-01-03 21:22:43 +00004684
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00004685 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004686 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004687 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004688 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004689 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4690 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004691 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004692 }
4693
Manuel Pégourié-Gonnardbfb355c2013-09-07 17:27:43 +02004694 /* In case we tried to reuse a session but it failed */
4695 if( ssl->session_negotiate->peer_cert != NULL )
4696 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004697 mbedtls_x509_crt_free( ssl->session_negotiate->peer_cert );
4698 mbedtls_free( ssl->session_negotiate->peer_cert );
Manuel Pégourié-Gonnardbfb355c2013-09-07 17:27:43 +02004699 }
4700
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004701 if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004702 sizeof( mbedtls_x509_crt ) ) ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004703 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004704 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004705 sizeof( mbedtls_x509_crt ) ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004706 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4707 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004708 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +00004709 }
4710
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004711 mbedtls_x509_crt_init( ssl->session_negotiate->peer_cert );
Paul Bakker5121ce52009-01-03 21:22:43 +00004712
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00004713 i += 3;
Paul Bakker5121ce52009-01-03 21:22:43 +00004714
4715 while( i < ssl->in_hslen )
4716 {
Philippe Antoine33e5c322018-07-09 10:39:02 +02004717 if ( i + 3 > ssl->in_hslen ) {
4718 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
4719 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4720 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
4721 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
4722 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004723 if( ssl->in_msg[i] != 0 )
4724 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004725 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004726 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4727 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004728 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004729 }
4730
4731 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
4732 | (unsigned int) ssl->in_msg[i + 2];
4733 i += 3;
4734
4735 if( n < 128 || i + n > ssl->in_hslen )
4736 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004738 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4739 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004740 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004741 }
4742
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004743 ret = mbedtls_x509_crt_parse_der( ssl->session_negotiate->peer_cert,
Paul Bakkerddf26b42013-09-18 13:46:23 +02004744 ssl->in_msg + i, n );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004745 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00004746 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004747 case 0: /*ok*/
4748 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
4749 /* Ignore certificate with an unknown algorithm: maybe a
4750 prior certificate was already trusted. */
4751 break;
4752
4753 case MBEDTLS_ERR_X509_ALLOC_FAILED:
4754 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
4755 goto crt_parse_der_failed;
4756
4757 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
4758 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
4759 goto crt_parse_der_failed;
4760
4761 default:
4762 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
4763 crt_parse_der_failed:
4764 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004765 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004766 return( ret );
4767 }
4768
4769 i += n;
4770 }
4771
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004772 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", ssl->session_negotiate->peer_cert );
Paul Bakker5121ce52009-01-03 21:22:43 +00004773
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01004774 /*
4775 * On client, make sure the server cert doesn't change during renego to
4776 * avoid "triple handshake" attack: https://secure-resumption.com/
4777 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004778#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004779 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004780 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01004781 {
4782 if( ssl->session->peer_cert == NULL )
4783 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004784 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004785 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4786 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004787 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01004788 }
4789
4790 if( ssl->session->peer_cert->raw.len !=
4791 ssl->session_negotiate->peer_cert->raw.len ||
4792 memcmp( ssl->session->peer_cert->raw.p,
4793 ssl->session_negotiate->peer_cert->raw.p,
4794 ssl->session->peer_cert->raw.len ) != 0 )
4795 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004796 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server cert changed during renegotiation" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004797 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4798 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004799 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01004800 }
4801 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004802#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01004803
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02004804 if( authmode != MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004805 {
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02004806 mbedtls_x509_crt *ca_chain;
4807 mbedtls_x509_crl *ca_crl;
4808
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004809#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02004810 if( ssl->handshake->sni_ca_chain != NULL )
4811 {
4812 ca_chain = ssl->handshake->sni_ca_chain;
4813 ca_crl = ssl->handshake->sni_ca_crl;
4814 }
4815 else
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004816#endif
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02004817 {
4818 ca_chain = ssl->conf->ca_chain;
4819 ca_crl = ssl->conf->ca_crl;
4820 }
4821
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004822 /*
4823 * Main check: verify certificate
4824 */
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02004825 ret = mbedtls_x509_crt_verify_with_profile(
4826 ssl->session_negotiate->peer_cert,
4827 ca_chain, ca_crl,
4828 ssl->conf->cert_profile,
4829 ssl->hostname,
4830 &ssl->session_negotiate->verify_result,
4831 ssl->conf->f_vrfy, ssl->conf->p_vrfy );
Paul Bakker5121ce52009-01-03 21:22:43 +00004832
4833 if( ret != 0 )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004834 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004835 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004836 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004837
4838 /*
4839 * Secondary checks: always done, but change 'ret' only if it was 0
4840 */
4841
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02004842#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004843 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004844 const mbedtls_pk_context *pk = &ssl->session_negotiate->peer_cert->pk;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004845
4846 /* If certificate uses an EC key, make sure the curve is OK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004847 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004848 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004849 {
Hanno Becker39ae8cd2017-05-08 16:31:14 +01004850 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
4851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004852 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004853 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004854 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004855 }
4856 }
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02004857#endif /* MBEDTLS_ECP_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00004858
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004859 if( mbedtls_ssl_check_cert_usage( ssl->session_negotiate->peer_cert,
Hanno Becker39ae8cd2017-05-08 16:31:14 +01004860 ciphersuite_info,
4861 ! ssl->conf->endpoint,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004862 &ssl->session_negotiate->verify_result ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004863 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004864 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004865 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004866 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004867 }
4868
Hanno Becker39ae8cd2017-05-08 16:31:14 +01004869 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
4870 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
4871 * with details encoded in the verification flags. All other kinds
4872 * of error codes, including those from the user provided f_vrfy
4873 * functions, are treated as fatal and lead to a failure of
4874 * ssl_parse_certificate even if verification was optional. */
4875 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
4876 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
4877 ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
4878 {
Paul Bakker5121ce52009-01-03 21:22:43 +00004879 ret = 0;
Hanno Becker39ae8cd2017-05-08 16:31:14 +01004880 }
4881
4882 if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
4883 {
4884 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
4885 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
4886 }
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004887
4888 if( ret != 0 )
4889 {
4890 /* The certificate may have been rejected for several reasons.
4891 Pick one and send the corresponding alert. Which alert to send
4892 may be a subject of debate in some cases. */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004893 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
4894 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
4895 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
4896 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
4897 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
4898 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
4899 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
4900 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
4901 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
4902 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
4903 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
4904 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
4905 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
4906 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
4907 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
4908 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
4909 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
4910 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
4911 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
4912 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
Gilles Peskine8498cb32017-05-10 15:39:40 +02004913 else
4914 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004915 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4916 alert );
4917 }
Hanno Becker39ae8cd2017-05-08 16:31:14 +01004918
Hanno Beckere6706e62017-05-15 16:05:15 +01004919#if defined(MBEDTLS_DEBUG_C)
4920 if( ssl->session_negotiate->verify_result != 0 )
4921 {
4922 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
4923 ssl->session_negotiate->verify_result ) );
4924 }
4925 else
4926 {
4927 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
4928 }
4929#endif /* MBEDTLS_DEBUG_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00004930 }
4931
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004932 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004933
4934 return( ret );
4935}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004936#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
4937 !MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
4938 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
4939 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
4940 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
4941 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
4942 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00004943
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004944int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004945{
4946 int ret;
4947
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004948 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004949
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004950 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00004951 ssl->out_msglen = 1;
4952 ssl->out_msg[0] = 1;
4953
Paul Bakker5121ce52009-01-03 21:22:43 +00004954 ssl->state++;
4955
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004956 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004957 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004958 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004959 return( ret );
4960 }
4961
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004962 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004963
4964 return( 0 );
4965}
4966
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004967int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004968{
4969 int ret;
4970
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004971 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004972
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004973 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004974 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004975 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004976 return( ret );
4977 }
4978
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004979 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00004980 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004981 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004982 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4983 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004984 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004985 }
4986
4987 if( ssl->in_msglen != 1 || ssl->in_msg[0] != 1 )
4988 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004989 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004990 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4991 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004992 return( MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC );
Paul Bakker5121ce52009-01-03 21:22:43 +00004993 }
4994
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02004995 /*
4996 * Switch to our negotiated transform and session parameters for inbound
4997 * data.
4998 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004999 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005000 ssl->transform_in = ssl->transform_negotiate;
5001 ssl->session_in = ssl->session_negotiate;
5002
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005003#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005004 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005005 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005006#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005007 ssl_dtls_replay_reset( ssl );
5008#endif
5009
5010 /* Increment epoch */
5011 if( ++ssl->in_epoch == 0 )
5012 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005013 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005014 /* This is highly unlikely to happen for legitimate reasons, so
5015 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005016 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005017 }
5018 }
5019 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005020#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005021 memset( ssl->in_ctr, 0, 8 );
5022
5023 /*
5024 * Set the in_msg pointer to the correct location based on IV length
5025 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005026 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005027 {
5028 ssl->in_msg = ssl->in_iv + ssl->transform_negotiate->ivlen -
5029 ssl->transform_negotiate->fixed_ivlen;
5030 }
5031 else
5032 ssl->in_msg = ssl->in_iv;
5033
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005034#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
5035 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005036 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005037 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005038 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005039 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005040 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5041 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005042 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005043 }
5044 }
5045#endif
5046
Paul Bakker5121ce52009-01-03 21:22:43 +00005047 ssl->state++;
5048
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005049 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005050
5051 return( 0 );
5052}
5053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005054void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
5055 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
Paul Bakker380da532012-04-18 16:10:25 +00005056{
Paul Bakkerfb08fd22013-08-27 15:06:26 +02005057 ((void) ciphersuite_info);
Paul Bakker769075d2012-11-24 11:26:46 +01005058
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005059#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
5060 defined(MBEDTLS_SSL_PROTO_TLS1_1)
5061 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker48916f92012-09-16 19:57:18 +00005062 ssl->handshake->update_checksum = ssl_update_checksum_md5sha1;
Paul Bakker380da532012-04-18 16:10:25 +00005063 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005064#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005065#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5066#if defined(MBEDTLS_SHA512_C)
5067 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005068 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
5069 else
5070#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005071#if defined(MBEDTLS_SHA256_C)
5072 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
Paul Bakker48916f92012-09-16 19:57:18 +00005073 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005074 else
5075#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005076#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02005077 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005078 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005079 return;
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02005080 }
Paul Bakker380da532012-04-18 16:10:25 +00005081}
Paul Bakkerf7abd422013-04-16 13:15:56 +02005082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005083void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02005084{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005085#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
5086 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005087 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
5088 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02005089#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005090#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5091#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005092 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02005093#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005094#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005095 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02005096#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005097#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02005098}
5099
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005100static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02005101 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00005102{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005103#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
5104 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005105 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
5106 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005107#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005108#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5109#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005110 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005111#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005112#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005113 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
Paul Bakker769075d2012-11-24 11:26:46 +01005114#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005115#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker380da532012-04-18 16:10:25 +00005116}
5117
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005118#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
5119 defined(MBEDTLS_SSL_PROTO_TLS1_1)
5120static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02005121 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00005122{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005123 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
5124 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00005125}
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005126#endif
Paul Bakker380da532012-04-18 16:10:25 +00005127
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005128#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5129#if defined(MBEDTLS_SHA256_C)
5130static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02005131 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00005132{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005133 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00005134}
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005135#endif
Paul Bakker380da532012-04-18 16:10:25 +00005136
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005137#if defined(MBEDTLS_SHA512_C)
5138static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02005139 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00005140{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005141 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00005142}
Paul Bakker769075d2012-11-24 11:26:46 +01005143#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005144#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker380da532012-04-18 16:10:25 +00005145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005146#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker1ef83d62012-04-11 12:09:53 +00005147static void ssl_calc_finished_ssl(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005148 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker5121ce52009-01-03 21:22:43 +00005149{
Paul Bakker3c2122f2013-06-24 19:03:14 +02005150 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005151 mbedtls_md5_context md5;
5152 mbedtls_sha1_context sha1;
Paul Bakker1ef83d62012-04-11 12:09:53 +00005153
Paul Bakker5121ce52009-01-03 21:22:43 +00005154 unsigned char padbuf[48];
5155 unsigned char md5sum[16];
5156 unsigned char sha1sum[20];
5157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005158 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00005159 if( !session )
5160 session = ssl->session;
5161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005162 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005163
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02005164 mbedtls_md5_init( &md5 );
5165 mbedtls_sha1_init( &sha1 );
5166
5167 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
5168 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005169
5170 /*
5171 * SSLv3:
5172 * hash =
5173 * MD5( master + pad2 +
5174 * MD5( handshake + sender + master + pad1 ) )
5175 * + SHA1( master + pad2 +
5176 * SHA1( handshake + sender + master + pad1 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005177 */
5178
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005179#if !defined(MBEDTLS_MD5_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005180 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
5181 md5.state, sizeof( md5.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02005182#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005183
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005184#if !defined(MBEDTLS_SHA1_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005185 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
5186 sha1.state, sizeof( sha1.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02005187#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005188
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005189 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
Paul Bakker3c2122f2013-06-24 19:03:14 +02005190 : "SRVR";
Paul Bakker5121ce52009-01-03 21:22:43 +00005191
Paul Bakker1ef83d62012-04-11 12:09:53 +00005192 memset( padbuf, 0x36, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005193
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005194 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
5195 mbedtls_md5_update_ret( &md5, session->master, 48 );
5196 mbedtls_md5_update_ret( &md5, padbuf, 48 );
5197 mbedtls_md5_finish_ret( &md5, md5sum );
Paul Bakker5121ce52009-01-03 21:22:43 +00005198
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005199 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
5200 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
5201 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
5202 mbedtls_sha1_finish_ret( &sha1, sha1sum );
Paul Bakker5121ce52009-01-03 21:22:43 +00005203
Paul Bakker1ef83d62012-04-11 12:09:53 +00005204 memset( padbuf, 0x5C, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005205
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005206 mbedtls_md5_starts_ret( &md5 );
5207 mbedtls_md5_update_ret( &md5, session->master, 48 );
5208 mbedtls_md5_update_ret( &md5, padbuf, 48 );
5209 mbedtls_md5_update_ret( &md5, md5sum, 16 );
5210 mbedtls_md5_finish_ret( &md5, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00005211
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005212 mbedtls_sha1_starts_ret( &sha1 );
5213 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
5214 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
5215 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
5216 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005217
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005218 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005219
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005220 mbedtls_md5_free( &md5 );
5221 mbedtls_sha1_free( &sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005222
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005223 mbedtls_zeroize( padbuf, sizeof( padbuf ) );
5224 mbedtls_zeroize( md5sum, sizeof( md5sum ) );
5225 mbedtls_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005227 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005228}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005229#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00005230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005231#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Paul Bakker1ef83d62012-04-11 12:09:53 +00005232static void ssl_calc_finished_tls(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005233 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker5121ce52009-01-03 21:22:43 +00005234{
Paul Bakker1ef83d62012-04-11 12:09:53 +00005235 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02005236 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005237 mbedtls_md5_context md5;
5238 mbedtls_sha1_context sha1;
Paul Bakker1ef83d62012-04-11 12:09:53 +00005239 unsigned char padbuf[36];
Paul Bakker5121ce52009-01-03 21:22:43 +00005240
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005241 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00005242 if( !session )
5243 session = ssl->session;
5244
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005245 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005246
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02005247 mbedtls_md5_init( &md5 );
5248 mbedtls_sha1_init( &sha1 );
5249
5250 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
5251 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005252
Paul Bakker1ef83d62012-04-11 12:09:53 +00005253 /*
5254 * TLSv1:
5255 * hash = PRF( master, finished_label,
5256 * MD5( handshake ) + SHA1( handshake ) )[0..11]
5257 */
Paul Bakker5121ce52009-01-03 21:22:43 +00005258
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005259#if !defined(MBEDTLS_MD5_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005260 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
5261 md5.state, sizeof( md5.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02005262#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00005263
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005264#if !defined(MBEDTLS_SHA1_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005265 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
5266 sha1.state, sizeof( sha1.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02005267#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00005268
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005269 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02005270 ? "client finished"
5271 : "server finished";
Paul Bakker1ef83d62012-04-11 12:09:53 +00005272
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005273 mbedtls_md5_finish_ret( &md5, padbuf );
5274 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005275
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02005276 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00005277 padbuf, 36, buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005278
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005279 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005280
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005281 mbedtls_md5_free( &md5 );
5282 mbedtls_sha1_free( &sha1 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005283
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005284 mbedtls_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005285
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005286 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005287}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005288#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker1ef83d62012-04-11 12:09:53 +00005289
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005290#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5291#if defined(MBEDTLS_SHA256_C)
Paul Bakkerca4ab492012-04-18 14:23:57 +00005292static void ssl_calc_finished_tls_sha256(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005293 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker1ef83d62012-04-11 12:09:53 +00005294{
5295 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02005296 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005297 mbedtls_sha256_context sha256;
Paul Bakker1ef83d62012-04-11 12:09:53 +00005298 unsigned char padbuf[32];
5299
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005300 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00005301 if( !session )
5302 session = ssl->session;
5303
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02005304 mbedtls_sha256_init( &sha256 );
5305
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005306 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005307
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02005308 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005309
5310 /*
5311 * TLSv1.2:
5312 * hash = PRF( master, finished_label,
5313 * Hash( handshake ) )[0.11]
5314 */
5315
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005316#if !defined(MBEDTLS_SHA256_ALT)
5317 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005318 sha256.state, sizeof( sha256.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02005319#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00005320
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005321 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02005322 ? "client finished"
5323 : "server finished";
Paul Bakker1ef83d62012-04-11 12:09:53 +00005324
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005325 mbedtls_sha256_finish_ret( &sha256, padbuf );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005326
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02005327 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00005328 padbuf, 32, buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005329
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005330 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005331
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005332 mbedtls_sha256_free( &sha256 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005333
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005334 mbedtls_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005335
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005336 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005337}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005338#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +00005339
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005340#if defined(MBEDTLS_SHA512_C)
Paul Bakkerca4ab492012-04-18 14:23:57 +00005341static void ssl_calc_finished_tls_sha384(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005342 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakkerca4ab492012-04-18 14:23:57 +00005343{
5344 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02005345 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005346 mbedtls_sha512_context sha512;
Paul Bakkerca4ab492012-04-18 14:23:57 +00005347 unsigned char padbuf[48];
5348
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005349 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00005350 if( !session )
5351 session = ssl->session;
5352
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02005353 mbedtls_sha512_init( &sha512 );
5354
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005355 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00005356
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02005357 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00005358
5359 /*
5360 * TLSv1.2:
5361 * hash = PRF( master, finished_label,
5362 * Hash( handshake ) )[0.11]
5363 */
5364
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005365#if !defined(MBEDTLS_SHA512_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005366 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
5367 sha512.state, sizeof( sha512.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02005368#endif
Paul Bakkerca4ab492012-04-18 14:23:57 +00005369
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005370 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02005371 ? "client finished"
5372 : "server finished";
Paul Bakkerca4ab492012-04-18 14:23:57 +00005373
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005374 mbedtls_sha512_finish_ret( &sha512, padbuf );
Paul Bakkerca4ab492012-04-18 14:23:57 +00005375
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02005376 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00005377 padbuf, 48, buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00005378
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005379 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00005380
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02005381 mbedtls_sha512_free( &sha512 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00005382
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005383 mbedtls_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00005384
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005385 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00005386}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005387#endif /* MBEDTLS_SHA512_C */
5388#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +00005389
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005390static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00005391{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005392 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005393
5394 /*
5395 * Free our handshake params
5396 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005397 mbedtls_ssl_handshake_free( ssl->handshake );
5398 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00005399 ssl->handshake = NULL;
5400
5401 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005402 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00005403 */
5404 if( ssl->transform )
5405 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005406 mbedtls_ssl_transform_free( ssl->transform );
5407 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00005408 }
5409 ssl->transform = ssl->transform_negotiate;
5410 ssl->transform_negotiate = NULL;
5411
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005412 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005413}
5414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005415void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005416{
5417 int resume = ssl->handshake->resume;
5418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005419 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005420
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005421#if defined(MBEDTLS_SSL_RENEGOTIATION)
5422 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005423 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005424 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005425 ssl->renego_records_seen = 0;
5426 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01005427#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005428
5429 /*
5430 * Free the previous session and switch in the current one
5431 */
Paul Bakker0a597072012-09-25 21:55:46 +00005432 if( ssl->session )
5433 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005434#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01005435 /* RFC 7366 3.1: keep the EtM state */
5436 ssl->session_negotiate->encrypt_then_mac =
5437 ssl->session->encrypt_then_mac;
5438#endif
5439
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005440 mbedtls_ssl_session_free( ssl->session );
5441 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00005442 }
5443 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00005444 ssl->session_negotiate = NULL;
5445
Paul Bakker0a597072012-09-25 21:55:46 +00005446 /*
5447 * Add cache entry
5448 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005449 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02005450 ssl->session->id_len != 0 &&
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02005451 resume == 0 )
5452 {
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01005453 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005454 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02005455 }
Paul Bakker0a597072012-09-25 21:55:46 +00005456
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005457#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005458 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005459 ssl->handshake->flight != NULL )
5460 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02005461 /* Cancel handshake timer */
5462 ssl_set_timer( ssl, 0 );
5463
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005464 /* Keep last flight around in case we need to resend it:
5465 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005466 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005467 }
5468 else
5469#endif
5470 ssl_handshake_wrapup_free_hs_transform( ssl );
5471
Paul Bakker48916f92012-09-16 19:57:18 +00005472 ssl->state++;
5473
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005474 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005475}
5476
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005477int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00005478{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02005479 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00005480
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005481 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005482
Paul Bakker92be97b2013-01-02 17:30:03 +01005483 /*
5484 * Set the out_msg pointer to the correct location based on IV length
5485 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005486 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker92be97b2013-01-02 17:30:03 +01005487 {
5488 ssl->out_msg = ssl->out_iv + ssl->transform_negotiate->ivlen -
5489 ssl->transform_negotiate->fixed_ivlen;
5490 }
5491 else
5492 ssl->out_msg = ssl->out_iv;
5493
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005494 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
Paul Bakker1ef83d62012-04-11 12:09:53 +00005495
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01005496 /*
5497 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
5498 * may define some other value. Currently (early 2016), no defined
5499 * ciphersuite does this (and this is unlikely to change as activity has
5500 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
5501 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005502 hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00005503
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005504#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00005505 ssl->verify_data_len = hash_len;
5506 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01005507#endif
Paul Bakker48916f92012-09-16 19:57:18 +00005508
Paul Bakker5121ce52009-01-03 21:22:43 +00005509 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005510 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5511 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00005512
5513 /*
5514 * In case of session resuming, invert the client and server
5515 * ChangeCipherSpec messages order.
5516 */
Paul Bakker0a597072012-09-25 21:55:46 +00005517 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005518 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005519#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005520 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005521 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01005522#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005523#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005524 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005525 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01005526#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005527 }
5528 else
5529 ssl->state++;
5530
Paul Bakker48916f92012-09-16 19:57:18 +00005531 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02005532 * Switch to our negotiated transform and session parameters for outbound
5533 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00005534 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005535 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01005536
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005537#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005538 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02005539 {
5540 unsigned char i;
5541
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02005542 /* Remember current epoch settings for resending */
5543 ssl->handshake->alt_transform_out = ssl->transform_out;
5544 memcpy( ssl->handshake->alt_out_ctr, ssl->out_ctr, 8 );
5545
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02005546 /* Set sequence_number to zero */
5547 memset( ssl->out_ctr + 2, 0, 6 );
5548
5549 /* Increment epoch */
5550 for( i = 2; i > 0; i-- )
5551 if( ++ssl->out_ctr[i - 1] != 0 )
5552 break;
5553
5554 /* The loop goes to its end iff the counter is wrapping */
5555 if( i == 0 )
5556 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005557 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
5558 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02005559 }
5560 }
5561 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005562#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02005563 memset( ssl->out_ctr, 0, 8 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005564
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02005565 ssl->transform_out = ssl->transform_negotiate;
5566 ssl->session_out = ssl->session_negotiate;
5567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005568#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
5569 if( mbedtls_ssl_hw_record_activate != NULL )
Paul Bakker07eb38b2012-12-19 14:42:06 +01005570 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005571 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Paul Bakker07eb38b2012-12-19 14:42:06 +01005572 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005573 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
5574 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker07eb38b2012-12-19 14:42:06 +01005575 }
5576 }
5577#endif
5578
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005579#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005580 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005581 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02005582#endif
5583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005584 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005585 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005586 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005587 return( ret );
5588 }
5589
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005590 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005591
5592 return( 0 );
5593}
5594
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005595#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00005596#define SSL_MAX_HASH_LEN 36
5597#else
5598#define SSL_MAX_HASH_LEN 12
5599#endif
5600
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005601int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005602{
Paul Bakker23986e52011-04-24 08:57:21 +00005603 int ret;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02005604 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00005605 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00005606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005607 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005608
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005609 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005610
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005611 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005612 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005613 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005614 return( ret );
5615 }
5616
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005617 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00005618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005619 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005620 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5621 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005622 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005623 }
5624
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00005625 /* There is currently no ciphersuite using another length with TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005626#if defined(MBEDTLS_SSL_PROTO_SSL3)
5627 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00005628 hash_len = 36;
5629 else
5630#endif
5631 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00005632
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005633 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
5634 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00005635 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005636 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005637 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5638 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005639 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00005640 }
5641
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005642 if( mbedtls_ssl_safer_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
Manuel Pégourié-Gonnard4abc3272014-09-10 12:02:46 +00005643 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005644 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005645 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005646 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5647 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005648 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00005649 }
5650
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005651#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00005652 ssl->verify_data_len = hash_len;
5653 memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01005654#endif
Paul Bakker48916f92012-09-16 19:57:18 +00005655
Paul Bakker0a597072012-09-25 21:55:46 +00005656 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005657 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005658#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005659 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005660 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01005661#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005662#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005663 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005664 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01005665#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005666 }
5667 else
5668 ssl->state++;
5669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005670#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005671 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005672 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02005673#endif
5674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005675 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005676
5677 return( 0 );
5678}
5679
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005680static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005681{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005682 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005683
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005684#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
5685 defined(MBEDTLS_SSL_PROTO_TLS1_1)
5686 mbedtls_md5_init( &handshake->fin_md5 );
5687 mbedtls_sha1_init( &handshake->fin_sha1 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005688 mbedtls_md5_starts_ret( &handshake->fin_md5 );
5689 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005690#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005691#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5692#if defined(MBEDTLS_SHA256_C)
5693 mbedtls_sha256_init( &handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005694 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005695#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005696#if defined(MBEDTLS_SHA512_C)
5697 mbedtls_sha512_init( &handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01005698 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005699#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005700#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005701
5702 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +01005703
5704#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
5705 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
5706 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
5707#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005708
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005709#if defined(MBEDTLS_DHM_C)
5710 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005711#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005712#if defined(MBEDTLS_ECDH_C)
5713 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005714#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02005715#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02005716 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02005717#if defined(MBEDTLS_SSL_CLI_C)
5718 handshake->ecjpake_cache = NULL;
5719 handshake->ecjpake_cache_len = 0;
5720#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02005721#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02005722
5723#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
5724 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
5725#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005726}
5727
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005728static void ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005729{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005730 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +02005731
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005732 mbedtls_cipher_init( &transform->cipher_ctx_enc );
5733 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Paul Bakker84bbeb52014-07-01 14:53:22 +02005734
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005735 mbedtls_md_init( &transform->md_ctx_enc );
5736 mbedtls_md_init( &transform->md_ctx_dec );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005737}
5738
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005739void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005740{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005741 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005742}
5743
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005744static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00005745{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005746 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00005747 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005748 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005749 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005750 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005751 if( ssl->handshake )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005752 mbedtls_ssl_handshake_free( ssl->handshake );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005753
5754 /*
5755 * Either the pointers are now NULL or cleared properly and can be freed.
5756 * Now allocate missing structures.
5757 */
5758 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02005759 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02005760 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02005761 }
Paul Bakker48916f92012-09-16 19:57:18 +00005762
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005763 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02005764 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02005765 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02005766 }
Paul Bakker48916f92012-09-16 19:57:18 +00005767
Paul Bakker82788fb2014-10-20 13:59:19 +02005768 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02005769 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02005770 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02005771 }
Paul Bakker48916f92012-09-16 19:57:18 +00005772
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005773 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00005774 if( ssl->handshake == NULL ||
5775 ssl->transform_negotiate == NULL ||
5776 ssl->session_negotiate == NULL )
5777 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02005778 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005779
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005780 mbedtls_free( ssl->handshake );
5781 mbedtls_free( ssl->transform_negotiate );
5782 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005783
5784 ssl->handshake = NULL;
5785 ssl->transform_negotiate = NULL;
5786 ssl->session_negotiate = NULL;
5787
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02005788 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00005789 }
5790
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005791 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005792 mbedtls_ssl_session_init( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005793 ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02005794 ssl_handshake_params_init( ssl->handshake );
5795
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005796#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02005797 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5798 {
5799 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02005800
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02005801 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5802 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
5803 else
5804 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02005805
5806 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02005807 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02005808#endif
5809
Paul Bakker48916f92012-09-16 19:57:18 +00005810 return( 0 );
5811}
5812
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02005813#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02005814/* Dummy cookie callbacks for defaults */
5815static int ssl_cookie_write_dummy( void *ctx,
5816 unsigned char **p, unsigned char *end,
5817 const unsigned char *cli_id, size_t cli_id_len )
5818{
5819 ((void) ctx);
5820 ((void) p);
5821 ((void) end);
5822 ((void) cli_id);
5823 ((void) cli_id_len);
5824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005825 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02005826}
5827
5828static int ssl_cookie_check_dummy( void *ctx,
5829 const unsigned char *cookie, size_t cookie_len,
5830 const unsigned char *cli_id, size_t cli_id_len )
5831{
5832 ((void) ctx);
5833 ((void) cookie);
5834 ((void) cookie_len);
5835 ((void) cli_id);
5836 ((void) cli_id_len);
5837
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005838 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02005839}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02005840#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02005841
Paul Bakker5121ce52009-01-03 21:22:43 +00005842/*
5843 * Initialize an SSL context
5844 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02005845void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
5846{
5847 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
5848}
5849
5850/*
5851 * Setup an SSL context
5852 */
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02005853int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02005854 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00005855{
Paul Bakker48916f92012-09-16 19:57:18 +00005856 int ret;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005857 const size_t len = MBEDTLS_SSL_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00005858
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02005859 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00005860
5861 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01005862 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00005863 */
k-stachowiakc2eddee2018-07-09 10:39:20 +02005864 ssl->in_buf = NULL;
5865 ssl->out_buf = NULL;
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02005866 if( ( ssl-> in_buf = mbedtls_calloc( 1, len ) ) == NULL ||
5867 ( ssl->out_buf = mbedtls_calloc( 1, len ) ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005868 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02005869 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", len ) );
k-stachowiak2c161142018-07-31 16:52:32 +02005870 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiakc2eddee2018-07-09 10:39:20 +02005871 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00005872 }
5873
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005874#if defined(MBEDTLS_SSL_PROTO_DTLS)
5875 if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5876 {
5877 ssl->out_hdr = ssl->out_buf;
5878 ssl->out_ctr = ssl->out_buf + 3;
5879 ssl->out_len = ssl->out_buf + 11;
5880 ssl->out_iv = ssl->out_buf + 13;
5881 ssl->out_msg = ssl->out_buf + 13;
5882
5883 ssl->in_hdr = ssl->in_buf;
5884 ssl->in_ctr = ssl->in_buf + 3;
5885 ssl->in_len = ssl->in_buf + 11;
5886 ssl->in_iv = ssl->in_buf + 13;
5887 ssl->in_msg = ssl->in_buf + 13;
5888 }
5889 else
5890#endif
5891 {
5892 ssl->out_ctr = ssl->out_buf;
5893 ssl->out_hdr = ssl->out_buf + 8;
5894 ssl->out_len = ssl->out_buf + 11;
5895 ssl->out_iv = ssl->out_buf + 13;
5896 ssl->out_msg = ssl->out_buf + 13;
5897
5898 ssl->in_ctr = ssl->in_buf;
5899 ssl->in_hdr = ssl->in_buf + 8;
5900 ssl->in_len = ssl->in_buf + 11;
5901 ssl->in_iv = ssl->in_buf + 13;
5902 ssl->in_msg = ssl->in_buf + 13;
5903 }
5904
Paul Bakker48916f92012-09-16 19:57:18 +00005905 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiakc2eddee2018-07-09 10:39:20 +02005906 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00005907
5908 return( 0 );
k-stachowiakc2eddee2018-07-09 10:39:20 +02005909
5910error:
5911 mbedtls_free( ssl->in_buf );
5912 mbedtls_free( ssl->out_buf );
5913
5914 ssl->conf = NULL;
5915
5916 ssl->in_buf = NULL;
5917 ssl->out_buf = NULL;
5918
5919 ssl->in_hdr = NULL;
5920 ssl->in_ctr = NULL;
5921 ssl->in_len = NULL;
5922 ssl->in_iv = NULL;
5923 ssl->in_msg = NULL;
5924
5925 ssl->out_hdr = NULL;
5926 ssl->out_ctr = NULL;
5927 ssl->out_len = NULL;
5928 ssl->out_iv = NULL;
5929 ssl->out_msg = NULL;
5930
k-stachowiak2c161142018-07-31 16:52:32 +02005931 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005932}
5933
5934/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00005935 * Reset an initialized and used SSL context for re-use while retaining
5936 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005937 *
5938 * If partial is non-zero, keep data in the input buffer and client ID.
5939 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00005940 */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005941static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00005942{
Paul Bakker48916f92012-09-16 19:57:18 +00005943 int ret;
5944
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005945 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01005946
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02005947 /* Cancel any possibly running timer */
5948 ssl_set_timer( ssl, 0 );
5949
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005950#if defined(MBEDTLS_SSL_RENEGOTIATION)
5951 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01005952 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00005953
5954 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005955 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
5956 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01005957#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005958 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00005959
Paul Bakker7eb013f2011-10-06 12:37:39 +00005960 ssl->in_offt = NULL;
5961
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01005962 ssl->in_msg = ssl->in_buf + 13;
Paul Bakker7eb013f2011-10-06 12:37:39 +00005963 ssl->in_msgtype = 0;
5964 ssl->in_msglen = 0;
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005965 if( partial == 0 )
5966 ssl->in_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005967#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02005968 ssl->next_record_offset = 0;
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005969 ssl->in_epoch = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02005970#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005971#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02005972 ssl_dtls_replay_reset( ssl );
5973#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00005974
5975 ssl->in_hslen = 0;
5976 ssl->nb_zero = 0;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005977
5978 ssl->keep_current_message = 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00005979
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01005980 ssl->out_msg = ssl->out_buf + 13;
Paul Bakker7eb013f2011-10-06 12:37:39 +00005981 ssl->out_msgtype = 0;
5982 ssl->out_msglen = 0;
5983 ssl->out_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005984#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
5985 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01005986 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01005987#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00005988
Paul Bakker48916f92012-09-16 19:57:18 +00005989 ssl->transform_in = NULL;
5990 ssl->transform_out = NULL;
Paul Bakker7eb013f2011-10-06 12:37:39 +00005991
Hanno Beckercd6a64a2018-08-13 16:35:15 +01005992 ssl->session_in = NULL;
5993 ssl->session_out = NULL;
5994
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005995 memset( ssl->out_buf, 0, MBEDTLS_SSL_BUFFER_LEN );
Hanno Beckercd6a64a2018-08-13 16:35:15 +01005996
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005997 if( partial == 0 )
5998 memset( ssl->in_buf, 0, MBEDTLS_SSL_BUFFER_LEN );
Paul Bakker05ef8352012-05-08 09:17:57 +00005999
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006000#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
6001 if( mbedtls_ssl_hw_record_reset != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00006002 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006003 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
6004 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
Paul Bakker2770fbd2012-07-03 13:30:23 +00006005 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006006 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
6007 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00006008 }
Paul Bakker05ef8352012-05-08 09:17:57 +00006009 }
6010#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00006011
Paul Bakker48916f92012-09-16 19:57:18 +00006012 if( ssl->transform )
Paul Bakker2770fbd2012-07-03 13:30:23 +00006013 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006014 mbedtls_ssl_transform_free( ssl->transform );
6015 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00006016 ssl->transform = NULL;
Paul Bakker2770fbd2012-07-03 13:30:23 +00006017 }
Paul Bakker48916f92012-09-16 19:57:18 +00006018
Paul Bakkerc0463502013-02-14 11:19:38 +01006019 if( ssl->session )
6020 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006021 mbedtls_ssl_session_free( ssl->session );
6022 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01006023 ssl->session = NULL;
6024 }
6025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006026#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02006027 ssl->alpn_chosen = NULL;
6028#endif
6029
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02006030#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02006031 if( partial == 0 )
6032 {
6033 mbedtls_free( ssl->cli_id );
6034 ssl->cli_id = NULL;
6035 ssl->cli_id_len = 0;
6036 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02006037#endif
6038
Paul Bakker48916f92012-09-16 19:57:18 +00006039 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
6040 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00006041
6042 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00006043}
6044
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02006045/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02006046 * Reset an initialized and used SSL context for re-use while retaining
6047 * all application-set variables, function pointers and data.
6048 */
6049int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
6050{
6051 return( ssl_session_reset_int( ssl, 0 ) );
6052}
6053
6054/*
Paul Bakker5121ce52009-01-03 21:22:43 +00006055 * SSL set accessors
6056 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006057void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00006058{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006059 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00006060}
6061
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02006062void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01006063{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006064 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01006065}
6066
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006067#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006068void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02006069{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006070 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02006071}
6072#endif
6073
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006074#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006075void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006076{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006077 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006078}
6079#endif
6080
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006081#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006082void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02006083{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006084 conf->hs_timeout_min = min;
6085 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02006086}
6087#endif
6088
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006089void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00006090{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006091 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00006092}
6093
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006094#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006095void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02006096 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00006097 void *p_vrfy )
6098{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006099 conf->f_vrfy = f_vrfy;
6100 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00006101}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006102#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00006103
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006104void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00006105 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00006106 void *p_rng )
6107{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01006108 conf->f_rng = f_rng;
6109 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00006110}
6111
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006112void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02006113 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00006114 void *p_dbg )
6115{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006116 conf->f_dbg = f_dbg;
6117 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00006118}
6119
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006120void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02006121 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00006122 mbedtls_ssl_send_t *f_send,
6123 mbedtls_ssl_recv_t *f_recv,
6124 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02006125{
6126 ssl->p_bio = p_bio;
6127 ssl->f_send = f_send;
6128 ssl->f_recv = f_recv;
6129 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01006130}
6131
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006132void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01006133{
6134 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02006135}
6136
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02006137void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
6138 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00006139 mbedtls_ssl_set_timer_t *f_set_timer,
6140 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02006141{
6142 ssl->p_timer = p_timer;
6143 ssl->f_set_timer = f_set_timer;
6144 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02006145
6146 /* Make sure we start with no timer running */
6147 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02006148}
6149
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006150#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006151void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01006152 void *p_cache,
6153 int (*f_get_cache)(void *, mbedtls_ssl_session *),
6154 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
Paul Bakker5121ce52009-01-03 21:22:43 +00006155{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01006156 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006157 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006158 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00006159}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006160#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00006161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006162#if defined(MBEDTLS_SSL_CLI_C)
6163int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00006164{
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02006165 int ret;
6166
6167 if( ssl == NULL ||
6168 session == NULL ||
6169 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006170 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02006171 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006172 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02006173 }
6174
6175 if( ( ret = ssl_session_copy( ssl->session_negotiate, session ) ) != 0 )
6176 return( ret );
6177
Paul Bakker0a597072012-09-25 21:55:46 +00006178 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02006179
6180 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006181}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006182#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00006183
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006184void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006185 const int *ciphersuites )
Paul Bakker5121ce52009-01-03 21:22:43 +00006186{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006187 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites;
6188 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites;
6189 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites;
6190 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02006191}
6192
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006193void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02006194 const int *ciphersuites,
Paul Bakker8f4ddae2013-04-15 15:09:54 +02006195 int major, int minor )
6196{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006197 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02006198 return;
6199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006200 if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02006201 return;
6202
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006203 conf->ciphersuite_list[minor] = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00006204}
6205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006206#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02006207void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01006208 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02006209{
6210 conf->cert_profile = profile;
6211}
6212
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02006213/* Append a new keycert entry to a (possibly empty) list */
6214static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
6215 mbedtls_x509_crt *cert,
6216 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02006217{
niisatoa35dbf12018-06-25 19:05:48 +09006218 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02006219
niisatoa35dbf12018-06-25 19:05:48 +09006220 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
6221 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02006222 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02006223
niisatoa35dbf12018-06-25 19:05:48 +09006224 new_cert->cert = cert;
6225 new_cert->key = key;
6226 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02006227
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02006228 /* Update head is the list was null, else add to the end */
6229 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01006230 {
niisatoa35dbf12018-06-25 19:05:48 +09006231 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01006232 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02006233 else
6234 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02006235 mbedtls_ssl_key_cert *cur = *head;
6236 while( cur->next != NULL )
6237 cur = cur->next;
niisatoa35dbf12018-06-25 19:05:48 +09006238 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02006239 }
6240
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02006241 return( 0 );
6242}
6243
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006244int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02006245 mbedtls_x509_crt *own_cert,
6246 mbedtls_pk_context *pk_key )
6247{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02006248 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02006249}
6250
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006251void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01006252 mbedtls_x509_crt *ca_chain,
6253 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006254{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01006255 conf->ca_chain = ca_chain;
6256 conf->ca_crl = ca_crl;
Paul Bakker5121ce52009-01-03 21:22:43 +00006257}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006258#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00006259
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02006260#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6261int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
6262 mbedtls_x509_crt *own_cert,
6263 mbedtls_pk_context *pk_key )
6264{
6265 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
6266 own_cert, pk_key ) );
6267}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02006268
6269void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
6270 mbedtls_x509_crt *ca_chain,
6271 mbedtls_x509_crl *ca_crl )
6272{
6273 ssl->handshake->sni_ca_chain = ca_chain;
6274 ssl->handshake->sni_ca_crl = ca_crl;
6275}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02006276
6277void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
6278 int authmode )
6279{
6280 ssl->handshake->sni_authmode = authmode;
6281}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02006282#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
6283
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02006284#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02006285/*
6286 * Set EC J-PAKE password for current handshake
6287 */
6288int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
6289 const unsigned char *pw,
6290 size_t pw_len )
6291{
6292 mbedtls_ecjpake_role role;
6293
Janos Follath8eb64132016-06-03 15:40:57 +01006294 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02006295 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6296
6297 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6298 role = MBEDTLS_ECJPAKE_SERVER;
6299 else
6300 role = MBEDTLS_ECJPAKE_CLIENT;
6301
6302 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
6303 role,
6304 MBEDTLS_MD_SHA256,
6305 MBEDTLS_ECP_DP_SECP256R1,
6306 pw, pw_len ) );
6307}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02006308#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02006309
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006310#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006311int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01006312 const unsigned char *psk, size_t psk_len,
6313 const unsigned char *psk_identity, size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02006314{
Paul Bakker6db455e2013-09-18 17:29:31 +02006315 if( psk == NULL || psk_identity == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006316 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker6db455e2013-09-18 17:29:31 +02006317
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006318 if( psk_len > MBEDTLS_PSK_MAX_LEN )
6319 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01006320
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02006321 /* Identity len will be encoded on two bytes */
6322 if( ( psk_identity_len >> 16 ) != 0 ||
6323 psk_identity_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
6324 {
6325 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6326 }
6327
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01006328 if( conf->psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02006329 {
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01006330 mbedtls_zeroize( conf->psk, conf->psk_len );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01006331
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01006332 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02006333 conf->psk = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01006334 conf->psk_len = 0;
6335 }
6336 if( conf->psk_identity != NULL )
6337 {
6338 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02006339 conf->psk_identity = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01006340 conf->psk_identity_len = 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02006341 }
6342
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02006343 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
6344 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
Mansour Moufidf81088b2015-02-17 13:10:21 -05006345 {
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01006346 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02006347 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01006348 conf->psk = NULL;
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02006349 conf->psk_identity = NULL;
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02006350 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Mansour Moufidf81088b2015-02-17 13:10:21 -05006351 }
Paul Bakker6db455e2013-09-18 17:29:31 +02006352
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01006353 conf->psk_len = psk_len;
6354 conf->psk_identity_len = psk_identity_len;
Paul Bakker6db455e2013-09-18 17:29:31 +02006355
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01006356 memcpy( conf->psk, psk, conf->psk_len );
6357 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker6db455e2013-09-18 17:29:31 +02006358
6359 return( 0 );
6360}
6361
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01006362int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
6363 const unsigned char *psk, size_t psk_len )
6364{
6365 if( psk == NULL || ssl->handshake == NULL )
6366 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6367
6368 if( psk_len > MBEDTLS_PSK_MAX_LEN )
6369 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6370
6371 if( ssl->handshake->psk != NULL )
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01006372 {
6373 mbedtls_zeroize( ssl->handshake->psk, ssl->handshake->psk_len );
Simon Butcher5b8d1d62015-10-04 22:06:51 +01006374 mbedtls_free( ssl->handshake->psk );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01006375 ssl->handshake->psk_len = 0;
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01006376 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01006377
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02006378 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02006379 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01006380
6381 ssl->handshake->psk_len = psk_len;
6382 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
6383
6384 return( 0 );
6385}
6386
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006387void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006388 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02006389 size_t),
6390 void *p_psk )
6391{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006392 conf->f_psk = f_psk;
6393 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02006394}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006395#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00006396
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02006397#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker470a8c42017-10-04 15:28:46 +01006398
6399#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006400int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
Paul Bakker5121ce52009-01-03 21:22:43 +00006401{
6402 int ret;
6403
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01006404 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
6405 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
6406 {
6407 mbedtls_mpi_free( &conf->dhm_P );
6408 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker5121ce52009-01-03 21:22:43 +00006409 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01006410 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006411
6412 return( 0 );
6413}
Hanno Becker470a8c42017-10-04 15:28:46 +01006414#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker5121ce52009-01-03 21:22:43 +00006415
Hanno Beckera90658f2017-10-04 15:29:08 +01006416int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
6417 const unsigned char *dhm_P, size_t P_len,
6418 const unsigned char *dhm_G, size_t G_len )
6419{
6420 int ret;
6421
6422 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
6423 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
6424 {
6425 mbedtls_mpi_free( &conf->dhm_P );
6426 mbedtls_mpi_free( &conf->dhm_G );
6427 return( ret );
6428 }
6429
6430 return( 0 );
6431}
Paul Bakker5121ce52009-01-03 21:22:43 +00006432
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006433int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00006434{
6435 int ret;
6436
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01006437 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
6438 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
6439 {
6440 mbedtls_mpi_free( &conf->dhm_P );
6441 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00006442 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01006443 }
Paul Bakker1b57b062011-01-06 15:48:19 +00006444
6445 return( 0 );
6446}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02006447#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00006448
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02006449#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
6450/*
6451 * Set the minimum length for Diffie-Hellman parameters
6452 */
6453void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
6454 unsigned int bitlen )
6455{
6456 conf->dhm_min_bitlen = bitlen;
6457}
6458#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
6459
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02006460#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02006461/*
6462 * Set allowed/preferred hashes for handshake signatures
6463 */
6464void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
6465 const int *hashes )
6466{
6467 conf->sig_hashes = hashes;
6468}
Hanno Becker947194e2017-04-07 13:25:49 +01006469#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02006470
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02006471#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01006472/*
6473 * Set the allowed elliptic curves
6474 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006475void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006476 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01006477{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006478 conf->curve_list = curve_list;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01006479}
Hanno Becker947194e2017-04-07 13:25:49 +01006480#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01006481
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01006482#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006483int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00006484{
Hanno Becker947194e2017-04-07 13:25:49 +01006485 /* Initialize to suppress unnecessary compiler warning */
6486 size_t hostname_len = 0;
6487
6488 /* Check if new hostname is valid before
6489 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01006490 if( hostname != NULL )
6491 {
6492 hostname_len = strlen( hostname );
6493
6494 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
6495 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6496 }
6497
6498 /* Now it's clear that we will overwrite the old hostname,
6499 * so we can free it safely */
6500
6501 if( ssl->hostname != NULL )
6502 {
6503 mbedtls_zeroize( ssl->hostname, strlen( ssl->hostname ) );
6504 mbedtls_free( ssl->hostname );
6505 }
6506
6507 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01006508
Paul Bakker5121ce52009-01-03 21:22:43 +00006509 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01006510 {
6511 ssl->hostname = NULL;
6512 }
6513 else
6514 {
6515 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01006516 if( ssl->hostname == NULL )
6517 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02006518
Hanno Becker947194e2017-04-07 13:25:49 +01006519 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02006520
Hanno Becker947194e2017-04-07 13:25:49 +01006521 ssl->hostname[hostname_len] = '\0';
6522 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006523
6524 return( 0 );
6525}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01006526#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00006527
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01006528#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006529void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006530 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00006531 const unsigned char *, size_t),
6532 void *p_sni )
6533{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006534 conf->f_sni = f_sni;
6535 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00006536}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006537#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00006538
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006539#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006540int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02006541{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02006542 size_t cur_len, tot_len;
6543 const char **p;
6544
6545 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08006546 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
6547 * MUST NOT be truncated."
6548 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02006549 */
6550 tot_len = 0;
6551 for( p = protos; *p != NULL; p++ )
6552 {
6553 cur_len = strlen( *p );
6554 tot_len += cur_len;
6555
6556 if( cur_len == 0 || cur_len > 255 || tot_len > 65535 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006557 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02006558 }
6559
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006560 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02006561
6562 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02006563}
6564
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006565const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02006566{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02006567 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02006568}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006569#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02006570
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02006571void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00006572{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006573 conf->max_major_ver = major;
6574 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00006575}
6576
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02006577void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00006578{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006579 conf->min_major_ver = major;
6580 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00006581}
6582
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006583#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006584void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02006585{
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01006586 conf->fallback = fallback;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02006587}
6588#endif
6589
Janos Follath088ce432017-04-10 12:42:31 +01006590#if defined(MBEDTLS_SSL_SRV_C)
6591void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
6592 char cert_req_ca_list )
6593{
6594 conf->cert_req_ca_list = cert_req_ca_list;
6595}
6596#endif
6597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006598#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006599void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01006600{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006601 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01006602}
6603#endif
6604
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006605#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006606void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02006607{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006608 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02006609}
6610#endif
6611
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02006612#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006613void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01006614{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006615 conf->arc4_disabled = arc4;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01006616}
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02006617#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01006618
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006619#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006620int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02006621{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006622 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
6623 mfl_code_to_length[mfl_code] > MBEDTLS_SSL_MAX_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02006624 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006625 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02006626 }
6627
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01006628 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02006629
6630 return( 0 );
6631}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006632#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02006633
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006634#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02006635void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02006636{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006637 conf->trunc_hmac = truncate;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02006638}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006639#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02006640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006641#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006642void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01006643{
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01006644 conf->cbc_record_splitting = split;
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01006645}
6646#endif
6647
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006648void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00006649{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006650 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00006651}
6652
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006653#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006654void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01006655{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006656 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01006657}
6658
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006659void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02006660{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006661 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02006662}
6663
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02006664void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01006665 const unsigned char period[8] )
6666{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02006667 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01006668}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006669#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00006670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006671#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02006672#if defined(MBEDTLS_SSL_CLI_C)
6673void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02006674{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01006675 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02006676}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02006677#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02006678
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02006679#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02006680void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
6681 mbedtls_ssl_ticket_write_t *f_ticket_write,
6682 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
6683 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02006684{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02006685 conf->f_ticket_write = f_ticket_write;
6686 conf->f_ticket_parse = f_ticket_parse;
6687 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02006688}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02006689#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006690#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02006691
Robert Cragie4feb7ae2015-10-02 13:33:37 +01006692#if defined(MBEDTLS_SSL_EXPORT_KEYS)
6693void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
6694 mbedtls_ssl_export_keys_t *f_export_keys,
6695 void *p_export_keys )
6696{
6697 conf->f_export_keys = f_export_keys;
6698 conf->p_export_keys = p_export_keys;
6699}
6700#endif
6701
Paul Bakker5121ce52009-01-03 21:22:43 +00006702/*
6703 * SSL get accessors
6704 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006705size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006706{
6707 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
6708}
6709
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02006710uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006711{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00006712 if( ssl->session != NULL )
6713 return( ssl->session->verify_result );
6714
6715 if( ssl->session_negotiate != NULL )
6716 return( ssl->session_negotiate->verify_result );
6717
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02006718 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00006719}
6720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006721const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00006722{
Paul Bakker926c8e42013-03-06 10:23:34 +01006723 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02006724 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01006725
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006726 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00006727}
6728
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006729const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00006730{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006731#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006732 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01006733 {
6734 switch( ssl->minor_ver )
6735 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006736 case MBEDTLS_SSL_MINOR_VERSION_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01006737 return( "DTLSv1.0" );
6738
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006739 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01006740 return( "DTLSv1.2" );
6741
6742 default:
6743 return( "unknown (DTLS)" );
6744 }
6745 }
6746#endif
6747
Paul Bakker43ca69c2011-01-15 17:35:19 +00006748 switch( ssl->minor_ver )
6749 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006750 case MBEDTLS_SSL_MINOR_VERSION_0:
Paul Bakker43ca69c2011-01-15 17:35:19 +00006751 return( "SSLv3.0" );
6752
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006753 case MBEDTLS_SSL_MINOR_VERSION_1:
Paul Bakker43ca69c2011-01-15 17:35:19 +00006754 return( "TLSv1.0" );
6755
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006756 case MBEDTLS_SSL_MINOR_VERSION_2:
Paul Bakker43ca69c2011-01-15 17:35:19 +00006757 return( "TLSv1.1" );
6758
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006759 case MBEDTLS_SSL_MINOR_VERSION_3:
Paul Bakker1ef83d62012-04-11 12:09:53 +00006760 return( "TLSv1.2" );
6761
Paul Bakker43ca69c2011-01-15 17:35:19 +00006762 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01006763 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00006764 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00006765}
6766
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006767int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02006768{
Hanno Becker12f7ede2018-08-17 15:28:19 +01006769 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006770 const mbedtls_ssl_transform *transform = ssl->transform_out;
Hanno Beckerdbd3e882018-08-03 09:40:07 +01006771 unsigned block_size;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02006772
Hanno Beckercd6a64a2018-08-13 16:35:15 +01006773 if( transform == NULL )
6774 return( (int) mbedtls_ssl_hdr_len( ssl ) );
6775
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006776#if defined(MBEDTLS_ZLIB_SUPPORT)
6777 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
6778 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02006779#endif
6780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006781 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02006782 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006783 case MBEDTLS_MODE_GCM:
6784 case MBEDTLS_MODE_CCM:
6785 case MBEDTLS_MODE_STREAM:
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02006786 transform_expansion = transform->minlen;
6787 break;
6788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006789 case MBEDTLS_MODE_CBC:
Hanno Beckerdbd3e882018-08-03 09:40:07 +01006790
6791 block_size = mbedtls_cipher_get_block_size(
6792 &transform->cipher_ctx_enc );
6793
Hanno Becker12f7ede2018-08-17 15:28:19 +01006794 /* Expansion due to the addition of the MAC. */
6795 transform_expansion += transform->maclen;
6796
6797 /* Expansion due to the addition of CBC padding;
6798 * Theoretically up to 256 bytes, but we never use
6799 * more than the block size of the underlying cipher. */
6800 transform_expansion += block_size;
6801
6802 /* For TLS 1.1 or higher, an explicit IV is added
6803 * after the record header. */
Hanno Beckerdbd3e882018-08-03 09:40:07 +01006804#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
6805 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Hanno Becker12f7ede2018-08-17 15:28:19 +01006806 transform_expansion += block_size;
Hanno Beckerdbd3e882018-08-03 09:40:07 +01006807#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker12f7ede2018-08-17 15:28:19 +01006808
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02006809 break;
6810
6811 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02006812 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006813 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02006814 }
6815
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02006816 return( (int)( mbedtls_ssl_hdr_len( ssl ) + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02006817}
6818
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02006819#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
6820size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
6821{
6822 size_t max_len;
6823
6824 /*
6825 * Assume mfl_code is correct since it was checked when set
6826 */
6827 max_len = mfl_code_to_length[ssl->conf->mfl_code];
6828
6829 /*
6830 * Check if a smaller max length was negotiated
6831 */
6832 if( ssl->session_out != NULL &&
6833 mfl_code_to_length[ssl->session_out->mfl_code] < max_len )
6834 {
6835 max_len = mfl_code_to_length[ssl->session_out->mfl_code];
6836 }
6837
6838 return max_len;
6839}
6840#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
6841
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006842#if defined(MBEDTLS_X509_CRT_PARSE_C)
6843const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00006844{
6845 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02006846 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00006847
Paul Bakkerd8bb8262014-06-17 14:06:49 +02006848 return( ssl->session->peer_cert );
Paul Bakkerb0550d92012-10-30 07:51:03 +00006849}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006850#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00006851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006852#if defined(MBEDTLS_SSL_CLI_C)
6853int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02006854{
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02006855 if( ssl == NULL ||
6856 dst == NULL ||
6857 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006858 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02006859 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006860 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02006861 }
6862
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02006863 return( ssl_session_copy( dst, ssl->session ) );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02006864}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006865#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02006866
Paul Bakker5121ce52009-01-03 21:22:43 +00006867/*
Paul Bakker1961b702013-01-25 14:49:24 +01006868 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00006869 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006870int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006871{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006872 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker5121ce52009-01-03 21:22:43 +00006873
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02006874 if( ssl == NULL || ssl->conf == NULL )
6875 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006877#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006878 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006879 ret = mbedtls_ssl_handshake_client_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00006880#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006881#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006882 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006883 ret = mbedtls_ssl_handshake_server_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00006884#endif
6885
Paul Bakker1961b702013-01-25 14:49:24 +01006886 return( ret );
6887}
6888
6889/*
6890 * Perform the SSL handshake
6891 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006892int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01006893{
6894 int ret = 0;
6895
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02006896 if( ssl == NULL || ssl->conf == NULL )
6897 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6898
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006899 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01006900
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006901 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +01006902 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006903 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01006904
6905 if( ret != 0 )
6906 break;
6907 }
6908
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006909 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006910
6911 return( ret );
6912}
6913
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006914#if defined(MBEDTLS_SSL_RENEGOTIATION)
6915#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00006916/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006917 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00006918 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006919static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006920{
6921 int ret;
6922
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006923 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006924
6925 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006926 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6927 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006928
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006929 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006930 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006931 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006932 return( ret );
6933 }
6934
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006935 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006936
6937 return( 0 );
6938}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006939#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006940
6941/*
6942 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006943 * - any side: calling mbedtls_ssl_renegotiate(),
6944 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
6945 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02006946 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01006947 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006948 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006949 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006950static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00006951{
6952 int ret;
6953
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006954 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00006955
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01006956 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
6957 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00006958
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02006959 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
6960 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006961#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006962 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006963 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02006964 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006965 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02006966 ssl->handshake->out_msg_seq = 1;
6967 else
6968 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02006969 }
6970#endif
6971
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006972 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
6973 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00006974
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006975 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00006976 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006977 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00006978 return( ret );
6979 }
6980
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006981 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00006982
6983 return( 0 );
6984}
6985
6986/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006987 * Renegotiate current connection on client,
6988 * or request renegotiation on server
6989 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006990int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01006991{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006992 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01006993
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02006994 if( ssl == NULL || ssl->conf == NULL )
6995 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6996
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006997#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01006998 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006999 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007000 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007001 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
7002 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007003
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007004 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02007005
7006 /* Did we already try/start sending HelloRequest? */
7007 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007008 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02007009
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01007010 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007011 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007012#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007014#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007015 /*
7016 * On client, either start the renegotiation process or,
7017 * if already in progress, continue the handshake
7018 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007019 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007020 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007021 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
7022 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007023
7024 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
7025 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007026 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007027 return( ret );
7028 }
7029 }
7030 else
7031 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007032 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007033 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007034 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007035 return( ret );
7036 }
7037 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007038#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01007039
Paul Bakker37ce0ff2013-10-31 14:32:04 +01007040 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01007041}
7042
7043/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01007044 * Check record counters and renegotiate if they're above the limit.
7045 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007046static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01007047{
Andres AG2196c7f2016-12-15 17:01:16 +00007048 size_t ep_len = ssl_ep_len( ssl );
7049 int in_ctr_cmp;
7050 int out_ctr_cmp;
7051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007052 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
7053 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007054 ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01007055 {
7056 return( 0 );
7057 }
7058
Andres AG2196c7f2016-12-15 17:01:16 +00007059 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
7060 ssl->conf->renego_period + ep_len, 8 - ep_len );
7061 out_ctr_cmp = memcmp( ssl->out_ctr + ep_len,
7062 ssl->conf->renego_period + ep_len, 8 - ep_len );
7063
7064 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01007065 {
7066 return( 0 );
7067 }
7068
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02007069 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007070 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01007071}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007072#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00007073
7074/*
7075 * Receive application data decrypted from the SSL layer
7076 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007077int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +00007078{
Hanno Becker4a810fb2017-05-24 16:27:30 +01007079 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +00007080 size_t n;
Paul Bakker5121ce52009-01-03 21:22:43 +00007081
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02007082 if( ssl == NULL || ssl->conf == NULL )
7083 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7084
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007085 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007086
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007087#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007088 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007089 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007090 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007091 return( ret );
7092
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02007093 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007094 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02007095 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007096 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02007097 return( ret );
7098 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007099 }
7100#endif
7101
Hanno Becker4a810fb2017-05-24 16:27:30 +01007102 /*
7103 * Check if renegotiation is necessary and/or handshake is
7104 * in process. If yes, perform/continue, and fall through
7105 * if an unexpected packet is received while the client
7106 * is waiting for the ServerHello.
7107 *
7108 * (There is no equivalent to the last condition on
7109 * the server-side as it is not treated as within
7110 * a handshake while waiting for the ClientHello
7111 * after a renegotiation request.)
7112 */
7113
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007114#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +01007115 ret = ssl_check_ctr_renegotiate( ssl );
7116 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
7117 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01007118 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007119 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01007120 return( ret );
7121 }
7122#endif
7123
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007124 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00007125 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007126 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +01007127 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
7128 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007129 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007130 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007131 return( ret );
7132 }
7133 }
7134
7135 if( ssl->in_offt == NULL )
7136 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02007137 /* Start timer if not already running */
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +02007138 if( ssl->f_get_timer != NULL &&
7139 ssl->f_get_timer( ssl->p_timer ) == -1 )
7140 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007141 ssl_set_timer( ssl, ssl->conf->read_timeout );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +02007142 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02007143
Hanno Becker4a810fb2017-05-24 16:27:30 +01007144 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007145 {
Hanno Becker4a810fb2017-05-24 16:27:30 +01007146 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
7147 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +00007148
Hanno Becker4a810fb2017-05-24 16:27:30 +01007149 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
7150 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007151 }
7152
7153 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007154 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +00007155 {
7156 /*
7157 * OpenSSL sends empty messages to randomize the IV
7158 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007159 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007160 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007161 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +00007162 return( 0 );
7163
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007164 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007165 return( ret );
7166 }
7167 }
7168
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007169 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +00007170 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007171 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00007172
Hanno Becker4a810fb2017-05-24 16:27:30 +01007173 /*
7174 * - For client-side, expect SERVER_HELLO_REQUEST.
7175 * - For server-side, expect CLIENT_HELLO.
7176 * - Fail (TLS) or silently drop record (DTLS) in other cases.
7177 */
7178
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007179#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007180 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007181 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
Hanno Becker4a810fb2017-05-24 16:27:30 +01007182 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
Paul Bakker48916f92012-09-16 19:57:18 +00007183 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007184 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02007185
7186 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007187#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007188 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01007189 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02007190#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007191 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02007192 }
Hanno Becker4a810fb2017-05-24 16:27:30 +01007193#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02007194
Hanno Becker4a810fb2017-05-24 16:27:30 +01007195#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007196 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007197 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02007198 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007199 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02007200
7201 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007202#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007203 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01007204 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02007205#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007206 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker48916f92012-09-16 19:57:18 +00007207 }
Hanno Becker4a810fb2017-05-24 16:27:30 +01007208#endif /* MBEDTLS_SSL_SRV_C */
7209
Hanno Becker21df7f92017-10-17 11:03:26 +01007210#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +01007211 /* Determine whether renegotiation attempt should be accepted */
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +01007212 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
7213 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
7214 ssl->conf->allow_legacy_renegotiation ==
7215 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
7216 {
7217 /*
7218 * Accept renegotiation request
7219 */
Paul Bakker48916f92012-09-16 19:57:18 +00007220
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +01007221 /* DTLS clients need to know renego is server-initiated */
7222#if defined(MBEDTLS_SSL_PROTO_DTLS)
7223 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7224 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7225 {
7226 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
7227 }
7228#endif
7229 ret = ssl_start_renegotiation( ssl );
7230 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
7231 ret != 0 )
7232 {
7233 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
7234 return( ret );
7235 }
7236 }
7237 else
Hanno Becker21df7f92017-10-17 11:03:26 +01007238#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +00007239 {
Hanno Becker4a810fb2017-05-24 16:27:30 +01007240 /*
7241 * Refuse renegotiation
7242 */
7243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007244 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00007245
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007246#if defined(MBEDTLS_SSL_PROTO_SSL3)
7247 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker48916f92012-09-16 19:57:18 +00007248 {
Gilles Peskine92e44262017-05-10 17:27:49 +02007249 /* SSLv3 does not have a "no_renegotiation" warning, so
7250 we send a fatal alert and abort the connection. */
7251 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7252 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
7253 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007254 }
7255 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007256#endif /* MBEDTLS_SSL_PROTO_SSL3 */
7257#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
7258 defined(MBEDTLS_SSL_PROTO_TLS1_2)
7259 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007260 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007261 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
7262 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
7263 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007264 {
7265 return( ret );
7266 }
Paul Bakker48916f92012-09-16 19:57:18 +00007267 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02007268 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007269#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
7270 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02007271 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007272 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7273 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02007274 }
Paul Bakker48916f92012-09-16 19:57:18 +00007275 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02007276
Hanno Becker4a810fb2017-05-24 16:27:30 +01007277 return( MBEDTLS_ERR_SSL_WANT_READ );
Paul Bakker48916f92012-09-16 19:57:18 +00007278 }
Hanno Becker21df7f92017-10-17 11:03:26 +01007279#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007280 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +01007281 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007282 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02007283 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007284 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02007285 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007286 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02007287 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007288 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02007289 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02007290 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +01007291 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007292#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02007293
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007294 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
7295 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02007296 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007297 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01007298 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02007299 }
7300
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007301 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +00007302 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007303 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
7304 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007305 }
7306
7307 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02007308
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02007309 /* We're going to return something now, cancel timer,
7310 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007311 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02007312 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02007313
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02007314#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02007315 /* If we requested renego but received AppData, resend HelloRequest.
7316 * Do it now, after setting in_offt, to avoid taking this branch
7317 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007318#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007319 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007320 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02007321 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02007322 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02007323 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007324 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02007325 return( ret );
7326 }
7327 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007328#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +01007329#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00007330 }
7331
7332 n = ( len < ssl->in_msglen )
7333 ? len : ssl->in_msglen;
7334
7335 memcpy( buf, ssl->in_offt, n );
7336 ssl->in_msglen -= n;
7337
7338 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +01007339 {
7340 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +00007341 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +01007342 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +01007343 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007344 else
Hanno Becker4a810fb2017-05-24 16:27:30 +01007345 {
Paul Bakker5121ce52009-01-03 21:22:43 +00007346 /* more data available */
7347 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +01007348 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007349
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007350 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007351
Paul Bakker23986e52011-04-24 08:57:21 +00007352 return( (int) n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007353}
7354
7355/*
Andres Amaya Garcia0fc4e082017-09-28 14:41:17 +01007356 * Send application data to be encrypted by the SSL layer, taking care of max
7357 * fragment length and buffer size.
7358 *
7359 * According to RFC 5246 Section 6.2.1:
7360 *
7361 * Zero-length fragments of Application data MAY be sent as they are
7362 * potentially useful as a traffic analysis countermeasure.
7363 *
7364 * Therefore, it is possible that the input message length is 0 and the
7365 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +00007366 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007367static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007368 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +00007369{
Paul Bakker23986e52011-04-24 08:57:21 +00007370 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007371#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02007372 size_t max_len = mbedtls_ssl_get_max_frag_len( ssl );
Florin0b7b83f2017-07-22 09:01:44 +02007373#else
7374 size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
7375#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02007376 if( len > max_len )
7377 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007378#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007379 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02007380 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007381 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02007382 "maximum fragment length: %d > %d",
7383 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007384 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02007385 }
7386 else
7387#endif
7388 len = max_len;
7389 }
Paul Bakker887bd502011-06-08 13:10:54 +00007390
Paul Bakker5121ce52009-01-03 21:22:43 +00007391 if( ssl->out_left != 0 )
7392 {
Andres Amaya Garcia0fc4e082017-09-28 14:41:17 +01007393 /*
7394 * The user has previously tried to send the data and
7395 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
7396 * written. In this case, we expect the high-level write function
7397 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
7398 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007399 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007400 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007401 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007402 return( ret );
7403 }
7404 }
Paul Bakker887bd502011-06-08 13:10:54 +00007405 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +00007406 {
Andres Amaya Garcia0fc4e082017-09-28 14:41:17 +01007407 /*
7408 * The user is trying to send a message the first time, so we need to
7409 * copy the data into the internal buffers and setup the data structure
7410 * to keep track of partial writes
7411 */
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02007412 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007413 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02007414 memcpy( ssl->out_msg, buf, len );
Paul Bakker887bd502011-06-08 13:10:54 +00007415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007416 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker887bd502011-06-08 13:10:54 +00007417 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007418 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker887bd502011-06-08 13:10:54 +00007419 return( ret );
7420 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007421 }
7422
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02007423 return( (int) len );
Paul Bakker5121ce52009-01-03 21:22:43 +00007424}
7425
7426/*
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007427 * Write application data, doing 1/n-1 splitting if necessary.
7428 *
7429 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01007430 * then the caller will call us again with the same arguments, so
Hanno Becker2b187c42017-09-18 14:58:11 +01007431 * remember whether we already did the split or not.
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007432 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007433#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007434static int ssl_write_split( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007435 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007436{
7437 int ret;
7438
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01007439 if( ssl->conf->cbc_record_splitting ==
7440 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01007441 len <= 1 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007442 ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_1 ||
7443 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
7444 != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007445 {
7446 return( ssl_write_real( ssl, buf, len ) );
7447 }
7448
7449 if( ssl->split_done == 0 )
7450 {
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01007451 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007452 return( ret );
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01007453 ssl->split_done = 1;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007454 }
7455
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01007456 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
7457 return( ret );
7458 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007459
7460 return( ret + 1 );
7461}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007462#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007463
7464/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007465 * Write application data (public-facing wrapper)
7466 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007467int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007468{
7469 int ret;
7470
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007471 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007472
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02007473 if( ssl == NULL || ssl->conf == NULL )
7474 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7475
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007476#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007477 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
7478 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007479 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007480 return( ret );
7481 }
7482#endif
7483
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007484 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007485 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007486 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007487 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +02007488 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007489 return( ret );
7490 }
7491 }
7492
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007493#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007494 ret = ssl_write_split( ssl, buf, len );
7495#else
7496 ret = ssl_write_real( ssl, buf, len );
7497#endif
7498
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02007499 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02007500
7501 return( ret );
7502}
7503
7504/*
Paul Bakker5121ce52009-01-03 21:22:43 +00007505 * Notify the peer that the connection is being closed
7506 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007507int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007508{
7509 int ret;
7510
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02007511 if( ssl == NULL || ssl->conf == NULL )
7512 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7513
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007514 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007515
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +02007516 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007517 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007518
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007519 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00007520 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007521 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
7522 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
7523 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007524 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007525 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007526 return( ret );
7527 }
7528 }
7529
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007530 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007531
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +02007532 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00007533}
7534
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007535void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +00007536{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007537 if( transform == NULL )
7538 return;
7539
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007540#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00007541 deflateEnd( &transform->ctx_deflate );
7542 inflateEnd( &transform->ctx_inflate );
7543#endif
7544
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007545 mbedtls_cipher_free( &transform->cipher_ctx_enc );
7546 mbedtls_cipher_free( &transform->cipher_ctx_dec );
Manuel Pégourié-Gonnardf71e5872013-09-23 17:12:43 +02007547
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007548 mbedtls_md_free( &transform->md_ctx_enc );
7549 mbedtls_md_free( &transform->md_ctx_dec );
Paul Bakker61d113b2013-07-04 11:51:43 +02007550
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007551 mbedtls_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +00007552}
7553
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007554#if defined(MBEDTLS_X509_CRT_PARSE_C)
7555static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02007556{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007557 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02007558
7559 while( cur != NULL )
7560 {
7561 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007562 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02007563 cur = next;
7564 }
7565}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007566#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02007567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007568void mbedtls_ssl_handshake_free( mbedtls_ssl_handshake_params *handshake )
Paul Bakker48916f92012-09-16 19:57:18 +00007569{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007570 if( handshake == NULL )
7571 return;
7572
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02007573#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
7574 defined(MBEDTLS_SSL_PROTO_TLS1_1)
7575 mbedtls_md5_free( &handshake->fin_md5 );
7576 mbedtls_sha1_free( &handshake->fin_sha1 );
7577#endif
7578#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
7579#if defined(MBEDTLS_SHA256_C)
7580 mbedtls_sha256_free( &handshake->fin_sha256 );
7581#endif
7582#if defined(MBEDTLS_SHA512_C)
7583 mbedtls_sha512_free( &handshake->fin_sha512 );
7584#endif
7585#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7586
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007587#if defined(MBEDTLS_DHM_C)
7588 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00007589#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007590#if defined(MBEDTLS_ECDH_C)
7591 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02007592#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02007593#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02007594 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02007595#if defined(MBEDTLS_SSL_CLI_C)
7596 mbedtls_free( handshake->ecjpake_cache );
7597 handshake->ecjpake_cache = NULL;
7598 handshake->ecjpake_cache_len = 0;
7599#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02007600#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02007601
Janos Follath4ae5c292016-02-10 11:27:43 +00007602#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
7603 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02007604 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007605 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02007606#endif
7607
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007608#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
7609 if( handshake->psk != NULL )
7610 {
7611 mbedtls_zeroize( handshake->psk, handshake->psk_len );
7612 mbedtls_free( handshake->psk );
7613 }
7614#endif
7615
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007616#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
7617 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02007618 /*
7619 * Free only the linked list wrapper, not the keys themselves
7620 * since the belong to the SNI callback
7621 */
7622 if( handshake->sni_key_cert != NULL )
7623 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007624 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02007625
7626 while( cur != NULL )
7627 {
7628 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007629 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02007630 cur = next;
7631 }
7632 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007633#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02007634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007635#if defined(MBEDTLS_SSL_PROTO_DTLS)
7636 mbedtls_free( handshake->verify_cookie );
7637 mbedtls_free( handshake->hs_msg );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02007638 ssl_flight_free( handshake->flight );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02007639#endif
7640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007641 mbedtls_zeroize( handshake, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00007642}
7643
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007644void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00007645{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007646 if( session == NULL )
7647 return;
7648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007649#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker0a597072012-09-25 21:55:46 +00007650 if( session->peer_cert != NULL )
Paul Bakker48916f92012-09-16 19:57:18 +00007651 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007652 mbedtls_x509_crt_free( session->peer_cert );
7653 mbedtls_free( session->peer_cert );
Paul Bakker48916f92012-09-16 19:57:18 +00007654 }
Paul Bakkered27a042013-04-18 22:46:23 +02007655#endif
Paul Bakker0a597072012-09-25 21:55:46 +00007656
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02007657#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007658 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02007659#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02007660
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007661 mbedtls_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00007662}
7663
Paul Bakker5121ce52009-01-03 21:22:43 +00007664/*
7665 * Free an SSL context
7666 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007667void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007668{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007669 if( ssl == NULL )
7670 return;
7671
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007672 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007673
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01007674 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007675 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007676 mbedtls_zeroize( ssl->out_buf, MBEDTLS_SSL_BUFFER_LEN );
7677 mbedtls_free( ssl->out_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00007678 }
7679
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01007680 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007681 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007682 mbedtls_zeroize( ssl->in_buf, MBEDTLS_SSL_BUFFER_LEN );
7683 mbedtls_free( ssl->in_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00007684 }
7685
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007686#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker16770332013-10-11 09:59:44 +02007687 if( ssl->compress_buf != NULL )
7688 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007689 mbedtls_zeroize( ssl->compress_buf, MBEDTLS_SSL_BUFFER_LEN );
7690 mbedtls_free( ssl->compress_buf );
Paul Bakker16770332013-10-11 09:59:44 +02007691 }
7692#endif
7693
Paul Bakker48916f92012-09-16 19:57:18 +00007694 if( ssl->transform )
7695 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007696 mbedtls_ssl_transform_free( ssl->transform );
7697 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00007698 }
7699
7700 if( ssl->handshake )
7701 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007702 mbedtls_ssl_handshake_free( ssl->handshake );
7703 mbedtls_ssl_transform_free( ssl->transform_negotiate );
7704 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00007705
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007706 mbedtls_free( ssl->handshake );
7707 mbedtls_free( ssl->transform_negotiate );
7708 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00007709 }
7710
Paul Bakkerc0463502013-02-14 11:19:38 +01007711 if( ssl->session )
7712 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007713 mbedtls_ssl_session_free( ssl->session );
7714 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01007715 }
7716
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02007717#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02007718 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007719 {
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01007720 mbedtls_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007721 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00007722 }
Paul Bakker0be444a2013-08-27 21:55:01 +02007723#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007724
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007725#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
7726 if( mbedtls_ssl_hw_record_finish != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00007727 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007728 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
7729 mbedtls_ssl_hw_record_finish( ssl );
Paul Bakker05ef8352012-05-08 09:17:57 +00007730 }
7731#endif
7732
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02007733#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007734 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02007735#endif
7736
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007737 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00007738
Paul Bakker86f04f42013-02-14 11:20:09 +01007739 /* Actually clear after last debug message */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007740 mbedtls_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007741}
7742
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007743/*
7744 * Initialze mbedtls_ssl_config
7745 */
7746void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
7747{
7748 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
7749}
7750
Simon Butcherc97b6972015-12-27 23:48:17 +00007751#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01007752static int ssl_preset_default_hashes[] = {
7753#if defined(MBEDTLS_SHA512_C)
7754 MBEDTLS_MD_SHA512,
7755 MBEDTLS_MD_SHA384,
7756#endif
7757#if defined(MBEDTLS_SHA256_C)
7758 MBEDTLS_MD_SHA256,
7759 MBEDTLS_MD_SHA224,
7760#endif
Gilles Peskine5d2511c2017-05-12 13:16:40 +02007761#if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01007762 MBEDTLS_MD_SHA1,
7763#endif
7764 MBEDTLS_MD_NONE
7765};
Simon Butcherc97b6972015-12-27 23:48:17 +00007766#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01007767
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007768static int ssl_preset_suiteb_ciphersuites[] = {
7769 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
7770 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
7771 0
7772};
7773
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02007774#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007775static int ssl_preset_suiteb_hashes[] = {
7776 MBEDTLS_MD_SHA256,
7777 MBEDTLS_MD_SHA384,
7778 MBEDTLS_MD_NONE
7779};
7780#endif
7781
7782#if defined(MBEDTLS_ECP_C)
7783static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
Jaeden Ameroba59f6b2019-06-03 08:27:16 +01007784#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007785 MBEDTLS_ECP_DP_SECP256R1,
Jaeden Ameroba59f6b2019-06-03 08:27:16 +01007786#endif
7787#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007788 MBEDTLS_ECP_DP_SECP384R1,
Jaeden Ameroba59f6b2019-06-03 08:27:16 +01007789#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007790 MBEDTLS_ECP_DP_NONE
7791};
7792#endif
7793
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007794/*
Tillmann Karras588ad502015-09-25 04:27:22 +02007795 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007796 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02007797int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007798 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007799{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02007800#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007801 int ret;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02007802#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007803
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02007804 /* Use the functions here so that they are covered in tests,
7805 * but otherwise access member directly for efficiency */
7806 mbedtls_ssl_conf_endpoint( conf, endpoint );
7807 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007808
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007809 /*
7810 * Things that are common to all presets
7811 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02007812#if defined(MBEDTLS_SSL_CLI_C)
7813 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
7814 {
7815 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
7816#if defined(MBEDTLS_SSL_SESSION_TICKETS)
7817 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
7818#endif
7819 }
7820#endif
7821
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02007822#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007823 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02007824#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007825
7826#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7827 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
7828#endif
7829
7830#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
7831 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
7832#endif
7833
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01007834#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
7835 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
7836#endif
7837
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02007838#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007839 conf->f_cookie_write = ssl_cookie_write_dummy;
7840 conf->f_cookie_check = ssl_cookie_check_dummy;
7841#endif
7842
7843#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
7844 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
7845#endif
7846
Janos Follath088ce432017-04-10 12:42:31 +01007847#if defined(MBEDTLS_SSL_SRV_C)
7848 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
7849#endif
7850
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007851#if defined(MBEDTLS_SSL_PROTO_DTLS)
7852 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
7853 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
7854#endif
7855
7856#if defined(MBEDTLS_SSL_RENEGOTIATION)
7857 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00007858 memset( conf->renego_period, 0x00, 2 );
7859 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007860#endif
7861
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007862#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
7863 if( endpoint == MBEDTLS_SSL_IS_SERVER )
7864 {
Hanno Becker00d0a682017-10-04 13:14:29 +01007865 const unsigned char dhm_p[] =
7866 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
7867 const unsigned char dhm_g[] =
7868 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
7869
Hanno Beckera90658f2017-10-04 15:29:08 +01007870 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
7871 dhm_p, sizeof( dhm_p ),
7872 dhm_g, sizeof( dhm_g ) ) ) != 0 )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007873 {
7874 return( ret );
7875 }
7876 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02007877#endif
7878
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007879 /*
7880 * Preset-specific defaults
7881 */
7882 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007883 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007884 /*
7885 * NSA Suite B
7886 */
7887 case MBEDTLS_SSL_PRESET_SUITEB:
7888 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
7889 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
7890 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
7891 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
7892
7893 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
7894 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
7895 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
7896 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
7897 ssl_preset_suiteb_ciphersuites;
7898
7899#if defined(MBEDTLS_X509_CRT_PARSE_C)
7900 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007901#endif
7902
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02007903#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007904 conf->sig_hashes = ssl_preset_suiteb_hashes;
7905#endif
7906
7907#if defined(MBEDTLS_ECP_C)
7908 conf->curve_list = ssl_preset_suiteb_curves;
7909#endif
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02007910 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007911
7912 /*
7913 * Default
7914 */
7915 default:
Ron Eldor5e9f14d2017-05-28 10:46:38 +03007916 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
7917 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
7918 MBEDTLS_SSL_MIN_MAJOR_VERSION :
7919 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
7920 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
7921 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
7922 MBEDTLS_SSL_MIN_MINOR_VERSION :
7923 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007924 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
7925 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
7926
7927#if defined(MBEDTLS_SSL_PROTO_DTLS)
7928 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7929 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
7930#endif
7931
7932 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
7933 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
7934 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
7935 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
7936 mbedtls_ssl_list_ciphersuites();
7937
7938#if defined(MBEDTLS_X509_CRT_PARSE_C)
7939 conf->cert_profile = &mbedtls_x509_crt_profile_default;
7940#endif
7941
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02007942#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01007943 conf->sig_hashes = ssl_preset_default_hashes;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007944#endif
7945
7946#if defined(MBEDTLS_ECP_C)
7947 conf->curve_list = mbedtls_ecp_grp_id_list();
7948#endif
7949
7950#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
7951 conf->dhm_min_bitlen = 1024;
7952#endif
7953 }
7954
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007955 return( 0 );
7956}
7957
7958/*
7959 * Free mbedtls_ssl_config
7960 */
7961void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
7962{
7963#if defined(MBEDTLS_DHM_C)
7964 mbedtls_mpi_free( &conf->dhm_P );
7965 mbedtls_mpi_free( &conf->dhm_G );
7966#endif
7967
7968#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
7969 if( conf->psk != NULL )
7970 {
7971 mbedtls_zeroize( conf->psk, conf->psk_len );
7972 mbedtls_zeroize( conf->psk_identity, conf->psk_identity_len );
7973 mbedtls_free( conf->psk );
7974 mbedtls_free( conf->psk_identity );
7975 conf->psk_len = 0;
7976 conf->psk_identity_len = 0;
7977 }
7978#endif
7979
7980#if defined(MBEDTLS_X509_CRT_PARSE_C)
7981 ssl_key_cert_free( conf->key_cert );
7982#endif
7983
7984 mbedtls_zeroize( conf, sizeof( mbedtls_ssl_config ) );
7985}
7986
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02007987#if defined(MBEDTLS_PK_C) && \
7988 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007989/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007990 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007991 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007992unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007993{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007994#if defined(MBEDTLS_RSA_C)
7995 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
7996 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007997#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007998#if defined(MBEDTLS_ECDSA_C)
7999 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
8000 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02008001#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008002 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02008003}
8004
Hanno Becker7e5437a2017-04-28 17:15:26 +01008005unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
8006{
8007 switch( type ) {
8008 case MBEDTLS_PK_RSA:
8009 return( MBEDTLS_SSL_SIG_RSA );
8010 case MBEDTLS_PK_ECDSA:
8011 case MBEDTLS_PK_ECKEY:
8012 return( MBEDTLS_SSL_SIG_ECDSA );
8013 default:
8014 return( MBEDTLS_SSL_SIG_ANON );
8015 }
8016}
8017
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008018mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008019{
8020 switch( sig )
8021 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008022#if defined(MBEDTLS_RSA_C)
8023 case MBEDTLS_SSL_SIG_RSA:
8024 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008025#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008026#if defined(MBEDTLS_ECDSA_C)
8027 case MBEDTLS_SSL_SIG_ECDSA:
8028 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008029#endif
8030 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008031 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008032 }
8033}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02008034#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008035
Hanno Becker7e5437a2017-04-28 17:15:26 +01008036#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
8037 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8038
8039/* Find an entry in a signature-hash set matching a given hash algorithm. */
8040mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
8041 mbedtls_pk_type_t sig_alg )
8042{
8043 switch( sig_alg )
8044 {
8045 case MBEDTLS_PK_RSA:
8046 return( set->rsa );
8047 case MBEDTLS_PK_ECDSA:
8048 return( set->ecdsa );
8049 default:
8050 return( MBEDTLS_MD_NONE );
8051 }
8052}
8053
8054/* Add a signature-hash-pair to a signature-hash set */
8055void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
8056 mbedtls_pk_type_t sig_alg,
8057 mbedtls_md_type_t md_alg )
8058{
8059 switch( sig_alg )
8060 {
8061 case MBEDTLS_PK_RSA:
8062 if( set->rsa == MBEDTLS_MD_NONE )
8063 set->rsa = md_alg;
8064 break;
8065
8066 case MBEDTLS_PK_ECDSA:
8067 if( set->ecdsa == MBEDTLS_MD_NONE )
8068 set->ecdsa = md_alg;
8069 break;
8070
8071 default:
8072 break;
8073 }
8074}
8075
8076/* Allow exactly one hash algorithm for each signature. */
8077void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
8078 mbedtls_md_type_t md_alg )
8079{
8080 set->rsa = md_alg;
8081 set->ecdsa = md_alg;
8082}
8083
8084#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
8085 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
8086
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02008087/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02008088 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02008089 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008090mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008091{
8092 switch( hash )
8093 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008094#if defined(MBEDTLS_MD5_C)
8095 case MBEDTLS_SSL_HASH_MD5:
8096 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008097#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008098#if defined(MBEDTLS_SHA1_C)
8099 case MBEDTLS_SSL_HASH_SHA1:
8100 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008101#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008102#if defined(MBEDTLS_SHA256_C)
8103 case MBEDTLS_SSL_HASH_SHA224:
8104 return( MBEDTLS_MD_SHA224 );
8105 case MBEDTLS_SSL_HASH_SHA256:
8106 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008107#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008108#if defined(MBEDTLS_SHA512_C)
8109 case MBEDTLS_SSL_HASH_SHA384:
8110 return( MBEDTLS_MD_SHA384 );
8111 case MBEDTLS_SSL_HASH_SHA512:
8112 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008113#endif
8114 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008115 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02008116 }
8117}
8118
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02008119/*
8120 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
8121 */
8122unsigned char mbedtls_ssl_hash_from_md_alg( int md )
8123{
8124 switch( md )
8125 {
8126#if defined(MBEDTLS_MD5_C)
8127 case MBEDTLS_MD_MD5:
8128 return( MBEDTLS_SSL_HASH_MD5 );
8129#endif
8130#if defined(MBEDTLS_SHA1_C)
8131 case MBEDTLS_MD_SHA1:
8132 return( MBEDTLS_SSL_HASH_SHA1 );
8133#endif
8134#if defined(MBEDTLS_SHA256_C)
8135 case MBEDTLS_MD_SHA224:
8136 return( MBEDTLS_SSL_HASH_SHA224 );
8137 case MBEDTLS_MD_SHA256:
8138 return( MBEDTLS_SSL_HASH_SHA256 );
8139#endif
8140#if defined(MBEDTLS_SHA512_C)
8141 case MBEDTLS_MD_SHA384:
8142 return( MBEDTLS_SSL_HASH_SHA384 );
8143 case MBEDTLS_MD_SHA512:
8144 return( MBEDTLS_SSL_HASH_SHA512 );
8145#endif
8146 default:
8147 return( MBEDTLS_SSL_HASH_NONE );
8148 }
8149}
8150
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02008151#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01008152/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02008153 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02008154 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01008155 */
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02008156int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01008157{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008158 const mbedtls_ecp_group_id *gid;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01008159
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02008160 if( ssl->conf->curve_list == NULL )
8161 return( -1 );
8162
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008163 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01008164 if( *gid == grp_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02008165 return( 0 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01008166
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02008167 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01008168}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02008169#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008170
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02008171#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02008172/*
8173 * Check if a hash proposed by the peer is in our list.
8174 * Return 0 if we're willing to use it, -1 otherwise.
8175 */
8176int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
8177 mbedtls_md_type_t md )
8178{
8179 const int *cur;
8180
8181 if( ssl->conf->sig_hashes == NULL )
8182 return( -1 );
8183
8184 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
8185 if( *cur == (int) md )
8186 return( 0 );
8187
8188 return( -1 );
8189}
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02008190#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02008191
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008192#if defined(MBEDTLS_X509_CRT_PARSE_C)
8193int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
8194 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01008195 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02008196 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008197{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01008198 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008199#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008200 int usage = 0;
8201#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008202#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02008203 const char *ext_oid;
8204 size_t ext_len;
8205#endif
8206
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008207#if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
8208 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02008209 ((void) cert);
8210 ((void) cert_endpoint);
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01008211 ((void) flags);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02008212#endif
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008214#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
8215 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008216 {
8217 /* Server part of the key exchange */
8218 switch( ciphersuite->key_exchange )
8219 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008220 case MBEDTLS_KEY_EXCHANGE_RSA:
8221 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01008222 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008223 break;
8224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008225 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
8226 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
8227 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
8228 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008229 break;
8230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008231 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
8232 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01008233 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008234 break;
8235
8236 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008237 case MBEDTLS_KEY_EXCHANGE_NONE:
8238 case MBEDTLS_KEY_EXCHANGE_PSK:
8239 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
8240 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02008241 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008242 usage = 0;
8243 }
8244 }
8245 else
8246 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008247 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
8248 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008249 }
8250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008251 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01008252 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01008253 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01008254 ret = -1;
8255 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02008256#else
8257 ((void) ciphersuite);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008258#endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008259
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008260#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
8261 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02008262 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008263 ext_oid = MBEDTLS_OID_SERVER_AUTH;
8264 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02008265 }
8266 else
8267 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008268 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
8269 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02008270 }
8271
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008272 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01008273 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01008274 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01008275 ret = -1;
8276 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008277#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02008278
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01008279 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02008280}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008281#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02008282
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008283/*
8284 * Convert version numbers to/from wire format
8285 * and, for DTLS, to/from TLS equivalent.
8286 *
8287 * For TLS this is the identity.
Brian J Murray1903fb32016-11-06 04:45:15 -08008288 * For DTLS, use 1's complement (v -> 255 - v, and then map as follows:
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008289 * 1.0 <-> 3.2 (DTLS 1.0 is based on TLS 1.1)
8290 * 1.x <-> 3.x+1 for x != 0 (DTLS 1.2 based on TLS 1.2)
8291 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008292void mbedtls_ssl_write_version( int major, int minor, int transport,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008293 unsigned char ver[2] )
8294{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008295#if defined(MBEDTLS_SSL_PROTO_DTLS)
8296 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008297 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008298 if( minor == MBEDTLS_SSL_MINOR_VERSION_2 )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008299 --minor; /* DTLS 1.0 stored as TLS 1.1 internally */
8300
8301 ver[0] = (unsigned char)( 255 - ( major - 2 ) );
8302 ver[1] = (unsigned char)( 255 - ( minor - 1 ) );
8303 }
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01008304 else
8305#else
8306 ((void) transport);
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008307#endif
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01008308 {
8309 ver[0] = (unsigned char) major;
8310 ver[1] = (unsigned char) minor;
8311 }
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008312}
8313
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008314void mbedtls_ssl_read_version( int *major, int *minor, int transport,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008315 const unsigned char ver[2] )
8316{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008317#if defined(MBEDTLS_SSL_PROTO_DTLS)
8318 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008319 {
8320 *major = 255 - ver[0] + 2;
8321 *minor = 255 - ver[1] + 1;
8322
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008323 if( *minor == MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008324 ++*minor; /* DTLS 1.0 stored as TLS 1.1 internally */
8325 }
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01008326 else
8327#else
8328 ((void) transport);
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008329#endif
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01008330 {
8331 *major = ver[0];
8332 *minor = ver[1];
8333 }
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01008334}
8335
Simon Butcher99000142016-10-13 17:21:01 +01008336int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
8337{
8338#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8339 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
8340 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
8341
8342 switch( md )
8343 {
8344#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
8345#if defined(MBEDTLS_MD5_C)
8346 case MBEDTLS_SSL_HASH_MD5:
Janos Follath182013f2016-10-25 10:50:22 +01008347 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
Simon Butcher99000142016-10-13 17:21:01 +01008348#endif
8349#if defined(MBEDTLS_SHA1_C)
8350 case MBEDTLS_SSL_HASH_SHA1:
8351 ssl->handshake->calc_verify = ssl_calc_verify_tls;
8352 break;
8353#endif
8354#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
8355#if defined(MBEDTLS_SHA512_C)
8356 case MBEDTLS_SSL_HASH_SHA384:
8357 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
8358 break;
8359#endif
8360#if defined(MBEDTLS_SHA256_C)
8361 case MBEDTLS_SSL_HASH_SHA256:
8362 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
8363 break;
8364#endif
8365 default:
8366 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
8367 }
8368
8369 return 0;
8370#else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
8371 (void) ssl;
8372 (void) md;
8373
8374 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
8375#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8376}
8377
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008378#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8379 defined(MBEDTLS_SSL_PROTO_TLS1_1)
8380int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
8381 unsigned char *output,
8382 unsigned char *data, size_t data_len )
8383{
8384 int ret = 0;
8385 mbedtls_md5_context mbedtls_md5;
8386 mbedtls_sha1_context mbedtls_sha1;
8387
8388 mbedtls_md5_init( &mbedtls_md5 );
8389 mbedtls_sha1_init( &mbedtls_sha1 );
8390
8391 /*
8392 * digitally-signed struct {
8393 * opaque md5_hash[16];
8394 * opaque sha_hash[20];
8395 * };
8396 *
8397 * md5_hash
8398 * MD5(ClientHello.random + ServerHello.random
8399 * + ServerParams);
8400 * sha_hash
8401 * SHA(ClientHello.random + ServerHello.random
8402 * + ServerParams);
8403 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008404 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008405 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008406 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008407 goto exit;
8408 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008409 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008410 ssl->handshake->randbytes, 64 ) ) != 0 )
8411 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008412 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008413 goto exit;
8414 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008415 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008416 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008417 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008418 goto exit;
8419 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008420 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008421 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008422 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008423 goto exit;
8424 }
8425
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008426 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008427 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008428 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008429 goto exit;
8430 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008431 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008432 ssl->handshake->randbytes, 64 ) ) != 0 )
8433 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008434 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008435 goto exit;
8436 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008437 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008438 data_len ) ) != 0 )
8439 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008440 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008441 goto exit;
8442 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008443 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008444 output + 16 ) ) != 0 )
8445 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008446 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01008447 goto exit;
8448 }
8449
8450exit:
8451 mbedtls_md5_free( &mbedtls_md5 );
8452 mbedtls_sha1_free( &mbedtls_sha1 );
8453
8454 if( ret != 0 )
8455 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8456 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
8457
8458 return( ret );
8459
8460}
8461#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
8462 MBEDTLS_SSL_PROTO_TLS1_1 */
8463
8464#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
8465 defined(MBEDTLS_SSL_PROTO_TLS1_2)
8466int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
8467 unsigned char *output,
8468 unsigned char *data, size_t data_len,
8469 mbedtls_md_type_t md_alg )
8470{
8471 int ret = 0;
8472 mbedtls_md_context_t ctx;
8473 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
8474
8475 mbedtls_md_init( &ctx );
8476
8477 /*
8478 * digitally-signed struct {
8479 * opaque client_random[32];
8480 * opaque server_random[32];
8481 * ServerDHParams params;
8482 * };
8483 */
8484 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
8485 {
8486 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
8487 goto exit;
8488 }
8489 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
8490 {
8491 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
8492 goto exit;
8493 }
8494 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
8495 {
8496 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
8497 goto exit;
8498 }
8499 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
8500 {
8501 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
8502 goto exit;
8503 }
8504 if( ( ret = mbedtls_md_finish( &ctx, output ) ) != 0 )
8505 {
8506 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
8507 goto exit;
8508 }
8509
8510exit:
8511 mbedtls_md_free( &ctx );
8512
8513 if( ret != 0 )
8514 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8515 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
8516
8517 return( ret );
8518}
8519#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
8520 MBEDTLS_SSL_PROTO_TLS1_2 */
8521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008522#endif /* MBEDTLS_SSL_TLS_C */