blob: 046caeccb63e70cea3f86090c7eb800e4e6ec6f5 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
SimonBd5800b72016-04-26 07:43:27 +010028#if defined(MBEDTLS_PLATFORM_C)
29#include "mbedtls/platform.h"
30#else
31#include <stdlib.h>
32#define mbedtls_calloc calloc
33#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010034#endif
35
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/ssl.h"
Chris Jones84a773f2021-03-05 18:38:47 +000037#include "ssl_misc.h"
Janos Follath73c616b2019-12-18 15:07:04 +000038#include "mbedtls/debug.h"
39#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050040#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010041#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020042#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020043
Rich Evans00ab4702015-02-06 13:43:58 +000044#include <string.h>
45
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050046#if defined(MBEDTLS_USE_PSA_CRYPTO)
47#include "mbedtls/psa_util.h"
48#include "psa/crypto.h"
49#endif
50
Janos Follath23bdca02016-10-07 14:47:14 +010051#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000052#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020053#endif
54
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020055#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010056
Hanno Beckera0e20d02019-05-15 14:03:01 +010057#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010058/* Top-level Connection ID API */
59
Hanno Becker8367ccc2019-05-14 11:30:10 +010060int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
61 size_t len,
62 int ignore_other_cid )
Hanno Beckerad4a1372019-05-03 13:06:44 +010063{
64 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
65 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
66
Hanno Becker611ac772019-05-14 11:45:26 +010067 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
68 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
69 {
70 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
71 }
72
73 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010074 conf->cid_len = len;
75 return( 0 );
76}
77
Hanno Beckerf8542cf2019-04-09 15:22:03 +010078int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
79 int enable,
80 unsigned char const *own_cid,
81 size_t own_cid_len )
82{
Hanno Becker76a79ab2019-05-03 14:38:32 +010083 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
84 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
85
Hanno Beckerca092242019-04-25 16:01:49 +010086 ssl->negotiate_cid = enable;
87 if( enable == MBEDTLS_SSL_CID_DISABLED )
88 {
89 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
90 return( 0 );
91 }
92 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckerad4a1372019-05-03 13:06:44 +010093 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Beckerca092242019-04-25 16:01:49 +010094
Hanno Beckerad4a1372019-05-03 13:06:44 +010095 if( own_cid_len != ssl->conf->cid_len )
Hanno Beckerca092242019-04-25 16:01:49 +010096 {
Hanno Beckerad4a1372019-05-03 13:06:44 +010097 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
98 (unsigned) own_cid_len,
99 (unsigned) ssl->conf->cid_len ) );
Hanno Beckerca092242019-04-25 16:01:49 +0100100 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
101 }
102
103 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100104 /* Truncation is not an issue here because
105 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
106 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100107
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100108 return( 0 );
109}
110
111int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
112 int *enabled,
113 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
114 size_t *peer_cid_len )
115{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100116 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100117
Hanno Becker76a79ab2019-05-03 14:38:32 +0100118 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
119 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
120 {
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100121 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker76a79ab2019-05-03 14:38:32 +0100122 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100123
Hanno Beckerc5f24222019-05-03 12:54:52 +0100124 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
125 * were used, but client and server requested the empty CID.
126 * This is indistinguishable from not using the CID extension
127 * in the first place. */
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100128 if( ssl->transform_in->in_cid_len == 0 &&
129 ssl->transform_in->out_cid_len == 0 )
130 {
131 return( 0 );
132 }
133
Hanno Becker615ef172019-05-22 16:50:35 +0100134 if( peer_cid_len != NULL )
135 {
136 *peer_cid_len = ssl->transform_in->out_cid_len;
137 if( peer_cid != NULL )
138 {
139 memcpy( peer_cid, ssl->transform_in->out_cid,
140 ssl->transform_in->out_cid_len );
141 }
142 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100143
144 *enabled = MBEDTLS_SSL_CID_ENABLED;
145
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100146 return( 0 );
147}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100148#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100149
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200150#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200152#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200153/*
154 * Convert max_fragment_length codes to length.
155 * RFC 6066 says:
156 * enum{
157 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
158 * } MaxFragmentLength;
159 * and we add 0 -> extension unused
160 */
Angus Grattond8213d02016-05-25 20:56:48 +1000161static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200162{
Angus Grattond8213d02016-05-25 20:56:48 +1000163 switch( mfl )
164 {
165 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
166 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
167 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
168 return 512;
169 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
170 return 1024;
171 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
172 return 2048;
173 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
174 return 4096;
175 default:
176 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
177 }
178}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200179#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200180
Hanno Becker52055ae2019-02-06 14:30:46 +0000181int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
182 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200183{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184 mbedtls_ssl_session_free( dst );
185 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200186
吴敬辉0b716112021-11-29 10:46:35 +0800187#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
188 dst->ticket = NULL;
189#endif
190
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200191#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000192
193#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200194 if( src->peer_cert != NULL )
195 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000196 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200197
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200198 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200199 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200200 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200205 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200206 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200207 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200208 dst->peer_cert = NULL;
209 return( ret );
210 }
211 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000212#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker9198ad12019-02-05 17:00:50 +0000213 if( src->peer_cert_digest != NULL )
214 {
Hanno Becker9198ad12019-02-05 17:00:50 +0000215 dst->peer_cert_digest =
Hanno Beckeraccc5992019-02-25 10:06:59 +0000216 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9198ad12019-02-05 17:00:50 +0000217 if( dst->peer_cert_digest == NULL )
218 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
219
220 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
221 src->peer_cert_digest_len );
222 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000223 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000224 }
225#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200228
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200229#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200230 if( src->ticket != NULL )
231 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200232 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200233 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200234 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200235
236 memcpy( dst->ticket, src->ticket, src->ticket_len );
237 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200238#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200239
240 return( 0 );
241}
242
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500243#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
244static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
245{
246 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
247 if( resized_buffer == NULL )
248 return -1;
249
250 /* We want to copy len_new bytes when downsizing the buffer, and
251 * len_old bytes when upsizing, so we choose the smaller of two sizes,
252 * to fit one buffer into another. Size checks, ensuring that no data is
253 * lost, are done outside of this function. */
254 memcpy( resized_buffer, *buffer,
255 ( len_new < *len_old ) ? len_new : *len_old );
256 mbedtls_platform_zeroize( *buffer, *len_old );
257 mbedtls_free( *buffer );
258
259 *buffer = resized_buffer;
260 *len_old = len_new;
261
262 return 0;
263}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200264
265static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
Andrzej Kurek069fa962021-01-07 08:02:15 -0500266 size_t in_buf_new_len,
267 size_t out_buf_new_len )
Andrzej Kurek4a063792020-10-21 15:08:44 +0200268{
269 int modified = 0;
270 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
271 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
272 if( ssl->in_buf != NULL )
273 {
274 written_in = ssl->in_msg - ssl->in_buf;
275 iv_offset_in = ssl->in_iv - ssl->in_buf;
276 len_offset_in = ssl->in_len - ssl->in_buf;
277 if( downsizing ?
278 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
279 ssl->in_buf_len < in_buf_new_len )
280 {
281 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
282 {
283 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
284 }
285 else
286 {
Paul Elliottb7449902021-03-10 18:14:58 +0000287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
288 in_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200289 modified = 1;
290 }
291 }
292 }
293
294 if( ssl->out_buf != NULL )
295 {
296 written_out = ssl->out_msg - ssl->out_buf;
297 iv_offset_out = ssl->out_iv - ssl->out_buf;
298 len_offset_out = ssl->out_len - ssl->out_buf;
299 if( downsizing ?
300 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
301 ssl->out_buf_len < out_buf_new_len )
302 {
303 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
304 {
305 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
306 }
307 else
308 {
Paul Elliottb7449902021-03-10 18:14:58 +0000309 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
310 out_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200311 modified = 1;
312 }
313 }
314 }
315 if( modified )
316 {
317 /* Update pointers here to avoid doing it twice. */
318 mbedtls_ssl_reset_in_out_pointers( ssl );
319 /* Fields below might not be properly updated with record
320 * splitting or with CID, so they are manually updated here. */
321 ssl->out_msg = ssl->out_buf + written_out;
322 ssl->out_len = ssl->out_buf + len_offset_out;
323 ssl->out_iv = ssl->out_buf + iv_offset_out;
324
325 ssl->in_msg = ssl->in_buf + written_in;
326 ssl->in_len = ssl->in_buf + len_offset_in;
327 ssl->in_iv = ssl->in_buf + iv_offset_in;
328 }
329}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500330#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
331
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200332#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurekc929a822019-01-14 03:51:11 -0500333#if defined(MBEDTLS_USE_PSA_CRYPTO)
k-stachowiak81053a52019-08-17 10:30:28 +0200334
335static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
Ronald Croncf56a0a2020-08-04 09:51:30 +0200336 psa_key_id_t key,
k-stachowiak81053a52019-08-17 10:30:28 +0200337 psa_algorithm_t alg,
338 const unsigned char* seed, size_t seed_length,
339 const unsigned char* label, size_t label_length,
340 size_t capacity )
341{
342 psa_status_t status;
343
344 status = psa_key_derivation_setup( derivation, alg );
345 if( status != PSA_SUCCESS )
346 return( status );
347
348 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
349 {
350 status = psa_key_derivation_input_bytes( derivation,
351 PSA_KEY_DERIVATION_INPUT_SEED,
352 seed, seed_length );
353 if( status != PSA_SUCCESS )
354 return( status );
355
Ronald Croncf56a0a2020-08-04 09:51:30 +0200356 if( mbedtls_svc_key_id_is_null( key ) )
Gilles Peskine311f54d2019-09-23 18:19:22 +0200357 {
358 status = psa_key_derivation_input_bytes(
359 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
360 NULL, 0 );
361 }
362 else
363 {
364 status = psa_key_derivation_input_key(
Ronald Croncf56a0a2020-08-04 09:51:30 +0200365 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
Gilles Peskine311f54d2019-09-23 18:19:22 +0200366 }
k-stachowiak81053a52019-08-17 10:30:28 +0200367 if( status != PSA_SUCCESS )
368 return( status );
369
370 status = psa_key_derivation_input_bytes( derivation,
371 PSA_KEY_DERIVATION_INPUT_LABEL,
372 label, label_length );
373 if( status != PSA_SUCCESS )
374 return( status );
375 }
376 else
377 {
378 return( PSA_ERROR_NOT_SUPPORTED );
379 }
380
381 status = psa_key_derivation_set_capacity( derivation, capacity );
382 if( status != PSA_SUCCESS )
383 return( status );
384
385 return( PSA_SUCCESS );
386}
387
Andrzej Kurekc929a822019-01-14 03:51:11 -0500388static int tls_prf_generic( mbedtls_md_type_t md_type,
389 const unsigned char *secret, size_t slen,
390 const char *label,
391 const unsigned char *random, size_t rlen,
392 unsigned char *dstbuf, size_t dlen )
393{
394 psa_status_t status;
395 psa_algorithm_t alg;
Ronald Croncf56a0a2020-08-04 09:51:30 +0200396 psa_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
Janos Follathda6ac012019-08-16 13:47:29 +0100397 psa_key_derivation_operation_t derivation =
Janos Follath8dee8772019-07-30 12:53:32 +0100398 PSA_KEY_DERIVATION_OPERATION_INIT;
Andrzej Kurekc929a822019-01-14 03:51:11 -0500399
Andrzej Kurekc929a822019-01-14 03:51:11 -0500400 if( md_type == MBEDTLS_MD_SHA384 )
401 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
402 else
403 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
404
Gilles Peskine311f54d2019-09-23 18:19:22 +0200405 /* Normally a "secret" should be long enough to be impossible to
406 * find by brute force, and in particular should not be empty. But
407 * this PRF is also used to derive an IV, in particular in EAP-TLS,
408 * and for this use case it makes sense to have a 0-length "secret".
409 * Since the key API doesn't allow importing a key of length 0,
Ronald Croncf56a0a2020-08-04 09:51:30 +0200410 * keep master_key=0, which setup_psa_key_derivation() understands
Gilles Peskine311f54d2019-09-23 18:19:22 +0200411 * to mean a 0-length "secret" input. */
412 if( slen != 0 )
413 {
414 psa_key_attributes_t key_attributes = psa_key_attributes_init();
415 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
416 psa_set_key_algorithm( &key_attributes, alg );
417 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500418
Ronald Croncf56a0a2020-08-04 09:51:30 +0200419 status = psa_import_key( &key_attributes, secret, slen, &master_key );
Gilles Peskine311f54d2019-09-23 18:19:22 +0200420 if( status != PSA_SUCCESS )
421 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
422 }
Andrzej Kurekc929a822019-01-14 03:51:11 -0500423
k-stachowiak81053a52019-08-17 10:30:28 +0200424 status = setup_psa_key_derivation( &derivation,
Ronald Croncf56a0a2020-08-04 09:51:30 +0200425 master_key, alg,
k-stachowiak81053a52019-08-17 10:30:28 +0200426 random, rlen,
427 (unsigned char const *) label,
428 (size_t) strlen( label ),
429 dlen );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500430 if( status != PSA_SUCCESS )
431 {
Janos Follathda6ac012019-08-16 13:47:29 +0100432 psa_key_derivation_abort( &derivation );
Ronald Croncf56a0a2020-08-04 09:51:30 +0200433 psa_destroy_key( master_key );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500434 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
435 }
436
Janos Follathda6ac012019-08-16 13:47:29 +0100437 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500438 if( status != PSA_SUCCESS )
439 {
Janos Follathda6ac012019-08-16 13:47:29 +0100440 psa_key_derivation_abort( &derivation );
Ronald Croncf56a0a2020-08-04 09:51:30 +0200441 psa_destroy_key( master_key );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500442 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
443 }
444
Janos Follathda6ac012019-08-16 13:47:29 +0100445 status = psa_key_derivation_abort( &derivation );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500446 if( status != PSA_SUCCESS )
Andrzej Kurek70737ca2019-01-14 05:37:13 -0500447 {
Ronald Croncf56a0a2020-08-04 09:51:30 +0200448 psa_destroy_key( master_key );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500449 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Andrzej Kurek70737ca2019-01-14 05:37:13 -0500450 }
Andrzej Kurekc929a822019-01-14 03:51:11 -0500451
Ronald Croncf56a0a2020-08-04 09:51:30 +0200452 if( ! mbedtls_svc_key_id_is_null( master_key ) )
453 status = psa_destroy_key( master_key );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500454 if( status != PSA_SUCCESS )
455 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
456
Andrzej Kurek33171262019-01-15 03:25:18 -0500457 return( 0 );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500458}
459
460#else /* MBEDTLS_USE_PSA_CRYPTO */
461
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200462static int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100463 const unsigned char *secret, size_t slen,
464 const char *label,
465 const unsigned char *random, size_t rlen,
466 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000467{
468 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100469 size_t i, j, k, md_len;
Ron Eldor3b350852019-05-07 18:31:49 +0300470 unsigned char *tmp;
471 size_t tmp_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200472 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
473 const mbedtls_md_info_t *md_info;
474 mbedtls_md_context_t md_ctx;
Janos Follath865b3eb2019-12-16 11:46:15 +0000475 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100476
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200477 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000478
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200479 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
480 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100481
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200482 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100483
Ron Eldor3b350852019-05-07 18:31:49 +0300484 tmp_len = md_len + strlen( label ) + rlen;
485 tmp = mbedtls_calloc( 1, tmp_len );
486 if( tmp == NULL )
487 {
488 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
489 goto exit;
490 }
Paul Bakker1ef83d62012-04-11 12:09:53 +0000491
492 nb = strlen( label );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100493 memcpy( tmp + md_len, label, nb );
494 memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000495 nb += rlen;
496
497 /*
498 * Compute P_<hash>(secret, label + random)[0..dlen]
499 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200500 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Ron Eldor3b350852019-05-07 18:31:49 +0300501 goto exit;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200503 mbedtls_md_hmac_starts( &md_ctx, secret, slen );
504 mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
505 mbedtls_md_hmac_finish( &md_ctx, tmp );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100506
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100507 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000508 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200509 mbedtls_md_hmac_reset ( &md_ctx );
510 mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
511 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100512
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200513 mbedtls_md_hmac_reset ( &md_ctx );
514 mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
515 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000516
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100517 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000518
519 for( j = 0; j < k; j++ )
520 dstbuf[i + j] = h_i[j];
521 }
522
Ron Eldor3b350852019-05-07 18:31:49 +0300523exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200524 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100525
Ron Eldor3b350852019-05-07 18:31:49 +0300526 mbedtls_platform_zeroize( tmp, tmp_len );
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500527 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000528
Ron Eldor3b350852019-05-07 18:31:49 +0300529 mbedtls_free( tmp );
530
531 return( ret );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000532}
Andrzej Kurekc929a822019-01-14 03:51:11 -0500533#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200534#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100535static int tls_prf_sha256( const unsigned char *secret, size_t slen,
536 const char *label,
537 const unsigned char *random, size_t rlen,
538 unsigned char *dstbuf, size_t dlen )
539{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200540 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100541 label, random, rlen, dstbuf, dlen ) );
542}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200543#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000544
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200545#if defined(MBEDTLS_SHA384_C)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200546static int tls_prf_sha384( const unsigned char *secret, size_t slen,
547 const char *label,
548 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000549 unsigned char *dstbuf, size_t dlen )
550{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200551 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100552 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +0000553}
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200554#endif /* MBEDTLS_SHA384_C */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200555#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +0000556
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200557static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200558
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200559#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
560#if defined(MBEDTLS_SHA256_C)
561static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
Rodrigo Dias Correa2c424572020-11-10 01:38:00 -0300562static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200563static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200564#endif
Paul Bakker769075d2012-11-24 11:26:46 +0100565
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200566#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200567static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
Rodrigo Dias Correa2c424572020-11-10 01:38:00 -0300568static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200569static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakker769075d2012-11-24 11:26:46 +0100570#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200571#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000572
Manuel Pégourié-Gonnard45be3d82019-02-18 23:35:14 +0100573#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \
Hanno Becker7d0a5692018-10-23 15:26:22 +0100574 defined(MBEDTLS_USE_PSA_CRYPTO)
575static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
576{
577 if( ssl->conf->f_psk != NULL )
578 {
579 /* If we've used a callback to select the PSK,
580 * the static configuration is irrelevant. */
Ronald Croncf56a0a2020-08-04 09:51:30 +0200581 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Becker7d0a5692018-10-23 15:26:22 +0100582 return( 1 );
583
584 return( 0 );
585 }
586
Ronald Croncf56a0a2020-08-04 09:51:30 +0200587 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
Hanno Becker7d0a5692018-10-23 15:26:22 +0100588 return( 1 );
589
590 return( 0 );
591}
592#endif /* MBEDTLS_USE_PSA_CRYPTO &&
Manuel Pégourié-Gonnard45be3d82019-02-18 23:35:14 +0100593 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
Hanno Becker7d0a5692018-10-23 15:26:22 +0100594
Ron Eldorcf280092019-05-14 20:19:13 +0300595static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
596{
Ron Eldorcf280092019-05-14 20:19:13 +0300597#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200598#if defined(MBEDTLS_SHA384_C)
Ron Eldorcf280092019-05-14 20:19:13 +0300599 if( tls_prf == tls_prf_sha384 )
600 {
601 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
602 }
603 else
604#endif
605#if defined(MBEDTLS_SHA256_C)
606 if( tls_prf == tls_prf_sha256 )
607 {
608 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
609 }
610 else
611#endif
612#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
613 return( MBEDTLS_SSL_TLS_PRF_NONE );
614}
Ron Eldorcf280092019-05-14 20:19:13 +0300615
Ron Eldor51d3ab52019-05-12 14:54:30 +0300616int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
617 const unsigned char *secret, size_t slen,
618 const char *label,
619 const unsigned char *random, size_t rlen,
620 unsigned char *dstbuf, size_t dlen )
621{
622 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
623
624 switch( prf )
625 {
Ron Eldord2f25f72019-05-15 14:54:22 +0300626#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200627#if defined(MBEDTLS_SHA384_C)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300628 case MBEDTLS_SSL_TLS_PRF_SHA384:
629 tls_prf = tls_prf_sha384;
630 break;
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200631#endif /* MBEDTLS_SHA384_C */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300632#if defined(MBEDTLS_SHA256_C)
633 case MBEDTLS_SSL_TLS_PRF_SHA256:
634 tls_prf = tls_prf_sha256;
635 break;
Ron Eldord2f25f72019-05-15 14:54:22 +0300636#endif /* MBEDTLS_SHA256_C */
637#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300638 default:
639 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
640 }
641
642 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
643}
644
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200645/* Type for the TLS PRF */
646typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
647 const unsigned char *, size_t,
648 unsigned char *, size_t);
649
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +0200650/*
Manuel Pégourié-Gonnardcba40d92019-05-06 12:55:40 +0200651 * Populate a transform structure with session keys and all the other
652 * necessary information.
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +0200653 *
Manuel Pégourié-Gonnardcba40d92019-05-06 12:55:40 +0200654 * Parameters:
655 * - [in/out]: transform: structure to populate
656 * [in] must be just initialised with mbedtls_ssl_transform_init()
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200657 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200658 * - [in] ciphersuite
659 * - [in] master
660 * - [in] encrypt_then_mac
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200661 * - [in] compression
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200662 * - [in] tls_prf: pointer to PRF to use for key derivation
663 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200664 * - [in] minor_ver: SSL/TLS minor version
665 * - [in] endpoint: client or server
Andrzej Kurek5902cd62021-09-28 10:00:32 -0400666 * - [in] ssl: used for:
667 * - ssl->conf->{f,p}_export_keys
668 * [in] optionally used for:
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200669 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +0200670 */
Hanno Beckerbd257552021-03-22 06:59:27 +0000671static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200672 int ciphersuite,
673 const unsigned char master[48],
Hanno Beckerbd257552021-03-22 06:59:27 +0000674#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
675 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200676 int encrypt_then_mac,
Hanno Beckerbd257552021-03-22 06:59:27 +0000677#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
678 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200679 ssl_tls_prf_t tls_prf,
680 const unsigned char randbytes[64],
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200681 int minor_ver,
682 unsigned endpoint,
Mateusz Starzyke204dbf2021-03-15 17:57:20 +0100683 const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +0000684{
Paul Bakkerda02a7f2013-08-31 17:25:14 +0200685 int ret = 0;
Hanno Beckercb1cc802018-11-17 22:27:38 +0000686#if defined(MBEDTLS_USE_PSA_CRYPTO)
687 int psa_fallthrough;
688#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker5121ce52009-01-03 21:22:43 +0000689 unsigned char keyblk[256];
690 unsigned char *key1;
691 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +0100692 unsigned char *mac_enc;
693 unsigned char *mac_dec;
sander-visser3888b032020-05-06 21:49:46 +0200694 size_t mac_key_len = 0;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200695 size_t iv_copy_len;
Gilles Peskine88d681c2021-09-01 11:19:33 +0200696 size_t keylen;
Hanno Beckere694c3e2017-12-27 21:34:08 +0000697 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200698 const mbedtls_cipher_info_t *cipher_info;
699 const mbedtls_md_info_t *md_info;
Paul Bakker68884e32013-01-07 18:20:04 +0100700
Andrzej Kurek324f72e2021-09-29 04:21:21 -0400701#if !defined(MBEDTLS_DEBUG_C) && \
702 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Andrzej Kureka72fe642021-09-29 15:57:30 -0400703 if( ssl->f_export_keys == NULL )
704 {
705 ssl = NULL; /* make sure we don't use it except for these cases */
706 (void) ssl;
707 }
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200708#endif
709
Manuel Pégourié-Gonnard96fb0ee2019-07-09 12:54:17 +0200710 /*
711 * Some data just needs copying into the structure
712 */
Jaeden Amero2de07f12019-06-05 13:32:08 +0100713#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000714 defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200715 transform->encrypt_then_mac = encrypt_then_mac;
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000716#endif
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200717 transform->minor_ver = minor_ver;
Hanno Beckere694c3e2017-12-27 21:34:08 +0000718
Manuel Pégourié-Gonnard96fb0ee2019-07-09 12:54:17 +0200719#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
720 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
721#endif
722
Hanno Beckerc0da10d2021-04-21 05:32:23 +0100723#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
724 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
725 {
726 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
727 * generation separate. This should never happen. */
728 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
729 }
730#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
731
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200732 /*
733 * Get various info structures
734 */
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200735 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200736 if( ciphersuite_info == NULL )
737 {
738 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200739 ciphersuite ) );
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200740 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
741 }
742
Hanno Beckere694c3e2017-12-27 21:34:08 +0000743 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
Paul Bakker68884e32013-01-07 18:20:04 +0100744 if( cipher_info == NULL )
745 {
Paul Elliott9f352112020-12-09 14:55:45 +0000746 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
Hanno Beckere694c3e2017-12-27 21:34:08 +0000747 ciphersuite_info->cipher ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200748 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100749 }
750
Hanno Beckere694c3e2017-12-27 21:34:08 +0000751 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
Paul Bakker68884e32013-01-07 18:20:04 +0100752 if( md_info == NULL )
753 {
Paul Elliott9f352112020-12-09 14:55:45 +0000754 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
Paul Elliott3891caf2020-12-17 18:42:40 +0000755 (unsigned) ciphersuite_info->mac ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200756 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100757 }
758
Hanno Beckera0e20d02019-05-15 14:03:01 +0100759#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker4bf74652019-04-26 16:22:27 +0100760 /* Copy own and peer's CID if the use of the CID
761 * extension has been negotiated. */
762 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
763 {
764 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
Hanno Becker8a7f9722019-04-30 13:52:29 +0100765
Hanno Becker05154c32019-05-03 15:23:51 +0100766 transform->in_cid_len = ssl->own_cid_len;
Hanno Becker05154c32019-05-03 15:23:51 +0100767 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
Hanno Becker1c1f0462019-05-03 12:55:51 +0100768 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
Hanno Becker4bf74652019-04-26 16:22:27 +0100769 transform->in_cid_len );
Hanno Beckerd1f20352019-05-15 10:21:55 +0100770
771 transform->out_cid_len = ssl->handshake->peer_cid_len;
772 memcpy( transform->out_cid, ssl->handshake->peer_cid,
773 ssl->handshake->peer_cid_len );
774 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
775 transform->out_cid_len );
Hanno Becker4bf74652019-04-26 16:22:27 +0100776 }
Hanno Beckera0e20d02019-05-15 14:03:01 +0100777#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker4bf74652019-04-26 16:22:27 +0100778
Paul Bakker5121ce52009-01-03 21:22:43 +0000779 /*
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200780 * Compute key block using the PRF
Paul Bakker5121ce52009-01-03 21:22:43 +0000781 */
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200782 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100783 if( ret != 0 )
784 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200785 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100786 return( ret );
787 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200789 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
Manuel Pégourié-Gonnardd91efa42019-05-20 10:27:20 +0200790 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200791 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200792 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200793 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000794
Paul Bakker5121ce52009-01-03 21:22:43 +0000795 /*
796 * Determine the appropriate key, IV and MAC length.
797 */
Paul Bakker68884e32013-01-07 18:20:04 +0100798
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200799 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200800
Hanno Becker8031d062018-01-03 15:32:31 +0000801#if defined(MBEDTLS_GCM_C) || \
802 defined(MBEDTLS_CCM_C) || \
803 defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200804 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_GCM ||
805 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CCM ||
806 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +0000807 {
Hanno Beckerf704bef2018-11-16 15:21:18 +0000808 size_t explicit_ivlen;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200809
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200810 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +0000811 mac_key_len = 0;
Hanno Beckere694c3e2017-12-27 21:34:08 +0000812 transform->taglen =
813 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200814
Hanno Becker447558d2020-05-28 07:36:33 +0100815 /* All modes haves 96-bit IVs, but the length of the static parts vary
816 * with mode and version:
817 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
818 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
Hanno Beckerf93c2d72020-05-28 07:39:43 +0100819 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
820 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
821 * sequence number).
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200822 */
Paul Bakker68884e32013-01-07 18:20:04 +0100823 transform->ivlen = 12;
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200824 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200825 transform->fixed_ivlen = 12;
826 else
Hanno Beckerc0da10d2021-04-21 05:32:23 +0100827 transform->fixed_ivlen = 4;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200828
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200829 /* Minimum length of encrypted record */
830 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
Hanno Beckere694c3e2017-12-27 21:34:08 +0000831 transform->minlen = explicit_ivlen + transform->taglen;
Paul Bakker68884e32013-01-07 18:20:04 +0100832 }
833 else
Hanno Becker8031d062018-01-03 15:32:31 +0000834#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000835#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200836 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM ||
837 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
Paul Bakker68884e32013-01-07 18:20:04 +0100838 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200839 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200840 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
841 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +0100842 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200843 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Ron Eldore6992702019-05-07 18:27:13 +0300844 goto end;
Paul Bakker68884e32013-01-07 18:20:04 +0100845 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000846
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200847 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +0000848 mac_key_len = mbedtls_md_get_size( md_info );
849 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200850
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200851 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +0100852 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +0000853
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200854 /* Minimum length */
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200855 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200856 transform->minlen = transform->maclen;
857 else
Paul Bakker68884e32013-01-07 18:20:04 +0100858 {
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200859 /*
860 * GenericBlockCipher:
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100861 * 1. if EtM is in use: one block plus MAC
862 * otherwise: * first multiple of blocklen greater than maclen
TRodziewicz2abf03c2021-06-25 14:40:09 +0200863 * 2. IV
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200864 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200865#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200866 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100867 {
868 transform->minlen = transform->maclen
869 + cipher_info->block_size;
870 }
871 else
872#endif
873 {
874 transform->minlen = transform->maclen
875 + cipher_info->block_size
876 - transform->maclen % cipher_info->block_size;
877 }
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200878
TRodziewicz0f82ec62021-05-12 17:49:18 +0200879#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
880 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200881 {
882 transform->minlen += transform->ivlen;
883 }
884 else
885#endif
886 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200887 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Ron Eldore6992702019-05-07 18:27:13 +0300888 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
889 goto end;
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200890 }
Paul Bakker68884e32013-01-07 18:20:04 +0100891 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000892 }
Hanno Becker8031d062018-01-03 15:32:31 +0000893 else
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000894#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Hanno Becker8031d062018-01-03 15:32:31 +0000895 {
896 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
897 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
898 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000899
Hanno Becker88aaf652017-12-27 08:17:40 +0000900 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
901 (unsigned) keylen,
902 (unsigned) transform->minlen,
903 (unsigned) transform->ivlen,
904 (unsigned) transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000905
906 /*
907 * Finally setup the cipher contexts, IVs and MAC secrets.
908 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200909#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200910 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +0000911 {
Hanno Becker81c7b182017-11-09 18:39:33 +0000912 key1 = keyblk + mac_key_len * 2;
Hanno Becker88aaf652017-12-27 08:17:40 +0000913 key2 = keyblk + mac_key_len * 2 + keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +0000914
Paul Bakker68884e32013-01-07 18:20:04 +0100915 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +0000916 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +0000917
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000918 /*
919 * This is not used in TLS v1.1.
920 */
Paul Bakker48916f92012-09-16 19:57:18 +0000921 iv_copy_len = ( transform->fixed_ivlen ) ?
922 transform->fixed_ivlen : transform->ivlen;
Hanno Becker88aaf652017-12-27 08:17:40 +0000923 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
924 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000925 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +0000926 }
927 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200928#endif /* MBEDTLS_SSL_CLI_C */
929#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200930 if( endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +0000931 {
Hanno Becker88aaf652017-12-27 08:17:40 +0000932 key1 = keyblk + mac_key_len * 2 + keylen;
Hanno Becker81c7b182017-11-09 18:39:33 +0000933 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000934
Hanno Becker81c7b182017-11-09 18:39:33 +0000935 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +0100936 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +0000937
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000938 /*
939 * This is not used in TLS v1.1.
940 */
Paul Bakker48916f92012-09-16 19:57:18 +0000941 iv_copy_len = ( transform->fixed_ivlen ) ?
942 transform->fixed_ivlen : transform->ivlen;
Hanno Becker88aaf652017-12-27 08:17:40 +0000943 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
944 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000945 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +0000946 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100947 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200948#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100949 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200950 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Ron Eldore6992702019-05-07 18:27:13 +0300951 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
952 goto end;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100953 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000954
TRodziewicz4ca18aa2021-05-20 14:46:20 +0200955#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
TRodziewicz0f82ec62021-05-12 17:49:18 +0200956#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
TRodziewicz345165c2021-07-06 13:42:11 +0200957 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
958 For AEAD-based ciphersuites, there is nothing to do here. */
959 if( mac_key_len != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +0100960 {
TRodziewicz345165c2021-07-06 13:42:11 +0200961 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
962 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +0100963 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200964#endif
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000965#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Paul Bakker68884e32013-01-07 18:20:04 +0100966
Hanno Beckerd56ed242018-01-03 15:32:51 +0000967 ((void) mac_dec);
968 ((void) mac_enc);
Paul Bakker05ef8352012-05-08 09:17:57 +0000969
Andrzej Kureka72fe642021-09-29 15:57:30 -0400970 if( ssl != NULL && ssl->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +0100971 {
Hanno Becker7e6c1782021-06-08 09:24:55 +0100972 ssl->f_export_keys( ssl->p_export_keys,
973 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
974 master, 48,
975 randbytes + 32,
976 randbytes,
977 tls_prf_get_type( tls_prf ) );
Ron Eldorf5cc10d2019-05-07 18:33:40 +0300978 }
Robert Cragie4feb7ae2015-10-02 13:33:37 +0100979
Hanno Beckerf704bef2018-11-16 15:21:18 +0000980#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +0200981 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_enc,
982 cipher_info, transform->taglen );
983 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
Hanno Beckerf704bef2018-11-16 15:21:18 +0000984 {
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +0200985 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
986 goto end;
987 }
Hanno Beckercb1cc802018-11-17 22:27:38 +0000988
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +0200989 if( ret == 0 )
990 {
991 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based encryption cipher context" ) );
992 psa_fallthrough = 0;
Hanno Beckerf704bef2018-11-16 15:21:18 +0000993 }
Hanno Beckerf704bef2018-11-16 15:21:18 +0000994 else
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +0200995 {
996 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record encryption - fall through to default setup." ) );
Hanno Beckercb1cc802018-11-17 22:27:38 +0000997 psa_fallthrough = 1;
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +0200998 }
Hanno Beckerf704bef2018-11-16 15:21:18 +0000999
Hanno Beckercb1cc802018-11-17 22:27:38 +00001000 if( psa_fallthrough == 1 )
Hanno Beckerf704bef2018-11-16 15:21:18 +00001001#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001002 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001003 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001004 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001005 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Ron Eldore6992702019-05-07 18:27:13 +03001006 goto end;
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001007 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001008
Hanno Beckerf704bef2018-11-16 15:21:18 +00001009#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +02001010 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_dec,
1011 cipher_info, transform->taglen );
1012 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
Hanno Beckerf704bef2018-11-16 15:21:18 +00001013 {
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +02001014 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1015 goto end;
1016 }
Hanno Beckercb1cc802018-11-17 22:27:38 +00001017
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +02001018 if( ret == 0 )
1019 {
1020 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based decryption cipher context" ) );
1021 psa_fallthrough = 0;
Hanno Beckerf704bef2018-11-16 15:21:18 +00001022 }
Hanno Beckerf704bef2018-11-16 15:21:18 +00001023 else
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +02001024 {
1025 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record decryption - fall through to default setup." ) );
Hanno Beckercb1cc802018-11-17 22:27:38 +00001026 psa_fallthrough = 1;
Manuel Pégourié-Gonnarda0b4b0c2021-09-21 14:06:33 +02001027 }
Hanno Beckerf704bef2018-11-16 15:21:18 +00001028
Hanno Beckercb1cc802018-11-17 22:27:38 +00001029 if( psa_fallthrough == 1 )
Hanno Beckerf704bef2018-11-16 15:21:18 +00001030#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001031 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001032 cipher_info ) ) != 0 )
1033 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001034 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Ron Eldore6992702019-05-07 18:27:13 +03001035 goto end;
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001036 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001037
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001038 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Gilles Peskine88d681c2021-09-01 11:19:33 +02001039 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001040 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001041 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001042 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Ron Eldore6992702019-05-07 18:27:13 +03001043 goto end;
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001044 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001045
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001046 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Gilles Peskine88d681c2021-09-01 11:19:33 +02001047 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001048 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001049 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001050 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Ron Eldore6992702019-05-07 18:27:13 +03001051 goto end;
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001052 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001054#if defined(MBEDTLS_CIPHER_MODE_CBC)
Gilles Peskinee720dbe2021-07-19 17:37:46 +02001055 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001056 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001057 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1058 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001059 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001060 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Ron Eldore6992702019-05-07 18:27:13 +03001061 goto end;
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001062 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001063
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001064 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1065 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001066 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Ron Eldore6992702019-05-07 18:27:13 +03001068 goto end;
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001069 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001070 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001071#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001072
Paul Bakker5121ce52009-01-03 21:22:43 +00001073
Ron Eldore6992702019-05-07 18:27:13 +03001074end:
Ron Eldora9f9a732019-05-07 18:29:02 +03001075 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Ron Eldore6992702019-05-07 18:27:13 +03001076 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001077}
1078
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001079/*
TRodziewicz0f82ec62021-05-12 17:49:18 +02001080 * Set appropriate PRF function and other SSL / TLS1.2 functions
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001081 *
1082 * Inputs:
1083 * - SSL/TLS minor version
1084 * - hash associated with the ciphersuite (only used by TLS 1.2)
1085 *
Manuel Pégourié-Gonnard31d3ef12019-05-10 10:25:00 +02001086 * Outputs:
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001087 * - the tls_prf, calc_verify and calc_finished members of handshake structure
1088 */
1089static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
1090 int minor_ver,
1091 mbedtls_md_type_t hash )
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001092{
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02001093#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001094 (void) hash;
1095#endif
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001096
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001097#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02001098#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001099 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1100 hash == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001101 {
1102 handshake->tls_prf = tls_prf_sha384;
1103 handshake->calc_verify = ssl_calc_verify_tls_sha384;
1104 handshake->calc_finished = ssl_calc_finished_tls_sha384;
1105 }
1106 else
1107#endif
1108#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001109 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001110 {
1111 handshake->tls_prf = tls_prf_sha256;
1112 handshake->calc_verify = ssl_calc_verify_tls_sha256;
1113 handshake->calc_finished = ssl_calc_finished_tls_sha256;
1114 }
1115 else
1116#endif
1117#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1118 {
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001119 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1120 }
1121
1122 return( 0 );
1123}
1124
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001125/*
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001126 * Compute master secret if needed
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001127 *
1128 * Parameters:
1129 * [in/out] handshake
1130 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001131 * (PSA-PSK) ciphersuite_info, psk_opaque
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001132 * [out] premaster (cleared)
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001133 * [out] master
1134 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
1135 * debug: conf->f_dbg, conf->p_dbg
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001136 * EMS: passed to calc_verify (debug + session_negotiate)
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001137 * PSA-PSA: minor_ver, conf
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001138 */
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001139static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001140 unsigned char *master,
Manuel Pégourié-Gonnard0d56aaa2019-05-03 09:58:33 +02001141 const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001142{
Janos Follath865b3eb2019-12-16 11:46:15 +00001143 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001144
1145 /* cf. RFC 5246, Section 8.1:
1146 * "The master secret is always exactly 48 bytes in length." */
1147 size_t const master_secret_len = 48;
1148
1149#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1150 unsigned char session_hash[48];
1151#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1152
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001153 /* The label for the KDF used for key expansion.
1154 * This is either "master secret" or "extended master secret"
1155 * depending on whether the Extended Master Secret extension
1156 * is used. */
1157 char const *lbl = "master secret";
1158
1159 /* The salt for the KDF used for key expansion.
1160 * - If the Extended Master Secret extension is not used,
1161 * this is ClientHello.Random + ServerHello.Random
1162 * (see Sect. 8.1 in RFC 5246).
1163 * - If the Extended Master Secret extension is used,
1164 * this is the transcript of the handshake so far.
1165 * (see Sect. 4 in RFC 7627). */
1166 unsigned char const *salt = handshake->randbytes;
1167 size_t salt_len = 64;
1168
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001169#if !defined(MBEDTLS_DEBUG_C) && \
1170 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
1171 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
1172 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
Manuel Pégourié-Gonnarda7505d12019-05-07 10:17:56 +02001173 ssl = NULL; /* make sure we don't use it except for those cases */
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001174 (void) ssl;
1175#endif
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001176
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001177 if( handshake->resume != 0 )
1178 {
1179 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001180 return( 0 );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001181 }
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001182
1183#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001184 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001185 {
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001186 lbl = "extended master secret";
1187 salt = session_hash;
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001188 handshake->calc_verify( ssl, session_hash, &salt_len );
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001189
Manuel Pégourié-Gonnard8faa70e2019-05-20 12:09:50 +02001190 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
1191 session_hash, salt_len );
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001192 }
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001193#endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */
1194
1195#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001196 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1197 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001198 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001199 ssl_use_opaque_psk( ssl ) == 1 )
1200 {
1201 /* Perform PSK-to-MS expansion in a single step. */
1202 psa_status_t status;
1203 psa_algorithm_t alg;
Ronald Croncf56a0a2020-08-04 09:51:30 +02001204 psa_key_id_t psk;
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001205 psa_key_derivation_operation_t derivation =
1206 PSA_KEY_DERIVATION_OPERATION_INIT;
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001207 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001208
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001209 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001210
Guilhem Bryantc5285d82020-03-25 17:08:15 +00001211 psk = mbedtls_ssl_get_opaque_psk( ssl );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001212
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001213 if( hash_alg == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001214 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001215 else
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001216 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
1217
k-stachowiak81053a52019-08-17 10:30:28 +02001218 status = setup_psa_key_derivation( &derivation, psk, alg,
1219 salt, salt_len,
1220 (unsigned char const *) lbl,
1221 (size_t) strlen( lbl ),
1222 master_secret_len );
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001223 if( status != PSA_SUCCESS )
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001224 {
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001225 psa_key_derivation_abort( &derivation );
1226 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001227 }
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001228
1229 status = psa_key_derivation_output_bytes( &derivation,
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001230 master,
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001231 master_secret_len );
1232 if( status != PSA_SUCCESS )
1233 {
1234 psa_key_derivation_abort( &derivation );
1235 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1236 }
1237
1238 status = psa_key_derivation_abort( &derivation );
1239 if( status != PSA_SUCCESS )
1240 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1241 }
1242 else
1243#endif
1244 {
1245 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
1246 lbl, salt, salt_len,
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001247 master,
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001248 master_secret_len );
1249 if( ret != 0 )
1250 {
1251 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
1252 return( ret );
1253 }
1254
1255 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
1256 handshake->premaster,
1257 handshake->pmslen );
1258
1259 mbedtls_platform_zeroize( handshake->premaster,
1260 sizeof(handshake->premaster) );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001261 }
1262
1263 return( 0 );
1264}
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001265
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +02001266int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
1267{
Janos Follath865b3eb2019-12-16 11:46:15 +00001268 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001269 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
1270 ssl->handshake->ciphersuite_info;
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001271
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001272 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
1273
1274 /* Set PRF, calc_verify and calc_finished function pointers */
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001275 ret = ssl_set_handshake_prfs( ssl->handshake,
1276 ssl->minor_ver,
1277 ciphersuite_info->mac );
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001278 if( ret != 0 )
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001279 {
1280 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001281 return( ret );
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001282 }
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001283
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001284 /* Compute master secret if needed */
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001285 ret = ssl_compute_master( ssl->handshake,
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001286 ssl->session_negotiate->master,
1287 ssl );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001288 if( ret != 0 )
1289 {
1290 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
1291 return( ret );
1292 }
1293
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001294 /* Swap the client and server random values:
1295 * - MS derivation wanted client+server (RFC 5246 8.1)
1296 * - key derivation wants server+client (RFC 5246 6.3) */
1297 {
1298 unsigned char tmp[64];
1299 memcpy( tmp, ssl->handshake->randbytes, 64 );
1300 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
1301 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
1302 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
1303 }
1304
1305 /* Populate transform structure */
Hanno Beckerbd257552021-03-22 06:59:27 +00001306 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
1307 ssl->session_negotiate->ciphersuite,
1308 ssl->session_negotiate->master,
1309#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
1310 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1311 ssl->session_negotiate->encrypt_then_mac,
1312#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
1313 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
1314 ssl->handshake->tls_prf,
1315 ssl->handshake->randbytes,
1316 ssl->minor_ver,
1317 ssl->conf->endpoint,
1318 ssl );
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001319 if( ret != 0 )
1320 {
Hanno Beckerbd257552021-03-22 06:59:27 +00001321 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001322 return( ret );
1323 }
1324
1325 /* We no longer need Server/ClientHello.random values */
1326 mbedtls_platform_zeroize( ssl->handshake->randbytes,
1327 sizeof( ssl->handshake->randbytes ) );
1328
1329 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
1330
1331 return( 0 );
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +02001332}
1333
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001334#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1335#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001336void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
Rodrigo Dias Correa2c424572020-11-10 01:38:00 -03001337 unsigned char *hash,
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001338 size_t *hlen )
Paul Bakker380da532012-04-18 16:10:25 +00001339{
Andrzej Kurekeb342242019-01-29 09:14:33 -05001340#if defined(MBEDTLS_USE_PSA_CRYPTO)
1341 size_t hash_size;
1342 psa_status_t status;
1343 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
1344
1345 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
1346 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
1347 if( status != PSA_SUCCESS )
1348 {
1349 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1350 return;
1351 }
1352
1353 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
1354 if( status != PSA_SUCCESS )
1355 {
1356 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1357 return;
1358 }
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001359
1360 *hlen = 32;
1361 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001362 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1363#else
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001364 mbedtls_sha256_context sha256;
Paul Bakker380da532012-04-18 16:10:25 +00001365
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001366 mbedtls_sha256_init( &sha256 );
1367
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001368 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001369
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001370 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +02001371 mbedtls_sha256_finish( &sha256, hash );
Paul Bakker380da532012-04-18 16:10:25 +00001372
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001373 *hlen = 32;
1374
1375 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001376 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001377
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001378 mbedtls_sha256_free( &sha256 );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001379#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker380da532012-04-18 16:10:25 +00001380 return;
1381}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001382#endif /* MBEDTLS_SHA256_C */
Paul Bakker380da532012-04-18 16:10:25 +00001383
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02001384#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001385void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
Rodrigo Dias Correa2c424572020-11-10 01:38:00 -03001386 unsigned char *hash,
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001387 size_t *hlen )
Paul Bakker380da532012-04-18 16:10:25 +00001388{
Andrzej Kurekeb342242019-01-29 09:14:33 -05001389#if defined(MBEDTLS_USE_PSA_CRYPTO)
1390 size_t hash_size;
1391 psa_status_t status;
Andrzej Kurek972fba52019-01-30 03:29:12 -05001392 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
Andrzej Kurekeb342242019-01-29 09:14:33 -05001393
1394 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
Andrzej Kurek972fba52019-01-30 03:29:12 -05001395 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001396 if( status != PSA_SUCCESS )
1397 {
1398 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1399 return;
1400 }
1401
Andrzej Kurek972fba52019-01-30 03:29:12 -05001402 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001403 if( status != PSA_SUCCESS )
1404 {
1405 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1406 return;
1407 }
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001408
1409 *hlen = 48;
1410 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001411 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1412#else
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001413 mbedtls_sha512_context sha512;
Paul Bakker380da532012-04-18 16:10:25 +00001414
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001415 mbedtls_sha512_init( &sha512 );
1416
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001417 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001418
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001419 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
TRodziewicz26371e42021-06-08 16:45:41 +02001420 mbedtls_sha512_finish( &sha512, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001421
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001422 *hlen = 48;
1423
1424 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001425 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001426
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001427 mbedtls_sha512_free( &sha512 );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001428#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker5121ce52009-01-03 21:22:43 +00001429 return;
1430}
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02001431#endif /* MBEDTLS_SHA384_C */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001432#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001433
Gilles Peskineeccd8882020-03-10 12:19:08 +01001434#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001435int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001436{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001437 unsigned char *p = ssl->handshake->premaster;
1438 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Guilhem Bryantb5f04e42020-04-01 11:23:58 +01001439 const unsigned char *psk = NULL;
Guilhem Bryant61b0fe62020-03-27 11:12:12 +00001440 size_t psk_len = 0;
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001441
Guilhem Bryantc5285d82020-03-25 17:08:15 +00001442 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
1443 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001444 {
Guilhem Bryantc5285d82020-03-25 17:08:15 +00001445 /*
1446 * This should never happen because the existence of a PSK is always
1447 * checked before calling this function
1448 */
Guilhem Bryant82194c82020-03-26 17:04:31 +00001449 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Guilhem Bryant0c9b1952020-04-08 11:02:38 +01001450 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001451 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001452
1453 /*
1454 * PMS = struct {
1455 * opaque other_secret<0..2^16-1>;
1456 * opaque psk<0..2^16-1>;
1457 * };
1458 * with "other_secret" depending on the particular key exchange
1459 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001460#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1461 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001462 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001463 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001464 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001465
Joe Subbiania5cb0d22021-08-23 11:35:25 +01001466 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
1467 p += 2;
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001468
1469 if( end < p || (size_t)( end - p ) < psk_len )
1470 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1471
1472 memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001473 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001474 }
1475 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001476#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1477#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1478 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001479 {
1480 /*
1481 * other_secret already set by the ClientKeyExchange message,
1482 * and is 48 bytes long
1483 */
Philippe Antoine747fd532018-05-30 09:13:21 +02001484 if( end - p < 2 )
1485 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1486
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001487 *p++ = 0;
1488 *p++ = 48;
1489 p += 48;
1490 }
1491 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001492#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1493#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1494 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001495 {
Janos Follath865b3eb2019-12-16 11:46:15 +00001496 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001497 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001498
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02001499 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001500 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001501 p + 2, end - ( p + 2 ), &len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001502 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001503 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001504 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001505 return( ret );
1506 }
Joe Subbiania5cb0d22021-08-23 11:35:25 +01001507 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
1508 p += 2 + len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001510 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001511 }
1512 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001513#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1514#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1515 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001516 {
Janos Follath865b3eb2019-12-16 11:46:15 +00001517 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001518 size_t zlen;
1519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001520 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02001521 p + 2, end - ( p + 2 ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001522 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001523 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001524 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001525 return( ret );
1526 }
1527
Joe Subbiania5cb0d22021-08-23 11:35:25 +01001528 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
1529 p += 2 + zlen;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001530
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001531 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
1532 MBEDTLS_DEBUG_ECDH_Z );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001533 }
1534 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001535#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001536 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001537 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1538 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001539 }
1540
1541 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001542 if( end - p < 2 )
1543 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01001544
Joe Subbiania5cb0d22021-08-23 11:35:25 +01001545 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
1546 p += 2;
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001547
1548 if( end < p || (size_t)( end - p ) < psk_len )
1549 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1550
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001551 memcpy( p, psk, psk_len );
1552 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001553
1554 ssl->handshake->pmslen = p - ssl->handshake->premaster;
1555
1556 return( 0 );
1557}
Gilles Peskineeccd8882020-03-10 12:19:08 +01001558#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001559
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001560#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
1561static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001562
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001563#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker786300f2020-02-05 10:46:40 +00001564int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001565{
1566 /* If renegotiation is not enforced, retransmit until we would reach max
1567 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001568 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001569 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001570 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001571 unsigned char doublings = 1;
1572
1573 while( ratio != 0 )
1574 {
1575 ++doublings;
1576 ratio >>= 1;
1577 }
1578
1579 if( ++ssl->renego_records_seen > doublings )
1580 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02001581 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001582 return( 0 );
1583 }
1584 }
1585
1586 return( ssl_write_hello_request( ssl ) );
1587}
1588#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001589#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02001590
Hanno Beckerb9d44792019-02-08 07:19:04 +00001591#if defined(MBEDTLS_X509_CRT_PARSE_C)
1592static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
1593{
1594#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
1595 if( session->peer_cert != NULL )
1596 {
1597 mbedtls_x509_crt_free( session->peer_cert );
1598 mbedtls_free( session->peer_cert );
1599 session->peer_cert = NULL;
1600 }
1601#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1602 if( session->peer_cert_digest != NULL )
1603 {
1604 /* Zeroization is not necessary. */
1605 mbedtls_free( session->peer_cert_digest );
1606 session->peer_cert_digest = NULL;
1607 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
1608 session->peer_cert_digest_len = 0;
1609 }
1610#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1611}
1612#endif /* MBEDTLS_X509_CRT_PARSE_C */
1613
Paul Bakker5121ce52009-01-03 21:22:43 +00001614/*
1615 * Handshake functions
1616 */
Gilles Peskineeccd8882020-03-10 12:19:08 +01001617#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02001618/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001619int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001620{
Hanno Beckere694c3e2017-12-27 21:34:08 +00001621 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1622 ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00001623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001624 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001625
Hanno Becker7177a882019-02-05 13:36:46 +00001626 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001627 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001628 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001629 ssl->state++;
1630 return( 0 );
1631 }
1632
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001633 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1634 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001635}
1636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001637int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001638{
Hanno Beckere694c3e2017-12-27 21:34:08 +00001639 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1640 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001641
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001642 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001643
Hanno Becker7177a882019-02-05 13:36:46 +00001644 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001645 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001647 ssl->state++;
1648 return( 0 );
1649 }
1650
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001651 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1652 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001653}
Gilles Peskinef9828522017-05-03 12:28:43 +02001654
Gilles Peskineeccd8882020-03-10 12:19:08 +01001655#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Gilles Peskinef9828522017-05-03 12:28:43 +02001656/* Some certificate support -> implement write and parse */
1657
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001658int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001659{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001660 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001661 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001662 const mbedtls_x509_crt *crt;
Hanno Beckere694c3e2017-12-27 21:34:08 +00001663 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1664 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001665
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001666 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001667
Hanno Becker7177a882019-02-05 13:36:46 +00001668 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001669 {
Johan Pascal4f099262020-09-22 10:59:26 +02001670 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1671 ssl->state++;
1672 return( 0 );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001673 }
1674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001675#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001676 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00001677 {
1678 if( ssl->client_auth == 0 )
1679 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001680 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001681 ssl->state++;
1682 return( 0 );
1683 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001684 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001685#endif /* MBEDTLS_SSL_CLI_C */
1686#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001687 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00001688 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001689 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001690 {
Hanno Becker9cfe6e92021-04-30 05:38:24 +01001691 /* Should never happen because we shouldn't have picked the
1692 * ciphersuite if we don't have a certificate. */
1693 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00001694 }
1695 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001696#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001697
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001698 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001699
1700 /*
1701 * 0 . 0 handshake type
1702 * 1 . 3 handshake length
1703 * 4 . 6 length of all certs
1704 * 7 . 9 length of cert. 1
1705 * 10 . n-1 peer certificate
1706 * n . n+2 length of cert. 2
1707 * n+3 . ... upper level cert, etc.
1708 */
1709 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001710 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00001711
Paul Bakker29087132010-03-21 21:03:34 +00001712 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001713 {
1714 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10001715 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00001716 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
1718 " > %" MBEDTLS_PRINTF_SIZET,
Paul Elliott3891caf2020-12-17 18:42:40 +00001719 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Hanno Becker91e1cc32021-04-30 05:28:49 +01001720 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Paul Bakker5121ce52009-01-03 21:22:43 +00001721 }
1722
Joe Subbianifbeb6922021-07-16 14:27:50 +01001723 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
1724 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
1725 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
Paul Bakker5121ce52009-01-03 21:22:43 +00001726
1727 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
1728 i += n; crt = crt->next;
1729 }
1730
Joe Subbianifbeb6922021-07-16 14:27:50 +01001731 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
1732 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
1733 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001734
1735 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001736 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
1737 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00001738
Paul Bakker5121ce52009-01-03 21:22:43 +00001739 ssl->state++;
1740
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02001741 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001742 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02001743 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001744 return( ret );
1745 }
1746
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001747 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001748
Paul Bakkered27a042013-04-18 22:46:23 +02001749 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001750}
1751
Hanno Becker84879e32019-01-31 07:44:03 +00001752#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Hanno Becker177475a2019-02-05 17:02:46 +00001753
1754#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001755static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
1756 unsigned char *crt_buf,
1757 size_t crt_buf_len )
1758{
1759 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
1760
1761 if( peer_crt == NULL )
1762 return( -1 );
1763
1764 if( peer_crt->raw.len != crt_buf_len )
1765 return( -1 );
1766
k-stachowiak95b68ef2019-09-16 12:21:00 +02001767 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001768}
Hanno Becker177475a2019-02-05 17:02:46 +00001769#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1770static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
1771 unsigned char *crt_buf,
1772 size_t crt_buf_len )
1773{
Janos Follath865b3eb2019-12-16 11:46:15 +00001774 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker177475a2019-02-05 17:02:46 +00001775 unsigned char const * const peer_cert_digest =
1776 ssl->session->peer_cert_digest;
1777 mbedtls_md_type_t const peer_cert_digest_type =
1778 ssl->session->peer_cert_digest_type;
1779 mbedtls_md_info_t const * const digest_info =
1780 mbedtls_md_info_from_type( peer_cert_digest_type );
1781 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
1782 size_t digest_len;
1783
1784 if( peer_cert_digest == NULL || digest_info == NULL )
1785 return( -1 );
1786
1787 digest_len = mbedtls_md_get_size( digest_info );
1788 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
1789 return( -1 );
1790
1791 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
1792 if( ret != 0 )
1793 return( -1 );
1794
1795 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
1796}
1797#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker84879e32019-01-31 07:44:03 +00001798#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001799
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02001800/*
1801 * Once the certificate message is read, parse it into a cert chain and
1802 * perform basic checks, but leave actual verification to the caller
1803 */
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001804static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
1805 mbedtls_x509_crt *chain )
Paul Bakker5121ce52009-01-03 21:22:43 +00001806{
Janos Follath865b3eb2019-12-16 11:46:15 +00001807 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001808#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1809 int crt_cnt=0;
1810#endif
Paul Bakker23986e52011-04-24 08:57:21 +00001811 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02001812 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00001813
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001814 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001815 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001816 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001817 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1818 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001819 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00001820 }
1821
Hanno Becker9ed1ba52021-06-24 11:03:13 +01001822 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
1823 {
1824 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1825 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
1826 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1827 }
1828
1829 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001830 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001831 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001832 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1833 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker9ed1ba52021-06-24 11:03:13 +01001834 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00001835 }
1836
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001837 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00001838
Paul Bakker5121ce52009-01-03 21:22:43 +00001839 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001840 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00001841 */
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00001842 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
Paul Bakker5121ce52009-01-03 21:22:43 +00001843
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00001844 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001845 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00001846 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001847 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001848 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1849 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker9ed1ba52021-06-24 11:03:13 +01001850 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00001851 }
1852
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001853 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
1854 i += 3;
1855
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001856 /* Iterate through and parse the CRTs in the provided chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00001857 while( i < ssl->in_hslen )
1858 {
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001859 /* Check that there's room for the next CRT's length fields. */
Philippe Antoine747fd532018-05-30 09:13:21 +02001860 if ( i + 3 > ssl->in_hslen ) {
1861 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckere2734e22019-01-31 07:44:17 +00001862 mbedtls_ssl_send_alert_message( ssl,
1863 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1864 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Dave Rodgman43fcb8d2021-06-28 21:49:15 +01001865 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +02001866 }
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001867 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
1868 * anything beyond 2**16 ~ 64K. */
Paul Bakker5121ce52009-01-03 21:22:43 +00001869 if( ssl->in_msg[i] != 0 )
1870 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001871 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckere2734e22019-01-31 07:44:17 +00001872 mbedtls_ssl_send_alert_message( ssl,
1873 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Dave Rodgman43fcb8d2021-06-28 21:49:15 +01001874 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
1875 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00001876 }
1877
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001878 /* Read length of the next CRT in the chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00001879 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
1880 | (unsigned int) ssl->in_msg[i + 2];
1881 i += 3;
1882
1883 if( n < 128 || i + n > ssl->in_hslen )
1884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckere2734e22019-01-31 07:44:17 +00001886 mbedtls_ssl_send_alert_message( ssl,
1887 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1888 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker9ed1ba52021-06-24 11:03:13 +01001889 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00001890 }
1891
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001892 /* Check if we're handling the first CRT in the chain. */
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001893#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1894 if( crt_cnt++ == 0 &&
1895 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
1896 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001897 {
Hanno Becker46f34d02019-02-08 14:00:04 +00001898 /* During client-side renegotiation, check that the server's
1899 * end-CRTs hasn't changed compared to the initial handshake,
1900 * mitigating the triple handshake attack. On success, reuse
1901 * the original end-CRT instead of parsing it again. */
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001902 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
1903 if( ssl_check_peer_crt_unchanged( ssl,
1904 &ssl->in_msg[i],
1905 n ) != 0 )
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001906 {
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001907 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
1908 mbedtls_ssl_send_alert_message( ssl,
1909 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Dave Rodgman43fcb8d2021-06-28 21:49:15 +01001910 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
1911 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001912 }
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001913
1914 /* Now we can safely free the original chain. */
1915 ssl_clear_peer_cert( ssl->session );
1916 }
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001917#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
1918
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001919 /* Parse the next certificate in the chain. */
Hanno Becker0056eab2019-02-08 14:39:16 +00001920#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001921 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
Hanno Becker0056eab2019-02-08 14:39:16 +00001922#else
Hanno Becker353a6f02019-02-26 11:51:34 +00001923 /* If we don't need to store the CRT chain permanently, parse
Hanno Becker0056eab2019-02-08 14:39:16 +00001924 * it in-place from the input buffer instead of making a copy. */
1925 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
1926#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001927 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00001928 {
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001929 case 0: /*ok*/
1930 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
1931 /* Ignore certificate with an unknown algorithm: maybe a
1932 prior certificate was already trusted. */
1933 break;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001934
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001935 case MBEDTLS_ERR_X509_ALLOC_FAILED:
1936 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
1937 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001938
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001939 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
1940 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
1941 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001942
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001943 default:
1944 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
1945 crt_parse_der_failed:
1946 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
1947 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
1948 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001949 }
1950
1951 i += n;
1952 }
1953
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001954 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02001955 return( 0 );
1956}
1957
Hanno Becker4a55f632019-02-05 12:49:06 +00001958#if defined(MBEDTLS_SSL_SRV_C)
1959static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
1960{
1961 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
1962 return( -1 );
1963
TRodziewicz0f82ec62021-05-12 17:49:18 +02001964#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker4a55f632019-02-05 12:49:06 +00001965 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
1966 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
1967 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
1968 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
1969 {
1970 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
1971 return( 0 );
1972 }
1973
1974 return( -1 );
TRodziewicz0f82ec62021-05-12 17:49:18 +02001975#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker4a55f632019-02-05 12:49:06 +00001976}
1977#endif /* MBEDTLS_SSL_SRV_C */
1978
Hanno Becker28f2fcd2019-02-07 10:11:07 +00001979/* Check if a certificate message is expected.
1980 * Return either
1981 * - SSL_CERTIFICATE_EXPECTED, or
1982 * - SSL_CERTIFICATE_SKIP
1983 * indicating whether a Certificate message is expected or not.
1984 */
1985#define SSL_CERTIFICATE_EXPECTED 0
1986#define SSL_CERTIFICATE_SKIP 1
1987static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
1988 int authmode )
1989{
1990 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00001991 ssl->handshake->ciphersuite_info;
Hanno Becker28f2fcd2019-02-07 10:11:07 +00001992
1993 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
1994 return( SSL_CERTIFICATE_SKIP );
1995
1996#if defined(MBEDTLS_SSL_SRV_C)
1997 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1998 {
1999 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2000 return( SSL_CERTIFICATE_SKIP );
2001
2002 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2003 {
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002004 ssl->session_negotiate->verify_result =
2005 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
2006 return( SSL_CERTIFICATE_SKIP );
2007 }
2008 }
Hanno Becker84d9d272019-03-01 08:10:46 +00002009#else
2010 ((void) authmode);
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002011#endif /* MBEDTLS_SSL_SRV_C */
2012
2013 return( SSL_CERTIFICATE_EXPECTED );
2014}
2015
Hanno Becker68636192019-02-05 14:36:34 +00002016static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
2017 int authmode,
2018 mbedtls_x509_crt *chain,
2019 void *rs_ctx )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002020{
Hanno Becker6bdfab22019-02-05 13:11:17 +00002021 int ret = 0;
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002022 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00002023 ssl->handshake->ciphersuite_info;
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002024 int have_ca_chain = 0;
Hanno Becker68636192019-02-05 14:36:34 +00002025
Hanno Becker8927c832019-04-03 12:52:50 +01002026 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
2027 void *p_vrfy;
2028
Hanno Becker68636192019-02-05 14:36:34 +00002029 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2030 return( 0 );
2031
Hanno Becker8927c832019-04-03 12:52:50 +01002032 if( ssl->f_vrfy != NULL )
2033 {
Hanno Beckerefb440a2019-04-03 13:04:33 +01002034 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
Hanno Becker8927c832019-04-03 12:52:50 +01002035 f_vrfy = ssl->f_vrfy;
2036 p_vrfy = ssl->p_vrfy;
2037 }
2038 else
2039 {
Hanno Beckerefb440a2019-04-03 13:04:33 +01002040 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
Hanno Becker8927c832019-04-03 12:52:50 +01002041 f_vrfy = ssl->conf->f_vrfy;
2042 p_vrfy = ssl->conf->p_vrfy;
2043 }
2044
Hanno Becker68636192019-02-05 14:36:34 +00002045 /*
2046 * Main check: verify certificate
2047 */
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002048#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
2049 if( ssl->conf->f_ca_cb != NULL )
2050 {
2051 ((void) rs_ctx);
2052 have_ca_chain = 1;
2053
2054 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
Jarno Lamsa9822c0d2019-04-01 16:59:48 +03002055 ret = mbedtls_x509_crt_verify_with_ca_cb(
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002056 chain,
2057 ssl->conf->f_ca_cb,
2058 ssl->conf->p_ca_cb,
2059 ssl->conf->cert_profile,
2060 ssl->hostname,
2061 &ssl->session_negotiate->verify_result,
Jaeden Amerofe710672019-04-16 15:03:12 +01002062 f_vrfy, p_vrfy );
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002063 }
2064 else
2065#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
2066 {
2067 mbedtls_x509_crt *ca_chain;
2068 mbedtls_x509_crl *ca_crl;
2069
2070#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2071 if( ssl->handshake->sni_ca_chain != NULL )
2072 {
2073 ca_chain = ssl->handshake->sni_ca_chain;
2074 ca_crl = ssl->handshake->sni_ca_crl;
2075 }
2076 else
2077#endif
2078 {
2079 ca_chain = ssl->conf->ca_chain;
2080 ca_crl = ssl->conf->ca_crl;
2081 }
2082
2083 if( ca_chain != NULL )
2084 have_ca_chain = 1;
2085
2086 ret = mbedtls_x509_crt_verify_restartable(
2087 chain,
2088 ca_chain, ca_crl,
2089 ssl->conf->cert_profile,
2090 ssl->hostname,
2091 &ssl->session_negotiate->verify_result,
Jaeden Amerofe710672019-04-16 15:03:12 +01002092 f_vrfy, p_vrfy, rs_ctx );
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002093 }
Hanno Becker68636192019-02-05 14:36:34 +00002094
2095 if( ret != 0 )
2096 {
2097 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
2098 }
2099
Gilles Peskineeccd8882020-03-10 12:19:08 +01002100#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Hanno Becker68636192019-02-05 14:36:34 +00002101 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2102 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
2103#endif
2104
2105 /*
2106 * Secondary checks: always done, but change 'ret' only if it was 0
2107 */
2108
2109#if defined(MBEDTLS_ECP_C)
2110 {
2111 const mbedtls_pk_context *pk = &chain->pk;
2112
2113 /* If certificate uses an EC key, make sure the curve is OK */
2114 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
2115 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
2116 {
2117 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
2118
2119 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
2120 if( ret == 0 )
Hanno Becker9ed1ba52021-06-24 11:03:13 +01002121 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Hanno Becker68636192019-02-05 14:36:34 +00002122 }
2123 }
2124#endif /* MBEDTLS_ECP_C */
2125
2126 if( mbedtls_ssl_check_cert_usage( chain,
2127 ciphersuite_info,
2128 ! ssl->conf->endpoint,
2129 &ssl->session_negotiate->verify_result ) != 0 )
2130 {
2131 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
2132 if( ret == 0 )
Hanno Becker9ed1ba52021-06-24 11:03:13 +01002133 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Hanno Becker68636192019-02-05 14:36:34 +00002134 }
2135
2136 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
2137 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
2138 * with details encoded in the verification flags. All other kinds
2139 * of error codes, including those from the user provided f_vrfy
2140 * functions, are treated as fatal and lead to a failure of
2141 * ssl_parse_certificate even if verification was optional. */
2142 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
2143 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
Hanno Becker9ed1ba52021-06-24 11:03:13 +01002144 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
Hanno Becker68636192019-02-05 14:36:34 +00002145 {
2146 ret = 0;
2147 }
2148
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002149 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
Hanno Becker68636192019-02-05 14:36:34 +00002150 {
2151 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
2152 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
2153 }
2154
2155 if( ret != 0 )
2156 {
2157 uint8_t alert;
2158
2159 /* The certificate may have been rejected for several reasons.
2160 Pick one and send the corresponding alert. Which alert to send
2161 may be a subject of debate in some cases. */
2162 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
2163 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
2164 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
2165 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
2166 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
2167 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2168 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
2169 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2170 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
2171 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2172 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
2173 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2174 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
2175 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2176 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
2177 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
2178 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
2179 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
2180 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
2181 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
2182 else
2183 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
2184 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2185 alert );
2186 }
2187
2188#if defined(MBEDTLS_DEBUG_C)
2189 if( ssl->session_negotiate->verify_result != 0 )
2190 {
Paul Elliott3891caf2020-12-17 18:42:40 +00002191 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
Paul Elliott9f352112020-12-09 14:55:45 +00002192 (unsigned int) ssl->session_negotiate->verify_result ) );
Hanno Becker68636192019-02-05 14:36:34 +00002193 }
2194 else
2195 {
2196 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
2197 }
2198#endif /* MBEDTLS_DEBUG_C */
2199
2200 return( ret );
2201}
2202
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002203#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2204static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
2205 unsigned char *start, size_t len )
2206{
Janos Follath865b3eb2019-12-16 11:46:15 +00002207 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002208 /* Remember digest of the peer's end-CRT. */
2209 ssl->session_negotiate->peer_cert_digest =
2210 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
2211 if( ssl->session_negotiate->peer_cert_digest == NULL )
2212 {
2213 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
irwir40883e92019-09-21 17:55:33 +03002214 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002215 mbedtls_ssl_send_alert_message( ssl,
2216 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2217 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2218
2219 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2220 }
2221
2222 ret = mbedtls_md( mbedtls_md_info_from_type(
2223 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
2224 start, len,
2225 ssl->session_negotiate->peer_cert_digest );
2226
2227 ssl->session_negotiate->peer_cert_digest_type =
2228 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
2229 ssl->session_negotiate->peer_cert_digest_len =
2230 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
2231
2232 return( ret );
2233}
2234
2235static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
2236 unsigned char *start, size_t len )
2237{
2238 unsigned char *end = start + len;
Janos Follath865b3eb2019-12-16 11:46:15 +00002239 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002240
2241 /* Make a copy of the peer's raw public key. */
2242 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
2243 ret = mbedtls_pk_parse_subpubkey( &start, end,
2244 &ssl->handshake->peer_pubkey );
2245 if( ret != 0 )
2246 {
2247 /* We should have parsed the public key before. */
2248 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2249 }
2250
2251 return( 0 );
2252}
2253#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2254
Hanno Becker68636192019-02-05 14:36:34 +00002255int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
2256{
2257 int ret = 0;
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002258 int crt_expected;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002259#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2260 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
2261 ? ssl->handshake->sni_authmode
2262 : ssl->conf->authmode;
2263#else
Johan Pascal4f099262020-09-22 10:59:26 +02002264 const int authmode = ssl->conf->authmode;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002265#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002266 void *rs_ctx = NULL;
Hanno Becker3dad3112019-02-05 17:19:52 +00002267 mbedtls_x509_crt *chain = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002268
2269 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2270
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002271 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
2272 if( crt_expected == SSL_CERTIFICATE_SKIP )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002273 {
2274 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Hanno Becker6bdfab22019-02-05 13:11:17 +00002275 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002276 }
2277
Gilles Peskineeccd8882020-03-10 12:19:08 +01002278#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002279 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02002280 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002281 {
Hanno Becker3dad3112019-02-05 17:19:52 +00002282 chain = ssl->handshake->ecrs_peer_cert;
2283 ssl->handshake->ecrs_peer_cert = NULL;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002284 goto crt_verify;
2285 }
2286#endif
2287
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02002288 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002289 {
2290 /* mbedtls_ssl_read_record may have sent an alert already. We
2291 let it decide whether to alert. */
2292 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Hanno Becker3dad3112019-02-05 17:19:52 +00002293 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002294 }
2295
Hanno Becker4a55f632019-02-05 12:49:06 +00002296#if defined(MBEDTLS_SSL_SRV_C)
2297 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
2298 {
2299 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Hanno Becker4a55f632019-02-05 12:49:06 +00002300
irwird3085ab2020-04-21 22:26:05 +03002301 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
Hanno Becker6bdfab22019-02-05 13:11:17 +00002302 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Hanno Becker4a55f632019-02-05 12:49:06 +00002303
Hanno Becker6bdfab22019-02-05 13:11:17 +00002304 goto exit;
Hanno Becker4a55f632019-02-05 12:49:06 +00002305 }
2306#endif /* MBEDTLS_SSL_SRV_C */
2307
Hanno Beckerc7bd7802019-02-05 15:37:23 +00002308 /* Clear existing peer CRT structure in case we tried to
2309 * reuse a session but it failed, and allocate a new one. */
Hanno Becker7a955a02019-02-05 13:08:01 +00002310 ssl_clear_peer_cert( ssl->session_negotiate );
Hanno Becker3dad3112019-02-05 17:19:52 +00002311
2312 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
2313 if( chain == NULL )
Hanno Beckerc7bd7802019-02-05 15:37:23 +00002314 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00002315 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
Hanno Beckerc7bd7802019-02-05 15:37:23 +00002316 sizeof( mbedtls_x509_crt ) ) );
2317 mbedtls_ssl_send_alert_message( ssl,
2318 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2319 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Becker7a955a02019-02-05 13:08:01 +00002320
Hanno Becker3dad3112019-02-05 17:19:52 +00002321 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
2322 goto exit;
2323 }
2324 mbedtls_x509_crt_init( chain );
2325
2326 ret = ssl_parse_certificate_chain( ssl, chain );
Hanno Beckerc7bd7802019-02-05 15:37:23 +00002327 if( ret != 0 )
Hanno Becker3dad3112019-02-05 17:19:52 +00002328 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002329
Gilles Peskineeccd8882020-03-10 12:19:08 +01002330#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002331 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02002332 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002333
2334crt_verify:
2335 if( ssl->handshake->ecrs_enabled)
2336 rs_ctx = &ssl->handshake->ecrs_ctx;
2337#endif
2338
Hanno Becker68636192019-02-05 14:36:34 +00002339 ret = ssl_parse_certificate_verify( ssl, authmode,
Hanno Becker3dad3112019-02-05 17:19:52 +00002340 chain, rs_ctx );
Hanno Becker68636192019-02-05 14:36:34 +00002341 if( ret != 0 )
Hanno Becker3dad3112019-02-05 17:19:52 +00002342 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00002343
Hanno Becker6bbd94c2019-02-05 17:02:28 +00002344#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker6bbd94c2019-02-05 17:02:28 +00002345 {
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002346 unsigned char *crt_start, *pk_start;
2347 size_t crt_len, pk_len;
Hanno Becker3dad3112019-02-05 17:19:52 +00002348
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002349 /* We parse the CRT chain without copying, so
2350 * these pointers point into the input buffer,
2351 * and are hence still valid after freeing the
2352 * CRT chain. */
Hanno Becker6bbd94c2019-02-05 17:02:28 +00002353
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002354 crt_start = chain->raw.p;
2355 crt_len = chain->raw.len;
Hanno Becker6bbd94c2019-02-05 17:02:28 +00002356
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002357 pk_start = chain->pk_raw.p;
2358 pk_len = chain->pk_raw.len;
2359
2360 /* Free the CRT structures before computing
2361 * digest and copying the peer's public key. */
2362 mbedtls_x509_crt_free( chain );
2363 mbedtls_free( chain );
2364 chain = NULL;
2365
2366 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
Hanno Beckera2747532019-02-06 16:19:04 +00002367 if( ret != 0 )
Hanno Beckera2747532019-02-06 16:19:04 +00002368 goto exit;
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002369
2370 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
2371 if( ret != 0 )
2372 goto exit;
Hanno Beckera2747532019-02-06 16:19:04 +00002373 }
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002374#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2375 /* Pass ownership to session structure. */
Hanno Becker3dad3112019-02-05 17:19:52 +00002376 ssl->session_negotiate->peer_cert = chain;
2377 chain = NULL;
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002378#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker3dad3112019-02-05 17:19:52 +00002379
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002380 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002381
Hanno Becker6bdfab22019-02-05 13:11:17 +00002382exit:
2383
Hanno Becker3dad3112019-02-05 17:19:52 +00002384 if( ret == 0 )
2385 ssl->state++;
2386
Gilles Peskineeccd8882020-03-10 12:19:08 +01002387#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Hanno Becker3dad3112019-02-05 17:19:52 +00002388 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
2389 {
2390 ssl->handshake->ecrs_peer_cert = chain;
2391 chain = NULL;
2392 }
2393#endif
2394
2395 if( chain != NULL )
2396 {
2397 mbedtls_x509_crt_free( chain );
2398 mbedtls_free( chain );
2399 }
2400
Paul Bakker5121ce52009-01-03 21:22:43 +00002401 return( ret );
2402}
Gilles Peskineeccd8882020-03-10 12:19:08 +01002403#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002404
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002405void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
2406 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
Paul Bakker380da532012-04-18 16:10:25 +00002407{
Paul Bakkerfb08fd22013-08-27 15:06:26 +02002408 ((void) ciphersuite_info);
Paul Bakker769075d2012-11-24 11:26:46 +01002409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002410#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002411#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002412 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002413 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
2414 else
2415#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002416#if defined(MBEDTLS_SHA256_C)
2417 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
Paul Bakker48916f92012-09-16 19:57:18 +00002418 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002419 else
2420#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002421#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02002422 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002423 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002424 return;
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02002425 }
Paul Bakker380da532012-04-18 16:10:25 +00002426}
Paul Bakkerf7abd422013-04-16 13:15:56 +02002427
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002428void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002429{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002430#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2431#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002432#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek2ad22972019-01-30 03:32:12 -05002433 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002434 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2435#else
TRodziewicz26371e42021-06-08 16:45:41 +02002436 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002437#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002438#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002439#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002440#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek2ad22972019-01-30 03:32:12 -05002441 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
Andrzej Kurek972fba52019-01-30 03:29:12 -05002442 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002443#else
TRodziewicz26371e42021-06-08 16:45:41 +02002444 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002445#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002446#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002447#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002448}
2449
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002450static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002451 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00002452{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002453#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2454#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002455#if defined(MBEDTLS_USE_PSA_CRYPTO)
2456 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2457#else
TRodziewicz26371e42021-06-08 16:45:41 +02002458 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002459#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002460#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002461#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002462#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05002463 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002464#else
TRodziewicz26371e42021-06-08 16:45:41 +02002465 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
Paul Bakker769075d2012-11-24 11:26:46 +01002466#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002467#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002468#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker380da532012-04-18 16:10:25 +00002469}
2470
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002471#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2472#if defined(MBEDTLS_SHA256_C)
2473static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002474 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00002475{
Andrzej Kurekeb342242019-01-29 09:14:33 -05002476#if defined(MBEDTLS_USE_PSA_CRYPTO)
2477 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2478#else
TRodziewicz26371e42021-06-08 16:45:41 +02002479 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002480#endif
Paul Bakker380da532012-04-18 16:10:25 +00002481}
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002482#endif
Paul Bakker380da532012-04-18 16:10:25 +00002483
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002484#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002485static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002486 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00002487{
Andrzej Kurekeb342242019-01-29 09:14:33 -05002488#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05002489 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002490#else
TRodziewicz26371e42021-06-08 16:45:41 +02002491 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002492#endif
Paul Bakker380da532012-04-18 16:10:25 +00002493}
Paul Bakker769075d2012-11-24 11:26:46 +01002494#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002495#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker380da532012-04-18 16:10:25 +00002496
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002497#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2498#if defined(MBEDTLS_SHA256_C)
Paul Bakkerca4ab492012-04-18 14:23:57 +00002499static void ssl_calc_finished_tls_sha256(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002500 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker1ef83d62012-04-11 12:09:53 +00002501{
2502 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02002503 const char *sender;
Paul Bakker1ef83d62012-04-11 12:09:53 +00002504 unsigned char padbuf[32];
Andrzej Kurekeb342242019-01-29 09:14:33 -05002505#if defined(MBEDTLS_USE_PSA_CRYPTO)
2506 size_t hash_size;
Jaeden Amero34973232019-02-20 10:32:28 +00002507 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
Andrzej Kurekeb342242019-01-29 09:14:33 -05002508 psa_status_t status;
2509#else
2510 mbedtls_sha256_context sha256;
2511#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00002512
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002513 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00002514 if( !session )
2515 session = ssl->session;
2516
Andrzej Kurekeb342242019-01-29 09:14:33 -05002517 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
2518 ? "client finished"
2519 : "server finished";
2520
2521#if defined(MBEDTLS_USE_PSA_CRYPTO)
2522 sha256_psa = psa_hash_operation_init();
2523
2524 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
2525
2526 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
2527 if( status != PSA_SUCCESS )
2528 {
2529 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
2530 return;
2531 }
2532
2533 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
2534 if( status != PSA_SUCCESS )
2535 {
2536 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
2537 return;
2538 }
2539 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
2540#else
2541
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02002542 mbedtls_sha256_init( &sha256 );
2543
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02002544 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002545
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02002546 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002547
2548 /*
2549 * TLSv1.2:
2550 * hash = PRF( master, finished_label,
2551 * Hash( handshake ) )[0.11]
2552 */
2553
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002554#if !defined(MBEDTLS_SHA256_ALT)
2555 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02002556 sha256.state, sizeof( sha256.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02002557#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00002558
TRodziewicz26371e42021-06-08 16:45:41 +02002559 mbedtls_sha256_finish( &sha256, padbuf );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002560 mbedtls_sha256_free( &sha256 );
2561#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker1ef83d62012-04-11 12:09:53 +00002562
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002563 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00002564 padbuf, 32, buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002565
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002566 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002567
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002568 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002569
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002570 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002571}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002572#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +00002573
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002574#if defined(MBEDTLS_SHA384_C)
Rodrigo Dias Corread596ca82020-11-25 00:42:28 -03002575
Paul Bakkerca4ab492012-04-18 14:23:57 +00002576static void ssl_calc_finished_tls_sha384(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002577 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002578{
2579 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02002580 const char *sender;
Rodrigo Dias Corread596ca82020-11-25 00:42:28 -03002581 unsigned char padbuf[48];
Andrzej Kurekeb342242019-01-29 09:14:33 -05002582#if defined(MBEDTLS_USE_PSA_CRYPTO)
2583 size_t hash_size;
Jaeden Amero34973232019-02-20 10:32:28 +00002584 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
Andrzej Kurekeb342242019-01-29 09:14:33 -05002585 psa_status_t status;
2586#else
2587 mbedtls_sha512_context sha512;
2588#endif
Paul Bakkerca4ab492012-04-18 14:23:57 +00002589
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002590 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00002591 if( !session )
2592 session = ssl->session;
2593
Andrzej Kurekeb342242019-01-29 09:14:33 -05002594 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
2595 ? "client finished"
2596 : "server finished";
2597
2598#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05002599 sha384_psa = psa_hash_operation_init();
Andrzej Kurekeb342242019-01-29 09:14:33 -05002600
2601 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
2602
Andrzej Kurek972fba52019-01-30 03:29:12 -05002603 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002604 if( status != PSA_SUCCESS )
2605 {
2606 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
2607 return;
2608 }
2609
Andrzej Kurek972fba52019-01-30 03:29:12 -05002610 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002611 if( status != PSA_SUCCESS )
2612 {
2613 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
2614 return;
2615 }
2616 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
2617#else
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02002618 mbedtls_sha512_init( &sha512 );
2619
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002620 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002621
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02002622 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002623
2624 /*
2625 * TLSv1.2:
2626 * hash = PRF( master, finished_label,
2627 * Hash( handshake ) )[0.11]
2628 */
2629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002630#if !defined(MBEDTLS_SHA512_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02002631 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
2632 sha512.state, sizeof( sha512.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02002633#endif
TRodziewicz26371e42021-06-08 16:45:41 +02002634 mbedtls_sha512_finish( &sha512, padbuf );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002635
Andrzej Kurekeb342242019-01-29 09:14:33 -05002636 mbedtls_sha512_free( &sha512 );
2637#endif
Paul Bakkerca4ab492012-04-18 14:23:57 +00002638
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002639 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00002640 padbuf, 48, buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002641
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002642 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002643
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002644 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002645
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002647}
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002648#endif /* MBEDTLS_SHA384_C */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002649#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +00002650
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00002651void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00002652{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002653 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002654
2655 /*
2656 * Free our handshake params
2657 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02002658 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002659 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00002660 ssl->handshake = NULL;
2661
2662 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002663 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00002664 */
2665 if( ssl->transform )
2666 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002667 mbedtls_ssl_transform_free( ssl->transform );
2668 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00002669 }
2670 ssl->transform = ssl->transform_negotiate;
2671 ssl->transform_negotiate = NULL;
2672
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002673 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002674}
2675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002676void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002677{
2678 int resume = ssl->handshake->resume;
2679
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002680 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002681
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002682#if defined(MBEDTLS_SSL_RENEGOTIATION)
2683 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002684 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002685 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002686 ssl->renego_records_seen = 0;
2687 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002688#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002689
2690 /*
2691 * Free the previous session and switch in the current one
2692 */
Paul Bakker0a597072012-09-25 21:55:46 +00002693 if( ssl->session )
2694 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002695#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01002696 /* RFC 7366 3.1: keep the EtM state */
2697 ssl->session_negotiate->encrypt_then_mac =
2698 ssl->session->encrypt_then_mac;
2699#endif
2700
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002701 mbedtls_ssl_session_free( ssl->session );
2702 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00002703 }
2704 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00002705 ssl->session_negotiate = NULL;
2706
Paul Bakker0a597072012-09-25 21:55:46 +00002707 /*
2708 * Add cache entry
2709 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002710 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002711 ssl->session->id_len != 0 &&
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02002712 resume == 0 )
2713 {
Hanno Beckerccdaf6e2021-04-15 09:26:17 +01002714 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
2715 ssl->session->id,
2716 ssl->session->id_len,
2717 ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002718 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02002719 }
Paul Bakker0a597072012-09-25 21:55:46 +00002720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002721#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002722 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002723 ssl->handshake->flight != NULL )
2724 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002725 /* Cancel handshake timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00002726 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002727
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002728 /* Keep last flight around in case we need to resend it:
2729 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002730 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002731 }
2732 else
2733#endif
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00002734 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002735
Paul Bakker48916f92012-09-16 19:57:18 +00002736 ssl->state++;
2737
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002738 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002739}
2740
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002741int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00002742{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002743 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00002744
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002745 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002746
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00002747 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01002748
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002749 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002750
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01002751 /*
2752 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
2753 * may define some other value. Currently (early 2016), no defined
2754 * ciphersuite does this (and this is unlikely to change as activity has
2755 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
2756 */
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002757 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00002758
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002759#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00002760 ssl->verify_data_len = hash_len;
2761 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002762#endif
Paul Bakker48916f92012-09-16 19:57:18 +00002763
Paul Bakker5121ce52009-01-03 21:22:43 +00002764 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002765 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2766 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00002767
2768 /*
2769 * In case of session resuming, invert the client and server
2770 * ChangeCipherSpec messages order.
2771 */
Paul Bakker0a597072012-09-25 21:55:46 +00002772 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002773 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002774#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002775 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002776 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01002777#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002778#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002779 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002780 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01002781#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002782 }
2783 else
2784 ssl->state++;
2785
Paul Bakker48916f92012-09-16 19:57:18 +00002786 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02002787 * Switch to our negotiated transform and session parameters for outbound
2788 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00002789 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002790 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01002791
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002792#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002793 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002794 {
2795 unsigned char i;
2796
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002797 /* Remember current epoch settings for resending */
2798 ssl->handshake->alt_transform_out = ssl->transform_out;
Jerry Yud9a94fe2021-09-28 18:58:59 +08002799 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
Jerry Yud96a5c22021-09-29 17:46:51 +08002800 sizeof( ssl->handshake->alt_out_ctr ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002801
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002802 /* Set sequence_number to zero */
Jerry Yufd320e92021-10-08 21:52:41 +08002803 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
Jerry Yud9a94fe2021-09-28 18:58:59 +08002804
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002805
2806 /* Increment epoch */
2807 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01002808 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002809 break;
2810
2811 /* The loop goes to its end iff the counter is wrapping */
2812 if( i == 0 )
2813 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002814 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
2815 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002816 }
2817 }
2818 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002819#endif /* MBEDTLS_SSL_PROTO_DTLS */
Jerry Yufd320e92021-10-08 21:52:41 +08002820 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002821
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002822 ssl->transform_out = ssl->transform_negotiate;
2823 ssl->session_out = ssl->session_negotiate;
2824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002825#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002826 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002827 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002828#endif
2829
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002830 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002831 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002832 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002833 return( ret );
2834 }
2835
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002836#if defined(MBEDTLS_SSL_PROTO_DTLS)
2837 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2838 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2839 {
2840 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
2841 return( ret );
2842 }
2843#endif
2844
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002845 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002846
2847 return( 0 );
2848}
2849
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00002850#define SSL_MAX_HASH_LEN 12
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00002851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002852int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002853{
Janos Follath865b3eb2019-12-16 11:46:15 +00002854 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002855 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00002856 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00002857
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002858 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002859
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002860 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002861
Hanno Becker327c93b2018-08-15 13:56:18 +01002862 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002863 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002864 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002865 return( ret );
2866 }
2867
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002868 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002869 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002870 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002871 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2872 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002873 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002874 }
2875
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002876 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00002877
Hanno Beckera0ca87e2021-06-24 10:27:37 +01002878 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
2879 {
2880 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2881 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2882 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2883 }
2884
2885 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00002886 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002887 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002888 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2889 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Beckera0ca87e2021-06-24 10:27:37 +01002890 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00002891 }
2892
Gabor Mezei90437e32021-10-20 11:59:27 +02002893 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
Manuel Pégourié-Gonnard4abc3272014-09-10 12:02:46 +00002894 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002895 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002896 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002897 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Dave Rodgman43fcb8d2021-06-28 21:49:15 +01002898 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
2899 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002900 }
2901
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002902#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00002903 ssl->verify_data_len = hash_len;
2904 memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002905#endif
Paul Bakker48916f92012-09-16 19:57:18 +00002906
Paul Bakker0a597072012-09-25 21:55:46 +00002907 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002908 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002909#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002910 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002911 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01002912#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002913#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002914 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002915 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01002916#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002917 }
2918 else
2919 ssl->state++;
2920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002921#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002922 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002923 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002924#endif
2925
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002926 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002927
2928 return( 0 );
2929}
2930
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002931static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002932{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002933 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002934
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002935#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2936#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002937#if defined(MBEDTLS_USE_PSA_CRYPTO)
2938 handshake->fin_sha256_psa = psa_hash_operation_init();
2939 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2940#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002941 mbedtls_sha256_init( &handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +02002942 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002943#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002944#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002945#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002946#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05002947 handshake->fin_sha384_psa = psa_hash_operation_init();
2948 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002949#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002950 mbedtls_sha512_init( &handshake->fin_sha512 );
TRodziewicz26371e42021-06-08 16:45:41 +02002951 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002952#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002953#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002954#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002955
2956 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +01002957
2958#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01002959 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01002960 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
2961#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002962
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002963#if defined(MBEDTLS_DHM_C)
2964 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002965#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002966#if defined(MBEDTLS_ECDH_C)
2967 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002968#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002969#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02002970 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02002971#if defined(MBEDTLS_SSL_CLI_C)
2972 handshake->ecjpake_cache = NULL;
2973 handshake->ecjpake_cache_len = 0;
2974#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02002975#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002976
Gilles Peskineeccd8882020-03-10 12:19:08 +01002977#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02002978 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02002979#endif
2980
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002981#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2982 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
2983#endif
Hanno Becker75173122019-02-06 16:18:31 +00002984
2985#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
2986 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2987 mbedtls_pk_init( &handshake->peer_pubkey );
2988#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002989}
2990
Hanno Beckera18d1322018-01-03 14:27:32 +00002991void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002992{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002993 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +02002994
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002995 mbedtls_cipher_init( &transform->cipher_ctx_enc );
2996 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Paul Bakker84bbeb52014-07-01 14:53:22 +02002997
Hanno Beckerfd86ca82020-11-30 08:54:23 +00002998#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002999 mbedtls_md_init( &transform->md_ctx_enc );
3000 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +00003001#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003002}
3003
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003004void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003005{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003006 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003007}
3008
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003009static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003010{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003011 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00003012 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003013 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003014 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003015 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003016 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02003017 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003018
3019 /*
3020 * Either the pointers are now NULL or cleared properly and can be freed.
3021 * Now allocate missing structures.
3022 */
3023 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003024 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003025 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003026 }
Paul Bakker48916f92012-09-16 19:57:18 +00003027
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003028 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003029 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003030 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003031 }
Paul Bakker48916f92012-09-16 19:57:18 +00003032
Paul Bakker82788fb2014-10-20 13:59:19 +02003033 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003034 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003035 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003036 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003037#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3038 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -04003039
Andrzej Kurek4a063792020-10-21 15:08:44 +02003040 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
3041 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003042#endif
Paul Bakker48916f92012-09-16 19:57:18 +00003043
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003044 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00003045 if( ssl->handshake == NULL ||
3046 ssl->transform_negotiate == NULL ||
3047 ssl->session_negotiate == NULL )
3048 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02003049 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003050
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003051 mbedtls_free( ssl->handshake );
3052 mbedtls_free( ssl->transform_negotiate );
3053 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003054
3055 ssl->handshake = NULL;
3056 ssl->transform_negotiate = NULL;
3057 ssl->session_negotiate = NULL;
3058
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003059 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00003060 }
3061
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003062 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003063 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Beckera18d1322018-01-03 14:27:32 +00003064 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02003065 ssl_handshake_params_init( ssl->handshake );
3066
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003067#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02003068 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3069 {
3070 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003071
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02003072 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3073 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
3074 else
3075 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003076
Hanno Becker0f57a652020-02-05 10:37:26 +00003077 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02003078 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003079#endif
3080
Brett Warrene0edc842021-08-17 09:53:13 +01003081/*
3082 * curve_list is translated to IANA TLS group identifiers here because
3083 * mbedtls_ssl_conf_curves returns void and so can't return
3084 * any error codes.
3085 */
3086#if defined(MBEDTLS_ECP_C)
3087#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3088 /* Heap allocate and translate curve_list from internal to IANA group ids */
3089 if ( ssl->conf->curve_list != NULL )
3090 {
3091 size_t length;
3092 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
3093
3094 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
3095 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
3096
3097 /* Leave room for zero termination */
3098 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
3099 if ( group_list == NULL )
3100 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3101
3102 for( size_t i = 0; i < length; i++ )
3103 {
3104 const mbedtls_ecp_curve_info *info =
3105 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
3106 if ( info == NULL )
3107 {
3108 mbedtls_free( group_list );
3109 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3110 }
3111 group_list[i] = info->tls_id;
3112 }
3113
3114 group_list[length] = 0;
3115
3116 ssl->handshake->group_list = group_list;
3117 ssl->handshake->group_list_heap_allocated = 1;
3118 }
3119 else
3120 {
3121 ssl->handshake->group_list = ssl->conf->group_list;
3122 ssl->handshake->group_list_heap_allocated = 0;
3123 }
3124#endif /* MBEDTLS_DEPRECATED_REMOVED */
3125#endif /* MBEDTLS_ECP_C */
3126
Paul Bakker48916f92012-09-16 19:57:18 +00003127 return( 0 );
3128}
3129
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02003130#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02003131/* Dummy cookie callbacks for defaults */
3132static int ssl_cookie_write_dummy( void *ctx,
3133 unsigned char **p, unsigned char *end,
3134 const unsigned char *cli_id, size_t cli_id_len )
3135{
3136 ((void) ctx);
3137 ((void) p);
3138 ((void) end);
3139 ((void) cli_id);
3140 ((void) cli_id_len);
3141
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003142 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02003143}
3144
3145static int ssl_cookie_check_dummy( void *ctx,
3146 const unsigned char *cookie, size_t cookie_len,
3147 const unsigned char *cli_id, size_t cli_id_len )
3148{
3149 ((void) ctx);
3150 ((void) cookie);
3151 ((void) cookie_len);
3152 ((void) cli_id);
3153 ((void) cli_id_len);
3154
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003155 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02003156}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02003157#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02003158
Paul Bakker5121ce52009-01-03 21:22:43 +00003159/*
3160 * Initialize an SSL context
3161 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02003162void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
3163{
3164 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
3165}
3166
Jerry Yu60835a82021-08-04 10:13:52 +08003167static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
3168{
3169#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
3170 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
3171 {
3172 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3173 {
3174 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported" ) );
3175 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3176 }
3177 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
3178 return( 0 );
3179 }
3180#endif
3181
3182#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3183 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
3184 {
3185 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
3186 return( 0 );
3187 }
3188#endif
3189
3190#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
3191 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( ssl->conf ) )
3192 {
3193 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Hybrid TLS 1.2 + TLS 1.3 configurations are not yet supported" ) );
3194 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3195 }
3196#endif
3197
3198 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
3199 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3200}
3201
3202static int ssl_conf_check(const mbedtls_ssl_context *ssl)
3203{
3204 int ret;
3205 ret = ssl_conf_version_check( ssl );
3206 if( ret != 0 )
3207 return( ret );
3208
3209 /* Space for further checks */
3210
3211 return( 0 );
3212}
3213
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02003214/*
3215 * Setup an SSL context
3216 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01003217
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02003218int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02003219 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00003220{
Janos Follath865b3eb2019-12-16 11:46:15 +00003221 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +00003222 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3223 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00003224
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02003225 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00003226
Jerry Yu60835a82021-08-04 10:13:52 +08003227 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
3228 return( ret );
3229
Paul Bakker62f2dee2012-09-28 07:31:51 +00003230 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003231 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00003232 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02003233
3234 /* Set to NULL in case of an error condition */
3235 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02003236
Darryl Greenb33cc762019-11-28 14:29:44 +00003237#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3238 ssl->in_buf_len = in_buf_len;
3239#endif
3240 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10003241 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003242 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00003243 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02003244 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02003245 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10003246 }
3247
Darryl Greenb33cc762019-11-28 14:29:44 +00003248#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3249 ssl->out_buf_len = out_buf_len;
3250#endif
3251 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10003252 if( ssl->out_buf == NULL )
3253 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00003254 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02003255 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02003256 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00003257 }
3258
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00003259 mbedtls_ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02003260
Johan Pascalb62bb512015-12-03 21:56:45 +01003261#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +02003262 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
Johan Pascalb62bb512015-12-03 21:56:45 +01003263#endif
3264
Paul Bakker48916f92012-09-16 19:57:18 +00003265 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02003266 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00003267
3268 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02003269
3270error:
3271 mbedtls_free( ssl->in_buf );
3272 mbedtls_free( ssl->out_buf );
3273
3274 ssl->conf = NULL;
3275
Darryl Greenb33cc762019-11-28 14:29:44 +00003276#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3277 ssl->in_buf_len = 0;
3278 ssl->out_buf_len = 0;
3279#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02003280 ssl->in_buf = NULL;
3281 ssl->out_buf = NULL;
3282
3283 ssl->in_hdr = NULL;
3284 ssl->in_ctr = NULL;
3285 ssl->in_len = NULL;
3286 ssl->in_iv = NULL;
3287 ssl->in_msg = NULL;
3288
3289 ssl->out_hdr = NULL;
3290 ssl->out_ctr = NULL;
3291 ssl->out_len = NULL;
3292 ssl->out_iv = NULL;
3293 ssl->out_msg = NULL;
3294
k-stachowiak9f7798e2018-07-31 16:52:32 +02003295 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003296}
3297
3298/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00003299 * Reset an initialized and used SSL context for re-use while retaining
3300 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003301 *
3302 * If partial is non-zero, keep data in the input buffer and client ID.
3303 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00003304 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01003305static void ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
3306 int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00003307{
Darryl Greenb33cc762019-11-28 14:29:44 +00003308#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3309 size_t in_buf_len = ssl->in_buf_len;
3310 size_t out_buf_len = ssl->out_buf_len;
3311#else
3312 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3313 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3314#endif
Paul Bakker48916f92012-09-16 19:57:18 +00003315
Hanno Beckerb0302c42021-08-03 09:39:42 +01003316#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
3317 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01003318#endif
3319
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003320 /* Cancel any possibly running timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00003321 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003322
Hanno Beckerb0302c42021-08-03 09:39:42 +01003323 mbedtls_ssl_reset_in_out_pointers( ssl );
3324
3325 /* Reset incoming message parsing */
3326 ssl->in_offt = NULL;
3327 ssl->nb_zero = 0;
3328 ssl->in_msgtype = 0;
3329 ssl->in_msglen = 0;
3330 ssl->in_hslen = 0;
3331 ssl->keep_current_message = 0;
3332 ssl->transform_in = NULL;
3333
3334#if defined(MBEDTLS_SSL_PROTO_DTLS)
3335 ssl->next_record_offset = 0;
3336 ssl->in_epoch = 0;
3337#endif
3338
3339 /* Keep current datagram if partial == 1 */
3340 if( partial == 0 )
3341 {
3342 ssl->in_left = 0;
3343 memset( ssl->in_buf, 0, in_buf_len );
3344 }
3345
3346 /* Reset outgoing message writing */
3347 ssl->out_msgtype = 0;
3348 ssl->out_msglen = 0;
3349 ssl->out_left = 0;
3350 memset( ssl->out_buf, 0, out_buf_len );
3351 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
3352 ssl->transform_out = NULL;
3353
3354#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3355 mbedtls_ssl_dtls_replay_reset( ssl );
3356#endif
3357
3358 if( ssl->transform )
3359 {
3360 mbedtls_ssl_transform_free( ssl->transform );
3361 mbedtls_free( ssl->transform );
3362 ssl->transform = NULL;
3363 }
3364}
3365
3366int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
3367{
3368 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3369
3370 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3371
3372 ssl_session_reset_msg_layer( ssl, partial );
3373
3374 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003375#if defined(MBEDTLS_SSL_RENEGOTIATION)
3376 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003377 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00003378
3379 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003380 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
3381 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003382#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003383 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00003384
Hanno Beckerb0302c42021-08-03 09:39:42 +01003385 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01003386 ssl->session_out = NULL;
Paul Bakkerc0463502013-02-14 11:19:38 +01003387 if( ssl->session )
3388 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003389 mbedtls_ssl_session_free( ssl->session );
3390 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01003391 ssl->session = NULL;
3392 }
3393
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003394#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02003395 ssl->alpn_chosen = NULL;
3396#endif
3397
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02003398#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01003399#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003400 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01003401#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003402 {
3403 mbedtls_free( ssl->cli_id );
3404 ssl->cli_id = NULL;
3405 ssl->cli_id_len = 0;
3406 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02003407#endif
3408
Paul Bakker48916f92012-09-16 19:57:18 +00003409 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3410 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003411
3412 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00003413}
3414
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02003415/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003416 * Reset an initialized and used SSL context for re-use while retaining
3417 * all application-set variables, function pointers and data.
3418 */
3419int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
3420{
Hanno Becker43aefe22020-02-05 10:44:56 +00003421 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003422}
3423
3424/*
Paul Bakker5121ce52009-01-03 21:22:43 +00003425 * SSL set accessors
3426 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003427void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00003428{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003429 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00003430}
3431
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02003432void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01003433{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003434 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01003435}
3436
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003437#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003438void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003439{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003440 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003441}
3442#endif
3443
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003444void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02003445{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003446 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02003447}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02003448
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003449#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01003450
Hanno Becker1841b0a2018-08-24 11:13:57 +01003451void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
3452 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01003453{
3454 ssl->disable_datagram_packing = !allow_packing;
3455}
3456
3457void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
3458 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02003459{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003460 conf->hs_timeout_min = min;
3461 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02003462}
3463#endif
3464
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003465void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00003466{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003467 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00003468}
3469
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003470#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003471void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02003472 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00003473 void *p_vrfy )
3474{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003475 conf->f_vrfy = f_vrfy;
3476 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00003477}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003478#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00003479
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003480void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00003481 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00003482 void *p_rng )
3483{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003484 conf->f_rng = f_rng;
3485 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00003486}
3487
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003488void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02003489 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00003490 void *p_dbg )
3491{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003492 conf->f_dbg = f_dbg;
3493 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00003494}
3495
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003496void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02003497 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00003498 mbedtls_ssl_send_t *f_send,
3499 mbedtls_ssl_recv_t *f_recv,
3500 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02003501{
3502 ssl->p_bio = p_bio;
3503 ssl->f_send = f_send;
3504 ssl->f_recv = f_recv;
3505 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01003506}
3507
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02003508#if defined(MBEDTLS_SSL_PROTO_DTLS)
3509void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
3510{
3511 ssl->mtu = mtu;
3512}
3513#endif
3514
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003515void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01003516{
3517 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02003518}
3519
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02003520void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
3521 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00003522 mbedtls_ssl_set_timer_t *f_set_timer,
3523 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02003524{
3525 ssl->p_timer = p_timer;
3526 ssl->f_set_timer = f_set_timer;
3527 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003528
3529 /* Make sure we start with no timer running */
Hanno Becker0f57a652020-02-05 10:37:26 +00003530 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02003531}
3532
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003533#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003534void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Hanno Beckera637ff62021-04-15 08:42:48 +01003535 void *p_cache,
3536 mbedtls_ssl_cache_get_t *f_get_cache,
3537 mbedtls_ssl_cache_set_t *f_set_cache )
Paul Bakker5121ce52009-01-03 21:22:43 +00003538{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01003539 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003540 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003541 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00003542}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003543#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00003544
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003545#if defined(MBEDTLS_SSL_CLI_C)
3546int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00003547{
Janos Follath865b3eb2019-12-16 11:46:15 +00003548 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003549
3550 if( ssl == NULL ||
3551 session == NULL ||
3552 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003553 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003555 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003556 }
3557
Hanno Beckere810bbc2021-05-14 16:01:05 +01003558 if( ssl->handshake->resume == 1 )
3559 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3560
Hanno Becker52055ae2019-02-06 14:30:46 +00003561 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
3562 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003563 return( ret );
3564
Paul Bakker0a597072012-09-25 21:55:46 +00003565 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003566
3567 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003568}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003569#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00003570
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01003571void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
3572 const int *ciphersuites )
3573{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01003574 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00003575}
3576
Hanno Becker71f1ed62021-07-24 06:01:47 +01003577#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
Jerry Yucadebe52021-08-24 10:36:45 +08003578void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
Hanno Becker71f1ed62021-07-24 06:01:47 +01003579 const int kex_modes )
3580{
Xiaofei Bai746f9482021-11-12 08:53:56 +00003581 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01003582}
3583#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
3584
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003585#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02003586void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01003587 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02003588{
3589 conf->cert_profile = profile;
3590}
3591
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003592/* Append a new keycert entry to a (possibly empty) list */
3593static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
3594 mbedtls_x509_crt *cert,
3595 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003596{
niisato8ee24222018-06-25 19:05:48 +09003597 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003598
niisato8ee24222018-06-25 19:05:48 +09003599 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
3600 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003601 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003602
niisato8ee24222018-06-25 19:05:48 +09003603 new_cert->cert = cert;
3604 new_cert->key = key;
3605 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003606
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003607 /* Update head is the list was null, else add to the end */
3608 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01003609 {
niisato8ee24222018-06-25 19:05:48 +09003610 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01003611 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003612 else
3613 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003614 mbedtls_ssl_key_cert *cur = *head;
3615 while( cur->next != NULL )
3616 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09003617 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003618 }
3619
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003620 return( 0 );
3621}
3622
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003623int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003624 mbedtls_x509_crt *own_cert,
3625 mbedtls_pk_context *pk_key )
3626{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02003627 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003628}
3629
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003630void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01003631 mbedtls_x509_crt *ca_chain,
3632 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003633{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01003634 conf->ca_chain = ca_chain;
3635 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00003636
3637#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
3638 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
3639 * cannot be used together. */
3640 conf->f_ca_cb = NULL;
3641 conf->p_ca_cb = NULL;
3642#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00003643}
Hanno Becker5adaad92019-03-27 16:54:37 +00003644
3645#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
3646void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00003647 mbedtls_x509_crt_ca_cb_t f_ca_cb,
Hanno Becker5adaad92019-03-27 16:54:37 +00003648 void *p_ca_cb )
3649{
3650 conf->f_ca_cb = f_ca_cb;
3651 conf->p_ca_cb = p_ca_cb;
3652
3653 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
3654 * cannot be used together. */
3655 conf->ca_chain = NULL;
3656 conf->ca_crl = NULL;
3657}
3658#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003659#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00003660
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02003661#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3662int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
3663 mbedtls_x509_crt *own_cert,
3664 mbedtls_pk_context *pk_key )
3665{
3666 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
3667 own_cert, pk_key ) );
3668}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02003669
3670void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
3671 mbedtls_x509_crt *ca_chain,
3672 mbedtls_x509_crl *ca_crl )
3673{
3674 ssl->handshake->sni_ca_chain = ca_chain;
3675 ssl->handshake->sni_ca_crl = ca_crl;
3676}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02003677
3678void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
3679 int authmode )
3680{
3681 ssl->handshake->sni_authmode = authmode;
3682}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02003683#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
3684
Hanno Becker8927c832019-04-03 12:52:50 +01003685#if defined(MBEDTLS_X509_CRT_PARSE_C)
3686void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
3687 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
3688 void *p_vrfy )
3689{
3690 ssl->f_vrfy = f_vrfy;
3691 ssl->p_vrfy = p_vrfy;
3692}
3693#endif
3694
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003695#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02003696/*
3697 * Set EC J-PAKE password for current handshake
3698 */
3699int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
3700 const unsigned char *pw,
3701 size_t pw_len )
3702{
3703 mbedtls_ecjpake_role role;
3704
Janos Follath8eb64132016-06-03 15:40:57 +01003705 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02003706 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3707
3708 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
3709 role = MBEDTLS_ECJPAKE_SERVER;
3710 else
3711 role = MBEDTLS_ECJPAKE_CLIENT;
3712
3713 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
3714 role,
3715 MBEDTLS_MD_SHA256,
3716 MBEDTLS_ECP_DP_SECP256R1,
3717 pw, pw_len ) );
3718}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003719#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02003720
Gilles Peskineeccd8882020-03-10 12:19:08 +01003721#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003722
Hanno Becker2ed3dce2021-04-19 21:59:14 +01003723static int ssl_conf_psk_is_configured( mbedtls_ssl_config const *conf )
3724{
3725#if defined(MBEDTLS_USE_PSA_CRYPTO)
3726 if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
3727 return( 1 );
3728#endif /* MBEDTLS_USE_PSA_CRYPTO */
3729
3730 if( conf->psk != NULL )
3731 return( 1 );
3732
3733 return( 0 );
3734}
3735
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003736static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
3737{
3738 /* Remove reference to existing PSK, if any. */
3739#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02003740 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003741 {
3742 /* The maintenance of the PSK key slot is the
3743 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02003744 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003745 }
Hanno Beckera63ac3f2018-11-05 12:47:16 +00003746 /* This and the following branch should never
3747 * be taken simultaenously as we maintain the
3748 * invariant that raw and opaque PSKs are never
3749 * configured simultaneously. As a safeguard,
3750 * though, `else` is omitted here. */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003751#endif /* MBEDTLS_USE_PSA_CRYPTO */
3752 if( conf->psk != NULL )
3753 {
3754 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
3755
3756 mbedtls_free( conf->psk );
3757 conf->psk = NULL;
3758 conf->psk_len = 0;
3759 }
3760
3761 /* Remove reference to PSK identity, if any. */
3762 if( conf->psk_identity != NULL )
3763 {
3764 mbedtls_free( conf->psk_identity );
3765 conf->psk_identity = NULL;
3766 conf->psk_identity_len = 0;
3767 }
3768}
3769
Hanno Becker7390c712018-11-15 13:33:04 +00003770/* This function assumes that PSK identity in the SSL config is unset.
3771 * It checks that the provided identity is well-formed and attempts
3772 * to make a copy of it in the SSL config.
3773 * On failure, the PSK identity in the config remains unset. */
3774static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
3775 unsigned char const *psk_identity,
3776 size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003777{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003778 /* Identity len will be encoded on two bytes */
Hanno Becker7390c712018-11-15 13:33:04 +00003779 if( psk_identity == NULL ||
3780 ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10003781 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003782 {
3783 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3784 }
3785
Hanno Becker7390c712018-11-15 13:33:04 +00003786 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
3787 if( conf->psk_identity == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003788 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker6db455e2013-09-18 17:29:31 +02003789
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01003790 conf->psk_identity_len = psk_identity_len;
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01003791 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker5ad403f2013-09-18 21:21:30 +02003792
3793 return( 0 );
Paul Bakker6db455e2013-09-18 17:29:31 +02003794}
3795
Hanno Becker7390c712018-11-15 13:33:04 +00003796int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
3797 const unsigned char *psk, size_t psk_len,
3798 const unsigned char *psk_identity, size_t psk_identity_len )
3799{
Janos Follath865b3eb2019-12-16 11:46:15 +00003800 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01003801
3802 /* We currently only support one PSK, raw or opaque. */
3803 if( ssl_conf_psk_is_configured( conf ) )
3804 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Becker7390c712018-11-15 13:33:04 +00003805
3806 /* Check and set raw PSK */
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01003807 if( psk == NULL )
Hanno Becker7390c712018-11-15 13:33:04 +00003808 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01003809 if( psk_len == 0 )
3810 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3811 if( psk_len > MBEDTLS_PSK_MAX_LEN )
3812 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3813
Hanno Becker7390c712018-11-15 13:33:04 +00003814 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
3815 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3816 conf->psk_len = psk_len;
3817 memcpy( conf->psk, psk, conf->psk_len );
3818
3819 /* Check and set PSK Identity */
3820 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
3821 if( ret != 0 )
3822 ssl_conf_remove_psk( conf );
3823
3824 return( ret );
3825}
3826
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003827static void ssl_remove_psk( mbedtls_ssl_context *ssl )
3828{
3829#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02003830 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003831 {
Ronald Croncf56a0a2020-08-04 09:51:30 +02003832 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003833 }
3834 else
3835#endif /* MBEDTLS_USE_PSA_CRYPTO */
3836 if( ssl->handshake->psk != NULL )
3837 {
3838 mbedtls_platform_zeroize( ssl->handshake->psk,
3839 ssl->handshake->psk_len );
3840 mbedtls_free( ssl->handshake->psk );
3841 ssl->handshake->psk_len = 0;
3842 }
3843}
3844
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003845int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
3846 const unsigned char *psk, size_t psk_len )
3847{
3848 if( psk == NULL || ssl->handshake == NULL )
3849 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3850
3851 if( psk_len > MBEDTLS_PSK_MAX_LEN )
3852 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3853
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003854 ssl_remove_psk( ssl );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003855
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003856 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003857 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003858
3859 ssl->handshake->psk_len = psk_len;
3860 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
3861
3862 return( 0 );
3863}
3864
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003865#if defined(MBEDTLS_USE_PSA_CRYPTO)
3866int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003867 psa_key_id_t psk,
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003868 const unsigned char *psk_identity,
3869 size_t psk_identity_len )
3870{
Janos Follath865b3eb2019-12-16 11:46:15 +00003871 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01003872
3873 /* We currently only support one PSK, raw or opaque. */
3874 if( ssl_conf_psk_is_configured( conf ) )
3875 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003876
Hanno Becker7390c712018-11-15 13:33:04 +00003877 /* Check and set opaque PSK */
Ronald Croncf56a0a2020-08-04 09:51:30 +02003878 if( mbedtls_svc_key_id_is_null( psk ) )
Hanno Becker7390c712018-11-15 13:33:04 +00003879 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ronald Croncf56a0a2020-08-04 09:51:30 +02003880 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00003881
3882 /* Check and set PSK Identity */
3883 ret = ssl_conf_set_psk_identity( conf, psk_identity,
3884 psk_identity_len );
3885 if( ret != 0 )
3886 ssl_conf_remove_psk( conf );
3887
3888 return( ret );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003889}
3890
3891int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
Ronald Croncf56a0a2020-08-04 09:51:30 +02003892 psa_key_id_t psk )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003893{
Ronald Croncf56a0a2020-08-04 09:51:30 +02003894 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
Ronald Cronc26f8d42020-09-01 10:51:51 +02003895 ( ssl->handshake == NULL ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003896 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3897
3898 ssl_remove_psk( ssl );
Ronald Croncf56a0a2020-08-04 09:51:30 +02003899 ssl->handshake->psk_opaque = psk;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003900 return( 0 );
3901}
3902#endif /* MBEDTLS_USE_PSA_CRYPTO */
3903
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003904void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003905 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02003906 size_t),
3907 void *p_psk )
3908{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003909 conf->f_psk = f_psk;
3910 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003911}
Gilles Peskineeccd8882020-03-10 12:19:08 +01003912#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00003913
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02003914#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckera90658f2017-10-04 15:29:08 +01003915int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
3916 const unsigned char *dhm_P, size_t P_len,
3917 const unsigned char *dhm_G, size_t G_len )
3918{
Janos Follath865b3eb2019-12-16 11:46:15 +00003919 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01003920
3921 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
3922 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
3923 {
3924 mbedtls_mpi_free( &conf->dhm_P );
3925 mbedtls_mpi_free( &conf->dhm_G );
3926 return( ret );
3927 }
3928
3929 return( 0 );
3930}
Paul Bakker5121ce52009-01-03 21:22:43 +00003931
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003932int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00003933{
Janos Follath865b3eb2019-12-16 11:46:15 +00003934 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00003935
Gilles Peskinee5702482021-06-11 21:59:08 +02003936 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
3937 &conf->dhm_P ) ) != 0 ||
3938 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
3939 &conf->dhm_G ) ) != 0 )
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01003940 {
3941 mbedtls_mpi_free( &conf->dhm_P );
3942 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00003943 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01003944 }
Paul Bakker1b57b062011-01-06 15:48:19 +00003945
3946 return( 0 );
3947}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02003948#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00003949
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02003950#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
3951/*
3952 * Set the minimum length for Diffie-Hellman parameters
3953 */
3954void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
3955 unsigned int bitlen )
3956{
3957 conf->dhm_min_bitlen = bitlen;
3958}
3959#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
3960
Gilles Peskineeccd8882020-03-10 12:19:08 +01003961#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02003962/*
3963 * Set allowed/preferred hashes for handshake signatures
3964 */
3965void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
3966 const int *hashes )
3967{
3968 conf->sig_hashes = hashes;
3969}
Hanno Becker1cd6e002021-08-10 13:27:10 +01003970
3971#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
Jerry Yu7899de82021-08-17 13:09:23 +08003972/* Configure allowed signature algorithms for use in TLS 1.3 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01003973void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
3974 const uint16_t* sig_algs )
3975{
3976 conf->tls13_sig_algs = sig_algs;
3977}
3978#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
Gilles Peskineeccd8882020-03-10 12:19:08 +01003979#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02003980
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02003981#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01003982#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003983/*
3984 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01003985 *
3986 * mbedtls_ssl_setup() takes the provided list
3987 * and translates it to a list of IANA TLS group identifiers,
3988 * stored in ssl->handshake->group_list.
3989 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003990 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003991void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003992 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003993{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003994 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01003995 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003996}
Brett Warrene0edc842021-08-17 09:53:13 +01003997#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01003998#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003999
Brett Warrene0edc842021-08-17 09:53:13 +01004000/*
4001 * Set the allowed groups
4002 */
4003void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
4004 const uint16_t *group_list )
4005{
4006#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4007 conf->curve_list = NULL;
4008#endif
4009 conf->group_list = group_list;
4010}
4011
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01004012#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004013int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00004014{
Hanno Becker947194e2017-04-07 13:25:49 +01004015 /* Initialize to suppress unnecessary compiler warning */
4016 size_t hostname_len = 0;
4017
4018 /* Check if new hostname is valid before
4019 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01004020 if( hostname != NULL )
4021 {
4022 hostname_len = strlen( hostname );
4023
4024 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
4025 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4026 }
4027
4028 /* Now it's clear that we will overwrite the old hostname,
4029 * so we can free it safely */
4030
4031 if( ssl->hostname != NULL )
4032 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004033 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01004034 mbedtls_free( ssl->hostname );
4035 }
4036
4037 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01004038
Paul Bakker5121ce52009-01-03 21:22:43 +00004039 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01004040 {
4041 ssl->hostname = NULL;
4042 }
4043 else
4044 {
4045 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01004046 if( ssl->hostname == NULL )
4047 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02004048
Hanno Becker947194e2017-04-07 13:25:49 +01004049 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02004050
Hanno Becker947194e2017-04-07 13:25:49 +01004051 ssl->hostname[hostname_len] = '\0';
4052 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004053
4054 return( 0 );
4055}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01004056#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00004057
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01004058#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004059void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004060 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00004061 const unsigned char *, size_t),
4062 void *p_sni )
4063{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004064 conf->f_sni = f_sni;
4065 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00004066}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004067#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00004068
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004069#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004070int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004071{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02004072 size_t cur_len, tot_len;
4073 const char **p;
4074
4075 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08004076 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
4077 * MUST NOT be truncated."
4078 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02004079 */
4080 tot_len = 0;
4081 for( p = protos; *p != NULL; p++ )
4082 {
4083 cur_len = strlen( *p );
4084 tot_len += cur_len;
4085
Ronald Cron8216dd32020-04-23 16:41:44 +02004086 if( ( cur_len == 0 ) ||
4087 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
4088 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004089 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02004090 }
4091
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004092 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02004093
4094 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004095}
4096
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004097const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004098{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02004099 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004100}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004101#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004102
Johan Pascalb62bb512015-12-03 21:56:45 +01004103#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldoref72faf2018-07-12 11:54:20 +03004104void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
4105 int support_mki_value )
Ron Eldor591f1622018-01-22 12:30:04 +02004106{
4107 conf->dtls_srtp_mki_support = support_mki_value;
4108}
4109
Ron Eldoref72faf2018-07-12 11:54:20 +03004110int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
4111 unsigned char *mki_value,
Johan Pascalf6417ec2020-09-22 15:15:19 +02004112 uint16_t mki_len )
Ron Eldor591f1622018-01-22 12:30:04 +02004113{
Johan Pascal5ef72d22020-10-28 17:05:47 +01004114 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
Ron Eldora9788042018-12-05 11:04:31 +02004115 {
Johan Pascald576fdb2020-09-22 10:39:53 +02004116 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ron Eldora9788042018-12-05 11:04:31 +02004117 }
Ron Eldor591f1622018-01-22 12:30:04 +02004118
4119 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
Ron Eldora9788042018-12-05 11:04:31 +02004120 {
Johan Pascald576fdb2020-09-22 10:39:53 +02004121 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ron Eldora9788042018-12-05 11:04:31 +02004122 }
Ron Eldor591f1622018-01-22 12:30:04 +02004123
4124 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
4125 ssl->dtls_srtp_info.mki_len = mki_len;
Ron Eldora9788042018-12-05 11:04:31 +02004126 return( 0 );
Ron Eldor591f1622018-01-22 12:30:04 +02004127}
4128
Ron Eldoref72faf2018-07-12 11:54:20 +03004129int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
Johan Pascal253d0262020-09-22 13:04:45 +02004130 const mbedtls_ssl_srtp_profile *profiles )
Johan Pascalb62bb512015-12-03 21:56:45 +01004131{
Johan Pascal253d0262020-09-22 13:04:45 +02004132 const mbedtls_ssl_srtp_profile *p;
4133 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01004134
Johan Pascal253d0262020-09-22 13:04:45 +02004135 /* check the profiles list: all entry must be valid,
4136 * its size cannot be more than the total number of supported profiles, currently 4 */
Johan Pascald387aa02020-09-23 18:47:56 +02004137 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
4138 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
4139 p++ )
Johan Pascald576fdb2020-09-22 10:39:53 +02004140 {
Johan Pascal5ef72d22020-10-28 17:05:47 +01004141 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
Johan Pascald576fdb2020-09-22 10:39:53 +02004142 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02004143 list_size++;
4144 }
4145 else
4146 {
4147 /* unsupported value, stop parsing and set the size to an error value */
4148 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01004149 }
4150 }
4151
Johan Pascal5ef72d22020-10-28 17:05:47 +01004152 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
Johan Pascald387aa02020-09-23 18:47:56 +02004153 {
Johan Pascal253d0262020-09-22 13:04:45 +02004154 conf->dtls_srtp_profile_list = NULL;
4155 conf->dtls_srtp_profile_list_len = 0;
4156 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4157 }
4158
Johan Pascal9bc97ca2020-09-21 23:44:45 +02004159 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02004160 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01004161
4162 return( 0 );
4163}
4164
Johan Pascal5ef72d22020-10-28 17:05:47 +01004165void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
4166 mbedtls_dtls_srtp_info *dtls_srtp_info )
Johan Pascalb62bb512015-12-03 21:56:45 +01004167{
Johan Pascal2258a4f2020-10-28 13:53:09 +01004168 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
4169 /* do not copy the mki value if there is no chosen profile */
Johan Pascal5ef72d22020-10-28 17:05:47 +01004170 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01004171 {
Johan Pascal2258a4f2020-10-28 13:53:09 +01004172 dtls_srtp_info->mki_len = 0;
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01004173 }
Johan Pascal2258a4f2020-10-28 13:53:09 +01004174 else
4175 {
4176 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Johan Pascal5ef72d22020-10-28 17:05:47 +01004177 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
4178 ssl->dtls_srtp_info.mki_len );
Johan Pascal2258a4f2020-10-28 13:53:09 +01004179 }
Johan Pascalb62bb512015-12-03 21:56:45 +01004180}
Johan Pascalb62bb512015-12-03 21:56:45 +01004181#endif /* MBEDTLS_SSL_DTLS_SRTP */
4182
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02004183void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00004184{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004185 conf->max_major_ver = major;
4186 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00004187}
4188
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02004189void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00004190{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004191 conf->min_major_ver = major;
4192 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00004193}
4194
Janos Follath088ce432017-04-10 12:42:31 +01004195#if defined(MBEDTLS_SSL_SRV_C)
4196void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
4197 char cert_req_ca_list )
4198{
4199 conf->cert_req_ca_list = cert_req_ca_list;
4200}
4201#endif
4202
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004203#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004204void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01004205{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004206 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01004207}
4208#endif
4209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004210#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004211void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02004212{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004213 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02004214}
4215#endif
4216
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004217#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004218int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004219{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004220 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10004221 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004222 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004223 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004224 }
4225
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01004226 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004227
4228 return( 0 );
4229}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004230#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004231
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004232void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00004233{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004234 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00004235}
4236
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004237#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004238void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01004239{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004240 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01004241}
4242
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004243void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02004244{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004245 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02004246}
4247
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004248void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01004249 const unsigned char period[8] )
4250{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004251 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01004252}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004253#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00004254
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004255#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004256#if defined(MBEDTLS_SSL_CLI_C)
4257void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02004258{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01004259 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02004260}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004261#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02004262
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004263#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02004264void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
4265 mbedtls_ssl_ticket_write_t *f_ticket_write,
4266 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
4267 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02004268{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02004269 conf->f_ticket_write = f_ticket_write;
4270 conf->f_ticket_parse = f_ticket_parse;
4271 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02004272}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004273#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004274#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02004275
Hanno Becker7e6c1782021-06-08 09:24:55 +01004276void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
4277 mbedtls_ssl_export_keys_t *f_export_keys,
4278 void *p_export_keys )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01004279{
Hanno Becker7e6c1782021-06-08 09:24:55 +01004280 ssl->f_export_keys = f_export_keys;
4281 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03004282}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01004283
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004284#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01004285void mbedtls_ssl_conf_async_private_cb(
4286 mbedtls_ssl_config *conf,
4287 mbedtls_ssl_async_sign_t *f_async_sign,
4288 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
4289 mbedtls_ssl_async_resume_t *f_async_resume,
4290 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004291 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01004292{
4293 conf->f_async_sign_start = f_async_sign;
4294 conf->f_async_decrypt_start = f_async_decrypt;
4295 conf->f_async_resume = f_async_resume;
4296 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004297 conf->p_async_config_data = async_config_data;
4298}
4299
Gilles Peskine8f97af72018-04-26 11:46:10 +02004300void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
4301{
4302 return( conf->p_async_config_data );
4303}
4304
Gilles Peskine1febfef2018-04-30 11:54:39 +02004305void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004306{
4307 if( ssl->handshake == NULL )
4308 return( NULL );
4309 else
4310 return( ssl->handshake->user_async_ctx );
4311}
4312
Gilles Peskine1febfef2018-04-30 11:54:39 +02004313void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004314 void *ctx )
4315{
4316 if( ssl->handshake != NULL )
4317 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01004318}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004319#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01004320
Paul Bakker5121ce52009-01-03 21:22:43 +00004321/*
4322 * SSL get accessors
4323 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02004324uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004325{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00004326 if( ssl->session != NULL )
4327 return( ssl->session->verify_result );
4328
4329 if( ssl->session_negotiate != NULL )
4330 return( ssl->session_negotiate->verify_result );
4331
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02004332 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00004333}
4334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004335const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00004336{
Paul Bakker926c8e42013-03-06 10:23:34 +01004337 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02004338 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01004339
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004340 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00004341}
4342
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004343const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00004344{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004345#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004346 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01004347 {
4348 switch( ssl->minor_ver )
4349 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004350 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01004351 return( "DTLSv1.2" );
4352
4353 default:
4354 return( "unknown (DTLS)" );
4355 }
4356 }
4357#endif
4358
Paul Bakker43ca69c2011-01-15 17:35:19 +00004359 switch( ssl->minor_ver )
4360 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004361 case MBEDTLS_SSL_MINOR_VERSION_3:
Paul Bakker1ef83d62012-04-11 12:09:53 +00004362 return( "TLSv1.2" );
4363
Paul Bakker43ca69c2011-01-15 17:35:19 +00004364 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01004365 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00004366 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00004367}
4368
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004369#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04004370size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
4371{
David Horstmann95d516f2021-05-04 18:36:56 +01004372 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04004373 size_t read_mfl;
4374
4375 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
4376 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
4377 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
4378 {
4379 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
4380 }
4381
4382 /* Check if a smaller max length was negotiated */
4383 if( ssl->session_out != NULL )
4384 {
4385 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
4386 if( read_mfl < max_len )
4387 {
4388 max_len = read_mfl;
4389 }
4390 }
4391
4392 // During a handshake, use the value being negotiated
4393 if( ssl->session_negotiate != NULL )
4394 {
4395 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
4396 if( read_mfl < max_len )
4397 {
4398 max_len = read_mfl;
4399 }
4400 }
4401
4402 return( max_len );
4403}
4404
4405size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004406{
4407 size_t max_len;
4408
4409 /*
4410 * Assume mfl_code is correct since it was checked when set
4411 */
Angus Grattond8213d02016-05-25 20:56:48 +10004412 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004413
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02004414 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004415 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10004416 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004417 {
Angus Grattond8213d02016-05-25 20:56:48 +10004418 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004419 }
4420
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02004421 /* During a handshake, use the value being negotiated */
4422 if( ssl->session_negotiate != NULL &&
4423 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
4424 {
4425 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
4426 }
4427
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004428 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004429}
4430#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4431
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02004432#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00004433size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02004434{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04004435 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
4436 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
4437 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
4438 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
4439 return ( 0 );
4440
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02004441 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
4442 return( ssl->mtu );
4443
4444 if( ssl->mtu == 0 )
4445 return( ssl->handshake->mtu );
4446
4447 return( ssl->mtu < ssl->handshake->mtu ?
4448 ssl->mtu : ssl->handshake->mtu );
4449}
4450#endif /* MBEDTLS_SSL_PROTO_DTLS */
4451
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004452int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
4453{
4454 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
4455
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02004456#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
4457 !defined(MBEDTLS_SSL_PROTO_DTLS)
4458 (void) ssl;
4459#endif
4460
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004461#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04004462 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004463
4464 if( max_len > mfl )
4465 max_len = mfl;
4466#endif
4467
4468#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00004469 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004470 {
Hanno Becker89490712020-02-05 10:50:12 +00004471 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004472 const int ret = mbedtls_ssl_get_record_expansion( ssl );
4473 const size_t overhead = (size_t) ret;
4474
4475 if( ret < 0 )
4476 return( ret );
4477
4478 if( mtu <= overhead )
4479 {
4480 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
4481 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4482 }
4483
4484 if( max_len > mtu - overhead )
4485 max_len = mtu - overhead;
4486 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02004487#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004488
Hanno Becker0defedb2018-08-10 12:35:02 +01004489#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
4490 !defined(MBEDTLS_SSL_PROTO_DTLS)
4491 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004492#endif
4493
4494 return( (int) max_len );
4495}
4496
Hanno Becker2d8e99b2021-04-21 06:19:50 +01004497int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
4498{
4499 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
4500
4501#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4502 (void) ssl;
4503#endif
4504
4505#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4506 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
4507
4508 if( max_len > mfl )
4509 max_len = mfl;
4510#endif
4511
4512 return( (int) max_len );
4513}
4514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004515#if defined(MBEDTLS_X509_CRT_PARSE_C)
4516const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00004517{
4518 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02004519 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00004520
Hanno Beckere6824572019-02-07 13:18:46 +00004521#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +02004522 return( ssl->session->peer_cert );
Hanno Beckere6824572019-02-07 13:18:46 +00004523#else
4524 return( NULL );
4525#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00004526}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004527#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00004528
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004529#if defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerf852b1c2019-02-05 11:42:30 +00004530int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
4531 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004532{
Hanno Beckere810bbc2021-05-14 16:01:05 +01004533 int ret;
4534
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004535 if( ssl == NULL ||
4536 dst == NULL ||
4537 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004538 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004539 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004540 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004541 }
4542
Hanno Beckere810bbc2021-05-14 16:01:05 +01004543 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
4544 * idempotent: Each session can only be exported once.
4545 *
4546 * (This is in preparation for TLS 1.3 support where we will
4547 * need the ability to export multiple sessions (aka tickets),
4548 * which will be achieved by calling mbedtls_ssl_get_session()
4549 * multiple times until it fails.)
4550 *
4551 * Check whether we have already exported the current session,
4552 * and fail if so.
4553 */
4554 if( ssl->session->exported == 1 )
4555 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4556
4557 ret = mbedtls_ssl_session_copy( dst, ssl->session );
4558 if( ret != 0 )
4559 return( ret );
4560
4561 /* Remember that we've exported the session. */
4562 ssl->session->exported = 1;
4563 return( 0 );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004564}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004565#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004566
Paul Bakker5121ce52009-01-03 21:22:43 +00004567/*
Hanno Beckera835da52019-05-16 12:39:07 +01004568 * Define ticket header determining Mbed TLS version
4569 * and structure of the ticket.
4570 */
4571
Hanno Becker94ef3b32019-05-16 12:50:45 +01004572/*
Hanno Becker50b59662019-05-28 14:30:45 +01004573 * Define bitflag determining compile-time settings influencing
4574 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01004575 */
4576
Hanno Becker50b59662019-05-28 14:30:45 +01004577#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01004578#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01004579#else
Hanno Becker3e088662019-05-29 11:10:18 +01004580#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004581#endif /* MBEDTLS_HAVE_TIME */
4582
4583#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01004584#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004585#else
Hanno Becker3e088662019-05-29 11:10:18 +01004586#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004587#endif /* MBEDTLS_X509_CRT_PARSE_C */
4588
4589#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01004590#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004591#else
Hanno Becker3e088662019-05-29 11:10:18 +01004592#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004593#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
4594
4595#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01004596#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004597#else
Hanno Becker3e088662019-05-29 11:10:18 +01004598#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004599#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4600
Hanno Becker94ef3b32019-05-16 12:50:45 +01004601#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01004602#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004603#else
Hanno Becker3e088662019-05-29 11:10:18 +01004604#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004605#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
4606
Hanno Becker94ef3b32019-05-16 12:50:45 +01004607#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4608#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
4609#else
4610#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
4611#endif /* MBEDTLS_SSL_SESSION_TICKETS */
4612
Hanno Becker3e088662019-05-29 11:10:18 +01004613#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
4614#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
4615#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
4616#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01004617#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
4618#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01004619
Hanno Becker50b59662019-05-28 14:30:45 +01004620#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Becker3e088662019-05-29 11:10:18 +01004621 ( (uint16_t) ( \
4622 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
4623 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
4624 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
4625 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
Hanno Becker3e088662019-05-29 11:10:18 +01004626 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Beckerbe34e8e2019-06-04 09:43:16 +01004627 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
Hanno Becker94ef3b32019-05-16 12:50:45 +01004628
Hanno Beckerf8787072019-05-16 12:41:07 +01004629static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01004630 MBEDTLS_VERSION_MAJOR,
4631 MBEDTLS_VERSION_MINOR,
4632 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01004633 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
4634 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
Hanno Beckerf8787072019-05-16 12:41:07 +01004635};
Hanno Beckera835da52019-05-16 12:39:07 +01004636
4637/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004638 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004639 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004640 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004641 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01004642 *
Hanno Beckerdce50972021-08-01 05:39:23 +01004643 * opaque mbedtls_version[3]; // library version: major, minor, patch
4644 * opaque session_format[2]; // library-version specific 16-bit field
4645 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004646 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01004647 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004648 * Note: When updating the format, remember to keep
4649 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004650 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004651 * // In this version, `session_format` determines
4652 * // the setting of those compile-time
4653 * // configuration options which influence
4654 * // the structure of mbedtls_ssl_session.
4655 *
Hanno Beckerfa0d61e2021-08-02 08:56:14 +01004656 * uint8_t minor_ver; // Protocol-version. Possible values:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004657 * // - TLS 1.2 (MBEDTLS_SSL_MINOR_VERSION_3)
4658 *
4659 * select (serialized_session.minor_ver) {
4660 *
4661 * case MBEDTLS_SSL_MINOR_VERSION_3: // TLS 1.2
4662 * serialized_session_tls12 data;
4663 *
4664 * };
4665 *
4666 * } serialized_session;
4667 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004668 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004669
4670#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4671/* Serialization of TLS 1.2 sessions:
4672 *
4673 * struct {
4674 * uint64 start_time;
4675 * uint8 ciphersuite[2]; // defined by the standard
4676 * uint8 compression; // 0 or 1
4677 * uint8 session_id_len; // at most 32
4678 * opaque session_id[32];
4679 * opaque master[48]; // fixed length in the standard
4680 * uint32 verify_result;
4681 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
4682 * opaque ticket<0..2^24-1>; // length 0 means no ticket
4683 * uint32 ticket_lifetime;
4684 * uint8 mfl_code; // up to 255 according to standard
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004685 * uint8 encrypt_then_mac; // 0 or 1
4686 * } serialized_session_tls12;
4687 *
4688 */
4689static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
4690 unsigned char *buf,
4691 size_t buf_len )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004692{
4693 unsigned char *p = buf;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004694 size_t used = 0;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004695
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004696#if defined(MBEDTLS_HAVE_TIME)
4697 uint64_t start;
4698#endif
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004699#if defined(MBEDTLS_X509_CRT_PARSE_C)
4700#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4701 size_t cert_len;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004702#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4703#endif /* MBEDTLS_X509_CRT_PARSE_C */
4704
Hanno Beckera835da52019-05-16 12:39:07 +01004705 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004706 * Time
4707 */
4708#if defined(MBEDTLS_HAVE_TIME)
4709 used += 8;
4710
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004711 if( used <= buf_len )
4712 {
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004713 start = (uint64_t) session->start;
4714
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004715 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
4716 p += 8;
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004717 }
4718#endif /* MBEDTLS_HAVE_TIME */
4719
4720 /*
4721 * Basic mandatory fields
4722 */
4723 used += 2 /* ciphersuite */
4724 + 1 /* compression */
4725 + 1 /* id_len */
4726 + sizeof( session->id )
4727 + sizeof( session->master )
4728 + 4; /* verify_result */
4729
4730 if( used <= buf_len )
4731 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004732 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
4733 p += 2;
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004734
Joe Subbiani2194dc42021-07-14 12:31:31 +01004735 *p++ = MBEDTLS_BYTE_0( session->compression );
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004736
Joe Subbiani2194dc42021-07-14 12:31:31 +01004737 *p++ = MBEDTLS_BYTE_0( session->id_len );
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004738 memcpy( p, session->id, 32 );
4739 p += 32;
4740
4741 memcpy( p, session->master, 48 );
4742 p += 48;
4743
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004744 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
4745 p += 4;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004746 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004747
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004748 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004749 * Peer's end-entity certificate
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004750 */
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004751#if defined(MBEDTLS_X509_CRT_PARSE_C)
4752#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4753 if( session->peer_cert == NULL )
4754 cert_len = 0;
4755 else
4756 cert_len = session->peer_cert->raw.len;
4757
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004758 used += 3 + cert_len;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004759
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004760 if( used <= buf_len )
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004761 {
Joe Subbiani2194dc42021-07-14 12:31:31 +01004762 *p++ = MBEDTLS_BYTE_2( cert_len );
4763 *p++ = MBEDTLS_BYTE_1( cert_len );
4764 *p++ = MBEDTLS_BYTE_0( cert_len );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004765
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004766 if( session->peer_cert != NULL )
4767 {
4768 memcpy( p, session->peer_cert->raw.p, cert_len );
4769 p += cert_len;
4770 }
4771 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004772#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004773 if( session->peer_cert_digest != NULL )
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004774 {
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004775 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
4776 if( used <= buf_len )
4777 {
4778 *p++ = (unsigned char) session->peer_cert_digest_type;
4779 *p++ = (unsigned char) session->peer_cert_digest_len;
4780 memcpy( p, session->peer_cert_digest,
4781 session->peer_cert_digest_len );
4782 p += session->peer_cert_digest_len;
4783 }
4784 }
4785 else
4786 {
4787 used += 2;
4788 if( used <= buf_len )
4789 {
4790 *p++ = (unsigned char) MBEDTLS_MD_NONE;
4791 *p++ = 0;
4792 }
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004793 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004794#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4795#endif /* MBEDTLS_X509_CRT_PARSE_C */
4796
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004797 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004798 * Session ticket if any, plus associated data
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004799 */
4800#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004801 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004802
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004803 if( used <= buf_len )
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004804 {
Joe Subbiani2194dc42021-07-14 12:31:31 +01004805 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
4806 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
4807 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004808
4809 if( session->ticket != NULL )
4810 {
4811 memcpy( p, session->ticket, session->ticket_len );
4812 p += session->ticket_len;
4813 }
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004814
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004815 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
4816 p += 4;
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004817 }
4818#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
4819
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004820 /*
4821 * Misc extension-related info
4822 */
4823#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4824 used += 1;
4825
4826 if( used <= buf_len )
4827 *p++ = session->mfl_code;
4828#endif
4829
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004830#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4831 used += 1;
4832
4833 if( used <= buf_len )
Joe Subbiani2194dc42021-07-14 12:31:31 +01004834 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004835#endif
4836
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004837 return( used );
4838}
4839#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004840
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004841static int ssl_session_save( const mbedtls_ssl_session *session,
4842 unsigned char omit_header,
4843 unsigned char *buf,
4844 size_t buf_len,
4845 size_t *olen )
4846{
4847 unsigned char *p = buf;
4848 size_t used = 0;
4849
4850 if( !omit_header )
4851 {
4852 /*
4853 * Add Mbed TLS version identifier
4854 */
4855
4856 used += sizeof( ssl_serialized_session_header );
4857
4858 if( used <= buf_len )
4859 {
4860 memcpy( p, ssl_serialized_session_header,
4861 sizeof( ssl_serialized_session_header ) );
4862 p += sizeof( ssl_serialized_session_header );
4863 }
4864 }
4865
4866 /*
4867 * TLS version identifier
4868 */
4869 used += 1;
4870 if( used <= buf_len )
4871 {
4872 *p++ = session->minor_ver;
4873 }
4874
4875 /* Forward to version-specific serialization routine. */
4876 switch( session->minor_ver )
4877 {
4878#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4879 case MBEDTLS_SSL_MINOR_VERSION_3:
4880 {
4881 size_t remaining_len = used <= buf_len ? buf_len - used : 0;
4882 used += ssl_session_save_tls12( session, p, remaining_len );
4883 break;
4884 }
4885#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4886
4887 default:
4888 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4889 }
4890
4891 *olen = used;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004892 if( used > buf_len )
4893 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004894
4895 return( 0 );
4896}
4897
4898/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004899 * Public wrapper for ssl_session_save()
4900 */
4901int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
4902 unsigned char *buf,
4903 size_t buf_len,
4904 size_t *olen )
4905{
4906 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
4907}
4908
4909/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004910 * Deserialize session, see mbedtls_ssl_session_save() for format.
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02004911 *
4912 * This internal version is wrapped by a public function that cleans up in
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004913 * case of error, and has an extra option omit_header.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004914 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004915static int ssl_session_load_tls12( mbedtls_ssl_session *session,
4916 const unsigned char *buf,
4917 size_t len )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004918{
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004919#if defined(MBEDTLS_HAVE_TIME)
4920 uint64_t start;
4921#endif
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004922#if defined(MBEDTLS_X509_CRT_PARSE_C)
4923#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4924 size_t cert_len;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004925#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4926#endif /* MBEDTLS_X509_CRT_PARSE_C */
4927
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004928 const unsigned char *p = buf;
4929 const unsigned char * const end = buf + len;
Hanno Beckera835da52019-05-16 12:39:07 +01004930
4931 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004932 * Time
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004933 */
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004934#if defined(MBEDTLS_HAVE_TIME)
4935 if( 8 > (size_t)( end - p ) )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004936 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4937
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004938 start = ( (uint64_t) p[0] << 56 ) |
4939 ( (uint64_t) p[1] << 48 ) |
4940 ( (uint64_t) p[2] << 40 ) |
4941 ( (uint64_t) p[3] << 32 ) |
4942 ( (uint64_t) p[4] << 24 ) |
4943 ( (uint64_t) p[5] << 16 ) |
4944 ( (uint64_t) p[6] << 8 ) |
4945 ( (uint64_t) p[7] );
4946 p += 8;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004947
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004948 session->start = (time_t) start;
4949#endif /* MBEDTLS_HAVE_TIME */
4950
4951 /*
4952 * Basic mandatory fields
4953 */
4954 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
4955 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4956
4957 session->ciphersuite = ( p[0] << 8 ) | p[1];
4958 p += 2;
4959
4960 session->compression = *p++;
4961
4962 session->id_len = *p++;
4963 memcpy( session->id, p, 32 );
4964 p += 32;
4965
4966 memcpy( session->master, p, 48 );
4967 p += 48;
4968
4969 session->verify_result = ( (uint32_t) p[0] << 24 ) |
4970 ( (uint32_t) p[1] << 16 ) |
4971 ( (uint32_t) p[2] << 8 ) |
4972 ( (uint32_t) p[3] );
4973 p += 4;
4974
4975 /* Immediately clear invalid pointer values that have been read, in case
4976 * we exit early before we replaced them with valid ones. */
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004977#if defined(MBEDTLS_X509_CRT_PARSE_C)
4978#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4979 session->peer_cert = NULL;
4980#else
4981 session->peer_cert_digest = NULL;
4982#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4983#endif /* MBEDTLS_X509_CRT_PARSE_C */
4984#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
4985 session->ticket = NULL;
4986#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
4987
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004988 /*
4989 * Peer certificate
4990 */
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004991#if defined(MBEDTLS_X509_CRT_PARSE_C)
4992#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4993 /* Deserialize CRT from the end of the ticket. */
4994 if( 3 > (size_t)( end - p ) )
4995 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4996
4997 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
4998 p += 3;
4999
5000 if( cert_len != 0 )
5001 {
Janos Follath865b3eb2019-12-16 11:46:15 +00005002 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005003
5004 if( cert_len > (size_t)( end - p ) )
5005 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5006
5007 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
5008
5009 if( session->peer_cert == NULL )
5010 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5011
5012 mbedtls_x509_crt_init( session->peer_cert );
5013
5014 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
5015 p, cert_len ) ) != 0 )
5016 {
5017 mbedtls_x509_crt_free( session->peer_cert );
5018 mbedtls_free( session->peer_cert );
5019 session->peer_cert = NULL;
5020 return( ret );
5021 }
5022
5023 p += cert_len;
5024 }
5025#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5026 /* Deserialize CRT digest from the end of the ticket. */
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005027 if( 2 > (size_t)( end - p ) )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005028 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5029
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005030 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
5031 session->peer_cert_digest_len = (size_t) *p++;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005032
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005033 if( session->peer_cert_digest_len != 0 )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005034 {
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005035 const mbedtls_md_info_t *md_info =
5036 mbedtls_md_info_from_type( session->peer_cert_digest_type );
5037 if( md_info == NULL )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005038 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005039 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
5040 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005041
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005042 if( session->peer_cert_digest_len > (size_t)( end - p ) )
5043 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5044
5045 session->peer_cert_digest =
5046 mbedtls_calloc( 1, session->peer_cert_digest_len );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005047 if( session->peer_cert_digest == NULL )
5048 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5049
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005050 memcpy( session->peer_cert_digest, p,
5051 session->peer_cert_digest_len );
5052 p += session->peer_cert_digest_len;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005053 }
5054#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5055#endif /* MBEDTLS_X509_CRT_PARSE_C */
5056
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005057 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005058 * Session ticket and associated data
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005059 */
5060#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5061 if( 3 > (size_t)( end - p ) )
5062 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5063
5064 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5065 p += 3;
5066
5067 if( session->ticket_len != 0 )
5068 {
5069 if( session->ticket_len > (size_t)( end - p ) )
5070 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5071
5072 session->ticket = mbedtls_calloc( 1, session->ticket_len );
5073 if( session->ticket == NULL )
5074 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5075
5076 memcpy( session->ticket, p, session->ticket_len );
5077 p += session->ticket_len;
5078 }
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005079
5080 if( 4 > (size_t)( end - p ) )
5081 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5082
5083 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
5084 ( (uint32_t) p[1] << 16 ) |
5085 ( (uint32_t) p[2] << 8 ) |
5086 ( (uint32_t) p[3] );
5087 p += 4;
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005088#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5089
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005090 /*
5091 * Misc extension-related info
5092 */
5093#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5094 if( 1 > (size_t)( end - p ) )
5095 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5096
5097 session->mfl_code = *p++;
5098#endif
5099
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005100#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5101 if( 1 > (size_t)( end - p ) )
5102 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5103
5104 session->encrypt_then_mac = *p++;
5105#endif
5106
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005107 /* Done, should have consumed entire buffer */
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005108 if( p != end )
5109 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5110
5111 return( 0 );
5112}
5113
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01005114static int ssl_session_load( mbedtls_ssl_session *session,
5115 unsigned char omit_header,
5116 const unsigned char *buf,
5117 size_t len )
5118{
5119 const unsigned char *p = buf;
5120 const unsigned char * const end = buf + len;
5121
5122 if( !omit_header )
5123 {
5124 /*
5125 * Check Mbed TLS version identifier
5126 */
5127
5128 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
5129 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5130
5131 if( memcmp( p, ssl_serialized_session_header,
5132 sizeof( ssl_serialized_session_header ) ) != 0 )
5133 {
5134 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
5135 }
5136 p += sizeof( ssl_serialized_session_header );
5137 }
5138
5139 /*
5140 * TLS version identifier
5141 */
5142 if( 1 > (size_t)( end - p ) )
5143 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5144 session->minor_ver = *p++;
5145
5146 /* Dispatch according to TLS version. */
5147 switch( session->minor_ver )
5148 {
5149#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5150 case MBEDTLS_SSL_MINOR_VERSION_3: /* TLS 1.2 */
5151 {
5152 size_t remaining_len = ( end - p );
5153 return( ssl_session_load_tls12( session, p, remaining_len ) );
5154 }
5155#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5156
5157 default:
5158 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5159 }
5160}
5161
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005162/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02005163 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02005164 */
5165int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
5166 const unsigned char *buf,
5167 size_t len )
5168{
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005169 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02005170
5171 if( ret != 0 )
5172 mbedtls_ssl_session_free( session );
5173
5174 return( ret );
5175}
5176
5177/*
Paul Bakker1961b702013-01-25 14:49:24 +01005178 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00005179 */
Hanno Becker41934dd2021-08-07 19:13:43 +01005180static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
5181{
5182 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5183
5184 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
5185 return( ret );
5186
5187#if defined(MBEDTLS_SSL_PROTO_DTLS)
5188 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5189 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
5190 {
5191 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
5192 return( ret );
5193 }
5194#endif /* MBEDTLS_SSL_PROTO_DTLS */
5195
5196 return( ret );
5197}
5198
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005199int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005200{
Hanno Becker41934dd2021-08-07 19:13:43 +01005201 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00005202
Hanno Becker41934dd2021-08-07 19:13:43 +01005203 if( ssl == NULL ||
5204 ssl->conf == NULL ||
5205 ssl->handshake == NULL ||
5206 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
5207 {
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005208 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker41934dd2021-08-07 19:13:43 +01005209 }
5210
5211 ret = ssl_prepare_handshake_step( ssl );
5212 if( ret != 0 )
5213 return( ret );
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005214
Jerry Yue7047812021-09-13 19:26:39 +08005215 ret = mbedtls_ssl_handle_pending_alert( ssl );
5216 if( ret != 0 )
5217 goto cleanup;
5218
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005219#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005220 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Jerry Yub9930e72021-08-06 17:11:51 +08005221 {
5222#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
5223 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yuf4436812021-08-26 22:59:56 +08005224 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
Jerry Yub9930e72021-08-06 17:11:51 +08005225#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
5226
5227#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5228 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
5229 ret = mbedtls_ssl_handshake_client_step( ssl );
5230#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5231 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005232#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005233#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005234 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Jerry Yub9930e72021-08-06 17:11:51 +08005235 {
5236#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
5237 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yu27561932021-08-27 17:07:38 +08005238 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
Jerry Yub9930e72021-08-06 17:11:51 +08005239#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
5240
5241#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5242 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
5243 ret = mbedtls_ssl_handshake_server_step( ssl );
5244#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5245 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005246#endif
5247
Jerry Yue7047812021-09-13 19:26:39 +08005248 if( ret != 0 )
5249 {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005250 /* handshake_step return error. And it is same
5251 * with alert_reason.
5252 */
Jerry Yu3bf1f972021-09-22 21:37:18 +08005253 if( ssl->send_alert )
Jerry Yue7047812021-09-13 19:26:39 +08005254 {
Jerry Yu3bf1f972021-09-22 21:37:18 +08005255 ret = mbedtls_ssl_handle_pending_alert( ssl );
Jerry Yue7047812021-09-13 19:26:39 +08005256 goto cleanup;
5257 }
5258 }
5259
5260cleanup:
Paul Bakker1961b702013-01-25 14:49:24 +01005261 return( ret );
5262}
5263
5264/*
5265 * Perform the SSL handshake
5266 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005267int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01005268{
5269 int ret = 0;
5270
Hanno Beckera817ea42020-10-20 15:20:23 +01005271 /* Sanity checks */
5272
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005273 if( ssl == NULL || ssl->conf == NULL )
5274 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5275
Hanno Beckera817ea42020-10-20 15:20:23 +01005276#if defined(MBEDTLS_SSL_PROTO_DTLS)
5277 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5278 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
5279 {
5280 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
5281 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
5282 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5283 }
5284#endif /* MBEDTLS_SSL_PROTO_DTLS */
5285
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005286 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01005287
Hanno Beckera817ea42020-10-20 15:20:23 +01005288 /* Main handshake loop */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005289 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +01005290 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005291 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01005292
5293 if( ret != 0 )
5294 break;
5295 }
5296
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005297 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005298
5299 return( ret );
5300}
5301
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005302#if defined(MBEDTLS_SSL_RENEGOTIATION)
5303#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00005304/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005305 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00005306 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005307static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005308{
Janos Follath865b3eb2019-12-16 11:46:15 +00005309 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005311 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005312
5313 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005314 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5315 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005316
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005317 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005318 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005319 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005320 return( ret );
5321 }
5322
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005323 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005324
5325 return( 0 );
5326}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005327#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005328
5329/*
5330 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005331 * - any side: calling mbedtls_ssl_renegotiate(),
5332 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
5333 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02005334 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005335 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005336 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005337 */
Hanno Becker40cdaa12020-02-05 10:48:27 +00005338int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00005339{
Janos Follath865b3eb2019-12-16 11:46:15 +00005340 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00005341
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005342 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005343
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005344 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
5345 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00005346
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02005347 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
5348 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005349#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005350 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005351 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02005352 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005353 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005354 ssl->handshake->out_msg_seq = 1;
5355 else
5356 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02005357 }
5358#endif
5359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005360 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
5361 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00005362
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005363 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00005364 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005365 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00005366 return( ret );
5367 }
5368
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005369 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005370
5371 return( 0 );
5372}
5373
5374/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005375 * Renegotiate current connection on client,
5376 * or request renegotiation on server
5377 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005378int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005379{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005380 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005381
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005382 if( ssl == NULL || ssl->conf == NULL )
5383 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5384
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005385#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005386 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005387 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005388 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005389 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5390 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005391
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005392 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02005393
5394 /* Did we already try/start sending HelloRequest? */
5395 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005396 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02005397
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005398 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005399 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005400#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005401
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005402#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005403 /*
5404 * On client, either start the renegotiation process or,
5405 * if already in progress, continue the handshake
5406 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005407 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005408 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005409 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5410 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005411
Hanno Becker40cdaa12020-02-05 10:48:27 +00005412 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005413 {
Hanno Becker40cdaa12020-02-05 10:48:27 +00005414 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005415 return( ret );
5416 }
5417 }
5418 else
5419 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005420 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005421 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005422 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005423 return( ret );
5424 }
5425 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005426#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005427
Paul Bakker37ce0ff2013-10-31 14:32:04 +01005428 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005429}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005430#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005431
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005432#if defined(MBEDTLS_X509_CRT_PARSE_C)
5433static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005434{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005435 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005436
5437 while( cur != NULL )
5438 {
5439 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005440 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005441 cur = next;
5442 }
5443}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005444#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005445
Gilles Peskine9b562d52018-04-25 20:32:43 +02005446void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00005447{
Gilles Peskine9b562d52018-04-25 20:32:43 +02005448 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
5449
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005450 if( handshake == NULL )
5451 return;
5452
Brett Warrene0edc842021-08-17 09:53:13 +01005453#if defined(MBEDTLS_ECP_C)
5454#if !defined(MBEDTLS_DEPRECATED_REMOVED)
5455 if ( ssl->handshake->group_list_heap_allocated )
5456 mbedtls_free( (void*) handshake->group_list );
5457 handshake->group_list = NULL;
5458#endif /* MBEDTLS_DEPRECATED_REMOVED */
5459#endif /* MBEDTLS_ECP_C */
5460
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02005461#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
5462 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
5463 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02005464 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02005465 handshake->async_in_progress = 0;
5466 }
5467#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
5468
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02005469#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5470#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05005471#if defined(MBEDTLS_USE_PSA_CRYPTO)
5472 psa_hash_abort( &handshake->fin_sha256_psa );
5473#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02005474 mbedtls_sha256_free( &handshake->fin_sha256 );
5475#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05005476#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02005477#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05005478#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05005479 psa_hash_abort( &handshake->fin_sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05005480#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02005481 mbedtls_sha512_free( &handshake->fin_sha512 );
5482#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05005483#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02005484#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5485
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005486#if defined(MBEDTLS_DHM_C)
5487 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00005488#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005489#if defined(MBEDTLS_ECDH_C)
5490 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02005491#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02005492#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02005493 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02005494#if defined(MBEDTLS_SSL_CLI_C)
5495 mbedtls_free( handshake->ecjpake_cache );
5496 handshake->ecjpake_cache = NULL;
5497 handshake->ecjpake_cache_len = 0;
5498#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02005499#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02005500
Janos Follath4ae5c292016-02-10 11:27:43 +00005501#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
5502 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02005503 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005504 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02005505#endif
5506
Gilles Peskineeccd8882020-03-10 12:19:08 +01005507#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01005508 if( handshake->psk != NULL )
5509 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05005510 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01005511 mbedtls_free( handshake->psk );
5512 }
5513#endif
5514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005515#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
5516 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02005517 /*
5518 * Free only the linked list wrapper, not the keys themselves
5519 * since the belong to the SNI callback
5520 */
5521 if( handshake->sni_key_cert != NULL )
5522 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005523 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02005524
5525 while( cur != NULL )
5526 {
5527 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005528 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02005529 cur = next;
5530 }
5531 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005532#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005533
Gilles Peskineeccd8882020-03-10 12:19:08 +01005534#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02005535 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Becker3dad3112019-02-05 17:19:52 +00005536 if( handshake->ecrs_peer_cert != NULL )
5537 {
5538 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
5539 mbedtls_free( handshake->ecrs_peer_cert );
5540 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02005541#endif
5542
Hanno Becker75173122019-02-06 16:18:31 +00005543#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
5544 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5545 mbedtls_pk_free( &handshake->peer_pubkey );
5546#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5547
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005548#if defined(MBEDTLS_SSL_PROTO_DTLS)
5549 mbedtls_free( handshake->verify_cookie );
Hanno Becker533ab5f2020-02-05 10:49:13 +00005550 mbedtls_ssl_flight_free( handshake->flight );
5551 mbedtls_ssl_buffering_free( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02005552#endif
5553
Hanno Becker4a63ed42019-01-08 11:39:35 +00005554#if defined(MBEDTLS_ECDH_C) && \
5555 defined(MBEDTLS_USE_PSA_CRYPTO)
5556 psa_destroy_key( handshake->ecdh_psa_privkey );
5557#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
5558
Jerry Yuba9c7272021-10-30 11:54:10 +08005559#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
Jerry Yua1a568c2021-11-09 10:17:21 +08005560 mbedtls_ssl_transform_free( handshake->transform_handshake );
5561 mbedtls_ssl_transform_free( handshake->transform_earlydata );
Jerry Yuba9c7272021-10-30 11:54:10 +08005562 mbedtls_free( handshake->transform_earlydata );
5563 mbedtls_free( handshake->transform_handshake );
Jerry Yuba9c7272021-10-30 11:54:10 +08005564#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
5565
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05005566
5567#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
5568 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
5569 * processes datagrams and the fact that a datagram is allowed to have
5570 * several records in it, it is possible that the I/O buffers are not
5571 * empty at this stage */
Andrzej Kurek4a063792020-10-21 15:08:44 +02005572 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
5573 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05005574#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01005575
Jerry Yuba9c7272021-10-30 11:54:10 +08005576 /* mbedtls_platform_zeroize MUST be last one in this function */
5577 mbedtls_platform_zeroize( handshake,
5578 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005579}
5580
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005581void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00005582{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005583 if( session == NULL )
5584 return;
5585
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005586#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker1294a0b2019-02-05 12:38:15 +00005587 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +02005588#endif
Paul Bakker0a597072012-09-25 21:55:46 +00005589
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02005590#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005591 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02005592#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02005593
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05005594 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005595}
5596
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02005597#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005598
5599#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5600#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
5601#else
5602#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
5603#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5604
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005605#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005606
5607#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5608#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
5609#else
5610#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
5611#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5612
5613#if defined(MBEDTLS_SSL_ALPN)
5614#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
5615#else
5616#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
5617#endif /* MBEDTLS_SSL_ALPN */
5618
5619#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
5620#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
5621#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
5622#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
5623
5624#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
5625 ( (uint32_t) ( \
5626 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
5627 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
5628 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
5629 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
5630 0u ) )
5631
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005632static unsigned char ssl_serialized_context_header[] = {
5633 MBEDTLS_VERSION_MAJOR,
5634 MBEDTLS_VERSION_MINOR,
5635 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01005636 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5637 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5638 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5639 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5640 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005641};
5642
Paul Bakker5121ce52009-01-03 21:22:43 +00005643/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005644 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02005645 *
5646 * The format of the serialized data is:
5647 * (in the presentation language of TLS, RFC 8446 section 3)
5648 *
5649 * // header
5650 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005651 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02005652 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005653 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005654 * Note: When updating the format, remember to keep these
5655 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02005656 *
5657 * // session sub-structure
5658 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
5659 * // transform sub-structure
5660 * uint8 random[64]; // ServerHello.random+ClientHello.random
5661 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
5662 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
5663 * // fields from ssl_context
5664 * uint32 badmac_seen; // DTLS: number of records with failing MAC
5665 * uint64 in_window_top; // DTLS: last validated record seq_num
5666 * uint64 in_window; // DTLS: bitmask for replay protection
5667 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
5668 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
5669 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
5670 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
5671 *
5672 * Note that many fields of the ssl_context or sub-structures are not
5673 * serialized, as they fall in one of the following categories:
5674 *
5675 * 1. forced value (eg in_left must be 0)
5676 * 2. pointer to dynamically-allocated memory (eg session, transform)
5677 * 3. value can be re-derived from other data (eg session keys from MS)
5678 * 4. value was temporary (eg content of input buffer)
5679 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005680 */
5681int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
5682 unsigned char *buf,
5683 size_t buf_len,
5684 size_t *olen )
5685{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005686 unsigned char *p = buf;
5687 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005688 size_t session_len;
5689 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005690
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02005691 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005692 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
5693 * this function's documentation.
5694 *
5695 * These are due to assumptions/limitations in the implementation. Some of
5696 * them are likely to stay (no handshake in progress) some might go away
5697 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02005698 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005699 /* The initial handshake must be over */
5700 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005701 {
5702 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02005703 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005704 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005705 if( ssl->handshake != NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005706 {
5707 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005708 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005709 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005710 /* Double-check that sub-structures are indeed ready */
5711 if( ssl->transform == NULL || ssl->session == NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005712 {
5713 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005714 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005715 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005716 /* There must be no pending incoming or outgoing data */
5717 if( mbedtls_ssl_check_pending( ssl ) != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005718 {
5719 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005720 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005721 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005722 if( ssl->out_left != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005723 {
5724 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005725 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005726 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005727 /* Protocol must be DLTS, not TLS */
5728 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005729 {
5730 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005731 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005732 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005733 /* Version must be 1.2 */
5734 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005735 {
5736 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005737 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005738 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005739 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005740 {
5741 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005742 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005743 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005744 /* We must be using an AEAD ciphersuite */
5745 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005746 {
5747 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005748 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005749 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005750 /* Renegotiation must not be enabled */
5751#if defined(MBEDTLS_SSL_RENEGOTIATION)
5752 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005753 {
5754 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005755 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005756 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005757#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005758
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005759 /*
5760 * Version and format identifier
5761 */
5762 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005763
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005764 if( used <= buf_len )
5765 {
5766 memcpy( p, ssl_serialized_context_header,
5767 sizeof( ssl_serialized_context_header ) );
5768 p += sizeof( ssl_serialized_context_header );
5769 }
5770
5771 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005772 * Session (length + data)
5773 */
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005774 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005775 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
5776 return( ret );
5777
5778 used += 4 + session_len;
5779 if( used <= buf_len )
5780 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005781 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
5782 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005783
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005784 ret = ssl_session_save( ssl->session, 1,
5785 p, session_len, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005786 if( ret != 0 )
5787 return( ret );
5788
5789 p += session_len;
5790 }
5791
5792 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005793 * Transform
5794 */
5795 used += sizeof( ssl->transform->randbytes );
5796 if( used <= buf_len )
5797 {
5798 memcpy( p, ssl->transform->randbytes,
5799 sizeof( ssl->transform->randbytes ) );
5800 p += sizeof( ssl->transform->randbytes );
5801 }
5802
5803#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5804 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
5805 if( used <= buf_len )
5806 {
5807 *p++ = ssl->transform->in_cid_len;
5808 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
5809 p += ssl->transform->in_cid_len;
5810
5811 *p++ = ssl->transform->out_cid_len;
5812 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
5813 p += ssl->transform->out_cid_len;
5814 }
5815#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5816
5817 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005818 * Saved fields from top-level ssl_context structure
5819 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005820 used += 4;
5821 if( used <= buf_len )
5822 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005823 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
5824 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005825 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005826
5827#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5828 used += 16;
5829 if( used <= buf_len )
5830 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005831 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
5832 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005833
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005834 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
5835 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005836 }
5837#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5838
5839#if defined(MBEDTLS_SSL_PROTO_DTLS)
5840 used += 1;
5841 if( used <= buf_len )
5842 {
5843 *p++ = ssl->disable_datagram_packing;
5844 }
5845#endif /* MBEDTLS_SSL_PROTO_DTLS */
5846
Jerry Yuae0b2e22021-10-08 15:21:19 +08005847 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005848 if( used <= buf_len )
5849 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08005850 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
5851 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005852 }
5853
5854#if defined(MBEDTLS_SSL_PROTO_DTLS)
5855 used += 2;
5856 if( used <= buf_len )
5857 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005858 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
5859 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005860 }
5861#endif /* MBEDTLS_SSL_PROTO_DTLS */
5862
5863#if defined(MBEDTLS_SSL_ALPN)
5864 {
5865 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnardf041f4e2019-07-24 00:58:27 +02005866 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005867 : 0;
5868
5869 used += 1 + alpn_len;
5870 if( used <= buf_len )
5871 {
5872 *p++ = alpn_len;
5873
5874 if( ssl->alpn_chosen != NULL )
5875 {
5876 memcpy( p, ssl->alpn_chosen, alpn_len );
5877 p += alpn_len;
5878 }
5879 }
5880 }
5881#endif /* MBEDTLS_SSL_ALPN */
5882
5883 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005884 * Done
5885 */
5886 *olen = used;
5887
5888 if( used > buf_len )
5889 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005890
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005891 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
5892
Hanno Becker43aefe22020-02-05 10:44:56 +00005893 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005894}
5895
5896/*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005897 * Helper to get TLS 1.2 PRF from ciphersuite
5898 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
5899 */
5900typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
5901 const char *label,
5902 const unsigned char *random, size_t rlen,
5903 unsigned char *dstbuf, size_t dlen );
5904static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
5905{
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02005906#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005907 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5908 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
5909
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02005910 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
5911 return( tls_prf_sha384 );
Jarno Lamsab7b486c2019-08-21 15:30:44 +03005912#else
5913 (void) ciphersuite_id;
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02005914#endif
5915 return( tls_prf_sha256 );
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005916}
5917
5918/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02005919 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005920 *
5921 * This internal version is wrapped by a public function that cleans up in
5922 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005923 */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005924static int ssl_context_load( mbedtls_ssl_context *ssl,
5925 const unsigned char *buf,
5926 size_t len )
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005927{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005928 const unsigned char *p = buf;
5929 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005930 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00005931 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005932
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005933 /*
5934 * The context should have been freshly setup or reset.
5935 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02005936 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005937 * renegotiating, or if the user mistakenly loaded a session first.)
5938 */
5939 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
5940 ssl->session != NULL )
5941 {
5942 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5943 }
5944
5945 /*
5946 * We can't check that the config matches the initial one, but we can at
5947 * least check it matches the requirements for serializing.
5948 */
5949 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
5950 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
5951 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 ||
5952 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ||
5953 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 ||
5954#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02005955 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005956#endif
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02005957 0 )
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005958 {
5959 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5960 }
5961
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005962 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
5963
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005964 /*
5965 * Check version identifier
5966 */
5967 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
5968 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5969
5970 if( memcmp( p, ssl_serialized_context_header,
5971 sizeof( ssl_serialized_context_header ) ) != 0 )
5972 {
5973 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
5974 }
5975 p += sizeof( ssl_serialized_context_header );
5976
5977 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005978 * Session
5979 */
5980 if( (size_t)( end - p ) < 4 )
5981 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5982
5983 session_len = ( (size_t) p[0] << 24 ) |
5984 ( (size_t) p[1] << 16 ) |
5985 ( (size_t) p[2] << 8 ) |
5986 ( (size_t) p[3] );
5987 p += 4;
5988
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005989 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00005990 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005991 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005992 ssl->session_in = ssl->session;
5993 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005994 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005995
5996 if( (size_t)( end - p ) < session_len )
5997 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5998
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005999 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006000 if( ret != 0 )
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02006001 {
6002 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006003 return( ret );
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02006004 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006005
6006 p += session_len;
6007
6008 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006009 * Transform
6010 */
6011
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006012 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00006013 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006014 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006015 ssl->transform_in = ssl->transform;
6016 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006017 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006018
6019 /* Read random bytes and populate structure */
6020 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
6021 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6022
Hanno Beckerbd257552021-03-22 06:59:27 +00006023 ret = ssl_tls12_populate_transform( ssl->transform,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006024 ssl->session->ciphersuite,
6025 ssl->session->master,
Hanno Beckerbd257552021-03-22 06:59:27 +00006026#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
6027 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006028 ssl->session->encrypt_then_mac,
Hanno Beckerbd257552021-03-22 06:59:27 +00006029#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
6030 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006031 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
6032 p, /* currently pointing to randbytes */
6033 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
6034 ssl->conf->endpoint,
6035 ssl );
6036 if( ret != 0 )
6037 return( ret );
6038
6039 p += sizeof( ssl->transform->randbytes );
6040
6041#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6042 /* Read connection IDs and store them */
6043 if( (size_t)( end - p ) < 1 )
6044 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6045
6046 ssl->transform->in_cid_len = *p++;
6047
Manuel Pégourié-Gonnard5ea13b82019-07-23 15:02:54 +02006048 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006049 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6050
6051 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
6052 p += ssl->transform->in_cid_len;
6053
6054 ssl->transform->out_cid_len = *p++;
6055
6056 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
6057 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6058
6059 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
6060 p += ssl->transform->out_cid_len;
6061#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6062
6063 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006064 * Saved fields from top-level ssl_context structure
6065 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006066 if( (size_t)( end - p ) < 4 )
6067 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6068
6069 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
6070 ( (uint32_t) p[1] << 16 ) |
6071 ( (uint32_t) p[2] << 8 ) |
6072 ( (uint32_t) p[3] );
6073 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006074
6075#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6076 if( (size_t)( end - p ) < 16 )
6077 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6078
6079 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
6080 ( (uint64_t) p[1] << 48 ) |
6081 ( (uint64_t) p[2] << 40 ) |
6082 ( (uint64_t) p[3] << 32 ) |
6083 ( (uint64_t) p[4] << 24 ) |
6084 ( (uint64_t) p[5] << 16 ) |
6085 ( (uint64_t) p[6] << 8 ) |
6086 ( (uint64_t) p[7] );
6087 p += 8;
6088
6089 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
6090 ( (uint64_t) p[1] << 48 ) |
6091 ( (uint64_t) p[2] << 40 ) |
6092 ( (uint64_t) p[3] << 32 ) |
6093 ( (uint64_t) p[4] << 24 ) |
6094 ( (uint64_t) p[5] << 16 ) |
6095 ( (uint64_t) p[6] << 8 ) |
6096 ( (uint64_t) p[7] );
6097 p += 8;
6098#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6099
6100#if defined(MBEDTLS_SSL_PROTO_DTLS)
6101 if( (size_t)( end - p ) < 1 )
6102 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6103
6104 ssl->disable_datagram_packing = *p++;
6105#endif /* MBEDTLS_SSL_PROTO_DTLS */
6106
Jerry Yud9a94fe2021-09-28 18:58:59 +08006107 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006108 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yud9a94fe2021-09-28 18:58:59 +08006109 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
6110 p += sizeof( ssl->cur_out_ctr );
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006111
6112#if defined(MBEDTLS_SSL_PROTO_DTLS)
6113 if( (size_t)( end - p ) < 2 )
6114 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6115
6116 ssl->mtu = ( p[0] << 8 ) | p[1];
6117 p += 2;
6118#endif /* MBEDTLS_SSL_PROTO_DTLS */
6119
6120#if defined(MBEDTLS_SSL_ALPN)
6121 {
6122 uint8_t alpn_len;
6123 const char **cur;
6124
6125 if( (size_t)( end - p ) < 1 )
6126 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6127
6128 alpn_len = *p++;
6129
6130 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
6131 {
6132 /* alpn_chosen should point to an item in the configured list */
6133 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
6134 {
6135 if( strlen( *cur ) == alpn_len &&
6136 memcmp( p, cur, alpn_len ) == 0 )
6137 {
6138 ssl->alpn_chosen = *cur;
6139 break;
6140 }
6141 }
6142 }
6143
6144 /* can only happen on conf mismatch */
6145 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
6146 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6147
6148 p += alpn_len;
6149 }
6150#endif /* MBEDTLS_SSL_ALPN */
6151
6152 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02006153 * Forced fields from top-level ssl_context structure
6154 *
6155 * Most of them already set to the correct value by mbedtls_ssl_init() and
6156 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
6157 */
6158 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
6159
6160 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6161 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6162
Hanno Becker361b10d2019-08-30 10:42:49 +01006163 /* Adjust pointers for header fields of outgoing records to
6164 * the given transform, accounting for explicit IV and CID. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00006165 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
Hanno Becker361b10d2019-08-30 10:42:49 +01006166
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02006167#if defined(MBEDTLS_SSL_PROTO_DTLS)
6168 ssl->in_epoch = 1;
6169#endif
6170
6171 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
6172 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00006173 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
6174 * inappropriately. */
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02006175 if( ssl->handshake != NULL )
6176 {
6177 mbedtls_ssl_handshake_free( ssl );
6178 mbedtls_free( ssl->handshake );
6179 ssl->handshake = NULL;
6180 }
6181
6182 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02006183 * Done - should have consumed entire buffer
6184 */
6185 if( p != end )
6186 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02006187
6188 return( 0 );
6189}
6190
6191/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02006192 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006193 */
6194int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
6195 const unsigned char *buf,
6196 size_t len )
6197{
6198 int ret = ssl_context_load( context, buf, len );
6199
6200 if( ret != 0 )
6201 mbedtls_ssl_free( context );
6202
6203 return( ret );
6204}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02006205#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006206
6207/*
Paul Bakker5121ce52009-01-03 21:22:43 +00006208 * Free an SSL context
6209 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006210void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006211{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006212 if( ssl == NULL )
6213 return;
6214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006215 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006216
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01006217 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006218 {
sander-visserb8aa2072020-05-06 22:05:13 +02006219#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6220 size_t out_buf_len = ssl->out_buf_len;
6221#else
6222 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
6223#endif
6224
Darryl Greenb33cc762019-11-28 14:29:44 +00006225 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006226 mbedtls_free( ssl->out_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05006227 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00006228 }
6229
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01006230 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006231 {
sander-visserb8aa2072020-05-06 22:05:13 +02006232#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6233 size_t in_buf_len = ssl->in_buf_len;
6234#else
6235 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6236#endif
6237
Darryl Greenb33cc762019-11-28 14:29:44 +00006238 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006239 mbedtls_free( ssl->in_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05006240 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00006241 }
6242
Paul Bakker48916f92012-09-16 19:57:18 +00006243 if( ssl->transform )
6244 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006245 mbedtls_ssl_transform_free( ssl->transform );
6246 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00006247 }
6248
6249 if( ssl->handshake )
6250 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02006251 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006252 mbedtls_ssl_transform_free( ssl->transform_negotiate );
6253 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00006254
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006255 mbedtls_free( ssl->handshake );
6256 mbedtls_free( ssl->transform_negotiate );
6257 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00006258 }
6259
Hanno Becker3aa186f2021-08-10 09:24:19 +01006260#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
6261 mbedtls_ssl_transform_free( ssl->transform_application );
6262 mbedtls_free( ssl->transform_application );
6263#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
6264
Paul Bakkerc0463502013-02-14 11:19:38 +01006265 if( ssl->session )
6266 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006267 mbedtls_ssl_session_free( ssl->session );
6268 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01006269 }
6270
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02006271#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02006272 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006273 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006274 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006275 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00006276 }
Paul Bakker0be444a2013-08-27 21:55:01 +02006277#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006278
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02006279#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006280 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02006281#endif
6282
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006283 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00006284
Paul Bakker86f04f42013-02-14 11:20:09 +01006285 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006286 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006287}
6288
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006289/*
6290 * Initialze mbedtls_ssl_config
6291 */
6292void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
6293{
6294 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
6295}
6296
Gilles Peskineeccd8882020-03-10 12:19:08 +01006297#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Gilles Peskineae270bf2021-06-02 00:05:29 +02006298/* The selection should be the same as mbedtls_x509_crt_profile_default in
Gilles Peskinea28f0f52021-06-02 15:29:38 +02006299 * x509_crt.c. Here, the order matters. Currently we favor stronger hashes,
6300 * for no fundamental reason.
Gilles Peskineae270bf2021-06-02 00:05:29 +02006301 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
6302 * about this list. */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006303static int ssl_preset_default_hashes[] = {
6304#if defined(MBEDTLS_SHA512_C)
6305 MBEDTLS_MD_SHA512,
Mateusz Starzyk3352a532021-04-06 14:28:22 +02006306#endif
6307#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006308 MBEDTLS_MD_SHA384,
6309#endif
6310#if defined(MBEDTLS_SHA256_C)
6311 MBEDTLS_MD_SHA256,
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02006312#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006313 MBEDTLS_MD_NONE
6314};
Simon Butcherc97b6972015-12-27 23:48:17 +00006315#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006316
Gilles Peskineae270bf2021-06-02 00:05:29 +02006317/* The selection should be the same as mbedtls_x509_crt_profile_default in
6318 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02006319 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02006320 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02006321 * about this list.
6322 */
Brett Warrene0edc842021-08-17 09:53:13 +01006323static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02006324#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006325 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02006326#endif
6327#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006328 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02006329#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02006330#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006331 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006332#endif
6333#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006334 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006335#endif
6336#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006337 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006338#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02006339#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006340 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02006341#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02006342#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006343 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006344#endif
6345#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006346 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006347#endif
Brett Warrene0edc842021-08-17 09:53:13 +01006348 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02006349};
Gilles Peskineae270bf2021-06-02 00:05:29 +02006350
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006351static int ssl_preset_suiteb_ciphersuites[] = {
6352 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
6353 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
6354 0
6355};
6356
Gilles Peskineeccd8882020-03-10 12:19:08 +01006357#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006358static int ssl_preset_suiteb_hashes[] = {
6359 MBEDTLS_MD_SHA256,
6360 MBEDTLS_MD_SHA384,
6361 MBEDTLS_MD_NONE
6362};
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006363
6364#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
6365static uint16_t ssl_preset_default_sig_algs[] = {
6366 /* ECDSA algorithms */
6367#if defined(MBEDTLS_ECDSA_C)
6368#if defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Xiaofei Bai746f9482021-11-12 08:53:56 +00006369 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006370#endif /* MBEDTLS_SHA256_C && MBEDTLS_ECP_DP_SECP256R1_ENABLED */
6371#if defined(MBEDTLS_SHA512_C) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Xiaofei Bai746f9482021-11-12 08:53:56 +00006372 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006373#endif /* MBEDTLS_SHA512_C && MBEDTLS_ECP_DP_SECP384R1_ENABLED */
6374#if defined(MBEDTLS_SHA512_C) && defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Xiaofei Bai746f9482021-11-12 08:53:56 +00006375 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006376#endif /* MBEDTLS_SHA512_C && MBEDTLS_ECP_DP_SECP521R1_ENABLED */
6377#endif /* MBEDTLS_ECDSA_C */
XiaokangQian82d34cc2021-11-03 08:51:56 +00006378
6379 /* RSA algorithms */
6380#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
Xiaofei Bai95395012021-11-25 08:51:30 +00006381 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
XiaokangQian82d34cc2021-11-03 08:51:56 +00006382#endif
Xiaofei Bai6dc90da2021-11-26 08:11:40 +00006383 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
XiaokangQian82d34cc2021-11-03 08:51:56 +00006384
Xiaofei Bai95395012021-11-25 08:51:30 +00006385 MBEDTLS_TLS1_3_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006386};
6387
6388static uint16_t ssl_preset_suiteb_sig_algs[] = {
6389 /* ECDSA algorithms */
6390#if defined(MBEDTLS_ECDSA_C)
6391#if defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Xiaofei Bai746f9482021-11-12 08:53:56 +00006392 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006393#endif /* MBEDTLS_SHA256_C && MBEDTLS_ECP_DP_SECP256R1_ENABLED */
6394#if defined(MBEDTLS_SHA512_C) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Xiaofei Bai746f9482021-11-12 08:53:56 +00006395 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006396#endif /* MBEDTLS_SHA512_C && MBEDTLS_ECP_DP_SECP384R1_ENABLED */
6397#endif /* MBEDTLS_ECDSA_C */
XiaokangQian4b82ca12021-11-18 08:27:17 +00006398
6399 /* RSA algorithms */
6400#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
Xiaofei Bai95395012021-11-25 08:51:30 +00006401 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
XiaokangQian4b82ca12021-11-18 08:27:17 +00006402#endif
Xiaofei Bai6dc90da2021-11-26 08:11:40 +00006403 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
XiaokangQian4b82ca12021-11-18 08:27:17 +00006404
Xiaofei Bai95395012021-11-25 08:51:30 +00006405 MBEDTLS_TLS1_3_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006406};
6407#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006408#endif
6409
Brett Warrene0edc842021-08-17 09:53:13 +01006410static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01006411#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006412 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01006413#endif
6414#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006415 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01006416#endif
Brett Warrene0edc842021-08-17 09:53:13 +01006417 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006418};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006419
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006420/*
Tillmann Karras588ad502015-09-25 04:27:22 +02006421 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006422 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02006423int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006424 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006425{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02006426#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00006427 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02006428#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006429
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02006430 /* Use the functions here so that they are covered in tests,
6431 * but otherwise access member directly for efficiency */
6432 mbedtls_ssl_conf_endpoint( conf, endpoint );
6433 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006434
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006435 /*
6436 * Things that are common to all presets
6437 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02006438#if defined(MBEDTLS_SSL_CLI_C)
6439 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
6440 {
6441 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
6442#if defined(MBEDTLS_SSL_SESSION_TICKETS)
6443 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
6444#endif
6445 }
6446#endif
6447
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006448#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6449 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
6450#endif
6451
6452#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6453 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
6454#endif
6455
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02006456#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006457 conf->f_cookie_write = ssl_cookie_write_dummy;
6458 conf->f_cookie_check = ssl_cookie_check_dummy;
6459#endif
6460
6461#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6462 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
6463#endif
6464
Janos Follath088ce432017-04-10 12:42:31 +01006465#if defined(MBEDTLS_SSL_SRV_C)
6466 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02006467 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01006468#endif
6469
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006470#if defined(MBEDTLS_SSL_PROTO_DTLS)
6471 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
6472 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
6473#endif
6474
6475#if defined(MBEDTLS_SSL_RENEGOTIATION)
6476 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00006477 memset( conf->renego_period, 0x00, 2 );
6478 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006479#endif
6480
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006481#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckere2defad2021-07-24 05:59:17 +01006482 if( endpoint == MBEDTLS_SSL_IS_SERVER )
6483 {
6484 const unsigned char dhm_p[] =
6485 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
6486 const unsigned char dhm_g[] =
6487 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01006488
Hanno Beckere2defad2021-07-24 05:59:17 +01006489 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
6490 dhm_p, sizeof( dhm_p ),
6491 dhm_g, sizeof( dhm_g ) ) ) != 0 )
6492 {
6493 return( ret );
6494 }
6495 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02006496#endif
6497
Hanno Becker71f1ed62021-07-24 06:01:47 +01006498#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
6499 /*
6500 * Allow all TLS 1.3 key exchange modes by default.
6501 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00006502 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01006503#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
6504
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006505 /*
6506 * Preset-specific defaults
6507 */
6508 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006509 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006510 /*
6511 * NSA Suite B
6512 */
6513 case MBEDTLS_SSL_PRESET_SUITEB:
6514 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6515 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
6516 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
6517 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
6518
Hanno Beckerd60b6c62021-04-29 12:04:11 +01006519 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006520
6521#if defined(MBEDTLS_X509_CRT_PARSE_C)
6522 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006523#endif
6524
Gilles Peskineeccd8882020-03-10 12:19:08 +01006525#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006526 conf->sig_hashes = ssl_preset_suiteb_hashes;
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006527#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
6528 conf->tls13_sig_algs = ssl_preset_suiteb_sig_algs;
6529#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006530#endif
6531
Brett Warrene0edc842021-08-17 09:53:13 +01006532#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
6533 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006534#endif
Brett Warrene0edc842021-08-17 09:53:13 +01006535 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02006536 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006537
6538 /*
6539 * Default
6540 */
6541 default:
Ron Eldor5e9f14d2017-05-28 10:46:38 +03006542 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
6543 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
6544 MBEDTLS_SSL_MIN_MAJOR_VERSION :
6545 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
6546 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
6547 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
6548 MBEDTLS_SSL_MIN_MINOR_VERSION :
6549 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006550 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
6551 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
6552
6553#if defined(MBEDTLS_SSL_PROTO_DTLS)
6554 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
TRodziewiczef73f012021-05-13 14:53:36 +02006555 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006556#endif
Hanno Beckerd60b6c62021-04-29 12:04:11 +01006557 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006558
6559#if defined(MBEDTLS_X509_CRT_PARSE_C)
6560 conf->cert_profile = &mbedtls_x509_crt_profile_default;
6561#endif
6562
Gilles Peskineeccd8882020-03-10 12:19:08 +01006563#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006564 conf->sig_hashes = ssl_preset_default_hashes;
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006565#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
6566 conf->tls13_sig_algs = ssl_preset_default_sig_algs;
6567#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
Hanno Beckerdeb68ce2021-08-10 16:04:05 +01006568#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006569
Brett Warrene0edc842021-08-17 09:53:13 +01006570#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
6571 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006572#endif
Brett Warrene0edc842021-08-17 09:53:13 +01006573 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006574
6575#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
6576 conf->dhm_min_bitlen = 1024;
6577#endif
6578 }
6579
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006580 return( 0 );
6581}
6582
6583/*
6584 * Free mbedtls_ssl_config
6585 */
6586void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
6587{
6588#if defined(MBEDTLS_DHM_C)
6589 mbedtls_mpi_free( &conf->dhm_P );
6590 mbedtls_mpi_free( &conf->dhm_G );
6591#endif
6592
Gilles Peskineeccd8882020-03-10 12:19:08 +01006593#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006594 if( conf->psk != NULL )
6595 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006596 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006597 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00006598 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006599 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09006600 }
6601
6602 if( conf->psk_identity != NULL )
6603 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006604 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09006605 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00006606 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006607 conf->psk_identity_len = 0;
6608 }
6609#endif
6610
6611#if defined(MBEDTLS_X509_CRT_PARSE_C)
6612 ssl_key_cert_free( conf->key_cert );
6613#endif
6614
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006615 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006616}
6617
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02006618#if defined(MBEDTLS_PK_C) && \
6619 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006620/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006621 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006622 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006623unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006624{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006625#if defined(MBEDTLS_RSA_C)
6626 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
6627 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006628#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006629#if defined(MBEDTLS_ECDSA_C)
6630 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
6631 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006632#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006633 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006634}
6635
Hanno Becker7e5437a2017-04-28 17:15:26 +01006636unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
6637{
6638 switch( type ) {
6639 case MBEDTLS_PK_RSA:
6640 return( MBEDTLS_SSL_SIG_RSA );
6641 case MBEDTLS_PK_ECDSA:
6642 case MBEDTLS_PK_ECKEY:
6643 return( MBEDTLS_SSL_SIG_ECDSA );
6644 default:
6645 return( MBEDTLS_SSL_SIG_ANON );
6646 }
6647}
6648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006649mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006650{
6651 switch( sig )
6652 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006653#if defined(MBEDTLS_RSA_C)
6654 case MBEDTLS_SSL_SIG_RSA:
6655 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006656#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006657#if defined(MBEDTLS_ECDSA_C)
6658 case MBEDTLS_SSL_SIG_ECDSA:
6659 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006660#endif
6661 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006662 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006663 }
6664}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02006665#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006666
Hanno Becker7e5437a2017-04-28 17:15:26 +01006667#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01006668 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01006669
6670/* Find an entry in a signature-hash set matching a given hash algorithm. */
6671mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
6672 mbedtls_pk_type_t sig_alg )
6673{
6674 switch( sig_alg )
6675 {
6676 case MBEDTLS_PK_RSA:
6677 return( set->rsa );
6678 case MBEDTLS_PK_ECDSA:
6679 return( set->ecdsa );
6680 default:
6681 return( MBEDTLS_MD_NONE );
6682 }
6683}
6684
6685/* Add a signature-hash-pair to a signature-hash set */
6686void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
6687 mbedtls_pk_type_t sig_alg,
6688 mbedtls_md_type_t md_alg )
6689{
6690 switch( sig_alg )
6691 {
6692 case MBEDTLS_PK_RSA:
6693 if( set->rsa == MBEDTLS_MD_NONE )
6694 set->rsa = md_alg;
6695 break;
6696
6697 case MBEDTLS_PK_ECDSA:
6698 if( set->ecdsa == MBEDTLS_MD_NONE )
6699 set->ecdsa = md_alg;
6700 break;
6701
6702 default:
6703 break;
6704 }
6705}
6706
6707/* Allow exactly one hash algorithm for each signature. */
6708void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
6709 mbedtls_md_type_t md_alg )
6710{
6711 set->rsa = md_alg;
6712 set->ecdsa = md_alg;
6713}
6714
6715#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
Gilles Peskineeccd8882020-03-10 12:19:08 +01006716 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Hanno Becker7e5437a2017-04-28 17:15:26 +01006717
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02006718/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006719 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02006720 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006721mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006722{
6723 switch( hash )
6724 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006725#if defined(MBEDTLS_MD5_C)
6726 case MBEDTLS_SSL_HASH_MD5:
6727 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006728#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006729#if defined(MBEDTLS_SHA1_C)
6730 case MBEDTLS_SSL_HASH_SHA1:
6731 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006732#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02006733#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006734 case MBEDTLS_SSL_HASH_SHA224:
6735 return( MBEDTLS_MD_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02006736#endif
6737#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006738 case MBEDTLS_SSL_HASH_SHA256:
6739 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006740#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02006741#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006742 case MBEDTLS_SSL_HASH_SHA384:
6743 return( MBEDTLS_MD_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02006744#endif
6745#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006746 case MBEDTLS_SSL_HASH_SHA512:
6747 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006748#endif
6749 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006750 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006751 }
6752}
6753
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006754/*
6755 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
6756 */
6757unsigned char mbedtls_ssl_hash_from_md_alg( int md )
6758{
6759 switch( md )
6760 {
6761#if defined(MBEDTLS_MD5_C)
6762 case MBEDTLS_MD_MD5:
6763 return( MBEDTLS_SSL_HASH_MD5 );
6764#endif
6765#if defined(MBEDTLS_SHA1_C)
6766 case MBEDTLS_MD_SHA1:
6767 return( MBEDTLS_SSL_HASH_SHA1 );
6768#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02006769#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006770 case MBEDTLS_MD_SHA224:
6771 return( MBEDTLS_SSL_HASH_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02006772#endif
6773#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006774 case MBEDTLS_MD_SHA256:
6775 return( MBEDTLS_SSL_HASH_SHA256 );
6776#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02006777#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006778 case MBEDTLS_MD_SHA384:
6779 return( MBEDTLS_SSL_HASH_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02006780#endif
6781#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006782 case MBEDTLS_MD_SHA512:
6783 return( MBEDTLS_SSL_HASH_SHA512 );
6784#endif
6785 default:
6786 return( MBEDTLS_SSL_HASH_NONE );
6787 }
6788}
6789
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02006790#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006791/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006792 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02006793 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006794 */
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02006795int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006796{
Brett Warrene0edc842021-08-17 09:53:13 +01006797 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006798
Brett Warrene0edc842021-08-17 09:53:13 +01006799 if( group_list == NULL )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02006800 return( -1 );
Brett Warrene0edc842021-08-17 09:53:13 +01006801 uint16_t tls_id = mbedtls_ecp_curve_info_from_grp_id(grp_id)->tls_id;
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02006802
Brett Warrene0edc842021-08-17 09:53:13 +01006803 for( ; *group_list != 0; group_list++ )
6804 {
6805 if( *group_list == tls_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02006806 return( 0 );
Brett Warrene0edc842021-08-17 09:53:13 +01006807 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006808
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02006809 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006810}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02006811#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006812
Gilles Peskineeccd8882020-03-10 12:19:08 +01006813#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006814/*
6815 * Check if a hash proposed by the peer is in our list.
6816 * Return 0 if we're willing to use it, -1 otherwise.
6817 */
6818int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
6819 mbedtls_md_type_t md )
6820{
6821 const int *cur;
6822
6823 if( ssl->conf->sig_hashes == NULL )
6824 return( -1 );
6825
6826 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
6827 if( *cur == (int) md )
6828 return( 0 );
6829
6830 return( -1 );
6831}
Gilles Peskineeccd8882020-03-10 12:19:08 +01006832#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006833
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006834#if defined(MBEDTLS_X509_CRT_PARSE_C)
6835int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
6836 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006837 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02006838 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006839{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006840 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006841 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006842 const char *ext_oid;
6843 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006844
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006845 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006846 {
6847 /* Server part of the key exchange */
6848 switch( ciphersuite->key_exchange )
6849 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006850 case MBEDTLS_KEY_EXCHANGE_RSA:
6851 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006852 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006853 break;
6854
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006855 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
6856 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
6857 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
6858 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006859 break;
6860
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006861 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
6862 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006863 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006864 break;
6865
6866 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006867 case MBEDTLS_KEY_EXCHANGE_NONE:
6868 case MBEDTLS_KEY_EXCHANGE_PSK:
6869 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
6870 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02006871 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006872 usage = 0;
6873 }
6874 }
6875 else
6876 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006877 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
6878 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006879 }
6880
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006881 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006882 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006883 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006884 ret = -1;
6885 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006886
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006887 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006888 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006889 ext_oid = MBEDTLS_OID_SERVER_AUTH;
6890 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006891 }
6892 else
6893 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006894 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
6895 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006896 }
6897
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006898 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006899 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006900 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006901 ret = -1;
6902 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006903
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006904 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006905}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006906#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02006907
Simon Butcher99000142016-10-13 17:21:01 +01006908int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
6909{
6910#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6911 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Hanno Becker541af852021-05-14 16:49:01 +01006912 return( -1 );
Simon Butcher99000142016-10-13 17:21:01 +01006913
6914 switch( md )
6915 {
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02006916#if defined(MBEDTLS_SHA384_C)
Simon Butcher99000142016-10-13 17:21:01 +01006917 case MBEDTLS_SSL_HASH_SHA384:
6918 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
6919 break;
6920#endif
6921#if defined(MBEDTLS_SHA256_C)
6922 case MBEDTLS_SSL_HASH_SHA256:
6923 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
6924 break;
6925#endif
6926 default:
Hanno Becker541af852021-05-14 16:49:01 +01006927 return( -1 );
Simon Butcher99000142016-10-13 17:21:01 +01006928 }
6929
6930 return 0;
6931#else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
6932 (void) ssl;
6933 (void) md;
6934
Hanno Becker541af852021-05-14 16:49:01 +01006935 return( -1 );
Simon Butcher99000142016-10-13 17:21:01 +01006936#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6937}
6938
TRodziewicz0f82ec62021-05-12 17:49:18 +02006939#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006940
6941#if defined(MBEDTLS_USE_PSA_CRYPTO)
6942int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
6943 unsigned char *hash, size_t *hashlen,
6944 unsigned char *data, size_t data_len,
6945 mbedtls_md_type_t md_alg )
6946{
Andrzej Kurek814feff2019-01-14 04:35:19 -05006947 psa_status_t status;
Jaeden Amero34973232019-02-20 10:32:28 +00006948 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006949 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
6950
Hanno Becker4c8c7aa2019-04-10 09:25:41 +01006951 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
Andrzej Kurek814feff2019-01-14 04:35:19 -05006952
6953 if( ( status = psa_hash_setup( &hash_operation,
6954 hash_alg ) ) != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006955 {
Andrzej Kurek814feff2019-01-14 04:35:19 -05006956 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006957 goto exit;
6958 }
6959
Andrzej Kurek814feff2019-01-14 04:35:19 -05006960 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
6961 64 ) ) != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006962 {
Andrzej Kurek814feff2019-01-14 04:35:19 -05006963 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006964 goto exit;
6965 }
6966
Andrzej Kurek814feff2019-01-14 04:35:19 -05006967 if( ( status = psa_hash_update( &hash_operation,
6968 data, data_len ) ) != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006969 {
Andrzej Kurek814feff2019-01-14 04:35:19 -05006970 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006971 goto exit;
6972 }
6973
Ronald Cron69a63422021-10-18 09:47:58 +02006974 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
Andrzej Kurek814feff2019-01-14 04:35:19 -05006975 hashlen ) ) != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006976 {
Andrzej Kurek814feff2019-01-14 04:35:19 -05006977 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006978 goto exit;
6979 }
6980
6981exit:
Andrzej Kurek814feff2019-01-14 04:35:19 -05006982 if( status != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006983 {
6984 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6985 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andrzej Kurek814feff2019-01-14 04:35:19 -05006986 switch( status )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006987 {
6988 case PSA_ERROR_NOT_SUPPORTED:
6989 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
Andrzej Kurek814feff2019-01-14 04:35:19 -05006990 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006991 case PSA_ERROR_BUFFER_TOO_SMALL:
6992 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
6993 case PSA_ERROR_INSUFFICIENT_MEMORY:
6994 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
6995 default:
TRodziewiczb579ccd2021-04-13 14:28:28 +02006996 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05006997 }
6998 }
6999 return( 0 );
7000}
7001
7002#else
7003
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007004int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +02007005 unsigned char *hash, size_t *hashlen,
7006 unsigned char *data, size_t data_len,
7007 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007008{
7009 int ret = 0;
7010 mbedtls_md_context_t ctx;
7011 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +02007012 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007013
Hanno Becker4c8c7aa2019-04-10 09:25:41 +01007014 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
Andrzej Kurek814feff2019-01-14 04:35:19 -05007015
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007016 mbedtls_md_init( &ctx );
7017
7018 /*
7019 * digitally-signed struct {
7020 * opaque client_random[32];
7021 * opaque server_random[32];
7022 * ServerDHParams params;
7023 * };
7024 */
7025 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7026 {
7027 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7028 goto exit;
7029 }
7030 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7031 {
7032 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7033 goto exit;
7034 }
7035 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7036 {
7037 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7038 goto exit;
7039 }
7040 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7041 {
7042 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7043 goto exit;
7044 }
Gilles Peskineca1d7422018-04-24 11:53:22 +02007045 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007046 {
7047 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7048 goto exit;
7049 }
7050
7051exit:
7052 mbedtls_md_free( &ctx );
7053
7054 if( ret != 0 )
7055 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7056 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7057
7058 return( ret );
7059}
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007060#endif /* MBEDTLS_USE_PSA_CRYPTO */
7061
TRodziewicz0f82ec62021-05-12 17:49:18 +02007062#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007063
Jerry Yu148165c2021-09-24 23:20:59 +08007064#if defined(MBEDTLS_USE_PSA_CRYPTO)
7065int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
7066 const mbedtls_md_type_t md,
7067 unsigned char *dst,
7068 size_t dst_len,
7069 size_t *olen )
7070{
7071 ((void) ssl);
7072 ((void) md);
7073 ((void) dst);
7074 ((void) dst_len);
7075 *olen = 0;
7076 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE);
7077}
7078#else /* MBEDTLS_USE_PSA_CRYPTO */
7079
Jerry Yu24c0ec32021-09-09 14:21:07 +08007080#if defined(MBEDTLS_SHA384_C)
Jerry Yu000f9762021-09-14 11:12:51 +08007081static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
7082 unsigned char *dst,
7083 size_t dst_len,
7084 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08007085{
Jerry Yu24c0ec32021-09-09 14:21:07 +08007086 int ret;
7087 mbedtls_sha512_context sha512;
7088
7089 if( dst_len < 48 )
7090 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7091
7092 mbedtls_sha512_init( &sha512 );
7093 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
7094
7095 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
7096 {
7097 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
7098 goto exit;
7099 }
7100
7101 *olen = 48;
7102
7103exit:
7104
7105 mbedtls_sha512_free( &sha512 );
7106 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08007107}
7108#endif /* MBEDTLS_SHA384_C */
7109
7110#if defined(MBEDTLS_SHA256_C)
Jerry Yu000f9762021-09-14 11:12:51 +08007111static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
7112 unsigned char *dst,
7113 size_t dst_len,
7114 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08007115{
Jerry Yu24c0ec32021-09-09 14:21:07 +08007116 int ret;
7117 mbedtls_sha256_context sha256;
7118
7119 if( dst_len < 32 )
7120 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7121
7122 mbedtls_sha256_init( &sha256 );
7123 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
7124
7125 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
7126 {
7127 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
7128 goto exit;
7129 }
7130
7131 *olen = 32;
7132
7133exit:
7134
7135 mbedtls_sha256_free( &sha256 );
7136 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08007137}
7138#endif /* MBEDTLS_SHA256_C */
7139
Jerry Yu000f9762021-09-14 11:12:51 +08007140int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
7141 const mbedtls_md_type_t md,
7142 unsigned char *dst,
7143 size_t dst_len,
7144 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08007145{
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007146 switch( md )
7147 {
7148
Jerry Yu24c0ec32021-09-09 14:21:07 +08007149#if defined(MBEDTLS_SHA384_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007150 case MBEDTLS_MD_SHA384:
Jerry Yu000f9762021-09-14 11:12:51 +08007151 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007152#endif /* MBEDTLS_SHA384_C */
7153
Jerry Yu24c0ec32021-09-09 14:21:07 +08007154#if defined(MBEDTLS_SHA256_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007155 case MBEDTLS_MD_SHA256:
Jerry Yu000f9762021-09-14 11:12:51 +08007156 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
Jerry Yu24c0ec32021-09-09 14:21:07 +08007157#endif /* MBEDTLS_SHA256_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007158
7159 default:
7160 break;
7161 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08007162 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7163}
Jerry Yu148165c2021-09-24 23:20:59 +08007164#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08007165
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007166#endif /* MBEDTLS_SSL_TLS_C */