blob: c5a8d2478188de3b6d6b1ac6c23247ca13d91322 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Jerry Yub476a442022-01-21 18:14:45 +080028#include <assert.h>
29
SimonBd5800b72016-04-26 07:43:27 +010030#include "mbedtls/platform.h"
SimonBd5800b72016-04-26 07:43:27 +010031
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000032#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010033#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010034#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000035#include "ssl_misc.h"
Andrzej Kurek25f27152022-08-17 16:09:31 -040036
Janos Follath73c616b2019-12-18 15:07:04 +000037#include "mbedtls/debug.h"
38#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050039#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010040#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020041#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020042
Rich Evans00ab4702015-02-06 13:43:58 +000043#include <string.h>
44
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050045#if defined(MBEDTLS_USE_PSA_CRYPTO)
46#include "mbedtls/psa_util.h"
47#include "psa/crypto.h"
48#endif
Manuel Pégourié-Gonnard07018f92022-09-15 11:29:35 +020049#include "mbedtls/legacy_or_psa.h"
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050050
Janos Follath23bdca02016-10-07 14:47:14 +010051#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000052#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020053#endif
54
Ronald Cronad8c17b2022-06-10 17:18:09 +020055#if defined(MBEDTLS_TEST_HOOKS)
56static mbedtls_ssl_chk_buf_ptr_args chk_buf_ptr_fail_args;
57
58void mbedtls_ssl_set_chk_buf_ptr_fail_args(
59 const uint8_t *cur, const uint8_t *end, size_t need )
60{
61 chk_buf_ptr_fail_args.cur = cur;
62 chk_buf_ptr_fail_args.end = end;
63 chk_buf_ptr_fail_args.need = need;
64}
65
66void mbedtls_ssl_reset_chk_buf_ptr_fail_args( void )
67{
68 memset( &chk_buf_ptr_fail_args, 0, sizeof( chk_buf_ptr_fail_args ) );
69}
70
71int mbedtls_ssl_cmp_chk_buf_ptr_fail_args( mbedtls_ssl_chk_buf_ptr_args *args )
72{
73 return( ( chk_buf_ptr_fail_args.cur != args->cur ) ||
74 ( chk_buf_ptr_fail_args.end != args->end ) ||
75 ( chk_buf_ptr_fail_args.need != args->need ) );
76}
77#endif /* MBEDTLS_TEST_HOOKS */
78
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020079#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010080
Hanno Beckera0e20d02019-05-15 14:03:01 +010081#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010082/* Top-level Connection ID API */
83
Hanno Becker8367ccc2019-05-14 11:30:10 +010084int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
85 size_t len,
86 int ignore_other_cid )
Hanno Beckerad4a1372019-05-03 13:06:44 +010087{
88 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
89 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
90
Hanno Becker611ac772019-05-14 11:45:26 +010091 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
92 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
93 {
94 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
95 }
96
97 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010098 conf->cid_len = len;
99 return( 0 );
100}
101
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100102int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
103 int enable,
104 unsigned char const *own_cid,
105 size_t own_cid_len )
106{
Hanno Becker76a79ab2019-05-03 14:38:32 +0100107 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
108 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
109
Hanno Beckerca092242019-04-25 16:01:49 +0100110 ssl->negotiate_cid = enable;
111 if( enable == MBEDTLS_SSL_CID_DISABLED )
112 {
113 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
114 return( 0 );
115 }
116 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckerad4a1372019-05-03 13:06:44 +0100117 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Beckerca092242019-04-25 16:01:49 +0100118
Hanno Beckerad4a1372019-05-03 13:06:44 +0100119 if( own_cid_len != ssl->conf->cid_len )
Hanno Beckerca092242019-04-25 16:01:49 +0100120 {
Hanno Beckerad4a1372019-05-03 13:06:44 +0100121 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
122 (unsigned) own_cid_len,
123 (unsigned) ssl->conf->cid_len ) );
Hanno Beckerca092242019-04-25 16:01:49 +0100124 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
125 }
126
127 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100128 /* Truncation is not an issue here because
129 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
130 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100131
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100132 return( 0 );
133}
134
Paul Elliott0113cf12022-03-11 20:26:47 +0000135int mbedtls_ssl_get_own_cid( mbedtls_ssl_context *ssl,
136 int *enabled,
137 unsigned char own_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
138 size_t *own_cid_len )
139{
140 *enabled = MBEDTLS_SSL_CID_DISABLED;
141
142 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
143 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
144
145 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID length is
146 * zero as this is indistinguishable from not requesting to use
147 * the CID extension. */
148 if( ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
149 return( 0 );
150
151 if( own_cid_len != NULL )
152 {
153 *own_cid_len = ssl->own_cid_len;
154 if( own_cid != NULL )
155 memcpy( own_cid, ssl->own_cid, ssl->own_cid_len );
156 }
157
158 *enabled = MBEDTLS_SSL_CID_ENABLED;
159
160 return( 0 );
161}
162
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100163int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
164 int *enabled,
165 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
166 size_t *peer_cid_len )
167{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100168 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100169
Hanno Becker76a79ab2019-05-03 14:38:32 +0100170 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Jerry Yu6848a612022-10-27 13:03:26 +0800171 mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Hanno Becker76a79ab2019-05-03 14:38:32 +0100172 {
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100173 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker76a79ab2019-05-03 14:38:32 +0100174 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100175
Hanno Beckerc5f24222019-05-03 12:54:52 +0100176 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
177 * were used, but client and server requested the empty CID.
178 * This is indistinguishable from not using the CID extension
179 * in the first place. */
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100180 if( ssl->transform_in->in_cid_len == 0 &&
181 ssl->transform_in->out_cid_len == 0 )
182 {
183 return( 0 );
184 }
185
Hanno Becker615ef172019-05-22 16:50:35 +0100186 if( peer_cid_len != NULL )
187 {
188 *peer_cid_len = ssl->transform_in->out_cid_len;
189 if( peer_cid != NULL )
190 {
191 memcpy( peer_cid, ssl->transform_in->out_cid,
192 ssl->transform_in->out_cid_len );
193 }
194 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100195
196 *enabled = MBEDTLS_SSL_CID_ENABLED;
197
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100198 return( 0 );
199}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100200#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200205/*
206 * Convert max_fragment_length codes to length.
207 * RFC 6066 says:
208 * enum{
209 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
210 * } MaxFragmentLength;
211 * and we add 0 -> extension unused
212 */
Angus Grattond8213d02016-05-25 20:56:48 +1000213static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200214{
Angus Grattond8213d02016-05-25 20:56:48 +1000215 switch( mfl )
216 {
217 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
218 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
219 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
220 return 512;
221 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
222 return 1024;
223 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
224 return 2048;
225 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
226 return 4096;
227 default:
228 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
229 }
230}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200231#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200232
Hanno Becker52055ae2019-02-06 14:30:46 +0000233int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
234 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200235{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200236 mbedtls_ssl_session_free( dst );
237 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
吴敬辉0b716112021-11-29 10:46:35 +0800238#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
239 dst->ticket = NULL;
Xiaokang Qian87306442022-10-12 09:47:38 +0000240#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
241 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000242 dst->hostname = NULL;
吴敬辉0b716112021-11-29 10:46:35 +0800243#endif
Xiaokang Qian87306442022-10-12 09:47:38 +0000244#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
吴敬辉0b716112021-11-29 10:46:35 +0800245
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200246#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000247
248#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200249 if( src->peer_cert != NULL )
250 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000251 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200252
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200253 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200254 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200255 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200257 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200258
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200259 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200260 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200261 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200262 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200263 dst->peer_cert = NULL;
264 return( ret );
265 }
266 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000267#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker9198ad12019-02-05 17:00:50 +0000268 if( src->peer_cert_digest != NULL )
269 {
Hanno Becker9198ad12019-02-05 17:00:50 +0000270 dst->peer_cert_digest =
Hanno Beckeraccc5992019-02-25 10:06:59 +0000271 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9198ad12019-02-05 17:00:50 +0000272 if( dst->peer_cert_digest == NULL )
273 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
274
275 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
276 src->peer_cert_digest_len );
277 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000278 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000279 }
280#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
281
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200282#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200283
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200284#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200285 if( src->ticket != NULL )
286 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200287 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200288 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200289 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200290
291 memcpy( dst->ticket, src->ticket, src->ticket_len );
292 }
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000293
294#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
295 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
296 if( src->endpoint == MBEDTLS_SSL_IS_CLIENT )
297 {
298 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
299 ret = mbedtls_ssl_session_set_hostname( dst, src->hostname );
300 if( ret != 0 )
301 return ( ret );
302 }
303#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
304 MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200305#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200306
307 return( 0 );
308}
309
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500310#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200311MBEDTLS_CHECK_RETURN_CRITICAL
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500312static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
313{
314 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
315 if( resized_buffer == NULL )
316 return -1;
317
318 /* We want to copy len_new bytes when downsizing the buffer, and
319 * len_old bytes when upsizing, so we choose the smaller of two sizes,
320 * to fit one buffer into another. Size checks, ensuring that no data is
321 * lost, are done outside of this function. */
322 memcpy( resized_buffer, *buffer,
323 ( len_new < *len_old ) ? len_new : *len_old );
324 mbedtls_platform_zeroize( *buffer, *len_old );
325 mbedtls_free( *buffer );
326
327 *buffer = resized_buffer;
328 *len_old = len_new;
329
330 return 0;
331}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200332
333static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
Andrzej Kurek069fa962021-01-07 08:02:15 -0500334 size_t in_buf_new_len,
335 size_t out_buf_new_len )
Andrzej Kurek4a063792020-10-21 15:08:44 +0200336{
337 int modified = 0;
338 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
339 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
340 if( ssl->in_buf != NULL )
341 {
342 written_in = ssl->in_msg - ssl->in_buf;
343 iv_offset_in = ssl->in_iv - ssl->in_buf;
344 len_offset_in = ssl->in_len - ssl->in_buf;
345 if( downsizing ?
346 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
347 ssl->in_buf_len < in_buf_new_len )
348 {
349 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
350 {
351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
352 }
353 else
354 {
Paul Elliottb7449902021-03-10 18:14:58 +0000355 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
356 in_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200357 modified = 1;
358 }
359 }
360 }
361
362 if( ssl->out_buf != NULL )
363 {
364 written_out = ssl->out_msg - ssl->out_buf;
365 iv_offset_out = ssl->out_iv - ssl->out_buf;
366 len_offset_out = ssl->out_len - ssl->out_buf;
367 if( downsizing ?
368 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
369 ssl->out_buf_len < out_buf_new_len )
370 {
371 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
372 {
373 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
374 }
375 else
376 {
Paul Elliottb7449902021-03-10 18:14:58 +0000377 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
378 out_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200379 modified = 1;
380 }
381 }
382 }
383 if( modified )
384 {
385 /* Update pointers here to avoid doing it twice. */
386 mbedtls_ssl_reset_in_out_pointers( ssl );
387 /* Fields below might not be properly updated with record
388 * splitting or with CID, so they are manually updated here. */
389 ssl->out_msg = ssl->out_buf + written_out;
390 ssl->out_len = ssl->out_buf + len_offset_out;
391 ssl->out_iv = ssl->out_buf + iv_offset_out;
392
393 ssl->in_msg = ssl->in_buf + written_in;
394 ssl->in_len = ssl->in_buf + len_offset_in;
395 ssl->in_iv = ssl->in_buf + iv_offset_in;
396 }
397}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500398#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
399
Jerry Yudb8c48a2022-01-27 14:54:54 +0800400#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800401
402#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
403typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
404 const char *label,
405 const unsigned char *random, size_t rlen,
406 unsigned char *dstbuf, size_t dlen );
407
408static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id );
409
410#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
411
412/* Type for the TLS PRF */
413typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
414 const unsigned char *, size_t,
415 unsigned char *, size_t);
416
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200417MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800418static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
419 int ciphersuite,
420 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200421#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yued14c932022-02-17 13:40:45 +0800422 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200423#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yued14c932022-02-17 13:40:45 +0800424 ssl_tls_prf_t tls_prf,
425 const unsigned char randbytes[64],
Glenn Strauss07c64162022-03-14 12:34:51 -0400426 mbedtls_ssl_protocol_version tls_version,
Jerry Yued14c932022-02-17 13:40:45 +0800427 unsigned endpoint,
428 const mbedtls_ssl_context *ssl );
429
Andrzej Kurek25f27152022-08-17 16:09:31 -0400430#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200431MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800432static int tls_prf_sha256( const unsigned char *secret, size_t slen,
433 const char *label,
434 const unsigned char *random, size_t rlen,
435 unsigned char *dstbuf, size_t dlen );
436static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
437static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
438
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400439#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yued14c932022-02-17 13:40:45 +0800440
Andrzej Kurek25f27152022-08-17 16:09:31 -0400441#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200442MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800443static int tls_prf_sha384( const unsigned char *secret, size_t slen,
444 const char *label,
445 const unsigned char *random, size_t rlen,
446 unsigned char *dstbuf, size_t dlen );
447
448static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
449static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400450#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yued14c932022-02-17 13:40:45 +0800451
Jerry Yu438ddd82022-07-07 06:55:50 +0000452static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
Jerry Yued14c932022-02-17 13:40:45 +0800453 unsigned char *buf,
454 size_t buf_len );
Jerry Yu251a12e2022-07-13 15:15:48 +0800455
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200456MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu438ddd82022-07-07 06:55:50 +0000457static int ssl_tls12_session_load( mbedtls_ssl_session *session,
Jerry Yued14c932022-02-17 13:40:45 +0800458 const unsigned char *buf,
459 size_t len );
460#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
461
Jerry Yu53d23e22022-02-09 16:25:09 +0800462static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
463
Andrzej Kurek25f27152022-08-17 16:09:31 -0400464#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yudb8c48a2022-01-27 14:54:54 +0800465static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400466#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yudb8c48a2022-01-27 14:54:54 +0800467
Andrzej Kurek25f27152022-08-17 16:09:31 -0400468#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yudb8c48a2022-01-27 14:54:54 +0800469static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400470#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Paul Bakker1ef83d62012-04-11 12:09:53 +0000471
Ron Eldor51d3ab52019-05-12 14:54:30 +0300472int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
473 const unsigned char *secret, size_t slen,
474 const char *label,
475 const unsigned char *random, size_t rlen,
476 unsigned char *dstbuf, size_t dlen )
477{
478 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
479
480 switch( prf )
481 {
Ron Eldord2f25f72019-05-15 14:54:22 +0300482#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek25f27152022-08-17 16:09:31 -0400483#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300484 case MBEDTLS_SSL_TLS_PRF_SHA384:
485 tls_prf = tls_prf_sha384;
486 break;
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400487#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -0400488#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300489 case MBEDTLS_SSL_TLS_PRF_SHA256:
490 tls_prf = tls_prf_sha256;
491 break;
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400492#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Ron Eldord2f25f72019-05-15 14:54:22 +0300493#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300494 default:
495 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
496 }
497
498 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
499}
500
Jerry Yuc73c6182022-02-08 20:29:25 +0800501#if defined(MBEDTLS_X509_CRT_PARSE_C)
502static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
503{
504#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
505 if( session->peer_cert != NULL )
506 {
507 mbedtls_x509_crt_free( session->peer_cert );
508 mbedtls_free( session->peer_cert );
509 session->peer_cert = NULL;
510 }
511#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
512 if( session->peer_cert_digest != NULL )
513 {
514 /* Zeroization is not necessary. */
515 mbedtls_free( session->peer_cert_digest );
516 session->peer_cert_digest = NULL;
517 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
518 session->peer_cert_digest_len = 0;
519 }
520#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
521}
522#endif /* MBEDTLS_X509_CRT_PARSE_C */
523
Jerry Yu7a485c12022-10-31 13:08:18 +0800524uint32_t mbedtls_ssl_get_extension_id( unsigned int extension_type )
525{
526 switch( extension_type )
527 {
528 case MBEDTLS_TLS_EXT_SERVERNAME:
529 return( MBEDTLS_SSL_EXT_ID_SERVERNAME );
530
531 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
532 return( MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH );
533
534 case MBEDTLS_TLS_EXT_STATUS_REQUEST:
535 return( MBEDTLS_SSL_EXT_ID_STATUS_REQUEST );
536
537 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
538 return( MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS );
539
540 case MBEDTLS_TLS_EXT_SIG_ALG:
541 return( MBEDTLS_SSL_EXT_ID_SIG_ALG );
542
543 case MBEDTLS_TLS_EXT_USE_SRTP:
544 return( MBEDTLS_SSL_EXT_ID_USE_SRTP );
545
546 case MBEDTLS_TLS_EXT_HEARTBEAT:
547 return( MBEDTLS_SSL_EXT_ID_HEARTBEAT );
548
549 case MBEDTLS_TLS_EXT_ALPN:
550 return( MBEDTLS_SSL_EXT_ID_ALPN );
551
552 case MBEDTLS_TLS_EXT_SCT:
553 return( MBEDTLS_SSL_EXT_ID_SCT );
554
555 case MBEDTLS_TLS_EXT_CLI_CERT_TYPE:
556 return( MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE );
557
558 case MBEDTLS_TLS_EXT_SERV_CERT_TYPE:
559 return( MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE );
560
561 case MBEDTLS_TLS_EXT_PADDING:
562 return( MBEDTLS_SSL_EXT_ID_PADDING );
563
564 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
565 return( MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY );
566
567 case MBEDTLS_TLS_EXT_EARLY_DATA:
568 return( MBEDTLS_SSL_EXT_ID_EARLY_DATA );
569
570 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
571 return( MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS );
572
573 case MBEDTLS_TLS_EXT_COOKIE:
574 return( MBEDTLS_SSL_EXT_ID_COOKIE );
575
576 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
577 return( MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES );
578
579 case MBEDTLS_TLS_EXT_CERT_AUTH:
580 return( MBEDTLS_SSL_EXT_ID_CERT_AUTH );
581
582 case MBEDTLS_TLS_EXT_OID_FILTERS:
583 return( MBEDTLS_SSL_EXT_ID_OID_FILTERS );
584
585 case MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH:
586 return( MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH );
587
588 case MBEDTLS_TLS_EXT_SIG_ALG_CERT:
589 return( MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT );
590
591 case MBEDTLS_TLS_EXT_KEY_SHARE:
592 return( MBEDTLS_SSL_EXT_ID_KEY_SHARE );
593
594 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
595 return( MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC );
596
597 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
598 return( MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS );
599
600 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
601 return( MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC );
602
603 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
604 return( MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET );
605
606 case MBEDTLS_TLS_EXT_SESSION_TICKET:
607 return( MBEDTLS_SSL_EXT_ID_SESSION_TICKET );
608
609 }
610
611 return( MBEDTLS_SSL_EXT_ID_UNRECOGNIZED );
612}
613
614uint32_t mbedtls_ssl_get_extension_mask( unsigned int extension_type )
615{
616 return( 1 << mbedtls_ssl_get_extension_id( extension_type ) );
617}
618
Jerry Yud25cab02022-10-31 12:48:30 +0800619#if defined(MBEDTLS_DEBUG_C)
620static const char *extension_name_table[] = {
Jerry Yuea52ed92022-11-08 21:01:17 +0800621 [MBEDTLS_SSL_EXT_ID_UNRECOGNIZED] = "unrecognized",
Jerry Yud25cab02022-10-31 12:48:30 +0800622 [MBEDTLS_SSL_EXT_ID_SERVERNAME] = "server_name",
623 [MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH] = "max_fragment_length",
624 [MBEDTLS_SSL_EXT_ID_STATUS_REQUEST] = "status_request",
625 [MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS] = "supported_groups",
626 [MBEDTLS_SSL_EXT_ID_SIG_ALG] = "signature_algorithms",
627 [MBEDTLS_SSL_EXT_ID_USE_SRTP] = "use_srtp",
628 [MBEDTLS_SSL_EXT_ID_HEARTBEAT] = "heartbeat",
629 [MBEDTLS_SSL_EXT_ID_ALPN] = "application_layer_protocol_negotiation",
630 [MBEDTLS_SSL_EXT_ID_SCT] = "signed_certificate_timestamp",
631 [MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE] = "client_certificate_type",
632 [MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE] = "server_certificate_type",
633 [MBEDTLS_SSL_EXT_ID_PADDING] = "padding",
634 [MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY] = "pre_shared_key",
635 [MBEDTLS_SSL_EXT_ID_EARLY_DATA] = "early_data",
636 [MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS] = "supported_versions",
637 [MBEDTLS_SSL_EXT_ID_COOKIE] = "cookie",
638 [MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES] = "psk_key_exchange_modes",
639 [MBEDTLS_SSL_EXT_ID_CERT_AUTH] = "certificate_authorities",
640 [MBEDTLS_SSL_EXT_ID_OID_FILTERS] = "oid_filters",
641 [MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH] = "post_handshake_auth",
642 [MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT] = "signature_algorithms_cert",
643 [MBEDTLS_SSL_EXT_ID_KEY_SHARE] = "key_share",
644 [MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC] = "truncated_hmac",
645 [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = "supported_point_formats",
646 [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = "encrypt_then_mac",
647 [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = "extended_master_secret",
648 [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = "session_ticket"
649};
650
Jerry Yuea52ed92022-11-08 21:01:17 +0800651static unsigned int extension_type_table[]={
Jerry Yud25cab02022-10-31 12:48:30 +0800652 [MBEDTLS_SSL_EXT_ID_UNRECOGNIZED] = 0xff,
653 [MBEDTLS_SSL_EXT_ID_SERVERNAME] = MBEDTLS_TLS_EXT_SERVERNAME,
654 [MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH] = MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH,
655 [MBEDTLS_SSL_EXT_ID_STATUS_REQUEST] = MBEDTLS_TLS_EXT_STATUS_REQUEST,
656 [MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS] = MBEDTLS_TLS_EXT_SUPPORTED_GROUPS,
657 [MBEDTLS_SSL_EXT_ID_SIG_ALG] = MBEDTLS_TLS_EXT_SIG_ALG,
658 [MBEDTLS_SSL_EXT_ID_USE_SRTP] = MBEDTLS_TLS_EXT_USE_SRTP,
659 [MBEDTLS_SSL_EXT_ID_HEARTBEAT] = MBEDTLS_TLS_EXT_HEARTBEAT,
660 [MBEDTLS_SSL_EXT_ID_ALPN] = MBEDTLS_TLS_EXT_ALPN,
661 [MBEDTLS_SSL_EXT_ID_SCT] = MBEDTLS_TLS_EXT_SCT,
662 [MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE] = MBEDTLS_TLS_EXT_CLI_CERT_TYPE,
663 [MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE] = MBEDTLS_TLS_EXT_SERV_CERT_TYPE,
664 [MBEDTLS_SSL_EXT_ID_PADDING] = MBEDTLS_TLS_EXT_PADDING,
665 [MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY] = MBEDTLS_TLS_EXT_PRE_SHARED_KEY,
666 [MBEDTLS_SSL_EXT_ID_EARLY_DATA] = MBEDTLS_TLS_EXT_EARLY_DATA,
667 [MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS] = MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS,
668 [MBEDTLS_SSL_EXT_ID_COOKIE] = MBEDTLS_TLS_EXT_COOKIE,
669 [MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES] = MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES,
670 [MBEDTLS_SSL_EXT_ID_CERT_AUTH] = MBEDTLS_TLS_EXT_CERT_AUTH,
671 [MBEDTLS_SSL_EXT_ID_OID_FILTERS] = MBEDTLS_TLS_EXT_OID_FILTERS,
672 [MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH] = MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH,
673 [MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT] = MBEDTLS_TLS_EXT_SIG_ALG_CERT,
674 [MBEDTLS_SSL_EXT_ID_KEY_SHARE] = MBEDTLS_TLS_EXT_KEY_SHARE,
675 [MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC] = MBEDTLS_TLS_EXT_TRUNCATED_HMAC,
676 [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS,
677 [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC,
678 [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET,
679 [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = MBEDTLS_TLS_EXT_SESSION_TICKET
680};
681
682const char *mbedtls_ssl_get_extension_name( unsigned int extension_type )
683{
684 return( extension_name_table[
685 mbedtls_ssl_get_extension_id( extension_type ) ] );
686}
687
688static const char *ssl_tls13_get_hs_msg_name( int hs_msg_type )
689{
690 switch( hs_msg_type )
691 {
692 case MBEDTLS_SSL_HS_CLIENT_HELLO:
693 return( "ClientHello" );
694 case MBEDTLS_SSL_HS_SERVER_HELLO:
695 return( "ServerHello" );
696 case MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST:
697 return( "HelloRetryRequest" );
698 case MBEDTLS_SSL_HS_NEW_SESSION_TICKET:
699 return( "NewSessionTicket" );
700 case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
701 return( "EncryptedExtensions" );
702 case MBEDTLS_SSL_HS_CERTIFICATE:
703 return( "Certificate" );
704 case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST:
705 return( "CertificateRequest" );
706 }
Jerry Yu79aa7212022-11-08 21:30:21 +0800707 return( "Unknown" );
Jerry Yud25cab02022-10-31 12:48:30 +0800708}
709
Jerry Yu79aa7212022-11-08 21:30:21 +0800710void mbedtls_ssl_print_extension( const mbedtls_ssl_context *ssl,
711 int level, const char *file, int line,
712 int hs_msg_type, unsigned int extension_type,
713 const char *extra_msg0, const char *extra_msg1 )
Jerry Yud25cab02022-10-31 12:48:30 +0800714{
715 const char *extra_msg;
716 if( extra_msg0 && extra_msg1 )
717 {
718 mbedtls_debug_print_msg(
719 ssl, level, file, line,
720 "%s: %s(%u) extension %s %s.",
721 ssl_tls13_get_hs_msg_name( hs_msg_type ),
722 mbedtls_ssl_get_extension_name( extension_type ),
723 extension_type,
724 extra_msg0, extra_msg1 );
725 return;
726 }
727
728 extra_msg = extra_msg0 ? extra_msg0 : extra_msg1;
729 if( extra_msg )
730 {
731 mbedtls_debug_print_msg(
732 ssl, level, file, line,
733 "%s: %s(%u) extension %s.", ssl_tls13_get_hs_msg_name( hs_msg_type ),
734 mbedtls_ssl_get_extension_name( extension_type ), extension_type,
735 extra_msg );
736 return;
737 }
738
739 mbedtls_debug_print_msg(
740 ssl, level, file, line,
741 "%s: %s(%u) extension.", ssl_tls13_get_hs_msg_name( hs_msg_type ),
742 mbedtls_ssl_get_extension_name( extension_type ), extension_type );
743}
744
745void mbedtls_ssl_print_extensions( const mbedtls_ssl_context *ssl,
746 int level, const char *file, int line,
747 int hs_msg_type, uint32_t extensions_mask,
748 const char *extra )
749{
750
751 for( unsigned i = 0;
752 i < sizeof( extension_name_table ) / sizeof( extension_name_table[0] );
753 i++ )
754 {
Jerry Yu79aa7212022-11-08 21:30:21 +0800755 mbedtls_ssl_print_extension(
Jerry Yuea52ed92022-11-08 21:01:17 +0800756 ssl, level, file, line, hs_msg_type, extension_type_table[i],
Jerry Yu97be6a92022-11-09 22:43:31 +0800757 extensions_mask & ( 1 << i ) ? "exists" : "does not exist", extra );
Jerry Yud25cab02022-10-31 12:48:30 +0800758 }
759}
760
761#endif /* MBEDTLS_DEBUG_C */
762
Jerry Yuc73c6182022-02-08 20:29:25 +0800763void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
764 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
765{
766 ((void) ciphersuite_info);
767
Andrzej Kurek25f27152022-08-17 16:09:31 -0400768#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800769 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
770 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
771 else
772#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400773#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800774 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
775 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
776 else
777#endif
778 {
779 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
780 return;
781 }
782}
783
XiaokangQianadab9a62022-07-18 07:41:26 +0000784void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
785 unsigned hs_type,
786 size_t total_hs_len )
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100787{
788 unsigned char hs_hdr[4];
789
790 /* Build HS header for checksum update. */
791 hs_hdr[0] = MBEDTLS_BYTE_0( hs_type );
792 hs_hdr[1] = MBEDTLS_BYTE_2( total_hs_len );
793 hs_hdr[2] = MBEDTLS_BYTE_1( total_hs_len );
794 hs_hdr[3] = MBEDTLS_BYTE_0( total_hs_len );
795
796 ssl->handshake->update_checksum( ssl, hs_hdr, sizeof( hs_hdr ) );
797}
798
799void mbedtls_ssl_add_hs_msg_to_checksum( mbedtls_ssl_context *ssl,
800 unsigned hs_type,
801 unsigned char const *msg,
802 size_t msg_len )
803{
804 mbedtls_ssl_add_hs_hdr_to_checksum( ssl, hs_type, msg_len );
805 ssl->handshake->update_checksum( ssl, msg, msg_len );
806}
807
Jerry Yuc73c6182022-02-08 20:29:25 +0800808void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
809{
810 ((void) ssl);
Andrzej Kurek25f27152022-08-17 16:09:31 -0400811#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800812#if defined(MBEDTLS_USE_PSA_CRYPTO)
813 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
814 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
815#else
816 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
817#endif
818#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400819#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800820#if defined(MBEDTLS_USE_PSA_CRYPTO)
821 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
822 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
823#else
Andrzej Kureka242e832022-08-11 10:03:14 -0400824 mbedtls_sha512_starts( &ssl->handshake->fin_sha384, 1 );
Jerry Yuc73c6182022-02-08 20:29:25 +0800825#endif
826#endif
827}
828
829static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
830 const unsigned char *buf, size_t len )
831{
Andrzej Kurek25f27152022-08-17 16:09:31 -0400832#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800833#if defined(MBEDTLS_USE_PSA_CRYPTO)
834 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
835#else
836 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
837#endif
838#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400839#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800840#if defined(MBEDTLS_USE_PSA_CRYPTO)
841 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
842#else
Andrzej Kureka242e832022-08-11 10:03:14 -0400843 mbedtls_sha512_update( &ssl->handshake->fin_sha384, buf, len );
Jerry Yuc73c6182022-02-08 20:29:25 +0800844#endif
845#endif
Andrzej Kurekeabeb302022-10-17 07:52:51 -0400846#if !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
847 !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
848 (void) ssl;
849 (void) buf;
850 (void) len;
851#endif
Jerry Yuc73c6182022-02-08 20:29:25 +0800852}
853
Andrzej Kurek25f27152022-08-17 16:09:31 -0400854#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800855static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
856 const unsigned char *buf, size_t len )
857{
858#if defined(MBEDTLS_USE_PSA_CRYPTO)
859 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
860#else
861 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
862#endif
863}
864#endif
865
Andrzej Kurek25f27152022-08-17 16:09:31 -0400866#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800867static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
868 const unsigned char *buf, size_t len )
869{
870#if defined(MBEDTLS_USE_PSA_CRYPTO)
871 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
872#else
Andrzej Kureka242e832022-08-11 10:03:14 -0400873 mbedtls_sha512_update( &ssl->handshake->fin_sha384, buf, len );
Jerry Yuc73c6182022-02-08 20:29:25 +0800874#endif
875}
876#endif
877
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200878static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200879{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200880 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200881
Andrzej Kurek25f27152022-08-17 16:09:31 -0400882#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500883#if defined(MBEDTLS_USE_PSA_CRYPTO)
884 handshake->fin_sha256_psa = psa_hash_operation_init();
885 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
886#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200887 mbedtls_sha256_init( &handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +0200888 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200889#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500890#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400891#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500892#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500893 handshake->fin_sha384_psa = psa_hash_operation_init();
894 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -0500895#else
Andrzej Kureka242e832022-08-11 10:03:14 -0400896 mbedtls_sha512_init( &handshake->fin_sha384 );
897 mbedtls_sha512_starts( &handshake->fin_sha384, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200898#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500899#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200900
901 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100902
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200903#if defined(MBEDTLS_DHM_C)
904 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200905#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +0200906#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200907 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200908#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200909#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +0200910#if defined(MBEDTLS_USE_PSA_CRYPTO)
911 handshake->psa_pake_ctx = psa_pake_operation_init();
912 handshake->psa_pake_password = MBEDTLS_SVC_KEY_ID_INIT;
913#else
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200914 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Neil Armstrongca7d5062022-05-31 14:43:23 +0200915#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +0200916#if defined(MBEDTLS_SSL_CLI_C)
917 handshake->ecjpake_cache = NULL;
918 handshake->ecjpake_cache_len = 0;
919#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200920#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200921
Gilles Peskineeccd8882020-03-10 12:19:08 +0100922#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +0200923 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +0200924#endif
925
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200926#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
927 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
928#endif
Hanno Becker75173122019-02-06 16:18:31 +0000929
930#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
931 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
932 mbedtls_pk_init( &handshake->peer_pubkey );
933#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200934}
935
Hanno Beckera18d1322018-01-03 14:27:32 +0000936void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200937{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200938 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +0200939
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100940#if defined(MBEDTLS_USE_PSA_CRYPTO)
941 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
942 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100943#else
944 mbedtls_cipher_init( &transform->cipher_ctx_enc );
945 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100946#endif
947
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000948#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +0100949#if defined(MBEDTLS_USE_PSA_CRYPTO)
950 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
951 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100952#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200953 mbedtls_md_init( &transform->md_ctx_enc );
954 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +0000955#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100956#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200957}
958
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200959void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200960{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200961 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200962}
963
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200964MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200965static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +0000966{
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200967 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +0000968 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200969 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200970 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200971 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200972 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +0200973 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200974
975 /*
976 * Either the pointers are now NULL or cleared properly and can be freed.
977 * Now allocate missing structures.
978 */
979 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200980 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200981 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200982 }
Paul Bakker48916f92012-09-16 19:57:18 +0000983
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200984 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200985 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200986 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200987 }
Paul Bakker48916f92012-09-16 19:57:18 +0000988
Paul Bakker82788fb2014-10-20 13:59:19 +0200989 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200990 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200991 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200992 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500993#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
994 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -0400995
Andrzej Kurek4a063792020-10-21 15:08:44 +0200996 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
997 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500998#endif
Paul Bakker48916f92012-09-16 19:57:18 +0000999
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001000 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00001001 if( ssl->handshake == NULL ||
1002 ssl->transform_negotiate == NULL ||
1003 ssl->session_negotiate == NULL )
1004 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02001005 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001006
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001007 mbedtls_free( ssl->handshake );
1008 mbedtls_free( ssl->transform_negotiate );
1009 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001010
1011 ssl->handshake = NULL;
1012 ssl->transform_negotiate = NULL;
1013 ssl->session_negotiate = NULL;
1014
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001015 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00001016 }
1017
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001018 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001019 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Beckera18d1322018-01-03 14:27:32 +00001020 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02001021 ssl_handshake_params_init( ssl->handshake );
1022
Jerry Yud0766ec2022-09-22 10:46:57 +08001023#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
1024 defined(MBEDTLS_SSL_SRV_C) && \
1025 defined(MBEDTLS_SSL_SESSION_TICKETS)
1026 ssl->handshake->new_session_tickets_count =
1027 ssl->conf->new_session_tickets_count ;
1028#endif
1029
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001030#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001031 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1032 {
1033 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001034
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001035 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
1036 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
1037 else
1038 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001039
Hanno Becker0f57a652020-02-05 10:37:26 +00001040 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001041 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001042#endif
1043
Brett Warrene0edc842021-08-17 09:53:13 +01001044/*
1045 * curve_list is translated to IANA TLS group identifiers here because
1046 * mbedtls_ssl_conf_curves returns void and so can't return
1047 * any error codes.
1048 */
1049#if defined(MBEDTLS_ECP_C)
1050#if !defined(MBEDTLS_DEPRECATED_REMOVED)
1051 /* Heap allocate and translate curve_list from internal to IANA group ids */
1052 if ( ssl->conf->curve_list != NULL )
1053 {
1054 size_t length;
1055 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
1056
1057 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
1058 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
1059
1060 /* Leave room for zero termination */
1061 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
1062 if ( group_list == NULL )
1063 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1064
1065 for( size_t i = 0; i < length; i++ )
1066 {
1067 const mbedtls_ecp_curve_info *info =
1068 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
1069 if ( info == NULL )
1070 {
1071 mbedtls_free( group_list );
1072 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
1073 }
1074 group_list[i] = info->tls_id;
1075 }
1076
1077 group_list[length] = 0;
1078
1079 ssl->handshake->group_list = group_list;
1080 ssl->handshake->group_list_heap_allocated = 1;
1081 }
1082 else
1083 {
1084 ssl->handshake->group_list = ssl->conf->group_list;
1085 ssl->handshake->group_list_heap_allocated = 0;
1086 }
1087#endif /* MBEDTLS_DEPRECATED_REMOVED */
1088#endif /* MBEDTLS_ECP_C */
1089
Ronald Crone68ab4f2022-10-05 12:46:29 +02001090#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08001091#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +08001092#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +08001093 /* Heap allocate and translate sig_hashes from internal hash identifiers to
1094 signature algorithms IANA identifiers. */
1095 if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) &&
Jerry Yuf017ee42022-01-12 15:49:48 +08001096 ssl->conf->sig_hashes != NULL )
1097 {
1098 const int *md;
1099 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +08001100 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +08001101 uint16_t *p;
1102
Jerry Yub476a442022-01-21 18:14:45 +08001103#if defined(static_assert)
1104 static_assert( MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
1105 <= ( SIZE_MAX - ( 2 * sizeof(uint16_t) ) ),
1106 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big" );
Jerry Yua68dca22022-01-20 16:28:27 +08001107#endif
1108
Jerry Yuf017ee42022-01-12 15:49:48 +08001109 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
1110 {
1111 if( mbedtls_ssl_hash_from_md_alg( *md ) == MBEDTLS_SSL_HASH_NONE )
1112 continue;
Jerry Yub476a442022-01-21 18:14:45 +08001113#if defined(MBEDTLS_ECDSA_C)
1114 sig_algs_len += sizeof( uint16_t );
1115#endif
Jerry Yua68dca22022-01-20 16:28:27 +08001116
Jerry Yub476a442022-01-21 18:14:45 +08001117#if defined(MBEDTLS_RSA_C)
1118 sig_algs_len += sizeof( uint16_t );
1119#endif
1120 if( sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN )
1121 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Jerry Yuf017ee42022-01-12 15:49:48 +08001122 }
1123
Jerry Yub476a442022-01-21 18:14:45 +08001124 if( sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN )
Jerry Yuf017ee42022-01-12 15:49:48 +08001125 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
1126
Jerry Yub476a442022-01-21 18:14:45 +08001127 ssl->handshake->sig_algs = mbedtls_calloc( 1, sig_algs_len +
1128 sizeof( uint16_t ));
Jerry Yuf017ee42022-01-12 15:49:48 +08001129 if( ssl->handshake->sig_algs == NULL )
1130 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1131
1132 p = (uint16_t *)ssl->handshake->sig_algs;
1133 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
1134 {
1135 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *md );
1136 if( hash == MBEDTLS_SSL_HASH_NONE )
1137 continue;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001138#if defined(MBEDTLS_ECDSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +08001139 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA);
1140 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001141#endif
1142#if defined(MBEDTLS_RSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +08001143 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA);
1144 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001145#endif
Jerry Yuf017ee42022-01-12 15:49:48 +08001146 }
Gabor Mezei15b95a62022-05-09 16:37:58 +02001147 *p = MBEDTLS_TLS_SIG_NONE;
Jerry Yuf017ee42022-01-12 15:49:48 +08001148 ssl->handshake->sig_algs_heap_allocated = 1;
1149 }
1150 else
Jerry Yua69269a2022-01-17 21:06:01 +08001151#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +08001152 {
Jerry Yuf017ee42022-01-12 15:49:48 +08001153 ssl->handshake->sig_algs_heap_allocated = 0;
1154 }
Jerry Yucc539102022-06-27 16:27:35 +08001155#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Ronald Crone68ab4f2022-10-05 12:46:29 +02001156#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +00001157 return( 0 );
1158}
1159
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001160#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001161/* Dummy cookie callbacks for defaults */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001162MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001163static int ssl_cookie_write_dummy( void *ctx,
1164 unsigned char **p, unsigned char *end,
1165 const unsigned char *cli_id, size_t cli_id_len )
1166{
1167 ((void) ctx);
1168 ((void) p);
1169 ((void) end);
1170 ((void) cli_id);
1171 ((void) cli_id_len);
1172
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001173 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001174}
1175
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001176MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001177static int ssl_cookie_check_dummy( void *ctx,
1178 const unsigned char *cookie, size_t cookie_len,
1179 const unsigned char *cli_id, size_t cli_id_len )
1180{
1181 ((void) ctx);
1182 ((void) cookie);
1183 ((void) cookie_len);
1184 ((void) cli_id);
1185 ((void) cli_id_len);
1186
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001187 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001188}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001189#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001190
Paul Bakker5121ce52009-01-03 21:22:43 +00001191/*
1192 * Initialize an SSL context
1193 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001194void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
1195{
1196 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
1197}
1198
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001199MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +08001200static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
1201{
Ronald Cron086ee0b2022-03-15 15:18:51 +01001202 const mbedtls_ssl_config *conf = ssl->conf;
1203
Ronald Cron6f135e12021-12-08 16:57:54 +01001204#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +01001205 if( mbedtls_ssl_conf_is_tls13_only( conf ) )
1206 {
XiaokangQianed582dd2022-04-13 08:21:05 +00001207 if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1208 {
1209 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported." ) );
1210 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1211 }
1212
Jerry Yu60835a82021-08-04 10:13:52 +08001213 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
1214 return( 0 );
1215 }
1216#endif
1217
1218#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Ronald Cron086ee0b2022-03-15 15:18:51 +01001219 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +08001220 {
1221 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
1222 return( 0 );
1223 }
1224#endif
1225
Ronald Cron6f135e12021-12-08 16:57:54 +01001226#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +01001227 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +08001228 {
XiaokangQianed582dd2022-04-13 08:21:05 +00001229 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1230 {
1231 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2" ) );
1232 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1233 }
1234
XiaokangQian8f9dfe42022-04-15 02:52:39 +00001235 if( conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1236 {
1237 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 server is not supported yet." ) );
1238 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1239 }
1240
1241
Ronald Crone1d3f062022-02-10 14:50:54 +01001242 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is TLS 1.3 or TLS 1.2." ) );
1243 return( 0 );
Jerry Yu60835a82021-08-04 10:13:52 +08001244 }
1245#endif
1246
1247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
1248 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
1249}
1250
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001251MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +08001252static int ssl_conf_check(const mbedtls_ssl_context *ssl)
1253{
1254 int ret;
1255 ret = ssl_conf_version_check( ssl );
1256 if( ret != 0 )
1257 return( ret );
1258
Jerry Yudef7ae42022-10-30 14:13:19 +08001259#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1260 /* RFC 8446 section 4.4.3
1261 *
1262 * If the verification fails, the receiver MUST terminate the handshake with
1263 * a "decrypt_error" alert.
1264 *
1265 * If the client is configured as TLS 1.3 only with optional verify, return
1266 * bad config.
1267 *
1268 */
1269 if( mbedtls_ssl_conf_tls13_ephemeral_enabled(
1270 (mbedtls_ssl_context *)ssl ) &&
1271 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
1272 ssl->conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
1273 ssl->conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
1274 ssl->conf->authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
1275 {
1276 MBEDTLS_SSL_DEBUG_MSG(
Dave Rodgmane8734d82022-10-31 14:30:24 +00001277 1, ( "Optional verify auth mode "
Jerry Yudef7ae42022-10-30 14:13:19 +08001278 "is not available for TLS 1.3 client" ) );
1279 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
1280 }
1281#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1282
Jerry Yu60835a82021-08-04 10:13:52 +08001283 /* Space for further checks */
1284
1285 return( 0 );
1286}
1287
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001288/*
1289 * Setup an SSL context
1290 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01001291
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001292int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02001293 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00001294{
Janos Follath865b3eb2019-12-16 11:46:15 +00001295 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +00001296 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1297 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00001298
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001299 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00001300
Jerry Yu60835a82021-08-04 10:13:52 +08001301 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
1302 return( ret );
1303
Paul Bakker62f2dee2012-09-28 07:31:51 +00001304 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01001305 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00001306 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02001307
1308 /* Set to NULL in case of an error condition */
1309 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02001310
Darryl Greenb33cc762019-11-28 14:29:44 +00001311#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1312 ssl->in_buf_len = in_buf_len;
1313#endif
1314 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001315 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001316 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001317 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001318 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001319 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10001320 }
1321
Darryl Greenb33cc762019-11-28 14:29:44 +00001322#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1323 ssl->out_buf_len = out_buf_len;
1324#endif
1325 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001326 if( ssl->out_buf == NULL )
1327 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001328 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001329 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001330 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001331 }
1332
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00001333 mbedtls_ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001334
Johan Pascalb62bb512015-12-03 21:56:45 +01001335#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +02001336 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
Johan Pascalb62bb512015-12-03 21:56:45 +01001337#endif
1338
Paul Bakker48916f92012-09-16 19:57:18 +00001339 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02001340 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001341
1342 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02001343
1344error:
1345 mbedtls_free( ssl->in_buf );
1346 mbedtls_free( ssl->out_buf );
1347
1348 ssl->conf = NULL;
1349
Darryl Greenb33cc762019-11-28 14:29:44 +00001350#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1351 ssl->in_buf_len = 0;
1352 ssl->out_buf_len = 0;
1353#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001354 ssl->in_buf = NULL;
1355 ssl->out_buf = NULL;
1356
1357 ssl->in_hdr = NULL;
1358 ssl->in_ctr = NULL;
1359 ssl->in_len = NULL;
1360 ssl->in_iv = NULL;
1361 ssl->in_msg = NULL;
1362
1363 ssl->out_hdr = NULL;
1364 ssl->out_ctr = NULL;
1365 ssl->out_len = NULL;
1366 ssl->out_iv = NULL;
1367 ssl->out_msg = NULL;
1368
k-stachowiak9f7798e2018-07-31 16:52:32 +02001369 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001370}
1371
1372/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001373 * Reset an initialized and used SSL context for re-use while retaining
1374 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001375 *
1376 * If partial is non-zero, keep data in the input buffer and client ID.
1377 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001378 */
XiaokangQian78b1fa72022-01-19 06:56:30 +00001379void mbedtls_ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
1380 int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00001381{
Darryl Greenb33cc762019-11-28 14:29:44 +00001382#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1383 size_t in_buf_len = ssl->in_buf_len;
1384 size_t out_buf_len = ssl->out_buf_len;
1385#else
1386 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1387 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1388#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001389
Hanno Beckerb0302c42021-08-03 09:39:42 +01001390#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1391 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001392#endif
1393
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001394 /* Cancel any possibly running timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00001395 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001396
Hanno Beckerb0302c42021-08-03 09:39:42 +01001397 mbedtls_ssl_reset_in_out_pointers( ssl );
1398
1399 /* Reset incoming message parsing */
1400 ssl->in_offt = NULL;
1401 ssl->nb_zero = 0;
1402 ssl->in_msgtype = 0;
1403 ssl->in_msglen = 0;
1404 ssl->in_hslen = 0;
1405 ssl->keep_current_message = 0;
1406 ssl->transform_in = NULL;
1407
1408#if defined(MBEDTLS_SSL_PROTO_DTLS)
1409 ssl->next_record_offset = 0;
1410 ssl->in_epoch = 0;
1411#endif
1412
1413 /* Keep current datagram if partial == 1 */
1414 if( partial == 0 )
1415 {
1416 ssl->in_left = 0;
1417 memset( ssl->in_buf, 0, in_buf_len );
1418 }
1419
Ronald Cronad8c17b2022-06-10 17:18:09 +02001420 ssl->send_alert = 0;
1421
Hanno Beckerb0302c42021-08-03 09:39:42 +01001422 /* Reset outgoing message writing */
1423 ssl->out_msgtype = 0;
1424 ssl->out_msglen = 0;
1425 ssl->out_left = 0;
1426 memset( ssl->out_buf, 0, out_buf_len );
1427 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
1428 ssl->transform_out = NULL;
1429
1430#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1431 mbedtls_ssl_dtls_replay_reset( ssl );
1432#endif
1433
XiaokangQian2b01dc32022-01-21 02:53:13 +00001434#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001435 if( ssl->transform )
1436 {
1437 mbedtls_ssl_transform_free( ssl->transform );
1438 mbedtls_free( ssl->transform );
1439 ssl->transform = NULL;
1440 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001441#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1442
XiaokangQian2b01dc32022-01-21 02:53:13 +00001443#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1444 mbedtls_ssl_transform_free( ssl->transform_application );
1445 mbedtls_free( ssl->transform_application );
1446 ssl->transform_application = NULL;
1447
1448 if( ssl->handshake != NULL )
1449 {
1450 mbedtls_ssl_transform_free( ssl->handshake->transform_earlydata );
1451 mbedtls_free( ssl->handshake->transform_earlydata );
1452 ssl->handshake->transform_earlydata = NULL;
1453
1454 mbedtls_ssl_transform_free( ssl->handshake->transform_handshake );
1455 mbedtls_free( ssl->handshake->transform_handshake );
1456 ssl->handshake->transform_handshake = NULL;
1457 }
1458
XiaokangQian2b01dc32022-01-21 02:53:13 +00001459#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001460}
1461
1462int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
1463{
1464 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1465
1466 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
1467
XiaokangQian78b1fa72022-01-19 06:56:30 +00001468 mbedtls_ssl_session_reset_msg_layer( ssl, partial );
Hanno Beckerb0302c42021-08-03 09:39:42 +01001469
1470 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001471#if defined(MBEDTLS_SSL_RENEGOTIATION)
1472 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001473 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001474
1475 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001476 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
1477 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001478#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001479 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001480
Hanno Beckerb0302c42021-08-03 09:39:42 +01001481 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001482 ssl->session_out = NULL;
Paul Bakkerc0463502013-02-14 11:19:38 +01001483 if( ssl->session )
1484 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001485 mbedtls_ssl_session_free( ssl->session );
1486 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01001487 ssl->session = NULL;
1488 }
1489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001490#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001491 ssl->alpn_chosen = NULL;
1492#endif
1493
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001494#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
David Horstmann3b2276a2022-10-06 14:49:08 +01001495 int free_cli_id = 1;
Hanno Becker4ccbf062018-08-10 11:20:38 +01001496#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
David Horstmann3b2276a2022-10-06 14:49:08 +01001497 free_cli_id = ( partial == 0 );
Hanno Becker4ccbf062018-08-10 11:20:38 +01001498#endif
David Horstmann3b2276a2022-10-06 14:49:08 +01001499 if( free_cli_id )
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001500 {
1501 mbedtls_free( ssl->cli_id );
1502 ssl->cli_id = NULL;
1503 ssl->cli_id_len = 0;
1504 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001505#endif
1506
Paul Bakker48916f92012-09-16 19:57:18 +00001507 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
1508 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001509
1510 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00001511}
1512
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001513/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001514 * Reset an initialized and used SSL context for re-use while retaining
1515 * all application-set variables, function pointers and data.
1516 */
1517int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
1518{
Hanno Becker43aefe22020-02-05 10:44:56 +00001519 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001520}
1521
1522/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001523 * SSL set accessors
1524 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001525void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00001526{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001527 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001528}
1529
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02001530void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001531{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001532 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001533}
1534
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001535#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001536void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001537{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001538 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001539}
1540#endif
1541
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001542void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001543{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001544 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001545}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001547#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001548
Hanno Becker1841b0a2018-08-24 11:13:57 +01001549void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
1550 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01001551{
1552 ssl->disable_datagram_packing = !allow_packing;
1553}
1554
1555void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
1556 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001557{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001558 conf->hs_timeout_min = min;
1559 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001560}
1561#endif
1562
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001563void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00001564{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001565 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001566}
1567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001568#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001569void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02001570 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001571 void *p_vrfy )
1572{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001573 conf->f_vrfy = f_vrfy;
1574 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001575}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001576#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001577
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001578void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001579 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00001580 void *p_rng )
1581{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001582 conf->f_rng = f_rng;
1583 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001584}
1585
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001586void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02001587 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00001588 void *p_dbg )
1589{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001590 conf->f_dbg = f_dbg;
1591 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001592}
1593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001594void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001595 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00001596 mbedtls_ssl_send_t *f_send,
1597 mbedtls_ssl_recv_t *f_recv,
1598 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001599{
1600 ssl->p_bio = p_bio;
1601 ssl->f_send = f_send;
1602 ssl->f_recv = f_recv;
1603 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001604}
1605
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001606#if defined(MBEDTLS_SSL_PROTO_DTLS)
1607void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
1608{
1609 ssl->mtu = mtu;
1610}
1611#endif
1612
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001613void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001614{
1615 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001616}
1617
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001618void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
1619 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00001620 mbedtls_ssl_set_timer_t *f_set_timer,
1621 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001622{
1623 ssl->p_timer = p_timer;
1624 ssl->f_set_timer = f_set_timer;
1625 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001626
1627 /* Make sure we start with no timer running */
Hanno Becker0f57a652020-02-05 10:37:26 +00001628 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001629}
1630
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001631#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001632void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Hanno Beckera637ff62021-04-15 08:42:48 +01001633 void *p_cache,
1634 mbedtls_ssl_cache_get_t *f_get_cache,
1635 mbedtls_ssl_cache_set_t *f_set_cache )
Paul Bakker5121ce52009-01-03 21:22:43 +00001636{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001637 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001638 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001639 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001640}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001641#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001642
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001643#if defined(MBEDTLS_SSL_CLI_C)
1644int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00001645{
Janos Follath865b3eb2019-12-16 11:46:15 +00001646 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001647
1648 if( ssl == NULL ||
1649 session == NULL ||
1650 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001651 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001652 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001653 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001654 }
1655
Hanno Beckere810bbc2021-05-14 16:01:05 +01001656 if( ssl->handshake->resume == 1 )
1657 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1658
Jerry Yu21092062022-10-10 21:21:31 +08001659#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1660 if( session->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Jerry Yu40afab62022-10-08 10:42:13 +08001661 {
Jerry Yu21092062022-10-10 21:21:31 +08001662 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1663 mbedtls_ssl_ciphersuite_from_id( session->ciphersuite );
1664
1665 if( mbedtls_ssl_validate_ciphersuite(
1666 ssl, ciphersuite_info, MBEDTLS_SSL_VERSION_TLS1_3,
1667 MBEDTLS_SSL_VERSION_TLS1_3 ) != 0 )
1668 {
1669 MBEDTLS_SSL_DEBUG_MSG( 4, ( "%d is not a valid TLS 1.3 ciphersuite.",
1670 session->ciphersuite ) );
1671 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1672 }
Jerry Yu40afab62022-10-08 10:42:13 +08001673 }
Jerry Yu21092062022-10-10 21:21:31 +08001674#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu40afab62022-10-08 10:42:13 +08001675
Hanno Becker52055ae2019-02-06 14:30:46 +00001676 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
1677 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001678 return( ret );
1679
Paul Bakker0a597072012-09-25 21:55:46 +00001680 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001681
1682 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001683}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001684#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001685
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001686void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
1687 const int *ciphersuites )
1688{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001689 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001690}
1691
Ronald Cron6f135e12021-12-08 16:57:54 +01001692#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yucadebe52021-08-24 10:36:45 +08001693void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
Hanno Becker71f1ed62021-07-24 06:01:47 +01001694 const int kex_modes )
1695{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001696 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001697}
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001698
1699#if defined(MBEDTLS_SSL_EARLY_DATA)
1700void mbedtls_ssl_tls13_conf_early_data( mbedtls_ssl_config *conf,
Xiaokang Qian72dbfef2022-10-26 06:33:57 +00001701 int early_data_enabled )
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001702{
1703 conf->early_data_enabled = early_data_enabled;
1704}
1705#endif /* MBEDTLS_SSL_EARLY_DATA */
Ronald Cron6f135e12021-12-08 16:57:54 +01001706#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001707
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001708#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001709void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01001710 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001711{
1712 conf->cert_profile = profile;
1713}
1714
Glenn Strauss36872db2022-01-22 05:06:31 -05001715static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
1716{
1717 mbedtls_ssl_key_cert *cur = key_cert, *next;
1718
1719 while( cur != NULL )
1720 {
1721 next = cur->next;
1722 mbedtls_free( cur );
1723 cur = next;
1724 }
1725}
1726
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001727/* Append a new keycert entry to a (possibly empty) list */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001728MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001729static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
1730 mbedtls_x509_crt *cert,
1731 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001732{
niisato8ee24222018-06-25 19:05:48 +09001733 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001734
Glenn Strauss36872db2022-01-22 05:06:31 -05001735 if( cert == NULL )
1736 {
1737 /* Free list if cert is null */
1738 ssl_key_cert_free( *head );
1739 *head = NULL;
1740 return( 0 );
1741 }
1742
niisato8ee24222018-06-25 19:05:48 +09001743 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
1744 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001745 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001746
niisato8ee24222018-06-25 19:05:48 +09001747 new_cert->cert = cert;
1748 new_cert->key = key;
1749 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001750
Glenn Strauss36872db2022-01-22 05:06:31 -05001751 /* Update head if the list was null, else add to the end */
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001752 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01001753 {
niisato8ee24222018-06-25 19:05:48 +09001754 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01001755 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001756 else
1757 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001758 mbedtls_ssl_key_cert *cur = *head;
1759 while( cur->next != NULL )
1760 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09001761 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001762 }
1763
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001764 return( 0 );
1765}
1766
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001767int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001768 mbedtls_x509_crt *own_cert,
1769 mbedtls_pk_context *pk_key )
1770{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02001771 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001772}
1773
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001774void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001775 mbedtls_x509_crt *ca_chain,
1776 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001777{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001778 conf->ca_chain = ca_chain;
1779 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001780
1781#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1782 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1783 * cannot be used together. */
1784 conf->f_ca_cb = NULL;
1785 conf->p_ca_cb = NULL;
1786#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001787}
Hanno Becker5adaad92019-03-27 16:54:37 +00001788
1789#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1790void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00001791 mbedtls_x509_crt_ca_cb_t f_ca_cb,
Hanno Becker5adaad92019-03-27 16:54:37 +00001792 void *p_ca_cb )
1793{
1794 conf->f_ca_cb = f_ca_cb;
1795 conf->p_ca_cb = p_ca_cb;
1796
1797 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1798 * cannot be used together. */
1799 conf->ca_chain = NULL;
1800 conf->ca_crl = NULL;
1801}
1802#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001803#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001804
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001805#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Glenn Strauss69894072022-01-24 12:58:00 -05001806const unsigned char *mbedtls_ssl_get_hs_sni( mbedtls_ssl_context *ssl,
1807 size_t *name_len )
1808{
1809 *name_len = ssl->handshake->sni_name_len;
1810 return( ssl->handshake->sni_name );
1811}
1812
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001813int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
1814 mbedtls_x509_crt *own_cert,
1815 mbedtls_pk_context *pk_key )
1816{
1817 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
1818 own_cert, pk_key ) );
1819}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001820
1821void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
1822 mbedtls_x509_crt *ca_chain,
1823 mbedtls_x509_crl *ca_crl )
1824{
1825 ssl->handshake->sni_ca_chain = ca_chain;
1826 ssl->handshake->sni_ca_crl = ca_crl;
1827}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001828
Glenn Strauss999ef702022-03-11 01:37:23 -05001829#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
1830void mbedtls_ssl_set_hs_dn_hints( mbedtls_ssl_context *ssl,
1831 const mbedtls_x509_crt *crt)
1832{
1833 ssl->handshake->dn_hints = crt;
1834}
1835#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
1836
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001837void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
1838 int authmode )
1839{
1840 ssl->handshake->sni_authmode = authmode;
1841}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001842#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1843
Hanno Becker8927c832019-04-03 12:52:50 +01001844#if defined(MBEDTLS_X509_CRT_PARSE_C)
1845void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
1846 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1847 void *p_vrfy )
1848{
1849 ssl->f_vrfy = f_vrfy;
1850 ssl->p_vrfy = p_vrfy;
1851}
1852#endif
1853
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001854#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001855/*
1856 * Set EC J-PAKE password for current handshake
1857 */
Valerio Setti02c25b52022-11-15 14:08:42 +01001858#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001859int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
1860 const unsigned char *pw,
1861 size_t pw_len )
1862{
Neil Armstrongca7d5062022-05-31 14:43:23 +02001863 psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
1864 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1865 psa_pake_role_t psa_role;
1866 psa_status_t status;
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001867
Janos Follath8eb64132016-06-03 15:40:57 +01001868 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001869 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1870
Neil Armstrongca7d5062022-05-31 14:43:23 +02001871 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1872 psa_role = PSA_PAKE_ROLE_SERVER;
1873 else
1874 psa_role = PSA_PAKE_ROLE_CLIENT;
1875
Valerio Settiaca21b72022-11-17 18:17:01 +01001876 /* Empty password is not valid */
1877 if( ( pw == NULL) || ( pw_len == 0 ) )
1878 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Neil Armstrongca7d5062022-05-31 14:43:23 +02001879
Valerio Settiaca21b72022-11-17 18:17:01 +01001880 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
1881 psa_set_key_algorithm( &attributes, PSA_ALG_JPAKE );
1882 psa_set_key_type( &attributes, PSA_KEY_TYPE_PASSWORD );
Neil Armstrongca7d5062022-05-31 14:43:23 +02001883
Valerio Settiaca21b72022-11-17 18:17:01 +01001884 status = psa_import_key( &attributes, pw, pw_len,
1885 &ssl->handshake->psa_pake_password );
1886 if( status != PSA_SUCCESS )
1887 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Neil Armstrongca7d5062022-05-31 14:43:23 +02001888
1889 psa_pake_cs_set_algorithm( &cipher_suite, PSA_ALG_JPAKE );
1890 psa_pake_cs_set_primitive( &cipher_suite,
1891 PSA_PAKE_PRIMITIVE( PSA_PAKE_PRIMITIVE_TYPE_ECC,
1892 PSA_ECC_FAMILY_SECP_R1,
1893 256) );
1894 psa_pake_cs_set_hash( &cipher_suite, PSA_ALG_SHA_256 );
1895
1896 status = psa_pake_setup( &ssl->handshake->psa_pake_ctx, &cipher_suite );
1897 if( status != PSA_SUCCESS )
1898 {
1899 psa_destroy_key( ssl->handshake->psa_pake_password );
1900 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1901 }
1902
1903 status = psa_pake_set_role( &ssl->handshake->psa_pake_ctx, psa_role );
1904 if( status != PSA_SUCCESS )
1905 {
1906 psa_destroy_key( ssl->handshake->psa_pake_password );
1907 psa_pake_abort( &ssl->handshake->psa_pake_ctx );
1908 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1909 }
1910
Valerio Setti70d1fa52022-12-07 16:20:27 +01001911 status = psa_pake_set_password_key( &ssl->handshake->psa_pake_ctx,
Valerio Settiaca21b72022-11-17 18:17:01 +01001912 ssl->handshake->psa_pake_password );
1913 if( status != PSA_SUCCESS )
Neil Armstrongca7d5062022-05-31 14:43:23 +02001914 {
Valerio Settiaca21b72022-11-17 18:17:01 +01001915 psa_destroy_key( ssl->handshake->psa_pake_password );
1916 psa_pake_abort( &ssl->handshake->psa_pake_ctx );
1917 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Neil Armstrongca7d5062022-05-31 14:43:23 +02001918 }
1919
1920 ssl->handshake->psa_pake_ctx_is_ok = 1;
1921
1922 return( 0 );
Valerio Setti02c25b52022-11-15 14:08:42 +01001923}
Valerio Settia9a97dc2022-11-28 18:26:16 +01001924
1925int mbedtls_ssl_set_hs_ecjpake_password_opaque( mbedtls_ssl_context *ssl,
1926 mbedtls_svc_key_id_t pwd )
1927{
1928 psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
1929 psa_pake_role_t psa_role;
1930 psa_status_t status;
1931
1932 if( ssl->handshake == NULL || ssl->conf == NULL )
1933 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1934
Valerio Settia9a97dc2022-11-28 18:26:16 +01001935 if( mbedtls_svc_key_id_is_null( pwd ) )
1936 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1937 ssl->handshake->psa_pake_password = pwd;
1938
1939 psa_pake_cs_set_algorithm( &cipher_suite, PSA_ALG_JPAKE );
1940 psa_pake_cs_set_primitive( &cipher_suite,
1941 PSA_PAKE_PRIMITIVE( PSA_PAKE_PRIMITIVE_TYPE_ECC,
1942 PSA_ECC_FAMILY_SECP_R1,
1943 256) );
1944 psa_pake_cs_set_hash( &cipher_suite, PSA_ALG_SHA_256 );
1945
1946 status = psa_pake_setup( &ssl->handshake->psa_pake_ctx, &cipher_suite );
1947 if( status != PSA_SUCCESS )
Valerio Setti757f3592022-12-02 11:07:11 +01001948 goto error;
Valerio Settia9a97dc2022-11-28 18:26:16 +01001949
Valerio Settic689ed82022-12-07 14:40:38 +01001950 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1951 psa_role = PSA_PAKE_ROLE_SERVER;
1952 else
1953 psa_role = PSA_PAKE_ROLE_CLIENT;
1954
Valerio Settia9a97dc2022-11-28 18:26:16 +01001955 status = psa_pake_set_role( &ssl->handshake->psa_pake_ctx, psa_role );
1956 if( status != PSA_SUCCESS )
Valerio Setti757f3592022-12-02 11:07:11 +01001957 goto error;
Valerio Settia9a97dc2022-11-28 18:26:16 +01001958
Valerio Setti70d1fa52022-12-07 16:20:27 +01001959 status = psa_pake_set_password_key( &ssl->handshake->psa_pake_ctx,
Valerio Settia9a97dc2022-11-28 18:26:16 +01001960 ssl->handshake->psa_pake_password );
1961 if( status != PSA_SUCCESS )
Valerio Setti757f3592022-12-02 11:07:11 +01001962 goto error;
Valerio Settia9a97dc2022-11-28 18:26:16 +01001963
1964 ssl->handshake->psa_pake_ctx_is_ok = 1;
1965
1966 return( 0 );
Valerio Setti757f3592022-12-02 11:07:11 +01001967
1968error:
1969 psa_pake_abort( &ssl->handshake->psa_pake_ctx );
1970 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Valerio Settia9a97dc2022-11-28 18:26:16 +01001971}
Valerio Setti02c25b52022-11-15 14:08:42 +01001972#else /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001973int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
1974 const unsigned char *pw,
1975 size_t pw_len )
1976{
1977 mbedtls_ecjpake_role role;
1978
1979 if( ssl->handshake == NULL || ssl->conf == NULL )
1980 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1981
Valerio Settic689ed82022-12-07 14:40:38 +01001982 /* Empty password is not valid */
1983 if( ( pw == NULL) || ( pw_len == 0 ) )
1984 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1985
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001986 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1987 role = MBEDTLS_ECJPAKE_SERVER;
1988 else
1989 role = MBEDTLS_ECJPAKE_CLIENT;
1990
1991 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
1992 role,
1993 MBEDTLS_MD_SHA256,
1994 MBEDTLS_ECP_DP_SECP256R1,
1995 pw, pw_len ) );
1996}
Valerio Setti02c25b52022-11-15 14:08:42 +01001997#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001998#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001999
Ronald Cron73fe8df2022-10-05 14:31:43 +02002000#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Ronald Crond29e13e2022-10-19 10:33:48 +02002001int mbedtls_ssl_conf_has_static_psk( mbedtls_ssl_config const *conf )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002002{
Ronald Crond29e13e2022-10-19 10:33:48 +02002003 if( conf->psk_identity == NULL ||
2004 conf->psk_identity_len == 0 )
2005 {
2006 return( 0 );
2007 }
2008
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002009#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Crond29e13e2022-10-19 10:33:48 +02002010 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002011 return( 1 );
2012#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Crond29e13e2022-10-19 10:33:48 +02002013
2014 if( conf->psk != NULL && conf->psk_len != 0 )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002015 return( 1 );
2016
2017 return( 0 );
2018}
2019
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002020static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
2021{
2022 /* Remove reference to existing PSK, if any. */
2023#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02002024 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002025 {
2026 /* The maintenance of the PSK key slot is the
2027 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02002028 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002029 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002030#endif /* MBEDTLS_USE_PSA_CRYPTO */
2031 if( conf->psk != NULL )
2032 {
2033 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
2034
2035 mbedtls_free( conf->psk );
2036 conf->psk = NULL;
2037 conf->psk_len = 0;
2038 }
2039
2040 /* Remove reference to PSK identity, if any. */
2041 if( conf->psk_identity != NULL )
2042 {
2043 mbedtls_free( conf->psk_identity );
2044 conf->psk_identity = NULL;
2045 conf->psk_identity_len = 0;
2046 }
2047}
2048
Hanno Becker7390c712018-11-15 13:33:04 +00002049/* This function assumes that PSK identity in the SSL config is unset.
2050 * It checks that the provided identity is well-formed and attempts
2051 * to make a copy of it in the SSL config.
2052 * On failure, the PSK identity in the config remains unset. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002053MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker7390c712018-11-15 13:33:04 +00002054static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
2055 unsigned char const *psk_identity,
2056 size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002057{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002058 /* Identity len will be encoded on two bytes */
Hanno Becker7390c712018-11-15 13:33:04 +00002059 if( psk_identity == NULL ||
Ronald Cron2a87e9b2022-10-19 10:55:26 +02002060 psk_identity_len == 0 ||
Hanno Becker7390c712018-11-15 13:33:04 +00002061 ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10002062 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002063 {
2064 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2065 }
2066
Hanno Becker7390c712018-11-15 13:33:04 +00002067 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
2068 if( conf->psk_identity == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002069 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker6db455e2013-09-18 17:29:31 +02002070
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01002071 conf->psk_identity_len = psk_identity_len;
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01002072 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker5ad403f2013-09-18 21:21:30 +02002073
2074 return( 0 );
Paul Bakker6db455e2013-09-18 17:29:31 +02002075}
2076
Hanno Becker7390c712018-11-15 13:33:04 +00002077int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
2078 const unsigned char *psk, size_t psk_len,
2079 const unsigned char *psk_identity, size_t psk_identity_len )
2080{
Janos Follath865b3eb2019-12-16 11:46:15 +00002081 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002082
2083 /* We currently only support one PSK, raw or opaque. */
Ronald Crond29e13e2022-10-19 10:33:48 +02002084 if( mbedtls_ssl_conf_has_static_psk( conf ) )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002085 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Becker7390c712018-11-15 13:33:04 +00002086
2087 /* Check and set raw PSK */
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01002088 if( psk == NULL )
Hanno Becker7390c712018-11-15 13:33:04 +00002089 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01002090 if( psk_len == 0 )
2091 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2092 if( psk_len > MBEDTLS_PSK_MAX_LEN )
2093 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2094
Hanno Becker7390c712018-11-15 13:33:04 +00002095 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
2096 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2097 conf->psk_len = psk_len;
2098 memcpy( conf->psk, psk, conf->psk_len );
2099
2100 /* Check and set PSK Identity */
2101 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
2102 if( ret != 0 )
2103 ssl_conf_remove_psk( conf );
2104
2105 return( ret );
2106}
2107
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002108static void ssl_remove_psk( mbedtls_ssl_context *ssl )
2109{
2110#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02002111 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002112 {
Neil Armstrong501c9322022-05-03 09:35:09 +02002113 /* The maintenance of the external PSK key slot is the
2114 * user's responsibility. */
2115 if( ssl->handshake->psk_opaque_is_internal )
2116 {
2117 psa_destroy_key( ssl->handshake->psk_opaque );
2118 ssl->handshake->psk_opaque_is_internal = 0;
2119 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02002120 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002121 }
Neil Armstronge952a302022-05-03 10:22:14 +02002122#else
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002123 if( ssl->handshake->psk != NULL )
2124 {
2125 mbedtls_platform_zeroize( ssl->handshake->psk,
2126 ssl->handshake->psk_len );
2127 mbedtls_free( ssl->handshake->psk );
2128 ssl->handshake->psk_len = 0;
2129 }
Neil Armstronge952a302022-05-03 10:22:14 +02002130#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002131}
2132
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002133int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
2134 const unsigned char *psk, size_t psk_len )
2135{
Neil Armstrong501c9322022-05-03 09:35:09 +02002136#if defined(MBEDTLS_USE_PSA_CRYPTO)
2137 psa_key_attributes_t key_attributes = psa_key_attributes_init();
Jerry Yu5d01c052022-08-17 10:18:10 +08002138 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Jerry Yu24b8c812022-08-20 19:06:56 +08002139 psa_algorithm_t alg = PSA_ALG_NONE;
Jerry Yu5d01c052022-08-17 10:18:10 +08002140 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrong501c9322022-05-03 09:35:09 +02002141#endif /* MBEDTLS_USE_PSA_CRYPTO */
2142
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002143 if( psk == NULL || ssl->handshake == NULL )
2144 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2145
2146 if( psk_len > MBEDTLS_PSK_MAX_LEN )
2147 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2148
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002149 ssl_remove_psk( ssl );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002150
Neil Armstrong501c9322022-05-03 09:35:09 +02002151#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yuccc68a42022-07-26 16:39:20 +08002152#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2153 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
2154 {
Jerry Yu6cf6b472022-08-16 14:50:28 +08002155 if( ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Jerry Yuccc68a42022-07-26 16:39:20 +08002156 alg = PSA_ALG_TLS12_PSK_TO_MS( PSA_ALG_SHA_384 );
2157 else
2158 alg = PSA_ALG_TLS12_PSK_TO_MS( PSA_ALG_SHA_256 );
2159 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
2160 }
2161#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Neil Armstrong501c9322022-05-03 09:35:09 +02002162
Jerry Yu568ec252022-07-22 21:27:34 +08002163#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yuccc68a42022-07-26 16:39:20 +08002164 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
2165 {
2166 alg = PSA_ALG_HKDF_EXTRACT( PSA_ALG_ANY_HASH );
2167 psa_set_key_usage_flags( &key_attributes,
2168 PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_EXPORT );
2169 }
2170#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2171
Neil Armstrong501c9322022-05-03 09:35:09 +02002172 psa_set_key_algorithm( &key_attributes, alg );
2173 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
2174
2175 status = psa_import_key( &key_attributes, psk, psk_len, &key );
2176 if( status != PSA_SUCCESS )
2177 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
2178
2179 /* Allow calling psa_destroy_key() on psk remove */
2180 ssl->handshake->psk_opaque_is_internal = 1;
2181 return mbedtls_ssl_set_hs_psk_opaque( ssl, key );
2182#else
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02002183 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002184 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002185
2186 ssl->handshake->psk_len = psk_len;
2187 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
2188
2189 return( 0 );
Neil Armstrong501c9322022-05-03 09:35:09 +02002190#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002191}
2192
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002193#if defined(MBEDTLS_USE_PSA_CRYPTO)
2194int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
Andrzej Kurek03e01462022-01-03 12:53:24 +01002195 mbedtls_svc_key_id_t psk,
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002196 const unsigned char *psk_identity,
2197 size_t psk_identity_len )
2198{
Janos Follath865b3eb2019-12-16 11:46:15 +00002199 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002200
2201 /* We currently only support one PSK, raw or opaque. */
Ronald Crond29e13e2022-10-19 10:33:48 +02002202 if( mbedtls_ssl_conf_has_static_psk( conf ) )
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002203 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002204
Hanno Becker7390c712018-11-15 13:33:04 +00002205 /* Check and set opaque PSK */
Ronald Croncf56a0a2020-08-04 09:51:30 +02002206 if( mbedtls_svc_key_id_is_null( psk ) )
Hanno Becker7390c712018-11-15 13:33:04 +00002207 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ronald Croncf56a0a2020-08-04 09:51:30 +02002208 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00002209
2210 /* Check and set PSK Identity */
2211 ret = ssl_conf_set_psk_identity( conf, psk_identity,
2212 psk_identity_len );
2213 if( ret != 0 )
2214 ssl_conf_remove_psk( conf );
2215
2216 return( ret );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002217}
2218
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002219int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
2220 mbedtls_svc_key_id_t psk )
2221{
2222 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
2223 ( ssl->handshake == NULL ) )
2224 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2225
2226 ssl_remove_psk( ssl );
2227 ssl->handshake->psk_opaque = psk;
2228 return( 0 );
2229}
2230#endif /* MBEDTLS_USE_PSA_CRYPTO */
2231
Jerry Yu8897c072022-08-12 13:56:53 +08002232#if defined(MBEDTLS_SSL_SRV_C)
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002233void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
2234 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
2235 size_t),
2236 void *p_psk )
2237{
2238 conf->f_psk = f_psk;
2239 conf->p_psk = p_psk;
2240}
Jerry Yu8897c072022-08-12 13:56:53 +08002241#endif /* MBEDTLS_SSL_SRV_C */
2242
Ronald Cron73fe8df2022-10-05 14:31:43 +02002243#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002244
2245#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine301711e2022-04-26 16:57:05 +02002246static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
2247 psa_algorithm_t alg )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002248{
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002249#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002250 if( alg == PSA_ALG_CBC_NO_PADDING )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002251 return( MBEDTLS_SSL_MODE_CBC );
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002252#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002253 if( PSA_ALG_IS_AEAD( alg ) )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002254 return( MBEDTLS_SSL_MODE_AEAD );
Gilles Peskine301711e2022-04-26 16:57:05 +02002255 return( MBEDTLS_SSL_MODE_STREAM );
2256}
2257
2258#else /* MBEDTLS_USE_PSA_CRYPTO */
2259
2260static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
2261 mbedtls_cipher_mode_t mode )
2262{
2263#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
2264 if( mode == MBEDTLS_MODE_CBC )
2265 return( MBEDTLS_SSL_MODE_CBC );
2266#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
2267
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002268#if defined(MBEDTLS_GCM_C) || \
2269 defined(MBEDTLS_CCM_C) || \
2270 defined(MBEDTLS_CHACHAPOLY_C)
2271 if( mode == MBEDTLS_MODE_GCM ||
2272 mode == MBEDTLS_MODE_CCM ||
2273 mode == MBEDTLS_MODE_CHACHAPOLY )
2274 return( MBEDTLS_SSL_MODE_AEAD );
2275#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002276
2277 return( MBEDTLS_SSL_MODE_STREAM );
2278}
Gilles Peskine301711e2022-04-26 16:57:05 +02002279#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002280
Gilles Peskinee108d982022-04-26 16:50:40 +02002281static mbedtls_ssl_mode_t mbedtls_ssl_get_actual_mode(
2282 mbedtls_ssl_mode_t base_mode,
2283 int encrypt_then_mac )
2284{
2285#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
2286 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
2287 base_mode == MBEDTLS_SSL_MODE_CBC )
2288 {
2289 return( MBEDTLS_SSL_MODE_CBC_ETM );
2290 }
2291#else
2292 (void) encrypt_then_mac;
2293#endif
2294 return( base_mode );
2295}
2296
Neil Armstrongab555e02022-04-04 11:07:59 +02002297mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002298 const mbedtls_ssl_transform *transform )
2299{
Gilles Peskinee108d982022-04-26 16:50:40 +02002300 mbedtls_ssl_mode_t base_mode = mbedtls_ssl_get_base_mode(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002301#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskinee108d982022-04-26 16:50:40 +02002302 transform->psa_alg
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002303#else
Gilles Peskinee108d982022-04-26 16:50:40 +02002304 mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc )
2305#endif
2306 );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002307
Gilles Peskinee108d982022-04-26 16:50:40 +02002308 int encrypt_then_mac = 0;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002309#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskinee108d982022-04-26 16:50:40 +02002310 encrypt_then_mac = transform->encrypt_then_mac;
2311#endif
2312 return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002313}
2314
Neil Armstrongab555e02022-04-04 11:07:59 +02002315mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002316#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002317 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002318#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002319 const mbedtls_ssl_ciphersuite_t *suite )
2320{
Gilles Peskinee108d982022-04-26 16:50:40 +02002321 mbedtls_ssl_mode_t base_mode = MBEDTLS_SSL_MODE_STREAM;
2322
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002323#if defined(MBEDTLS_USE_PSA_CRYPTO)
2324 psa_status_t status;
2325 psa_algorithm_t alg;
2326 psa_key_type_t type;
2327 size_t size;
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002328 status = mbedtls_ssl_cipher_to_psa( suite->cipher, 0, &alg, &type, &size );
2329 if( status == PSA_SUCCESS )
Gilles Peskinee108d982022-04-26 16:50:40 +02002330 base_mode = mbedtls_ssl_get_base_mode( alg );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002331#else
2332 const mbedtls_cipher_info_t *cipher =
2333 mbedtls_cipher_info_from_type( suite->cipher );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002334 if( cipher != NULL )
Gilles Peskinee108d982022-04-26 16:50:40 +02002335 {
2336 base_mode =
2337 mbedtls_ssl_get_base_mode(
2338 mbedtls_cipher_info_get_mode( cipher ) );
2339 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002340#endif /* MBEDTLS_USE_PSA_CRYPTO */
2341
Gilles Peskinee108d982022-04-26 16:50:40 +02002342#if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
2343 int encrypt_then_mac = 0;
2344#endif
2345 return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002346}
2347
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002348#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu251a12e2022-07-13 15:15:48 +08002349
2350#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu438ddd82022-07-07 06:55:50 +00002351/* Serialization of TLS 1.3 sessions:
2352 *
2353 * struct {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002354 * opaque hostname<0..2^16-1>;
Jerry Yu438ddd82022-07-07 06:55:50 +00002355 * uint64 ticket_received;
2356 * uint32 ticket_lifetime;
Jerry Yu34191072022-08-18 10:32:09 +08002357 * opaque ticket<1..2^16-1>;
Jerry Yu438ddd82022-07-07 06:55:50 +00002358 * } ClientOnlyData;
2359 *
2360 * struct {
2361 * uint8 endpoint;
2362 * uint8 ciphersuite[2];
2363 * uint32 ticket_age_add;
2364 * uint8 ticket_flags;
2365 * opaque resumption_key<0..255>;
2366 * select ( endpoint ) {
2367 * case client: ClientOnlyData;
2368 * case server: uint64 start_time;
2369 * };
2370 * } serialized_session_tls13;
2371 *
2372 */
2373#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yue36fdd62022-08-17 21:31:36 +08002374MBEDTLS_CHECK_RETURN_CRITICAL
2375static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
2376 unsigned char *buf,
2377 size_t buf_len,
2378 size_t *olen )
Jerry Yu438ddd82022-07-07 06:55:50 +00002379{
2380 unsigned char *p = buf;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00002381#if defined(MBEDTLS_SSL_CLI_C) && \
2382 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2383 size_t hostname_len = ( session->hostname == NULL ) ?
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002384 0 : strlen( session->hostname ) + 1;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00002385#endif
Jerry Yubc7c1a42022-07-21 22:57:37 +08002386 size_t needed = 1 /* endpoint */
2387 + 2 /* ciphersuite */
2388 + 4 /* ticket_age_add */
Jerry Yu34191072022-08-18 10:32:09 +08002389 + 1 /* ticket_flags */
2390 + 1; /* resumption_key length */
Jerry Yue36fdd62022-08-17 21:31:36 +08002391 *olen = 0;
Jerry Yu34191072022-08-18 10:32:09 +08002392
2393 if( session->resumption_key_len > MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN )
2394 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2395 needed += session->resumption_key_len; /* resumption_key */
2396
Jerry Yu438ddd82022-07-07 06:55:50 +00002397#if defined(MBEDTLS_HAVE_TIME)
2398 needed += 8; /* start_time or ticket_received */
2399#endif
2400
2401#if defined(MBEDTLS_SSL_CLI_C)
2402 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
2403 {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002404#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00002405 needed += 2 /* hostname_len */
Xiaokang Qian2f9efd32022-10-10 11:24:08 +00002406 + hostname_len; /* hostname */
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00002407#endif
2408
Jerry Yu438ddd82022-07-07 06:55:50 +00002409 needed += 4 /* ticket_lifetime */
Jerry Yue36fdd62022-08-17 21:31:36 +08002410 + 2; /* ticket_len */
Jerry Yu34191072022-08-18 10:32:09 +08002411
2412 /* Check size_t overflow */
Jerry Yue36fdd62022-08-17 21:31:36 +08002413 if( session->ticket_len > SIZE_MAX - needed )
2414 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yu34191072022-08-18 10:32:09 +08002415
Jerry Yue28d9742022-08-18 15:44:03 +08002416 needed += session->ticket_len; /* ticket */
Jerry Yu438ddd82022-07-07 06:55:50 +00002417 }
2418#endif /* MBEDTLS_SSL_CLI_C */
2419
Jerry Yue36fdd62022-08-17 21:31:36 +08002420 *olen = needed;
Jerry Yu438ddd82022-07-07 06:55:50 +00002421 if( needed > buf_len )
Jerry Yue36fdd62022-08-17 21:31:36 +08002422 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Jerry Yu438ddd82022-07-07 06:55:50 +00002423
2424 p[0] = session->endpoint;
2425 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 1 );
2426 MBEDTLS_PUT_UINT32_BE( session->ticket_age_add, p, 3 );
2427 p[7] = session->ticket_flags;
2428
2429 /* save resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002430 p[8] = session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002431 p += 9;
Jerry Yubc7c1a42022-07-21 22:57:37 +08002432 memcpy( p, session->resumption_key, session->resumption_key_len );
2433 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002434
2435#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
2436 if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
2437 {
2438 MBEDTLS_PUT_UINT64_BE( (uint64_t) session->start, p, 0 );
2439 p += 8;
2440 }
2441#endif /* MBEDTLS_HAVE_TIME */
2442
2443#if defined(MBEDTLS_SSL_CLI_C)
2444 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
2445 {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002446#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2447 MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 );
2448 p += 2;
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002449 if( hostname_len > 0 )
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002450 {
2451 /* save host name */
2452 memcpy( p, session->hostname, hostname_len );
2453 p += hostname_len;
2454 }
2455#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
2456
Jerry Yu438ddd82022-07-07 06:55:50 +00002457#if defined(MBEDTLS_HAVE_TIME)
2458 MBEDTLS_PUT_UINT64_BE( (uint64_t) session->ticket_received, p, 0 );
2459 p += 8;
2460#endif
2461 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
2462 p += 4;
2463
2464 MBEDTLS_PUT_UINT16_BE( session->ticket_len, p, 0 );
2465 p += 2;
Jerry Yu34191072022-08-18 10:32:09 +08002466
2467 if( session->ticket != NULL && session->ticket_len > 0 )
Jerry Yu438ddd82022-07-07 06:55:50 +00002468 {
2469 memcpy( p, session->ticket, session->ticket_len );
2470 p += session->ticket_len;
2471 }
2472 }
2473#endif /* MBEDTLS_SSL_CLI_C */
Jerry Yue36fdd62022-08-17 21:31:36 +08002474 return( 0 );
Jerry Yu438ddd82022-07-07 06:55:50 +00002475}
2476
2477MBEDTLS_CHECK_RETURN_CRITICAL
2478static int ssl_tls13_session_load( mbedtls_ssl_session *session,
2479 const unsigned char *buf,
2480 size_t len )
2481{
2482 const unsigned char *p = buf;
2483 const unsigned char *end = buf + len;
2484
2485 if( end - p < 9 )
2486 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2487 session->endpoint = p[0];
2488 session->ciphersuite = MBEDTLS_GET_UINT16_BE( p, 1 );
2489 session->ticket_age_add = MBEDTLS_GET_UINT32_BE( p, 3 );
2490 session->ticket_flags = p[7];
2491
2492 /* load resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002493 session->resumption_key_len = p[8];
Jerry Yu438ddd82022-07-07 06:55:50 +00002494 p += 9;
2495
Jerry Yubc7c1a42022-07-21 22:57:37 +08002496 if( end - p < session->resumption_key_len )
Jerry Yu438ddd82022-07-07 06:55:50 +00002497 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2498
Jerry Yubc7c1a42022-07-21 22:57:37 +08002499 if( sizeof( session->resumption_key ) < session->resumption_key_len )
Jerry Yu438ddd82022-07-07 06:55:50 +00002500 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yubc7c1a42022-07-21 22:57:37 +08002501 memcpy( session->resumption_key, p, session->resumption_key_len );
2502 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002503
2504#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
2505 if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
2506 {
2507 if( end - p < 8 )
2508 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2509 session->start = MBEDTLS_GET_UINT64_BE( p, 0 );
2510 p += 8;
2511 }
2512#endif /* MBEDTLS_HAVE_TIME */
2513
2514#if defined(MBEDTLS_SSL_CLI_C)
2515 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
2516 {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002517#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
2518 defined(MBEDTLS_SSL_SESSION_TICKETS)
2519 size_t hostname_len;
2520 /* load host name */
2521 if( end - p < 2 )
2522 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2523 hostname_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2524 p += 2;
2525
2526 if( end - p < ( long int )hostname_len )
2527 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2528 if( hostname_len > 0 )
2529 {
2530 session->hostname = mbedtls_calloc( 1, hostname_len );
2531 if( session->hostname == NULL )
2532 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2533 memcpy( session->hostname, p, hostname_len );
2534 p += hostname_len;
2535 }
2536#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION &&
2537 MBEDTLS_SSL_SESSION_TICKETS */
2538
Jerry Yu438ddd82022-07-07 06:55:50 +00002539#if defined(MBEDTLS_HAVE_TIME)
2540 if( end - p < 8 )
2541 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2542 session->ticket_received = MBEDTLS_GET_UINT64_BE( p, 0 );
2543 p += 8;
2544#endif
2545 if( end - p < 4 )
2546 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2547 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE( p, 0 );
2548 p += 4;
2549
2550 if( end - p < 2 )
2551 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2552 session->ticket_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2553 p += 2;
2554
2555 if( end - p < ( long int )session->ticket_len )
2556 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2557 if( session->ticket_len > 0 )
2558 {
2559 session->ticket = mbedtls_calloc( 1, session->ticket_len );
2560 if( session->ticket == NULL )
2561 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2562 memcpy( session->ticket, p, session->ticket_len );
2563 p += session->ticket_len;
2564 }
2565 }
2566#endif /* MBEDTLS_SSL_CLI_C */
2567
2568 return( 0 );
2569
2570}
2571#else /* MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yue36fdd62022-08-17 21:31:36 +08002572MBEDTLS_CHECK_RETURN_CRITICAL
2573static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
2574 unsigned char *buf,
2575 size_t buf_len,
2576 size_t *olen )
Jerry Yu251a12e2022-07-13 15:15:48 +08002577{
2578 ((void) session);
2579 ((void) buf);
2580 ((void) buf_len);
Jerry Yue36fdd62022-08-17 21:31:36 +08002581 *olen = 0;
2582 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Jerry Yu251a12e2022-07-13 15:15:48 +08002583}
Jerry Yu438ddd82022-07-07 06:55:50 +00002584
2585static int ssl_tls13_session_load( const mbedtls_ssl_session *session,
2586 unsigned char *buf,
2587 size_t buf_len )
2588{
2589 ((void) session);
2590 ((void) buf);
2591 ((void) buf_len);
2592 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2593}
2594#endif /* !MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yu251a12e2022-07-13 15:15:48 +08002595#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2596
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01002597psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002598 size_t taglen,
2599 psa_algorithm_t *alg,
2600 psa_key_type_t *key_type,
2601 size_t *key_size )
2602{
2603 switch ( mbedtls_cipher_type )
2604 {
2605 case MBEDTLS_CIPHER_AES_128_CBC:
2606 *alg = PSA_ALG_CBC_NO_PADDING;
2607 *key_type = PSA_KEY_TYPE_AES;
2608 *key_size = 128;
2609 break;
2610 case MBEDTLS_CIPHER_AES_128_CCM:
2611 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2612 *key_type = PSA_KEY_TYPE_AES;
2613 *key_size = 128;
2614 break;
2615 case MBEDTLS_CIPHER_AES_128_GCM:
2616 *alg = PSA_ALG_GCM;
2617 *key_type = PSA_KEY_TYPE_AES;
2618 *key_size = 128;
2619 break;
2620 case MBEDTLS_CIPHER_AES_192_CCM:
2621 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2622 *key_type = PSA_KEY_TYPE_AES;
2623 *key_size = 192;
2624 break;
2625 case MBEDTLS_CIPHER_AES_192_GCM:
2626 *alg = PSA_ALG_GCM;
2627 *key_type = PSA_KEY_TYPE_AES;
2628 *key_size = 192;
2629 break;
2630 case MBEDTLS_CIPHER_AES_256_CBC:
2631 *alg = PSA_ALG_CBC_NO_PADDING;
2632 *key_type = PSA_KEY_TYPE_AES;
2633 *key_size = 256;
2634 break;
2635 case MBEDTLS_CIPHER_AES_256_CCM:
2636 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2637 *key_type = PSA_KEY_TYPE_AES;
2638 *key_size = 256;
2639 break;
2640 case MBEDTLS_CIPHER_AES_256_GCM:
2641 *alg = PSA_ALG_GCM;
2642 *key_type = PSA_KEY_TYPE_AES;
2643 *key_size = 256;
2644 break;
2645 case MBEDTLS_CIPHER_ARIA_128_CBC:
2646 *alg = PSA_ALG_CBC_NO_PADDING;
2647 *key_type = PSA_KEY_TYPE_ARIA;
2648 *key_size = 128;
2649 break;
2650 case MBEDTLS_CIPHER_ARIA_128_CCM:
2651 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2652 *key_type = PSA_KEY_TYPE_ARIA;
2653 *key_size = 128;
2654 break;
2655 case MBEDTLS_CIPHER_ARIA_128_GCM:
2656 *alg = PSA_ALG_GCM;
2657 *key_type = PSA_KEY_TYPE_ARIA;
2658 *key_size = 128;
2659 break;
2660 case MBEDTLS_CIPHER_ARIA_192_CCM:
2661 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2662 *key_type = PSA_KEY_TYPE_ARIA;
2663 *key_size = 192;
2664 break;
2665 case MBEDTLS_CIPHER_ARIA_192_GCM:
2666 *alg = PSA_ALG_GCM;
2667 *key_type = PSA_KEY_TYPE_ARIA;
2668 *key_size = 192;
2669 break;
2670 case MBEDTLS_CIPHER_ARIA_256_CBC:
2671 *alg = PSA_ALG_CBC_NO_PADDING;
2672 *key_type = PSA_KEY_TYPE_ARIA;
2673 *key_size = 256;
2674 break;
2675 case MBEDTLS_CIPHER_ARIA_256_CCM:
2676 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2677 *key_type = PSA_KEY_TYPE_ARIA;
2678 *key_size = 256;
2679 break;
2680 case MBEDTLS_CIPHER_ARIA_256_GCM:
2681 *alg = PSA_ALG_GCM;
2682 *key_type = PSA_KEY_TYPE_ARIA;
2683 *key_size = 256;
2684 break;
2685 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
2686 *alg = PSA_ALG_CBC_NO_PADDING;
2687 *key_type = PSA_KEY_TYPE_CAMELLIA;
2688 *key_size = 128;
2689 break;
2690 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
2691 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2692 *key_type = PSA_KEY_TYPE_CAMELLIA;
2693 *key_size = 128;
2694 break;
2695 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
2696 *alg = PSA_ALG_GCM;
2697 *key_type = PSA_KEY_TYPE_CAMELLIA;
2698 *key_size = 128;
2699 break;
2700 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
2701 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2702 *key_type = PSA_KEY_TYPE_CAMELLIA;
2703 *key_size = 192;
2704 break;
2705 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
2706 *alg = PSA_ALG_GCM;
2707 *key_type = PSA_KEY_TYPE_CAMELLIA;
2708 *key_size = 192;
2709 break;
2710 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
2711 *alg = PSA_ALG_CBC_NO_PADDING;
2712 *key_type = PSA_KEY_TYPE_CAMELLIA;
2713 *key_size = 256;
2714 break;
2715 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
2716 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2717 *key_type = PSA_KEY_TYPE_CAMELLIA;
2718 *key_size = 256;
2719 break;
2720 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
2721 *alg = PSA_ALG_GCM;
2722 *key_type = PSA_KEY_TYPE_CAMELLIA;
2723 *key_size = 256;
2724 break;
2725 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
2726 *alg = PSA_ALG_CHACHA20_POLY1305;
2727 *key_type = PSA_KEY_TYPE_CHACHA20;
2728 *key_size = 256;
2729 break;
2730 case MBEDTLS_CIPHER_NULL:
2731 *alg = MBEDTLS_SSL_NULL_CIPHER;
2732 *key_type = 0;
2733 *key_size = 0;
2734 break;
2735 default:
2736 return PSA_ERROR_NOT_SUPPORTED;
2737 }
2738
2739 return PSA_SUCCESS;
2740}
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002741#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002742
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002743#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckera90658f2017-10-04 15:29:08 +01002744int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
2745 const unsigned char *dhm_P, size_t P_len,
2746 const unsigned char *dhm_G, size_t G_len )
2747{
Janos Follath865b3eb2019-12-16 11:46:15 +00002748 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01002749
Glenn Strausscee11292021-12-20 01:43:17 -05002750 mbedtls_mpi_free( &conf->dhm_P );
2751 mbedtls_mpi_free( &conf->dhm_G );
2752
Hanno Beckera90658f2017-10-04 15:29:08 +01002753 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
2754 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
2755 {
2756 mbedtls_mpi_free( &conf->dhm_P );
2757 mbedtls_mpi_free( &conf->dhm_G );
2758 return( ret );
2759 }
2760
2761 return( 0 );
2762}
Paul Bakker5121ce52009-01-03 21:22:43 +00002763
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002764int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00002765{
Janos Follath865b3eb2019-12-16 11:46:15 +00002766 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00002767
Glenn Strausscee11292021-12-20 01:43:17 -05002768 mbedtls_mpi_free( &conf->dhm_P );
2769 mbedtls_mpi_free( &conf->dhm_G );
2770
Gilles Peskinee5702482021-06-11 21:59:08 +02002771 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
2772 &conf->dhm_P ) ) != 0 ||
2773 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
2774 &conf->dhm_G ) ) != 0 )
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002775 {
2776 mbedtls_mpi_free( &conf->dhm_P );
2777 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00002778 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002779 }
Paul Bakker1b57b062011-01-06 15:48:19 +00002780
2781 return( 0 );
2782}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002783#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00002784
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002785#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
2786/*
2787 * Set the minimum length for Diffie-Hellman parameters
2788 */
2789void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
2790 unsigned int bitlen )
2791{
2792 conf->dhm_min_bitlen = bitlen;
2793}
2794#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
2795
Ronald Crone68ab4f2022-10-05 12:46:29 +02002796#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002797#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002798/*
2799 * Set allowed/preferred hashes for handshake signatures
2800 */
2801void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
2802 const int *hashes )
2803{
2804 conf->sig_hashes = hashes;
2805}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002806#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002807
Jerry Yuf017ee42022-01-12 15:49:48 +08002808/* Configure allowed signature algorithms for handshake */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002809void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
2810 const uint16_t* sig_algs )
2811{
Jerry Yuf017ee42022-01-12 15:49:48 +08002812#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2813 conf->sig_hashes = NULL;
2814#endif /* !MBEDTLS_DEPRECATED_REMOVED */
2815 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01002816}
Ronald Crone68ab4f2022-10-05 12:46:29 +02002817#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002818
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02002819#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01002820#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002821/*
2822 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01002823 *
2824 * mbedtls_ssl_setup() takes the provided list
2825 * and translates it to a list of IANA TLS group identifiers,
2826 * stored in ssl->handshake->group_list.
2827 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002828 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002829void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002830 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002831{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002832 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01002833 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002834}
Brett Warrene0edc842021-08-17 09:53:13 +01002835#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01002836#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002837
Brett Warrene0edc842021-08-17 09:53:13 +01002838/*
2839 * Set the allowed groups
2840 */
2841void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
2842 const uint16_t *group_list )
2843{
2844#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
2845 conf->curve_list = NULL;
2846#endif
2847 conf->group_list = group_list;
2848}
2849
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002850#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002851int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00002852{
Hanno Becker947194e2017-04-07 13:25:49 +01002853 /* Initialize to suppress unnecessary compiler warning */
2854 size_t hostname_len = 0;
2855
2856 /* Check if new hostname is valid before
2857 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01002858 if( hostname != NULL )
2859 {
2860 hostname_len = strlen( hostname );
2861
2862 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
2863 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2864 }
2865
2866 /* Now it's clear that we will overwrite the old hostname,
2867 * so we can free it safely */
2868
2869 if( ssl->hostname != NULL )
2870 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002871 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01002872 mbedtls_free( ssl->hostname );
2873 }
2874
2875 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01002876
Paul Bakker5121ce52009-01-03 21:22:43 +00002877 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01002878 {
2879 ssl->hostname = NULL;
2880 }
2881 else
2882 {
2883 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01002884 if( ssl->hostname == NULL )
2885 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002886
Hanno Becker947194e2017-04-07 13:25:49 +01002887 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002888
Hanno Becker947194e2017-04-07 13:25:49 +01002889 ssl->hostname[hostname_len] = '\0';
2890 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002891
2892 return( 0 );
2893}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01002894#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002895
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002896#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002897void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002898 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00002899 const unsigned char *, size_t),
2900 void *p_sni )
2901{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002902 conf->f_sni = f_sni;
2903 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00002904}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002905#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00002906
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002907#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002908int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002909{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002910 size_t cur_len, tot_len;
2911 const char **p;
2912
2913 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08002914 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
2915 * MUST NOT be truncated."
2916 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002917 */
2918 tot_len = 0;
2919 for( p = protos; *p != NULL; p++ )
2920 {
2921 cur_len = strlen( *p );
2922 tot_len += cur_len;
2923
Ronald Cron8216dd32020-04-23 16:41:44 +02002924 if( ( cur_len == 0 ) ||
2925 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
2926 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002927 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002928 }
2929
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002930 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002931
2932 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002933}
2934
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002935const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002936{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002937 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002938}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002939#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002940
Johan Pascalb62bb512015-12-03 21:56:45 +01002941#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldoref72faf2018-07-12 11:54:20 +03002942void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
2943 int support_mki_value )
Ron Eldor591f1622018-01-22 12:30:04 +02002944{
2945 conf->dtls_srtp_mki_support = support_mki_value;
2946}
2947
Ron Eldoref72faf2018-07-12 11:54:20 +03002948int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
2949 unsigned char *mki_value,
Johan Pascalf6417ec2020-09-22 15:15:19 +02002950 uint16_t mki_len )
Ron Eldor591f1622018-01-22 12:30:04 +02002951{
Johan Pascal5ef72d22020-10-28 17:05:47 +01002952 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
Ron Eldora9788042018-12-05 11:04:31 +02002953 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002954 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ron Eldora9788042018-12-05 11:04:31 +02002955 }
Ron Eldor591f1622018-01-22 12:30:04 +02002956
2957 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
Ron Eldora9788042018-12-05 11:04:31 +02002958 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002959 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ron Eldora9788042018-12-05 11:04:31 +02002960 }
Ron Eldor591f1622018-01-22 12:30:04 +02002961
2962 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
2963 ssl->dtls_srtp_info.mki_len = mki_len;
Ron Eldora9788042018-12-05 11:04:31 +02002964 return( 0 );
Ron Eldor591f1622018-01-22 12:30:04 +02002965}
2966
Ron Eldoref72faf2018-07-12 11:54:20 +03002967int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
Johan Pascal253d0262020-09-22 13:04:45 +02002968 const mbedtls_ssl_srtp_profile *profiles )
Johan Pascalb62bb512015-12-03 21:56:45 +01002969{
Johan Pascal253d0262020-09-22 13:04:45 +02002970 const mbedtls_ssl_srtp_profile *p;
2971 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002972
Johan Pascal253d0262020-09-22 13:04:45 +02002973 /* check the profiles list: all entry must be valid,
2974 * its size cannot be more than the total number of supported profiles, currently 4 */
Johan Pascald387aa02020-09-23 18:47:56 +02002975 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
2976 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
2977 p++ )
Johan Pascald576fdb2020-09-22 10:39:53 +02002978 {
Johan Pascal5ef72d22020-10-28 17:05:47 +01002979 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
Johan Pascald576fdb2020-09-22 10:39:53 +02002980 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002981 list_size++;
2982 }
2983 else
2984 {
2985 /* unsupported value, stop parsing and set the size to an error value */
2986 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01002987 }
2988 }
2989
Johan Pascal5ef72d22020-10-28 17:05:47 +01002990 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
Johan Pascald387aa02020-09-23 18:47:56 +02002991 {
Johan Pascal253d0262020-09-22 13:04:45 +02002992 conf->dtls_srtp_profile_list = NULL;
2993 conf->dtls_srtp_profile_list_len = 0;
2994 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2995 }
2996
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002997 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02002998 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01002999
3000 return( 0 );
3001}
3002
Johan Pascal5ef72d22020-10-28 17:05:47 +01003003void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
3004 mbedtls_dtls_srtp_info *dtls_srtp_info )
Johan Pascalb62bb512015-12-03 21:56:45 +01003005{
Johan Pascal2258a4f2020-10-28 13:53:09 +01003006 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
3007 /* do not copy the mki value if there is no chosen profile */
Johan Pascal5ef72d22020-10-28 17:05:47 +01003008 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01003009 {
Johan Pascal2258a4f2020-10-28 13:53:09 +01003010 dtls_srtp_info->mki_len = 0;
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01003011 }
Johan Pascal2258a4f2020-10-28 13:53:09 +01003012 else
3013 {
3014 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Johan Pascal5ef72d22020-10-28 17:05:47 +01003015 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
3016 ssl->dtls_srtp_info.mki_len );
Johan Pascal2258a4f2020-10-28 13:53:09 +01003017 }
Johan Pascalb62bb512015-12-03 21:56:45 +01003018}
Johan Pascalb62bb512015-12-03 21:56:45 +01003019#endif /* MBEDTLS_SSL_DTLS_SRTP */
3020
Aditya Patwardhan3096f332022-07-26 14:31:46 +05303021#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02003022void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00003023{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04003024 conf->max_tls_version = (major << 8) | minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00003025}
3026
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02003027void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00003028{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04003029 conf->min_tls_version = (major << 8) | minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00003030}
Aditya Patwardhan3096f332022-07-26 14:31:46 +05303031#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker1d29fb52012-09-28 13:28:45 +00003032
Janos Follath088ce432017-04-10 12:42:31 +01003033#if defined(MBEDTLS_SSL_SRV_C)
3034void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
3035 char cert_req_ca_list )
3036{
3037 conf->cert_req_ca_list = cert_req_ca_list;
3038}
3039#endif
3040
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003041#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003042void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01003043{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003044 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01003045}
3046#endif
3047
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003048#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003049void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02003050{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003051 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02003052}
3053#endif
3054
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003055#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003056int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003057{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003058 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10003059 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003060 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003061 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003062 }
3063
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01003064 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003065
3066 return( 0 );
3067}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003068#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003069
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003070void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00003071{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003072 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00003073}
3074
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003075#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003076void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003077{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003078 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003079}
3080
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003081void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02003082{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003083 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02003084}
3085
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003086void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01003087 const unsigned char period[8] )
3088{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003089 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01003090}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003091#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00003092
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003093#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003094#if defined(MBEDTLS_SSL_CLI_C)
3095void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003096{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01003097 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003098}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003099#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02003100
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003101#if defined(MBEDTLS_SSL_SRV_C)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003102
Jerry Yud0766ec2022-09-22 10:46:57 +08003103#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003104void mbedtls_ssl_conf_new_session_tickets( mbedtls_ssl_config *conf,
3105 uint16_t num_tickets )
3106{
Jerry Yud0766ec2022-09-22 10:46:57 +08003107 conf->new_session_tickets_count = num_tickets;
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003108}
3109#endif
3110
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02003111void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
3112 mbedtls_ssl_ticket_write_t *f_ticket_write,
3113 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
3114 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02003115{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02003116 conf->f_ticket_write = f_ticket_write;
3117 conf->f_ticket_parse = f_ticket_parse;
3118 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02003119}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003120#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003121#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003122
Hanno Becker7e6c1782021-06-08 09:24:55 +01003123void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
3124 mbedtls_ssl_export_keys_t *f_export_keys,
3125 void *p_export_keys )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01003126{
Hanno Becker7e6c1782021-06-08 09:24:55 +01003127 ssl->f_export_keys = f_export_keys;
3128 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03003129}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01003130
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003131#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003132void mbedtls_ssl_conf_async_private_cb(
3133 mbedtls_ssl_config *conf,
3134 mbedtls_ssl_async_sign_t *f_async_sign,
3135 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
3136 mbedtls_ssl_async_resume_t *f_async_resume,
3137 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003138 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003139{
3140 conf->f_async_sign_start = f_async_sign;
3141 conf->f_async_decrypt_start = f_async_decrypt;
3142 conf->f_async_resume = f_async_resume;
3143 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003144 conf->p_async_config_data = async_config_data;
3145}
3146
Gilles Peskine8f97af72018-04-26 11:46:10 +02003147void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
3148{
3149 return( conf->p_async_config_data );
3150}
3151
Gilles Peskine1febfef2018-04-30 11:54:39 +02003152void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003153{
3154 if( ssl->handshake == NULL )
3155 return( NULL );
3156 else
3157 return( ssl->handshake->user_async_ctx );
3158}
3159
Gilles Peskine1febfef2018-04-30 11:54:39 +02003160void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003161 void *ctx )
3162{
3163 if( ssl->handshake != NULL )
3164 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003165}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003166#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003167
Paul Bakker5121ce52009-01-03 21:22:43 +00003168/*
3169 * SSL get accessors
3170 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02003171uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003172{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00003173 if( ssl->session != NULL )
3174 return( ssl->session->verify_result );
3175
3176 if( ssl->session_negotiate != NULL )
3177 return( ssl->session_negotiate->verify_result );
3178
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02003179 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00003180}
3181
Glenn Strauss8f526902022-01-13 00:04:49 -05003182int mbedtls_ssl_get_ciphersuite_id_from_ssl( const mbedtls_ssl_context *ssl )
3183{
3184 if( ssl == NULL || ssl->session == NULL )
3185 return( 0 );
3186
3187 return( ssl->session->ciphersuite );
3188}
3189
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003190const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00003191{
Paul Bakker926c8e42013-03-06 10:23:34 +01003192 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02003193 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01003194
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003195 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00003196}
3197
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003198const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00003199{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003200#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003201 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003202 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003203 switch( ssl->tls_version )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003204 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003205 case MBEDTLS_SSL_VERSION_TLS1_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003206 return( "DTLSv1.2" );
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003207 default:
3208 return( "unknown (DTLS)" );
3209 }
3210 }
3211#endif
3212
Glenn Strauss60bfe602022-03-14 19:04:24 -04003213 switch( ssl->tls_version )
Paul Bakker43ca69c2011-01-15 17:35:19 +00003214 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003215 case MBEDTLS_SSL_VERSION_TLS1_2:
Paul Bakker1ef83d62012-04-11 12:09:53 +00003216 return( "TLSv1.2" );
Glenn Strauss60bfe602022-03-14 19:04:24 -04003217 case MBEDTLS_SSL_VERSION_TLS1_3:
Gilles Peskinec63a1e02022-01-13 01:10:24 +01003218 return( "TLSv1.3" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00003219 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003220 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00003221 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00003222}
3223
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003224#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003225size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
3226{
David Horstmann95d516f2021-05-04 18:36:56 +01003227 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003228 size_t read_mfl;
3229
3230 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
3231 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
3232 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
3233 {
3234 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
3235 }
3236
3237 /* Check if a smaller max length was negotiated */
3238 if( ssl->session_out != NULL )
3239 {
3240 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
3241 if( read_mfl < max_len )
3242 {
3243 max_len = read_mfl;
3244 }
3245 }
3246
3247 // During a handshake, use the value being negotiated
3248 if( ssl->session_negotiate != NULL )
3249 {
3250 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
3251 if( read_mfl < max_len )
3252 {
3253 max_len = read_mfl;
3254 }
3255 }
3256
3257 return( max_len );
3258}
3259
3260size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003261{
3262 size_t max_len;
3263
3264 /*
3265 * Assume mfl_code is correct since it was checked when set
3266 */
Angus Grattond8213d02016-05-25 20:56:48 +10003267 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003268
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003269 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003270 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10003271 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003272 {
Angus Grattond8213d02016-05-25 20:56:48 +10003273 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003274 }
3275
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003276 /* During a handshake, use the value being negotiated */
3277 if( ssl->session_negotiate != NULL &&
3278 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
3279 {
3280 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
3281 }
3282
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003283 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003284}
3285#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
3286
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003287#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00003288size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003289{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04003290 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
3291 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
3292 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
3293 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
3294 return ( 0 );
3295
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003296 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
3297 return( ssl->mtu );
3298
3299 if( ssl->mtu == 0 )
3300 return( ssl->handshake->mtu );
3301
3302 return( ssl->mtu < ssl->handshake->mtu ?
3303 ssl->mtu : ssl->handshake->mtu );
3304}
3305#endif /* MBEDTLS_SSL_PROTO_DTLS */
3306
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003307int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
3308{
3309 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
3310
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02003311#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
3312 !defined(MBEDTLS_SSL_PROTO_DTLS)
3313 (void) ssl;
3314#endif
3315
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003316#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003317 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003318
3319 if( max_len > mfl )
3320 max_len = mfl;
3321#endif
3322
3323#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00003324 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003325 {
Hanno Becker89490712020-02-05 10:50:12 +00003326 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003327 const int ret = mbedtls_ssl_get_record_expansion( ssl );
3328 const size_t overhead = (size_t) ret;
3329
3330 if( ret < 0 )
3331 return( ret );
3332
3333 if( mtu <= overhead )
3334 {
3335 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
3336 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3337 }
3338
3339 if( max_len > mtu - overhead )
3340 max_len = mtu - overhead;
3341 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003342#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003343
Hanno Becker0defedb2018-08-10 12:35:02 +01003344#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
3345 !defined(MBEDTLS_SSL_PROTO_DTLS)
3346 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003347#endif
3348
3349 return( (int) max_len );
3350}
3351
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003352int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
3353{
3354 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
3355
3356#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3357 (void) ssl;
3358#endif
3359
3360#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3361 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
3362
3363 if( max_len > mfl )
3364 max_len = mfl;
3365#endif
3366
3367 return( (int) max_len );
3368}
3369
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003370#if defined(MBEDTLS_X509_CRT_PARSE_C)
3371const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00003372{
3373 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02003374 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00003375
Hanno Beckere6824572019-02-07 13:18:46 +00003376#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +02003377 return( ssl->session->peer_cert );
Hanno Beckere6824572019-02-07 13:18:46 +00003378#else
3379 return( NULL );
3380#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00003381}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003382#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00003383
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003384#if defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerf852b1c2019-02-05 11:42:30 +00003385int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
3386 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003387{
Hanno Beckere810bbc2021-05-14 16:01:05 +01003388 int ret;
3389
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003390 if( ssl == NULL ||
3391 dst == NULL ||
3392 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003393 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003394 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003395 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003396 }
3397
Hanno Beckere810bbc2021-05-14 16:01:05 +01003398 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
3399 * idempotent: Each session can only be exported once.
3400 *
3401 * (This is in preparation for TLS 1.3 support where we will
3402 * need the ability to export multiple sessions (aka tickets),
3403 * which will be achieved by calling mbedtls_ssl_get_session()
3404 * multiple times until it fails.)
3405 *
3406 * Check whether we have already exported the current session,
3407 * and fail if so.
3408 */
3409 if( ssl->session->exported == 1 )
3410 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3411
3412 ret = mbedtls_ssl_session_copy( dst, ssl->session );
3413 if( ret != 0 )
3414 return( ret );
3415
3416 /* Remember that we've exported the session. */
3417 ssl->session->exported = 1;
3418 return( 0 );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003419}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003420#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003421
Paul Bakker5121ce52009-01-03 21:22:43 +00003422/*
Hanno Beckera835da52019-05-16 12:39:07 +01003423 * Define ticket header determining Mbed TLS version
3424 * and structure of the ticket.
3425 */
3426
Hanno Becker94ef3b32019-05-16 12:50:45 +01003427/*
Hanno Becker50b59662019-05-28 14:30:45 +01003428 * Define bitflag determining compile-time settings influencing
3429 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01003430 */
3431
Hanno Becker50b59662019-05-28 14:30:45 +01003432#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01003433#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01003434#else
Hanno Becker3e088662019-05-29 11:10:18 +01003435#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003436#endif /* MBEDTLS_HAVE_TIME */
3437
3438#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01003439#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003440#else
Hanno Becker3e088662019-05-29 11:10:18 +01003441#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003442#endif /* MBEDTLS_X509_CRT_PARSE_C */
3443
3444#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01003445#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003446#else
Hanno Becker3e088662019-05-29 11:10:18 +01003447#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003448#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
3449
3450#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01003451#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003452#else
Hanno Becker3e088662019-05-29 11:10:18 +01003453#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003454#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
3455
Hanno Becker94ef3b32019-05-16 12:50:45 +01003456#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01003457#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003458#else
Hanno Becker3e088662019-05-29 11:10:18 +01003459#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003460#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
3461
Hanno Becker94ef3b32019-05-16 12:50:45 +01003462#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3463#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
3464#else
3465#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
3466#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3467
Hanno Becker3e088662019-05-29 11:10:18 +01003468#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
3469#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
3470#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
3471#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01003472#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
3473#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01003474
Hanno Becker50b59662019-05-28 14:30:45 +01003475#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Becker3e088662019-05-29 11:10:18 +01003476 ( (uint16_t) ( \
3477 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
3478 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
3479 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
3480 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
Hanno Becker3e088662019-05-29 11:10:18 +01003481 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Beckerbe34e8e2019-06-04 09:43:16 +01003482 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
Hanno Becker94ef3b32019-05-16 12:50:45 +01003483
Hanno Beckerf8787072019-05-16 12:41:07 +01003484static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01003485 MBEDTLS_VERSION_MAJOR,
3486 MBEDTLS_VERSION_MINOR,
3487 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01003488 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3489 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
Hanno Beckerf8787072019-05-16 12:41:07 +01003490};
Hanno Beckera835da52019-05-16 12:39:07 +01003491
3492/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003493 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02003494 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003495 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003496 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01003497 *
Hanno Beckerdce50972021-08-01 05:39:23 +01003498 * opaque mbedtls_version[3]; // library version: major, minor, patch
3499 * opaque session_format[2]; // library-version specific 16-bit field
3500 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003501 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01003502 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003503 * Note: When updating the format, remember to keep
3504 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003505 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003506 * // In this version, `session_format` determines
3507 * // the setting of those compile-time
3508 * // configuration options which influence
3509 * // the structure of mbedtls_ssl_session.
3510 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003511 * uint8_t minor_ver; // Protocol minor version. Possible values:
3512 * // - TLS 1.2 (3)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003513 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003514 * select (serialized_session.tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003515 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003516 * case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003517 * serialized_session_tls12 data;
3518 *
3519 * };
3520 *
3521 * } serialized_session;
3522 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003523 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003524
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003525MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003526static int ssl_session_save( const mbedtls_ssl_session *session,
3527 unsigned char omit_header,
3528 unsigned char *buf,
3529 size_t buf_len,
3530 size_t *olen )
3531{
3532 unsigned char *p = buf;
3533 size_t used = 0;
Jerry Yu251a12e2022-07-13 15:15:48 +08003534 size_t remaining_len;
Jerry Yue36fdd62022-08-17 21:31:36 +08003535#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3536 size_t out_len;
3537 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3538#endif
Jerry Yu438ddd82022-07-07 06:55:50 +00003539 if( session == NULL )
3540 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3541
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003542 if( !omit_header )
3543 {
3544 /*
3545 * Add Mbed TLS version identifier
3546 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003547 used += sizeof( ssl_serialized_session_header );
3548
3549 if( used <= buf_len )
3550 {
3551 memcpy( p, ssl_serialized_session_header,
3552 sizeof( ssl_serialized_session_header ) );
3553 p += sizeof( ssl_serialized_session_header );
3554 }
3555 }
3556
3557 /*
3558 * TLS version identifier
3559 */
3560 used += 1;
3561 if( used <= buf_len )
3562 {
Glenn Straussda7851c2022-03-14 13:29:48 -04003563 *p++ = MBEDTLS_BYTE_0( session->tls_version );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003564 }
3565
3566 /* Forward to version-specific serialization routine. */
Jerry Yufca4d572022-07-21 10:37:48 +08003567 remaining_len = (buf_len >= used) ? buf_len - used : 0;
Glenn Straussda7851c2022-03-14 13:29:48 -04003568 switch( session->tls_version )
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003569 {
3570#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Glenn Straussda7851c2022-03-14 13:29:48 -04003571 case MBEDTLS_SSL_VERSION_TLS1_2:
Jerry Yu438ddd82022-07-07 06:55:50 +00003572 used += ssl_tls12_session_save( session, p, remaining_len );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003573 break;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003574#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3575
Jerry Yu251a12e2022-07-13 15:15:48 +08003576#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3577 case MBEDTLS_SSL_VERSION_TLS1_3:
Jerry Yue36fdd62022-08-17 21:31:36 +08003578 ret = ssl_tls13_session_save( session, p, remaining_len, &out_len );
3579 if( ret != 0 && ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
Jerry Yue36fdd62022-08-17 21:31:36 +08003580 return( ret );
Jerry Yue36fdd62022-08-17 21:31:36 +08003581 used += out_len;
Jerry Yu251a12e2022-07-13 15:15:48 +08003582 break;
Jerry Yu251a12e2022-07-13 15:15:48 +08003583#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3584
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003585 default:
3586 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3587 }
3588
3589 *olen = used;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02003590 if( used > buf_len )
3591 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003592
3593 return( 0 );
3594}
3595
3596/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003597 * Public wrapper for ssl_session_save()
3598 */
3599int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
3600 unsigned char *buf,
3601 size_t buf_len,
3602 size_t *olen )
3603{
3604 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
3605}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003606
Jerry Yuf1b23ca2022-02-18 11:48:47 +08003607/*
3608 * Deserialize session, see mbedtls_ssl_session_save() for format.
3609 *
3610 * This internal version is wrapped by a public function that cleans up in
3611 * case of error, and has an extra option omit_header.
3612 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003613MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003614static int ssl_session_load( mbedtls_ssl_session *session,
3615 unsigned char omit_header,
3616 const unsigned char *buf,
3617 size_t len )
3618{
3619 const unsigned char *p = buf;
3620 const unsigned char * const end = buf + len;
Jerry Yu438ddd82022-07-07 06:55:50 +00003621 size_t remaining_len;
3622
3623
3624 if( session == NULL )
3625 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003626
3627 if( !omit_header )
3628 {
3629 /*
3630 * Check Mbed TLS version identifier
3631 */
3632
3633 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
3634 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3635
3636 if( memcmp( p, ssl_serialized_session_header,
3637 sizeof( ssl_serialized_session_header ) ) != 0 )
3638 {
3639 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
3640 }
3641 p += sizeof( ssl_serialized_session_header );
3642 }
3643
3644 /*
3645 * TLS version identifier
3646 */
3647 if( 1 > (size_t)( end - p ) )
3648 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Glenn Straussda7851c2022-03-14 13:29:48 -04003649 session->tls_version = 0x0300 | *p++;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003650
3651 /* Dispatch according to TLS version. */
Jerry Yu438ddd82022-07-07 06:55:50 +00003652 remaining_len = ( end - p );
Glenn Straussda7851c2022-03-14 13:29:48 -04003653 switch( session->tls_version )
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003654 {
3655#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Glenn Straussda7851c2022-03-14 13:29:48 -04003656 case MBEDTLS_SSL_VERSION_TLS1_2:
Jerry Yu438ddd82022-07-07 06:55:50 +00003657 return( ssl_tls12_session_load( session, p, remaining_len ) );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003658#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3659
Jerry Yu438ddd82022-07-07 06:55:50 +00003660#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3661 case MBEDTLS_SSL_VERSION_TLS1_3:
3662 return( ssl_tls13_session_load( session, p, remaining_len ) );
3663#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3664
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003665 default:
3666 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3667 }
3668}
3669
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003670/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003671 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003672 */
3673int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
3674 const unsigned char *buf,
3675 size_t len )
3676{
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003677 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003678
3679 if( ret != 0 )
3680 mbedtls_ssl_session_free( session );
3681
3682 return( ret );
3683}
3684
3685/*
Paul Bakker1961b702013-01-25 14:49:24 +01003686 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00003687 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003688MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker41934dd2021-08-07 19:13:43 +01003689static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
3690{
3691 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3692
Ronald Cron66dbf912022-02-02 15:33:46 +01003693 /*
3694 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01003695 * that were written into the output buffer by the previous handshake step,
3696 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01003697 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
3698 * We proceed to the next handshake step only when all data from the
3699 * previous one have been sent to the peer, thus we make sure that this is
3700 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
3701 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
3702 * we have to wait before to go ahead.
3703 * In the case of TLS 1.3, handshake step handlers do not send data to the
3704 * peer. Data are only sent here and through
3705 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
Andrzej Kurek5c65c572022-04-13 14:28:52 -04003706 * alert occurred.
Ronald Cron66dbf912022-02-02 15:33:46 +01003707 */
Hanno Becker41934dd2021-08-07 19:13:43 +01003708 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3709 return( ret );
3710
3711#if defined(MBEDTLS_SSL_PROTO_DTLS)
3712 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3713 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
3714 {
3715 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3716 return( ret );
3717 }
3718#endif /* MBEDTLS_SSL_PROTO_DTLS */
3719
3720 return( ret );
3721}
3722
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003723int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003724{
Hanno Becker41934dd2021-08-07 19:13:43 +01003725 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00003726
Hanno Becker41934dd2021-08-07 19:13:43 +01003727 if( ssl == NULL ||
3728 ssl->conf == NULL ||
3729 ssl->handshake == NULL ||
Jerry Yu1fb32992022-10-27 13:18:19 +08003730 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Hanno Becker41934dd2021-08-07 19:13:43 +01003731 {
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003732 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker41934dd2021-08-07 19:13:43 +01003733 }
3734
3735 ret = ssl_prepare_handshake_step( ssl );
3736 if( ret != 0 )
3737 return( ret );
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003738
Jerry Yue7047812021-09-13 19:26:39 +08003739 ret = mbedtls_ssl_handle_pending_alert( ssl );
3740 if( ret != 0 )
3741 goto cleanup;
3742
Tom Cosgrove2fdc7b32022-09-21 12:33:17 +01003743 /* If ssl->conf->endpoint is not one of MBEDTLS_SSL_IS_CLIENT or
3744 * MBEDTLS_SSL_IS_SERVER, this is the return code we give */
3745 ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3746
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003747#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003748 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Jerry Yub9930e72021-08-06 17:11:51 +08003749 {
Ronald Cron27c85e72022-03-08 11:37:55 +01003750 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %s",
3751 mbedtls_ssl_states_str( ssl->state ) ) );
Jerry Yub9930e72021-08-06 17:11:51 +08003752
Ronald Cron9f0fba32022-02-10 16:45:15 +01003753 switch( ssl->state )
3754 {
3755 case MBEDTLS_SSL_HELLO_REQUEST:
3756 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Tom Cosgrove87d9c6c2022-09-22 09:27:56 +01003757 ret = 0;
Ronald Cron9f0fba32022-02-10 16:45:15 +01003758 break;
Jerry Yub9930e72021-08-06 17:11:51 +08003759
Ronald Cron9f0fba32022-02-10 16:45:15 +01003760 case MBEDTLS_SSL_CLIENT_HELLO:
3761 ret = mbedtls_ssl_write_client_hello( ssl );
3762 break;
3763
3764 default:
3765#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Glenn Strauss60bfe602022-03-14 19:04:24 -04003766 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Ronald Cron9f0fba32022-02-10 16:45:15 +01003767 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
3768 else
3769 ret = mbedtls_ssl_handshake_client_step( ssl );
3770#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
3771 ret = mbedtls_ssl_handshake_client_step( ssl );
3772#else
3773 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
3774#endif
3775 }
Jerry Yub9930e72021-08-06 17:11:51 +08003776 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003777#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003778#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003779 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Jerry Yub9930e72021-08-06 17:11:51 +08003780 {
Ronald Cron6f135e12021-12-08 16:57:54 +01003781#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yub9930e72021-08-06 17:11:51 +08003782 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yu27561932021-08-27 17:07:38 +08003783 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
Ronald Cron6f135e12021-12-08 16:57:54 +01003784#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08003785
3786#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3787 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
3788 ret = mbedtls_ssl_handshake_server_step( ssl );
3789#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3790 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003791#endif
3792
Jerry Yue7047812021-09-13 19:26:39 +08003793 if( ret != 0 )
3794 {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08003795 /* handshake_step return error. And it is same
3796 * with alert_reason.
3797 */
Jerry Yu3bf1f972021-09-22 21:37:18 +08003798 if( ssl->send_alert )
Jerry Yue7047812021-09-13 19:26:39 +08003799 {
Jerry Yu3bf1f972021-09-22 21:37:18 +08003800 ret = mbedtls_ssl_handle_pending_alert( ssl );
Jerry Yue7047812021-09-13 19:26:39 +08003801 goto cleanup;
3802 }
3803 }
3804
3805cleanup:
Paul Bakker1961b702013-01-25 14:49:24 +01003806 return( ret );
3807}
3808
3809/*
3810 * Perform the SSL handshake
3811 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003812int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01003813{
3814 int ret = 0;
3815
Hanno Beckera817ea42020-10-20 15:20:23 +01003816 /* Sanity checks */
3817
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003818 if( ssl == NULL || ssl->conf == NULL )
3819 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3820
Hanno Beckera817ea42020-10-20 15:20:23 +01003821#if defined(MBEDTLS_SSL_PROTO_DTLS)
3822 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3823 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
3824 {
3825 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
3826 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
3827 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3828 }
3829#endif /* MBEDTLS_SSL_PROTO_DTLS */
3830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003831 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01003832
Hanno Beckera817ea42020-10-20 15:20:23 +01003833 /* Main handshake loop */
Jerry Yu1fb32992022-10-27 13:18:19 +08003834 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +01003835 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003836 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003837
3838 if( ret != 0 )
3839 break;
3840 }
3841
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003842 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003843
3844 return( ret );
3845}
3846
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003847#if defined(MBEDTLS_SSL_RENEGOTIATION)
3848#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00003849/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003850 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00003851 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003852MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003853static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003854{
Janos Follath865b3eb2019-12-16 11:46:15 +00003855 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003857 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003858
3859 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003860 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3861 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003862
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003863 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003864 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003865 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003866 return( ret );
3867 }
3868
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003869 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003870
3871 return( 0 );
3872}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003873#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003874
3875/*
3876 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003877 * - any side: calling mbedtls_ssl_renegotiate(),
3878 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
3879 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02003880 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003881 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003882 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003883 */
Hanno Becker40cdaa12020-02-05 10:48:27 +00003884int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003885{
Janos Follath865b3eb2019-12-16 11:46:15 +00003886 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00003887
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003888 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003889
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003890 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3891 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003892
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003893 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
3894 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003895#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003896 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003897 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003898 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003899 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003900 ssl->handshake->out_msg_seq = 1;
3901 else
3902 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003903 }
3904#endif
3905
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003906 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3907 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00003908
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003909 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00003910 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003911 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003912 return( ret );
3913 }
3914
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003915 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003916
3917 return( 0 );
3918}
3919
3920/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003921 * Renegotiate current connection on client,
3922 * or request renegotiation on server
3923 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003924int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003925{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003926 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003927
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003928 if( ssl == NULL || ssl->conf == NULL )
3929 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3930
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003931#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003932 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003933 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003934 {
Jerry Yu6848a612022-10-27 13:03:26 +08003935 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003936 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003937
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003938 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003939
3940 /* Did we already try/start sending HelloRequest? */
3941 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003942 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003943
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003944 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003945 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003946#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003947
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003948#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003949 /*
3950 * On client, either start the renegotiation process or,
3951 * if already in progress, continue the handshake
3952 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003953 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003954 {
Jerry Yu6848a612022-10-27 13:03:26 +08003955 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003956 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003957
Hanno Becker40cdaa12020-02-05 10:48:27 +00003958 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003959 {
Hanno Becker40cdaa12020-02-05 10:48:27 +00003960 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003961 return( ret );
3962 }
3963 }
3964 else
3965 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003966 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003967 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003968 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003969 return( ret );
3970 }
3971 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003972#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003973
Paul Bakker37ce0ff2013-10-31 14:32:04 +01003974 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003975}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003976#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003977
Gilles Peskine9b562d52018-04-25 20:32:43 +02003978void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003979{
Gilles Peskine9b562d52018-04-25 20:32:43 +02003980 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3981
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003982 if( handshake == NULL )
3983 return;
3984
Brett Warrene0edc842021-08-17 09:53:13 +01003985#if defined(MBEDTLS_ECP_C)
3986#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3987 if ( ssl->handshake->group_list_heap_allocated )
3988 mbedtls_free( (void*) handshake->group_list );
3989 handshake->group_list = NULL;
3990#endif /* MBEDTLS_DEPRECATED_REMOVED */
3991#endif /* MBEDTLS_ECP_C */
3992
Ronald Crone68ab4f2022-10-05 12:46:29 +02003993#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08003994#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3995 if ( ssl->handshake->sig_algs_heap_allocated )
3996 mbedtls_free( (void*) handshake->sig_algs );
3997 handshake->sig_algs = NULL;
3998#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00003999#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
4000 if( ssl->handshake->certificate_request_context )
4001 {
4002 mbedtls_free( (void*) handshake->certificate_request_context );
4003 }
4004#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02004005#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yuf017ee42022-01-12 15:49:48 +08004006
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004007#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
4008 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
4009 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02004010 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004011 handshake->async_in_progress = 0;
4012 }
4013#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
4014
Andrzej Kurek25f27152022-08-17 16:09:31 -04004015#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -05004016#if defined(MBEDTLS_USE_PSA_CRYPTO)
4017 psa_hash_abort( &handshake->fin_sha256_psa );
4018#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004019 mbedtls_sha256_free( &handshake->fin_sha256 );
4020#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05004021#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04004022#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -05004023#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05004024 psa_hash_abort( &handshake->fin_sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05004025#else
Andrzej Kureka242e832022-08-11 10:03:14 -04004026 mbedtls_sha512_free( &handshake->fin_sha384 );
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004027#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05004028#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004029
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004030#if defined(MBEDTLS_DHM_C)
4031 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00004032#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +02004033#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004034 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02004035#endif
Valerio Setti02c25b52022-11-15 14:08:42 +01004036
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02004037#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +02004038#if defined(MBEDTLS_USE_PSA_CRYPTO)
4039 psa_pake_abort( &handshake->psa_pake_ctx );
4040 psa_destroy_key( handshake->psa_pake_password );
4041 handshake->psa_pake_password = MBEDTLS_SVC_KEY_ID_INIT;
4042#else
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02004043 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Neil Armstrongca7d5062022-05-31 14:43:23 +02004044#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02004045#if defined(MBEDTLS_SSL_CLI_C)
4046 mbedtls_free( handshake->ecjpake_cache );
4047 handshake->ecjpake_cache = NULL;
4048 handshake->ecjpake_cache_len = 0;
4049#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02004050#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02004051
Janos Follath4ae5c292016-02-10 11:27:43 +00004052#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
4053 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02004054 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004055 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02004056#endif
4057
Ronald Cron73fe8df2022-10-05 14:31:43 +02004058#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02004059#if defined(MBEDTLS_USE_PSA_CRYPTO)
4060 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
4061 {
4062 /* The maintenance of the external PSK key slot is the
4063 * user's responsibility. */
4064 if( ssl->handshake->psk_opaque_is_internal )
4065 {
4066 psa_destroy_key( ssl->handshake->psk_opaque );
4067 ssl->handshake->psk_opaque_is_internal = 0;
4068 }
4069 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4070 }
Neil Armstronge952a302022-05-03 10:22:14 +02004071#else
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004072 if( handshake->psk != NULL )
4073 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004074 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004075 mbedtls_free( handshake->psk );
4076 }
Neil Armstronge952a302022-05-03 10:22:14 +02004077#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Cron73fe8df2022-10-05 14:31:43 +02004078#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004079
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004080#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
4081 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02004082 /*
4083 * Free only the linked list wrapper, not the keys themselves
4084 * since the belong to the SNI callback
4085 */
Glenn Strauss36872db2022-01-22 05:06:31 -05004086 ssl_key_cert_free( handshake->sni_key_cert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004087#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02004088
Gilles Peskineeccd8882020-03-10 12:19:08 +01004089#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02004090 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Becker3dad3112019-02-05 17:19:52 +00004091 if( handshake->ecrs_peer_cert != NULL )
4092 {
4093 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
4094 mbedtls_free( handshake->ecrs_peer_cert );
4095 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02004096#endif
4097
Hanno Becker75173122019-02-06 16:18:31 +00004098#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
4099 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4100 mbedtls_pk_free( &handshake->peer_pubkey );
4101#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4102
XiaokangQian9b93c0d2022-02-09 06:02:25 +00004103#if defined(MBEDTLS_SSL_CLI_C) && \
4104 ( defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
4105 mbedtls_free( handshake->cookie );
4106#endif /* MBEDTLS_SSL_CLI_C &&
4107 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00004108
4109#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker533ab5f2020-02-05 10:49:13 +00004110 mbedtls_ssl_flight_free( handshake->flight );
4111 mbedtls_ssl_buffering_free( ssl );
XiaokangQian8499b6c2022-01-27 09:00:11 +00004112#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02004113
Ronald Cronf12b81d2022-03-15 10:42:41 +01004114#if defined(MBEDTLS_ECDH_C) && \
4115 ( defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
Neil Armstrongf716a702022-04-04 11:23:46 +02004116 if( handshake->ecdh_psa_privkey_is_external == 0 )
Neil Armstrong8113d252022-03-23 10:57:04 +01004117 psa_destroy_key( handshake->ecdh_psa_privkey );
Hanno Becker4a63ed42019-01-08 11:39:35 +00004118#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
4119
Ronald Cron6f135e12021-12-08 16:57:54 +01004120#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yua1a568c2021-11-09 10:17:21 +08004121 mbedtls_ssl_transform_free( handshake->transform_handshake );
4122 mbedtls_ssl_transform_free( handshake->transform_earlydata );
Jerry Yuba9c7272021-10-30 11:54:10 +08004123 mbedtls_free( handshake->transform_earlydata );
4124 mbedtls_free( handshake->transform_handshake );
Ronald Cron6f135e12021-12-08 16:57:54 +01004125#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08004126
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004127
4128#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4129 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
4130 * processes datagrams and the fact that a datagram is allowed to have
4131 * several records in it, it is possible that the I/O buffers are not
4132 * empty at this stage */
Andrzej Kurek4a063792020-10-21 15:08:44 +02004133 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
4134 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004135#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01004136
Jerry Yuba9c7272021-10-30 11:54:10 +08004137 /* mbedtls_platform_zeroize MUST be last one in this function */
4138 mbedtls_platform_zeroize( handshake,
4139 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00004140}
4141
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004142void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00004143{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004144 if( session == NULL )
4145 return;
4146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004147#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker1294a0b2019-02-05 12:38:15 +00004148 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +02004149#endif
Paul Bakker0a597072012-09-25 21:55:46 +00004150
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004151#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00004152#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
4153 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00004154 mbedtls_free( session->hostname );
4155#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004156 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02004157#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02004158
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004159 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00004160}
4161
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004162#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004163
4164#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4165#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
4166#else
4167#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
4168#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4169
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004170#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004171
4172#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4173#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
4174#else
4175#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
4176#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4177
4178#if defined(MBEDTLS_SSL_ALPN)
4179#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
4180#else
4181#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
4182#endif /* MBEDTLS_SSL_ALPN */
4183
4184#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
4185#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
4186#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
4187#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
4188
4189#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
4190 ( (uint32_t) ( \
4191 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
4192 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
4193 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
4194 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
4195 0u ) )
4196
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004197static unsigned char ssl_serialized_context_header[] = {
4198 MBEDTLS_VERSION_MAJOR,
4199 MBEDTLS_VERSION_MINOR,
4200 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01004201 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
4202 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
4203 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
4204 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
4205 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004206};
4207
Paul Bakker5121ce52009-01-03 21:22:43 +00004208/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004209 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004210 *
4211 * The format of the serialized data is:
4212 * (in the presentation language of TLS, RFC 8446 section 3)
4213 *
4214 * // header
4215 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004216 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004217 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004218 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004219 * Note: When updating the format, remember to keep these
4220 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004221 *
4222 * // session sub-structure
4223 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
4224 * // transform sub-structure
4225 * uint8 random[64]; // ServerHello.random+ClientHello.random
4226 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
4227 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
4228 * // fields from ssl_context
4229 * uint32 badmac_seen; // DTLS: number of records with failing MAC
4230 * uint64 in_window_top; // DTLS: last validated record seq_num
4231 * uint64 in_window; // DTLS: bitmask for replay protection
4232 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
4233 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
4234 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
4235 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
4236 *
4237 * Note that many fields of the ssl_context or sub-structures are not
4238 * serialized, as they fall in one of the following categories:
4239 *
4240 * 1. forced value (eg in_left must be 0)
4241 * 2. pointer to dynamically-allocated memory (eg session, transform)
4242 * 3. value can be re-derived from other data (eg session keys from MS)
4243 * 4. value was temporary (eg content of input buffer)
4244 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004245 */
4246int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
4247 unsigned char *buf,
4248 size_t buf_len,
4249 size_t *olen )
4250{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004251 unsigned char *p = buf;
4252 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004253 size_t session_len;
4254 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004255
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02004256 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004257 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
4258 * this function's documentation.
4259 *
4260 * These are due to assumptions/limitations in the implementation. Some of
4261 * them are likely to stay (no handshake in progress) some might go away
4262 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02004263 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004264 /* The initial handshake must be over */
Jerry Yu6848a612022-10-27 13:03:26 +08004265 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004266 {
4267 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02004268 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004269 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004270 if( ssl->handshake != NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004271 {
4272 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004273 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004274 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004275 /* Double-check that sub-structures are indeed ready */
4276 if( ssl->transform == NULL || ssl->session == NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004277 {
4278 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004279 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004280 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004281 /* There must be no pending incoming or outgoing data */
4282 if( mbedtls_ssl_check_pending( ssl ) != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004283 {
4284 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004285 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004286 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004287 if( ssl->out_left != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004288 {
4289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004290 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004291 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004292 /* Protocol must be DLTS, not TLS */
4293 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004294 {
4295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004296 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004297 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004298 /* Version must be 1.2 */
Glenn Strauss60bfe602022-03-14 19:04:24 -04004299 if( ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004300 {
4301 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004302 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004303 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004304 /* We must be using an AEAD ciphersuite */
4305 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004306 {
4307 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004308 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004309 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004310 /* Renegotiation must not be enabled */
4311#if defined(MBEDTLS_SSL_RENEGOTIATION)
4312 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004313 {
4314 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004315 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004316 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004317#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004318
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004319 /*
4320 * Version and format identifier
4321 */
4322 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004323
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004324 if( used <= buf_len )
4325 {
4326 memcpy( p, ssl_serialized_context_header,
4327 sizeof( ssl_serialized_context_header ) );
4328 p += sizeof( ssl_serialized_context_header );
4329 }
4330
4331 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004332 * Session (length + data)
4333 */
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004334 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004335 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
4336 return( ret );
4337
4338 used += 4 + session_len;
4339 if( used <= buf_len )
4340 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004341 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
4342 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004343
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004344 ret = ssl_session_save( ssl->session, 1,
4345 p, session_len, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004346 if( ret != 0 )
4347 return( ret );
4348
4349 p += session_len;
4350 }
4351
4352 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004353 * Transform
4354 */
4355 used += sizeof( ssl->transform->randbytes );
4356 if( used <= buf_len )
4357 {
4358 memcpy( p, ssl->transform->randbytes,
4359 sizeof( ssl->transform->randbytes ) );
4360 p += sizeof( ssl->transform->randbytes );
4361 }
4362
4363#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4364 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
4365 if( used <= buf_len )
4366 {
4367 *p++ = ssl->transform->in_cid_len;
4368 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
4369 p += ssl->transform->in_cid_len;
4370
4371 *p++ = ssl->transform->out_cid_len;
4372 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
4373 p += ssl->transform->out_cid_len;
4374 }
4375#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4376
4377 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004378 * Saved fields from top-level ssl_context structure
4379 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004380 used += 4;
4381 if( used <= buf_len )
4382 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004383 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
4384 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004385 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004386
4387#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4388 used += 16;
4389 if( used <= buf_len )
4390 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004391 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
4392 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004393
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004394 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
4395 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004396 }
4397#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4398
4399#if defined(MBEDTLS_SSL_PROTO_DTLS)
4400 used += 1;
4401 if( used <= buf_len )
4402 {
4403 *p++ = ssl->disable_datagram_packing;
4404 }
4405#endif /* MBEDTLS_SSL_PROTO_DTLS */
4406
Jerry Yuae0b2e22021-10-08 15:21:19 +08004407 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004408 if( used <= buf_len )
4409 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08004410 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
4411 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004412 }
4413
4414#if defined(MBEDTLS_SSL_PROTO_DTLS)
4415 used += 2;
4416 if( used <= buf_len )
4417 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004418 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
4419 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004420 }
4421#endif /* MBEDTLS_SSL_PROTO_DTLS */
4422
4423#if defined(MBEDTLS_SSL_ALPN)
4424 {
4425 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnardf041f4e2019-07-24 00:58:27 +02004426 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004427 : 0;
4428
4429 used += 1 + alpn_len;
4430 if( used <= buf_len )
4431 {
4432 *p++ = alpn_len;
4433
4434 if( ssl->alpn_chosen != NULL )
4435 {
4436 memcpy( p, ssl->alpn_chosen, alpn_len );
4437 p += alpn_len;
4438 }
4439 }
4440 }
4441#endif /* MBEDTLS_SSL_ALPN */
4442
4443 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004444 * Done
4445 */
4446 *olen = used;
4447
4448 if( used > buf_len )
4449 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004450
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004451 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
4452
Hanno Becker43aefe22020-02-05 10:44:56 +00004453 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004454}
4455
4456/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004457 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004458 *
4459 * This internal version is wrapped by a public function that cleans up in
4460 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004461 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004462MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004463static int ssl_context_load( mbedtls_ssl_context *ssl,
4464 const unsigned char *buf,
4465 size_t len )
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004466{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004467 const unsigned char *p = buf;
4468 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004469 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00004470 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004471#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek894edde2022-09-29 06:31:14 -04004472 tls_prf_fn prf_func = NULL;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004473#endif
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004474
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004475 /*
4476 * The context should have been freshly setup or reset.
4477 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02004478 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004479 * renegotiating, or if the user mistakenly loaded a session first.)
4480 */
4481 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
4482 ssl->session != NULL )
4483 {
4484 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4485 }
4486
4487 /*
4488 * We can't check that the config matches the initial one, but we can at
4489 * least check it matches the requirements for serializing.
4490 */
4491 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004492 ssl->conf->max_tls_version < MBEDTLS_SSL_VERSION_TLS1_2 ||
4493 ssl->conf->min_tls_version > MBEDTLS_SSL_VERSION_TLS1_2 ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004494#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02004495 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004496#endif
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02004497 0 )
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004498 {
4499 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4500 }
4501
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004502 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
4503
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004504 /*
4505 * Check version identifier
4506 */
4507 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
4508 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4509
4510 if( memcmp( p, ssl_serialized_context_header,
4511 sizeof( ssl_serialized_context_header ) ) != 0 )
4512 {
4513 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
4514 }
4515 p += sizeof( ssl_serialized_context_header );
4516
4517 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004518 * Session
4519 */
4520 if( (size_t)( end - p ) < 4 )
4521 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4522
4523 session_len = ( (size_t) p[0] << 24 ) |
4524 ( (size_t) p[1] << 16 ) |
4525 ( (size_t) p[2] << 8 ) |
4526 ( (size_t) p[3] );
4527 p += 4;
4528
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004529 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004530 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004531 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004532 ssl->session_in = ssl->session;
4533 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004534 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004535
4536 if( (size_t)( end - p ) < session_len )
4537 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4538
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004539 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004540 if( ret != 0 )
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004541 {
4542 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004543 return( ret );
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004544 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004545
4546 p += session_len;
4547
4548 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004549 * Transform
4550 */
4551
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004552 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004553 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004554 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004555 ssl->transform_in = ssl->transform;
4556 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004557 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004558
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004559#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek894edde2022-09-29 06:31:14 -04004560 prf_func = ssl_tls12prf_from_cs( ssl->session->ciphersuite );
4561 if( prf_func == NULL )
4562 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4563
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004564 /* Read random bytes and populate structure */
4565 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
4566 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004567
Hanno Beckerbd257552021-03-22 06:59:27 +00004568 ret = ssl_tls12_populate_transform( ssl->transform,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004569 ssl->session->ciphersuite,
4570 ssl->session->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004571#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004572 ssl->session->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004573#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Andrzej Kurek894edde2022-09-29 06:31:14 -04004574 prf_func,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004575 p, /* currently pointing to randbytes */
Glenn Strauss07c64162022-03-14 12:34:51 -04004576 MBEDTLS_SSL_VERSION_TLS1_2, /* (D)TLS 1.2 is forced */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004577 ssl->conf->endpoint,
4578 ssl );
4579 if( ret != 0 )
4580 return( ret );
Jerry Yu840fbb22022-02-17 14:59:29 +08004581#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004582 p += sizeof( ssl->transform->randbytes );
4583
4584#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4585 /* Read connection IDs and store them */
4586 if( (size_t)( end - p ) < 1 )
4587 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4588
4589 ssl->transform->in_cid_len = *p++;
4590
Manuel Pégourié-Gonnard5ea13b82019-07-23 15:02:54 +02004591 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004592 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4593
4594 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
4595 p += ssl->transform->in_cid_len;
4596
4597 ssl->transform->out_cid_len = *p++;
4598
4599 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
4600 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4601
4602 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
4603 p += ssl->transform->out_cid_len;
4604#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4605
4606 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004607 * Saved fields from top-level ssl_context structure
4608 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004609 if( (size_t)( end - p ) < 4 )
4610 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4611
4612 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
4613 ( (uint32_t) p[1] << 16 ) |
4614 ( (uint32_t) p[2] << 8 ) |
4615 ( (uint32_t) p[3] );
4616 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004617
4618#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4619 if( (size_t)( end - p ) < 16 )
4620 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4621
4622 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
4623 ( (uint64_t) p[1] << 48 ) |
4624 ( (uint64_t) p[2] << 40 ) |
4625 ( (uint64_t) p[3] << 32 ) |
4626 ( (uint64_t) p[4] << 24 ) |
4627 ( (uint64_t) p[5] << 16 ) |
4628 ( (uint64_t) p[6] << 8 ) |
4629 ( (uint64_t) p[7] );
4630 p += 8;
4631
4632 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
4633 ( (uint64_t) p[1] << 48 ) |
4634 ( (uint64_t) p[2] << 40 ) |
4635 ( (uint64_t) p[3] << 32 ) |
4636 ( (uint64_t) p[4] << 24 ) |
4637 ( (uint64_t) p[5] << 16 ) |
4638 ( (uint64_t) p[6] << 8 ) |
4639 ( (uint64_t) p[7] );
4640 p += 8;
4641#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4642
4643#if defined(MBEDTLS_SSL_PROTO_DTLS)
4644 if( (size_t)( end - p ) < 1 )
4645 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4646
4647 ssl->disable_datagram_packing = *p++;
4648#endif /* MBEDTLS_SSL_PROTO_DTLS */
4649
Jerry Yud9a94fe2021-09-28 18:58:59 +08004650 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004651 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yud9a94fe2021-09-28 18:58:59 +08004652 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
4653 p += sizeof( ssl->cur_out_ctr );
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004654
4655#if defined(MBEDTLS_SSL_PROTO_DTLS)
4656 if( (size_t)( end - p ) < 2 )
4657 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4658
4659 ssl->mtu = ( p[0] << 8 ) | p[1];
4660 p += 2;
4661#endif /* MBEDTLS_SSL_PROTO_DTLS */
4662
4663#if defined(MBEDTLS_SSL_ALPN)
4664 {
4665 uint8_t alpn_len;
4666 const char **cur;
4667
4668 if( (size_t)( end - p ) < 1 )
4669 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4670
4671 alpn_len = *p++;
4672
4673 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
4674 {
4675 /* alpn_chosen should point to an item in the configured list */
4676 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
4677 {
4678 if( strlen( *cur ) == alpn_len &&
4679 memcmp( p, cur, alpn_len ) == 0 )
4680 {
4681 ssl->alpn_chosen = *cur;
4682 break;
4683 }
4684 }
4685 }
4686
4687 /* can only happen on conf mismatch */
4688 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
4689 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4690
4691 p += alpn_len;
4692 }
4693#endif /* MBEDTLS_SSL_ALPN */
4694
4695 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004696 * Forced fields from top-level ssl_context structure
4697 *
4698 * Most of them already set to the correct value by mbedtls_ssl_init() and
4699 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
4700 */
4701 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Glenn Strauss60bfe602022-03-14 19:04:24 -04004702 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004703
Hanno Becker361b10d2019-08-30 10:42:49 +01004704 /* Adjust pointers for header fields of outgoing records to
4705 * the given transform, accounting for explicit IV and CID. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004706 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
Hanno Becker361b10d2019-08-30 10:42:49 +01004707
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004708#if defined(MBEDTLS_SSL_PROTO_DTLS)
4709 ssl->in_epoch = 1;
4710#endif
4711
4712 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
4713 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00004714 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
4715 * inappropriately. */
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004716 if( ssl->handshake != NULL )
4717 {
4718 mbedtls_ssl_handshake_free( ssl );
4719 mbedtls_free( ssl->handshake );
4720 ssl->handshake = NULL;
4721 }
4722
4723 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004724 * Done - should have consumed entire buffer
4725 */
4726 if( p != end )
4727 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004728
4729 return( 0 );
4730}
4731
4732/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004733 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004734 */
4735int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
4736 const unsigned char *buf,
4737 size_t len )
4738{
4739 int ret = ssl_context_load( context, buf, len );
4740
4741 if( ret != 0 )
4742 mbedtls_ssl_free( context );
4743
4744 return( ret );
4745}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004746#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004747
4748/*
Paul Bakker5121ce52009-01-03 21:22:43 +00004749 * Free an SSL context
4750 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004751void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004752{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004753 if( ssl == NULL )
4754 return;
4755
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004756 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004757
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01004758 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004759 {
sander-visserb8aa2072020-05-06 22:05:13 +02004760#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4761 size_t out_buf_len = ssl->out_buf_len;
4762#else
4763 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4764#endif
4765
Darryl Greenb33cc762019-11-28 14:29:44 +00004766 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004767 mbedtls_free( ssl->out_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004768 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004769 }
4770
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01004771 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004772 {
sander-visserb8aa2072020-05-06 22:05:13 +02004773#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4774 size_t in_buf_len = ssl->in_buf_len;
4775#else
4776 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4777#endif
4778
Darryl Greenb33cc762019-11-28 14:29:44 +00004779 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004780 mbedtls_free( ssl->in_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004781 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004782 }
4783
Paul Bakker48916f92012-09-16 19:57:18 +00004784 if( ssl->transform )
4785 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004786 mbedtls_ssl_transform_free( ssl->transform );
4787 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00004788 }
4789
4790 if( ssl->handshake )
4791 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02004792 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004793 mbedtls_ssl_transform_free( ssl->transform_negotiate );
4794 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00004795
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004796 mbedtls_free( ssl->handshake );
4797 mbedtls_free( ssl->transform_negotiate );
4798 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00004799 }
4800
Ronald Cron6f135e12021-12-08 16:57:54 +01004801#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker3aa186f2021-08-10 09:24:19 +01004802 mbedtls_ssl_transform_free( ssl->transform_application );
4803 mbedtls_free( ssl->transform_application );
Ronald Cron6f135e12021-12-08 16:57:54 +01004804#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01004805
Paul Bakkerc0463502013-02-14 11:19:38 +01004806 if( ssl->session )
4807 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004808 mbedtls_ssl_session_free( ssl->session );
4809 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01004810 }
4811
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02004812#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02004813 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004814 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004815 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004816 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00004817 }
Paul Bakker0be444a2013-08-27 21:55:01 +02004818#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004819
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004820#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004821 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02004822#endif
4823
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004824 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00004825
Paul Bakker86f04f42013-02-14 11:20:09 +01004826 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004827 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004828}
4829
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004830/*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08004831 * Initialize mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004832 */
4833void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
4834{
4835 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
4836}
4837
Gilles Peskineae270bf2021-06-02 00:05:29 +02004838/* The selection should be the same as mbedtls_x509_crt_profile_default in
4839 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02004840 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02004841 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02004842 * about this list.
4843 */
Brett Warrene0edc842021-08-17 09:53:13 +01004844static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02004845#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004846 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004847#endif
4848#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004849 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004850#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004851#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004852 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004853#endif
4854#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004855 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004856#endif
4857#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004858 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004859#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02004860#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004861 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004862#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004863#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004864 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004865#endif
4866#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004867 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004868#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004869 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02004870};
Gilles Peskineae270bf2021-06-02 00:05:29 +02004871
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004872static int ssl_preset_suiteb_ciphersuites[] = {
4873 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
4874 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
4875 0
4876};
4877
Ronald Crone68ab4f2022-10-05 12:46:29 +02004878#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004879
Jerry Yu909df7b2022-01-22 11:56:27 +08004880/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08004881 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08004882 * rules SHOULD be upheld.
4883 * - No duplicate entries.
4884 * - But if there is a good reason, do not change the order of the algorithms.
Jerry Yu09a99fc2022-07-28 14:22:17 +08004885 * - ssl_tls12_preset* is for TLS 1.2 use only.
Jerry Yu370e1462022-01-25 10:36:53 +08004886 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08004887 */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004888static uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08004889
Andrzej Kurek25f27152022-08-17 16:09:31 -04004890#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yued5e9f42022-01-26 11:21:34 +08004891 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4892 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004893#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA &&
Jerry Yued5e9f42022-01-26 11:21:34 +08004894 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004895
Andrzej Kurek25f27152022-08-17 16:09:31 -04004896#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu909df7b2022-01-22 11:56:27 +08004897 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4898 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004899#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu909df7b2022-01-22 11:56:27 +08004900 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
4901
Andrzej Kurek25f27152022-08-17 16:09:31 -04004902#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yued5e9f42022-01-26 11:21:34 +08004903 defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
4904 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004905#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yued5e9f42022-01-26 11:21:34 +08004906 MBEDTLS_ECP_DP_SECP521R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004907
Andrzej Kurek25f27152022-08-17 16:09:31 -04004908#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004909 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
Andrzej Kurek25f27152022-08-17 16:09:31 -04004910#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004911
Andrzej Kurek25f27152022-08-17 16:09:31 -04004912#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004913 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
Andrzej Kurek25f27152022-08-17 16:09:31 -04004914#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004915
Andrzej Kurek25f27152022-08-17 16:09:31 -04004916#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004917 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Andrzej Kurek25f27152022-08-17 16:09:31 -04004918#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004919
Andrzej Kurek25f27152022-08-17 16:09:31 -04004920#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004921 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
4922#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */
4923
Andrzej Kurek25f27152022-08-17 16:09:31 -04004924#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004925 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
4926#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */
4927
Andrzej Kurek25f27152022-08-17 16:09:31 -04004928#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004929 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4930#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4931
Gabor Mezei15b95a62022-05-09 16:37:58 +02004932 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004933};
4934
4935/* NOTICE: see above */
4936#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4937static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Andrzej Kurek25f27152022-08-17 16:09:31 -04004938#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004939#if defined(MBEDTLS_ECDSA_C)
4940 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512 ),
Jerry Yu713013f2022-01-17 18:16:35 +08004941#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004942#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4943 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
4944#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004945#if defined(MBEDTLS_RSA_C)
4946 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512 ),
4947#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004948#endif /* MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04004949#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004950#if defined(MBEDTLS_ECDSA_C)
4951 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004952#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004953#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4954 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
4955#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004956#if defined(MBEDTLS_RSA_C)
4957 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
4958#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004959#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04004960#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004961#if defined(MBEDTLS_ECDSA_C)
4962 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004963#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004964#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4965 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4966#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004967#if defined(MBEDTLS_RSA_C)
4968 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
4969#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004970#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Gabor Mezei15b95a62022-05-09 16:37:58 +02004971 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004972};
4973#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4974/* NOTICE: see above */
4975static uint16_t ssl_preset_suiteb_sig_algs[] = {
4976
Andrzej Kurek25f27152022-08-17 16:09:31 -04004977#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu909df7b2022-01-22 11:56:27 +08004978 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4979 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004980#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu909df7b2022-01-22 11:56:27 +08004981 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
4982
Andrzej Kurek25f27152022-08-17 16:09:31 -04004983#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu53037892022-01-25 11:02:06 +08004984 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4985 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004986#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu53037892022-01-25 11:02:06 +08004987 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004988
Andrzej Kurek25f27152022-08-17 16:09:31 -04004989#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu909df7b2022-01-22 11:56:27 +08004990 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004991#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu1a8b4812022-01-20 17:56:50 +08004992
Andrzej Kurek25f27152022-08-17 16:09:31 -04004993#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu53037892022-01-25 11:02:06 +08004994 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004995#endif /* MBEDTLS_RSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu53037892022-01-25 11:02:06 +08004996
Gabor Mezei15b95a62022-05-09 16:37:58 +02004997 MBEDTLS_TLS_SIG_NONE
Jerry Yu713013f2022-01-17 18:16:35 +08004998};
Jerry Yu6106fdc2022-01-12 16:36:14 +08004999
Jerry Yu909df7b2022-01-22 11:56:27 +08005000/* NOTICE: see above */
5001#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5002static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005003#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02005004#if defined(MBEDTLS_ECDSA_C)
5005 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
Jerry Yu713013f2022-01-17 18:16:35 +08005006#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005007#if defined(MBEDTLS_RSA_C)
5008 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
5009#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005010#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04005011#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02005012#if defined(MBEDTLS_ECDSA_C)
5013 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
Jerry Yu18c833e2022-01-25 10:55:47 +08005014#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005015#if defined(MBEDTLS_RSA_C)
5016 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
5017#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005018#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Gabor Mezei15b95a62022-05-09 16:37:58 +02005019 MBEDTLS_TLS_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01005020};
Jerry Yu909df7b2022-01-22 11:56:27 +08005021#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5022
Ronald Crone68ab4f2022-10-05 12:46:29 +02005023#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005024
Brett Warrene0edc842021-08-17 09:53:13 +01005025static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01005026#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01005027 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01005028#endif
5029#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01005030 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01005031#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005032 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005033};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005034
Ronald Crone68ab4f2022-10-05 12:46:29 +02005035#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005036/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08005037 * to make sure there are no duplicated signature algorithm entries. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005038MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf377d642022-01-25 10:43:59 +08005039static int ssl_check_no_sig_alg_duplication( uint16_t * sig_algs )
Jerry Yu1a8b4812022-01-20 17:56:50 +08005040{
5041 size_t i, j;
5042 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08005043
Gabor Mezei15b95a62022-05-09 16:37:58 +02005044 for( i = 0; sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08005045 {
Jerry Yuf377d642022-01-25 10:43:59 +08005046 for( j = 0; j < i; j++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08005047 {
Jerry Yuf377d642022-01-25 10:43:59 +08005048 if( sig_algs[i] != sig_algs[j] )
5049 continue;
5050 mbedtls_printf( " entry(%04x,%" MBEDTLS_PRINTF_SIZET
5051 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
5052 sig_algs[i], j, i );
5053 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005054 }
5055 }
5056 return( ret );
5057}
5058
Ronald Crone68ab4f2022-10-05 12:46:29 +02005059#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08005060
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005061/*
Tillmann Karras588ad502015-09-25 04:27:22 +02005062 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005063 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005064int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005065 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005066{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005067#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00005068 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005069#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005070
Ronald Crone68ab4f2022-10-05 12:46:29 +02005071#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf377d642022-01-25 10:43:59 +08005072 if( ssl_check_no_sig_alg_duplication( ssl_preset_suiteb_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08005073 {
5074 mbedtls_printf( "ssl_preset_suiteb_sig_algs has duplicated entries\n" );
5075 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
5076 }
5077
Jerry Yuf377d642022-01-25 10:43:59 +08005078 if( ssl_check_no_sig_alg_duplication( ssl_preset_default_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08005079 {
5080 mbedtls_printf( "ssl_preset_default_sig_algs has duplicated entries\n" );
5081 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
5082 }
Jerry Yu909df7b2022-01-22 11:56:27 +08005083
5084#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yuf377d642022-01-25 10:43:59 +08005085 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_suiteb_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08005086 {
Jerry Yu909df7b2022-01-22 11:56:27 +08005087 mbedtls_printf( "ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08005088 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
5089 }
5090
Jerry Yuf377d642022-01-25 10:43:59 +08005091 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_default_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08005092 {
Jerry Yu909df7b2022-01-22 11:56:27 +08005093 mbedtls_printf( "ssl_tls12_preset_default_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08005094 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
5095 }
5096#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02005097#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08005098
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02005099 /* Use the functions here so that they are covered in tests,
5100 * but otherwise access member directly for efficiency */
5101 mbedtls_ssl_conf_endpoint( conf, endpoint );
5102 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005103
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005104 /*
5105 * Things that are common to all presets
5106 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005107#if defined(MBEDTLS_SSL_CLI_C)
5108 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
5109 {
5110 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
5111#if defined(MBEDTLS_SSL_SESSION_TICKETS)
5112 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
5113#endif
5114 }
5115#endif
5116
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005117#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5118 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
5119#endif
5120
5121#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5122 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
5123#endif
5124
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02005125#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005126 conf->f_cookie_write = ssl_cookie_write_dummy;
5127 conf->f_cookie_check = ssl_cookie_check_dummy;
5128#endif
5129
5130#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5131 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
5132#endif
5133
Janos Follath088ce432017-04-10 12:42:31 +01005134#if defined(MBEDTLS_SSL_SRV_C)
5135 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02005136 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01005137#endif
5138
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005139#if defined(MBEDTLS_SSL_PROTO_DTLS)
5140 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
5141 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
5142#endif
5143
5144#if defined(MBEDTLS_SSL_RENEGOTIATION)
5145 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00005146 memset( conf->renego_period, 0x00, 2 );
5147 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005148#endif
5149
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005150#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckere2defad2021-07-24 05:59:17 +01005151 if( endpoint == MBEDTLS_SSL_IS_SERVER )
5152 {
5153 const unsigned char dhm_p[] =
5154 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
5155 const unsigned char dhm_g[] =
5156 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01005157
Hanno Beckere2defad2021-07-24 05:59:17 +01005158 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
5159 dhm_p, sizeof( dhm_p ),
5160 dhm_g, sizeof( dhm_g ) ) ) != 0 )
5161 {
5162 return( ret );
5163 }
5164 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02005165#endif
5166
Ronald Cron6f135e12021-12-08 16:57:54 +01005167#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yud0766ec2022-09-22 10:46:57 +08005168#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08005169 mbedtls_ssl_conf_new_session_tickets(
5170 conf, MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS );
5171#endif
Hanno Becker71f1ed62021-07-24 06:01:47 +01005172 /*
5173 * Allow all TLS 1.3 key exchange modes by default.
5174 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00005175 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01005176#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01005177
XiaokangQian4d3a6042022-04-21 13:46:17 +00005178 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5179 {
Glenn Strauss2dfcea22022-03-14 17:26:42 -04005180#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
XiaokangQian4d3a6042022-04-21 13:46:17 +00005181 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian060d8672022-04-21 09:24:56 +00005182 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005183#else
XiaokangQian060d8672022-04-21 09:24:56 +00005184 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
XiaokangQian060d8672022-04-21 09:24:56 +00005185#endif
XiaokangQian4d3a6042022-04-21 13:46:17 +00005186 }
5187 else
5188 {
5189#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
5190 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
5191 {
5192 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5193 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5194 }
5195 else
5196 /* Hybrid TLS 1.2 / 1.3 is not supported on server side yet */
5197 {
5198 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5199 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5200 }
5201#elif defined(MBEDTLS_SSL_PROTO_TLS1_3)
5202 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5203 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5204#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
5205 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5206 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5207#else
5208 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
5209#endif
5210 }
Glenn Strauss2dfcea22022-03-14 17:26:42 -04005211
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005212 /*
5213 * Preset-specific defaults
5214 */
5215 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005216 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005217 /*
5218 * NSA Suite B
5219 */
5220 case MBEDTLS_SSL_PRESET_SUITEB:
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005221
Hanno Beckerd60b6c62021-04-29 12:04:11 +01005222 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005223
5224#if defined(MBEDTLS_X509_CRT_PARSE_C)
5225 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005226#endif
5227
Ronald Crone68ab4f2022-10-05 12:46:29 +02005228#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005229#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5230 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
5231 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
5232 else
5233#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5234 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02005235#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005236
Brett Warrene0edc842021-08-17 09:53:13 +01005237#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
5238 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005239#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005240 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02005241 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005242
5243 /*
5244 * Default
5245 */
5246 default:
Ronald Cronf6606552022-03-15 11:23:25 +01005247
Hanno Beckerd60b6c62021-04-29 12:04:11 +01005248 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005249
5250#if defined(MBEDTLS_X509_CRT_PARSE_C)
5251 conf->cert_profile = &mbedtls_x509_crt_profile_default;
5252#endif
5253
Ronald Crone68ab4f2022-10-05 12:46:29 +02005254#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005255#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5256 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
5257 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
5258 else
5259#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5260 conf->sig_algs = ssl_preset_default_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02005261#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005262
Brett Warrene0edc842021-08-17 09:53:13 +01005263#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
5264 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005265#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005266 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005267
5268#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
5269 conf->dhm_min_bitlen = 1024;
5270#endif
5271 }
5272
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005273 return( 0 );
5274}
5275
5276/*
5277 * Free mbedtls_ssl_config
5278 */
5279void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
5280{
5281#if defined(MBEDTLS_DHM_C)
5282 mbedtls_mpi_free( &conf->dhm_P );
5283 mbedtls_mpi_free( &conf->dhm_G );
5284#endif
5285
Ronald Cron73fe8df2022-10-05 14:31:43 +02005286#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02005287#if defined(MBEDTLS_USE_PSA_CRYPTO)
5288 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
5289 {
Neil Armstrong501c9322022-05-03 09:35:09 +02005290 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
5291 }
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005292#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005293 if( conf->psk != NULL )
5294 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05005295 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005296 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00005297 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005298 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09005299 }
5300
5301 if( conf->psk_identity != NULL )
5302 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05005303 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09005304 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00005305 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005306 conf->psk_identity_len = 0;
5307 }
Ronald Cron73fe8df2022-10-05 14:31:43 +02005308#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005309
5310#if defined(MBEDTLS_X509_CRT_PARSE_C)
5311 ssl_key_cert_free( conf->key_cert );
5312#endif
5313
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05005314 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005315}
5316
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02005317#if defined(MBEDTLS_PK_C) && \
5318 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005319/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005320 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005321 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005322unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005323{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005324#if defined(MBEDTLS_RSA_C)
5325 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
5326 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005327#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005328#if defined(MBEDTLS_ECDSA_C)
5329 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
5330 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005331#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005332 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005333}
5334
Hanno Becker7e5437a2017-04-28 17:15:26 +01005335unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
5336{
5337 switch( type ) {
5338 case MBEDTLS_PK_RSA:
5339 return( MBEDTLS_SSL_SIG_RSA );
5340 case MBEDTLS_PK_ECDSA:
5341 case MBEDTLS_PK_ECKEY:
5342 return( MBEDTLS_SSL_SIG_ECDSA );
5343 default:
5344 return( MBEDTLS_SSL_SIG_ANON );
5345 }
5346}
5347
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005348mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005349{
5350 switch( sig )
5351 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005352#if defined(MBEDTLS_RSA_C)
5353 case MBEDTLS_SSL_SIG_RSA:
5354 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005355#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005356#if defined(MBEDTLS_ECDSA_C)
5357 case MBEDTLS_SSL_SIG_ECDSA:
5358 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005359#endif
5360 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005361 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005362 }
5363}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02005364#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005365
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02005366/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005367 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02005368 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005369mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005370{
5371 switch( hash )
5372 {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005373#if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005374 case MBEDTLS_SSL_HASH_MD5:
5375 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005376#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005377#if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005378 case MBEDTLS_SSL_HASH_SHA1:
5379 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005380#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005381#if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005382 case MBEDTLS_SSL_HASH_SHA224:
5383 return( MBEDTLS_MD_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02005384#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005385#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005386 case MBEDTLS_SSL_HASH_SHA256:
5387 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005388#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005389#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005390 case MBEDTLS_SSL_HASH_SHA384:
5391 return( MBEDTLS_MD_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02005392#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005393#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005394 case MBEDTLS_SSL_HASH_SHA512:
5395 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005396#endif
5397 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005398 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005399 }
5400}
5401
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005402/*
5403 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
5404 */
5405unsigned char mbedtls_ssl_hash_from_md_alg( int md )
5406{
5407 switch( md )
5408 {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005409#if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005410 case MBEDTLS_MD_MD5:
5411 return( MBEDTLS_SSL_HASH_MD5 );
5412#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005413#if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005414 case MBEDTLS_MD_SHA1:
5415 return( MBEDTLS_SSL_HASH_SHA1 );
5416#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005417#if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005418 case MBEDTLS_MD_SHA224:
5419 return( MBEDTLS_SSL_HASH_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02005420#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005421#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005422 case MBEDTLS_MD_SHA256:
5423 return( MBEDTLS_SSL_HASH_SHA256 );
5424#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005425#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005426 case MBEDTLS_MD_SHA384:
5427 return( MBEDTLS_SSL_HASH_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02005428#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005429#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005430 case MBEDTLS_MD_SHA512:
5431 return( MBEDTLS_SSL_HASH_SHA512 );
5432#endif
5433 default:
5434 return( MBEDTLS_SSL_HASH_NONE );
5435 }
5436}
5437
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005438/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005439 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005440 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005441 */
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005442int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005443{
Brett Warrene0edc842021-08-17 09:53:13 +01005444 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005445
Brett Warrene0edc842021-08-17 09:53:13 +01005446 if( group_list == NULL )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005447 return( -1 );
5448
Brett Warrene0edc842021-08-17 09:53:13 +01005449 for( ; *group_list != 0; group_list++ )
5450 {
5451 if( *group_list == tls_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005452 return( 0 );
Brett Warrene0edc842021-08-17 09:53:13 +01005453 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005454
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005455 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005456}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005457
5458#if defined(MBEDTLS_ECP_C)
5459/*
5460 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
5461 */
5462int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
5463{
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005464 const mbedtls_ecp_curve_info *grp_info =
Tom Cosgrovebcc13c92022-08-24 15:08:16 +01005465 mbedtls_ecp_curve_info_from_grp_id( grp_id );
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005466
Tom Cosgrovebcc13c92022-08-24 15:08:16 +01005467 if ( grp_info == NULL )
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005468 return -1;
5469
5470 uint16_t tls_id = grp_info->tls_id;
5471
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005472 return mbedtls_ssl_check_curve_tls_id( ssl, tls_id );
5473}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02005474#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005475
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005476#if defined(MBEDTLS_X509_CRT_PARSE_C)
5477int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
5478 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005479 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02005480 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005481{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005482 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005483 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005484 const char *ext_oid;
5485 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005486
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005487 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005488 {
5489 /* Server part of the key exchange */
5490 switch( ciphersuite->key_exchange )
5491 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005492 case MBEDTLS_KEY_EXCHANGE_RSA:
5493 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005494 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005495 break;
5496
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005497 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
5498 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
5499 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
5500 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005501 break;
5502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005503 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
5504 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005505 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005506 break;
5507
5508 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005509 case MBEDTLS_KEY_EXCHANGE_NONE:
5510 case MBEDTLS_KEY_EXCHANGE_PSK:
5511 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
5512 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02005513 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005514 usage = 0;
5515 }
5516 }
5517 else
5518 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005519 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
5520 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005521 }
5522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005523 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005524 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005525 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005526 ret = -1;
5527 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005528
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005529 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005530 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005531 ext_oid = MBEDTLS_OID_SERVER_AUTH;
5532 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005533 }
5534 else
5535 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005536 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
5537 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005538 }
5539
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005540 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005541 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005542 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005543 ret = -1;
5544 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005545
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005546 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005547}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005548#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02005549
Jerry Yu148165c2021-09-24 23:20:59 +08005550#if defined(MBEDTLS_USE_PSA_CRYPTO)
5551int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
5552 const mbedtls_md_type_t md,
5553 unsigned char *dst,
5554 size_t dst_len,
5555 size_t *olen )
5556{
Ronald Cronf6893e12022-01-07 22:09:01 +01005557 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5558 psa_hash_operation_t *hash_operation_to_clone;
5559 psa_hash_operation_t hash_operation = psa_hash_operation_init();
5560
Jerry Yu148165c2021-09-24 23:20:59 +08005561 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01005562
5563 switch( md )
5564 {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005565#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cronf6893e12022-01-07 22:09:01 +01005566 case MBEDTLS_MD_SHA384:
5567 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
5568 break;
5569#endif
5570
Andrzej Kurek25f27152022-08-17 16:09:31 -04005571#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cronf6893e12022-01-07 22:09:01 +01005572 case MBEDTLS_MD_SHA256:
5573 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
5574 break;
5575#endif
5576
5577 default:
5578 goto exit;
5579 }
5580
5581 status = psa_hash_clone( hash_operation_to_clone, &hash_operation );
5582 if( status != PSA_SUCCESS )
5583 goto exit;
5584
5585 status = psa_hash_finish( &hash_operation, dst, dst_len, olen );
5586 if( status != PSA_SUCCESS )
5587 goto exit;
5588
5589exit:
Andrzej Kurekeabeb302022-10-17 07:52:51 -04005590#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
5591 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
5592 (void) ssl;
5593#endif
Ronald Cronb788c042022-02-15 09:14:15 +01005594 return( psa_ssl_status_to_mbedtls( status ) );
Jerry Yu148165c2021-09-24 23:20:59 +08005595}
5596#else /* MBEDTLS_USE_PSA_CRYPTO */
5597
Andrzej Kurek25f27152022-08-17 16:09:31 -04005598#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005599MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu000f9762021-09-14 11:12:51 +08005600static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
5601 unsigned char *dst,
5602 size_t dst_len,
5603 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005604{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005605 int ret;
5606 mbedtls_sha512_context sha512;
5607
5608 if( dst_len < 48 )
5609 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5610
5611 mbedtls_sha512_init( &sha512 );
Andrzej Kureka242e832022-08-11 10:03:14 -04005612 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005613
5614 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
5615 {
5616 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
5617 goto exit;
5618 }
5619
5620 *olen = 48;
5621
5622exit:
5623
5624 mbedtls_sha512_free( &sha512 );
5625 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005626}
Andrzej Kurek25f27152022-08-17 16:09:31 -04005627#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005628
Andrzej Kurek25f27152022-08-17 16:09:31 -04005629#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005630MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu000f9762021-09-14 11:12:51 +08005631static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
5632 unsigned char *dst,
5633 size_t dst_len,
5634 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005635{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005636 int ret;
5637 mbedtls_sha256_context sha256;
5638
5639 if( dst_len < 32 )
5640 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5641
5642 mbedtls_sha256_init( &sha256 );
5643 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Jerry Yuc5aef882021-12-23 20:15:02 +08005644
Jerry Yu24c0ec32021-09-09 14:21:07 +08005645 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
5646 {
5647 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
5648 goto exit;
5649 }
5650
5651 *olen = 32;
5652
5653exit:
5654
5655 mbedtls_sha256_free( &sha256 );
5656 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005657}
Andrzej Kurek25f27152022-08-17 16:09:31 -04005658#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005659
Jerry Yu000f9762021-09-14 11:12:51 +08005660int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
5661 const mbedtls_md_type_t md,
5662 unsigned char *dst,
5663 size_t dst_len,
5664 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005665{
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005666 switch( md )
5667 {
5668
Andrzej Kurek25f27152022-08-17 16:09:31 -04005669#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005670 case MBEDTLS_MD_SHA384:
Jerry Yuc5aef882021-12-23 20:15:02 +08005671 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005672#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005673
Andrzej Kurek25f27152022-08-17 16:09:31 -04005674#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005675 case MBEDTLS_MD_SHA256:
Jerry Yuc5aef882021-12-23 20:15:02 +08005676 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005677#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005678
5679 default:
Andrzej Kurek409248a2022-10-24 10:33:21 -04005680#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
5681 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
5682 (void) ssl;
5683 (void) dst;
5684 (void) dst_len;
5685 (void) olen;
5686#endif
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005687 break;
5688 }
Jerry Yuc5aef882021-12-23 20:15:02 +08005689 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005690}
XiaokangQian647719a2021-12-07 09:16:29 +00005691
Jerry Yu148165c2021-09-24 23:20:59 +08005692#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005693
Ronald Crone68ab4f2022-10-05 12:46:29 +02005694#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Gabor Mezei078e8032022-04-27 21:17:56 +02005695/* mbedtls_ssl_parse_sig_alg_ext()
5696 *
5697 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
5698 * value (TLS 1.3 RFC8446):
5699 * enum {
5700 * ....
5701 * ecdsa_secp256r1_sha256( 0x0403 ),
5702 * ecdsa_secp384r1_sha384( 0x0503 ),
5703 * ecdsa_secp521r1_sha512( 0x0603 ),
5704 * ....
5705 * } SignatureScheme;
5706 *
5707 * struct {
5708 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
5709 * } SignatureSchemeList;
5710 *
5711 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
5712 * value (TLS 1.2 RFC5246):
5713 * enum {
5714 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
5715 * sha512(6), (255)
5716 * } HashAlgorithm;
5717 *
5718 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
5719 * SignatureAlgorithm;
5720 *
5721 * struct {
5722 * HashAlgorithm hash;
5723 * SignatureAlgorithm signature;
5724 * } SignatureAndHashAlgorithm;
5725 *
5726 * SignatureAndHashAlgorithm
5727 * supported_signature_algorithms<2..2^16-2>;
5728 *
5729 * The TLS 1.3 signature algorithm extension was defined to be a compatible
5730 * generalization of the TLS 1.2 signature algorithm extension.
5731 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
5732 * `SignatureScheme` field of TLS 1.3
5733 *
5734 */
5735int mbedtls_ssl_parse_sig_alg_ext( mbedtls_ssl_context *ssl,
5736 const unsigned char *buf,
5737 const unsigned char *end )
5738{
5739 const unsigned char *p = buf;
5740 size_t supported_sig_algs_len = 0;
5741 const unsigned char *supported_sig_algs_end;
5742 uint16_t sig_alg;
5743 uint32_t common_idx = 0;
5744
5745 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
5746 supported_sig_algs_len = MBEDTLS_GET_UINT16_BE( p, 0 );
5747 p += 2;
5748
5749 memset( ssl->handshake->received_sig_algs, 0,
5750 sizeof(ssl->handshake->received_sig_algs) );
5751
5752 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, supported_sig_algs_len );
5753 supported_sig_algs_end = p + supported_sig_algs_len;
5754 while( p < supported_sig_algs_end )
5755 {
5756 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, supported_sig_algs_end, 2 );
5757 sig_alg = MBEDTLS_GET_UINT16_BE( p, 0 );
5758 p += 2;
Jerry Yuf3b46b52022-06-19 16:52:27 +08005759 MBEDTLS_SSL_DEBUG_MSG( 4, ( "received signature algorithm: 0x%x %s",
5760 sig_alg,
5761 mbedtls_ssl_sig_alg_to_str( sig_alg ) ) );
Jerry Yu2fe6c632022-06-29 10:02:38 +08005762#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu52b7d922022-07-01 18:03:31 +08005763 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
Jerry Yu2fe6c632022-06-29 10:02:38 +08005764 ( ! ( mbedtls_ssl_sig_alg_is_supported( ssl, sig_alg ) &&
5765 mbedtls_ssl_sig_alg_is_offered( ssl, sig_alg ) ) ) )
5766 {
Gabor Mezei078e8032022-04-27 21:17:56 +02005767 continue;
Jerry Yu2fe6c632022-06-29 10:02:38 +08005768 }
5769#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gabor Mezei078e8032022-04-27 21:17:56 +02005770
Jerry Yuf3b46b52022-06-19 16:52:27 +08005771 MBEDTLS_SSL_DEBUG_MSG( 4, ( "valid signature algorithm: %s",
5772 mbedtls_ssl_sig_alg_to_str( sig_alg ) ) );
Gabor Mezei078e8032022-04-27 21:17:56 +02005773
5774 if( common_idx + 1 < MBEDTLS_RECEIVED_SIG_ALGS_SIZE )
5775 {
5776 ssl->handshake->received_sig_algs[common_idx] = sig_alg;
5777 common_idx += 1;
5778 }
5779 }
5780 /* Check that we consumed all the message. */
5781 if( p != end )
5782 {
5783 MBEDTLS_SSL_DEBUG_MSG( 1,
5784 ( "Signature algorithms extension length misaligned" ) );
5785 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
5786 MBEDTLS_ERR_SSL_DECODE_ERROR );
5787 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5788 }
5789
5790 if( common_idx == 0 )
5791 {
5792 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature algorithm in common" ) );
5793 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
5794 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
5795 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
5796 }
5797
Gabor Mezei15b95a62022-05-09 16:37:58 +02005798 ssl->handshake->received_sig_algs[common_idx] = MBEDTLS_TLS_SIG_NONE;
Gabor Mezei078e8032022-04-27 21:17:56 +02005799 return( 0 );
5800}
5801
Ronald Crone68ab4f2022-10-05 12:46:29 +02005802#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Gabor Mezei078e8032022-04-27 21:17:56 +02005803
Jerry Yudc7bd172022-02-17 13:44:15 +08005804#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5805
5806#if defined(MBEDTLS_USE_PSA_CRYPTO)
5807
5808static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
5809 mbedtls_svc_key_id_t key,
5810 psa_algorithm_t alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005811 const unsigned char* raw_psk, size_t raw_psk_length,
Jerry Yudc7bd172022-02-17 13:44:15 +08005812 const unsigned char* seed, size_t seed_length,
5813 const unsigned char* label, size_t label_length,
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005814 const unsigned char* other_secret,
5815 size_t other_secret_length,
Jerry Yudc7bd172022-02-17 13:44:15 +08005816 size_t capacity )
5817{
5818 psa_status_t status;
5819
5820 status = psa_key_derivation_setup( derivation, alg );
5821 if( status != PSA_SUCCESS )
5822 return( status );
5823
5824 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
5825 {
5826 status = psa_key_derivation_input_bytes( derivation,
5827 PSA_KEY_DERIVATION_INPUT_SEED,
5828 seed, seed_length );
5829 if( status != PSA_SUCCESS )
5830 return( status );
5831
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005832 if ( other_secret != NULL )
Przemek Stekiel1f027032022-04-05 17:12:11 +02005833 {
5834 status = psa_key_derivation_input_bytes( derivation,
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005835 PSA_KEY_DERIVATION_INPUT_OTHER_SECRET,
5836 other_secret, other_secret_length );
Przemek Stekiel1f027032022-04-05 17:12:11 +02005837 if( status != PSA_SUCCESS )
5838 return( status );
5839 }
5840
Jerry Yudc7bd172022-02-17 13:44:15 +08005841 if( mbedtls_svc_key_id_is_null( key ) )
5842 {
5843 status = psa_key_derivation_input_bytes(
5844 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005845 raw_psk, raw_psk_length );
Jerry Yudc7bd172022-02-17 13:44:15 +08005846 }
5847 else
5848 {
5849 status = psa_key_derivation_input_key(
5850 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
5851 }
5852 if( status != PSA_SUCCESS )
5853 return( status );
5854
5855 status = psa_key_derivation_input_bytes( derivation,
5856 PSA_KEY_DERIVATION_INPUT_LABEL,
5857 label, label_length );
5858 if( status != PSA_SUCCESS )
5859 return( status );
5860 }
5861 else
5862 {
5863 return( PSA_ERROR_NOT_SUPPORTED );
5864 }
5865
5866 status = psa_key_derivation_set_capacity( derivation, capacity );
5867 if( status != PSA_SUCCESS )
5868 return( status );
5869
5870 return( PSA_SUCCESS );
5871}
5872
Andrzej Kurek57d10632022-10-24 10:32:01 -04005873#if defined(PSA_WANT_ALG_SHA_384) || \
5874 defined(PSA_WANT_ALG_SHA_256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005875MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005876static int tls_prf_generic( mbedtls_md_type_t md_type,
5877 const unsigned char *secret, size_t slen,
5878 const char *label,
5879 const unsigned char *random, size_t rlen,
5880 unsigned char *dstbuf, size_t dlen )
5881{
5882 psa_status_t status;
5883 psa_algorithm_t alg;
5884 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
5885 psa_key_derivation_operation_t derivation =
5886 PSA_KEY_DERIVATION_OPERATION_INIT;
5887
5888 if( md_type == MBEDTLS_MD_SHA384 )
5889 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
5890 else
5891 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
5892
5893 /* Normally a "secret" should be long enough to be impossible to
5894 * find by brute force, and in particular should not be empty. But
5895 * this PRF is also used to derive an IV, in particular in EAP-TLS,
5896 * and for this use case it makes sense to have a 0-length "secret".
5897 * Since the key API doesn't allow importing a key of length 0,
5898 * keep master_key=0, which setup_psa_key_derivation() understands
5899 * to mean a 0-length "secret" input. */
5900 if( slen != 0 )
5901 {
5902 psa_key_attributes_t key_attributes = psa_key_attributes_init();
5903 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
5904 psa_set_key_algorithm( &key_attributes, alg );
5905 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
5906
5907 status = psa_import_key( &key_attributes, secret, slen, &master_key );
5908 if( status != PSA_SUCCESS )
5909 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5910 }
5911
5912 status = setup_psa_key_derivation( &derivation,
5913 master_key, alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005914 NULL, 0,
Jerry Yudc7bd172022-02-17 13:44:15 +08005915 random, rlen,
5916 (unsigned char const *) label,
5917 (size_t) strlen( label ),
Przemek Stekiel1f027032022-04-05 17:12:11 +02005918 NULL, 0,
Jerry Yudc7bd172022-02-17 13:44:15 +08005919 dlen );
5920 if( status != PSA_SUCCESS )
5921 {
5922 psa_key_derivation_abort( &derivation );
5923 psa_destroy_key( master_key );
5924 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5925 }
5926
5927 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
5928 if( status != PSA_SUCCESS )
5929 {
5930 psa_key_derivation_abort( &derivation );
5931 psa_destroy_key( master_key );
5932 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5933 }
5934
5935 status = psa_key_derivation_abort( &derivation );
5936 if( status != PSA_SUCCESS )
5937 {
5938 psa_destroy_key( master_key );
5939 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5940 }
5941
5942 if( ! mbedtls_svc_key_id_is_null( master_key ) )
5943 status = psa_destroy_key( master_key );
5944 if( status != PSA_SUCCESS )
5945 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5946
5947 return( 0 );
5948}
Andrzej Kurek57d10632022-10-24 10:32:01 -04005949#endif /* PSA_WANT_ALG_SHA_256 || PSA_WANT_ALG_SHA_384 */
Jerry Yudc7bd172022-02-17 13:44:15 +08005950#else /* MBEDTLS_USE_PSA_CRYPTO */
5951
Andrzej Kurek57d10632022-10-24 10:32:01 -04005952#if defined(MBEDTLS_MD_C) && \
5953 ( defined(MBEDTLS_SHA256_C) || \
5954 defined(MBEDTLS_SHA384_C) )
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005955MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005956static int tls_prf_generic( mbedtls_md_type_t md_type,
5957 const unsigned char *secret, size_t slen,
5958 const char *label,
5959 const unsigned char *random, size_t rlen,
5960 unsigned char *dstbuf, size_t dlen )
5961{
5962 size_t nb;
5963 size_t i, j, k, md_len;
5964 unsigned char *tmp;
5965 size_t tmp_len = 0;
5966 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
5967 const mbedtls_md_info_t *md_info;
5968 mbedtls_md_context_t md_ctx;
5969 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5970
5971 mbedtls_md_init( &md_ctx );
5972
5973 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
5974 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5975
5976 md_len = mbedtls_md_get_size( md_info );
5977
5978 tmp_len = md_len + strlen( label ) + rlen;
5979 tmp = mbedtls_calloc( 1, tmp_len );
5980 if( tmp == NULL )
5981 {
5982 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
5983 goto exit;
5984 }
5985
5986 nb = strlen( label );
5987 memcpy( tmp + md_len, label, nb );
5988 memcpy( tmp + md_len + nb, random, rlen );
5989 nb += rlen;
5990
5991 /*
5992 * Compute P_<hash>(secret, label + random)[0..dlen]
5993 */
5994 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
5995 goto exit;
5996
5997 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
5998 if( ret != 0 )
5999 goto exit;
6000 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
6001 if( ret != 0 )
6002 goto exit;
6003 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
6004 if( ret != 0 )
6005 goto exit;
6006
6007 for( i = 0; i < dlen; i += md_len )
6008 {
6009 ret = mbedtls_md_hmac_reset ( &md_ctx );
6010 if( ret != 0 )
6011 goto exit;
6012 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
6013 if( ret != 0 )
6014 goto exit;
6015 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
6016 if( ret != 0 )
6017 goto exit;
6018
6019 ret = mbedtls_md_hmac_reset ( &md_ctx );
6020 if( ret != 0 )
6021 goto exit;
6022 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
6023 if( ret != 0 )
6024 goto exit;
6025 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
6026 if( ret != 0 )
6027 goto exit;
6028
6029 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
6030
6031 for( j = 0; j < k; j++ )
6032 dstbuf[i + j] = h_i[j];
6033 }
6034
6035exit:
6036 mbedtls_md_free( &md_ctx );
6037
Dave Rodgman29b9b2b2022-11-01 16:08:14 +00006038 if ( tmp != NULL )
6039 mbedtls_platform_zeroize( tmp, tmp_len );
6040
Jerry Yudc7bd172022-02-17 13:44:15 +08006041 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
6042
6043 mbedtls_free( tmp );
6044
6045 return( ret );
6046}
Andrzej Kurek57d10632022-10-24 10:32:01 -04006047#endif /* MBEDTLS_MD_C && ( MBEDTLS_SHA256_C || MBEDTLS_SHA384_C ) */
Jerry Yudc7bd172022-02-17 13:44:15 +08006048#endif /* MBEDTLS_USE_PSA_CRYPTO */
6049
Andrzej Kurek25f27152022-08-17 16:09:31 -04006050#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006051MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08006052static int tls_prf_sha256( const unsigned char *secret, size_t slen,
6053 const char *label,
6054 const unsigned char *random, size_t rlen,
6055 unsigned char *dstbuf, size_t dlen )
6056{
6057 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
6058 label, random, rlen, dstbuf, dlen ) );
6059}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04006060#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yudc7bd172022-02-17 13:44:15 +08006061
Andrzej Kurek25f27152022-08-17 16:09:31 -04006062#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006063MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08006064static int tls_prf_sha384( const unsigned char *secret, size_t slen,
6065 const char *label,
6066 const unsigned char *random, size_t rlen,
6067 unsigned char *dstbuf, size_t dlen )
6068{
6069 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
6070 label, random, rlen, dstbuf, dlen ) );
6071}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04006072#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yudc7bd172022-02-17 13:44:15 +08006073
Jerry Yuf009d862022-02-17 14:01:37 +08006074/*
6075 * Set appropriate PRF function and other SSL / TLS1.2 functions
6076 *
6077 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08006078 * - hash associated with the ciphersuite (only used by TLS 1.2)
6079 *
6080 * Outputs:
6081 * - the tls_prf, calc_verify and calc_finished members of handshake structure
6082 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006083MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf009d862022-02-17 14:01:37 +08006084static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
Jerry Yuf009d862022-02-17 14:01:37 +08006085 mbedtls_md_type_t hash )
6086{
Andrzej Kurek25f27152022-08-17 16:09:31 -04006087#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cron81591aa2022-03-07 09:05:51 +01006088 if( hash == MBEDTLS_MD_SHA384 )
Jerry Yuf009d862022-02-17 14:01:37 +08006089 {
6090 handshake->tls_prf = tls_prf_sha384;
6091 handshake->calc_verify = ssl_calc_verify_tls_sha384;
6092 handshake->calc_finished = ssl_calc_finished_tls_sha384;
6093 }
6094 else
6095#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04006096#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuf009d862022-02-17 14:01:37 +08006097 {
Ronald Cron81591aa2022-03-07 09:05:51 +01006098 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08006099 handshake->tls_prf = tls_prf_sha256;
6100 handshake->calc_verify = ssl_calc_verify_tls_sha256;
6101 handshake->calc_finished = ssl_calc_finished_tls_sha256;
6102 }
Ronald Cron81591aa2022-03-07 09:05:51 +01006103#else
Jerry Yuf009d862022-02-17 14:01:37 +08006104 {
Jerry Yuf009d862022-02-17 14:01:37 +08006105 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01006106 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08006107 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6108 }
Ronald Cron81591aa2022-03-07 09:05:51 +01006109#endif
Jerry Yuf009d862022-02-17 14:01:37 +08006110
6111 return( 0 );
6112}
Jerry Yud6ab2352022-02-17 14:03:43 +08006113
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006114/*
6115 * Compute master secret if needed
6116 *
6117 * Parameters:
6118 * [in/out] handshake
6119 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
6120 * (PSA-PSK) ciphersuite_info, psk_opaque
6121 * [out] premaster (cleared)
6122 * [out] master
6123 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
6124 * debug: conf->f_dbg, conf->p_dbg
6125 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01006126 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006127 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006128MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006129static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
6130 unsigned char *master,
6131 const mbedtls_ssl_context *ssl )
6132{
6133 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6134
6135 /* cf. RFC 5246, Section 8.1:
6136 * "The master secret is always exactly 48 bytes in length." */
6137 size_t const master_secret_len = 48;
6138
6139#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6140 unsigned char session_hash[48];
6141#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
6142
6143 /* The label for the KDF used for key expansion.
6144 * This is either "master secret" or "extended master secret"
6145 * depending on whether the Extended Master Secret extension
6146 * is used. */
6147 char const *lbl = "master secret";
6148
Przemek Stekielae4ed302022-04-05 17:15:55 +02006149 /* The seed for the KDF used for key expansion.
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006150 * - If the Extended Master Secret extension is not used,
6151 * this is ClientHello.Random + ServerHello.Random
6152 * (see Sect. 8.1 in RFC 5246).
6153 * - If the Extended Master Secret extension is used,
6154 * this is the transcript of the handshake so far.
6155 * (see Sect. 4 in RFC 7627). */
Przemek Stekielae4ed302022-04-05 17:15:55 +02006156 unsigned char const *seed = handshake->randbytes;
6157 size_t seed_len = 64;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006158
6159#if !defined(MBEDTLS_DEBUG_C) && \
6160 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
6161 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
6162 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
6163 ssl = NULL; /* make sure we don't use it except for those cases */
6164 (void) ssl;
6165#endif
6166
6167 if( handshake->resume != 0 )
6168 {
6169 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
6170 return( 0 );
6171 }
6172
6173#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6174 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
6175 {
6176 lbl = "extended master secret";
Przemek Stekielae4ed302022-04-05 17:15:55 +02006177 seed = session_hash;
6178 handshake->calc_verify( ssl, session_hash, &seed_len );
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006179
6180 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
Przemek Stekielae4ed302022-04-05 17:15:55 +02006181 session_hash, seed_len );
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006182 }
Przemek Stekiel169bf0b2022-04-29 07:53:29 +02006183#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006184
Przemek Stekiel99114f32022-04-22 11:20:09 +02006185#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Przemek Stekiel8a4b7fd2022-04-28 09:22:22 +02006186 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Neil Armstronge952a302022-05-03 10:22:14 +02006187 if( mbedtls_ssl_ciphersuite_uses_psk( handshake->ciphersuite_info ) == 1 )
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006188 {
6189 /* Perform PSK-to-MS expansion in a single step. */
6190 psa_status_t status;
6191 psa_algorithm_t alg;
6192 mbedtls_svc_key_id_t psk;
6193 psa_key_derivation_operation_t derivation =
6194 PSA_KEY_DERIVATION_OPERATION_INIT;
6195 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
6196
6197 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
6198
6199 psk = mbedtls_ssl_get_opaque_psk( ssl );
6200
6201 if( hash_alg == MBEDTLS_MD_SHA384 )
6202 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
6203 else
6204 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
6205
Przemek Stekiel51a1f362022-04-13 08:57:06 +02006206 size_t other_secret_len = 0;
6207 unsigned char* other_secret = NULL;
Przemek Stekielc2033402022-04-05 17:19:41 +02006208
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006209 switch( handshake->ciphersuite_info->key_exchange )
Przemek Stekielc2033402022-04-05 17:19:41 +02006210 {
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006211 /* Provide other secret.
Przemek Stekiel51a1f362022-04-13 08:57:06 +02006212 * Other secret is stored in premaster, where first 2 bytes hold the
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006213 * length of the other key.
Przemek Stekielc2033402022-04-05 17:19:41 +02006214 */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006215 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Przemek Stekiel8abcee92022-04-28 09:16:28 +02006216 /* For RSA-PSK other key length is always 48 bytes. */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006217 other_secret_len = 48;
6218 other_secret = handshake->premaster + 2;
6219 break;
6220 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006221 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006222 other_secret_len = MBEDTLS_GET_UINT16_BE(handshake->premaster, 0);
6223 other_secret = handshake->premaster + 2;
6224 break;
6225 default:
6226 break;
Przemek Stekielc2033402022-04-05 17:19:41 +02006227 }
6228
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006229 status = setup_psa_key_derivation( &derivation, psk, alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02006230 ssl->conf->psk, ssl->conf->psk_len,
Przemek Stekielae4ed302022-04-05 17:15:55 +02006231 seed, seed_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006232 (unsigned char const *) lbl,
6233 (size_t) strlen( lbl ),
Przemek Stekiel51a1f362022-04-13 08:57:06 +02006234 other_secret, other_secret_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006235 master_secret_len );
6236 if( status != PSA_SUCCESS )
6237 {
6238 psa_key_derivation_abort( &derivation );
6239 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
6240 }
6241
6242 status = psa_key_derivation_output_bytes( &derivation,
6243 master,
6244 master_secret_len );
6245 if( status != PSA_SUCCESS )
6246 {
6247 psa_key_derivation_abort( &derivation );
6248 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
6249 }
6250
6251 status = psa_key_derivation_abort( &derivation );
6252 if( status != PSA_SUCCESS )
6253 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
6254 }
6255 else
6256#endif
6257 {
Neil Armstrongca7d5062022-05-31 14:43:23 +02006258#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
6259 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
6260 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
6261 {
6262 psa_status_t status;
6263 psa_algorithm_t alg = PSA_ALG_TLS12_ECJPAKE_TO_PMS;
6264 psa_key_derivation_operation_t derivation =
6265 PSA_KEY_DERIVATION_OPERATION_INIT;
6266
6267 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PMS KDF for ECJPAKE" ) );
6268
6269 handshake->pmslen = PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE;
6270
6271 status = psa_key_derivation_setup( &derivation, alg );
6272 if( status != PSA_SUCCESS )
6273 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
6274
6275 status = psa_key_derivation_set_capacity( &derivation,
6276 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE );
6277 if( status != PSA_SUCCESS )
6278 {
6279 psa_key_derivation_abort( &derivation );
6280 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
6281 }
6282
6283 status = psa_pake_get_implicit_key( &handshake->psa_pake_ctx,
6284 &derivation );
6285 if( status != PSA_SUCCESS )
6286 {
6287 psa_key_derivation_abort( &derivation );
6288 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
6289 }
6290
6291 status = psa_key_derivation_output_bytes( &derivation,
6292 handshake->premaster,
6293 handshake->pmslen );
6294 if( status != PSA_SUCCESS )
6295 {
6296 psa_key_derivation_abort( &derivation );
6297 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
6298 }
6299
6300 status = psa_key_derivation_abort( &derivation );
6301 if( status != PSA_SUCCESS )
6302 {
6303 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
6304 }
6305 }
6306#endif
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006307 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
Przemek Stekielae4ed302022-04-05 17:15:55 +02006308 lbl, seed, seed_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006309 master,
6310 master_secret_len );
6311 if( ret != 0 )
6312 {
6313 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
6314 return( ret );
6315 }
6316
6317 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
6318 handshake->premaster,
6319 handshake->pmslen );
6320
6321 mbedtls_platform_zeroize( handshake->premaster,
6322 sizeof(handshake->premaster) );
6323 }
6324
6325 return( 0 );
6326}
6327
Jerry Yud62f87e2022-02-17 14:09:02 +08006328int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
6329{
6330 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6331 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
6332 ssl->handshake->ciphersuite_info;
6333
6334 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
6335
6336 /* Set PRF, calc_verify and calc_finished function pointers */
6337 ret = ssl_set_handshake_prfs( ssl->handshake,
Jerry Yud62f87e2022-02-17 14:09:02 +08006338 ciphersuite_info->mac );
6339 if( ret != 0 )
6340 {
6341 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
6342 return( ret );
6343 }
6344
6345 /* Compute master secret if needed */
6346 ret = ssl_compute_master( ssl->handshake,
6347 ssl->session_negotiate->master,
6348 ssl );
6349 if( ret != 0 )
6350 {
6351 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
6352 return( ret );
6353 }
6354
6355 /* Swap the client and server random values:
6356 * - MS derivation wanted client+server (RFC 5246 8.1)
6357 * - key derivation wants server+client (RFC 5246 6.3) */
6358 {
6359 unsigned char tmp[64];
6360 memcpy( tmp, ssl->handshake->randbytes, 64 );
6361 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
6362 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
6363 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
6364 }
6365
6366 /* Populate transform structure */
6367 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
6368 ssl->session_negotiate->ciphersuite,
6369 ssl->session_negotiate->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02006370#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yud62f87e2022-02-17 14:09:02 +08006371 ssl->session_negotiate->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02006372#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yud62f87e2022-02-17 14:09:02 +08006373 ssl->handshake->tls_prf,
6374 ssl->handshake->randbytes,
Glenn Strauss60bfe602022-03-14 19:04:24 -04006375 ssl->tls_version,
Jerry Yud62f87e2022-02-17 14:09:02 +08006376 ssl->conf->endpoint,
6377 ssl );
6378 if( ret != 0 )
6379 {
6380 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
6381 return( ret );
6382 }
6383
6384 /* We no longer need Server/ClientHello.random values */
6385 mbedtls_platform_zeroize( ssl->handshake->randbytes,
6386 sizeof( ssl->handshake->randbytes ) );
6387
6388 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
6389
6390 return( 0 );
6391}
Jerry Yu8392e0d2022-02-17 14:10:24 +08006392
Ronald Cron4dcbca92022-03-07 10:21:40 +01006393int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
6394{
Ronald Cron4dcbca92022-03-07 10:21:40 +01006395 switch( md )
6396 {
Andrzej Kurek25f27152022-08-17 16:09:31 -04006397#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cron4dcbca92022-03-07 10:21:40 +01006398 case MBEDTLS_SSL_HASH_SHA384:
6399 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
6400 break;
6401#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04006402#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cron4dcbca92022-03-07 10:21:40 +01006403 case MBEDTLS_SSL_HASH_SHA256:
6404 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
6405 break;
6406#endif
6407 default:
6408 return( -1 );
6409 }
Andrzej Kurekeabeb302022-10-17 07:52:51 -04006410#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
6411 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
6412 (void) ssl;
6413#endif
Ronald Cronc2f13a02022-03-07 10:25:24 +01006414 return( 0 );
Ronald Cron4dcbca92022-03-07 10:21:40 +01006415}
6416
Andrzej Kurek25f27152022-08-17 16:09:31 -04006417#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu8392e0d2022-02-17 14:10:24 +08006418void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
6419 unsigned char *hash,
6420 size_t *hlen )
6421{
6422#if defined(MBEDTLS_USE_PSA_CRYPTO)
6423 size_t hash_size;
6424 psa_status_t status;
6425 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
6426
6427 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
6428 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
6429 if( status != PSA_SUCCESS )
6430 {
6431 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6432 return;
6433 }
6434
6435 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
6436 if( status != PSA_SUCCESS )
6437 {
6438 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6439 return;
6440 }
6441
6442 *hlen = 32;
6443 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
6444 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
6445#else
6446 mbedtls_sha256_context sha256;
6447
6448 mbedtls_sha256_init( &sha256 );
6449
6450 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
6451
6452 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
6453 mbedtls_sha256_finish( &sha256, hash );
6454
6455 *hlen = 32;
6456
6457 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
6458 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
6459
6460 mbedtls_sha256_free( &sha256 );
6461#endif /* MBEDTLS_USE_PSA_CRYPTO */
6462 return;
6463}
Andrzej Kurek25f27152022-08-17 16:09:31 -04006464#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu8392e0d2022-02-17 14:10:24 +08006465
Andrzej Kurek25f27152022-08-17 16:09:31 -04006466#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc1cb3842022-02-17 14:13:48 +08006467void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
6468 unsigned char *hash,
6469 size_t *hlen )
6470{
6471#if defined(MBEDTLS_USE_PSA_CRYPTO)
6472 size_t hash_size;
6473 psa_status_t status;
6474 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
6475
6476 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
6477 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
6478 if( status != PSA_SUCCESS )
6479 {
6480 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6481 return;
6482 }
6483
6484 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
6485 if( status != PSA_SUCCESS )
6486 {
6487 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6488 return;
6489 }
6490
6491 *hlen = 48;
6492 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
6493 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
6494#else
6495 mbedtls_sha512_context sha512;
6496
6497 mbedtls_sha512_init( &sha512 );
6498
6499 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
6500
Andrzej Kureka242e832022-08-11 10:03:14 -04006501 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
Jerry Yuc1cb3842022-02-17 14:13:48 +08006502 mbedtls_sha512_finish( &sha512, hash );
6503
6504 *hlen = 48;
6505
6506 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
6507 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
6508
6509 mbedtls_sha512_free( &sha512 );
6510#endif /* MBEDTLS_USE_PSA_CRYPTO */
6511 return;
6512}
Andrzej Kurek25f27152022-08-17 16:09:31 -04006513#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yuc1cb3842022-02-17 14:13:48 +08006514
Neil Armstrong80f6f322022-05-03 17:56:38 +02006515#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
6516 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Jerry Yuce3dca42022-02-17 14:16:37 +08006517int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
6518{
6519 unsigned char *p = ssl->handshake->premaster;
6520 unsigned char *end = p + sizeof( ssl->handshake->premaster );
6521 const unsigned char *psk = NULL;
6522 size_t psk_len = 0;
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006523 int psk_ret = mbedtls_ssl_get_psk( ssl, &psk, &psk_len );
Jerry Yuce3dca42022-02-17 14:16:37 +08006524
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006525 if( psk_ret == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
Jerry Yuce3dca42022-02-17 14:16:37 +08006526 {
6527 /*
6528 * This should never happen because the existence of a PSK is always
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006529 * checked before calling this function.
6530 *
6531 * The exception is opaque DHE-PSK. For DHE-PSK fill premaster with
Przemek Stekiel8abcee92022-04-28 09:16:28 +02006532 * the shared secret without PSK.
Jerry Yuce3dca42022-02-17 14:16:37 +08006533 */
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006534 if ( key_ex != MBEDTLS_KEY_EXCHANGE_DHE_PSK )
6535 {
6536 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6537 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6538 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006539 }
6540
6541 /*
6542 * PMS = struct {
6543 * opaque other_secret<0..2^16-1>;
6544 * opaque psk<0..2^16-1>;
6545 * };
6546 * with "other_secret" depending on the particular key exchange
6547 */
6548#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
6549 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
6550 {
6551 if( end - p < 2 )
6552 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6553
6554 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
6555 p += 2;
6556
6557 if( end < p || (size_t)( end - p ) < psk_len )
6558 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6559
6560 memset( p, 0, psk_len );
6561 p += psk_len;
6562 }
6563 else
6564#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
6565#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
6566 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
6567 {
6568 /*
6569 * other_secret already set by the ClientKeyExchange message,
6570 * and is 48 bytes long
6571 */
6572 if( end - p < 2 )
6573 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6574
6575 *p++ = 0;
6576 *p++ = 48;
6577 p += 48;
6578 }
6579 else
6580#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
6581#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
6582 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
6583 {
6584 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6585 size_t len;
6586
6587 /* Write length only when we know the actual value */
6588 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
6589 p + 2, end - ( p + 2 ), &len,
6590 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
6591 {
6592 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
6593 return( ret );
6594 }
6595 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
6596 p += 2 + len;
6597
6598 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
6599 }
6600 else
6601#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Neil Armstrong80f6f322022-05-03 17:56:38 +02006602#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Jerry Yuce3dca42022-02-17 14:16:37 +08006603 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
6604 {
6605 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6606 size_t zlen;
6607
6608 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
6609 p + 2, end - ( p + 2 ),
6610 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
6611 {
6612 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
6613 return( ret );
6614 }
6615
6616 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
6617 p += 2 + zlen;
6618
6619 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
6620 MBEDTLS_DEBUG_ECDH_Z );
6621 }
6622 else
Neil Armstrong80f6f322022-05-03 17:56:38 +02006623#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Jerry Yuce3dca42022-02-17 14:16:37 +08006624 {
6625 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6626 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6627 }
6628
6629 /* opaque psk<0..2^16-1>; */
6630 if( end - p < 2 )
6631 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6632
6633 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
6634 p += 2;
6635
6636 if( end < p || (size_t)( end - p ) < psk_len )
6637 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6638
6639 memcpy( p, psk, psk_len );
6640 p += psk_len;
6641
6642 ssl->handshake->pmslen = p - ssl->handshake->premaster;
6643
6644 return( 0 );
6645}
Neil Armstrong80f6f322022-05-03 17:56:38 +02006646#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08006647
6648#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006649MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuc2c673d2022-02-17 14:20:39 +08006650static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
6651
6652#if defined(MBEDTLS_SSL_PROTO_DTLS)
6653int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
6654{
6655 /* If renegotiation is not enforced, retransmit until we would reach max
6656 * timeout if we were using the usual handshake doubling scheme */
6657 if( ssl->conf->renego_max_records < 0 )
6658 {
6659 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
6660 unsigned char doublings = 1;
6661
6662 while( ratio != 0 )
6663 {
6664 ++doublings;
6665 ratio >>= 1;
6666 }
6667
6668 if( ++ssl->renego_records_seen > doublings )
6669 {
6670 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
6671 return( 0 );
6672 }
6673 }
6674
6675 return( ssl_write_hello_request( ssl ) );
6676}
6677#endif
6678#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08006679
Jerry Yud9526692022-02-17 14:23:47 +08006680/*
6681 * Handshake functions
6682 */
6683#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6684/* No certificate support -> dummy functions */
6685int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
6686{
6687 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6688 ssl->handshake->ciphersuite_info;
6689
6690 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
6691
6692 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6693 {
6694 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6695 ssl->state++;
6696 return( 0 );
6697 }
6698
6699 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6700 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6701}
6702
6703int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6704{
6705 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6706 ssl->handshake->ciphersuite_info;
6707
6708 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6709
6710 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6711 {
6712 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6713 ssl->state++;
6714 return( 0 );
6715 }
6716
6717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6718 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6719}
6720
6721#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6722/* Some certificate support -> implement write and parse */
6723
6724int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
6725{
6726 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
6727 size_t i, n;
6728 const mbedtls_x509_crt *crt;
6729 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6730 ssl->handshake->ciphersuite_info;
6731
6732 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
6733
6734 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6735 {
6736 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6737 ssl->state++;
6738 return( 0 );
6739 }
6740
6741#if defined(MBEDTLS_SSL_CLI_C)
6742 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6743 {
6744 if( ssl->handshake->client_auth == 0 )
6745 {
6746 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6747 ssl->state++;
6748 return( 0 );
6749 }
6750 }
6751#endif /* MBEDTLS_SSL_CLI_C */
6752#if defined(MBEDTLS_SSL_SRV_C)
6753 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6754 {
6755 if( mbedtls_ssl_own_cert( ssl ) == NULL )
6756 {
6757 /* Should never happen because we shouldn't have picked the
6758 * ciphersuite if we don't have a certificate. */
6759 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6760 }
6761 }
6762#endif
6763
6764 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
6765
6766 /*
6767 * 0 . 0 handshake type
6768 * 1 . 3 handshake length
6769 * 4 . 6 length of all certs
6770 * 7 . 9 length of cert. 1
6771 * 10 . n-1 peer certificate
6772 * n . n+2 length of cert. 2
6773 * n+3 . ... upper level cert, etc.
6774 */
6775 i = 7;
6776 crt = mbedtls_ssl_own_cert( ssl );
6777
6778 while( crt != NULL )
6779 {
6780 n = crt->raw.len;
6781 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
6782 {
6783 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
6784 " > %" MBEDTLS_PRINTF_SIZET,
6785 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
6786 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
6787 }
6788
6789 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
6790 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
6791 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
6792
6793 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
6794 i += n; crt = crt->next;
6795 }
6796
6797 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
6798 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
6799 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
6800
6801 ssl->out_msglen = i;
6802 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6803 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
6804
6805 ssl->state++;
6806
6807 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
6808 {
6809 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
6810 return( ret );
6811 }
6812
6813 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
6814
6815 return( ret );
6816}
6817
6818#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6819
6820#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006821MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006822static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
6823 unsigned char *crt_buf,
6824 size_t crt_buf_len )
6825{
6826 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
6827
6828 if( peer_crt == NULL )
6829 return( -1 );
6830
6831 if( peer_crt->raw.len != crt_buf_len )
6832 return( -1 );
6833
6834 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
6835}
6836#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006837MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006838static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
6839 unsigned char *crt_buf,
6840 size_t crt_buf_len )
6841{
6842 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6843 unsigned char const * const peer_cert_digest =
6844 ssl->session->peer_cert_digest;
6845 mbedtls_md_type_t const peer_cert_digest_type =
6846 ssl->session->peer_cert_digest_type;
6847 mbedtls_md_info_t const * const digest_info =
6848 mbedtls_md_info_from_type( peer_cert_digest_type );
6849 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
6850 size_t digest_len;
6851
6852 if( peer_cert_digest == NULL || digest_info == NULL )
6853 return( -1 );
6854
6855 digest_len = mbedtls_md_get_size( digest_info );
6856 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
6857 return( -1 );
6858
6859 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
6860 if( ret != 0 )
6861 return( -1 );
6862
6863 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
6864}
6865#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6866#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6867
6868/*
6869 * Once the certificate message is read, parse it into a cert chain and
6870 * perform basic checks, but leave actual verification to the caller
6871 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006872MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006873static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
6874 mbedtls_x509_crt *chain )
6875{
6876 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6877#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6878 int crt_cnt=0;
6879#endif
6880 size_t i, n;
6881 uint8_t alert;
6882
6883 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
6884 {
6885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6886 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6887 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6888 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
6889 }
6890
6891 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
6892 {
6893 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6894 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6895 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
6896 }
6897
6898 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
6899 {
6900 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6901 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6902 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6903 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6904 }
6905
6906 i = mbedtls_ssl_hs_hdr_len( ssl );
6907
6908 /*
6909 * Same message structure as in mbedtls_ssl_write_certificate()
6910 */
6911 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
6912
6913 if( ssl->in_msg[i] != 0 ||
6914 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
6915 {
6916 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6917 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6918 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6919 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6920 }
6921
6922 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
6923 i += 3;
6924
6925 /* Iterate through and parse the CRTs in the provided chain. */
6926 while( i < ssl->in_hslen )
6927 {
6928 /* Check that there's room for the next CRT's length fields. */
6929 if ( i + 3 > ssl->in_hslen ) {
6930 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6931 mbedtls_ssl_send_alert_message( ssl,
6932 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6933 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6934 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6935 }
6936 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
6937 * anything beyond 2**16 ~ 64K. */
6938 if( ssl->in_msg[i] != 0 )
6939 {
6940 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6941 mbedtls_ssl_send_alert_message( ssl,
6942 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6943 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
6944 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
6945 }
6946
6947 /* Read length of the next CRT in the chain. */
6948 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
6949 | (unsigned int) ssl->in_msg[i + 2];
6950 i += 3;
6951
6952 if( n < 128 || i + n > ssl->in_hslen )
6953 {
6954 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6955 mbedtls_ssl_send_alert_message( ssl,
6956 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6957 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6958 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6959 }
6960
6961 /* Check if we're handling the first CRT in the chain. */
6962#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6963 if( crt_cnt++ == 0 &&
6964 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
6965 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
6966 {
6967 /* During client-side renegotiation, check that the server's
6968 * end-CRTs hasn't changed compared to the initial handshake,
6969 * mitigating the triple handshake attack. On success, reuse
6970 * the original end-CRT instead of parsing it again. */
6971 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
6972 if( ssl_check_peer_crt_unchanged( ssl,
6973 &ssl->in_msg[i],
6974 n ) != 0 )
6975 {
6976 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
6977 mbedtls_ssl_send_alert_message( ssl,
6978 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6979 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
6980 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
6981 }
6982
6983 /* Now we can safely free the original chain. */
6984 ssl_clear_peer_cert( ssl->session );
6985 }
6986#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6987
6988 /* Parse the next certificate in the chain. */
6989#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6990 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
6991#else
6992 /* If we don't need to store the CRT chain permanently, parse
6993 * it in-place from the input buffer instead of making a copy. */
6994 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
6995#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6996 switch( ret )
6997 {
6998 case 0: /*ok*/
6999 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7000 /* Ignore certificate with an unknown algorithm: maybe a
7001 prior certificate was already trusted. */
7002 break;
7003
7004 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7005 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7006 goto crt_parse_der_failed;
7007
7008 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7009 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7010 goto crt_parse_der_failed;
7011
7012 default:
7013 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7014 crt_parse_der_failed:
7015 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
7016 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
7017 return( ret );
7018 }
7019
7020 i += n;
7021 }
7022
7023 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
7024 return( 0 );
7025}
7026
7027#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007028MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08007029static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
7030{
7031 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7032 return( -1 );
7033
7034 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
7035 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7036 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
7037 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
7038 {
Ronald Cron19385882022-06-15 16:26:13 +02007039 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer has no certificate" ) );
Jerry Yud9526692022-02-17 14:23:47 +08007040 return( 0 );
7041 }
7042 return( -1 );
7043}
7044#endif /* MBEDTLS_SSL_SRV_C */
7045
7046/* Check if a certificate message is expected.
7047 * Return either
7048 * - SSL_CERTIFICATE_EXPECTED, or
7049 * - SSL_CERTIFICATE_SKIP
7050 * indicating whether a Certificate message is expected or not.
7051 */
7052#define SSL_CERTIFICATE_EXPECTED 0
7053#define SSL_CERTIFICATE_SKIP 1
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007054MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08007055static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
7056 int authmode )
7057{
7058 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7059 ssl->handshake->ciphersuite_info;
7060
7061 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
7062 return( SSL_CERTIFICATE_SKIP );
7063
7064#if defined(MBEDTLS_SSL_SRV_C)
7065 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7066 {
7067 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
7068 return( SSL_CERTIFICATE_SKIP );
7069
7070 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
7071 {
7072 ssl->session_negotiate->verify_result =
7073 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
7074 return( SSL_CERTIFICATE_SKIP );
7075 }
7076 }
7077#else
7078 ((void) authmode);
7079#endif /* MBEDTLS_SSL_SRV_C */
7080
7081 return( SSL_CERTIFICATE_EXPECTED );
7082}
7083
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007084MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08007085static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
7086 int authmode,
7087 mbedtls_x509_crt *chain,
7088 void *rs_ctx )
7089{
7090 int ret = 0;
7091 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7092 ssl->handshake->ciphersuite_info;
7093 int have_ca_chain = 0;
7094
7095 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
7096 void *p_vrfy;
7097
7098 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
7099 return( 0 );
7100
7101 if( ssl->f_vrfy != NULL )
7102 {
7103 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
7104 f_vrfy = ssl->f_vrfy;
7105 p_vrfy = ssl->p_vrfy;
7106 }
7107 else
7108 {
7109 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
7110 f_vrfy = ssl->conf->f_vrfy;
7111 p_vrfy = ssl->conf->p_vrfy;
7112 }
7113
7114 /*
7115 * Main check: verify certificate
7116 */
7117#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
7118 if( ssl->conf->f_ca_cb != NULL )
7119 {
7120 ((void) rs_ctx);
7121 have_ca_chain = 1;
7122
7123 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
7124 ret = mbedtls_x509_crt_verify_with_ca_cb(
7125 chain,
7126 ssl->conf->f_ca_cb,
7127 ssl->conf->p_ca_cb,
7128 ssl->conf->cert_profile,
7129 ssl->hostname,
7130 &ssl->session_negotiate->verify_result,
7131 f_vrfy, p_vrfy );
7132 }
7133 else
7134#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
7135 {
7136 mbedtls_x509_crt *ca_chain;
7137 mbedtls_x509_crl *ca_crl;
7138
7139#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7140 if( ssl->handshake->sni_ca_chain != NULL )
7141 {
7142 ca_chain = ssl->handshake->sni_ca_chain;
7143 ca_crl = ssl->handshake->sni_ca_crl;
7144 }
7145 else
7146#endif
7147 {
7148 ca_chain = ssl->conf->ca_chain;
7149 ca_crl = ssl->conf->ca_crl;
7150 }
7151
7152 if( ca_chain != NULL )
7153 have_ca_chain = 1;
7154
7155 ret = mbedtls_x509_crt_verify_restartable(
7156 chain,
7157 ca_chain, ca_crl,
7158 ssl->conf->cert_profile,
7159 ssl->hostname,
7160 &ssl->session_negotiate->verify_result,
7161 f_vrfy, p_vrfy, rs_ctx );
7162 }
7163
7164 if( ret != 0 )
7165 {
7166 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
7167 }
7168
7169#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
7170 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
7171 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
7172#endif
7173
7174 /*
7175 * Secondary checks: always done, but change 'ret' only if it was 0
7176 */
7177
7178#if defined(MBEDTLS_ECP_C)
7179 {
7180 const mbedtls_pk_context *pk = &chain->pk;
7181
Manuel Pégourié-Gonnard66b0d612022-06-17 10:49:29 +02007182 /* If certificate uses an EC key, make sure the curve is OK.
7183 * This is a public key, so it can't be opaque, so can_do() is a good
7184 * enough check to ensure pk_ec() is safe to use here. */
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007185 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) )
Jerry Yud9526692022-02-17 14:23:47 +08007186 {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007187 /* and in the unlikely case the above assumption no longer holds
7188 * we are making sure that pk_ec() here does not return a NULL
7189 */
7190 const mbedtls_ecp_keypair *ec = mbedtls_pk_ec( *pk );
7191 if( ec == NULL )
7192 {
Tom Cosgrove20c11372022-08-24 15:06:13 +01007193 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_pk_ec() returned NULL" ) );
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007194 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7195 }
Jerry Yud9526692022-02-17 14:23:47 +08007196
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007197 if( mbedtls_ssl_check_curve( ssl, ec->grp.id ) != 0 )
7198 {
7199 ssl->session_negotiate->verify_result |=
7200 MBEDTLS_X509_BADCERT_BAD_KEY;
7201
7202 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
7203 if( ret == 0 )
7204 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
7205 }
Jerry Yud9526692022-02-17 14:23:47 +08007206 }
7207 }
7208#endif /* MBEDTLS_ECP_C */
7209
7210 if( mbedtls_ssl_check_cert_usage( chain,
7211 ciphersuite_info,
7212 ! ssl->conf->endpoint,
7213 &ssl->session_negotiate->verify_result ) != 0 )
7214 {
7215 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
7216 if( ret == 0 )
7217 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
7218 }
7219
7220 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
7221 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
7222 * with details encoded in the verification flags. All other kinds
7223 * of error codes, including those from the user provided f_vrfy
7224 * functions, are treated as fatal and lead to a failure of
7225 * ssl_parse_certificate even if verification was optional. */
7226 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
7227 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7228 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
7229 {
7230 ret = 0;
7231 }
7232
7233 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
7234 {
7235 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
7236 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
7237 }
7238
7239 if( ret != 0 )
7240 {
7241 uint8_t alert;
7242
7243 /* The certificate may have been rejected for several reasons.
7244 Pick one and send the corresponding alert. Which alert to send
7245 may be a subject of debate in some cases. */
7246 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
7247 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
7248 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
7249 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7250 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
7251 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7252 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
7253 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7254 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
7255 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7256 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
7257 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7258 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
7259 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7260 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
7261 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
7262 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
7263 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
7264 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
7265 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
7266 else
7267 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
7268 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7269 alert );
7270 }
7271
7272#if defined(MBEDTLS_DEBUG_C)
7273 if( ssl->session_negotiate->verify_result != 0 )
7274 {
7275 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
7276 (unsigned int) ssl->session_negotiate->verify_result ) );
7277 }
7278 else
7279 {
7280 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
7281 }
7282#endif /* MBEDTLS_DEBUG_C */
7283
7284 return( ret );
7285}
7286
7287#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007288MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08007289static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
7290 unsigned char *start, size_t len )
7291{
7292 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7293 /* Remember digest of the peer's end-CRT. */
7294 ssl->session_negotiate->peer_cert_digest =
7295 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
7296 if( ssl->session_negotiate->peer_cert_digest == NULL )
7297 {
7298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
7299 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
7300 mbedtls_ssl_send_alert_message( ssl,
7301 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7302 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7303
7304 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7305 }
7306
7307 ret = mbedtls_md( mbedtls_md_info_from_type(
7308 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
7309 start, len,
7310 ssl->session_negotiate->peer_cert_digest );
7311
7312 ssl->session_negotiate->peer_cert_digest_type =
7313 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
7314 ssl->session_negotiate->peer_cert_digest_len =
7315 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
7316
7317 return( ret );
7318}
7319
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007320MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08007321static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
7322 unsigned char *start, size_t len )
7323{
7324 unsigned char *end = start + len;
7325 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7326
7327 /* Make a copy of the peer's raw public key. */
7328 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
7329 ret = mbedtls_pk_parse_subpubkey( &start, end,
7330 &ssl->handshake->peer_pubkey );
7331 if( ret != 0 )
7332 {
7333 /* We should have parsed the public key before. */
7334 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7335 }
7336
7337 return( 0 );
7338}
7339#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7340
7341int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
7342{
7343 int ret = 0;
7344 int crt_expected;
7345#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7346 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
7347 ? ssl->handshake->sni_authmode
7348 : ssl->conf->authmode;
7349#else
7350 const int authmode = ssl->conf->authmode;
7351#endif
7352 void *rs_ctx = NULL;
7353 mbedtls_x509_crt *chain = NULL;
7354
7355 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
7356
7357 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
7358 if( crt_expected == SSL_CERTIFICATE_SKIP )
7359 {
7360 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
7361 goto exit;
7362 }
7363
7364#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
7365 if( ssl->handshake->ecrs_enabled &&
7366 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
7367 {
7368 chain = ssl->handshake->ecrs_peer_cert;
7369 ssl->handshake->ecrs_peer_cert = NULL;
7370 goto crt_verify;
7371 }
7372#endif
7373
7374 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
7375 {
7376 /* mbedtls_ssl_read_record may have sent an alert already. We
7377 let it decide whether to alert. */
7378 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
7379 goto exit;
7380 }
7381
7382#if defined(MBEDTLS_SSL_SRV_C)
7383 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
7384 {
7385 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
7386
7387 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
7388 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
7389
7390 goto exit;
7391 }
7392#endif /* MBEDTLS_SSL_SRV_C */
7393
7394 /* Clear existing peer CRT structure in case we tried to
7395 * reuse a session but it failed, and allocate a new one. */
7396 ssl_clear_peer_cert( ssl->session_negotiate );
7397
7398 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
7399 if( chain == NULL )
7400 {
7401 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
7402 sizeof( mbedtls_x509_crt ) ) );
7403 mbedtls_ssl_send_alert_message( ssl,
7404 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7405 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7406
7407 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
7408 goto exit;
7409 }
7410 mbedtls_x509_crt_init( chain );
7411
7412 ret = ssl_parse_certificate_chain( ssl, chain );
7413 if( ret != 0 )
7414 goto exit;
7415
7416#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
7417 if( ssl->handshake->ecrs_enabled)
7418 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
7419
7420crt_verify:
7421 if( ssl->handshake->ecrs_enabled)
7422 rs_ctx = &ssl->handshake->ecrs_ctx;
7423#endif
7424
7425 ret = ssl_parse_certificate_verify( ssl, authmode,
7426 chain, rs_ctx );
7427 if( ret != 0 )
7428 goto exit;
7429
7430#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7431 {
7432 unsigned char *crt_start, *pk_start;
7433 size_t crt_len, pk_len;
7434
7435 /* We parse the CRT chain without copying, so
7436 * these pointers point into the input buffer,
7437 * and are hence still valid after freeing the
7438 * CRT chain. */
7439
7440 crt_start = chain->raw.p;
7441 crt_len = chain->raw.len;
7442
7443 pk_start = chain->pk_raw.p;
7444 pk_len = chain->pk_raw.len;
7445
7446 /* Free the CRT structures before computing
7447 * digest and copying the peer's public key. */
7448 mbedtls_x509_crt_free( chain );
7449 mbedtls_free( chain );
7450 chain = NULL;
7451
7452 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
7453 if( ret != 0 )
7454 goto exit;
7455
7456 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
7457 if( ret != 0 )
7458 goto exit;
7459 }
7460#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7461 /* Pass ownership to session structure. */
7462 ssl->session_negotiate->peer_cert = chain;
7463 chain = NULL;
7464#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7465
7466 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
7467
7468exit:
7469
7470 if( ret == 0 )
7471 ssl->state++;
7472
7473#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
7474 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
7475 {
7476 ssl->handshake->ecrs_peer_cert = chain;
7477 chain = NULL;
7478 }
7479#endif
7480
7481 if( chain != NULL )
7482 {
7483 mbedtls_x509_crt_free( chain );
7484 mbedtls_free( chain );
7485 }
7486
7487 return( ret );
7488}
7489#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7490
Andrzej Kurek25f27152022-08-17 16:09:31 -04007491#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu615bd6f2022-02-17 14:25:15 +08007492static void ssl_calc_finished_tls_sha256(
7493 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
7494{
7495 int len = 12;
7496 const char *sender;
7497 unsigned char padbuf[32];
7498#if defined(MBEDTLS_USE_PSA_CRYPTO)
7499 size_t hash_size;
7500 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
7501 psa_status_t status;
7502#else
7503 mbedtls_sha256_context sha256;
7504#endif
7505
7506 mbedtls_ssl_session *session = ssl->session_negotiate;
7507 if( !session )
7508 session = ssl->session;
7509
7510 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
7511 ? "client finished"
7512 : "server finished";
7513
7514#if defined(MBEDTLS_USE_PSA_CRYPTO)
7515 sha256_psa = psa_hash_operation_init();
7516
7517 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
7518
7519 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
7520 if( status != PSA_SUCCESS )
7521 {
7522 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
7523 return;
7524 }
7525
7526 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
7527 if( status != PSA_SUCCESS )
7528 {
7529 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
7530 return;
7531 }
7532 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
7533#else
7534
7535 mbedtls_sha256_init( &sha256 );
7536
7537 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
7538
7539 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
7540
7541 /*
7542 * TLSv1.2:
7543 * hash = PRF( master, finished_label,
7544 * Hash( handshake ) )[0.11]
7545 */
7546
7547#if !defined(MBEDTLS_SHA256_ALT)
7548 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
7549 sha256.state, sizeof( sha256.state ) );
7550#endif
7551
7552 mbedtls_sha256_finish( &sha256, padbuf );
7553 mbedtls_sha256_free( &sha256 );
7554#endif /* MBEDTLS_USE_PSA_CRYPTO */
7555
7556 ssl->handshake->tls_prf( session->master, 48, sender,
7557 padbuf, 32, buf, len );
7558
7559 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
7560
7561 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
7562
7563 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
7564}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04007565#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu615bd6f2022-02-17 14:25:15 +08007566
Jerry Yub7ba49e2022-02-17 14:25:53 +08007567
Andrzej Kurek25f27152022-08-17 16:09:31 -04007568#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yub7ba49e2022-02-17 14:25:53 +08007569static void ssl_calc_finished_tls_sha384(
7570 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
7571{
7572 int len = 12;
7573 const char *sender;
7574 unsigned char padbuf[48];
7575#if defined(MBEDTLS_USE_PSA_CRYPTO)
7576 size_t hash_size;
7577 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
7578 psa_status_t status;
7579#else
7580 mbedtls_sha512_context sha512;
7581#endif
7582
7583 mbedtls_ssl_session *session = ssl->session_negotiate;
7584 if( !session )
7585 session = ssl->session;
7586
7587 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
7588 ? "client finished"
7589 : "server finished";
7590
7591#if defined(MBEDTLS_USE_PSA_CRYPTO)
7592 sha384_psa = psa_hash_operation_init();
7593
7594 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
7595
7596 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
7597 if( status != PSA_SUCCESS )
7598 {
7599 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
7600 return;
7601 }
7602
7603 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
7604 if( status != PSA_SUCCESS )
7605 {
7606 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
7607 return;
7608 }
7609 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
7610#else
7611 mbedtls_sha512_init( &sha512 );
7612
7613 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
7614
Andrzej Kureka242e832022-08-11 10:03:14 -04007615 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
Jerry Yub7ba49e2022-02-17 14:25:53 +08007616
7617 /*
7618 * TLSv1.2:
7619 * hash = PRF( master, finished_label,
7620 * Hash( handshake ) )[0.11]
7621 */
7622
7623#if !defined(MBEDTLS_SHA512_ALT)
7624 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
7625 sha512.state, sizeof( sha512.state ) );
7626#endif
7627 mbedtls_sha512_finish( &sha512, padbuf );
7628
7629 mbedtls_sha512_free( &sha512 );
7630#endif
7631
7632 ssl->handshake->tls_prf( session->master, 48, sender,
7633 padbuf, 48, buf, len );
7634
7635 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
7636
7637 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
7638
7639 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
7640}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04007641#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yub7ba49e2022-02-17 14:25:53 +08007642
Jerry Yuaef00152022-02-17 14:27:31 +08007643void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
7644{
7645 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
7646
7647 /*
7648 * Free our handshake params
7649 */
7650 mbedtls_ssl_handshake_free( ssl );
7651 mbedtls_free( ssl->handshake );
7652 ssl->handshake = NULL;
7653
7654 /*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08007655 * Free the previous transform and switch in the current one
Jerry Yuaef00152022-02-17 14:27:31 +08007656 */
7657 if( ssl->transform )
7658 {
7659 mbedtls_ssl_transform_free( ssl->transform );
7660 mbedtls_free( ssl->transform );
7661 }
7662 ssl->transform = ssl->transform_negotiate;
7663 ssl->transform_negotiate = NULL;
7664
7665 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
7666}
7667
Jerry Yu2a9fff52022-02-17 14:28:51 +08007668void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
7669{
7670 int resume = ssl->handshake->resume;
7671
7672 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
7673
7674#if defined(MBEDTLS_SSL_RENEGOTIATION)
7675 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
7676 {
7677 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
7678 ssl->renego_records_seen = 0;
7679 }
7680#endif
7681
7682 /*
7683 * Free the previous session and switch in the current one
7684 */
7685 if( ssl->session )
7686 {
7687#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7688 /* RFC 7366 3.1: keep the EtM state */
7689 ssl->session_negotiate->encrypt_then_mac =
7690 ssl->session->encrypt_then_mac;
7691#endif
7692
7693 mbedtls_ssl_session_free( ssl->session );
7694 mbedtls_free( ssl->session );
7695 }
7696 ssl->session = ssl->session_negotiate;
7697 ssl->session_negotiate = NULL;
7698
7699 /*
7700 * Add cache entry
7701 */
7702 if( ssl->conf->f_set_cache != NULL &&
7703 ssl->session->id_len != 0 &&
7704 resume == 0 )
7705 {
7706 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
7707 ssl->session->id,
7708 ssl->session->id_len,
7709 ssl->session ) != 0 )
7710 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
7711 }
7712
7713#if defined(MBEDTLS_SSL_PROTO_DTLS)
7714 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7715 ssl->handshake->flight != NULL )
7716 {
7717 /* Cancel handshake timer */
7718 mbedtls_ssl_set_timer( ssl, 0 );
7719
7720 /* Keep last flight around in case we need to resend it:
7721 * we need the handshake and transform structures for that */
7722 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
7723 }
7724 else
7725#endif
7726 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
7727
Jerry Yu5ed73ff2022-10-27 13:08:42 +08007728 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Jerry Yu2a9fff52022-02-17 14:28:51 +08007729
7730 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
7731}
7732
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007733int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
7734{
7735 int ret, hash_len;
7736
7737 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
7738
7739 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
7740
7741 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
7742
7743 /*
7744 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
7745 * may define some other value. Currently (early 2016), no defined
7746 * ciphersuite does this (and this is unlikely to change as activity has
7747 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
7748 */
7749 hash_len = 12;
7750
7751#if defined(MBEDTLS_SSL_RENEGOTIATION)
7752 ssl->verify_data_len = hash_len;
7753 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
7754#endif
7755
7756 ssl->out_msglen = 4 + hash_len;
7757 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7758 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
7759
7760 /*
7761 * In case of session resuming, invert the client and server
7762 * ChangeCipherSpec messages order.
7763 */
7764 if( ssl->handshake->resume != 0 )
7765 {
7766#if defined(MBEDTLS_SSL_CLI_C)
7767 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7768 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
7769#endif
7770#if defined(MBEDTLS_SSL_SRV_C)
7771 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7772 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
7773#endif
7774 }
7775 else
7776 ssl->state++;
7777
7778 /*
7779 * Switch to our negotiated transform and session parameters for outbound
7780 * data.
7781 */
7782 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
7783
7784#if defined(MBEDTLS_SSL_PROTO_DTLS)
7785 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7786 {
7787 unsigned char i;
7788
7789 /* Remember current epoch settings for resending */
7790 ssl->handshake->alt_transform_out = ssl->transform_out;
7791 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
7792 sizeof( ssl->handshake->alt_out_ctr ) );
7793
7794 /* Set sequence_number to zero */
7795 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
7796
7797
7798 /* Increment epoch */
7799 for( i = 2; i > 0; i-- )
7800 if( ++ssl->cur_out_ctr[i - 1] != 0 )
7801 break;
7802
7803 /* The loop goes to its end iff the counter is wrapping */
7804 if( i == 0 )
7805 {
7806 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
7807 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
7808 }
7809 }
7810 else
7811#endif /* MBEDTLS_SSL_PROTO_DTLS */
7812 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
7813
7814 ssl->transform_out = ssl->transform_negotiate;
7815 ssl->session_out = ssl->session_negotiate;
7816
7817#if defined(MBEDTLS_SSL_PROTO_DTLS)
7818 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7819 mbedtls_ssl_send_flight_completed( ssl );
7820#endif
7821
7822 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
7823 {
7824 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
7825 return( ret );
7826 }
7827
7828#if defined(MBEDTLS_SSL_PROTO_DTLS)
7829 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7830 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
7831 {
7832 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
7833 return( ret );
7834 }
7835#endif
7836
7837 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
7838
7839 return( 0 );
7840}
7841
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007842#define SSL_MAX_HASH_LEN 12
7843
7844int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
7845{
7846 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7847 unsigned int hash_len = 12;
7848 unsigned char buf[SSL_MAX_HASH_LEN];
7849
7850 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
7851
7852 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
7853
7854 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
7855 {
7856 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
7857 goto exit;
7858 }
7859
7860 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
7861 {
7862 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7863 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7864 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
7865 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
7866 goto exit;
7867 }
7868
7869 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
7870 {
7871 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7872 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
7873 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
7874 goto exit;
7875 }
7876
7877 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
7878 {
7879 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7880 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7881 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
7882 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
7883 goto exit;
7884 }
7885
7886 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
7887 buf, hash_len ) != 0 )
7888 {
7889 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7890 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7891 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
7892 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
7893 goto exit;
7894 }
7895
7896#if defined(MBEDTLS_SSL_RENEGOTIATION)
7897 ssl->verify_data_len = hash_len;
7898 memcpy( ssl->peer_verify_data, buf, hash_len );
7899#endif
7900
7901 if( ssl->handshake->resume != 0 )
7902 {
7903#if defined(MBEDTLS_SSL_CLI_C)
7904 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7905 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
7906#endif
7907#if defined(MBEDTLS_SSL_SRV_C)
7908 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7909 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
7910#endif
7911 }
7912 else
7913 ssl->state++;
7914
7915#if defined(MBEDTLS_SSL_PROTO_DTLS)
7916 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7917 mbedtls_ssl_recv_flight_completed( ssl );
7918#endif
7919
7920 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
7921
7922exit:
7923 mbedtls_platform_zeroize( buf, hash_len );
7924 return( ret );
7925}
7926
Jerry Yu392112c2022-02-17 14:34:10 +08007927#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
7928/*
7929 * Helper to get TLS 1.2 PRF from ciphersuite
7930 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
7931 */
7932static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
7933{
Jerry Yu392112c2022-02-17 14:34:10 +08007934 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
Andrzej Kurek68327742022-10-03 06:18:18 -04007935 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
7936#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Leonid Rozenboime9d8dcd2022-08-08 15:57:48 -07007937 if( ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Jerry Yu392112c2022-02-17 14:34:10 +08007938 return( tls_prf_sha384 );
Andrzej Kurek894edde2022-09-29 06:31:14 -04007939 else
Jerry Yu392112c2022-02-17 14:34:10 +08007940#endif
Andrzej Kurek894edde2022-09-29 06:31:14 -04007941#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
7942 {
7943 if( ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA256 )
7944 return( tls_prf_sha256 );
7945 }
7946#endif
7947#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
7948 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
7949 (void) ciphersuite_info;
7950#endif
Andrzej Kurekeabeb302022-10-17 07:52:51 -04007951
Andrzej Kurek894edde2022-09-29 06:31:14 -04007952 return( NULL );
Jerry Yu392112c2022-02-17 14:34:10 +08007953}
7954#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08007955
7956static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
7957{
7958 ((void) tls_prf);
Andrzej Kurek25f27152022-08-17 16:09:31 -04007959#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yue93ffcd2022-02-17 14:37:06 +08007960 if( tls_prf == tls_prf_sha384 )
7961 {
7962 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
7963 }
7964 else
7965#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04007966#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yue93ffcd2022-02-17 14:37:06 +08007967 if( tls_prf == tls_prf_sha256 )
7968 {
7969 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
7970 }
7971 else
7972#endif
7973 return( MBEDTLS_SSL_TLS_PRF_NONE );
7974}
7975
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007976/*
7977 * Populate a transform structure with session keys and all the other
7978 * necessary information.
7979 *
7980 * Parameters:
7981 * - [in/out]: transform: structure to populate
7982 * [in] must be just initialised with mbedtls_ssl_transform_init()
7983 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
7984 * - [in] ciphersuite
7985 * - [in] master
7986 * - [in] encrypt_then_mac
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007987 * - [in] tls_prf: pointer to PRF to use for key derivation
7988 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Glenn Strauss07c64162022-03-14 12:34:51 -04007989 * - [in] tls_version: TLS version
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007990 * - [in] endpoint: client or server
7991 * - [in] ssl: used for:
7992 * - ssl->conf->{f,p}_export_keys
7993 * [in] optionally used for:
7994 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
7995 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007996MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007997static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
7998 int ciphersuite,
7999 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008000#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008001 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008002#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008003 ssl_tls_prf_t tls_prf,
8004 const unsigned char randbytes[64],
Glenn Strauss07c64162022-03-14 12:34:51 -04008005 mbedtls_ssl_protocol_version tls_version,
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008006 unsigned endpoint,
8007 const mbedtls_ssl_context *ssl )
8008{
8009 int ret = 0;
8010 unsigned char keyblk[256];
8011 unsigned char *key1;
8012 unsigned char *key2;
8013 unsigned char *mac_enc;
8014 unsigned char *mac_dec;
8015 size_t mac_key_len = 0;
8016 size_t iv_copy_len;
8017 size_t keylen;
8018 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008019 mbedtls_ssl_mode_t ssl_mode;
Neil Armstronge4512952022-03-08 09:08:22 +01008020#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008021 const mbedtls_cipher_info_t *cipher_info;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008022 const mbedtls_md_info_t *md_info;
Neil Armstronge4512952022-03-08 09:08:22 +01008023#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008024
8025#if defined(MBEDTLS_USE_PSA_CRYPTO)
8026 psa_key_type_t key_type;
8027 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
8028 psa_algorithm_t alg;
Neil Armstronge4512952022-03-08 09:08:22 +01008029 psa_algorithm_t mac_alg = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008030 size_t key_bits;
8031 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
8032#endif
8033
8034#if !defined(MBEDTLS_DEBUG_C) && \
8035 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
8036 if( ssl->f_export_keys == NULL )
8037 {
8038 ssl = NULL; /* make sure we don't use it except for these cases */
8039 (void) ssl;
8040 }
8041#endif
8042
8043 /*
8044 * Some data just needs copying into the structure
8045 */
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008046#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008047 transform->encrypt_then_mac = encrypt_then_mac;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008048#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Glenn Strauss07c64162022-03-14 12:34:51 -04008049 transform->tls_version = tls_version;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008050
8051#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
8052 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
8053#endif
8054
8055#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Glenn Strauss07c64162022-03-14 12:34:51 -04008056 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008057 {
8058 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
8059 * generation separate. This should never happen. */
8060 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
8061 }
8062#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
8063
8064 /*
8065 * Get various info structures
8066 */
8067 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
8068 if( ciphersuite_info == NULL )
8069 {
8070 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
8071 ciphersuite ) );
8072 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8073 }
8074
Neil Armstrongab555e02022-04-04 11:07:59 +02008075 ssl_mode = mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008076#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008077 encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008078#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008079 ciphersuite_info );
8080
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008081 if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
8082 transform->taglen =
8083 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
8084
8085#if defined(MBEDTLS_USE_PSA_CRYPTO)
8086 if( ( status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher,
8087 transform->taglen,
8088 &alg,
8089 &key_type,
8090 &key_bits ) ) != PSA_SUCCESS )
8091 {
8092 ret = psa_ssl_status_to_mbedtls( status );
8093 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", ret );
8094 goto end;
8095 }
8096#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008097 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
8098 if( cipher_info == NULL )
8099 {
8100 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
8101 ciphersuite_info->cipher ) );
8102 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8103 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008104#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008105
Neil Armstronge4512952022-03-08 09:08:22 +01008106#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02008107 mac_alg = mbedtls_hash_info_psa_from_md( ciphersuite_info->mac );
Neil Armstronge4512952022-03-08 09:08:22 +01008108 if( mac_alg == 0 )
8109 {
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02008110 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_hash_info_psa_from_md for %u not found",
Neil Armstronge4512952022-03-08 09:08:22 +01008111 (unsigned) ciphersuite_info->mac ) );
8112 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8113 }
8114#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008115 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
8116 if( md_info == NULL )
8117 {
8118 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
8119 (unsigned) ciphersuite_info->mac ) );
8120 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8121 }
Neil Armstronge4512952022-03-08 09:08:22 +01008122#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008123
8124#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
8125 /* Copy own and peer's CID if the use of the CID
8126 * extension has been negotiated. */
8127 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
8128 {
8129 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
8130
8131 transform->in_cid_len = ssl->own_cid_len;
8132 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
8133 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
8134 transform->in_cid_len );
8135
8136 transform->out_cid_len = ssl->handshake->peer_cid_len;
8137 memcpy( transform->out_cid, ssl->handshake->peer_cid,
8138 ssl->handshake->peer_cid_len );
8139 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
8140 transform->out_cid_len );
8141 }
8142#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
8143
8144 /*
8145 * Compute key block using the PRF
8146 */
8147 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
8148 if( ret != 0 )
8149 {
8150 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
8151 return( ret );
8152 }
8153
8154 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
8155 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
8156 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
8157 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
8158 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
8159
8160 /*
8161 * Determine the appropriate key, IV and MAC length.
8162 */
8163
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008164#if defined(MBEDTLS_USE_PSA_CRYPTO)
8165 keylen = PSA_BITS_TO_BYTES(key_bits);
8166#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008167 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008168#endif
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008169
8170#if defined(MBEDTLS_GCM_C) || \
8171 defined(MBEDTLS_CCM_C) || \
8172 defined(MBEDTLS_CHACHAPOLY_C)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008173 if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008174 {
8175 size_t explicit_ivlen;
8176
8177 transform->maclen = 0;
8178 mac_key_len = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008179
8180 /* All modes haves 96-bit IVs, but the length of the static parts vary
8181 * with mode and version:
8182 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
8183 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
8184 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
8185 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
8186 * sequence number).
8187 */
8188 transform->ivlen = 12;
David Horstmann3b2276a2022-10-06 14:49:08 +01008189
8190 int is_chachapoly = 0;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008191#if defined(MBEDTLS_USE_PSA_CRYPTO)
David Horstmann3b2276a2022-10-06 14:49:08 +01008192 is_chachapoly = ( key_type == PSA_KEY_TYPE_CHACHA20 );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008193#else
David Horstmann3b2276a2022-10-06 14:49:08 +01008194 is_chachapoly = ( mbedtls_cipher_info_get_mode( cipher_info )
8195 == MBEDTLS_MODE_CHACHAPOLY );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008196#endif /* MBEDTLS_USE_PSA_CRYPTO */
David Horstmann3b2276a2022-10-06 14:49:08 +01008197
8198 if( is_chachapoly )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008199 transform->fixed_ivlen = 12;
8200 else
8201 transform->fixed_ivlen = 4;
8202
8203 /* Minimum length of encrypted record */
8204 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
8205 transform->minlen = explicit_ivlen + transform->taglen;
8206 }
8207 else
8208#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
8209#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008210 if( ssl_mode == MBEDTLS_SSL_MODE_STREAM ||
8211 ssl_mode == MBEDTLS_SSL_MODE_CBC ||
8212 ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008213 {
Neil Armstronge4512952022-03-08 09:08:22 +01008214#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstrongd1be7672022-04-04 11:21:41 +02008215 size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008216#else
8217 size_t block_size = cipher_info->block_size;
8218#endif /* MBEDTLS_USE_PSA_CRYPTO */
8219
8220#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01008221 /* Get MAC length */
8222 mac_key_len = PSA_HASH_LENGTH(mac_alg);
8223#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008224 /* Initialize HMAC contexts */
8225 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
8226 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
8227 {
8228 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
8229 goto end;
8230 }
8231
8232 /* Get MAC length */
8233 mac_key_len = mbedtls_md_get_size( md_info );
Neil Armstronge4512952022-03-08 09:08:22 +01008234#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008235 transform->maclen = mac_key_len;
8236
8237 /* IV length */
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008238#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstrong2230e6c2022-04-27 10:36:14 +02008239 transform->ivlen = PSA_CIPHER_IV_LENGTH( key_type, alg );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008240#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008241 transform->ivlen = cipher_info->iv_size;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008242#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008243
8244 /* Minimum length */
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008245 if( ssl_mode == MBEDTLS_SSL_MODE_STREAM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008246 transform->minlen = transform->maclen;
8247 else
8248 {
8249 /*
8250 * GenericBlockCipher:
8251 * 1. if EtM is in use: one block plus MAC
8252 * otherwise: * first multiple of blocklen greater than maclen
8253 * 2. IV
8254 */
8255#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008256 if( ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008257 {
8258 transform->minlen = transform->maclen
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008259 + block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008260 }
8261 else
8262#endif
8263 {
8264 transform->minlen = transform->maclen
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008265 + block_size
8266 - transform->maclen % block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008267 }
8268
Glenn Strauss07c64162022-03-14 12:34:51 -04008269 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008270 {
8271 transform->minlen += transform->ivlen;
8272 }
8273 else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008274 {
8275 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
8276 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8277 goto end;
8278 }
8279 }
8280 }
8281 else
8282#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
8283 {
8284 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
8285 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
8286 }
8287
8288 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
8289 (unsigned) keylen,
8290 (unsigned) transform->minlen,
8291 (unsigned) transform->ivlen,
8292 (unsigned) transform->maclen ) );
8293
8294 /*
8295 * Finally setup the cipher contexts, IVs and MAC secrets.
8296 */
8297#if defined(MBEDTLS_SSL_CLI_C)
8298 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
8299 {
8300 key1 = keyblk + mac_key_len * 2;
8301 key2 = keyblk + mac_key_len * 2 + keylen;
8302
8303 mac_enc = keyblk;
8304 mac_dec = keyblk + mac_key_len;
8305
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008306 iv_copy_len = ( transform->fixed_ivlen ) ?
8307 transform->fixed_ivlen : transform->ivlen;
8308 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
8309 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
8310 iv_copy_len );
8311 }
8312 else
8313#endif /* MBEDTLS_SSL_CLI_C */
8314#if defined(MBEDTLS_SSL_SRV_C)
8315 if( endpoint == MBEDTLS_SSL_IS_SERVER )
8316 {
8317 key1 = keyblk + mac_key_len * 2 + keylen;
8318 key2 = keyblk + mac_key_len * 2;
8319
8320 mac_enc = keyblk + mac_key_len;
8321 mac_dec = keyblk;
8322
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008323 iv_copy_len = ( transform->fixed_ivlen ) ?
8324 transform->fixed_ivlen : transform->ivlen;
8325 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
8326 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
8327 iv_copy_len );
8328 }
8329 else
8330#endif /* MBEDTLS_SSL_SRV_C */
8331 {
8332 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
8333 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8334 goto end;
8335 }
8336
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008337 if( ssl != NULL && ssl->f_export_keys != NULL )
8338 {
8339 ssl->f_export_keys( ssl->p_export_keys,
8340 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
8341 master, 48,
8342 randbytes + 32,
8343 randbytes,
8344 tls_prf_get_type( tls_prf ) );
8345 }
8346
8347#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008348 transform->psa_alg = alg;
8349
8350 if ( alg != MBEDTLS_SSL_NULL_CIPHER )
8351 {
8352 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
8353 psa_set_key_algorithm( &attributes, alg );
8354 psa_set_key_type( &attributes, key_type );
8355
8356 if( ( status = psa_import_key( &attributes,
8357 key1,
8358 PSA_BITS_TO_BYTES( key_bits ),
8359 &transform->psa_key_enc ) ) != PSA_SUCCESS )
8360 {
8361 MBEDTLS_SSL_DEBUG_RET( 3, "psa_import_key", (int)status );
8362 ret = psa_ssl_status_to_mbedtls( status );
8363 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
8364 goto end;
8365 }
8366
8367 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
8368
8369 if( ( status = psa_import_key( &attributes,
8370 key2,
8371 PSA_BITS_TO_BYTES( key_bits ),
8372 &transform->psa_key_dec ) ) != PSA_SUCCESS )
8373 {
8374 ret = psa_ssl_status_to_mbedtls( status );
8375 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
8376 goto end;
8377 }
8378 }
8379#else
8380 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
8381 cipher_info ) ) != 0 )
8382 {
8383 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
8384 goto end;
8385 }
8386
8387 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
8388 cipher_info ) ) != 0 )
8389 {
8390 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
8391 goto end;
8392 }
8393
8394 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
8395 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
8396 MBEDTLS_ENCRYPT ) ) != 0 )
8397 {
8398 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
8399 goto end;
8400 }
8401
8402 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
8403 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
8404 MBEDTLS_DECRYPT ) ) != 0 )
8405 {
8406 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
8407 goto end;
8408 }
8409
8410#if defined(MBEDTLS_CIPHER_MODE_CBC)
8411 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
8412 {
8413 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
8414 MBEDTLS_PADDING_NONE ) ) != 0 )
8415 {
8416 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
8417 goto end;
8418 }
8419
8420 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
8421 MBEDTLS_PADDING_NONE ) ) != 0 )
8422 {
8423 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
8424 goto end;
8425 }
8426 }
8427#endif /* MBEDTLS_CIPHER_MODE_CBC */
8428#endif /* MBEDTLS_USE_PSA_CRYPTO */
8429
Neil Armstrong29c0c042022-03-17 17:47:28 +01008430#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
8431 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
8432 For AEAD-based ciphersuites, there is nothing to do here. */
8433 if( mac_key_len != 0 )
8434 {
8435#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01008436 transform->psa_mac_alg = PSA_ALG_HMAC( mac_alg );
Neil Armstrong29c0c042022-03-17 17:47:28 +01008437
8438 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
Neil Armstronge4512952022-03-08 09:08:22 +01008439 psa_set_key_algorithm( &attributes, PSA_ALG_HMAC( mac_alg ) );
Neil Armstrong29c0c042022-03-17 17:47:28 +01008440 psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
8441
8442 if( ( status = psa_import_key( &attributes,
8443 mac_enc, mac_key_len,
8444 &transform->psa_mac_enc ) ) != PSA_SUCCESS )
8445 {
8446 ret = psa_ssl_status_to_mbedtls( status );
8447 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
8448 goto end;
8449 }
8450
Ronald Cronfb39f152022-03-25 14:36:28 +01008451 if( ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ) ||
Andrzej Kurek8c95ac42022-08-17 16:17:00 -04008452 ( ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING )
8453#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
8454 && ( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED )
8455#endif
8456 ) )
Neil Armstrong29c0c042022-03-17 17:47:28 +01008457 /* mbedtls_ct_hmac() requires the key to be exportable */
8458 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT |
8459 PSA_KEY_USAGE_VERIFY_HASH );
8460 else
8461 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
8462
8463 if( ( status = psa_import_key( &attributes,
8464 mac_dec, mac_key_len,
8465 &transform->psa_mac_dec ) ) != PSA_SUCCESS )
8466 {
8467 ret = psa_ssl_status_to_mbedtls( status );
8468 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
8469 goto end;
8470 }
8471#else
8472 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
8473 if( ret != 0 )
8474 goto end;
8475 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
8476 if( ret != 0 )
8477 goto end;
8478#endif /* MBEDTLS_USE_PSA_CRYPTO */
8479 }
8480#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
8481
8482 ((void) mac_dec);
8483 ((void) mac_enc);
8484
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008485end:
8486 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
8487 return( ret );
8488}
8489
Valerio Settia08b1a42022-11-17 15:10:02 +01008490#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
8491 defined(MBEDTLS_USE_PSA_CRYPTO)
Valerio Setti6b3dab02022-11-17 17:14:54 +01008492int mbedtls_psa_ecjpake_read_round(
Valerio Settia08b1a42022-11-17 15:10:02 +01008493 psa_pake_operation_t *pake_ctx,
8494 const unsigned char *buf,
Valerio Setti6b3dab02022-11-17 17:14:54 +01008495 size_t len, mbedtls_ecjpake_rounds_t round )
Valerio Settia08b1a42022-11-17 15:10:02 +01008496{
8497 psa_status_t status;
8498 size_t input_offset = 0;
Valerio Setti819de862022-11-17 18:05:19 +01008499 /*
Valerio Setti6b3dab02022-11-17 17:14:54 +01008500 * At round one repeat the KEY_SHARE, ZK_PUBLIC & ZF_PROOF twice
8501 * At round two perform a single cycle
8502 */
8503 unsigned int remaining_steps = ( round == MBEDTLS_ECJPAKE_ROUND_ONE) ? 2 : 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008504
Valerio Setti6b3dab02022-11-17 17:14:54 +01008505 for( ; remaining_steps > 0; remaining_steps-- )
Valerio Settia08b1a42022-11-17 15:10:02 +01008506 {
8507 for( psa_pake_step_t step = PSA_PAKE_STEP_KEY_SHARE;
8508 step <= PSA_PAKE_STEP_ZK_PROOF;
8509 ++step )
8510 {
8511 /* Length is stored at the first byte */
8512 size_t length = buf[input_offset];
8513 input_offset += 1;
8514
8515 if( input_offset + length > len )
8516 {
8517 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
8518 }
8519
8520 status = psa_pake_input( pake_ctx, step,
8521 buf + input_offset, length );
8522 if( status != PSA_SUCCESS)
8523 {
8524 return psa_ssl_status_to_mbedtls( status );
8525 }
8526
8527 input_offset += length;
8528 }
8529 }
8530
Valerio Setti819de862022-11-17 18:05:19 +01008531 if( input_offset != len )
Valerio Setti61ea17d2022-11-18 12:11:00 +01008532 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Valerio Setti30ebe112022-11-17 16:23:34 +01008533
Valerio Settia08b1a42022-11-17 15:10:02 +01008534 return( 0 );
8535}
8536
Valerio Setti6b3dab02022-11-17 17:14:54 +01008537int mbedtls_psa_ecjpake_write_round(
Valerio Settia08b1a42022-11-17 15:10:02 +01008538 psa_pake_operation_t *pake_ctx,
8539 unsigned char *buf,
Valerio Setti6b3dab02022-11-17 17:14:54 +01008540 size_t len, size_t *olen,
8541 mbedtls_ecjpake_rounds_t round )
Valerio Settia08b1a42022-11-17 15:10:02 +01008542{
8543 psa_status_t status;
8544 size_t output_offset = 0;
8545 size_t output_len;
Valerio Setti819de862022-11-17 18:05:19 +01008546 /*
Valerio Setti6b3dab02022-11-17 17:14:54 +01008547 * At round one repeat the KEY_SHARE, ZK_PUBLIC & ZF_PROOF twice
8548 * At round two perform a single cycle
8549 */
8550 unsigned int remaining_steps = ( round == MBEDTLS_ECJPAKE_ROUND_ONE) ? 2 : 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008551
Valerio Setti6b3dab02022-11-17 17:14:54 +01008552 for( ; remaining_steps > 0; remaining_steps-- )
Valerio Settia08b1a42022-11-17 15:10:02 +01008553 {
Valerio Setti6b3dab02022-11-17 17:14:54 +01008554 for( psa_pake_step_t step = PSA_PAKE_STEP_KEY_SHARE;
8555 step <= PSA_PAKE_STEP_ZK_PROOF;
Valerio Settia08b1a42022-11-17 15:10:02 +01008556 ++step )
8557 {
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008558 /*
Valerio Settid4a9b1a2022-11-22 11:11:10 +01008559 * For each step, prepend 1 byte with the length of the data as
8560 * given by psa_pake_output().
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008561 */
Valerio Settia08b1a42022-11-17 15:10:02 +01008562 status = psa_pake_output( pake_ctx, step,
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008563 buf + output_offset + 1,
8564 len - output_offset - 1,
Valerio Settia08b1a42022-11-17 15:10:02 +01008565 &output_len );
8566 if( status != PSA_SUCCESS )
8567 {
8568 return( psa_ssl_status_to_mbedtls( status ) );
8569 }
8570
Valerio Setti99d88c12022-11-22 16:03:43 +01008571 *(buf + output_offset) = (uint8_t) output_len;
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008572
8573 output_offset += output_len + 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008574 }
8575 }
8576
8577 *olen = output_offset;
8578
8579 return( 0 );
8580}
Valerio Settia08b1a42022-11-17 15:10:02 +01008581#endif //MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED && MBEDTLS_USE_PSA_CRYPTO
8582
Jerry Yuee40f9d2022-02-17 14:55:16 +08008583#if defined(MBEDTLS_USE_PSA_CRYPTO)
8584int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
8585 unsigned char *hash, size_t *hashlen,
8586 unsigned char *data, size_t data_len,
8587 mbedtls_md_type_t md_alg )
8588{
8589 psa_status_t status;
8590 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02008591 psa_algorithm_t hash_alg = mbedtls_hash_info_psa_from_md( md_alg );
Jerry Yuee40f9d2022-02-17 14:55:16 +08008592
8593 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
8594
8595 if( ( status = psa_hash_setup( &hash_operation,
8596 hash_alg ) ) != PSA_SUCCESS )
8597 {
8598 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
8599 goto exit;
8600 }
8601
8602 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
8603 64 ) ) != PSA_SUCCESS )
8604 {
8605 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
8606 goto exit;
8607 }
8608
8609 if( ( status = psa_hash_update( &hash_operation,
8610 data, data_len ) ) != PSA_SUCCESS )
8611 {
8612 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
8613 goto exit;
8614 }
8615
8616 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
8617 hashlen ) ) != PSA_SUCCESS )
8618 {
8619 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
8620 goto exit;
8621 }
8622
8623exit:
8624 if( status != PSA_SUCCESS )
8625 {
8626 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8627 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
8628 switch( status )
8629 {
8630 case PSA_ERROR_NOT_SUPPORTED:
8631 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
8632 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
8633 case PSA_ERROR_BUFFER_TOO_SMALL:
8634 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
8635 case PSA_ERROR_INSUFFICIENT_MEMORY:
8636 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
8637 default:
8638 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
8639 }
8640 }
8641 return( 0 );
8642}
8643
8644#else
8645
8646int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
8647 unsigned char *hash, size_t *hashlen,
8648 unsigned char *data, size_t data_len,
8649 mbedtls_md_type_t md_alg )
8650{
8651 int ret = 0;
8652 mbedtls_md_context_t ctx;
8653 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
8654 *hashlen = mbedtls_md_get_size( md_info );
8655
8656 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
8657
8658 mbedtls_md_init( &ctx );
8659
8660 /*
8661 * digitally-signed struct {
8662 * opaque client_random[32];
8663 * opaque server_random[32];
8664 * ServerDHParams params;
8665 * };
8666 */
8667 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
8668 {
8669 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
8670 goto exit;
8671 }
8672 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
8673 {
8674 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
8675 goto exit;
8676 }
8677 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
8678 {
8679 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
8680 goto exit;
8681 }
8682 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
8683 {
8684 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
8685 goto exit;
8686 }
8687 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
8688 {
8689 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
8690 goto exit;
8691 }
8692
8693exit:
8694 mbedtls_md_free( &ctx );
8695
8696 if( ret != 0 )
8697 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8698 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
8699
8700 return( ret );
8701}
8702#endif /* MBEDTLS_USE_PSA_CRYPTO */
8703
Jerry Yud9d91da2022-02-17 14:57:06 +08008704#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
8705
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008706/* Find the preferred hash for a given signature algorithm. */
8707unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
8708 mbedtls_ssl_context *ssl,
8709 unsigned int sig_alg )
Jerry Yud9d91da2022-02-17 14:57:06 +08008710{
Gabor Mezei078e8032022-04-27 21:17:56 +02008711 unsigned int i;
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008712 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
Gabor Mezei078e8032022-04-27 21:17:56 +02008713
8714 if( sig_alg == MBEDTLS_SSL_SIG_ANON )
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008715 return( MBEDTLS_SSL_HASH_NONE );
Gabor Mezei078e8032022-04-27 21:17:56 +02008716
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008717 for( i = 0; received_sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++ )
Jerry Yud9d91da2022-02-17 14:57:06 +08008718 {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008719 unsigned int hash_alg_received =
8720 MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(
8721 received_sig_algs[i] );
8722 unsigned int sig_alg_received =
8723 MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(
8724 received_sig_algs[i] );
8725
8726 if( sig_alg == sig_alg_received )
8727 {
8728#if defined(MBEDTLS_USE_PSA_CRYPTO)
8729 if( ssl->handshake->key_cert && ssl->handshake->key_cert->key )
8730 {
Neil Armstrong96eceb82022-06-30 18:05:05 +02008731 psa_algorithm_t psa_hash_alg =
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02008732 mbedtls_hash_info_psa_from_md( hash_alg_received );
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008733
Neil Armstrong96eceb82022-06-30 18:05:05 +02008734 if( sig_alg_received == MBEDTLS_SSL_SIG_ECDSA &&
8735 ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key,
8736 PSA_ALG_ECDSA( psa_hash_alg ),
8737 PSA_KEY_USAGE_SIGN_HASH ) )
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008738 continue;
8739
Neil Armstrong96eceb82022-06-30 18:05:05 +02008740 if( sig_alg_received == MBEDTLS_SSL_SIG_RSA &&
Neil Armstrong971f30d2022-07-01 16:23:50 +02008741 ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key,
8742 PSA_ALG_RSA_PKCS1V15_SIGN(
8743 psa_hash_alg ),
8744 PSA_KEY_USAGE_SIGN_HASH ) )
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008745 continue;
8746 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008747#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong96eceb82022-06-30 18:05:05 +02008748
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008749 return( hash_alg_received );
8750 }
Jerry Yud9d91da2022-02-17 14:57:06 +08008751 }
Jerry Yud9d91da2022-02-17 14:57:06 +08008752
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008753 return( MBEDTLS_SSL_HASH_NONE );
Jerry Yud9d91da2022-02-17 14:57:06 +08008754}
8755
8756#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
8757
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008758/* Serialization of TLS 1.2 sessions:
8759 *
8760 * struct {
8761 * uint64 start_time;
8762 * uint8 ciphersuite[2]; // defined by the standard
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008763 * uint8 session_id_len; // at most 32
8764 * opaque session_id[32];
8765 * opaque master[48]; // fixed length in the standard
8766 * uint32 verify_result;
8767 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
8768 * opaque ticket<0..2^24-1>; // length 0 means no ticket
8769 * uint32 ticket_lifetime;
8770 * uint8 mfl_code; // up to 255 according to standard
8771 * uint8 encrypt_then_mac; // 0 or 1
8772 * } serialized_session_tls12;
8773 *
8774 */
Jerry Yu438ddd82022-07-07 06:55:50 +00008775static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008776 unsigned char *buf,
8777 size_t buf_len )
8778{
8779 unsigned char *p = buf;
8780 size_t used = 0;
8781
8782#if defined(MBEDTLS_HAVE_TIME)
8783 uint64_t start;
8784#endif
8785#if defined(MBEDTLS_X509_CRT_PARSE_C)
8786#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8787 size_t cert_len;
8788#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8789#endif /* MBEDTLS_X509_CRT_PARSE_C */
8790
8791 /*
8792 * Time
8793 */
8794#if defined(MBEDTLS_HAVE_TIME)
8795 used += 8;
8796
8797 if( used <= buf_len )
8798 {
8799 start = (uint64_t) session->start;
8800
8801 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
8802 p += 8;
8803 }
8804#endif /* MBEDTLS_HAVE_TIME */
8805
8806 /*
8807 * Basic mandatory fields
8808 */
8809 used += 2 /* ciphersuite */
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008810 + 1 /* id_len */
8811 + sizeof( session->id )
8812 + sizeof( session->master )
8813 + 4; /* verify_result */
8814
8815 if( used <= buf_len )
8816 {
8817 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
8818 p += 2;
8819
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008820 *p++ = MBEDTLS_BYTE_0( session->id_len );
8821 memcpy( p, session->id, 32 );
8822 p += 32;
8823
8824 memcpy( p, session->master, 48 );
8825 p += 48;
8826
8827 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
8828 p += 4;
8829 }
8830
8831 /*
8832 * Peer's end-entity certificate
8833 */
8834#if defined(MBEDTLS_X509_CRT_PARSE_C)
8835#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8836 if( session->peer_cert == NULL )
8837 cert_len = 0;
8838 else
8839 cert_len = session->peer_cert->raw.len;
8840
8841 used += 3 + cert_len;
8842
8843 if( used <= buf_len )
8844 {
8845 *p++ = MBEDTLS_BYTE_2( cert_len );
8846 *p++ = MBEDTLS_BYTE_1( cert_len );
8847 *p++ = MBEDTLS_BYTE_0( cert_len );
8848
8849 if( session->peer_cert != NULL )
8850 {
8851 memcpy( p, session->peer_cert->raw.p, cert_len );
8852 p += cert_len;
8853 }
8854 }
8855#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8856 if( session->peer_cert_digest != NULL )
8857 {
8858 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
8859 if( used <= buf_len )
8860 {
8861 *p++ = (unsigned char) session->peer_cert_digest_type;
8862 *p++ = (unsigned char) session->peer_cert_digest_len;
8863 memcpy( p, session->peer_cert_digest,
8864 session->peer_cert_digest_len );
8865 p += session->peer_cert_digest_len;
8866 }
8867 }
8868 else
8869 {
8870 used += 2;
8871 if( used <= buf_len )
8872 {
8873 *p++ = (unsigned char) MBEDTLS_MD_NONE;
8874 *p++ = 0;
8875 }
8876 }
8877#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8878#endif /* MBEDTLS_X509_CRT_PARSE_C */
8879
8880 /*
8881 * Session ticket if any, plus associated data
8882 */
8883#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8884 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
8885
8886 if( used <= buf_len )
8887 {
8888 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
8889 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
8890 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
8891
8892 if( session->ticket != NULL )
8893 {
8894 memcpy( p, session->ticket, session->ticket_len );
8895 p += session->ticket_len;
8896 }
8897
8898 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
8899 p += 4;
8900 }
8901#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8902
8903 /*
8904 * Misc extension-related info
8905 */
8906#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8907 used += 1;
8908
8909 if( used <= buf_len )
8910 *p++ = session->mfl_code;
8911#endif
8912
8913#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
8914 used += 1;
8915
8916 if( used <= buf_len )
8917 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
8918#endif
8919
8920 return( used );
8921}
8922
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008923MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu438ddd82022-07-07 06:55:50 +00008924static int ssl_tls12_session_load( mbedtls_ssl_session *session,
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008925 const unsigned char *buf,
8926 size_t len )
8927{
8928#if defined(MBEDTLS_HAVE_TIME)
8929 uint64_t start;
8930#endif
8931#if defined(MBEDTLS_X509_CRT_PARSE_C)
8932#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8933 size_t cert_len;
8934#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8935#endif /* MBEDTLS_X509_CRT_PARSE_C */
8936
8937 const unsigned char *p = buf;
8938 const unsigned char * const end = buf + len;
8939
8940 /*
8941 * Time
8942 */
8943#if defined(MBEDTLS_HAVE_TIME)
8944 if( 8 > (size_t)( end - p ) )
8945 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8946
8947 start = ( (uint64_t) p[0] << 56 ) |
8948 ( (uint64_t) p[1] << 48 ) |
8949 ( (uint64_t) p[2] << 40 ) |
8950 ( (uint64_t) p[3] << 32 ) |
8951 ( (uint64_t) p[4] << 24 ) |
8952 ( (uint64_t) p[5] << 16 ) |
8953 ( (uint64_t) p[6] << 8 ) |
8954 ( (uint64_t) p[7] );
8955 p += 8;
8956
8957 session->start = (time_t) start;
8958#endif /* MBEDTLS_HAVE_TIME */
8959
8960 /*
8961 * Basic mandatory fields
8962 */
Thomas Daubney20f89a92022-06-20 15:12:19 +01008963 if( 2 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008964 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8965
8966 session->ciphersuite = ( p[0] << 8 ) | p[1];
8967 p += 2;
8968
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008969 session->id_len = *p++;
8970 memcpy( session->id, p, 32 );
8971 p += 32;
8972
8973 memcpy( session->master, p, 48 );
8974 p += 48;
8975
8976 session->verify_result = ( (uint32_t) p[0] << 24 ) |
8977 ( (uint32_t) p[1] << 16 ) |
8978 ( (uint32_t) p[2] << 8 ) |
8979 ( (uint32_t) p[3] );
8980 p += 4;
8981
8982 /* Immediately clear invalid pointer values that have been read, in case
8983 * we exit early before we replaced them with valid ones. */
8984#if defined(MBEDTLS_X509_CRT_PARSE_C)
8985#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8986 session->peer_cert = NULL;
8987#else
8988 session->peer_cert_digest = NULL;
8989#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8990#endif /* MBEDTLS_X509_CRT_PARSE_C */
8991#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8992 session->ticket = NULL;
8993#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8994
8995 /*
8996 * Peer certificate
8997 */
8998#if defined(MBEDTLS_X509_CRT_PARSE_C)
8999#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
9000 /* Deserialize CRT from the end of the ticket. */
9001 if( 3 > (size_t)( end - p ) )
9002 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9003
9004 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
9005 p += 3;
9006
9007 if( cert_len != 0 )
9008 {
9009 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
9010
9011 if( cert_len > (size_t)( end - p ) )
9012 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9013
9014 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
9015
9016 if( session->peer_cert == NULL )
9017 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
9018
9019 mbedtls_x509_crt_init( session->peer_cert );
9020
9021 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
9022 p, cert_len ) ) != 0 )
9023 {
9024 mbedtls_x509_crt_free( session->peer_cert );
9025 mbedtls_free( session->peer_cert );
9026 session->peer_cert = NULL;
9027 return( ret );
9028 }
9029
9030 p += cert_len;
9031 }
9032#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9033 /* Deserialize CRT digest from the end of the ticket. */
9034 if( 2 > (size_t)( end - p ) )
9035 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9036
9037 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
9038 session->peer_cert_digest_len = (size_t) *p++;
9039
9040 if( session->peer_cert_digest_len != 0 )
9041 {
9042 const mbedtls_md_info_t *md_info =
9043 mbedtls_md_info_from_type( session->peer_cert_digest_type );
9044 if( md_info == NULL )
9045 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9046 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
9047 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9048
9049 if( session->peer_cert_digest_len > (size_t)( end - p ) )
9050 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9051
9052 session->peer_cert_digest =
9053 mbedtls_calloc( 1, session->peer_cert_digest_len );
9054 if( session->peer_cert_digest == NULL )
9055 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
9056
9057 memcpy( session->peer_cert_digest, p,
9058 session->peer_cert_digest_len );
9059 p += session->peer_cert_digest_len;
9060 }
9061#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9062#endif /* MBEDTLS_X509_CRT_PARSE_C */
9063
9064 /*
9065 * Session ticket and associated data
9066 */
9067#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
9068 if( 3 > (size_t)( end - p ) )
9069 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9070
9071 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
9072 p += 3;
9073
9074 if( session->ticket_len != 0 )
9075 {
9076 if( session->ticket_len > (size_t)( end - p ) )
9077 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9078
9079 session->ticket = mbedtls_calloc( 1, session->ticket_len );
9080 if( session->ticket == NULL )
9081 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
9082
9083 memcpy( session->ticket, p, session->ticket_len );
9084 p += session->ticket_len;
9085 }
9086
9087 if( 4 > (size_t)( end - p ) )
9088 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9089
9090 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
9091 ( (uint32_t) p[1] << 16 ) |
9092 ( (uint32_t) p[2] << 8 ) |
9093 ( (uint32_t) p[3] );
9094 p += 4;
9095#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
9096
9097 /*
9098 * Misc extension-related info
9099 */
9100#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
9101 if( 1 > (size_t)( end - p ) )
9102 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9103
9104 session->mfl_code = *p++;
9105#endif
9106
9107#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
9108 if( 1 > (size_t)( end - p ) )
9109 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9110
9111 session->encrypt_then_mac = *p++;
9112#endif
9113
9114 /* Done, should have consumed entire buffer */
9115 if( p != end )
9116 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9117
9118 return( 0 );
9119}
Jerry Yudc7bd172022-02-17 13:44:15 +08009120#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9121
XiaokangQian75d40ef2022-04-20 11:05:24 +00009122int mbedtls_ssl_validate_ciphersuite(
9123 const mbedtls_ssl_context *ssl,
9124 const mbedtls_ssl_ciphersuite_t *suite_info,
9125 mbedtls_ssl_protocol_version min_tls_version,
9126 mbedtls_ssl_protocol_version max_tls_version )
9127{
9128 (void) ssl;
9129
9130 if( suite_info == NULL )
9131 return( -1 );
9132
9133 if( ( suite_info->min_tls_version > max_tls_version ) ||
9134 ( suite_info->max_tls_version < min_tls_version ) )
9135 {
9136 return( -1 );
9137 }
9138
XiaokangQian060d8672022-04-21 09:24:56 +00009139#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_CLI_C)
XiaokangQian75d40ef2022-04-20 11:05:24 +00009140#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009141#if defined(MBEDTLS_USE_PSA_CRYPTO)
9142 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
9143 ssl->handshake->psa_pake_ctx_is_ok != 1 )
9144#else
XiaokangQian75d40ef2022-04-20 11:05:24 +00009145 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
9146 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
Neil Armstrongca7d5062022-05-31 14:43:23 +02009147#endif /* MBEDTLS_USE_PSA_CRYPTO */
XiaokangQian75d40ef2022-04-20 11:05:24 +00009148 {
9149 return( -1 );
9150 }
9151#endif
9152
9153 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
9154#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
9155 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
9156 mbedtls_ssl_conf_has_static_psk( ssl->conf ) == 0 )
9157 {
9158 return( -1 );
9159 }
9160#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
9161#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9162
9163 return( 0 );
9164}
9165
Ronald Crone68ab4f2022-10-05 12:46:29 +02009166#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
XiaokangQianeaf36512022-04-24 09:07:44 +00009167/*
9168 * Function for writing a signature algorithm extension.
9169 *
9170 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
9171 * value (TLS 1.3 RFC8446):
9172 * enum {
9173 * ....
9174 * ecdsa_secp256r1_sha256( 0x0403 ),
9175 * ecdsa_secp384r1_sha384( 0x0503 ),
9176 * ecdsa_secp521r1_sha512( 0x0603 ),
9177 * ....
9178 * } SignatureScheme;
9179 *
9180 * struct {
9181 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
9182 * } SignatureSchemeList;
9183 *
9184 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
9185 * value (TLS 1.2 RFC5246):
9186 * enum {
9187 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
9188 * sha512(6), (255)
9189 * } HashAlgorithm;
9190 *
9191 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
9192 * SignatureAlgorithm;
9193 *
9194 * struct {
9195 * HashAlgorithm hash;
9196 * SignatureAlgorithm signature;
9197 * } SignatureAndHashAlgorithm;
9198 *
9199 * SignatureAndHashAlgorithm
9200 * supported_signature_algorithms<2..2^16-2>;
9201 *
9202 * The TLS 1.3 signature algorithm extension was defined to be a compatible
9203 * generalization of the TLS 1.2 signature algorithm extension.
9204 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
9205 * `SignatureScheme` field of TLS 1.3
9206 *
9207 */
9208int mbedtls_ssl_write_sig_alg_ext( mbedtls_ssl_context *ssl, unsigned char *buf,
9209 const unsigned char *end, size_t *out_len )
9210{
9211 unsigned char *p = buf;
9212 unsigned char *supported_sig_alg; /* Start of supported_signature_algorithms */
9213 size_t supported_sig_alg_len = 0; /* Length of supported_signature_algorithms */
9214
9215 *out_len = 0;
9216
9217 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding signature_algorithms extension" ) );
9218
9219 /* Check if we have space for header and length field:
9220 * - extension_type (2 bytes)
9221 * - extension_data_length (2 bytes)
9222 * - supported_signature_algorithms_length (2 bytes)
9223 */
9224 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
9225 p += 6;
9226
9227 /*
9228 * Write supported_signature_algorithms
9229 */
9230 supported_sig_alg = p;
9231 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs( ssl );
9232 if( sig_alg == NULL )
9233 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
9234
9235 for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ )
9236 {
Jerry Yu53f5c152022-06-22 20:24:38 +08009237 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got signature scheme [%x] %s",
9238 *sig_alg,
9239 mbedtls_ssl_sig_alg_to_str( *sig_alg ) ) );
XiaokangQianeaf36512022-04-24 09:07:44 +00009240 if( ! mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg ) )
9241 continue;
9242 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
9243 MBEDTLS_PUT_UINT16_BE( *sig_alg, p, 0 );
9244 p += 2;
Jerry Yu80dd5db2022-06-22 19:30:32 +08009245 MBEDTLS_SSL_DEBUG_MSG( 3, ( "sent signature scheme [%x] %s",
Jerry Yuf3b46b52022-06-19 16:52:27 +08009246 *sig_alg,
9247 mbedtls_ssl_sig_alg_to_str( *sig_alg ) ) );
XiaokangQianeaf36512022-04-24 09:07:44 +00009248 }
9249
9250 /* Length of supported_signature_algorithms */
9251 supported_sig_alg_len = p - supported_sig_alg;
9252 if( supported_sig_alg_len == 0 )
9253 {
9254 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No signature algorithms defined." ) );
9255 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
9256 }
9257
XiaokangQianeaf36512022-04-24 09:07:44 +00009258 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SIG_ALG, buf, 0 );
XiaokangQianeaf36512022-04-24 09:07:44 +00009259 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len + 2, buf, 2 );
XiaokangQianeaf36512022-04-24 09:07:44 +00009260 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len, buf, 4 );
9261
XiaokangQianeaf36512022-04-24 09:07:44 +00009262 *out_len = p - buf;
9263
9264#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yuc4bf5d62022-10-29 09:08:47 +08009265 mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_SIG_ALG );
XiaokangQianeaf36512022-04-24 09:07:44 +00009266#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu0c354a22022-08-29 15:25:36 +08009267
XiaokangQianeaf36512022-04-24 09:07:44 +00009268 return( 0 );
9269}
Ronald Crone68ab4f2022-10-05 12:46:29 +02009270#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
XiaokangQianeaf36512022-04-24 09:07:44 +00009271
XiaokangQian40a35232022-05-07 09:02:40 +00009272#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
XiaokangQian9b2b7712022-05-17 02:57:00 +00009273/*
9274 * mbedtls_ssl_parse_server_name_ext
9275 *
9276 * Structure of server_name extension:
9277 *
9278 * enum {
9279 * host_name(0), (255)
9280 * } NameType;
9281 * opaque HostName<1..2^16-1>;
9282 *
9283 * struct {
9284 * NameType name_type;
9285 * select (name_type) {
9286 * case host_name: HostName;
9287 * } name;
9288 * } ServerName;
9289 * struct {
9290 * ServerName server_name_list<1..2^16-1>
9291 * } ServerNameList;
9292 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02009293MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian9b2b7712022-05-17 02:57:00 +00009294int mbedtls_ssl_parse_server_name_ext( mbedtls_ssl_context *ssl,
9295 const unsigned char *buf,
9296 const unsigned char *end )
XiaokangQian40a35232022-05-07 09:02:40 +00009297{
9298 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
9299 const unsigned char *p = buf;
XiaokangQian9b2b7712022-05-17 02:57:00 +00009300 size_t server_name_list_len, hostname_len;
9301 const unsigned char *server_name_list_end;
XiaokangQian40a35232022-05-07 09:02:40 +00009302
XiaokangQianf2a94202022-05-20 06:44:24 +00009303 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
XiaokangQian40a35232022-05-07 09:02:40 +00009304
9305 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQian9b2b7712022-05-17 02:57:00 +00009306 server_name_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian40a35232022-05-07 09:02:40 +00009307 p += 2;
9308
XiaokangQian9b2b7712022-05-17 02:57:00 +00009309 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, server_name_list_len );
9310 server_name_list_end = p + server_name_list_len;
XiaokangQian75fe8c72022-06-15 09:42:45 +00009311 while( p < server_name_list_end )
XiaokangQian40a35232022-05-07 09:02:40 +00009312 {
XiaokangQian9b2b7712022-05-17 02:57:00 +00009313 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, server_name_list_end, 3 );
XiaokangQian40a35232022-05-07 09:02:40 +00009314 hostname_len = MBEDTLS_GET_UINT16_BE( p, 1 );
XiaokangQian9b2b7712022-05-17 02:57:00 +00009315 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, server_name_list_end,
9316 hostname_len + 3 );
XiaokangQian40a35232022-05-07 09:02:40 +00009317
9318 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
9319 {
XiaokangQian75fe8c72022-06-15 09:42:45 +00009320 /* sni_name is intended to be used only during the parsing of the
9321 * ClientHello message (it is reset to NULL before the end of
9322 * the message parsing). Thus it is ok to just point to the
9323 * reception buffer and not make a copy of it.
9324 */
XiaokangQianf2a94202022-05-20 06:44:24 +00009325 ssl->handshake->sni_name = p + 3;
9326 ssl->handshake->sni_name_len = hostname_len;
9327 if( ssl->conf->f_sni == NULL )
9328 return( 0 );
XiaokangQian40a35232022-05-07 09:02:40 +00009329 ret = ssl->conf->f_sni( ssl->conf->p_sni,
XiaokangQian9b2b7712022-05-17 02:57:00 +00009330 ssl, p + 3, hostname_len );
XiaokangQian40a35232022-05-07 09:02:40 +00009331 if( ret != 0 )
9332 {
XiaokangQianf2a94202022-05-20 06:44:24 +00009333 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
XiaokangQian129aeb92022-06-02 09:29:18 +00009334 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME,
9335 MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME );
XiaokangQian40a35232022-05-07 09:02:40 +00009336 return( MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME );
9337 }
9338 return( 0 );
9339 }
9340
9341 p += hostname_len + 3;
9342 }
9343
9344 return( 0 );
9345}
9346#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9347
XiaokangQianacb39922022-06-17 10:18:48 +00009348#if defined(MBEDTLS_SSL_ALPN)
Ronald Cronce7d76e2022-07-08 18:56:49 +02009349MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianacb39922022-06-17 10:18:48 +00009350int mbedtls_ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
9351 const unsigned char *buf,
9352 const unsigned char *end )
9353{
9354 const unsigned char *p = buf;
XiaokangQianc7403452022-06-23 03:24:12 +00009355 size_t protocol_name_list_len;
XiaokangQian95d5f542022-06-24 02:29:26 +00009356 const unsigned char *protocol_name_list;
9357 const unsigned char *protocol_name_list_end;
XiaokangQianc7403452022-06-23 03:24:12 +00009358 size_t protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009359
9360 /* If ALPN not configured, just ignore the extension */
9361 if( ssl->conf->alpn_list == NULL )
9362 return( 0 );
9363
9364 /*
XiaokangQianc7403452022-06-23 03:24:12 +00009365 * RFC7301, section 3.1
9366 * opaque ProtocolName<1..2^8-1>;
XiaokangQianacb39922022-06-17 10:18:48 +00009367 *
XiaokangQianc7403452022-06-23 03:24:12 +00009368 * struct {
9369 * ProtocolName protocol_name_list<2..2^16-1>
9370 * } ProtocolNameList;
XiaokangQianacb39922022-06-17 10:18:48 +00009371 */
9372
XiaokangQianc7403452022-06-23 03:24:12 +00009373 /*
XiaokangQian0b776e22022-06-24 09:04:59 +00009374 * protocol_name_list_len 2 bytes
9375 * protocol_name_len 1 bytes
9376 * protocol_name >=1 byte
XiaokangQianc7403452022-06-23 03:24:12 +00009377 */
XiaokangQianacb39922022-06-17 10:18:48 +00009378 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 4 );
9379
XiaokangQianc7403452022-06-23 03:24:12 +00009380 protocol_name_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQianacb39922022-06-17 10:18:48 +00009381 p += 2;
XiaokangQianc7403452022-06-23 03:24:12 +00009382 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, protocol_name_list_len );
XiaokangQian95d5f542022-06-24 02:29:26 +00009383 protocol_name_list = p;
9384 protocol_name_list_end = p + protocol_name_list_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009385
9386 /* Validate peer's list (lengths) */
XiaokangQian95d5f542022-06-24 02:29:26 +00009387 while( p < protocol_name_list_end )
XiaokangQianacb39922022-06-17 10:18:48 +00009388 {
XiaokangQian95d5f542022-06-24 02:29:26 +00009389 protocol_name_len = *p++;
9390 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, protocol_name_list_end,
9391 protocol_name_len );
XiaokangQianc7403452022-06-23 03:24:12 +00009392 if( protocol_name_len == 0 )
XiaokangQian95d5f542022-06-24 02:29:26 +00009393 {
9394 MBEDTLS_SSL_PEND_FATAL_ALERT(
9395 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
9396 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
XiaokangQianacb39922022-06-17 10:18:48 +00009397 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
XiaokangQian95d5f542022-06-24 02:29:26 +00009398 }
9399
9400 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009401 }
9402
9403 /* Use our order of preference */
9404 for( const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++ )
9405 {
9406 size_t const alpn_len = strlen( *alpn );
XiaokangQian95d5f542022-06-24 02:29:26 +00009407 p = protocol_name_list;
9408 while( p < protocol_name_list_end )
XiaokangQianacb39922022-06-17 10:18:48 +00009409 {
XiaokangQian95d5f542022-06-24 02:29:26 +00009410 protocol_name_len = *p++;
XiaokangQianc7403452022-06-23 03:24:12 +00009411 if( protocol_name_len == alpn_len &&
XiaokangQian95d5f542022-06-24 02:29:26 +00009412 memcmp( p, *alpn, alpn_len ) == 0 )
XiaokangQianacb39922022-06-17 10:18:48 +00009413 {
9414 ssl->alpn_chosen = *alpn;
9415 return( 0 );
9416 }
XiaokangQian95d5f542022-06-24 02:29:26 +00009417
9418 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009419 }
9420 }
9421
XiaokangQian95d5f542022-06-24 02:29:26 +00009422 /* If we get here, no match was found */
XiaokangQianacb39922022-06-17 10:18:48 +00009423 MBEDTLS_SSL_PEND_FATAL_ALERT(
9424 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL,
9425 MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
9426 return( MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
9427}
9428
9429int mbedtls_ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
9430 unsigned char *buf,
9431 unsigned char *end,
XiaokangQianc7403452022-06-23 03:24:12 +00009432 size_t *out_len )
XiaokangQianacb39922022-06-17 10:18:48 +00009433{
9434 unsigned char *p = buf;
XiaokangQian95d5f542022-06-24 02:29:26 +00009435 size_t protocol_name_len;
XiaokangQianc7403452022-06-23 03:24:12 +00009436 *out_len = 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009437
9438 if( ssl->alpn_chosen == NULL )
9439 {
9440 return( 0 );
9441 }
9442
XiaokangQian95d5f542022-06-24 02:29:26 +00009443 protocol_name_len = strlen( ssl->alpn_chosen );
9444 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 + protocol_name_len );
XiaokangQianacb39922022-06-17 10:18:48 +00009445
9446 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server side, adding alpn extension" ) );
9447 /*
9448 * 0 . 1 ext identifier
9449 * 2 . 3 ext length
9450 * 4 . 5 protocol list length
9451 * 6 . 6 protocol name length
9452 * 7 . 7+n protocol name
9453 */
9454 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ALPN, p, 0 );
9455
XiaokangQian95d5f542022-06-24 02:29:26 +00009456 *out_len = 7 + protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009457
XiaokangQian95d5f542022-06-24 02:29:26 +00009458 MBEDTLS_PUT_UINT16_BE( protocol_name_len + 3, p, 2 );
9459 MBEDTLS_PUT_UINT16_BE( protocol_name_len + 1, p, 4 );
XiaokangQian0b776e22022-06-24 09:04:59 +00009460 /* Note: the length of the chosen protocol has been checked to be less
9461 * than 255 bytes in `mbedtls_ssl_conf_alpn_protocols`.
9462 */
XiaokangQian95d5f542022-06-24 02:29:26 +00009463 p[6] = MBEDTLS_BYTE_0( protocol_name_len );
XiaokangQianacb39922022-06-17 10:18:48 +00009464
XiaokangQian95d5f542022-06-24 02:29:26 +00009465 memcpy( p + 7, ssl->alpn_chosen, protocol_name_len );
Jerry Yub95dd362022-11-08 21:19:34 +08009466
9467#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
9468 mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_ALPN );
9469#endif
9470
XiaokangQianacb39922022-06-17 10:18:48 +00009471 return ( 0 );
9472}
9473#endif /* MBEDTLS_SSL_ALPN */
9474
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009475#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
Xiaokang Qian03409292022-10-12 02:49:52 +00009476 defined(MBEDTLS_SSL_SESSION_TICKETS) && \
Xiaokang Qianed0620c2022-10-12 06:58:13 +00009477 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00009478 defined(MBEDTLS_SSL_CLI_C)
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009479int mbedtls_ssl_session_set_hostname( mbedtls_ssl_session *session,
9480 const char *hostname )
9481{
9482 /* Initialize to suppress unnecessary compiler warning */
9483 size_t hostname_len = 0;
9484
9485 /* Check if new hostname is valid before
9486 * making any change to current one */
9487 if( hostname != NULL )
9488 {
9489 hostname_len = strlen( hostname );
9490
9491 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
9492 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9493 }
9494
9495 /* Now it's clear that we will overwrite the old hostname,
9496 * so we can free it safely */
9497 if( session->hostname != NULL )
9498 {
9499 mbedtls_platform_zeroize( session->hostname,
9500 strlen( session->hostname ) );
9501 mbedtls_free( session->hostname );
9502 }
9503
9504 /* Passing NULL as hostname shall clear the old one */
9505 if( hostname == NULL )
9506 {
9507 session->hostname = NULL;
9508 }
9509 else
9510 {
9511 session->hostname = mbedtls_calloc( 1, hostname_len + 1 );
9512 if( session->hostname == NULL )
9513 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
9514
9515 memcpy( session->hostname, hostname, hostname_len );
9516 }
9517
9518 return( 0 );
9519}
Xiaokang Qian03409292022-10-12 02:49:52 +00009520#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
9521 MBEDTLS_SSL_SESSION_TICKETS &&
Xiaokang Qianed0620c2022-10-12 06:58:13 +00009522 MBEDTLS_SSL_SERVER_NAME_INDICATION &&
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00009523 MBEDTLS_SSL_CLI_C */
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009524
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009525#endif /* MBEDTLS_SSL_TLS_C */