blob: 2edec1698af02857996836932554c126467e2c84 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 shared functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21/*
22 * The SSL 3.0 specification was drafted by Netscape in 1996,
23 * and became an IETF standard in 1999.
24 *
25 * http://wp.netscape.com/eng/ssl3/
26 * http://www.ietf.org/rfc/rfc2246.txt
27 * http://www.ietf.org/rfc/rfc4346.txt
28 */
29
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020030#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000031#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020032#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020034#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000037
SimonBd5800b72016-04-26 07:43:27 +010038#if defined(MBEDTLS_PLATFORM_C)
39#include "mbedtls/platform.h"
40#else
41#include <stdlib.h>
42#define mbedtls_calloc calloc
43#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010044#endif
45
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/debug.h"
47#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020048#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050049#include "mbedtls/platform_util.h"
Hanno Beckerb5352f02019-05-16 12:39:07 +010050#include "mbedtls/version.h"
Jarno Lamsaaf60cd72019-12-19 16:45:23 +020051#include "mbedtls/platform.h"
52
Rich Evans00ab4702015-02-06 13:43:58 +000053#include <string.h>
54
Janos Follath23bdca02016-10-07 14:47:14 +010055#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000056#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020057#endif
58
Andrzej Kurekf7df0d32020-09-19 12:00:57 +020059#define PROPER_HS_FRAGMENT 0x75
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -040060
Andrzej Kureka7932372020-09-19 07:56:06 +020061#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
62static int mbedtls_ssl_switch_key( mbedtls_ssl_transform *transform,
63 const mbedtls_operation_t operation )
64{
65 unsigned char * key;
Andrzej Kurek69bafce2020-09-19 12:45:20 +020066 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
67 int flow_ctrl = 0;
Andrzej Kureka7932372020-09-19 07:56:06 +020068#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
69 uint32_t hash;
70#endif
71 if( operation == MBEDTLS_ENCRYPT )
72 {
Andrzej Kurek69bafce2020-09-19 12:45:20 +020073 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +020074 key = transform->key_enc;
75#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
76 hash = transform->key_enc_hash;
77#endif
78 }
79 else if ( operation == MBEDTLS_DECRYPT )
80 {
Andrzej Kurek69bafce2020-09-19 12:45:20 +020081 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +020082 key = transform->key_dec;
83#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
84 hash = transform->key_dec_hash;
85#endif
86 }
87 else
88 {
89 return ( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
90 }
91#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
92 /* Check hash */
93 if( hash != mbedtls_hash( key, transform->key_bitlen >> 3 ) )
94 {
95 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
96 }
Andrzej Kurek69bafce2020-09-19 12:45:20 +020097 else
98 {
99 flow_ctrl++;
100 }
101#else
102 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +0200103#endif
104 if( operation != transform->cipher_ctx.operation )
105 {
106 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx,
107 key,
108 transform->key_bitlen,
109 operation ) ) != 0 )
110 {
111 return( ret );
112 }
113 }
Andrzej Kurek69bafce2020-09-19 12:45:20 +0200114 if( flow_ctrl == 2 )
115 {
116 return( 0 );
117 }
118 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Andrzej Kureka7932372020-09-19 07:56:06 +0200119}
120#endif
121
Hanno Beckeref982d52019-07-23 15:56:18 +0100122#if defined(MBEDTLS_USE_TINYCRYPT)
123static int uecc_rng_wrapper( uint8_t *dest, unsigned int size )
124{
Hanno Beckerd089fad2019-07-24 09:05:05 +0100125 int ret;
126 ret = mbedtls_ssl_conf_rng_func( NULL, dest, size );
127 if( ret == 0 )
128 return( (int) size );
129
130 return( 0 );
Hanno Beckeref982d52019-07-23 15:56:18 +0100131}
Hanno Becker75f12d12019-07-23 16:16:15 +0100132
133int mbedtls_ssl_ecdh_read_peerkey( mbedtls_ssl_context *ssl,
134 unsigned char **p, unsigned char *end )
135{
136 size_t const secp256r1_uncompressed_point_length =
137 1 /* length */ + 1 /* length */ + 2 * NUM_ECC_BYTES /* data */;
138
139 if( (size_t)( end - *p ) < secp256r1_uncompressed_point_length )
140 {
141 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Bad ECDH peer pubkey (too short)" ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +0100142 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +0100143 }
144
145 if( (*p)[0] != 2 * NUM_ECC_BYTES + 1 ||
146 (*p)[1] != 0x04 )
147 {
148 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Unexpected ECDH peer pubkey header - expected { %#02x, %#02x }, got { %#02x, %#02x }",
149 2 * NUM_ECC_BYTES + 1,
150 0x04,
151 (unsigned) (*p)[0],
152 (unsigned) (*p)[1] ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +0100153 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +0100154 }
155
Piotr Nowicki305a5ec2020-08-10 17:42:18 +0200156 if( mbedtls_platform_memcpy( ssl->handshake->ecdh_peerkey, *p + 2, 2 * NUM_ECC_BYTES ) !=
157 ssl->handshake->ecdh_peerkey )
158 {
159 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
160 }
Hanno Becker75f12d12019-07-23 16:16:15 +0100161
162 *p += secp256r1_uncompressed_point_length;
163 return( 0 );
164}
Hanno Beckeref982d52019-07-23 15:56:18 +0100165#endif /* MBEDTLS_USE_TINYCRYPT */
166
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100167static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl );
Hanno Beckercd9dcda2018-08-28 17:18:56 +0100168static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100169
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100170/* Length of the "epoch" field in the record header */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200171static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100172{
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200173#if !defined(MBEDTLS_SSL_TRANSPORT__BOTH)
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +0100174 ((void) ssl);
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100175#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200176
177#if defined(MBEDTLS_SSL_PROTO_DTLS)
178 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
179 return( 2 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200180 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200181#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200182#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100183 return( 0 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200184#endif
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100185}
186
Hanno Beckerb82350b2019-07-26 07:24:05 +0100187static void ssl_send_pending_fatal_alert( mbedtls_ssl_context *ssl )
188{
189 if( ssl->pending_fatal_alert_msg == MBEDTLS_SSL_ALERT_MSG_NONE )
190 return;
191
192 mbedtls_ssl_send_alert_message( ssl,
193 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
194 ssl->pending_fatal_alert_msg );
195 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
196}
197
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200198/*
199 * Start a timer.
200 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200201 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200203{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100204 if( mbedtls_ssl_get_set_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200205 return;
206
207 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
Hanno Becker0ae6b242019-06-13 16:45:36 +0100208 mbedtls_ssl_get_set_timer( ssl )( ssl->p_timer,
209 millisecs / 4,
210 millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200211}
212
213/*
214 * Return -1 is timer is expired, 0 if it isn't.
215 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200216static int ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200217{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100218 if( mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +0200219 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200220
Hanno Becker0ae6b242019-06-13 16:45:36 +0100221 if( mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200222 {
223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200224 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200225 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200226
227 return( 0 );
228}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200229
Hanno Becker5aa4e2c2018-08-06 09:26:08 +0100230static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
231 mbedtls_ssl_transform *transform );
Hanno Beckerf5970a02019-05-08 09:38:41 +0100232static void ssl_update_in_pointers( mbedtls_ssl_context *ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100233
Hanno Becker02f26092019-07-03 16:13:00 +0100234#if defined(MBEDTLS_SSL_RECORD_CHECKING)
Hanno Becker03e2db62019-07-12 14:40:00 +0100235static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
236 unsigned char *buf,
237 size_t len,
238 mbedtls_record *rec );
239
Hanno Becker02f26092019-07-03 16:13:00 +0100240int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl,
241 unsigned char *buf,
242 size_t buflen )
243{
Andrzej Kurekfd56f402020-05-25 11:52:05 -0400244 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker03e2db62019-07-12 14:40:00 +0100245 mbedtls_record rec;
246 MBEDTLS_SSL_DEBUG_MSG( 1, ( "=> mbedtls_ssl_check_record" ) );
247 MBEDTLS_SSL_DEBUG_BUF( 3, "record buffer", buf, buflen );
248
249 /* We don't support record checking in TLS because
250 * (a) there doesn't seem to be a usecase for it, and
251 * (b) In SSLv3 and TLS 1.0, CBC record decryption has state
252 * and we'd need to backup the transform here.
253 */
254#if defined(MBEDTLS_SSL_PROTO_TLS)
255 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
256 {
257 ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
258 goto exit;
259 }
260 MBEDTLS_SSL_TRANSPORT_ELSE
261#endif /* MBEDTLS_SSL_PROTO_TLS */
262#if defined(MBEDTLS_SSL_PROTO_DTLS)
263 {
264 ret = ssl_parse_record_header( ssl, buf, buflen, &rec );
265 if( ret != 0 )
266 {
267 MBEDTLS_SSL_DEBUG_RET( 3, "ssl_parse_record_header", ret );
268 goto exit;
269 }
270
271 if( ssl->transform_in != NULL )
272 {
273 ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in, &rec );
274 if( ret != 0 )
275 {
276 MBEDTLS_SSL_DEBUG_RET( 3, "mbedtls_ssl_decrypt_buf", ret );
277 goto exit;
278 }
279 }
280 }
281#endif /* MBEDTLS_SSL_PROTO_DTLS */
282
283exit:
284 /* On success, we have decrypted the buffer in-place, so make
285 * sure we don't leak any plaintext data. */
286 mbedtls_platform_zeroize( buf, buflen );
287
288 /* For the purpose of this API, treat messages with unexpected CID
289 * as well as such from future epochs as unexpected. */
290 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID ||
291 ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
292 {
293 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
294 }
295
296 MBEDTLS_SSL_DEBUG_MSG( 1, ( "<= mbedtls_ssl_check_record" ) );
297 return( ret );
Hanno Becker02f26092019-07-03 16:13:00 +0100298}
299#endif /* MBEDTLS_SSL_RECORD_CHECKING */
300
Hanno Becker67bc7c32018-08-06 11:33:50 +0100301#define SSL_DONT_FORCE_FLUSH 0
302#define SSL_FORCE_FLUSH 1
303
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200304#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +0100305
Hanno Beckera5a2b082019-05-15 14:03:01 +0100306#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100307/* Top-level Connection ID API */
308
Hanno Beckere0200da2019-06-13 09:23:43 +0100309#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
310 !defined(MBEDTLS_SSL_CONF_CID_LEN) && \
311 !defined(MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +0100312int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
313 size_t len,
314 int ignore_other_cid )
Hanno Beckereec2be92019-05-03 13:06:44 +0100315{
316 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
317 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
318
Hanno Becker791ec6b2019-05-14 11:45:26 +0100319 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
320 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
321 {
322 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
323 }
324
325 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckereec2be92019-05-03 13:06:44 +0100326 conf->cid_len = len;
327 return( 0 );
328}
Hanno Beckere0200da2019-06-13 09:23:43 +0100329#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
330 !MBEDTLS_SSL_CONF_CID_LEN &&
331 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
332
333#if MBEDTLS_SSL_CONF_CID_LEN > MBEDTLS_SSL_CID_IN_LEN_MAX
334#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_CID_LEN"
335#endif
336#if MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE && \
337 MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_FAIL
338#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID"
339#endif
340
341#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
342 !MBEDTLS_SSL_CONF_CID_LEN &&
343 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
Hanno Beckereec2be92019-05-03 13:06:44 +0100344
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100345int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
346 int enable,
347 unsigned char const *own_cid,
348 size_t own_cid_len )
349{
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200350 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker78c43022019-05-03 14:38:32 +0100351 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
352
Hanno Becker07489862019-04-25 16:01:49 +0100353 ssl->negotiate_cid = enable;
354 if( enable == MBEDTLS_SSL_CID_DISABLED )
355 {
356 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
357 return( 0 );
358 }
359 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckereec2be92019-05-03 13:06:44 +0100360 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Becker07489862019-04-25 16:01:49 +0100361
Hanno Beckere0200da2019-06-13 09:23:43 +0100362 if( own_cid_len != mbedtls_ssl_conf_get_cid_len( ssl->conf ) )
Hanno Becker07489862019-04-25 16:01:49 +0100363 {
Hanno Beckereec2be92019-05-03 13:06:44 +0100364 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
365 (unsigned) own_cid_len,
Hanno Beckere0200da2019-06-13 09:23:43 +0100366 (unsigned) mbedtls_ssl_conf_get_cid_len( ssl->conf ) ) );
Hanno Becker07489862019-04-25 16:01:49 +0100367 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
368 }
369
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300370 /* Not using more secure mbedtls_platform_memcpy as cid is public */
371 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb4a56062019-04-30 14:07:31 +0100372 /* Truncation is not an issue here because
373 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
374 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Becker07489862019-04-25 16:01:49 +0100375
Andrzej Kurekafec8852020-07-15 16:31:27 -0400376 return( 0 );
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100377}
378
379int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
380 int *enabled,
381 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
382 size_t *peer_cid_len )
383{
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100384 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Becker2de89fa2019-04-26 17:08:02 +0100385
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200386 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker78c43022019-05-03 14:38:32 +0100387 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
388 {
Hanno Becker2de89fa2019-04-26 17:08:02 +0100389 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker78c43022019-05-03 14:38:32 +0100390 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100391
Hanno Beckercb063f52019-05-03 12:54:52 +0100392 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
393 * were used, but client and server requested the empty CID.
394 * This is indistinguishable from not using the CID extension
395 * in the first place. */
Hanno Becker2de89fa2019-04-26 17:08:02 +0100396 if( ssl->transform_in->in_cid_len == 0 &&
397 ssl->transform_in->out_cid_len == 0 )
398 {
399 return( 0 );
400 }
401
Hanno Becker633d6042019-05-22 16:50:35 +0100402 if( peer_cid_len != NULL )
403 {
404 *peer_cid_len = ssl->transform_in->out_cid_len;
405 if( peer_cid != NULL )
406 {
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300407 /* Not using more secure mbedtls_platform_memcpy as cid is public */
408 memcpy( peer_cid, ssl->transform_in->out_cid,
Hanno Becker633d6042019-05-22 16:50:35 +0100409 ssl->transform_in->out_cid_len );
410 }
411 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100412
413 *enabled = MBEDTLS_SSL_CID_ENABLED;
414
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100415 return( 0 );
416}
Hanno Beckera5a2b082019-05-15 14:03:01 +0100417#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100418
Hanno Beckerd5847772018-08-28 10:09:23 +0100419/* Forward declarations for functions related to message buffering. */
420static void ssl_buffering_free( mbedtls_ssl_context *ssl );
421static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
422 uint8_t slot );
423static void ssl_free_buffered_record( mbedtls_ssl_context *ssl );
424static int ssl_load_buffered_message( mbedtls_ssl_context *ssl );
425static int ssl_load_buffered_record( mbedtls_ssl_context *ssl );
426static int ssl_buffer_message( mbedtls_ssl_context *ssl );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +0100427static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
428 mbedtls_record const *rec );
Hanno Beckeref7afdf2018-08-28 17:16:31 +0100429static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl );
Hanno Beckerd5847772018-08-28 10:09:23 +0100430
Hanno Beckera67dee22018-08-22 10:05:20 +0100431static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl );
Hanno Becker11682cc2018-08-22 14:41:02 +0100432static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context const *ssl )
Hanno Becker2b1e3542018-08-06 11:19:13 +0100433{
Hanno Becker11682cc2018-08-22 14:41:02 +0100434 size_t mtu = ssl_get_current_mtu( ssl );
Andrzej Kurekf3844952020-10-16 23:03:01 +0200435#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
436 size_t out_buf_len = ssl->out_buf_len;
437#else
438 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
439#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +0100440
Andrzej Kurekf3844952020-10-16 23:03:01 +0200441 if( mtu != 0 && mtu < out_buf_len )
Hanno Becker11682cc2018-08-22 14:41:02 +0100442 return( mtu );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100443
Andrzej Kurekf3844952020-10-16 23:03:01 +0200444 return( out_buf_len );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100445}
446
Hanno Becker67bc7c32018-08-06 11:33:50 +0100447static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
448{
Hanno Becker11682cc2018-08-22 14:41:02 +0100449 size_t const bytes_written = ssl->out_left;
450 size_t const mtu = ssl_get_maximum_datagram_size( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100451
452 /* Double-check that the write-index hasn't gone
453 * past what we can transmit in a single datagram. */
Hanno Becker11682cc2018-08-22 14:41:02 +0100454 if( bytes_written > mtu )
Hanno Becker67bc7c32018-08-06 11:33:50 +0100455 {
456 /* Should never happen... */
457 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
458 }
459
460 return( (int) ( mtu - bytes_written ) );
461}
462
463static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl )
464{
465 int ret;
466 size_t remaining, expansion;
Andrzej Kurek748face2018-10-11 07:20:19 -0400467 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100468
469#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +0200470 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100471
472 if( max_len > mfl )
473 max_len = mfl;
Hanno Beckerf4b010e2018-08-24 10:47:29 +0100474
475 /* By the standard (RFC 6066 Sect. 4), the MFL extension
476 * only limits the maximum record payload size, so in theory
477 * we would be allowed to pack multiple records of payload size
478 * MFL into a single datagram. However, this would mean that there's
479 * no way to explicitly communicate MTU restrictions to the peer.
480 *
481 * The following reduction of max_len makes sure that we never
482 * write datagrams larger than MFL + Record Expansion Overhead.
483 */
484 if( max_len <= ssl->out_left )
485 return( 0 );
486
487 max_len -= ssl->out_left;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100488#endif
489
490 ret = ssl_get_remaining_space_in_datagram( ssl );
491 if( ret < 0 )
492 return( ret );
493 remaining = (size_t) ret;
494
495 ret = mbedtls_ssl_get_record_expansion( ssl );
496 if( ret < 0 )
497 return( ret );
498 expansion = (size_t) ret;
499
500 if( remaining <= expansion )
501 return( 0 );
502
503 remaining -= expansion;
504 if( remaining >= max_len )
505 remaining = max_len;
506
507 return( (int) remaining );
508}
509
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200510/*
511 * Double the retransmit timeout value, within the allowed range,
512 * returning -1 if the maximum value has already been reached.
513 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200514static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200515{
516 uint32_t new_timeout;
517
Hanno Becker1f835fa2019-06-13 10:14:59 +0100518 if( ssl->handshake->retransmit_timeout >=
519 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
520 {
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200521 return( -1 );
Hanno Becker1f835fa2019-06-13 10:14:59 +0100522 }
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200523
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200524 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
525 * in the following way: after the initial transmission and a first
526 * retransmission, back off to a temporary estimated MTU of 508 bytes.
527 * This value is guaranteed to be deliverable (if not guaranteed to be
528 * delivered) of any compliant IPv4 (and IPv6) network, and should work
529 * on most non-IP stacks too. */
Hanno Becker1f835fa2019-06-13 10:14:59 +0100530 if( ssl->handshake->retransmit_timeout !=
531 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) )
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400532 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200533 ssl->handshake->mtu = 508;
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400534 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl->handshake->mtu ) );
535 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200536
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200537 new_timeout = 2 * ssl->handshake->retransmit_timeout;
538
539 /* Avoid arithmetic overflow and range overflow */
540 if( new_timeout < ssl->handshake->retransmit_timeout ||
Hanno Becker1f835fa2019-06-13 10:14:59 +0100541 new_timeout > mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200542 {
Hanno Becker1f835fa2019-06-13 10:14:59 +0100543 new_timeout = mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200544 }
545
546 ssl->handshake->retransmit_timeout = new_timeout;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200547 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200548 ssl->handshake->retransmit_timeout ) );
549
550 return( 0 );
551}
552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200553static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200554{
Hanno Becker1f835fa2019-06-13 10:14:59 +0100555 ssl->handshake->retransmit_timeout = mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200556 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200557 ssl->handshake->retransmit_timeout ) );
558}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200559#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200560
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200561#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200562/*
563 * Convert max_fragment_length codes to length.
564 * RFC 6066 says:
565 * enum{
566 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
567 * } MaxFragmentLength;
568 * and we add 0 -> extension unused
569 */
Angus Grattond8213d02016-05-25 20:56:48 +1000570static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200571{
Angus Grattond8213d02016-05-25 20:56:48 +1000572 switch( mfl )
573 {
574 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300575 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000576 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
577 return 512;
578 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
579 return 1024;
580 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
581 return 2048;
582 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
583 return 4096;
584 default:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300585 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000586 }
587}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200588#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200589
Hanno Becker58fccf22019-02-06 14:30:46 +0000590int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
591 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200592{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200593 mbedtls_ssl_session_free( dst );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300594 mbedtls_platform_memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200595
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerd5258fa2019-02-07 12:27:42 +0000597
598#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200599 if( src->peer_cert != NULL )
600 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200601 int ret;
602
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200603 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200604 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200605 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200607 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200608
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200609 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200610 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200611 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200612 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200613 dst->peer_cert = NULL;
614 return( ret );
615 }
616 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100617#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000618 if( src->peer_cert_digest != NULL )
619 {
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000620 dst->peer_cert_digest =
Hanno Becker9d64b782019-02-25 10:06:59 +0000621 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000622 if( dst->peer_cert_digest == NULL )
623 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
624
Teppo Järvelin91d79382019-10-02 09:09:31 +0300625 mbedtls_platform_memcpy( dst->peer_cert_digest, src->peer_cert_digest,
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000626 src->peer_cert_digest_len );
627 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Becker9d64b782019-02-25 10:06:59 +0000628 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000629 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100630#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200632#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200633
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200634#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200635 if( src->ticket != NULL )
636 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200637 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200638 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200639 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200640
Teppo Järvelin91d79382019-10-02 09:09:31 +0300641 mbedtls_platform_memcpy( dst->ticket, src->ticket, src->ticket_len );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200642 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200643#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200644
645 return( 0 );
646}
647
Andrzej Kurekf3844952020-10-16 23:03:01 +0200648#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
649static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
650{
651 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
652 if( resized_buffer == NULL )
653 return -1;
654
655 /* We want to copy len_new bytes when downsizing the buffer, and
656 * len_old bytes when upsizing, so we choose the smaller of two sizes,
657 * to fit one buffer into another. Size checks, ensuring that no data is
658 * lost, are done outside of this function. */
659 memcpy( resized_buffer, *buffer,
660 ( len_new < *len_old ) ? len_new : *len_old );
661 mbedtls_platform_zeroize( *buffer, *len_old );
662 mbedtls_free( *buffer );
663
664 *buffer = resized_buffer;
665 *len_old = len_new;
666
667 return 0;
668}
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200669
670static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
671 uint32_t in_buf_new_len,
672 uint32_t out_buf_new_len )
673{
674 int modified = 0;
675 size_t written_in = 0, len_offset_in = 0;
676 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
677 if( ssl->in_buf != NULL )
678 {
679 written_in = ssl->in_msg - ssl->in_buf;
680 len_offset_in = ssl->in_len - ssl->in_buf;
681 if( ( downsizing && ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len ) ||
682 ( !downsizing && ssl->in_buf_len < in_buf_new_len ) )
683 {
684 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
685 {
686 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
687 }
688 else
689 {
690 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %d", in_buf_new_len ) );
691 modified = 1;
692 }
693 }
694 }
695
696 if( ssl->out_buf != NULL )
697 {
698 written_out = ssl->out_msg - ssl->out_buf;
699 iv_offset_out = ssl->out_iv - ssl->out_buf;
700 len_offset_out = ssl->out_len - ssl->out_buf;
701 if( ( downsizing && ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len ) ||
702 ( !downsizing && ssl->out_buf_len < out_buf_new_len ) )
703 {
704 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
705 {
706 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
707 }
708 else
709 {
710 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %d", out_buf_new_len ) );
711 modified = 1;
712 }
713 }
714 }
715 if( modified )
716 {
717 /* Update pointers here to avoid doing it twice. */
718 ssl_reset_in_out_pointers( ssl );
719 /* Fields below might not be properly updated with record
720 * splitting or with CID, so they are manually updated here. */
721 ssl->out_msg = ssl->out_buf + written_out;
722 ssl->out_len = ssl->out_buf + len_offset_out;
723 ssl->out_iv = ssl->out_buf + iv_offset_out;
724
725 ssl->in_msg = ssl->in_buf + written_in;
726 ssl->in_len = ssl->in_buf + len_offset_in;
727 }
728}
Andrzej Kurekf3844952020-10-16 23:03:01 +0200729#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
730
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200731#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
732int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
Paul Bakker9af723c2014-05-01 13:03:14 +0200733 const unsigned char *key_enc, const unsigned char *key_dec,
734 size_t keylen,
735 const unsigned char *iv_enc, const unsigned char *iv_dec,
736 size_t ivlen,
737 const unsigned char *mac_enc, const unsigned char *mac_dec,
Paul Bakker66d5d072014-06-17 16:39:18 +0200738 size_t maclen ) = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
740int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
741int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
742int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
743int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
744#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000745
Paul Bakker5121ce52009-01-03 21:22:43 +0000746/*
747 * Key material generation
748 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200749#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +0100750MBEDTLS_NO_INLINE static int ssl3_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200751 const char *label,
752 const unsigned char *random, size_t rlen,
Paul Bakker5f70b252012-09-13 14:23:06 +0000753 unsigned char *dstbuf, size_t dlen )
754{
Andres Amaya Garcia33952502017-07-20 16:29:16 +0100755 int ret = 0;
Paul Bakker5f70b252012-09-13 14:23:06 +0000756 size_t i;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200757 mbedtls_md5_context md5;
758 mbedtls_sha1_context sha1;
Paul Bakker5f70b252012-09-13 14:23:06 +0000759 unsigned char padding[16];
760 unsigned char sha1sum[20];
Andrzej Kurekafec8852020-07-15 16:31:27 -0400761 ((void)label);
Paul Bakker5f70b252012-09-13 14:23:06 +0000762
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200763 mbedtls_md5_init( &md5 );
764 mbedtls_sha1_init( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +0200765
Paul Bakker5f70b252012-09-13 14:23:06 +0000766 /*
767 * SSLv3:
768 * block =
769 * MD5( secret + SHA1( 'A' + secret + random ) ) +
770 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
771 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
772 * ...
773 */
774 for( i = 0; i < dlen / 16; i++ )
775 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200776 mbedtls_platform_memset( padding, (unsigned char) ('A' + i), 1 + i );
Paul Bakker5f70b252012-09-13 14:23:06 +0000777
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100778 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100779 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100780 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100781 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100782 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100783 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100784 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100785 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100786 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100787 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000788
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100789 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100790 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100791 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100792 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100793 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100794 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100795 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100796 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000797 }
798
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100799exit:
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200800 mbedtls_md5_free( &md5 );
801 mbedtls_sha1_free( &sha1 );
Paul Bakker5f70b252012-09-13 14:23:06 +0000802
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500803 mbedtls_platform_zeroize( padding, sizeof( padding ) );
804 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5f70b252012-09-13 14:23:06 +0000805
Andrzej Kurekafec8852020-07-15 16:31:27 -0400806 return( ret );
Paul Bakker5f70b252012-09-13 14:23:06 +0000807}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200808#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +0000809
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200810#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +0100811MBEDTLS_NO_INLINE static int tls1_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200812 const char *label,
813 const unsigned char *random, size_t rlen,
Paul Bakker23986e52011-04-24 08:57:21 +0000814 unsigned char *dstbuf, size_t dlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000815{
Paul Bakker23986e52011-04-24 08:57:21 +0000816 size_t nb, hs;
817 size_t i, j, k;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200818 const unsigned char *S1, *S2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000819 unsigned char tmp[128];
820 unsigned char h_i[20];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100821 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200822 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100823 int ret;
824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200825 mbedtls_md_init( &md_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +0000826
827 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200828 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000829
830 hs = ( slen + 1 ) / 2;
831 S1 = secret;
832 S2 = secret + slen - hs;
833
834 nb = strlen( label );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300835 mbedtls_platform_memcpy( tmp + 20, label, nb );
836 mbedtls_platform_memcpy( tmp + 20 + nb, random, rlen );
Paul Bakker5121ce52009-01-03 21:22:43 +0000837 nb += rlen;
838
839 /*
840 * First compute P_md5(secret,label+random)[0..dlen]
841 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100842 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) ==
843 MBEDTLS_MD_INVALID_HANDLE )
844 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200845 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100846 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100847
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200848 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100849 return( ret );
850
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200851 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
852 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
853 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000854
855 for( i = 0; i < dlen; i += 16 )
856 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200857 mbedtls_md_hmac_reset ( &md_ctx );
858 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
859 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100860
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200861 mbedtls_md_hmac_reset ( &md_ctx );
862 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
863 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000864
865 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
866
867 for( j = 0; j < k; j++ )
868 dstbuf[i + j] = h_i[j];
869 }
870
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200871 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100872
Paul Bakker5121ce52009-01-03 21:22:43 +0000873 /*
874 * XOR out with P_sha1(secret,label+random)[0..dlen]
875 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100876 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) ==
877 MBEDTLS_MD_INVALID_HANDLE )
878 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200879 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100880 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200882 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100883 return( ret );
884
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200885 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
886 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
887 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000888
889 for( i = 0; i < dlen; i += 20 )
890 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200891 mbedtls_md_hmac_reset ( &md_ctx );
892 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
893 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100894
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200895 mbedtls_md_hmac_reset ( &md_ctx );
896 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
897 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000898
899 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
900
901 for( j = 0; j < k; j++ )
902 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
903 }
904
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200905 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100906
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500907 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
908 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000909
Andrzej Kurekafec8852020-07-15 16:31:27 -0400910 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000911}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200912#endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000913
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200914#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerf6cc7422019-08-16 14:34:52 +0100915#if !( defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_SHA512_C) )
916MBEDTLS_ALWAYS_INLINE static inline
917#else
918static
919#endif
920int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100921 const unsigned char *secret, size_t slen,
922 const char *label,
923 const unsigned char *random, size_t rlen,
924 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000925{
926 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100927 size_t i, j, k, md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000928 unsigned char tmp[128];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200929 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100930 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200931 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100932 int ret;
933
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200934 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000935
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100936 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) ==
937 MBEDTLS_MD_INVALID_HANDLE )
938 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200939 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100940 }
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200942 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100943
944 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000946
947 nb = strlen( label );
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200948 (void)mbedtls_platform_memcpy( tmp + md_len, label, nb );
949 (void)mbedtls_platform_memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000950 nb += rlen;
951
952 /*
953 * Compute P_<hash>(secret, label + random)[0..dlen]
954 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200955 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100956 return( ret );
957
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200958 if ( ( ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen ) ) != 0 )
959 return( ret );
960 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb ) ) != 0 )
961 return( ret );
962 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
963 return( ret );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100964
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100965 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000966 {
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200967 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
968 return( ret );
969 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb ) ) != 0 )
970 return( ret );
971 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, h_i ) ) != 0 )
972 return( ret );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100973
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200974 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
975 return( ret );
976 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len ) ) != 0 )
977 return( ret );
978 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
979 return( ret );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000980
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100981 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000982
983 for( j = 0; j < k; j++ )
984 dstbuf[i + j] = h_i[j];
985 }
986
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200987 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100988
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200989 (void)mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
990 (void)mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000991
Andrzej Kurekafec8852020-07-15 16:31:27 -0400992 return( 0 );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000993}
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100994
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200995#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +0100996MBEDTLS_NO_INLINE static int tls_prf_sha256(
997 const unsigned char *secret, size_t slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100998 const char *label,
999 const unsigned char *random, size_t rlen,
1000 unsigned char *dstbuf, size_t dlen )
1001{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001002 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001003 label, random, rlen, dstbuf, dlen ) );
1004}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001005#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +00001006
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001007#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001008MBEDTLS_NO_INLINE static int tls_prf_sha384(
1009 const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02001010 const char *label,
1011 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001012 unsigned char *dstbuf, size_t dlen )
1013{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001014 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001015 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001016}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001017#endif /* MBEDTLS_SHA512_C */
1018#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +00001019
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001020/*
1021 * Call the appropriate PRF function
1022 */
Hanno Becker2793f742019-08-16 14:28:43 +01001023MBEDTLS_ALWAYS_INLINE static inline int ssl_prf( int minor_ver,
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001024 mbedtls_md_type_t hash,
1025 const unsigned char *secret, size_t slen,
1026 const char *label,
1027 const unsigned char *random, size_t rlen,
1028 unsigned char *dstbuf, size_t dlen )
1029{
1030#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1031 (void) hash;
1032#endif
1033
1034#if defined(MBEDTLS_SSL_PROTO_SSL3)
1035 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1036 return( ssl3_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
1037 else
1038#endif
1039#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001040 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001041 return( tls1_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
1042 else
1043#endif
1044#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1045#if defined(MBEDTLS_SHA512_C)
1046 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1047 hash == MBEDTLS_MD_SHA384 )
1048 {
1049 return( tls_prf_sha384( secret, slen, label, random, rlen,
1050 dstbuf, dlen ) );
1051 }
1052 else
1053#endif
1054#if defined(MBEDTLS_SHA256_C)
1055 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1056 {
1057 return( tls_prf_sha256( secret, slen, label, random, rlen,
1058 dstbuf, dlen ) );
1059 }
1060#endif
1061#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1062
1063 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1064}
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001065
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001066#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +01001067MBEDTLS_NO_INLINE static void ssl_calc_finished_ssl(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001068 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1069{
1070 const char *sender;
1071 mbedtls_md5_context md5;
1072 mbedtls_sha1_context sha1;
1073
1074 unsigned char padbuf[48];
1075 unsigned char md5sum[16];
1076 unsigned char sha1sum[20];
1077
1078 mbedtls_ssl_session *session = ssl->session_negotiate;
1079 if( !session )
1080 session = ssl->session;
1081
1082 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
1083
1084 mbedtls_md5_init( &md5 );
1085 mbedtls_sha1_init( &sha1 );
1086
1087 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1088 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1089
1090 /*
1091 * SSLv3:
1092 * hash =
1093 * MD5( master + pad2 +
1094 * MD5( handshake + sender + master + pad1 ) )
1095 * + SHA1( master + pad2 +
1096 * SHA1( handshake + sender + master + pad1 ) )
1097 */
1098
1099#if !defined(MBEDTLS_MD5_ALT)
1100 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1101 md5.state, sizeof( md5.state ) );
1102#endif
1103
1104#if !defined(MBEDTLS_SHA1_ALT)
1105 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1106 sha1.state, sizeof( sha1.state ) );
1107#endif
1108
1109 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
1110 : "SRVR";
1111
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001112 mbedtls_platform_memset( padbuf, 0x36, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001113
1114 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
1115 mbedtls_md5_update_ret( &md5, session->master, 48 );
1116 mbedtls_md5_update_ret( &md5, padbuf, 48 );
1117 mbedtls_md5_finish_ret( &md5, md5sum );
1118
1119 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
1120 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
1121 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
1122 mbedtls_sha1_finish_ret( &sha1, sha1sum );
1123
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001124 mbedtls_platform_memset( padbuf, 0x5C, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001125
1126 mbedtls_md5_starts_ret( &md5 );
1127 mbedtls_md5_update_ret( &md5, session->master, 48 );
1128 mbedtls_md5_update_ret( &md5, padbuf, 48 );
1129 mbedtls_md5_update_ret( &md5, md5sum, 16 );
1130 mbedtls_md5_finish_ret( &md5, buf );
1131
1132 mbedtls_sha1_starts_ret( &sha1 );
1133 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
1134 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
1135 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
1136 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
1137
1138 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
1139
1140 mbedtls_md5_free( &md5 );
1141 mbedtls_sha1_free( &sha1 );
1142
1143 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1144 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
1145 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
1146
1147 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1148}
1149#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1150
1151#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +01001152MBEDTLS_NO_INLINE static void ssl_calc_finished_tls(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001153 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1154{
1155 int len = 12;
1156 const char *sender;
1157 mbedtls_md5_context md5;
1158 mbedtls_sha1_context sha1;
1159 unsigned char padbuf[36];
1160
1161 mbedtls_ssl_session *session = ssl->session_negotiate;
1162 if( !session )
1163 session = ssl->session;
1164
1165 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
1166
1167 mbedtls_md5_init( &md5 );
1168 mbedtls_sha1_init( &sha1 );
1169
1170 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1171 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1172
1173 /*
1174 * TLSv1:
1175 * hash = PRF( master, finished_label,
1176 * MD5( handshake ) + SHA1( handshake ) )[0..11]
1177 */
1178
1179#if !defined(MBEDTLS_MD5_ALT)
1180 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1181 md5.state, sizeof( md5.state ) );
1182#endif
1183
1184#if !defined(MBEDTLS_SHA1_ALT)
1185 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1186 sha1.state, sizeof( sha1.state ) );
1187#endif
1188
1189 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1190 ? "client finished"
1191 : "server finished";
1192
1193 mbedtls_md5_finish_ret( &md5, padbuf );
1194 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
1195
1196 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1197 mbedtls_ssl_suite_get_mac(
1198 mbedtls_ssl_ciphersuite_from_id(
1199 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1200 session->master, 48, sender,
1201 padbuf, 36, buf, len );
1202
1203 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1204
1205 mbedtls_md5_free( &md5 );
1206 mbedtls_sha1_free( &sha1 );
1207
1208 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1209
1210 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1211}
1212#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1213
1214#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1215#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001216MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha256(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001217 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1218{
1219 int len = 12;
1220 const char *sender;
1221 mbedtls_sha256_context sha256;
1222 unsigned char padbuf[32];
1223
1224 mbedtls_ssl_session *session = ssl->session_negotiate;
1225 if( !session )
1226 session = ssl->session;
1227
1228 mbedtls_sha256_init( &sha256 );
1229
1230 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
1231
1232 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1233
1234 /*
1235 * TLSv1.2:
1236 * hash = PRF( master, finished_label,
1237 * Hash( handshake ) )[0.11]
1238 */
1239
1240#if !defined(MBEDTLS_SHA256_ALT)
1241 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
1242 sha256.state, sizeof( sha256.state ) );
1243#endif
1244
1245 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1246 ? "client finished"
1247 : "server finished";
1248
1249 mbedtls_sha256_finish_ret( &sha256, padbuf );
1250
1251 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1252 mbedtls_ssl_suite_get_mac(
1253 mbedtls_ssl_ciphersuite_from_id(
1254 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1255 session->master, 48, sender,
1256 padbuf, 32, buf, len );
1257
1258 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1259
1260 mbedtls_sha256_free( &sha256 );
1261
1262 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1263
1264 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1265}
1266#endif /* MBEDTLS_SHA256_C */
1267
1268#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001269MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha384(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001270 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1271{
1272 int len = 12;
1273 const char *sender;
1274 mbedtls_sha512_context sha512;
1275 unsigned char padbuf[48];
1276
1277 mbedtls_ssl_session *session = ssl->session_negotiate;
1278 if( !session )
1279 session = ssl->session;
1280
1281 mbedtls_sha512_init( &sha512 );
1282
1283 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
1284
1285 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1286
1287 /*
1288 * TLSv1.2:
1289 * hash = PRF( master, finished_label,
1290 * Hash( handshake ) )[0.11]
1291 */
1292
1293#if !defined(MBEDTLS_SHA512_ALT)
1294 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
1295 sha512.state, sizeof( sha512.state ) );
1296#endif
1297
1298 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1299 ? "client finished"
1300 : "server finished";
1301
1302 mbedtls_sha512_finish_ret( &sha512, padbuf );
1303
1304 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1305 mbedtls_ssl_suite_get_mac(
1306 mbedtls_ssl_ciphersuite_from_id(
1307 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1308 session->master, 48, sender,
1309 padbuf, 48, buf, len );
1310
1311 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1312
1313 mbedtls_sha512_free( &sha512 );
1314
1315 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1316
1317 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1318}
1319#endif /* MBEDTLS_SHA512_C */
1320#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1321
Hanno Becker2793f742019-08-16 14:28:43 +01001322MBEDTLS_ALWAYS_INLINE static inline int ssl_calc_finished(
1323 int minor_ver,
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001324 mbedtls_md_type_t hash,
1325 mbedtls_ssl_context *ssl,
1326 unsigned char *buf,
1327 int from )
1328{
1329#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1330 (void) hash;
1331#endif
1332
1333#if defined(MBEDTLS_SSL_PROTO_SSL3)
1334 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1335 ssl_calc_finished_ssl( ssl, buf, from );
1336 else
1337#endif
1338#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001339 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001340 ssl_calc_finished_tls( ssl, buf, from );
1341 else
1342#endif
1343#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1344#if defined(MBEDTLS_SHA512_C)
1345 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1346 hash == MBEDTLS_MD_SHA384 )
1347 {
1348 ssl_calc_finished_tls_sha384( ssl, buf, from );
1349 }
1350 else
1351#endif
1352#if defined(MBEDTLS_SHA256_C)
1353 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1354 ssl_calc_finished_tls_sha256( ssl, buf, from );
1355 else
1356#endif
1357#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1358 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1359
1360 return( 0 );
1361}
1362
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001363/*
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001364 * Populate a transform structure with session keys and all the other
1365 * necessary information.
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001366 *
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001367 * Parameters:
1368 * - [in/out]: transform: structure to populate
1369 * [in] must be just initialised with mbedtls_ssl_transform_init()
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001370 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001371 * - [in] ciphersuite
1372 * - [in] master
1373 * - [in] encrypt_then_mac
1374 * - [in] trunc_hmac
1375 * - [in] compression
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001376 * - [in] tls_prf: pointer to PRF to use for key derivation
1377 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001378 * - [in] minor_ver: SSL/TLS minor version
1379 * - [in] endpoint: client or server
1380 * - [in] ssl: optionally used for:
1381 * - MBEDTLS_SSL_HW_RECORD_ACCEL: whole context
1382 * - MBEDTLS_SSL_EXPORT_KEYS: ssl->conf->{f,p}_export_keys
1383 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001384 */
Hanno Becker298a4702019-08-16 10:21:32 +01001385/* Force compilers to inline this function if it's used only
1386 * from one place, because at least ARMC5 doesn't do that
1387 * automatically. */
1388#if !defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
1389MBEDTLS_ALWAYS_INLINE static inline
1390#else
1391static
1392#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
1393int ssl_populate_transform( mbedtls_ssl_transform *transform,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001394 int ciphersuite,
1395 const unsigned char master[48],
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001396#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001397#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1398 int encrypt_then_mac,
1399#endif
1400#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1401 int trunc_hmac,
1402#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001403#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001404#if defined(MBEDTLS_ZLIB_SUPPORT)
1405 int compression,
1406#endif
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001407 const unsigned char randbytes[64],
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001408 int minor_ver,
1409 unsigned endpoint,
Manuel Pégourié-Gonnard13bebd02020-03-13 11:28:19 +01001410#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1411 const
1412#endif
1413 mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001414{
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001415 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001416 unsigned char keyblk[256];
1417 unsigned char *key1;
1418 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +01001419 unsigned char *mac_enc;
1420 unsigned char *mac_dec;
Hanno Becker81c7b182017-11-09 18:39:33 +00001421 size_t mac_key_len;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001422 size_t iv_copy_len;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001423 unsigned keylen;
Hanno Becker473f98f2019-06-26 10:27:32 +01001424 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001425 const mbedtls_cipher_info_t *cipher_info;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001426 mbedtls_md_handle_t md_info;
Paul Bakker68884e32013-01-07 18:20:04 +01001427
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001428#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \
1429 !defined(MBEDTLS_SSL_EXPORT_KEYS) && \
1430 !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02001431 ssl = NULL; /* make sure we don't use it except for those cases */
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001432 (void) ssl;
Hanno Becker3307b532017-12-27 21:37:21 +00001433#endif
Hanno Becker3307b532017-12-27 21:37:21 +00001434
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001435 /*
1436 * Some data just needs copying into the structure
1437 */
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001438#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
1439 defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001440 transform->encrypt_then_mac = encrypt_then_mac;
Paul Bakker5121ce52009-01-03 21:22:43 +00001441#endif
Hanno Becker0a92b812019-06-24 15:46:40 +01001442
1443#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001444 transform->minor_ver = minor_ver;
Hanno Becker0a92b812019-06-24 15:46:40 +01001445#else
1446 ((void) minor_ver);
1447#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Paul Bakker5121ce52009-01-03 21:22:43 +00001448
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001449#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Teppo Järvelin91d79382019-10-02 09:09:31 +03001450 mbedtls_platform_memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001451#endif
1452
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001453 /*
1454 * Get various info structures
1455 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001456 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
Hanno Becker473f98f2019-06-26 10:27:32 +01001457 if( ciphersuite_info == MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE )
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001458 {
1459 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001460 ciphersuite ) );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001461 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1462 }
1463
Hanno Becker473f98f2019-06-26 10:27:32 +01001464 cipher_info = mbedtls_cipher_info_from_type(
1465 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) );
Paul Bakker68884e32013-01-07 18:20:04 +01001466 if( cipher_info == NULL )
1467 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001468 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001469 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001470 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001471 }
1472
Hanno Becker473f98f2019-06-26 10:27:32 +01001473 md_info = mbedtls_md_info_from_type(
1474 mbedtls_ssl_suite_get_mac( ciphersuite_info ) );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001475 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Paul Bakker68884e32013-01-07 18:20:04 +01001476 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001477 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001478 mbedtls_ssl_suite_get_mac( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001479 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001480 }
1481
Hanno Beckera5a2b082019-05-15 14:03:01 +01001482#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001483 /* Copy own and peer's CID if the use of the CID
1484 * extension has been negotiated. */
1485 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
1486 {
1487 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
Hanno Beckerd91dc372019-04-30 13:52:29 +01001488
Hanno Becker4932f9f2019-05-03 15:23:51 +01001489 transform->in_cid_len = ssl->own_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001490 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1491 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
Hanno Becker8013b272019-05-03 12:55:51 +01001492 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001493 transform->in_cid_len );
Hanno Beckere582d122019-05-15 10:21:55 +01001494
1495 transform->out_cid_len = ssl->handshake->peer_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001496 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1497 memcpy( transform->out_cid, ssl->handshake->peer_cid,
Hanno Beckere582d122019-05-15 10:21:55 +01001498 ssl->handshake->peer_cid_len );
1499 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
1500 transform->out_cid_len );
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001501 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01001502#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001503
Paul Bakker5121ce52009-01-03 21:22:43 +00001504 /*
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001505 * Compute key block using the PRF
Paul Bakker1ef83d62012-04-11 12:09:53 +00001506 */
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001507 ret = ssl_prf( minor_ver,
1508 mbedtls_ssl_suite_get_mac( ciphersuite_info ),
1509 master, 48, "key expansion", randbytes, 64,
1510 keyblk, 256 );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001511 if( ret != 0 )
1512 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001513 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001514 return( ret );
1515 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001517 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02001518 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001519 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001520 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001521 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001522
Paul Bakker5121ce52009-01-03 21:22:43 +00001523 /*
1524 * Determine the appropriate key, IV and MAC length.
1525 */
Paul Bakker68884e32013-01-07 18:20:04 +01001526
Hanno Beckere7f2df02017-12-27 08:17:40 +00001527 keylen = cipher_info->key_bitlen / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001528
Hanno Beckerf1229442018-01-03 15:32:31 +00001529#if defined(MBEDTLS_GCM_C) || \
1530 defined(MBEDTLS_CCM_C) || \
1531 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001532 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001533 cipher_info->mode == MBEDTLS_MODE_CCM ||
1534 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +00001535 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001536 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +00001537 mac_key_len = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01001538 transform->taglen = mbedtls_ssl_suite_get_flags( ciphersuite_info ) &
1539 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001540
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001541 /* All modes haves 96-bit IVs;
1542 * GCM and CCM has 4 implicit and 8 explicit bytes
1543 * ChachaPoly has all 12 bytes implicit
1544 */
Paul Bakker68884e32013-01-07 18:20:04 +01001545 transform->ivlen = 12;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001546 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
1547 transform->fixed_ivlen = 12;
1548 else
1549 transform->fixed_ivlen = 4;
Paul Bakker68884e32013-01-07 18:20:04 +01001550 }
1551 else
Hanno Beckerf1229442018-01-03 15:32:31 +00001552#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
1553#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1554 if( cipher_info->mode == MBEDTLS_MODE_STREAM ||
1555 cipher_info->mode == MBEDTLS_MODE_CBC )
Paul Bakker68884e32013-01-07 18:20:04 +01001556 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001557 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001558 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
1559 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001560 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001561 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001562 return( ret );
Paul Bakker68884e32013-01-07 18:20:04 +01001563 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001564
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001565 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +00001566 mac_key_len = mbedtls_md_get_size( md_info );
1567 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001568
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001569#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001570 /*
1571 * If HMAC is to be truncated, we shall keep the leftmost bytes,
1572 * (rfc 6066 page 13 or rfc 2104 section 4),
1573 * so we only need to adjust the length here.
1574 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001575 if( trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Hanno Beckere89353a2017-11-20 16:36:41 +00001576 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001577 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
Hanno Beckere89353a2017-11-20 16:36:41 +00001578
1579#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
1580 /* Fall back to old, non-compliant version of the truncated
Hanno Becker563423f2017-11-21 17:20:17 +00001581 * HMAC implementation which also truncates the key
1582 * (Mbed TLS versions from 1.3 to 2.6.0) */
Hanno Beckere89353a2017-11-20 16:36:41 +00001583 mac_key_len = transform->maclen;
1584#endif
1585 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001586#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001587
1588 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +01001589 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001590 }
Hanno Beckerf1229442018-01-03 15:32:31 +00001591 else
1592#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1593 {
1594 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1595 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1596 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001597
Hanno Beckera9d5c452019-07-25 16:47:12 +01001598 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, ivlen: %u, maclen: %u",
Hanno Beckere7f2df02017-12-27 08:17:40 +00001599 (unsigned) keylen,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001600 (unsigned) transform->ivlen,
1601 (unsigned) transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001602
1603 /*
1604 * Finally setup the cipher contexts, IVs and MAC secrets.
1605 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001606#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001607 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00001608 {
Hanno Becker81c7b182017-11-09 18:39:33 +00001609 key1 = keyblk + mac_key_len * 2;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001610 key2 = keyblk + mac_key_len * 2 + keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +00001611
Paul Bakker68884e32013-01-07 18:20:04 +01001612 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +00001613 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001614
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001615 /*
1616 * This is not used in TLS v1.1.
1617 */
Paul Bakker48916f92012-09-16 19:57:18 +00001618 iv_copy_len = ( transform->fixed_ivlen ) ?
1619 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001620 mbedtls_platform_memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
1621 mbedtls_platform_memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001622 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001623 }
1624 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001625#endif /* MBEDTLS_SSL_CLI_C */
1626#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001627 if( endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00001628 {
Hanno Beckere7f2df02017-12-27 08:17:40 +00001629 key1 = keyblk + mac_key_len * 2 + keylen;
Hanno Becker81c7b182017-11-09 18:39:33 +00001630 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00001631
Hanno Becker81c7b182017-11-09 18:39:33 +00001632 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +01001633 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +00001634
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001635 /*
1636 * This is not used in TLS v1.1.
1637 */
Paul Bakker48916f92012-09-16 19:57:18 +00001638 iv_copy_len = ( transform->fixed_ivlen ) ?
1639 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001640 mbedtls_platform_memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
1641 mbedtls_platform_memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001642 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001643 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001644 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001645#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001646 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001647 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1648 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001649 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001650
Hanno Becker92231322018-01-03 15:32:51 +00001651#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001652#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001653 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001654 {
Hanno Becker92231322018-01-03 15:32:51 +00001655 if( mac_key_len > sizeof( transform->mac_enc ) )
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001656 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001657 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1658 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001659 }
1660
Teppo Järvelin91d79382019-10-02 09:09:31 +03001661 mbedtls_platform_memcpy( transform->mac_enc, mac_enc, mac_key_len );
1662 mbedtls_platform_memcpy( transform->mac_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +01001663 }
1664 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001665#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1666#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1667 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001668 if( mbedtls_ssl_ver_geq( minor_ver, MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakker68884e32013-01-07 18:20:04 +01001669 {
Gilles Peskine039fd122018-03-19 19:06:08 +01001670 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1671 For AEAD-based ciphersuites, there is nothing to do here. */
1672 if( mac_key_len != 0 )
1673 {
1674 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
1675 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
1676 }
Paul Bakker68884e32013-01-07 18:20:04 +01001677 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001678 else
1679#endif
Paul Bakker577e0062013-08-28 11:57:20 +02001680 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001681 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1682 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02001683 }
Hanno Becker92231322018-01-03 15:32:51 +00001684#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker68884e32013-01-07 18:20:04 +01001685
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001686#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1687 if( mbedtls_ssl_hw_record_init != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00001688 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001689 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00001690
Hanno Beckere7f2df02017-12-27 08:17:40 +00001691 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen,
Paul Bakker07eb38b2012-12-19 14:42:06 +01001692 transform->iv_enc, transform->iv_dec,
1693 iv_copy_len,
Paul Bakker68884e32013-01-07 18:20:04 +01001694 mac_enc, mac_dec,
Hanno Becker81c7b182017-11-09 18:39:33 +00001695 mac_key_len ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00001696 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001697 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1698 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00001699 }
1700 }
Hanno Becker92231322018-01-03 15:32:51 +00001701#else
1702 ((void) mac_dec);
1703 ((void) mac_enc);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001704#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00001705
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001706#if defined(MBEDTLS_SSL_EXPORT_KEYS)
1707 if( ssl->conf->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001708 {
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001709 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001710 master, keyblk,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001711 mac_key_len, keylen,
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001712 iv_copy_len );
1713 }
1714#endif
Andrzej Kurek11750442020-09-17 07:12:06 -04001715#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
1716 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx,
1717 cipher_info ) ) != 0 )
1718 {
1719 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1720 return( ret );
1721 }
1722 transform->key_enc = mbedtls_calloc( 1, cipher_info->key_bitlen >> 3 );
1723 transform->key_dec = mbedtls_calloc( 1, cipher_info->key_bitlen >> 3 );
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001724
Andrzej Kurek11750442020-09-17 07:12:06 -04001725 memcpy( transform->key_enc, key1, cipher_info->key_bitlen >> 3 );
1726 memcpy( transform->key_dec, key2, cipher_info->key_bitlen >> 3 );
1727
1728 transform->key_bitlen = cipher_info->key_bitlen;
Andrzej Kureka7932372020-09-19 07:56:06 +02001729#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
1730 transform->key_enc_hash = mbedtls_hash( transform->key_enc, transform->key_bitlen >> 3 );
1731 transform->key_dec_hash = mbedtls_hash( transform->key_dec, transform->key_bitlen >> 3 );
1732#endif
1733
Andrzej Kurek11750442020-09-17 07:12:06 -04001734#else
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001735 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001736 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001737 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001738 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001739 return( ret );
1740 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001741
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001742 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001743 cipher_info ) ) != 0 )
1744 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001745 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001746 return( ret );
1747 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001748
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001749 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001750 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001751 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001752 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001753 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001754 return( ret );
1755 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001756
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001757 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001758 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001759 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001760 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001761 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001762 return( ret );
1763 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001764#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001765#if defined(MBEDTLS_CIPHER_MODE_CBC)
1766 if( cipher_info->mode == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001767 {
Andrzej Kurek11750442020-09-17 07:12:06 -04001768#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
1769 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx,
1770 MBEDTLS_PADDING_NONE ) ) != 0 )
1771 {
1772 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1773 return( ret );
1774 }
1775#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001776 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1777 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001778 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001779 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001780 return( ret );
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001781 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001782
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001783 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1784 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001785 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001786 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001787 return( ret );
1788 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001789#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001790 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001791#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001792
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001793 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001794
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02001795 /* Initialize Zlib contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001796#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001797 if( compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001798 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001799 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001800
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001801 mbedtls_platform_memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1802 mbedtls_platform_memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001803
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001804 if( deflateInit( &transform->ctx_deflate,
1805 Z_DEFAULT_COMPRESSION ) != Z_OK ||
Paul Bakker48916f92012-09-16 19:57:18 +00001806 inflateInit( &transform->ctx_inflate ) != Z_OK )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001807 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001808 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1809 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001810 }
1811 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001812#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00001813
Paul Bakker5121ce52009-01-03 21:22:43 +00001814 return( 0 );
1815}
1816
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001817#if defined(MBEDTLS_SSL_PROTO_SSL3)
1818static inline void ssl_calc_verify_ssl( const mbedtls_ssl_context *ssl,
1819 unsigned char hash[36],
1820 size_t *hlen )
1821{
1822 mbedtls_md5_context md5;
1823 mbedtls_sha1_context sha1;
1824 unsigned char pad_1[48];
1825 unsigned char pad_2[48];
1826
1827 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
1828
1829 mbedtls_md5_init( &md5 );
1830 mbedtls_sha1_init( &sha1 );
1831
1832 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1833 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1834
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001835 mbedtls_platform_memset( pad_1, 0x36, 48 );
1836 mbedtls_platform_memset( pad_2, 0x5C, 48 );
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001837
1838 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1839 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1840 mbedtls_md5_finish_ret( &md5, hash );
1841
1842 mbedtls_md5_starts_ret( &md5 );
1843 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1844 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1845 mbedtls_md5_update_ret( &md5, hash, 16 );
1846 mbedtls_md5_finish_ret( &md5, hash );
1847
1848 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1849 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1850 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1851
1852 mbedtls_sha1_starts_ret( &sha1 );
1853 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1854 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1855 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1856 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1857
1858 *hlen = 36;
1859
1860 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1861 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1862
1863 mbedtls_md5_free( &md5 );
1864 mbedtls_sha1_free( &sha1 );
1865
1866 return;
1867}
1868#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1869
1870#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1871static inline void ssl_calc_verify_tls( const mbedtls_ssl_context *ssl,
1872 unsigned char hash[36],
1873 size_t *hlen )
1874{
1875 mbedtls_md5_context md5;
1876 mbedtls_sha1_context sha1;
1877
1878 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
1879
1880 mbedtls_md5_init( &md5 );
1881 mbedtls_sha1_init( &sha1 );
1882
1883 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1884 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1885
1886 mbedtls_md5_finish_ret( &md5, hash );
1887 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1888
1889 *hlen = 36;
1890
1891 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1892 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1893
1894 mbedtls_md5_free( &md5 );
1895 mbedtls_sha1_free( &sha1 );
1896
1897 return;
1898}
1899#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1900
1901#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1902#if defined(MBEDTLS_SHA256_C)
1903static inline void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1904 unsigned char hash[32],
1905 size_t *hlen )
1906{
1907 mbedtls_sha256_context sha256;
1908
1909 mbedtls_sha256_init( &sha256 );
1910
1911 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1912
1913 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1914 mbedtls_sha256_finish_ret( &sha256, hash );
1915
1916 *hlen = 32;
1917
1918 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1919 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1920
1921 mbedtls_sha256_free( &sha256 );
1922
1923 return;
1924}
1925#endif /* MBEDTLS_SHA256_C */
1926
1927#if defined(MBEDTLS_SHA512_C)
1928static inline void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1929 unsigned char hash[48],
1930 size_t *hlen )
1931{
1932 mbedtls_sha512_context sha512;
1933
1934 mbedtls_sha512_init( &sha512 );
1935
1936 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1937
1938 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1939 mbedtls_sha512_finish_ret( &sha512, hash );
1940
1941 *hlen = 48;
1942
1943 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1944 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1945
1946 mbedtls_sha512_free( &sha512 );
1947
1948 return;
1949}
1950#endif /* MBEDTLS_SHA512_C */
1951#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1952
Hanno Becker2f41b242019-08-15 17:29:43 +01001953int mbedtls_ssl_calc_verify( int minor_ver,
1954 mbedtls_md_type_t hash,
1955 mbedtls_ssl_context const *ssl,
1956 unsigned char *dst,
1957 size_t *hlen )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001958{
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001959#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1960 (void) hash;
1961#endif
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001962
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001963#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001964 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker2f41b242019-08-15 17:29:43 +01001965 ssl_calc_verify_ssl( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001966 else
1967#endif
1968#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001969 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker2f41b242019-08-15 17:29:43 +01001970 ssl_calc_verify_tls( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001971 else
1972#endif
1973#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1974#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001975 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1976 hash == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001977 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001978 ssl_calc_verify_tls_sha384( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001979 }
1980 else
1981#endif
1982#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001983 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001984 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001985 ssl_calc_verify_tls_sha256( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001986 }
1987 else
1988#endif
1989#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1990 {
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001991 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1992 }
1993
1994 return( 0 );
1995}
1996
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001997/*
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001998 * Compute master secret if needed
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001999 *
2000 * Parameters:
2001 * [in/out] handshake
2002 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
2003 * [out] premaster (cleared)
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002004 * [out] master
2005 * [in] ssl: optionally used for debugging and calc_verify
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002006 */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002007static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002008 unsigned char *master,
Manuel Pégourié-Gonnarded3b7a92019-05-03 09:58:33 +02002009 const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002010{
2011 int ret;
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002012
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002013/* #if !defined(MBEDTLS_DEBUG_C) && !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) */
2014/* ssl = NULL; /\* make sure we don't use it except for debug and EMS *\/ */
2015/* (void) ssl; */
2016/* #endif */
2017
2018 mbedtls_ssl_ciphersuite_handle_t const ciphersuite =
2019 mbedtls_ssl_handshake_get_ciphersuite( handshake );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002020
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002021#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02002022 if( handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002023 {
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002024 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
2025 return( 0 );
2026 }
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002027#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002028
2029 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
2030 handshake->pmslen );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002031
2032#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckera49ec562019-06-11 14:47:55 +01002033 if( mbedtls_ssl_hs_get_extended_ms( handshake )
2034 == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002035 {
2036 unsigned char session_hash[48];
2037 size_t hash_len;
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002038
Hanno Becker2f41b242019-08-15 17:29:43 +01002039 mbedtls_ssl_calc_verify(
2040 mbedtls_ssl_get_minor_ver( ssl ),
2041 mbedtls_ssl_suite_get_mac( ciphersuite ),
2042 ssl, session_hash, &hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002043
Manuel Pégourié-Gonnard9c5bcc92019-05-20 12:09:50 +02002044 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
2045 session_hash, hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002046
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002047 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
2048 mbedtls_ssl_suite_get_mac( ciphersuite ),
2049 handshake->premaster, handshake->pmslen,
2050 "extended master secret",
2051 session_hash, hash_len,
2052 master, 48 );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002053 }
2054 else
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002055#endif
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02002056 {
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002057 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
2058 mbedtls_ssl_suite_get_mac( ciphersuite ),
2059 handshake->premaster, handshake->pmslen,
2060 "master secret",
2061 handshake->randbytes, 64,
2062 master, 48 );
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02002063 }
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002064 if( ret != 0 )
2065 {
2066 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
2067 return( ret );
2068 }
2069
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02002070 if( handshake->premaster == mbedtls_platform_zeroize(
Piotr Nowickia6348ed2020-06-29 15:03:56 +02002071 handshake->premaster, sizeof(handshake->premaster) ) )
2072 {
2073 return( 0 );
2074 }
2075
2076 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002077}
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002078
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02002079int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
2080{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04002081 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002082
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002083 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
Jarno Lamsa4031a452019-12-19 08:11:12 +02002084 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_UNSET;
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002085 /* Compute master secret if needed */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002086 ret = ssl_compute_master( ssl->handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002087 ssl->session_negotiate->master,
2088 ssl );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002089 if( ret != 0 )
2090 {
2091 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
2092 return( ret );
2093 }
2094
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002095 /* Swap the client and server random values:
2096 * - MS derivation wanted client+server (RFC 5246 8.1)
2097 * - key derivation wants server+client (RFC 5246 6.3) */
2098 {
2099 unsigned char tmp[64];
Teppo Järvelin91d79382019-10-02 09:09:31 +03002100 mbedtls_platform_memcpy( tmp, ssl->handshake->randbytes, 64 );
2101 mbedtls_platform_memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
2102 mbedtls_platform_memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002103 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
2104 }
2105
2106 /* Populate transform structure */
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02002107 ret = ssl_populate_transform( ssl->transform_negotiate,
Hanno Beckere02758c2019-06-26 15:31:31 +01002108 mbedtls_ssl_session_get_ciphersuite( ssl->session_negotiate ),
2109 ssl->session_negotiate->master,
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01002110#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002111#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01002112 ssl->session_negotiate->encrypt_then_mac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002113#endif
2114#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01002115 ssl->session_negotiate->trunc_hmac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002116#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01002117#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002118#if defined(MBEDTLS_ZLIB_SUPPORT)
Hanno Beckere02758c2019-06-26 15:31:31 +01002119 ssl->session_negotiate->compression,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002120#endif
Hanno Beckere02758c2019-06-26 15:31:31 +01002121 ssl->handshake->randbytes,
Hanno Becker2881d802019-05-22 14:44:53 +01002122 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Beckere02758c2019-06-26 15:31:31 +01002123 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
2124 ssl );
Jarno Lamsa4031a452019-12-19 08:11:12 +02002125 if( ret == 0 )
2126 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002127 mbedtls_platform_random_delay();
Jarno Lamsa4031a452019-12-19 08:11:12 +02002128 if( ret == 0 )
2129 {
2130 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_SET;
2131 }
2132 else
2133 {
2134 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2135 }
2136 }
2137 else
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002138 {
2139 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
2140 return( ret );
2141 }
2142
2143 /* We no longer need Server/ClientHello.random values */
2144 mbedtls_platform_zeroize( ssl->handshake->randbytes,
2145 sizeof( ssl->handshake->randbytes ) );
2146
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002147 /* Allocate compression buffer */
2148#if defined(MBEDTLS_ZLIB_SUPPORT)
jiblime92af9a92019-12-18 21:40:01 -08002149 if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002150 ssl->compress_buf == NULL )
2151 {
2152 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
2153 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
2154 if( ssl->compress_buf == NULL )
2155 {
2156 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02002157 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002158 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2159 }
2160 }
2161#endif
2162
Paul Bakker5121ce52009-01-03 21:22:43 +00002163 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
2164
2165 return( 0 );
2166}
2167
Hanno Becker09d23642019-07-22 17:18:18 +01002168int mbedtls_ssl_build_pms( mbedtls_ssl_context *ssl )
2169{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04002170 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker09d23642019-07-22 17:18:18 +01002171
2172 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
2173 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Beckera3c2c172019-07-23 16:51:57 +01002174#if defined(MBEDTLS_USE_TINYCRYPT)
2175 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01002176 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
Hanno Beckera3c2c172019-07-23 16:51:57 +01002177 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01002178 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2179 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2180 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2181 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2182 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002183 {
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002184 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2185 ssl->handshake->ecdh_privkey,
2186 ssl->handshake->premaster );
2187 if( ret == UECC_FAULT_DETECTED )
2188 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2189 if( ret != UECC_SUCCESS )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002190 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002191 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Hanno Beckera3c2c172019-07-23 16:51:57 +01002192
2193 ssl->handshake->pmslen = NUM_ECC_BYTES;
2194 }
2195 else
2196#endif
Hanno Becker09d23642019-07-22 17:18:18 +01002197#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
2198 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2199 == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
2200 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002201 ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002202 ssl->handshake->premaster,
2203 MBEDTLS_PREMASTER_SIZE,
2204 &ssl->handshake->pmslen,
2205 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002206 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2207 if( ret == 0 )
2208 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002209 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002210 if( ret == 0 )
2211 {
2212 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2213 }
2214 else
2215 {
Piotr Nowickie048b912020-06-05 17:59:28 +02002216 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret",
2217 MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2218 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002219 }
2220 }
2221 else
Hanno Becker09d23642019-07-22 17:18:18 +01002222 {
2223 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
2224 return( ret );
2225 }
2226
2227 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
2228 }
2229 else
2230#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
Hanno Becker29d16552019-07-24 11:11:45 +01002231#if defined(MBEDTLS_ECDH_C) && \
2232 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2233 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2234 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2235 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) )
Hanno Becker09d23642019-07-22 17:18:18 +01002236 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2237 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2238 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2239 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2240 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2241 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2242 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2243 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2244 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002245 ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002246 &ssl->handshake->pmslen,
2247 ssl->handshake->premaster,
2248 MBEDTLS_MPI_MAX_SIZE,
2249 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002250 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2251 if( ret == 0 )
2252 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002253 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002254 if( ret == 0 )
2255 {
2256 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2257 }
2258 else
2259 {
2260 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002261 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002262 }
2263 }
2264 else
Hanno Becker09d23642019-07-22 17:18:18 +01002265 {
2266 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
2267 return( ret );
2268 }
2269
2270 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
2271 }
2272 else
2273#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2274 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2275 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2276 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2277#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2278 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
2279 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002280 ret = mbedtls_ssl_psk_derive_premaster( ssl,
2281 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) );
2282 if( ret == 0 )
2283 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002284 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002285 if( ret == 0 )
2286 {
2287 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2288 }
2289 else
2290 {
2291 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002292 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002293 }
2294 }
2295 else
Hanno Becker09d23642019-07-22 17:18:18 +01002296 {
2297 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
2298 return( ret );
2299 }
2300 }
2301 else
2302#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2303#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2304 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
2305 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2306 {
2307 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
2308 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
2309 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002310 mbedtls_ssl_conf_get_prng( ssl->conf ) );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002311 if( ret == 0 )
2312 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002313 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002314 if( ret == 0 )
2315 {
2316 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2317 }
2318 else
2319 {
2320 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002321 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002322 }
2323 }
2324 else
Hanno Becker09d23642019-07-22 17:18:18 +01002325 {
2326 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
2327 return( ret );
2328 }
2329 }
2330 else
2331#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2332#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
2333 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2334 == MBEDTLS_KEY_EXCHANGE_RSA )
2335 {
2336 ((void) ret);
Manuel Pégourié-Gonnard8793fab2019-08-01 10:44:07 +02002337 /* The premaster secret has already been set by
Hanno Becker09d23642019-07-22 17:18:18 +01002338 * ssl_rsa_generate_partial_pms(). Only the
2339 * PMS length needs to be set. */
2340 ssl->handshake->pmslen = 48;
2341 }
2342 else
2343#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2344 {
2345 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2346 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2347 }
2348
2349 return( 0 );
2350}
2351
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002352#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2353int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002354{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002355 unsigned char *p = ssl->handshake->premaster;
2356 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002357 const unsigned char *psk = ssl->conf->psk;
2358 size_t psk_len = ssl->conf->psk_len;
2359
2360 /* If the psk callback was called, use its result */
2361 if( ssl->handshake->psk != NULL )
2362 {
2363 psk = ssl->handshake->psk;
2364 psk_len = ssl->handshake->psk_len;
2365 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002366
2367 /*
2368 * PMS = struct {
2369 * opaque other_secret<0..2^16-1>;
2370 * opaque psk<0..2^16-1>;
2371 * };
2372 * with "other_secret" depending on the particular key exchange
2373 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002374#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
2375 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002376 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002377 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002378 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002379
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002380 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002381
2382 if( end < p || (size_t)( end - p ) < psk_len )
2383 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2384
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002385 mbedtls_platform_memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002386 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002387 }
2388 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002389#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
2390#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2391 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002392 {
2393 /*
2394 * other_secret already set by the ClientKeyExchange message,
2395 * and is 48 bytes long
2396 */
Philippe Antoine747fd532018-05-30 09:13:21 +02002397 if( end - p < 2 )
2398 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2399
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002400 *p++ = 0;
2401 *p++ = 48;
2402 p += 48;
2403 }
2404 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002405#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2406#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2407 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002408 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002409 int ret;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002410 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002411
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02002412 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002413 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002414 p + 2, end - ( p + 2 ), &len,
Hanno Beckerece325c2019-06-13 15:39:27 +01002415 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002416 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002417 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002418 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002419 return( ret );
2420 }
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002421 p = mbedtls_platform_put_uint16_be( p, len );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002422 p += len;
2423
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002424 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002425 }
2426 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002427#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2428#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2429 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002430 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002431 int ret;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002432 size_t zlen;
2433
Hanno Becker982da7e2019-09-02 09:47:39 +01002434#if defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002435 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2436 ssl->handshake->ecdh_privkey,
2437 p + 2 );
2438 if( ret == UECC_FAULT_DETECTED )
2439 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2440 if( ret != UECC_SUCCESS )
Hanno Becker982da7e2019-09-02 09:47:39 +01002441 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Hanno Becker982da7e2019-09-02 09:47:39 +01002442
2443 zlen = NUM_ECC_BYTES;
2444#else /* MBEDTLS_USE_TINYCRYPT */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002445 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02002446 p + 2, end - ( p + 2 ),
Hanno Beckerece325c2019-06-13 15:39:27 +01002447 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002448 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002449 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002450 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002451 return( ret );
2452 }
2453
Hanno Becker982da7e2019-09-02 09:47:39 +01002454 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2455 MBEDTLS_DEBUG_ECDH_Z );
2456#endif /* MBEDTLS_USE_TINYCRYPT */
2457
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002458 p = mbedtls_platform_put_uint16_be( p, zlen );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002459 p += zlen;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002460 }
2461 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002462#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002463 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002464 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2465 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002466 }
2467
2468 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002469 if( end - p < 2 )
2470 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01002471
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002472 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002473
2474 if( end < p || (size_t)( end - p ) < psk_len )
2475 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2476
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02002477 if( mbedtls_platform_memcpy( p, psk, psk_len ) != p )
2478 {
2479 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2480 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002481 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002482
2483 ssl->handshake->pmslen = p - ssl->handshake->premaster;
2484
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002485 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2486
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002487 return( 0 );
2488}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002489#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002490
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002491#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00002492/*
2493 * SSLv3.0 MAC functions
2494 */
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002495#define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002496static void ssl_mac( mbedtls_md_context_t *md_ctx,
2497 const unsigned char *secret,
2498 const unsigned char *buf, size_t len,
2499 const unsigned char *ctr, int type,
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002500 unsigned char out[SSL_MAC_MAX_BYTES] )
Paul Bakker5121ce52009-01-03 21:22:43 +00002501{
2502 unsigned char header[11];
2503 unsigned char padding[48];
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002504 int padlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002505 int md_size = mbedtls_md_get_size( md_ctx->md_info );
2506 int md_type = mbedtls_md_get_type( md_ctx->md_info );
Paul Bakker68884e32013-01-07 18:20:04 +01002507
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002508 /* Only MD5 and SHA-1 supported */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002509 if( md_type == MBEDTLS_MD_MD5 )
Paul Bakker68884e32013-01-07 18:20:04 +01002510 padlen = 48;
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002511 else
Paul Bakker68884e32013-01-07 18:20:04 +01002512 padlen = 40;
Paul Bakker5121ce52009-01-03 21:22:43 +00002513
Teppo Järvelin91d79382019-10-02 09:09:31 +03002514 mbedtls_platform_memcpy( header, ctr, 8 );
Arto Kinnunen6e3f09b2019-09-06 17:37:01 +03002515 header[8] = (unsigned char) type;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002516 (void)mbedtls_platform_put_uint16_be( &header[9], len );
Paul Bakker5121ce52009-01-03 21:22:43 +00002517
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002518 mbedtls_platform_memset( padding, 0x36, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002519 mbedtls_md_starts( md_ctx );
2520 mbedtls_md_update( md_ctx, secret, md_size );
2521 mbedtls_md_update( md_ctx, padding, padlen );
2522 mbedtls_md_update( md_ctx, header, 11 );
2523 mbedtls_md_update( md_ctx, buf, len );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002524 mbedtls_md_finish( md_ctx, out );
Paul Bakker5121ce52009-01-03 21:22:43 +00002525
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002526 mbedtls_platform_memset( padding, 0x5C, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002527 mbedtls_md_starts( md_ctx );
2528 mbedtls_md_update( md_ctx, secret, md_size );
2529 mbedtls_md_update( md_ctx, padding, padlen );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002530 mbedtls_md_update( md_ctx, out, md_size );
2531 mbedtls_md_finish( md_ctx, out );
Paul Bakker5f70b252012-09-13 14:23:06 +00002532}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002533#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +00002534
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002535/* The function below is only used in the Lucky 13 counter-measure in
Hanno Becker30d02cd2018-10-18 15:43:13 +01002536 * mbedtls_ssl_decrypt_buf(). These are the defines that guard the call site. */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002537#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) && \
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002538 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
2539 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2540 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
2541/* This function makes sure every byte in the memory region is accessed
2542 * (in ascending addresses order) */
2543static void ssl_read_memory( unsigned char *p, size_t len )
2544{
2545 unsigned char acc = 0;
2546 volatile unsigned char force;
2547
2548 for( ; len != 0; p++, len-- )
2549 acc ^= *p;
2550
2551 force = acc;
2552 (void) force;
2553}
2554#endif /* SSL_SOME_MODES_USE_MAC && ( TLS1 || TLS1_1 || TLS1_2 ) */
2555
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002556/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002557 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +02002558 */
Hanno Becker3307b532017-12-27 21:37:21 +00002559
Hanno Beckera5a2b082019-05-15 14:03:01 +01002560#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker89693692019-05-20 15:06:12 +01002561/* This functions transforms a DTLS plaintext fragment and a record content
2562 * type into an instance of the DTLSInnerPlaintext structure:
Hanno Becker92c930f2019-04-29 17:31:37 +01002563 *
2564 * struct {
2565 * opaque content[DTLSPlaintext.length];
2566 * ContentType real_type;
2567 * uint8 zeros[length_of_padding];
2568 * } DTLSInnerPlaintext;
2569 *
2570 * Input:
2571 * - `content`: The beginning of the buffer holding the
2572 * plaintext to be wrapped.
2573 * - `*content_size`: The length of the plaintext in Bytes.
2574 * - `max_len`: The number of Bytes available starting from
2575 * `content`. This must be `>= *content_size`.
2576 * - `rec_type`: The desired record content type.
2577 *
2578 * Output:
2579 * - `content`: The beginning of the resulting DTLSInnerPlaintext structure.
2580 * - `*content_size`: The length of the resulting DTLSInnerPlaintext structure.
2581 *
2582 * Returns:
2583 * - `0` on success.
2584 * - A negative error code if `max_len` didn't offer enough space
2585 * for the expansion.
2586 */
2587static int ssl_cid_build_inner_plaintext( unsigned char *content,
2588 size_t *content_size,
2589 size_t remaining,
2590 uint8_t rec_type )
2591{
2592 size_t len = *content_size;
Hanno Becker78426092019-05-13 15:31:17 +01002593 size_t pad = ( MBEDTLS_SSL_CID_PADDING_GRANULARITY -
2594 ( len + 1 ) % MBEDTLS_SSL_CID_PADDING_GRANULARITY ) %
2595 MBEDTLS_SSL_CID_PADDING_GRANULARITY;
Hanno Becker92c930f2019-04-29 17:31:37 +01002596
2597 /* Write real content type */
2598 if( remaining == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002599 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Hanno Becker92c930f2019-04-29 17:31:37 +01002600 content[ len ] = rec_type;
2601 len++;
2602 remaining--;
2603
2604 if( remaining < pad )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002605 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002606 mbedtls_platform_memset( content + len, 0, pad );
Hanno Becker92c930f2019-04-29 17:31:37 +01002607 len += pad;
2608 remaining -= pad;
2609
2610 *content_size = len;
Andrzej Kurekafec8852020-07-15 16:31:27 -04002611 return( 0 );
Hanno Becker92c930f2019-04-29 17:31:37 +01002612}
2613
Hanno Becker7dc25772019-05-20 15:08:01 +01002614/* This function parses a DTLSInnerPlaintext structure.
2615 * See ssl_cid_build_inner_plaintext() for details. */
Hanno Becker92c930f2019-04-29 17:31:37 +01002616static int ssl_cid_parse_inner_plaintext( unsigned char const *content,
2617 size_t *content_size,
2618 uint8_t *rec_type )
2619{
2620 size_t remaining = *content_size;
2621
2622 /* Determine length of padding by skipping zeroes from the back. */
2623 do
2624 {
2625 if( remaining == 0 )
2626 return( -1 );
2627 remaining--;
2628 } while( content[ remaining ] == 0 );
2629
2630 *content_size = remaining;
2631 *rec_type = content[ remaining ];
2632
2633 return( 0 );
2634}
Hanno Beckera5a2b082019-05-15 14:03:01 +01002635#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01002636
Hanno Becker99abf512019-05-20 14:50:53 +01002637/* `add_data` must have size 13 Bytes if the CID extension is disabled,
Hanno Beckeracadb0a2019-05-08 18:15:21 +01002638 * and 13 + 1 + CID-length Bytes if the CID extension is enabled. */
Hanno Becker3307b532017-12-27 21:37:21 +00002639static void ssl_extract_add_data_from_record( unsigned char* add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002640 size_t *add_data_len,
Hanno Becker3307b532017-12-27 21:37:21 +00002641 mbedtls_record *rec )
2642{
Hanno Becker99abf512019-05-20 14:50:53 +01002643 /* Quoting RFC 5246 (TLS 1.2):
Hanno Beckere83efe62019-04-29 13:52:53 +01002644 *
2645 * additional_data = seq_num + TLSCompressed.type +
2646 * TLSCompressed.version + TLSCompressed.length;
2647 *
Hanno Becker99abf512019-05-20 14:50:53 +01002648 * For the CID extension, this is extended as follows
2649 * (quoting draft-ietf-tls-dtls-connection-id-05,
2650 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05):
Hanno Beckere83efe62019-04-29 13:52:53 +01002651 *
2652 * additional_data = seq_num + DTLSPlaintext.type +
2653 * DTLSPlaintext.version +
Hanno Becker99abf512019-05-20 14:50:53 +01002654 * cid +
2655 * cid_length +
Hanno Beckere83efe62019-04-29 13:52:53 +01002656 * length_of_DTLSInnerPlaintext;
2657 */
2658
Teppo Järvelin91d79382019-10-02 09:09:31 +03002659 mbedtls_platform_memcpy( add_data, rec->ctr, sizeof( rec->ctr ) );
Hanno Becker3307b532017-12-27 21:37:21 +00002660 add_data[8] = rec->type;
Teppo Järvelin91d79382019-10-02 09:09:31 +03002661 mbedtls_platform_memcpy( add_data + 9, rec->ver, sizeof( rec->ver ) );
Hanno Beckere83efe62019-04-29 13:52:53 +01002662
Hanno Beckera5a2b082019-05-15 14:03:01 +01002663#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker1f02f052019-05-09 11:38:24 +01002664 if( rec->cid_len != 0 )
2665 {
Teppo Järvelin91d79382019-10-02 09:09:31 +03002666 mbedtls_platform_memcpy( add_data + 11, rec->cid, rec->cid_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002667 add_data[11 + rec->cid_len + 0] = rec->cid_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002668 (void)mbedtls_platform_put_uint16_be( &add_data[11 + rec->cid_len + 1],
2669 rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002670 *add_data_len = 13 + 1 + rec->cid_len;
2671 }
2672 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01002673#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker1f02f052019-05-09 11:38:24 +01002674 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002675 (void)mbedtls_platform_put_uint16_be( &add_data[11], rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002676 *add_data_len = 13;
2677 }
Hanno Becker3307b532017-12-27 21:37:21 +00002678}
2679
Hanno Becker611a83b2018-01-03 14:27:32 +00002680int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl,
2681 mbedtls_ssl_transform *transform,
2682 mbedtls_record *rec,
2683 int (*f_rng)(void *, unsigned char *, size_t),
2684 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +00002685{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002686 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002687 int auth_done = 0;
Hanno Becker3307b532017-12-27 21:37:21 +00002688 unsigned char * data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01002689 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_OUT_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01002690 size_t add_data_len;
Hanno Becker3307b532017-12-27 21:37:21 +00002691 size_t post_avail;
Andrzej Kurekff517212020-08-10 07:10:35 -04002692 int encryption_status = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker3307b532017-12-27 21:37:21 +00002693
2694 /* The SSL context is only used for debugging purposes! */
Hanno Becker611a83b2018-01-03 14:27:32 +00002695#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02002696 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker3307b532017-12-27 21:37:21 +00002697 ((void) ssl);
2698#endif
2699
2700 /* The PRNG is used for dynamic IV generation that's used
2701 * for CBC transformations in TLS 1.1 and TLS 1.2. */
2702#if !( defined(MBEDTLS_CIPHER_MODE_CBC) && \
2703 ( defined(MBEDTLS_AES_C) || \
2704 defined(MBEDTLS_ARIA_C) || \
2705 defined(MBEDTLS_CAMELLIA_C) ) && \
2706 ( defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) ) )
2707 ((void) f_rng);
2708 ((void) p_rng);
2709#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002710
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002711 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002712
Hanno Becker3307b532017-12-27 21:37:21 +00002713 if( transform == NULL )
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002714 {
Hanno Becker3307b532017-12-27 21:37:21 +00002715 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to encrypt_buf" ) );
2716 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2717 }
Hanno Becker505089d2019-05-01 09:45:57 +01002718 if( rec == NULL
2719 || rec->buf == NULL
2720 || rec->buf_len < rec->data_offset
2721 || rec->buf_len - rec->data_offset < rec->data_len
Hanno Beckera5a2b082019-05-15 14:03:01 +01002722#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01002723 || rec->cid_len != 0
2724#endif
2725 )
Hanno Becker3307b532017-12-27 21:37:21 +00002726 {
2727 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to encrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002728 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002729 }
2730
Hanno Becker3307b532017-12-27 21:37:21 +00002731 data = rec->buf + rec->data_offset;
Hanno Becker92c930f2019-04-29 17:31:37 +01002732 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002733 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Hanno Becker3307b532017-12-27 21:37:21 +00002734 data, rec->data_len );
Andrzej Kurek11750442020-09-17 07:12:06 -04002735#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
2736 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx );
2737#else
Hanno Becker3307b532017-12-27 21:37:21 +00002738 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc );
Andrzej Kurek11750442020-09-17 07:12:06 -04002739#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002740 if( rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
2741 {
2742 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record content %u too large, maximum %d",
2743 (unsigned) rec->data_len,
2744 MBEDTLS_SSL_OUT_CONTENT_LEN ) );
2745 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2746 }
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +01002747
Hanno Beckera5a2b082019-05-15 14:03:01 +01002748#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01002749 /*
2750 * Add CID information
2751 */
2752 rec->cid_len = transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03002753 /* Not using more secure mbedtls_platform_memcpy as cid is public */
2754 memcpy( rec->cid, transform->out_cid, transform->out_cid_len );
Hanno Beckere83efe62019-04-29 13:52:53 +01002755 MBEDTLS_SSL_DEBUG_BUF( 3, "CID", rec->cid, rec->cid_len );
Hanno Becker92c930f2019-04-29 17:31:37 +01002756 if( rec->cid_len != 0 )
2757 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002758 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker92c930f2019-04-29 17:31:37 +01002759 /*
Hanno Becker7dc25772019-05-20 15:08:01 +01002760 * Wrap plaintext into DTLSInnerPlaintext structure.
2761 * See ssl_cid_build_inner_plaintext() for more information.
Hanno Becker92c930f2019-04-29 17:31:37 +01002762 *
Hanno Becker7dc25772019-05-20 15:08:01 +01002763 * Note that this changes `rec->data_len`, and hence
2764 * `post_avail` needs to be recalculated afterwards.
Hanno Becker92c930f2019-04-29 17:31:37 +01002765 */
Andrzej Kurek84bde412020-07-06 15:27:34 -04002766 if( ( ret = ssl_cid_build_inner_plaintext( data,
2767 &rec->data_len,
2768 post_avail,
2769 rec->type ) ) != 0 )
Hanno Becker92c930f2019-04-29 17:31:37 +01002770 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002771 return( ret );
Hanno Becker92c930f2019-04-29 17:31:37 +01002772 }
2773
2774 rec->type = MBEDTLS_SSL_MSG_CID;
2775 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01002776#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01002777
Hanno Becker92c930f2019-04-29 17:31:37 +01002778 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
2779
Paul Bakker5121ce52009-01-03 21:22:43 +00002780 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002781 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +00002782 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002783#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002784 if( mode == MBEDTLS_MODE_STREAM ||
2785 ( mode == MBEDTLS_MODE_CBC
2786#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3307b532017-12-27 21:37:21 +00002787 && transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002788#endif
2789 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00002790 {
Hanno Becker3307b532017-12-27 21:37:21 +00002791 if( post_avail < transform->maclen )
2792 {
2793 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2794 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2795 }
2796
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002797#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01002798 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
2799 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002800 {
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002801 unsigned char mac[SSL_MAC_MAX_BYTES];
Hanno Becker3307b532017-12-27 21:37:21 +00002802 ssl_mac( &transform->md_ctx_enc, transform->mac_enc,
2803 data, rec->data_len, rec->ctr, rec->type, mac );
Teppo Järvelin91d79382019-10-02 09:09:31 +03002804 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002805 }
2806 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002807#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002808#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2809 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01002810 if( mbedtls_ssl_ver_geq(
2811 mbedtls_ssl_transform_get_minor_ver( transform ),
2812 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002813 {
Hanno Becker992b6872017-11-09 18:57:39 +00002814 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
2815
Hanno Beckere83efe62019-04-29 13:52:53 +01002816 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker992b6872017-11-09 18:57:39 +00002817
Hanno Becker3307b532017-12-27 21:37:21 +00002818 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002819 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00002820 mbedtls_md_hmac_update( &transform->md_ctx_enc,
2821 data, rec->data_len );
2822 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
2823 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
2824
Teppo Järvelin91d79382019-10-02 09:09:31 +03002825 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002826 }
2827 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002828#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002829 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002830 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2831 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002832 }
2833
Hanno Becker3307b532017-12-27 21:37:21 +00002834 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", data + rec->data_len,
2835 transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002836
Hanno Becker3307b532017-12-27 21:37:21 +00002837 rec->data_len += transform->maclen;
2838 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002839 auth_done++;
Paul Bakker577e0062013-08-28 11:57:20 +02002840 }
Hanno Becker5cc04d52018-01-03 15:24:20 +00002841#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00002842
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002843 /*
2844 * Encrypt
2845 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002846#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
2847 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00002848 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002849 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00002850 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002851 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Hanno Becker3307b532017-12-27 21:37:21 +00002852 "including %d bytes of padding",
2853 rec->data_len, 0 ) );
Andrzej Kurek11750442020-09-17 07:12:06 -04002854#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02002855 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
2856 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04002857 {
Andrzej Kureka7932372020-09-19 07:56:06 +02002858 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04002859 return( ret );
2860 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002861
Andrzej Kurekff517212020-08-10 07:10:35 -04002862 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04002863 transform->iv_enc, transform->ivlen,
2864 data, rec->data_len,
2865 data, &olen ) ) != 0 )
2866 {
2867 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
2868 return( ret );
2869 }
2870#else
Andrzej Kurekff517212020-08-10 07:10:35 -04002871 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002872 transform->iv_enc, transform->ivlen,
2873 data, rec->data_len,
2874 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002875 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002876 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002877 return( ret );
2878 }
Andrzej Kurek11750442020-09-17 07:12:06 -04002879#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002880 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002881 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002882 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2883 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002884 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002885 }
Paul Bakker68884e32013-01-07 18:20:04 +01002886 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002887#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002888
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002889#if defined(MBEDTLS_GCM_C) || \
2890 defined(MBEDTLS_CCM_C) || \
2891 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002892 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002893 mode == MBEDTLS_MODE_CCM ||
2894 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002895 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02002896 int ret;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002897 unsigned char iv[12];
Hanno Becker3307b532017-12-27 21:37:21 +00002898 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002899
Hanno Becker3307b532017-12-27 21:37:21 +00002900 /* Check that there's space for both the authentication tag
2901 * and the explicit IV before and after the record content. */
2902 if( post_avail < transform->taglen ||
2903 rec->data_offset < explicit_iv_len )
2904 {
2905 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2906 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2907 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00002908
Paul Bakker68884e32013-01-07 18:20:04 +01002909 /*
2910 * Generate IV
2911 */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002912 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
2913 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002914 /* GCM and CCM: fixed || explicit (=seqnum) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002915 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
2916 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, rec->ctr,
Hanno Becker3307b532017-12-27 21:37:21 +00002917 explicit_iv_len );
2918 /* Prefix record content with explicit IV. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002919 mbedtls_platform_memcpy( data - explicit_iv_len, rec->ctr, explicit_iv_len );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002920 }
2921 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
2922 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002923 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002924 unsigned char i;
2925
Teppo Järvelin91d79382019-10-02 09:09:31 +03002926 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002927
2928 for( i = 0; i < 8; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00002929 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002930 }
2931 else
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002932 {
2933 /* Reminder if we ever add an AEAD mode with a different size */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002934 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2935 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002936 }
2937
Hanno Beckere83efe62019-04-29 13:52:53 +01002938 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker08885812019-04-26 13:34:37 +01002939
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002940 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
2941 iv, transform->ivlen );
2942 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
Hanno Becker3307b532017-12-27 21:37:21 +00002943 data - explicit_iv_len, explicit_iv_len );
2944 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01002945 add_data, add_data_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002946 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002947 "including 0 bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00002948 rec->data_len ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002949
Paul Bakker68884e32013-01-07 18:20:04 +01002950 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02002951 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002952 */
Andrzej Kurek11750442020-09-17 07:12:06 -04002953#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02002954 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
2955 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04002956 {
Andrzej Kureka7932372020-09-19 07:56:06 +02002957 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04002958 return( ret );
2959 }
Hanno Becker3307b532017-12-27 21:37:21 +00002960
Andrzej Kurekff517212020-08-10 07:10:35 -04002961 if( ( ret = encryption_status = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04002962 iv, transform->ivlen,
2963 add_data, add_data_len, /* add data */
2964 data, rec->data_len, /* source */
2965 data, &rec->data_len, /* destination */
2966 data + rec->data_len, transform->taglen ) ) != 0 )
2967 {
2968 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
2969 return( ret );
2970 }
2971#else
Andrzej Kurekff517212020-08-10 07:10:35 -04002972 if( ( ret = encryption_status = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002973 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01002974 add_data, add_data_len, /* add data */
Hanno Becker3307b532017-12-27 21:37:21 +00002975 data, rec->data_len, /* source */
2976 data, &rec->data_len, /* destination */
2977 data + rec->data_len, transform->taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002978 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002979 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002980 return( ret );
2981 }
Andrzej Kurek11750442020-09-17 07:12:06 -04002982#endif
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04002983
Hanno Becker3307b532017-12-27 21:37:21 +00002984 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag",
2985 data + rec->data_len, transform->taglen );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002986
Hanno Becker3307b532017-12-27 21:37:21 +00002987 rec->data_len += transform->taglen + explicit_iv_len;
2988 rec->data_offset -= explicit_iv_len;
2989 post_avail -= transform->taglen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002990 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002991 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002992 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002993#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
2994#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00002995 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002996 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00002997 {
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002998 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00002999 size_t padlen, i;
3000 size_t olen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003001
Hanno Becker3307b532017-12-27 21:37:21 +00003002 /* Currently we're always using minimal padding
3003 * (up to 255 bytes would be allowed). */
3004 padlen = transform->ivlen - ( rec->data_len + 1 ) % transform->ivlen;
3005 if( padlen == transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003006 padlen = 0;
3007
Hanno Becker3307b532017-12-27 21:37:21 +00003008 /* Check there's enough space in the buffer for the padding. */
3009 if( post_avail < padlen + 1 )
3010 {
3011 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3012 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3013 }
3014
Paul Bakker5121ce52009-01-03 21:22:43 +00003015 for( i = 0; i <= padlen; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00003016 data[rec->data_len + i] = (unsigned char) padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00003017
Hanno Becker3307b532017-12-27 21:37:21 +00003018 rec->data_len += padlen + 1;
3019 post_avail -= padlen + 1;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003020
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003021#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003022 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00003023 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
3024 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003025 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003026 if( mbedtls_ssl_ver_geq(
3027 mbedtls_ssl_transform_get_minor_ver( transform ),
3028 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003029 {
Hanno Becker3307b532017-12-27 21:37:21 +00003030 if( f_rng == NULL )
3031 {
3032 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No PRNG provided to encrypt_record routine" ) );
3033 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3034 }
3035
3036 if( rec->data_offset < transform->ivlen )
3037 {
3038 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3039 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3040 }
3041
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003042 /*
3043 * Generate IV
3044 */
Hanno Becker3307b532017-12-27 21:37:21 +00003045 ret = f_rng( p_rng, transform->iv_enc, transform->ivlen );
Paul Bakkera3d195c2011-11-27 21:07:34 +00003046 if( ret != 0 )
3047 return( ret );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003048
Teppo Järvelin91d79382019-10-02 09:09:31 +03003049 mbedtls_platform_memcpy( data - transform->ivlen, transform->iv_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00003050 transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003051
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003052 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003053#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003054
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003055 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003056 "including %d bytes of IV and %d bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00003057 rec->data_len, transform->ivlen,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02003058 padlen + 1 ) );
Andrzej Kurek11750442020-09-17 07:12:06 -04003059#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003060 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
3061 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003062 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003063 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003064 return( ret );
3065 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003066
Andrzej Kurekff517212020-08-10 07:10:35 -04003067 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04003068 transform->iv_enc,
3069 transform->ivlen,
3070 data, rec->data_len,
3071 data, &olen ) ) != 0 )
3072 {
3073 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3074 return( ret );
3075 }
3076#else
Andrzej Kurekff517212020-08-10 07:10:35 -04003077 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00003078 transform->iv_enc,
3079 transform->ivlen,
3080 data, rec->data_len,
3081 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003082 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003083 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003084 return( ret );
3085 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003086#endif
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04003087
Hanno Becker3307b532017-12-27 21:37:21 +00003088 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003089 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003090 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3091 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003092 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003093
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003094#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003095 if( mbedtls_ssl_ver_lt(
3096 mbedtls_ssl_transform_get_minor_ver( transform ),
3097 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003098 {
3099 /*
3100 * Save IV in SSL3 and TLS1
3101 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003102#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3103 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx.iv,
3104 transform->ivlen );
3105#else
Teppo Järvelin91d79382019-10-02 09:09:31 +03003106 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx_enc.iv,
Hanno Becker3307b532017-12-27 21:37:21 +00003107 transform->ivlen );
Andrzej Kurek11750442020-09-17 07:12:06 -04003108#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003109 }
Hanno Becker3307b532017-12-27 21:37:21 +00003110 else
Paul Bakkercca5b812013-08-31 17:40:26 +02003111#endif
Hanno Becker3307b532017-12-27 21:37:21 +00003112 {
3113 data -= transform->ivlen;
3114 rec->data_offset -= transform->ivlen;
3115 rec->data_len += transform->ivlen;
3116 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003117
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003118#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003119 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003120 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00003121 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
3122
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003123 /*
3124 * MAC(MAC_write_key, seq_num +
3125 * TLSCipherText.type +
3126 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003127 * length_of( (IV +) ENC(...) ) +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003128 * IV + // except for TLS 1.0
3129 * ENC(content + padding + padding_length));
3130 */
Hanno Becker3307b532017-12-27 21:37:21 +00003131
3132 if( post_avail < transform->maclen)
3133 {
3134 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3135 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3136 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003137
Hanno Beckere83efe62019-04-29 13:52:53 +01003138 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003139
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003140 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Hanno Becker3307b532017-12-27 21:37:21 +00003141 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01003142 add_data_len );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003143
Hanno Becker3307b532017-12-27 21:37:21 +00003144 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01003145 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00003146 mbedtls_md_hmac_update( &transform->md_ctx_enc,
3147 data, rec->data_len );
3148 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
3149 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003150
Teppo Järvelin91d79382019-10-02 09:09:31 +03003151 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003152
Hanno Becker3307b532017-12-27 21:37:21 +00003153 rec->data_len += transform->maclen;
3154 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003155 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003156 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003157#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00003158 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003159 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003160#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003161 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003162 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003163 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3164 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003165 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003166
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003167 /* Make extra sure authentication was performed, exactly once */
3168 if( auth_done != 1 )
3169 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003170 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3171 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003172 }
3173
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003174 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003175
Andrzej Kurekff517212020-08-10 07:10:35 -04003176 if( encryption_status == 0 )
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04003177 {
3178 return( 0 );
3179 }
3180 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +00003181}
3182
Hanno Becker40478be2019-07-12 08:23:59 +01003183int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
Hanno Becker611a83b2018-01-03 14:27:32 +00003184 mbedtls_ssl_transform *transform,
3185 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00003186{
Hanno Becker4c6876b2017-12-27 21:28:58 +00003187 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003188 mbedtls_cipher_mode_t mode;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003189 int ret, auth_done = 0;
Hanno Becker5cc04d52018-01-03 15:24:20 +00003190#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01003191 size_t padlen = 0, correct = 1;
3192#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003193 unsigned char* data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01003194 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_IN_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01003195 size_t add_data_len;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003196
Hanno Becker611a83b2018-01-03 14:27:32 +00003197#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02003198 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003199 ((void) ssl);
3200#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003202 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003203 if( rec == NULL ||
3204 rec->buf == NULL ||
3205 rec->buf_len < rec->data_offset ||
3206 rec->buf_len - rec->data_offset < rec->data_len )
3207 {
3208 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to decrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003209 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003210 }
3211
Hanno Becker4c6876b2017-12-27 21:28:58 +00003212 data = rec->buf + rec->data_offset;
Andrzej Kurek11750442020-09-17 07:12:06 -04003213#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3214 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx );
3215#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003216 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -04003217#endif
Hanno Beckera5a2b082019-05-15 14:03:01 +01003218#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01003219 /*
3220 * Match record's CID with incoming CID.
3221 */
Hanno Beckerabd7c892019-05-08 13:02:22 +01003222 if( rec->cid_len != transform->in_cid_len ||
Teppo Järvelin0efac532019-10-04 13:21:08 +03003223 memcmp( rec->cid, transform->in_cid, rec->cid_len ) != 0 ) // use regular memcmp as CID is public
Hanno Beckerabd7c892019-05-08 13:02:22 +01003224 {
Hanno Beckere8eff9a2019-05-14 11:30:10 +01003225 return( MBEDTLS_ERR_SSL_UNEXPECTED_CID );
Hanno Beckerabd7c892019-05-08 13:02:22 +01003226 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003227#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01003228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003229#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
3230 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker68884e32013-01-07 18:20:04 +01003231 {
3232 padlen = 0;
Andrzej Kurek11750442020-09-17 07:12:06 -04003233#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003234 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3235 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003236 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003237 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003238 return( ret );
3239 }
3240 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx,
3241 transform->iv_dec,
3242 transform->ivlen,
3243 data, rec->data_len,
3244 data, &olen ) ) != 0 )
3245 {
3246 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3247 return( ret );
3248 }
3249#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003250 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3251 transform->iv_dec,
3252 transform->ivlen,
3253 data, rec->data_len,
3254 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003255 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003256 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003257 return( ret );
3258 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003259#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003260 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003261 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003262 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3263 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003264 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003265 }
Paul Bakker68884e32013-01-07 18:20:04 +01003266 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003267#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003268#if defined(MBEDTLS_GCM_C) || \
3269 defined(MBEDTLS_CCM_C) || \
3270 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003271 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003272 mode == MBEDTLS_MODE_CCM ||
3273 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003274 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003275 unsigned char iv[12];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003276 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003277
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003278 /*
3279 * Prepare IV from explicit and implicit data.
3280 */
3281
3282 /* Check that there's enough space for the explicit IV
3283 * (at the beginning of the record) and the MAC (at the
3284 * end of the record). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003285 if( rec->data_len < explicit_iv_len + transform->taglen )
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003286 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003287 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003288 "+ taglen (%d)", rec->data_len,
3289 explicit_iv_len, transform->taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003290 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003291 }
Paul Bakker68884e32013-01-07 18:20:04 +01003292
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003293#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003294 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
3295 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003296 /* GCM and CCM: fixed || explicit */
Paul Bakker68884e32013-01-07 18:20:04 +01003297
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003298 /* Fixed */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003299 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003300 /* Explicit */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003301 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, data, 8 );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003302 }
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003303 else
3304#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3305#if defined(MBEDTLS_CHACHAPOLY_C)
3306 if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003307 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02003308 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003309 unsigned char i;
3310
Teppo Järvelin91d79382019-10-02 09:09:31 +03003311 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003312
3313 for( i = 0; i < 8; i++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003314 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003315 }
3316 else
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003317#endif /* MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003318 {
3319 /* Reminder if we ever add an AEAD mode with a different size */
3320 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3321 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3322 }
3323
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003324 /* Group changes to data, data_len, and add_data, because
3325 * add_data depends on data_len. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003326 data += explicit_iv_len;
3327 rec->data_offset += explicit_iv_len;
3328 rec->data_len -= explicit_iv_len + transform->taglen;
3329
Hanno Beckere83efe62019-04-29 13:52:53 +01003330 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003331 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01003332 add_data, add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003333
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003334 /* Because of the check above, we know that there are
3335 * explicit_iv_len Bytes preceeding data, and taglen
3336 * bytes following data + data_len. This justifies
Hanno Becker07d420d2019-07-10 11:44:13 +01003337 * the debug message and the invocation of
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003338 * mbedtls_cipher_auth_decrypt() below. */
3339
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003340 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv, transform->ivlen );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003341 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", data + rec->data_len,
Hanno Becker8759e162017-12-27 21:34:08 +00003342 transform->taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01003343
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003344 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003345 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003346 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003347#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003348 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3349 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003350 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003351 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003352 return( ret );
3353 }
3354 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx,
3355 iv, transform->ivlen,
3356 add_data, add_data_len,
3357 data, rec->data_len,
3358 data, &olen,
3359 data + rec->data_len,
3360 transform->taglen ) ) != 0 )
3361 {
3362 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
3363
3364 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3365 return( MBEDTLS_ERR_SSL_INVALID_MAC );
3366
3367 return( ret );
3368 }
3369#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003370 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx_dec,
3371 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01003372 add_data, add_data_len,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003373 data, rec->data_len,
3374 data, &olen,
3375 data + rec->data_len,
3376 transform->taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003377 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003378 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003379
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003380 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3381 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003382
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003383 return( ret );
3384 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003385#endif
3386
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003387 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003388
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003389 /* Double-check that AEAD decryption doesn't change content length. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003390 if( olen != rec->data_len )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003391 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003392 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3393 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003394 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00003395 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003396 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003397#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3398#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003399 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003400 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00003401 {
Paul Bakkere47b34b2013-02-27 14:48:00 +01003402 size_t minlen = 0;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003403
Paul Bakker5121ce52009-01-03 21:22:43 +00003404 /*
Paul Bakker45829992013-01-03 14:52:21 +01003405 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00003406 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003407#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003408 if( mbedtls_ssl_ver_geq(
3409 mbedtls_ssl_transform_get_minor_ver( transform ),
3410 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003411 {
3412 /* The ciphertext is prefixed with the CBC IV. */
3413 minlen += transform->ivlen;
3414 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003415#endif
Paul Bakker45829992013-01-03 14:52:21 +01003416
Hanno Becker4c6876b2017-12-27 21:28:58 +00003417 /* Size considerations:
3418 *
3419 * - The CBC cipher text must not be empty and hence
3420 * at least of size transform->ivlen.
3421 *
3422 * Together with the potential IV-prefix, this explains
3423 * the first of the two checks below.
3424 *
3425 * - The record must contain a MAC, either in plain or
3426 * encrypted, depending on whether Encrypt-then-MAC
3427 * is used or not.
3428 * - If it is, the message contains the IV-prefix,
3429 * the CBC ciphertext, and the MAC.
3430 * - If it is not, the padded plaintext, and hence
3431 * the CBC ciphertext, has at least length maclen + 1
3432 * because there is at least the padding length byte.
3433 *
3434 * As the CBC ciphertext is not empty, both cases give the
3435 * lower bound minlen + maclen + 1 on the record size, which
3436 * we test for in the second check below.
3437 */
3438 if( rec->data_len < minlen + transform->ivlen ||
3439 rec->data_len < minlen + transform->maclen + 1 )
Paul Bakker45829992013-01-03 14:52:21 +01003440 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003441 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003442 "+ 1 ) ( + expl IV )", rec->data_len,
3443 transform->ivlen,
3444 transform->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003445 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01003446 }
3447
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003448 /*
3449 * Authenticate before decrypt if enabled
3450 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003451#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003452 if( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003453 {
Hanno Becker992b6872017-11-09 18:57:39 +00003454 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003455
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003456 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003457
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003458 /* Update data_len in tandem with add_data.
3459 *
3460 * The subtraction is safe because of the previous check
3461 * data_len >= minlen + maclen + 1.
3462 *
3463 * Afterwards, we know that data + data_len is followed by at
3464 * least maclen Bytes, which justifies the call to
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003465 * mbedtls_platform_memequal() below.
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003466 *
3467 * Further, we still know that data_len > minlen */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003468 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003469 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003470
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003471 /* Calculate expected MAC. */
Hanno Beckere83efe62019-04-29 13:52:53 +01003472 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
3473 add_data_len );
3474 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3475 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003476 mbedtls_md_hmac_update( &transform->md_ctx_dec,
3477 data, rec->data_len );
3478 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
3479 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003480
Hanno Becker4c6876b2017-12-27 21:28:58 +00003481 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len,
3482 transform->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00003483 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003484 transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003485
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003486 /* Compare expected MAC with MAC at the end of the record. */
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003487 if( mbedtls_platform_memequal( data + rec->data_len, mac_expect,
3488 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003489 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003490 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003491 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003492 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003493 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003494 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003495#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003496
3497 /*
3498 * Check length sanity
3499 */
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003500
3501 /* We know from above that data_len > minlen >= 0,
3502 * so the following check in particular implies that
3503 * data_len >= minlen + ivlen ( = minlen or 2 * minlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003504 if( rec->data_len % transform->ivlen != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003505 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003506 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003507 rec->data_len, transform->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003508 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003509 }
3510
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003511#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003512 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00003513 * Initialize for prepended IV for block cipher in TLS v1.1 and up
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003514 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003515 if( mbedtls_ssl_ver_geq(
3516 mbedtls_ssl_transform_get_minor_ver( transform ),
3517 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003518 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003519 /* Safe because data_len >= minlen + ivlen = 2 * ivlen. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003520 mbedtls_platform_memcpy( transform->iv_dec, data, transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003521
Hanno Becker4c6876b2017-12-27 21:28:58 +00003522 data += transform->ivlen;
3523 rec->data_offset += transform->ivlen;
3524 rec->data_len -= transform->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003525 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003526#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003527
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003528 /* We still have data_len % ivlen == 0 and data_len >= ivlen here. */
Andrzej Kurek11750442020-09-17 07:12:06 -04003529#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003530 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3531 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003532 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003533 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003534 return( ret );
3535 }
Andrzej Kureka7932372020-09-19 07:56:06 +02003536
Andrzej Kurek11750442020-09-17 07:12:06 -04003537 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx,
3538 transform->iv_dec, transform->ivlen,
3539 data, rec->data_len, data, &olen ) ) != 0 )
3540 {
3541 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3542 return( ret );
3543 }
3544#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003545 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3546 transform->iv_dec, transform->ivlen,
3547 data, rec->data_len, data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003548 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003549 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003550 return( ret );
3551 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003552#endif
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003553 /* Double-check that length hasn't changed during decryption. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003554 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003555 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003556 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3557 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003558 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003559
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003560#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003561 if( mbedtls_ssl_ver_lt(
3562 mbedtls_ssl_transform_get_minor_ver( transform ),
3563 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003564 {
3565 /*
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003566 * Save IV in SSL3 and TLS1, where CBC decryption of consecutive
3567 * records is equivalent to CBC decryption of the concatenation
3568 * of the records; in other words, IVs are maintained across
3569 * record decryptions.
Paul Bakkercca5b812013-08-31 17:40:26 +02003570 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003571#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3572 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx.iv,
3573 transform->ivlen );
3574#else
Teppo Järvelin91d79382019-10-02 09:09:31 +03003575 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx_dec.iv,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003576 transform->ivlen );
Andrzej Kurek11750442020-09-17 07:12:06 -04003577#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003578 }
Paul Bakkercca5b812013-08-31 17:40:26 +02003579#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003580
Hanno Becker4c6876b2017-12-27 21:28:58 +00003581 /* Safe since data_len >= minlen + maclen + 1, so after having
3582 * subtracted at most minlen and maclen up to this point,
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003583 * data_len > 0 (because of data_len % ivlen == 0, it's actually
3584 * >= ivlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003585 padlen = data[rec->data_len - 1];
Paul Bakker45829992013-01-03 14:52:21 +01003586
Hanno Becker4c6876b2017-12-27 21:28:58 +00003587 if( auth_done == 1 )
3588 {
3589 correct *= ( rec->data_len >= padlen + 1 );
3590 padlen *= ( rec->data_len >= padlen + 1 );
3591 }
3592 else
Paul Bakker45829992013-01-03 14:52:21 +01003593 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003594#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003595 if( rec->data_len < transform->maclen + padlen + 1 )
3596 {
3597 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
3598 rec->data_len,
3599 transform->maclen,
3600 padlen + 1 ) );
3601 }
Paul Bakkerd66f0702013-01-31 16:57:45 +01003602#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003603
3604 correct *= ( rec->data_len >= transform->maclen + padlen + 1 );
3605 padlen *= ( rec->data_len >= transform->maclen + padlen + 1 );
Paul Bakker45829992013-01-03 14:52:21 +01003606 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003607
Hanno Becker4c6876b2017-12-27 21:28:58 +00003608 padlen++;
3609
3610 /* Regardless of the validity of the padding,
3611 * we have data_len >= padlen here. */
3612
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003613#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003614 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3615 MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003616 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003617 if( padlen > transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003619#if defined(MBEDTLS_SSL_DEBUG_ALL)
3620 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003621 "should be no more than %d",
3622 padlen, transform->ivlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003623#endif
Paul Bakker45829992013-01-03 14:52:21 +01003624 correct = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00003625 }
3626 }
3627 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003628#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3629#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3630 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003631 if( mbedtls_ssl_ver_gt(
3632 mbedtls_ssl_transform_get_minor_ver( transform ),
3633 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003634 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003635 /* The padding check involves a series of up to 256
3636 * consecutive memory reads at the end of the record
3637 * plaintext buffer. In order to hide the length and
3638 * validity of the padding, always perform exactly
3639 * `min(256,plaintext_len)` reads (but take into account
3640 * only the last `padlen` bytes for the padding check). */
3641 size_t pad_count = 0;
3642 size_t real_count = 0;
3643 volatile unsigned char* const check = data;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003644
Hanno Becker4c6876b2017-12-27 21:28:58 +00003645 /* Index of first padding byte; it has been ensured above
3646 * that the subtraction is safe. */
3647 size_t const padding_idx = rec->data_len - padlen;
3648 size_t const num_checks = rec->data_len <= 256 ? rec->data_len : 256;
3649 size_t const start_idx = rec->data_len - num_checks;
3650 size_t idx;
Paul Bakker956c9e02013-12-19 14:42:28 +01003651
Hanno Becker4c6876b2017-12-27 21:28:58 +00003652 for( idx = start_idx; idx < rec->data_len; idx++ )
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003653 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003654 real_count |= ( idx >= padding_idx );
3655 pad_count += real_count * ( check[idx] == padlen - 1 );
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003656 }
Hanno Becker4c6876b2017-12-27 21:28:58 +00003657 correct &= ( pad_count == padlen );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003658
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003659#if defined(MBEDTLS_SSL_DEBUG_ALL)
Paul Bakker66d5d072014-06-17 16:39:18 +02003660 if( padlen > 0 && correct == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003661 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003662#endif
Paul Bakkere47b34b2013-02-27 14:48:00 +01003663 padlen &= correct * 0x1FF;
Paul Bakker5121ce52009-01-03 21:22:43 +00003664 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003665 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003666#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3667 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003668 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003669 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3670 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003671 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003672
Hanno Becker4c6876b2017-12-27 21:28:58 +00003673 /* If the padding was found to be invalid, padlen == 0
3674 * and the subtraction is safe. If the padding was found valid,
3675 * padlen hasn't been changed and the previous assertion
3676 * data_len >= padlen still holds. */
3677 rec->data_len -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00003678 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003679 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003680#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003681 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003682 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003683 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3684 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003685 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003686
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003687#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003688 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003689 data, rec->data_len );
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003690#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003691
3692 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003693 * Authenticate if not done yet.
3694 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00003695 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00003696#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003697 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003698 {
Hanno Becker992b6872017-11-09 18:57:39 +00003699 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01003700
Hanno Becker4c6876b2017-12-27 21:28:58 +00003701 /* If the initial value of padlen was such that
3702 * data_len < maclen + padlen + 1, then padlen
3703 * got reset to 1, and the initial check
3704 * data_len >= minlen + maclen + 1
3705 * guarantees that at this point we still
3706 * have at least data_len >= maclen.
3707 *
3708 * If the initial value of padlen was such that
3709 * data_len >= maclen + padlen + 1, then we have
3710 * subtracted either padlen + 1 (if the padding was correct)
3711 * or 0 (if the padding was incorrect) since then,
3712 * hence data_len >= maclen in any case.
3713 */
3714 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003715 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Paul Bakker5121ce52009-01-03 21:22:43 +00003716
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003717#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003718 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3719 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003720 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003721 ssl_mac( &transform->md_ctx_dec,
3722 transform->mac_dec,
3723 data, rec->data_len,
3724 rec->ctr, rec->type,
3725 mac_expect );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003726 }
3727 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003728#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3729#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3730 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003731 if( mbedtls_ssl_ver_gt(
3732 mbedtls_ssl_transform_get_minor_ver( transform ),
3733 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003734 {
3735 /*
3736 * Process MAC and always update for padlen afterwards to make
Gilles Peskine20b44082018-05-29 14:06:49 +02003737 * total time independent of padlen.
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003738 *
3739 * Known timing attacks:
3740 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
3741 *
Gilles Peskine20b44082018-05-29 14:06:49 +02003742 * To compensate for different timings for the MAC calculation
3743 * depending on how much padding was removed (which is determined
3744 * by padlen), process extra_run more blocks through the hash
3745 * function.
3746 *
3747 * The formula in the paper is
3748 * extra_run = ceil( (L1-55) / 64 ) - ceil( (L2-55) / 64 )
3749 * where L1 is the size of the header plus the decrypted message
3750 * plus CBC padding and L2 is the size of the header plus the
3751 * decrypted message. This is for an underlying hash function
3752 * with 64-byte blocks.
3753 * We use ( (Lx+8) / 64 ) to handle 'negative Lx' values
3754 * correctly. We round down instead of up, so -56 is the correct
3755 * value for our calculations instead of -55.
3756 *
Gilles Peskine1bd9d582018-06-04 11:58:44 +02003757 * Repeat the formula rather than defining a block_size variable.
3758 * This avoids requiring division by a variable at runtime
3759 * (which would be marginally less efficient and would require
3760 * linking an extra division function in some builds).
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003761 */
3762 size_t j, extra_run = 0;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003763 unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003764
3765 /*
3766 * The next two sizes are the minimum and maximum values of
3767 * in_msglen over all padlen values.
3768 *
3769 * They're independent of padlen, since we previously did
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003770 * data_len -= padlen.
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003771 *
3772 * Note that max_len + maclen is never more than the buffer
3773 * length, as we previously did in_msglen -= maclen too.
3774 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003775 const size_t max_len = rec->data_len + padlen;
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003776 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
3777
Hanno Becker4c6876b2017-12-27 21:28:58 +00003778 memset( tmp, 0, sizeof( tmp ) );
3779
Hanno Beckera5cedbc2019-07-17 11:21:02 +01003780 switch( mbedtls_md_get_type(
3781 mbedtls_md_get_handle( &transform->md_ctx_dec ) ) )
Gilles Peskine20b44082018-05-29 14:06:49 +02003782 {
Gilles Peskined0e55a42018-06-04 12:03:30 +02003783#if defined(MBEDTLS_MD5_C) || defined(MBEDTLS_SHA1_C) || \
3784 defined(MBEDTLS_SHA256_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003785 case MBEDTLS_MD_MD5:
3786 case MBEDTLS_MD_SHA1:
Gilles Peskine20b44082018-05-29 14:06:49 +02003787 case MBEDTLS_MD_SHA256:
Gilles Peskine20b44082018-05-29 14:06:49 +02003788 /* 8 bytes of message size, 64-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003789 extra_run =
3790 ( add_data_len + rec->data_len + padlen + 8 ) / 64 -
3791 ( add_data_len + rec->data_len + 8 ) / 64;
Gilles Peskine20b44082018-05-29 14:06:49 +02003792 break;
3793#endif
Gilles Peskinea7fe25d2018-06-04 12:01:18 +02003794#if defined(MBEDTLS_SHA512_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003795 case MBEDTLS_MD_SHA384:
Gilles Peskine20b44082018-05-29 14:06:49 +02003796 /* 16 bytes of message size, 128-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003797 extra_run =
3798 ( add_data_len + rec->data_len + padlen + 16 ) / 128 -
3799 ( add_data_len + rec->data_len + 16 ) / 128;
Gilles Peskine20b44082018-05-29 14:06:49 +02003800 break;
3801#endif
3802 default:
Gilles Peskine5c389842018-06-04 12:02:43 +02003803 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Gilles Peskine20b44082018-05-29 14:06:49 +02003804 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3805 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01003806
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003807 extra_run &= correct * 0xFF;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003808
Hanno Beckere83efe62019-04-29 13:52:53 +01003809 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3810 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003811 mbedtls_md_hmac_update( &transform->md_ctx_dec, data,
3812 rec->data_len );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003813 /* Make sure we access everything even when padlen > 0. This
3814 * makes the synchronisation requirements for just-in-time
3815 * Prime+Probe attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003816 ssl_read_memory( data + rec->data_len, padlen );
3817 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003818
3819 /* Call mbedtls_md_process at least once due to cache attacks
3820 * that observe whether md_process() was called of not */
Manuel Pégourié-Gonnard47fede02015-04-29 01:35:48 +02003821 for( j = 0; j < extra_run + 1; j++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003822 mbedtls_md_process( &transform->md_ctx_dec, tmp );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003823
Hanno Becker4c6876b2017-12-27 21:28:58 +00003824 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003825
3826 /* Make sure we access all the memory that could contain the MAC,
3827 * before we check it in the next code block. This makes the
3828 * synchronisation requirements for just-in-time Prime+Probe
3829 * attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003830 ssl_read_memory( data + min_len,
3831 max_len - min_len + transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003832 }
3833 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003834#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3835 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003836 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003837 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3838 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003839 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003840
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003841#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003842 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, transform->maclen );
3843 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len, transform->maclen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003844#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003845
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003846 if( mbedtls_platform_memequal( data + rec->data_len, mac_expect,
3847 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003848 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003849#if defined(MBEDTLS_SSL_DEBUG_ALL)
3850 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003851#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003852 correct = 0;
3853 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003854 auth_done++;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003855 }
Hanno Beckerdd3ab132018-10-17 14:43:14 +01003856
3857 /*
3858 * Finally check the correct flag
3859 */
3860 if( correct == 0 )
3861 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Hanno Becker5cc04d52018-01-03 15:24:20 +00003862#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003863
3864 /* Make extra sure authentication was performed, exactly once */
3865 if( auth_done != 1 )
3866 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003867 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3868 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003869 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003870
Hanno Beckera5a2b082019-05-15 14:03:01 +01003871#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker92c930f2019-04-29 17:31:37 +01003872 if( rec->cid_len != 0 )
3873 {
3874 ret = ssl_cid_parse_inner_plaintext( data, &rec->data_len,
3875 &rec->type );
3876 if( ret != 0 )
3877 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3878 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003879#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01003880
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003881 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003882
3883 return( 0 );
3884}
3885
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01003886#undef MAC_NONE
3887#undef MAC_PLAINTEXT
3888#undef MAC_CIPHERTEXT
3889
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003890#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00003891/*
3892 * Compression/decompression functions
3893 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003894static int ssl_compress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003895{
3896 int ret;
3897 unsigned char *msg_post = ssl->out_msg;
Andrzej Kurek5462e022018-04-20 07:58:53 -04003898 ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003899 size_t len_pre = ssl->out_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003900 unsigned char *msg_pre = ssl->compress_buf;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003901#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3902 size_t out_buf_len = ssl->out_buf_len;
3903#else
3904 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3905#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00003906
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003907 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003908
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003909 if( len_pre == 0 )
3910 return( 0 );
3911
Teppo Järvelin91d79382019-10-02 09:09:31 +03003912 mbedtls_platform_memcpy( msg_pre, ssl->out_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003913
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003914 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003915 ssl->out_msglen ) );
3916
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003917 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003918 ssl->out_msg, ssl->out_msglen );
3919
Paul Bakker48916f92012-09-16 19:57:18 +00003920 ssl->transform_out->ctx_deflate.next_in = msg_pre;
3921 ssl->transform_out->ctx_deflate.avail_in = len_pre;
3922 ssl->transform_out->ctx_deflate.next_out = msg_post;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003923 ssl->transform_out->ctx_deflate.avail_out = out_buf_len - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003924
Paul Bakker48916f92012-09-16 19:57:18 +00003925 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003926 if( ret != Z_OK )
3927 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003928 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
3929 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003930 }
3931
Andrzej Kurekf3844952020-10-16 23:03:01 +02003932 ssl->out_msglen = out_buf_len -
Andrzej Kurek5462e022018-04-20 07:58:53 -04003933 ssl->transform_out->ctx_deflate.avail_out - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003934
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003935 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003936 ssl->out_msglen ) );
3937
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003938 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003939 ssl->out_msg, ssl->out_msglen );
3940
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003941 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003942
3943 return( 0 );
3944}
3945
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003946static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003947{
3948 int ret;
3949 unsigned char *msg_post = ssl->in_msg;
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003950 ptrdiff_t header_bytes = ssl->in_msg - ssl->in_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003951 size_t len_pre = ssl->in_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003952 unsigned char *msg_pre = ssl->compress_buf;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003953#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3954 size_t in_buf_len = ssl->in_buf_len;
3955#else
3956 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3957#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00003958
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003959 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003960
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003961 if( len_pre == 0 )
3962 return( 0 );
3963
Teppo Järvelin91d79382019-10-02 09:09:31 +03003964 mbedtls_platform_memcpy( msg_pre, ssl->in_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003965
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003966 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003967 ssl->in_msglen ) );
3968
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003969 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003970 ssl->in_msg, ssl->in_msglen );
3971
Paul Bakker48916f92012-09-16 19:57:18 +00003972 ssl->transform_in->ctx_inflate.next_in = msg_pre;
3973 ssl->transform_in->ctx_inflate.avail_in = len_pre;
3974 ssl->transform_in->ctx_inflate.next_out = msg_post;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003975 ssl->transform_in->ctx_inflate.avail_out = in_buf_len -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003976 header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003977
Paul Bakker48916f92012-09-16 19:57:18 +00003978 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003979 if( ret != Z_OK )
3980 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003981 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
3982 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003983 }
3984
Andrzej Kurekf3844952020-10-16 23:03:01 +02003985 ssl->in_msglen = in_buf_len -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003986 ssl->transform_in->ctx_inflate.avail_out - header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003987
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003988 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003989 ssl->in_msglen ) );
3990
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003991 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003992 ssl->in_msg, ssl->in_msglen );
3993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003994 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003995
3996 return( 0 );
3997}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003998#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00003999
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004000#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
4001static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004002
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004003#if defined(MBEDTLS_SSL_PROTO_DTLS)
4004static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004005{
4006 /* If renegotiation is not enforced, retransmit until we would reach max
4007 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004008 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004009 {
Hanno Becker1f835fa2019-06-13 10:14:59 +01004010 uint32_t ratio =
4011 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) /
4012 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004013 unsigned char doublings = 1;
4014
4015 while( ratio != 0 )
4016 {
4017 ++doublings;
4018 ratio >>= 1;
4019 }
4020
4021 if( ++ssl->renego_records_seen > doublings )
4022 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02004023 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004024 return( 0 );
4025 }
4026 }
4027
4028 return( ssl_write_hello_request( ssl ) );
4029}
4030#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004031#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004032
Paul Bakker5121ce52009-01-03 21:22:43 +00004033/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004034 * Fill the input message buffer by appending data to it.
4035 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004036 *
4037 * If we return 0, is it guaranteed that (at least) nb_want bytes are
4038 * available (from this read and/or a previous one). Otherwise, an error code
4039 * is returned (possibly EOF or WANT_READ).
4040 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004041 * With stream transport (TLS) on success ssl->in_left == nb_want, but
4042 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
4043 * since we always read a whole datagram at once.
4044 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02004045 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004046 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00004047 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004048int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00004049{
Paul Bakker23986e52011-04-24 08:57:21 +00004050 int ret;
4051 size_t len;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004052#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4053 size_t in_buf_len = ssl->in_buf_len;
4054#else
4055 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4056#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004058 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004059
Hanno Beckera58a8962019-06-13 16:11:15 +01004060 if( mbedtls_ssl_get_recv( ssl ) == NULL &&
4061 mbedtls_ssl_get_recv_timeout( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004062 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004063 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01004064 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004065 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004066 }
4067
Andrzej Kurekf3844952020-10-16 23:03:01 +02004068 if( nb_want > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004069 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004070 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
4071 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004072 }
4073
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004074#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004075 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004076 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004077 uint32_t timeout;
4078
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02004079 /* Just to be sure */
Hanno Becker0ae6b242019-06-13 16:45:36 +01004080 if( mbedtls_ssl_get_set_timer( ssl ) == NULL ||
4081 mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02004082 {
4083 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
4084 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
4085 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4086 }
4087
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004088 /*
4089 * The point is, we need to always read a full datagram at once, so we
4090 * sometimes read more then requested, and handle the additional data.
4091 * It could be the rest of the current record (while fetching the
4092 * header) and/or some other records in the same datagram.
4093 */
4094
4095 /*
4096 * Move to the next record in the already read datagram if applicable
4097 */
4098 if( ssl->next_record_offset != 0 )
4099 {
4100 if( ssl->in_left < ssl->next_record_offset )
4101 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004102 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4103 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004104 }
4105
4106 ssl->in_left -= ssl->next_record_offset;
4107
4108 if( ssl->in_left != 0 )
4109 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004110 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004111 ssl->next_record_offset ) );
4112 memmove( ssl->in_hdr,
4113 ssl->in_hdr + ssl->next_record_offset,
4114 ssl->in_left );
4115 }
4116
4117 ssl->next_record_offset = 0;
4118 }
4119
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004120 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Paul Bakker5121ce52009-01-03 21:22:43 +00004121 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004122
4123 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004124 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004125 */
4126 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004127 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004128 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004129 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004130 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004131
4132 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01004133 * A record can't be split across datagrams. If we need to read but
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004134 * are not at the beginning of a new record, the caller did something
4135 * wrong.
4136 */
4137 if( ssl->in_left != 0 )
4138 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004139 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4140 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004141 }
4142
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004143 /*
4144 * Don't even try to read if time's out already.
4145 * This avoids by-passing the timer when repeatedly receiving messages
4146 * that will end up being dropped.
4147 */
4148 if( ssl_check_timer( ssl ) != 0 )
Hanno Beckere65ce782017-05-22 14:47:48 +01004149 {
4150 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004151 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Hanno Beckere65ce782017-05-22 14:47:48 +01004152 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004153 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004154 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02004155 len = in_buf_len - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004156
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004157 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004158 timeout = ssl->handshake->retransmit_timeout;
4159 else
Hanno Becker1f835fa2019-06-13 10:14:59 +01004160 timeout = mbedtls_ssl_conf_get_read_timeout( ssl->conf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004162 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004163
Hanno Beckera58a8962019-06-13 16:11:15 +01004164 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
4165 {
4166 ret = mbedtls_ssl_get_recv_timeout( ssl )
4167 ( ssl->p_bio, ssl->in_hdr, len, timeout );
4168 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004169 else
Hanno Beckera58a8962019-06-13 16:11:15 +01004170 {
4171 ret = mbedtls_ssl_get_recv( ssl )
4172 ( ssl->p_bio, ssl->in_hdr, len );
4173 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004174
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004175 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004176
4177 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004178 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004179 }
4180
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004181 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004182 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004183 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004184 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004186 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004187 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004188 if( ssl_double_retransmit_timeout( ssl ) != 0 )
4189 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004190 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004191 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004192 }
4193
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004194 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004195 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004196 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004197 return( ret );
4198 }
4199
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004200 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004201 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004202#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +01004203 else if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4204 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004205 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004206 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004207 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004208 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004209 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004210 return( ret );
4211 }
4212
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004213 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004214 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004215#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004216 }
4217
Paul Bakker5121ce52009-01-03 21:22:43 +00004218 if( ret < 0 )
4219 return( ret );
4220
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004221 ssl->in_left = ret;
4222 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004223 MBEDTLS_SSL_TRANSPORT_ELSE
4224#endif /* MBEDTLS_SSL_PROTO_DTLS */
4225#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004226 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004227 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004228 ssl->in_left, nb_want ) );
4229
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004230 while( ssl->in_left < nb_want )
4231 {
4232 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02004233
4234 if( ssl_check_timer( ssl ) != 0 )
4235 ret = MBEDTLS_ERR_SSL_TIMEOUT;
4236 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004237 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004238 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004239 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004240 ret = mbedtls_ssl_get_recv_timeout( ssl )( ssl->p_bio,
4241 ssl->in_hdr + ssl->in_left, len,
4242 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004243 }
4244 else
4245 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004246 ret = mbedtls_ssl_get_recv( ssl )( ssl->p_bio,
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004247 ssl->in_hdr + ssl->in_left, len );
4248 }
4249 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004251 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004252 ssl->in_left, nb_want ) );
4253 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004254
4255 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004256 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004257
4258 if( ret < 0 )
4259 return( ret );
4260
mohammad160352aecb92018-03-28 23:41:40 -07004261 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16035bd15cb2018-02-28 04:30:59 -08004262 {
Darryl Green11999bb2018-03-13 15:22:58 +00004263 MBEDTLS_SSL_DEBUG_MSG( 1,
4264 ( "f_recv returned %d bytes but only %lu were requested",
mohammad160319d392b2018-04-02 07:25:26 -07004265 ret, (unsigned long)len ) );
mohammad16035bd15cb2018-02-28 04:30:59 -08004266 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4267 }
4268
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004269 ssl->in_left += ret;
4270 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004271 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004272#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00004273
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004274 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004275
4276 return( 0 );
4277}
4278
4279/*
4280 * Flush any data not yet written
4281 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004282int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004283{
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01004284 int ret;
Hanno Becker04484622018-08-06 09:49:38 +01004285 unsigned char *buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00004286
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004288
Hanno Beckera58a8962019-06-13 16:11:15 +01004289 if( mbedtls_ssl_get_send( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004290 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004291 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01004292 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004293 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004294 }
4295
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004296 /* Avoid incrementing counter if data is flushed */
4297 if( ssl->out_left == 0 )
4298 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004299 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004300 return( 0 );
4301 }
4302
Paul Bakker5121ce52009-01-03 21:22:43 +00004303 while( ssl->out_left > 0 )
4304 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004305 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
Hanno Becker43395762019-05-03 14:46:38 +01004306 mbedtls_ssl_out_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004307
Hanno Becker2b1e3542018-08-06 11:19:13 +01004308 buf = ssl->out_hdr - ssl->out_left;
Hanno Beckera58a8962019-06-13 16:11:15 +01004309 ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00004310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004311 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004312
4313 if( ret <= 0 )
4314 return( ret );
4315
mohammad160352aecb92018-03-28 23:41:40 -07004316 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16034bbaeb42018-02-22 04:29:04 -08004317 {
Darryl Green11999bb2018-03-13 15:22:58 +00004318 MBEDTLS_SSL_DEBUG_MSG( 1,
4319 ( "f_send returned %d bytes but only %lu bytes were sent",
mohammad160319d392b2018-04-02 07:25:26 -07004320 ret, (unsigned long)ssl->out_left ) );
mohammad16034bbaeb42018-02-22 04:29:04 -08004321 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4322 }
4323
Paul Bakker5121ce52009-01-03 21:22:43 +00004324 ssl->out_left -= ret;
4325 }
4326
Hanno Becker2b1e3542018-08-06 11:19:13 +01004327#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004328 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004329 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004330 ssl->out_hdr = ssl->out_buf;
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004331 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004332 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2b1e3542018-08-06 11:19:13 +01004333#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004334#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +01004335 {
4336 ssl->out_hdr = ssl->out_buf + 8;
4337 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004338#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004339 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004340
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004341 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004342
4343 return( 0 );
4344}
4345
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004346/*
4347 * Functions to handle the DTLS retransmission state machine
4348 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004349#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004350/*
4351 * Append current handshake message to current outgoing flight
4352 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004353static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004354{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004355 mbedtls_ssl_flight_item *msg;
Hanno Becker3b235902018-08-06 09:54:53 +01004356 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
4357 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
4358 ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004359
4360 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004361 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004362 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004363 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004364 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004365 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004366 }
4367
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004368 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004369 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004370 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004371 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004372 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004373 }
4374
4375 /* Copy current handshake message with headers */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004376 mbedtls_platform_memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004377 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004378 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004379 msg->next = NULL;
4380
4381 /* Append to the current flight */
4382 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004383 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004384 else
4385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004386 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004387 while( cur->next != NULL )
4388 cur = cur->next;
4389 cur->next = msg;
4390 }
4391
Hanno Becker3b235902018-08-06 09:54:53 +01004392 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004393 return( 0 );
4394}
4395
4396/*
4397 * Free the current flight of handshake messages
4398 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004399static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004400{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004401 mbedtls_ssl_flight_item *cur = flight;
4402 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004403
4404 while( cur != NULL )
4405 {
4406 next = cur->next;
4407
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004408 mbedtls_free( cur->p );
4409 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004410
4411 cur = next;
4412 }
4413}
4414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004415#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4416static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004417#endif
4418
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004419/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004420 * Swap transform_out and out_ctr with the alternative ones
4421 */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004422static int ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004423{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004424 mbedtls_ssl_transform *tmp_transform;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004425 unsigned char tmp_out_ctr[8];
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004426#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4427 int ret;
4428#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004429
4430 if( ssl->transform_out == ssl->handshake->alt_transform_out )
4431 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004432 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004433 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004434 }
4435
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004436 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004437
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004438 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004439 tmp_transform = ssl->transform_out;
4440 ssl->transform_out = ssl->handshake->alt_transform_out;
4441 ssl->handshake->alt_transform_out = tmp_transform;
4442
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004443 /* Swap epoch + sequence_number */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004444 mbedtls_platform_memcpy( tmp_out_ctr, ssl->cur_out_ctr, 8 );
4445 mbedtls_platform_memcpy( ssl->cur_out_ctr, ssl->handshake->alt_out_ctr, 8 );
4446 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004447
4448 /* Adjust to the newly activated transform */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004449 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004450
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004451#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4452 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004453 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004454 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004455 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004456 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
4457 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004458 }
4459 }
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004460#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
4461
4462 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004463}
4464
4465/*
4466 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004467 */
4468int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
4469{
4470 int ret = 0;
4471
4472 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
4473
4474 ret = mbedtls_ssl_flight_transmit( ssl );
4475
4476 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
4477
4478 return( ret );
4479}
4480
4481/*
4482 * Transmit or retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004483 *
4484 * Need to remember the current message in case flush_output returns
4485 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004486 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004487 */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004488int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004489{
Hanno Becker67bc7c32018-08-06 11:33:50 +01004490 int ret;
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004491 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004492
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004493 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004494 {
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004495 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004496
4497 ssl->handshake->cur_msg = ssl->handshake->flight;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004498 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004499 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4500 return( ret );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004501
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004502 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004503 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004504
4505 while( ssl->handshake->cur_msg != NULL )
4506 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004507 size_t max_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004508 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004509
Hanno Beckere1dcb032018-08-17 16:47:58 +01004510 int const is_finished =
4511 ( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
4512 cur->p[0] == MBEDTLS_SSL_HS_FINISHED );
4513
Hanno Becker04da1892018-08-14 13:22:10 +01004514 uint8_t const force_flush = ssl->disable_datagram_packing == 1 ?
4515 SSL_FORCE_FLUSH : SSL_DONT_FORCE_FLUSH;
4516
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004517 /* Swap epochs before sending Finished: we can't do it after
4518 * sending ChangeCipherSpec, in case write returns WANT_READ.
4519 * Must be done before copying, may change out_msg pointer */
Hanno Beckere1dcb032018-08-17 16:47:58 +01004520 if( is_finished && ssl->handshake->cur_msg_p == ( cur->p + 12 ) )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004521 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004522 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004523 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4524 return( ret );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004525 }
4526
Hanno Becker67bc7c32018-08-06 11:33:50 +01004527 ret = ssl_get_remaining_payload_in_datagram( ssl );
4528 if( ret < 0 )
4529 return( ret );
4530 max_frag_len = (size_t) ret;
4531
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004532 /* CCS is copied as is, while HS messages may need fragmentation */
4533 if( cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4534 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004535 if( max_frag_len == 0 )
4536 {
4537 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4538 return( ret );
4539
4540 continue;
4541 }
4542
Teppo Järvelin91d79382019-10-02 09:09:31 +03004543 mbedtls_platform_memcpy( ssl->out_msg, cur->p, cur->len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004544 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004545 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004546
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004547 /* Update position inside current message */
4548 ssl->handshake->cur_msg_p += cur->len;
4549 }
4550 else
4551 {
4552 const unsigned char * const p = ssl->handshake->cur_msg_p;
4553 const size_t hs_len = cur->len - 12;
4554 const size_t frag_off = p - ( cur->p + 12 );
4555 const size_t rem_len = hs_len - frag_off;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004556 size_t cur_hs_frag_len, max_hs_frag_len;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004557
Hanno Beckere1dcb032018-08-17 16:47:58 +01004558 if( ( max_frag_len < 12 ) || ( max_frag_len == 12 && hs_len != 0 ) )
Manuel Pégourié-Gonnarda1071a52018-08-20 11:56:14 +02004559 {
Hanno Beckere1dcb032018-08-17 16:47:58 +01004560 if( is_finished )
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004561 {
4562 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4563 return( ret );
4564 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004565
Hanno Becker67bc7c32018-08-06 11:33:50 +01004566 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4567 return( ret );
4568
4569 continue;
4570 }
4571 max_hs_frag_len = max_frag_len - 12;
4572
4573 cur_hs_frag_len = rem_len > max_hs_frag_len ?
4574 max_hs_frag_len : rem_len;
4575
4576 if( frag_off == 0 && cur_hs_frag_len != hs_len )
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004577 {
4578 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
Hanno Becker67bc7c32018-08-06 11:33:50 +01004579 (unsigned) cur_hs_frag_len,
4580 (unsigned) max_hs_frag_len ) );
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004581 }
Manuel Pégourié-Gonnardb747c6c2018-08-12 13:28:53 +02004582
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004583 /* Messages are stored with handshake headers as if not fragmented,
4584 * copy beginning of headers then fill fragmentation fields.
4585 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004586 mbedtls_platform_memcpy( ssl->out_msg, cur->p, 6 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004587
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004588 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[6], frag_off );
4589 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[9],
4590 cur_hs_frag_len );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004591
4592 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl->out_msg, 12 );
4593
Hanno Becker3f7b9732018-08-28 09:53:25 +01004594 /* Copy the handshake message content and set records fields */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004595 mbedtls_platform_memcpy( ssl->out_msg + 12, p, cur_hs_frag_len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004596 ssl->out_msglen = cur_hs_frag_len + 12;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004597 ssl->out_msgtype = cur->type;
4598
4599 /* Update position inside current message */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004600 ssl->handshake->cur_msg_p += cur_hs_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004601 }
4602
4603 /* If done with the current message move to the next one if any */
4604 if( ssl->handshake->cur_msg_p >= cur->p + cur->len )
4605 {
4606 if( cur->next != NULL )
4607 {
4608 ssl->handshake->cur_msg = cur->next;
4609 ssl->handshake->cur_msg_p = cur->next->p + 12;
4610 }
4611 else
4612 {
4613 ssl->handshake->cur_msg = NULL;
4614 ssl->handshake->cur_msg_p = NULL;
4615 }
4616 }
4617
4618 /* Actually send the message out */
Hanno Becker04da1892018-08-14 13:22:10 +01004619 if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004620 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004621 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004622 return( ret );
4623 }
4624 }
4625
Hanno Becker67bc7c32018-08-06 11:33:50 +01004626 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4627 return( ret );
4628
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004629 /* Update state and set timer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004630 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
4631 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02004632 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004633 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004634 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004635 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
4636 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004637
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004638 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004639
4640 return( 0 );
4641}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004642
4643/*
4644 * To be called when the last message of an incoming flight is received.
4645 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004646void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004647{
4648 /* We won't need to resend that one any more */
4649 ssl_flight_free( ssl->handshake->flight );
4650 ssl->handshake->flight = NULL;
4651 ssl->handshake->cur_msg = NULL;
4652
4653 /* The next incoming flight will start with this msg_seq */
4654 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
4655
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004656 /* We don't want to remember CCS's across flight boundaries. */
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004657 ssl->handshake->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004658
Hanno Becker0271f962018-08-16 13:23:47 +01004659 /* Clear future message buffering structure. */
4660 ssl_buffering_free( ssl );
4661
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004662 /* Cancel timer */
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004663 ssl_set_timer( ssl, 0 );
4664
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004665 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4666 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004667 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004668 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004669 }
4670 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004671 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004672}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004673
4674/*
4675 * To be called when the last message of an outgoing flight is send.
4676 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004677void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004678{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004679 ssl_reset_retransmit_timeout( ssl );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004680 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004681
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004682 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4683 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004684 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004685 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004686 }
4687 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004688 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004689}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004690#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004691
Paul Bakker5121ce52009-01-03 21:22:43 +00004692/*
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004693 * Handshake layer functions
Paul Bakker5121ce52009-01-03 21:22:43 +00004694 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004695
4696/*
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004697 * Write (DTLS: or queue) current handshake (including CCS) message.
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004698 *
4699 * - fill in handshake headers
4700 * - update handshake checksum
4701 * - DTLS: save message for resending
4702 * - then pass to the record layer
4703 *
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004704 * DTLS: except for HelloRequest, messages are only queued, and will only be
4705 * actually sent when calling flight_transmit() or resend().
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004706 *
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004707 * Inputs:
4708 * - ssl->out_msglen: 4 + actual handshake message len
4709 * (4 is the size of handshake headers for TLS)
4710 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
4711 * - ssl->out_msg + 4: the handshake message body
4712 *
Manuel Pégourié-Gonnard065a2a32018-08-20 11:09:26 +02004713 * Outputs, ie state before passing to flight_append() or write_record():
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004714 * - ssl->out_msglen: the length of the record contents
4715 * (including handshake headers but excluding record headers)
4716 * - ssl->out_msg: the record contents (handshake headers + content)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004717 */
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004718int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004719{
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004720 int ret;
4721 const size_t hs_len = ssl->out_msglen - 4;
4722 const unsigned char hs_type = ssl->out_msg[0];
Paul Bakker5121ce52009-01-03 21:22:43 +00004723
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004724 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
4725
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004726 /*
4727 * Sanity checks
4728 */
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004729 if( ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004730 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4731 {
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004732 /* In SSLv3, the client might send a NoCertificate alert. */
4733#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2881d802019-05-22 14:44:53 +01004734 if( ! ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004735 ssl->out_msgtype == MBEDTLS_SSL_MSG_ALERT &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01004736 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4737 MBEDTLS_SSL_IS_CLIENT ) )
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004738#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
4739 {
4740 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4741 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4742 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004743 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004744
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004745 /* Whenever we send anything different from a
4746 * HelloRequest we should be in a handshake - double check. */
4747 if( ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4748 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) &&
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004749 ssl->handshake == NULL )
4750 {
4751 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4752 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4753 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004754
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004755#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004756 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004757 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004758 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004759 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004760 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4761 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004762 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004763#endif
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004764
Hanno Beckerb50a2532018-08-06 11:52:54 +01004765 /* Double-check that we did not exceed the bounds
4766 * of the outgoing record buffer.
4767 * This should never fail as the various message
4768 * writing functions must obey the bounds of the
4769 * outgoing record buffer, but better be safe.
4770 *
4771 * Note: We deliberately do not check for the MTU or MFL here.
4772 */
4773 if( ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN )
4774 {
4775 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
4776 "size %u, maximum %u",
4777 (unsigned) ssl->out_msglen,
4778 (unsigned) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
4779 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4780 }
4781
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004782 /*
4783 * Fill handshake headers
4784 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004785 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004786 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004787 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[1], hs_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00004788
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004789 /*
4790 * DTLS has additional fields in the Handshake layer,
4791 * between the length field and the actual payload:
4792 * uint16 message_seq;
4793 * uint24 fragment_offset;
4794 * uint24 fragment_length;
4795 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004796#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004797 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004798 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004799 /* Make room for the additional DTLS fields */
Angus Grattond8213d02016-05-25 20:56:48 +10004800 if( MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8 )
Hanno Becker9648f8b2017-09-18 10:55:54 +01004801 {
4802 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
4803 "size %u, maximum %u",
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004804 (unsigned) ( hs_len ),
Angus Grattond8213d02016-05-25 20:56:48 +10004805 (unsigned) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
Hanno Becker9648f8b2017-09-18 10:55:54 +01004806 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4807 }
4808
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004809 memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004810 ssl->out_msglen += 8;
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004811
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004812 /* Write message_seq and update it, except for HelloRequest */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004813 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004814 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004815 (void)mbedtls_platform_put_uint16_be( &ssl->out_msg[4],
4816 ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02004817 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004818 }
4819 else
4820 {
4821 ssl->out_msg[4] = 0;
4822 ssl->out_msg[5] = 0;
4823 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004824
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004825 /* Handshake hashes are computed without fragmentation,
4826 * so set frag_offset = 0 and frag_len = hs_len for now */
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02004827 if( mbedtls_platform_memset( ssl->out_msg + 6, 0x00, 3 ) !=
4828 ssl->out_msg + 6 )
4829 {
4830 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
4831 }
4832 if( mbedtls_platform_memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 ) !=
4833 ssl->out_msg + 9 )
4834 {
4835 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
4836 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004837 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004838#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004839
Hanno Becker0207e532018-08-28 10:28:28 +01004840 /* Update running hashes of handshake messages seen */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004841 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Hanno Becker8a4b5902019-08-15 17:04:57 +01004842 mbedtls_ssl_update_checksum( ssl, ssl->out_msg, ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00004843 }
4844
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004845 /* Either send now, or just save to be sent (and resent) later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004846#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004847 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004848 ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4849 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004850 {
4851 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
4852 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004853 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004854 return( ret );
4855 }
4856 }
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004857 else
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004858#endif
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004859 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004860 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004861 {
4862 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
4863 return( ret );
4864 }
4865 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004866
4867 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
4868
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004869 return( 0 );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004870}
4871
4872/*
4873 * Record layer functions
4874 */
4875
4876/*
4877 * Write current record.
4878 *
4879 * Uses:
4880 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
4881 * - ssl->out_msglen: length of the record content (excl headers)
4882 * - ssl->out_msg: record content
4883 */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004884int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush )
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004885{
4886 int ret, done = 0;
4887 size_t len = ssl->out_msglen;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004888 uint8_t flush = force_flush;
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004889
4890 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004891
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004892#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00004893 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004894 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00004895 {
4896 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
4897 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004898 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004899 return( ret );
4900 }
4901
4902 len = ssl->out_msglen;
4903 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004904#endif /*MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004905
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004906#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4907 if( mbedtls_ssl_hw_record_write != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004908 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004909 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004910
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004911 ret = mbedtls_ssl_hw_record_write( ssl );
4912 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00004913 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004914 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
4915 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004916 }
Paul Bakkerc7878112012-12-19 14:41:14 +01004917
4918 if( ret == 0 )
4919 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00004920 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004921#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00004922 if( !done )
4923 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004924 unsigned i;
4925 size_t protected_record_size;
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004926 volatile int encrypted_fi = 0;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004927#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4928 size_t out_buf_len = ssl->out_buf_len;
4929#else
4930 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4931#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004932
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004933 /* Skip writing the record content type to after the encryption,
4934 * as it may change when using the CID extension. */
4935
Hanno Becker2881d802019-05-22 14:44:53 +01004936 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4937 mbedtls_ssl_get_minor_ver( ssl ),
4938 ssl->conf->transport, ssl->out_hdr + 1 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01004939
Teppo Järvelin91d79382019-10-02 09:09:31 +03004940 mbedtls_platform_memcpy( ssl->out_ctr, ssl->cur_out_ctr, 8 );
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004941 (void)mbedtls_platform_put_uint16_be( ssl->out_len, len );
Paul Bakker05ef8352012-05-08 09:17:57 +00004942
Paul Bakker48916f92012-09-16 19:57:18 +00004943 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00004944 {
Hanno Becker3307b532017-12-27 21:37:21 +00004945 mbedtls_record rec;
4946
4947 rec.buf = ssl->out_iv;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004948 rec.buf_len = out_buf_len - ( ssl->out_iv - ssl->out_buf );
Hanno Becker3307b532017-12-27 21:37:21 +00004949 rec.data_len = ssl->out_msglen;
4950 rec.data_offset = ssl->out_msg - rec.buf;
4951
Teppo Järvelin91d79382019-10-02 09:09:31 +03004952 mbedtls_platform_memcpy( &rec.ctr[0], ssl->out_ctr, 8 );
Hanno Becker2881d802019-05-22 14:44:53 +01004953 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4954 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Becker3307b532017-12-27 21:37:21 +00004955 ssl->conf->transport, rec.ver );
4956 rec.type = ssl->out_msgtype;
4957
Hanno Beckera5a2b082019-05-15 14:03:01 +01004958#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01004959 /* The CID is set by mbedtls_ssl_encrypt_buf(). */
Hanno Beckere83efe62019-04-29 13:52:53 +01004960 rec.cid_len = 0;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004961#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01004962
Hanno Becker611a83b2018-01-03 14:27:32 +00004963 if( ( ret = mbedtls_ssl_encrypt_buf( ssl, ssl->transform_out, &rec,
Hanno Beckerece325c2019-06-13 15:39:27 +01004964 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01004965 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00004966 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004967 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00004968 return( ret );
4969 }
4970
Hanno Becker3307b532017-12-27 21:37:21 +00004971 if( rec.data_offset != 0 )
4972 {
4973 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4974 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4975 }
4976
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004977 /* Update the record content type and CID. */
4978 ssl->out_msgtype = rec.type;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004979#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID )
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03004980 /* Not using more secure mbedtls_platform_memcpy as cid is public */
4981 memcpy( ssl->out_cid, rec.cid, rec.cid_len );
Hanno Beckera5a2b082019-05-15 14:03:01 +01004982#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc5aee962019-03-14 12:56:23 +00004983 ssl->out_msglen = len = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004984 (void)mbedtls_platform_put_uint16_be( ssl->out_len, rec.data_len );
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004985 encrypted_fi = 1;
4986 }
4987
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004988 /* Double check to ensure the encryption has been done */
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004989 if( ssl->transform_out != NULL && encrypted_fi == 0 )
4990 {
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004991 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004992 }
4993
Hanno Becker43395762019-05-03 14:46:38 +01004994 protected_record_size = len + mbedtls_ssl_out_hdr_len( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01004995
4996#if defined(MBEDTLS_SSL_PROTO_DTLS)
4997 /* In case of DTLS, double-check that we don't exceed
4998 * the remaining space in the datagram. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004999 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2b1e3542018-08-06 11:19:13 +01005000 {
Hanno Becker554b0af2018-08-22 20:33:41 +01005001 ret = ssl_get_remaining_space_in_datagram( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01005002 if( ret < 0 )
5003 return( ret );
5004
5005 if( protected_record_size > (size_t) ret )
5006 {
5007 /* Should never happen */
5008 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5009 }
5010 }
5011#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker05ef8352012-05-08 09:17:57 +00005012
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005013 /* Now write the potentially updated record content type. */
5014 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
5015
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005016 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01005017 "version = [%d:%d], msglen = %d",
5018 ssl->out_hdr[0], ssl->out_hdr[1],
5019 ssl->out_hdr[2], len ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00005020
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005021 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01005022 ssl->out_hdr, protected_record_size );
Hanno Becker2b1e3542018-08-06 11:19:13 +01005023
5024 ssl->out_left += protected_record_size;
5025 ssl->out_hdr += protected_record_size;
5026 ssl_update_out_pointers( ssl, ssl->transform_out );
5027
Hanno Becker04484622018-08-06 09:49:38 +01005028 for( i = 8; i > ssl_ep_len( ssl ); i-- )
5029 if( ++ssl->cur_out_ctr[i - 1] != 0 )
5030 break;
5031
5032 /* The loop goes to its end iff the counter is wrapping */
5033 if( i == ssl_ep_len( ssl ) )
5034 {
5035 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
5036 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
5037 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005038 }
5039
Hanno Becker67bc7c32018-08-06 11:33:50 +01005040#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005041 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker47db8772018-08-21 13:32:13 +01005042 flush == SSL_DONT_FORCE_FLUSH )
Hanno Becker67bc7c32018-08-06 11:33:50 +01005043 {
Hanno Becker1f5a15d2018-08-21 13:31:31 +01005044 size_t remaining;
5045 ret = ssl_get_remaining_payload_in_datagram( ssl );
5046 if( ret < 0 )
5047 {
5048 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
5049 ret );
5050 return( ret );
5051 }
5052
5053 remaining = (size_t) ret;
Hanno Becker67bc7c32018-08-06 11:33:50 +01005054 if( remaining == 0 )
Hanno Beckerf0da6672018-08-28 09:55:10 +01005055 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01005056 flush = SSL_FORCE_FLUSH;
Hanno Beckerf0da6672018-08-28 09:55:10 +01005057 }
Hanno Becker67bc7c32018-08-06 11:33:50 +01005058 else
5059 {
Hanno Becker513815a2018-08-20 11:56:09 +01005060 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining ) );
Hanno Becker67bc7c32018-08-06 11:33:50 +01005061 }
5062 }
5063#endif /* MBEDTLS_SSL_PROTO_DTLS */
5064
5065 if( ( flush == SSL_FORCE_FLUSH ) &&
5066 ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005067 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005068 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005069 return( ret );
5070 }
5071
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005072 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005073
5074 return( 0 );
5075}
5076
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005077#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckere25e3b72018-08-16 09:30:53 +01005078
5079static int ssl_hs_is_proper_fragment( mbedtls_ssl_context *ssl )
5080{
5081 if( ssl->in_msglen < ssl->in_hslen ||
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02005082 mbedtls_platform_memequal( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
5083 mbedtls_platform_memequal( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
Hanno Beckere25e3b72018-08-16 09:30:53 +01005084 {
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04005085 return( PROPER_HS_FRAGMENT );
Hanno Beckere25e3b72018-08-16 09:30:53 +01005086 }
5087 return( 0 );
5088}
Hanno Becker44650b72018-08-16 12:51:11 +01005089
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005090static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005091{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005092 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[9] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01005093}
5094
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005095static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005096{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005097 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[6] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01005098}
5099
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005100static int ssl_check_hs_header( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005101{
5102 uint32_t msg_len, frag_off, frag_len;
5103
5104 msg_len = ssl_get_hs_total_len( ssl );
5105 frag_off = ssl_get_hs_frag_off( ssl );
5106 frag_len = ssl_get_hs_frag_len( ssl );
5107
5108 if( frag_off > msg_len )
5109 return( -1 );
5110
5111 if( frag_len > msg_len - frag_off )
5112 return( -1 );
5113
5114 if( frag_len + 12 > ssl->in_msglen )
5115 return( -1 );
5116
5117 return( 0 );
5118}
5119
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005120/*
5121 * Mark bits in bitmask (used for DTLS HS reassembly)
5122 */
5123static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
5124{
5125 unsigned int start_bits, end_bits;
5126
5127 start_bits = 8 - ( offset % 8 );
5128 if( start_bits != 8 )
5129 {
5130 size_t first_byte_idx = offset / 8;
5131
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02005132 /* Special case */
5133 if( len <= start_bits )
5134 {
5135 for( ; len != 0; len-- )
5136 mask[first_byte_idx] |= 1 << ( start_bits - len );
5137
5138 /* Avoid potential issues with offset or len becoming invalid */
5139 return;
5140 }
5141
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005142 offset += start_bits; /* Now offset % 8 == 0 */
5143 len -= start_bits;
5144
5145 for( ; start_bits != 0; start_bits-- )
5146 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
5147 }
5148
5149 end_bits = len % 8;
5150 if( end_bits != 0 )
5151 {
5152 size_t last_byte_idx = ( offset + len ) / 8;
5153
5154 len -= end_bits; /* Now len % 8 == 0 */
5155
5156 for( ; end_bits != 0; end_bits-- )
5157 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
5158 }
5159
5160 memset( mask + offset / 8, 0xFF, len / 8 );
5161}
5162
Andrzej Kurek0919b142020-07-06 15:28:59 -04005163#define BITMASK_CHECK_FAILED 0x75555555
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005164/*
5165 * Check that bitmask is full
5166 */
5167static int ssl_bitmask_check( unsigned char *mask, size_t len )
5168{
5169 size_t i;
5170
5171 for( i = 0; i < len / 8; i++ )
5172 if( mask[i] != 0xFF )
Andrzej Kurek0919b142020-07-06 15:28:59 -04005173 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005174
5175 for( i = 0; i < len % 8; i++ )
5176 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04005177 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005178
5179 return( 0 );
5180}
5181
Hanno Becker56e205e2018-08-16 09:06:12 +01005182/* msg_len does not include the handshake header */
Hanno Becker65dc8852018-08-23 09:40:49 +01005183static size_t ssl_get_reassembly_buffer_size( size_t msg_len,
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005184 unsigned add_bitmap )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005185{
Hanno Becker56e205e2018-08-16 09:06:12 +01005186 size_t alloc_len;
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005187
Hanno Becker56e205e2018-08-16 09:06:12 +01005188 alloc_len = 12; /* Handshake header */
5189 alloc_len += msg_len; /* Content buffer */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005190
Hanno Beckerd07df862018-08-16 09:14:58 +01005191 if( add_bitmap )
5192 alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap */
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005193
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005194 return( alloc_len );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005195}
Hanno Becker56e205e2018-08-16 09:06:12 +01005196
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005197#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005198
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005199static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl )
Hanno Becker12555c62018-08-16 12:47:53 +01005200{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005201 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[1] ) );
Hanno Becker12555c62018-08-16 12:47:53 +01005202}
Hanno Beckere25e3b72018-08-16 09:30:53 +01005203
Simon Butcher99000142016-10-13 17:21:01 +01005204int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005205{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005206 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005207 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005208 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005209 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005210 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005211 }
5212
Hanno Becker12555c62018-08-16 12:47:53 +01005213 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005215 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005216 " %d, type = %d, hslen = %d",
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01005217 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005218
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005219#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005220 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005221 {
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005222 int ret;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005223 unsigned int recv_msg_seq = (unsigned int)
5224 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005225
Hanno Becker44650b72018-08-16 12:51:11 +01005226 if( ssl_check_hs_header( ssl ) != 0 )
5227 {
5228 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
5229 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5230 }
5231
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005232 if( ssl->handshake != NULL &&
Hanno Beckerc76c6192017-06-06 10:03:17 +01005233 ( ( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
5234 recv_msg_seq != ssl->handshake->in_msg_seq ) ||
5235 ( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5236 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) ) )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005237 {
Hanno Becker9e1ec222018-08-15 15:54:43 +01005238 if( recv_msg_seq > ssl->handshake->in_msg_seq )
5239 {
5240 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
5241 recv_msg_seq,
5242 ssl->handshake->in_msg_seq ) );
5243 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5244 }
5245
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02005246 /* Retransmit only on last message from previous flight, to avoid
5247 * too many retransmissions.
5248 * Besides, No sane server ever retransmits HelloVerifyRequest */
5249 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005250 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005251 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005252 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005253 "message_seq = %d, start_of_flight = %d",
5254 recv_msg_seq,
5255 ssl->handshake->in_flight_start_seq ) );
5256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005257 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005258 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005259 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005260 return( ret );
5261 }
5262 }
5263 else
5264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005265 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005266 "message_seq = %d, expected = %d",
5267 recv_msg_seq,
5268 ssl->handshake->in_msg_seq ) );
5269 }
5270
Hanno Becker90333da2017-10-10 11:27:13 +01005271 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005272 }
5273 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005274
Hanno Becker6d97ef52018-08-16 13:09:04 +01005275 /* Message reassembly is handled alongside buffering of future
5276 * messages; the commonality is that both handshake fragments and
Hanno Becker83ab41c2018-08-28 17:19:38 +01005277 * future messages cannot be forwarded immediately to the
Hanno Becker6d97ef52018-08-16 13:09:04 +01005278 * handshake logic layer. */
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04005279 if( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005280 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005281 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Hanno Becker6d97ef52018-08-16 13:09:04 +01005282 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005283 }
5284 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005285 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005286#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005287#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005288 {
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005289 /* With TLS we don't handle fragmentation (for now) */
5290 if( ssl->in_msglen < ssl->in_hslen )
5291 {
5292 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
5293 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
5294 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005295 }
Manuel Pégourié-Gonnardec1c2222019-06-12 10:18:26 +02005296#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005297
Simon Butcher99000142016-10-13 17:21:01 +01005298 return( 0 );
5299}
5300
5301void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
5302{
Hanno Becker0271f962018-08-16 13:23:47 +01005303 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Simon Butcher99000142016-10-13 17:21:01 +01005304
Hanno Becker0271f962018-08-16 13:23:47 +01005305 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && hs != NULL )
Hanno Becker8a4b5902019-08-15 17:04:57 +01005306 mbedtls_ssl_update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005307
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005308 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005309#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005310 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005311 ssl->handshake != NULL )
5312 {
Hanno Becker0271f962018-08-16 13:23:47 +01005313 unsigned offset;
5314 mbedtls_ssl_hs_buffer *hs_buf;
Hanno Beckere25e3b72018-08-16 09:30:53 +01005315
Hanno Becker0271f962018-08-16 13:23:47 +01005316 /* Increment handshake sequence number */
5317 hs->in_msg_seq++;
5318
5319 /*
5320 * Clear up handshake buffering and reassembly structure.
5321 */
5322
5323 /* Free first entry */
Hanno Beckere605b192018-08-21 15:59:07 +01005324 ssl_buffering_free_slot( ssl, 0 );
Hanno Becker0271f962018-08-16 13:23:47 +01005325
5326 /* Shift all other entries */
Hanno Beckere605b192018-08-21 15:59:07 +01005327 for( offset = 0, hs_buf = &hs->buffering.hs[0];
5328 offset + 1 < MBEDTLS_SSL_MAX_BUFFERED_HS;
Hanno Becker0271f962018-08-16 13:23:47 +01005329 offset++, hs_buf++ )
5330 {
5331 *hs_buf = *(hs_buf + 1);
5332 }
5333
5334 /* Create a fresh last entry */
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02005335 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005336 }
5337#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005338}
5339
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005340/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005341 * DTLS anti-replay: RFC 6347 4.1.2.6
5342 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005343 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
5344 * Bit n is set iff record number in_window_top - n has been seen.
5345 *
5346 * Usually, in_window_top is the last record number seen and the lsb of
5347 * in_window is set. The only exception is the initial state (record number 0
5348 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005349 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005350#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5351static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005352{
5353 ssl->in_window_top = 0;
5354 ssl->in_window = 0;
5355}
5356
5357static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
5358{
5359 return( ( (uint64_t) buf[0] << 40 ) |
5360 ( (uint64_t) buf[1] << 32 ) |
5361 ( (uint64_t) buf[2] << 24 ) |
5362 ( (uint64_t) buf[3] << 16 ) |
5363 ( (uint64_t) buf[4] << 8 ) |
5364 ( (uint64_t) buf[5] ) );
5365}
5366
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005367static int mbedtls_ssl_dtls_record_replay_check( mbedtls_ssl_context *ssl, uint8_t *record_in_ctr )
5368{
5369 int ret;
5370 unsigned char *original_in_ctr;
5371
5372 // save original in_ctr
5373 original_in_ctr = ssl->in_ctr;
5374
5375 // use counter from record
5376 ssl->in_ctr = record_in_ctr;
5377
5378 ret = mbedtls_ssl_dtls_replay_check( (mbedtls_ssl_context const *) ssl );
5379
5380 // restore the counter
5381 ssl->in_ctr = original_in_ctr;
5382
5383 return ret;
5384}
5385
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005386/*
5387 * Return 0 if sequence number is acceptable, -1 otherwise
5388 */
Hanno Beckerfc551722019-07-12 08:50:37 +01005389int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context const *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005390{
5391 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5392 uint64_t bit;
5393
Hanno Becker7f376f42019-06-12 16:20:48 +01005394 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5395 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5396 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005397 return( 0 );
Hanno Becker7f376f42019-06-12 16:20:48 +01005398 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005399
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005400 if( rec_seqnum > ssl->in_window_top )
5401 return( 0 );
5402
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005403 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005404
5405 if( bit >= 64 )
5406 return( -1 );
5407
5408 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
5409 return( -1 );
5410
5411 return( 0 );
5412}
5413
5414/*
5415 * Update replay window on new validated record
5416 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005417void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005418{
5419 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5420
Hanno Becker7f376f42019-06-12 16:20:48 +01005421 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5422 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5423 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005424 return;
Hanno Becker7f376f42019-06-12 16:20:48 +01005425 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005426
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005427 if( rec_seqnum > ssl->in_window_top )
5428 {
5429 /* Update window_top and the contents of the window */
5430 uint64_t shift = rec_seqnum - ssl->in_window_top;
5431
5432 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005433 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005434 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005435 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005436 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005437 ssl->in_window |= 1;
5438 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005439
5440 ssl->in_window_top = rec_seqnum;
5441 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005442 else
5443 {
5444 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005445 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005446
5447 if( bit < 64 ) /* Always true, but be extra sure */
5448 ssl->in_window |= (uint64_t) 1 << bit;
5449 }
5450}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005451#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005452
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005453#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005454/* Forward declaration */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005455static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
5456
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005457/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005458 * Without any SSL context, check if a datagram looks like a ClientHello with
5459 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01005460 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005461 *
5462 * - if cookie is valid, return 0
5463 * - if ClientHello looks superficially valid but cookie is not,
5464 * fill obuf and set olen, then
5465 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
5466 * - otherwise return a specific error code
5467 */
5468static int ssl_check_dtls_clihlo_cookie(
5469 mbedtls_ssl_cookie_write_t *f_cookie_write,
5470 mbedtls_ssl_cookie_check_t *f_cookie_check,
5471 void *p_cookie,
5472 const unsigned char *cli_id, size_t cli_id_len,
5473 const unsigned char *in, size_t in_len,
5474 unsigned char *obuf, size_t buf_len, size_t *olen )
5475{
5476 size_t sid_len, cookie_len;
5477 unsigned char *p;
5478
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005479 /*
5480 * Structure of ClientHello with record and handshake headers,
5481 * and expected values. We don't need to check a lot, more checks will be
5482 * done when actually parsing the ClientHello - skipping those checks
5483 * avoids code duplication and does not make cookie forging any easier.
5484 *
5485 * 0-0 ContentType type; copied, must be handshake
5486 * 1-2 ProtocolVersion version; copied
5487 * 3-4 uint16 epoch; copied, must be 0
5488 * 5-10 uint48 sequence_number; copied
5489 * 11-12 uint16 length; (ignored)
5490 *
5491 * 13-13 HandshakeType msg_type; (ignored)
5492 * 14-16 uint24 length; (ignored)
5493 * 17-18 uint16 message_seq; copied
5494 * 19-21 uint24 fragment_offset; copied, must be 0
5495 * 22-24 uint24 fragment_length; (ignored)
5496 *
5497 * 25-26 ProtocolVersion client_version; (ignored)
5498 * 27-58 Random random; (ignored)
5499 * 59-xx SessionID session_id; 1 byte len + sid_len content
5500 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
5501 * ...
5502 *
5503 * Minimum length is 61 bytes.
5504 */
5505 if( in_len < 61 ||
5506 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
5507 in[3] != 0 || in[4] != 0 ||
5508 in[19] != 0 || in[20] != 0 || in[21] != 0 )
5509 {
5510 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5511 }
5512
5513 sid_len = in[59];
5514 if( sid_len > in_len - 61 )
5515 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5516
5517 cookie_len = in[60 + sid_len];
5518 if( cookie_len > in_len - 60 )
5519 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5520
5521 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
5522 cli_id, cli_id_len ) == 0 )
5523 {
5524 /* Valid cookie */
5525 return( 0 );
5526 }
5527
5528 /*
5529 * If we get here, we've got an invalid cookie, let's prepare HVR.
5530 *
5531 * 0-0 ContentType type; copied
5532 * 1-2 ProtocolVersion version; copied
5533 * 3-4 uint16 epoch; copied
5534 * 5-10 uint48 sequence_number; copied
5535 * 11-12 uint16 length; olen - 13
5536 *
5537 * 13-13 HandshakeType msg_type; hello_verify_request
5538 * 14-16 uint24 length; olen - 25
5539 * 17-18 uint16 message_seq; copied
5540 * 19-21 uint24 fragment_offset; copied
5541 * 22-24 uint24 fragment_length; olen - 25
5542 *
5543 * 25-26 ProtocolVersion server_version; 0xfe 0xff
5544 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
5545 *
5546 * Minimum length is 28.
5547 */
5548 if( buf_len < 28 )
5549 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5550
5551 /* Copy most fields and adapt others */
Teppo Järvelin91d79382019-10-02 09:09:31 +03005552 mbedtls_platform_memcpy( obuf, in, 25 );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005553 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
5554 obuf[25] = 0xfe;
5555 obuf[26] = 0xff;
5556
5557 /* Generate and write actual cookie */
5558 p = obuf + 28;
5559 if( f_cookie_write( p_cookie,
5560 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
5561 {
5562 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5563 }
5564
5565 *olen = p - obuf;
5566
5567 /* Go back and fill length fields */
5568 obuf[27] = (unsigned char)( *olen - 28 );
5569
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005570 (void)mbedtls_platform_put_uint24_be( &obuf[14], ( *olen - 25 ) );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005571 obuf[22] = obuf[14];
5572 obuf[23] = obuf[15];
5573 obuf[24] = obuf[16];
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005574
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005575 (void)mbedtls_platform_put_uint16_be( &obuf[11], ( *olen - 13 ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005576
5577 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
5578}
5579
5580/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005581 * Handle possible client reconnect with the same UDP quadruplet
5582 * (RFC 6347 Section 4.2.8).
5583 *
5584 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
5585 * that looks like a ClientHello.
5586 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005587 * - if the input looks like a ClientHello without cookies,
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005588 * send back HelloVerifyRequest, then return 0
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005589 * - if the input looks like a ClientHello with a valid cookie,
5590 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02005591 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005592 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005593 *
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005594 * This function is called (through ssl_check_client_reconnect()) when an
5595 * unexpected record is found in ssl_get_next_record(), which will discard the
5596 * record if we return 0, and bubble up the return value otherwise (this
5597 * includes the case of MBEDTLS_ERR_SSL_CLIENT_RECONNECT and of unexpected
5598 * errors, and is the right thing to do in both cases).
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005599 */
5600static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
5601{
5602 int ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005603 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005604
Hanno Becker87b56262019-07-10 14:37:41 +01005605 if( ssl->conf->f_cookie_write == NULL ||
5606 ssl->conf->f_cookie_check == NULL )
5607 {
5608 /* If we can't use cookies to verify reachability of the peer,
5609 * drop the record. */
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005610 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no cookie callbacks, "
5611 "can't check reconnect validity" ) );
Hanno Becker87b56262019-07-10 14:37:41 +01005612 return( 0 );
5613 }
5614
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005615 ret = ssl_check_dtls_clihlo_cookie(
5616 ssl->conf->f_cookie_write,
5617 ssl->conf->f_cookie_check,
5618 ssl->conf->p_cookie,
5619 ssl->cli_id, ssl->cli_id_len,
5620 ssl->in_buf, ssl->in_left,
Angus Grattond8213d02016-05-25 20:56:48 +10005621 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005622
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005623 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
5624
5625 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005626 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005627 int send_ret;
5628 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
5629 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
5630 ssl->out_buf, len );
Brian J Murray1903fb32016-11-06 04:45:15 -08005631 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005632 * If the error is permanent we'll catch it later,
5633 * if it's not, then hopefully it'll work next time. */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005634 send_ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, ssl->out_buf, len );
5635 MBEDTLS_SSL_DEBUG_RET( 2, "mbedtls_ssl_get_send", send_ret );
5636 (void) send_ret;
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005637 return( 0 );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005638 }
5639
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005640 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005641 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005642 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005643 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
5644 {
5645 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
5646 return( ret );
5647 }
5648
5649 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005650 }
5651
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005652 return( ret );
5653}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005654#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005655
Hanno Becker46483f12019-05-03 13:25:54 +01005656static int ssl_check_record_type( uint8_t record_type )
5657{
5658 if( record_type != MBEDTLS_SSL_MSG_HANDSHAKE &&
5659 record_type != MBEDTLS_SSL_MSG_ALERT &&
5660 record_type != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
5661 record_type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
5662 {
5663 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5664 }
5665
5666 return( 0 );
5667}
5668
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005669/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005670 * ContentType type;
5671 * ProtocolVersion version;
5672 * uint16 epoch; // DTLS only
5673 * uint48 sequence_number; // DTLS only
5674 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005675 *
5676 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00005677 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005678 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
5679 *
5680 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00005681 * 1. proceed with the record if this function returns 0
5682 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
5683 * 3. return CLIENT_RECONNECT if this function return that value
5684 * 4. drop the whole datagram if this function returns anything else.
5685 * Point 2 is needed when the peer is resending, and we have already received
5686 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005687 */
Hanno Becker21fc61c2019-07-12 11:10:16 +01005688static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005689 unsigned char *buf,
5690 size_t len,
5691 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00005692{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005693 int major_ver, minor_ver;
Paul Bakker5121ce52009-01-03 21:22:43 +00005694
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005695 size_t const rec_hdr_type_offset = 0;
5696 size_t const rec_hdr_type_len = 1;
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02005697
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005698 size_t const rec_hdr_version_offset = rec_hdr_type_offset +
5699 rec_hdr_type_len;
5700 size_t const rec_hdr_version_len = 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00005701
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005702 size_t const rec_hdr_ctr_len = 8;
5703#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker61817612019-07-25 10:13:02 +01005704 uint32_t rec_epoch;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005705 size_t const rec_hdr_ctr_offset = rec_hdr_version_offset +
5706 rec_hdr_version_len;
5707
Hanno Beckera5a2b082019-05-15 14:03:01 +01005708#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005709 size_t const rec_hdr_cid_offset = rec_hdr_ctr_offset +
5710 rec_hdr_ctr_len;
Hanno Becker61817612019-07-25 10:13:02 +01005711 size_t rec_hdr_cid_len = 0;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005712#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5713#endif /* MBEDTLS_SSL_PROTO_DTLS */
5714
5715 size_t rec_hdr_len_offset; /* To be determined */
5716 size_t const rec_hdr_len_len = 2;
5717
5718 /*
5719 * Check minimum lengths for record header.
5720 */
5721
5722#if defined(MBEDTLS_SSL_PROTO_DTLS)
5723 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5724 {
5725 rec_hdr_len_offset = rec_hdr_ctr_offset + rec_hdr_ctr_len;
5726 }
5727 MBEDTLS_SSL_TRANSPORT_ELSE
5728#endif /* MBEDTLS_SSL_PROTO_DTLS */
5729#if defined(MBEDTLS_SSL_PROTO_TLS)
5730 {
5731 rec_hdr_len_offset = rec_hdr_version_offset + rec_hdr_version_len;
5732 }
5733#endif /* MBEDTLS_SSL_PROTO_DTLS */
5734
5735 if( len < rec_hdr_len_offset + rec_hdr_len_len )
5736 {
5737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header of length %u",
5738 (unsigned) len,
5739 (unsigned)( rec_hdr_len_len + rec_hdr_len_len ) ) );
5740 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5741 }
5742
5743 /*
5744 * Parse and validate record content type
5745 */
5746
5747 rec->type = buf[ rec_hdr_type_offset ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005748
5749 /* Check record content type */
5750#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5751 rec->cid_len = 0;
5752
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005753 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005754 mbedtls_ssl_conf_get_cid_len( ssl->conf ) != 0 &&
5755 rec->type == MBEDTLS_SSL_MSG_CID )
Hanno Becker8b09b732019-05-08 12:03:28 +01005756 {
5757 /* Shift pointers to account for record header including CID
5758 * struct {
5759 * ContentType special_type = tls12_cid;
5760 * ProtocolVersion version;
5761 * uint16 epoch;
5762 * uint48 sequence_number;
Hanno Becker3b2bf5b2019-05-23 17:03:19 +01005763 * opaque cid[cid_length]; // Additional field compared to
5764 * // default DTLS record format
Hanno Becker8b09b732019-05-08 12:03:28 +01005765 * uint16 length;
5766 * opaque enc_content[DTLSCiphertext.length];
5767 * } DTLSCiphertext;
5768 */
5769
5770 /* So far, we only support static CID lengths
5771 * fixed in the configuration. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005772 rec_hdr_cid_len = mbedtls_ssl_conf_get_cid_len( ssl->conf );
5773 rec_hdr_len_offset += rec_hdr_cid_len;
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005774
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005775 if( len < rec_hdr_len_offset + rec_hdr_len_len )
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005776 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005777 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header including CID, length %u",
5778 (unsigned) len,
5779 (unsigned)( rec_hdr_len_offset + rec_hdr_len_len ) ) );
Hanno Becker29823462019-07-10 14:53:43 +01005780 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005781 }
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005782
Manuel Pégourié-Gonnardf3a15b32019-08-02 10:17:15 +02005783 /* configured CID len is guaranteed at most 255, see
5784 * MBEDTLS_SSL_CID_OUT_LEN_MAX in check_config.h */
5785 rec->cid_len = (uint8_t) rec_hdr_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005786 /* Not using more secure mbedtls_platform_memcpy as cid is public */
5787 memcpy( rec->cid, buf + rec_hdr_cid_offset, rec_hdr_cid_len );
Hanno Becker8b09b732019-05-08 12:03:28 +01005788 }
5789 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01005790#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005791 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005792 if( ssl_check_record_type( rec->type ) )
5793 {
Hanno Becker03e2db62019-07-12 14:40:00 +01005794 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type %u",
5795 (unsigned) rec->type ) );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005796 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5797 }
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005798 }
5799
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005800 /*
5801 * Parse and validate record version
5802 */
5803
Hanno Becker8061c6e2019-07-26 08:07:03 +01005804 rec->ver[0] = buf[ rec_hdr_version_offset + 0 ];
5805 rec->ver[1] = buf[ rec_hdr_version_offset + 1 ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005806 mbedtls_ssl_read_version( &major_ver, &minor_ver,
5807 ssl->conf->transport,
Hanno Becker8061c6e2019-07-26 08:07:03 +01005808 &rec->ver[0] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005809
Hanno Becker2881d802019-05-22 14:44:53 +01005810 if( major_ver != mbedtls_ssl_get_major_ver( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005811 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005812 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
5813 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005814 }
5815
Hanno Becker7bcf2b52019-07-26 09:02:40 +01005816 if( mbedtls_ssl_ver_gt( minor_ver,
5817 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ) ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005818 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005819 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
5820 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005821 }
5822
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005823 /*
5824 * Parse/Copy record sequence number.
5825 */
Hanno Becker8b09b732019-05-08 12:03:28 +01005826
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005827#if defined(MBEDTLS_SSL_PROTO_DTLS)
5828 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5829 {
5830 /* Copy explicit record sequence number from input buffer. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005831 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5832 memcpy( &rec->ctr[0], buf + rec_hdr_ctr_offset,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005833 rec_hdr_ctr_len );
5834 }
5835 MBEDTLS_SSL_TRANSPORT_ELSE
5836#endif /* MBEDTLS_SSL_PROTO_DTLS */
5837#if defined(MBEDTLS_SSL_PROTO_TLS)
5838 {
5839 /* Copy implicit record sequence number from SSL context structure. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005840 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5841 memcpy( &rec->ctr[0], ssl->in_ctr, rec_hdr_ctr_len );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005842 }
5843#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker8b09b732019-05-08 12:03:28 +01005844
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005845 /*
5846 * Parse record length.
5847 */
5848
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005849 rec->data_offset = rec_hdr_len_offset + rec_hdr_len_len;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005850 rec->data_len = mbedtls_platform_get_uint16_be( &buf[rec_hdr_len_offset] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005851 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", buf, rec->data_offset );
5852
Hanno Becker8b09b732019-05-08 12:03:28 +01005853 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
Hanno Beckerd8f7c4a2019-05-23 17:03:44 +01005854 "version = [%d:%d], msglen = %d",
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005855 rec->type,
5856 major_ver, minor_ver, rec->data_len ) );
5857
5858 rec->buf = buf;
5859 rec->buf_len = rec->data_offset + rec->data_len;
Hanno Becker8b09b732019-05-08 12:03:28 +01005860
Hanno Beckerec014082019-07-26 08:20:27 +01005861 if( rec->data_len == 0 )
5862 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5863
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005864 /*
Hanno Becker52c6dc62017-05-26 16:07:36 +01005865 * DTLS-related tests.
5866 * Check epoch before checking length constraint because
5867 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
5868 * message gets duplicated before the corresponding Finished message,
5869 * the second ChangeCipherSpec should be discarded because it belongs
5870 * to an old epoch, but not because its length is shorter than
5871 * the minimum record length for packets using the new record transform.
5872 * Note that these two kinds of failures are handled differently,
5873 * as an unexpected record is silently skipped but an invalid
5874 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005875 */
5876#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005877 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005878 {
Arto Kinnunena3fa06e2019-09-09 12:22:51 +03005879 rec_epoch = (uint32_t)mbedtls_platform_get_uint16_be( rec->ctr );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005880
Hanno Beckere0452772019-07-10 17:12:07 +01005881 /* Check that the datagram is large enough to contain a record
5882 * of the advertised length. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005883 if( len < rec->data_offset + rec->data_len )
Hanno Beckere0452772019-07-10 17:12:07 +01005884 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Datagram of length %u too small to contain record of advertised length %u.",
5886 (unsigned) len,
5887 (unsigned)( rec->data_offset + rec->data_len ) ) );
Hanno Beckere0452772019-07-10 17:12:07 +01005888 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5889 }
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005890
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005891 /* Records from other, non-matching epochs are silently discarded.
5892 * (The case of same-port Client reconnects must be considered in
5893 * the caller). */
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005894 if( rec_epoch != ssl->in_epoch )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005895 {
5896 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
5897 "expected %d, received %d",
5898 ssl->in_epoch, rec_epoch ) );
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005899
5900 /* Records from the next epoch are considered for buffering
5901 * (concretely: early Finished messages). */
5902 if( rec_epoch == (unsigned) ssl->in_epoch + 1 )
5903 {
5904 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
5905 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5906 }
5907
Hanno Becker87b56262019-07-10 14:37:41 +01005908 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005909 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005910#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005911 /* For records from the correct epoch, check whether their
5912 * sequence number has been seen before. */
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005913 else if( mbedtls_ssl_dtls_record_replay_check( (mbedtls_ssl_context *) ssl,
5914 &rec->ctr[0] ) != 0 )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005915 {
5916 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
5917 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
5918 }
5919#endif
5920 }
5921#endif /* MBEDTLS_SSL_PROTO_DTLS */
5922
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005923 return( 0 );
5924}
Paul Bakker5121ce52009-01-03 21:22:43 +00005925
Hanno Becker87b56262019-07-10 14:37:41 +01005926
5927#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
5928static int ssl_check_client_reconnect( mbedtls_ssl_context *ssl )
5929{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005930 unsigned int rec_epoch = (unsigned int)
5931 mbedtls_platform_get_uint16_be( &ssl->in_ctr[0] );
Hanno Becker87b56262019-07-10 14:37:41 +01005932
5933 /*
5934 * Check for an epoch 0 ClientHello. We can't use in_msg here to
5935 * access the first byte of record content (handshake type), as we
5936 * have an active transform (possibly iv_len != 0), so use the
5937 * fact that the record header len is 13 instead.
5938 */
5939 if( rec_epoch == 0 &&
5940 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
5941 MBEDTLS_SSL_IS_SERVER &&
5942 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5943 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
5944 ssl->in_left > 13 &&
5945 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
5946 {
5947 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
5948 "from the same port" ) );
5949 return( ssl_handle_possible_reconnect( ssl ) );
5950 }
5951
5952 return( 0 );
5953}
5954#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
5955
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005956/*
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01005957 * If applicable, decrypt record content
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005958 */
Hanno Beckera89610a2019-07-11 13:07:45 +01005959static int ssl_prepare_record_content( mbedtls_ssl_context *ssl,
5960 mbedtls_record *rec )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005961{
5962 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02005963
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005964 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
Hanno Beckera89610a2019-07-11 13:07:45 +01005965 rec->buf, rec->buf_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00005966
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005967#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
5968 if( mbedtls_ssl_hw_record_read != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00005969 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005970 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00005971
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005972 ret = mbedtls_ssl_hw_record_read( ssl );
5973 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00005974 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005975 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
5976 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00005977 }
Paul Bakkerc7878112012-12-19 14:41:14 +01005978
5979 if( ret == 0 )
5980 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00005981 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005982#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker48916f92012-09-16 19:57:18 +00005983 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005984 {
Hanno Becker106f3da2019-07-12 09:35:58 +01005985 unsigned char const old_msg_type = rec->type;
5986
Hanno Becker611a83b2018-01-03 14:27:32 +00005987 if( ( ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in,
Hanno Beckera89610a2019-07-11 13:07:45 +01005988 rec ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005989 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005990 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005991
Hanno Beckera5a2b082019-05-15 14:03:01 +01005992#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005993 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID &&
Hanno Beckere0200da2019-06-13 09:23:43 +01005994 mbedtls_ssl_conf_get_ignore_unexpected_cid( ssl->conf )
5995 == MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005996 {
Hanno Becker675c4d62019-05-24 10:11:06 +01005997 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ignoring unexpected CID" ) );
Hanno Becker687e0fb2019-05-08 13:02:55 +01005998 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005999 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01006000#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker687e0fb2019-05-08 13:02:55 +01006001
Paul Bakker5121ce52009-01-03 21:22:43 +00006002 return( ret );
6003 }
6004
Hanno Becker106f3da2019-07-12 09:35:58 +01006005 if( old_msg_type != rec->type )
Hanno Becker93012fe2018-08-07 14:30:18 +01006006 {
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006007 MBEDTLS_SSL_DEBUG_MSG( 4, ( "record type after decrypt (before %d): %d",
Hanno Becker106f3da2019-07-12 09:35:58 +01006008 old_msg_type, rec->type ) );
Hanno Becker93012fe2018-08-07 14:30:18 +01006009 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006010
Paul Bakker5121ce52009-01-03 21:22:43 +00006011 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Hanno Becker106f3da2019-07-12 09:35:58 +01006012 rec->buf + rec->data_offset, rec->data_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00006013
Hanno Beckera5a2b082019-05-15 14:03:01 +01006014#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006015 /* We have already checked the record content type
6016 * in ssl_parse_record_header(), failing or silently
6017 * dropping the record in the case of an unknown type.
6018 *
6019 * Since with the use of CIDs, the record content type
6020 * might change during decryption, re-check the record
6021 * content type, but treat a failure as fatal this time. */
Hanno Becker106f3da2019-07-12 09:35:58 +01006022 if( ssl_check_record_type( rec->type ) )
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006023 {
6024 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
6025 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6026 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01006027#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006028
Hanno Becker106f3da2019-07-12 09:35:58 +01006029 if( rec->data_len == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006030 {
6031#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker2881d802019-05-22 14:44:53 +01006032 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_3
Hanno Becker106f3da2019-07-12 09:35:58 +01006033 && rec->type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006034 {
6035 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
6036 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
6037 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6038 }
6039#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6040
6041 ssl->nb_zero++;
6042
6043 /*
6044 * Three or more empty messages may be a DoS attack
6045 * (excessive CPU consumption).
6046 */
6047 if( ssl->nb_zero > 3 )
6048 {
6049 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Hanno Becker70463db2019-05-08 10:38:32 +01006050 "messages, possible DoS attack" ) );
6051 /* Treat the records as if they were not properly authenticated,
6052 * thereby failing the connection if we see more than allowed
6053 * by the configured bad MAC threshold. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00006054 return( MBEDTLS_ERR_SSL_INVALID_MAC );
6055 }
6056 }
6057 else
6058 ssl->nb_zero = 0;
6059
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006060 /* Only needed for TLS, as with DTLS in_ctr is read from the header */
6061#if defined(MBEDTLS_SSL_PROTO_TLS)
6062 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006063 {
6064 unsigned i;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006065 for( i = 8; i > 0; i-- )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006066 if( ++ssl->in_ctr[i - 1] != 0 )
6067 break;
6068
Manuel Pégourié-Gonnard8794a422019-06-11 10:04:57 +02006069 /* The loop goes to its end only if the counter is wrapping around */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006070 if( i == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006071 {
6072 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
6073 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
6074 }
6075 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006076#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker4c6876b2017-12-27 21:28:58 +00006077
Paul Bakker5121ce52009-01-03 21:22:43 +00006078 }
6079
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006080#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006081 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02006082 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006083 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02006084 }
6085#endif
6086
Hanno Beckerf0242852019-07-09 17:30:02 +01006087 /* Check actual (decrypted) record content length against
6088 * configured maximum. */
6089 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
6090 {
6091 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
6092 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6093 }
6094
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006095 return( 0 );
6096}
6097
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006098static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006099
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006100/*
6101 * Read a record.
6102 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02006103 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
6104 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
6105 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006106 */
Hanno Becker1097b342018-08-15 14:09:41 +01006107
6108/* Helper functions for mbedtls_ssl_read_record(). */
6109static int ssl_consume_current_message( mbedtls_ssl_context *ssl );
Hanno Beckere74d5562018-08-15 14:26:08 +01006110static int ssl_get_next_record( mbedtls_ssl_context *ssl );
6111static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl );
Hanno Becker4162b112018-08-15 14:05:04 +01006112
Hanno Becker327c93b2018-08-15 13:56:18 +01006113int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
Hanno Becker3a0aad12018-08-20 09:44:02 +01006114 unsigned update_hs_digest )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006115{
6116 int ret;
6117
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006118 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006119
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006120 if( ssl->keep_current_message == 0 )
6121 {
6122 do {
Simon Butcher99000142016-10-13 17:21:01 +01006123
Hanno Becker26994592018-08-15 14:14:59 +01006124 ret = ssl_consume_current_message( ssl );
Hanno Becker90333da2017-10-10 11:27:13 +01006125 if( ret != 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006126 return( ret );
Hanno Becker26994592018-08-15 14:14:59 +01006127
Hanno Beckere74d5562018-08-15 14:26:08 +01006128 if( ssl_record_is_in_progress( ssl ) == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006129 {
Hanno Becker40f50842018-08-15 14:48:01 +01006130#if defined(MBEDTLS_SSL_PROTO_DTLS)
6131 int have_buffered = 0;
Hanno Beckere74d5562018-08-15 14:26:08 +01006132
Hanno Becker40f50842018-08-15 14:48:01 +01006133 /* We only check for buffered messages if the
6134 * current datagram is fully consumed. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006135 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006136 ssl_next_record_is_in_datagram( ssl ) == 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006137 {
Hanno Becker40f50842018-08-15 14:48:01 +01006138 if( ssl_load_buffered_message( ssl ) == 0 )
6139 have_buffered = 1;
6140 }
6141
6142 if( have_buffered == 0 )
6143#endif /* MBEDTLS_SSL_PROTO_DTLS */
6144 {
6145 ret = ssl_get_next_record( ssl );
6146 if( ret == MBEDTLS_ERR_SSL_CONTINUE_PROCESSING )
6147 continue;
6148
6149 if( ret != 0 )
6150 {
Hanno Beckerc573ac32018-08-28 17:15:25 +01006151 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
Hanno Becker42a6b042019-07-26 07:25:20 +01006152 ssl_send_pending_fatal_alert( ssl );
Hanno Becker40f50842018-08-15 14:48:01 +01006153 return( ret );
6154 }
Hanno Beckere74d5562018-08-15 14:26:08 +01006155 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006156 }
6157
6158 ret = mbedtls_ssl_handle_message_type( ssl );
6159
Hanno Becker40f50842018-08-15 14:48:01 +01006160#if defined(MBEDTLS_SSL_PROTO_DTLS)
6161 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6162 {
6163 /* Buffer future message */
6164 ret = ssl_buffer_message( ssl );
6165 if( ret != 0 )
6166 return( ret );
6167
6168 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
6169 }
6170#endif /* MBEDTLS_SSL_PROTO_DTLS */
6171
Hanno Becker90333da2017-10-10 11:27:13 +01006172 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret ||
6173 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING == ret );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006174
6175 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01006176 {
Hanno Becker05c4fc82017-11-09 14:34:06 +00006177 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
Simon Butcher99000142016-10-13 17:21:01 +01006178 return( ret );
6179 }
6180
Hanno Becker327c93b2018-08-15 13:56:18 +01006181 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
Hanno Becker3a0aad12018-08-20 09:44:02 +01006182 update_hs_digest == 1 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006183 {
6184 mbedtls_ssl_update_handshake_status( ssl );
6185 }
Simon Butcher99000142016-10-13 17:21:01 +01006186 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006187 else
Simon Butcher99000142016-10-13 17:21:01 +01006188 {
Hanno Becker02f59072018-08-15 14:00:24 +01006189 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006190 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01006191 }
6192
6193 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
6194
6195 return( 0 );
6196}
6197
Hanno Becker40f50842018-08-15 14:48:01 +01006198#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006199static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
Simon Butcher99000142016-10-13 17:21:01 +01006200{
Hanno Becker40f50842018-08-15 14:48:01 +01006201 if( ssl->in_left > ssl->next_record_offset )
6202 return( 1 );
Simon Butcher99000142016-10-13 17:21:01 +01006203
Hanno Becker40f50842018-08-15 14:48:01 +01006204 return( 0 );
6205}
6206
6207static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
6208{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006209 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker37f95322018-08-16 13:55:32 +01006210 mbedtls_ssl_hs_buffer * hs_buf;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006211 int ret = 0;
6212
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006213 if( hs == NULL )
6214 return( -1 );
6215
Hanno Beckere00ae372018-08-20 09:39:42 +01006216 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
6217
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006218 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC ||
6219 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
6220 {
6221 /* Check if we have seen a ChangeCipherSpec before.
6222 * If yes, synthesize a CCS record. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006223 if( !hs->buffering.seen_ccs )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006224 {
6225 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
6226 ret = -1;
Hanno Becker0d4b3762018-08-20 09:36:59 +01006227 goto exit;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006228 }
6229
Hanno Becker39b8bc92018-08-28 17:17:13 +01006230 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006231 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
6232 ssl->in_msglen = 1;
6233 ssl->in_msg[0] = 1;
6234
6235 /* As long as they are equal, the exact value doesn't matter. */
6236 ssl->in_left = 0;
6237 ssl->next_record_offset = 0;
6238
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006239 hs->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006240 goto exit;
6241 }
Hanno Becker37f95322018-08-16 13:55:32 +01006242
Hanno Beckerb8f50142018-08-28 10:01:34 +01006243#if defined(MBEDTLS_DEBUG_C)
Hanno Becker37f95322018-08-16 13:55:32 +01006244 /* Debug only */
6245 {
6246 unsigned offset;
6247 for( offset = 1; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
6248 {
6249 hs_buf = &hs->buffering.hs[offset];
6250 if( hs_buf->is_valid == 1 )
6251 {
6252 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
6253 hs->in_msg_seq + offset,
Hanno Beckera591c482018-08-28 17:20:00 +01006254 hs_buf->is_complete ? "fully" : "partially" ) );
Hanno Becker37f95322018-08-16 13:55:32 +01006255 }
6256 }
6257 }
Hanno Beckerb8f50142018-08-28 10:01:34 +01006258#endif /* MBEDTLS_DEBUG_C */
Hanno Becker37f95322018-08-16 13:55:32 +01006259
6260 /* Check if we have buffered and/or fully reassembled the
6261 * next handshake message. */
6262 hs_buf = &hs->buffering.hs[0];
6263 if( ( hs_buf->is_valid == 1 ) && ( hs_buf->is_complete == 1 ) )
6264 {
6265 /* Synthesize a record containing the buffered HS message. */
Arto Kinnunen84eeb4f2019-09-10 10:32:30 +03006266 size_t msg_len = mbedtls_platform_get_uint24_be( &hs_buf->data[1] );
Hanno Becker37f95322018-08-16 13:55:32 +01006267
6268 /* Double-check that we haven't accidentally buffered
6269 * a message that doesn't fit into the input buffer. */
6270 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
6271 {
6272 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6273 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6274 }
6275
6276 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
6277 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
6278 hs_buf->data, msg_len + 12 );
6279
6280 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6281 ssl->in_hslen = msg_len + 12;
6282 ssl->in_msglen = msg_len + 12;
Teppo Järvelin91d79382019-10-02 09:09:31 +03006283 mbedtls_platform_memcpy( ssl->in_msg, hs_buf->data, ssl->in_hslen );
Hanno Becker37f95322018-08-16 13:55:32 +01006284
6285 ret = 0;
6286 goto exit;
6287 }
6288 else
6289 {
6290 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
6291 hs->in_msg_seq ) );
6292 }
6293
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006294 ret = -1;
6295
6296exit:
6297
6298 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
6299 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006300}
6301
Hanno Beckera02b0b42018-08-21 17:20:27 +01006302static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
6303 size_t desired )
6304{
6305 int offset;
6306 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006307 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
6308 (unsigned) desired ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006309
Hanno Becker01315ea2018-08-21 17:22:17 +01006310 /* Get rid of future records epoch first, if such exist. */
6311 ssl_free_buffered_record( ssl );
6312
6313 /* Check if we have enough space available now. */
6314 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6315 hs->buffering.total_bytes_buffered ) )
6316 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006317 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
Hanno Becker01315ea2018-08-21 17:22:17 +01006318 return( 0 );
6319 }
Hanno Beckera02b0b42018-08-21 17:20:27 +01006320
Hanno Becker4f432ad2018-08-28 10:02:32 +01006321 /* We don't have enough space to buffer the next expected handshake
6322 * message. Remove buffers used for future messages to gain space,
6323 * starting with the most distant one. */
Hanno Beckera02b0b42018-08-21 17:20:27 +01006324 for( offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1;
6325 offset >= 0; offset-- )
6326 {
6327 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
6328 offset ) );
6329
Hanno Beckerb309b922018-08-23 13:18:05 +01006330 ssl_buffering_free_slot( ssl, (uint8_t) offset );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006331
6332 /* Check if we have enough space available now. */
6333 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6334 hs->buffering.total_bytes_buffered ) )
6335 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006336 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006337 return( 0 );
6338 }
6339 }
6340
6341 return( -1 );
6342}
6343
Hanno Becker40f50842018-08-15 14:48:01 +01006344static int ssl_buffer_message( mbedtls_ssl_context *ssl )
6345{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006346 int ret = 0;
6347 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6348
6349 if( hs == NULL )
6350 return( 0 );
6351
6352 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
6353
6354 switch( ssl->in_msgtype )
6355 {
6356 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC:
6357 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
Hanno Beckere678eaa2018-08-21 14:57:46 +01006358
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006359 hs->buffering.seen_ccs = 1;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006360 break;
6361
6362 case MBEDTLS_SSL_MSG_HANDSHAKE:
Hanno Becker37f95322018-08-16 13:55:32 +01006363 {
6364 unsigned recv_msg_seq_offset;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03006365 unsigned recv_msg_seq = (unsigned)
6366 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03006367
Hanno Becker37f95322018-08-16 13:55:32 +01006368 mbedtls_ssl_hs_buffer *hs_buf;
6369 size_t msg_len = ssl->in_hslen - 12;
6370
6371 /* We should never receive an old handshake
6372 * message - double-check nonetheless. */
6373 if( recv_msg_seq < ssl->handshake->in_msg_seq )
6374 {
6375 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6376 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6377 }
6378
6379 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
6380 if( recv_msg_seq_offset >= MBEDTLS_SSL_MAX_BUFFERED_HS )
6381 {
6382 /* Silently ignore -- message too far in the future */
6383 MBEDTLS_SSL_DEBUG_MSG( 2,
6384 ( "Ignore future HS message with sequence number %u, "
6385 "buffering window %u - %u",
6386 recv_msg_seq, ssl->handshake->in_msg_seq,
6387 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - 1 ) );
6388
6389 goto exit;
6390 }
6391
6392 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
6393 recv_msg_seq, recv_msg_seq_offset ) );
6394
6395 hs_buf = &hs->buffering.hs[ recv_msg_seq_offset ];
6396
6397 /* Check if the buffering for this seq nr has already commenced. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006398 if( !hs_buf->is_valid )
Hanno Becker37f95322018-08-16 13:55:32 +01006399 {
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006400 size_t reassembly_buf_sz;
6401
Hanno Becker37f95322018-08-16 13:55:32 +01006402 hs_buf->is_fragmented =
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04006403 ( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT );
Hanno Becker37f95322018-08-16 13:55:32 +01006404
6405 /* We copy the message back into the input buffer
6406 * after reassembly, so check that it's not too large.
6407 * This is an implementation-specific limitation
6408 * and not one from the standard, hence it is not
6409 * checked in ssl_check_hs_header(). */
Hanno Becker96a6c692018-08-21 15:56:03 +01006410 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker37f95322018-08-16 13:55:32 +01006411 {
6412 /* Ignore message */
6413 goto exit;
6414 }
6415
Hanno Beckere0b150f2018-08-21 15:51:03 +01006416 /* Check if we have enough space to buffer the message. */
6417 if( hs->buffering.total_bytes_buffered >
6418 MBEDTLS_SSL_DTLS_MAX_BUFFERING )
6419 {
6420 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6421 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6422 }
6423
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006424 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
6425 hs_buf->is_fragmented );
Hanno Beckere0b150f2018-08-21 15:51:03 +01006426
6427 if( reassembly_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6428 hs->buffering.total_bytes_buffered ) )
6429 {
6430 if( recv_msg_seq_offset > 0 )
6431 {
6432 /* If we can't buffer a future message because
6433 * of space limitations -- ignore. */
6434 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
6435 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6436 (unsigned) hs->buffering.total_bytes_buffered ) );
6437 goto exit;
6438 }
Hanno Beckere1801392018-08-21 16:51:05 +01006439 else
6440 {
6441 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- attempt to make space by freeing buffered future messages\n",
6442 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6443 (unsigned) hs->buffering.total_bytes_buffered ) );
6444 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006445
Hanno Beckera02b0b42018-08-21 17:20:27 +01006446 if( ssl_buffer_make_space( ssl, reassembly_buf_sz ) != 0 )
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006447 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006448 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %u (%u with bitmap) would exceed the compile-time limit %u (already %u bytes buffered) -- fail\n",
6449 (unsigned) msg_len,
6450 (unsigned) reassembly_buf_sz,
6451 MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Beckere0b150f2018-08-21 15:51:03 +01006452 (unsigned) hs->buffering.total_bytes_buffered ) );
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006453 ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
6454 goto exit;
6455 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006456 }
6457
6458 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
6459 msg_len ) );
6460
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006461 hs_buf->data = mbedtls_calloc( 1, reassembly_buf_sz );
6462 if( hs_buf->data == NULL )
Hanno Becker37f95322018-08-16 13:55:32 +01006463 {
Hanno Beckere0b150f2018-08-21 15:51:03 +01006464 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
Hanno Becker37f95322018-08-16 13:55:32 +01006465 goto exit;
6466 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006467 hs_buf->data_len = reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006468
6469 /* Prepare final header: copy msg_type, length and message_seq,
6470 * then add standardised fragment_offset and fragment_length */
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02006471 if( mbedtls_platform_memcpy( hs_buf->data, ssl->in_msg, 6 ) !=
6472 hs_buf->data )
6473 {
6474 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6475 goto exit;
6476 }
6477 if( mbedtls_platform_memset( hs_buf->data + 6, 0, 3 ) !=
6478 hs_buf->data + 6 )
6479 {
6480 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6481 goto exit;
6482 }
6483 if( mbedtls_platform_memcpy( hs_buf->data + 9, hs_buf->data + 1, 3 ) !=
6484 hs_buf->data + 9 )
6485 {
6486 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6487 goto exit;
6488 }
Hanno Becker37f95322018-08-16 13:55:32 +01006489
6490 hs_buf->is_valid = 1;
Hanno Beckere0b150f2018-08-21 15:51:03 +01006491
6492 hs->buffering.total_bytes_buffered += reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006493 }
6494 else
6495 {
6496 /* Make sure msg_type and length are consistent */
Teppo Järvelin0efac532019-10-04 13:21:08 +03006497 if( memcmp( hs_buf->data, ssl->in_msg, 4 ) != 0 ) // use regular memcmp as msg type is public
Hanno Becker37f95322018-08-16 13:55:32 +01006498 {
6499 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
6500 /* Ignore */
6501 goto exit;
6502 }
6503 }
6504
Hanno Becker4422bbb2018-08-20 09:40:19 +01006505 if( !hs_buf->is_complete )
Hanno Becker37f95322018-08-16 13:55:32 +01006506 {
6507 size_t frag_len, frag_off;
6508 unsigned char * const msg = hs_buf->data + 12;
6509
6510 /*
6511 * Check and copy current fragment
6512 */
6513
6514 /* Validation of header fields already done in
6515 * mbedtls_ssl_prepare_handshake_record(). */
6516 frag_off = ssl_get_hs_frag_off( ssl );
6517 frag_len = ssl_get_hs_frag_len( ssl );
6518
6519 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
6520 frag_off, frag_len ) );
Teppo Järvelin91d79382019-10-02 09:09:31 +03006521 mbedtls_platform_memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
Hanno Becker37f95322018-08-16 13:55:32 +01006522
6523 if( hs_buf->is_fragmented )
6524 {
6525 unsigned char * const bitmask = msg + msg_len;
6526 ssl_bitmask_set( bitmask, frag_off, frag_len );
6527 hs_buf->is_complete = ( ssl_bitmask_check( bitmask,
6528 msg_len ) == 0 );
6529 }
6530 else
6531 {
6532 hs_buf->is_complete = 1;
6533 }
6534
6535 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
6536 hs_buf->is_complete ? "" : "not yet " ) );
6537 }
6538
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006539 break;
Hanno Becker37f95322018-08-16 13:55:32 +01006540 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006541
6542 default:
Hanno Becker360bef32018-08-28 10:04:33 +01006543 /* We don't buffer other types of messages. */
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006544 break;
6545 }
6546
6547exit:
6548
6549 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
6550 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006551}
6552#endif /* MBEDTLS_SSL_PROTO_DTLS */
6553
Hanno Becker1097b342018-08-15 14:09:41 +01006554static int ssl_consume_current_message( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006555{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006556 /*
Hanno Becker4a810fb2017-05-24 16:27:30 +01006557 * Consume last content-layer message and potentially
6558 * update in_msglen which keeps track of the contents'
6559 * consumption state.
6560 *
6561 * (1) Handshake messages:
6562 * Remove last handshake message, move content
6563 * and adapt in_msglen.
6564 *
6565 * (2) Alert messages:
6566 * Consume whole record content, in_msglen = 0.
6567 *
Hanno Becker4a810fb2017-05-24 16:27:30 +01006568 * (3) Change cipher spec:
6569 * Consume whole record content, in_msglen = 0.
6570 *
6571 * (4) Application data:
6572 * Don't do anything - the record layer provides
6573 * the application data as a stream transport
6574 * and consumes through mbedtls_ssl_read only.
6575 *
6576 */
6577
6578 /* Case (1): Handshake messages */
6579 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006580 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006581 /* Hard assertion to be sure that no application data
6582 * is in flight, as corrupting ssl->in_msglen during
6583 * ssl->in_offt != NULL is fatal. */
6584 if( ssl->in_offt != NULL )
6585 {
6586 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6587 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6588 }
6589
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006590 /*
6591 * Get next Handshake message in the current record
6592 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006593
Hanno Becker4a810fb2017-05-24 16:27:30 +01006594 /* Notes:
Hanno Beckere72489d2017-10-23 13:23:50 +01006595 * (1) in_hslen is not necessarily the size of the
Hanno Becker4a810fb2017-05-24 16:27:30 +01006596 * current handshake content: If DTLS handshake
6597 * fragmentation is used, that's the fragment
6598 * size instead. Using the total handshake message
Hanno Beckere72489d2017-10-23 13:23:50 +01006599 * size here is faulty and should be changed at
6600 * some point.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006601 * (2) While it doesn't seem to cause problems, one
6602 * has to be very careful not to assume that in_hslen
6603 * is always <= in_msglen in a sensible communication.
6604 * Again, it's wrong for DTLS handshake fragmentation.
6605 * The following check is therefore mandatory, and
6606 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006607 * Additionally, ssl->in_hslen might be arbitrarily out of
6608 * bounds after handling a DTLS message with an unexpected
6609 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006610 */
6611 if( ssl->in_hslen < ssl->in_msglen )
6612 {
6613 ssl->in_msglen -= ssl->in_hslen;
6614 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
6615 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006616
Hanno Becker4a810fb2017-05-24 16:27:30 +01006617 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
6618 ssl->in_msg, ssl->in_msglen );
6619 }
6620 else
6621 {
6622 ssl->in_msglen = 0;
6623 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02006624
Hanno Becker4a810fb2017-05-24 16:27:30 +01006625 ssl->in_hslen = 0;
6626 }
6627 /* Case (4): Application data */
6628 else if( ssl->in_offt != NULL )
6629 {
6630 return( 0 );
6631 }
6632 /* Everything else (CCS & Alerts) */
6633 else
6634 {
6635 ssl->in_msglen = 0;
6636 }
6637
Hanno Becker1097b342018-08-15 14:09:41 +01006638 return( 0 );
6639}
Hanno Becker4a810fb2017-05-24 16:27:30 +01006640
Hanno Beckere74d5562018-08-15 14:26:08 +01006641static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
6642{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006643 if( ssl->in_msglen > 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006644 return( 1 );
6645
6646 return( 0 );
6647}
6648
Hanno Becker5f066e72018-08-16 14:56:31 +01006649#if defined(MBEDTLS_SSL_PROTO_DTLS)
6650
6651static void ssl_free_buffered_record( mbedtls_ssl_context *ssl )
6652{
6653 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6654 if( hs == NULL )
6655 return;
6656
Hanno Becker01315ea2018-08-21 17:22:17 +01006657 if( hs->buffering.future_record.data != NULL )
Hanno Becker4a810fb2017-05-24 16:27:30 +01006658 {
Hanno Becker01315ea2018-08-21 17:22:17 +01006659 hs->buffering.total_bytes_buffered -=
6660 hs->buffering.future_record.len;
6661
6662 mbedtls_free( hs->buffering.future_record.data );
6663 hs->buffering.future_record.data = NULL;
6664 }
Hanno Becker5f066e72018-08-16 14:56:31 +01006665}
6666
6667static int ssl_load_buffered_record( mbedtls_ssl_context *ssl )
6668{
6669 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6670 unsigned char * rec;
6671 size_t rec_len;
6672 unsigned rec_epoch;
Andrzej Kurekf3844952020-10-16 23:03:01 +02006673#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6674 size_t in_buf_len = ssl->in_buf_len;
6675#else
6676 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6677#endif
Hanno Becker5f066e72018-08-16 14:56:31 +01006678
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006679 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006680 return( 0 );
6681
6682 if( hs == NULL )
6683 return( 0 );
6684
Hanno Becker5f066e72018-08-16 14:56:31 +01006685 rec = hs->buffering.future_record.data;
6686 rec_len = hs->buffering.future_record.len;
6687 rec_epoch = hs->buffering.future_record.epoch;
6688
6689 if( rec == NULL )
6690 return( 0 );
6691
Hanno Becker4cb782d2018-08-20 11:19:05 +01006692 /* Only consider loading future records if the
6693 * input buffer is empty. */
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006694 if( ssl_next_record_is_in_datagram( ssl ) == 1 )
Hanno Becker4cb782d2018-08-20 11:19:05 +01006695 return( 0 );
6696
Hanno Becker5f066e72018-08-16 14:56:31 +01006697 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
6698
6699 if( rec_epoch != ssl->in_epoch )
6700 {
6701 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
6702 goto exit;
6703 }
6704
6705 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
6706
6707 /* Double-check that the record is not too large */
Andrzej Kurekf3844952020-10-16 23:03:01 +02006708 if( rec_len > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006709 {
6710 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6711 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6712 }
6713
Teppo Järvelin91d79382019-10-02 09:09:31 +03006714 mbedtls_platform_memcpy( ssl->in_hdr, rec, rec_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006715 ssl->in_left = rec_len;
6716 ssl->next_record_offset = 0;
6717
6718 ssl_free_buffered_record( ssl );
6719
6720exit:
6721 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
6722 return( 0 );
6723}
6724
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006725static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
6726 mbedtls_record const *rec )
Hanno Becker5f066e72018-08-16 14:56:31 +01006727{
6728 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker5f066e72018-08-16 14:56:31 +01006729
6730 /* Don't buffer future records outside handshakes. */
6731 if( hs == NULL )
6732 return( 0 );
6733
6734 /* Only buffer handshake records (we are only interested
6735 * in Finished messages). */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006736 if( rec->type != MBEDTLS_SSL_MSG_HANDSHAKE )
Hanno Becker5f066e72018-08-16 14:56:31 +01006737 return( 0 );
6738
6739 /* Don't buffer more than one future epoch record. */
6740 if( hs->buffering.future_record.data != NULL )
6741 return( 0 );
6742
Hanno Becker01315ea2018-08-21 17:22:17 +01006743 /* Don't buffer record if there's not enough buffering space remaining. */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006744 if( rec->buf_len > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
Hanno Becker01315ea2018-08-21 17:22:17 +01006745 hs->buffering.total_bytes_buffered ) )
6746 {
6747 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006748 (unsigned) rec->buf_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Becker01315ea2018-08-21 17:22:17 +01006749 (unsigned) hs->buffering.total_bytes_buffered ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006750 return( 0 );
6751 }
6752
Hanno Becker5f066e72018-08-16 14:56:31 +01006753 /* Buffer record */
6754 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
6755 ssl->in_epoch + 1 ) );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006756 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006757
6758 /* ssl_parse_record_header() only considers records
6759 * of the next epoch as candidates for buffering. */
6760 hs->buffering.future_record.epoch = ssl->in_epoch + 1;
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006761 hs->buffering.future_record.len = rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006762
6763 hs->buffering.future_record.data =
6764 mbedtls_calloc( 1, hs->buffering.future_record.len );
6765 if( hs->buffering.future_record.data == NULL )
6766 {
6767 /* If we run out of RAM trying to buffer a
6768 * record from the next epoch, just ignore. */
6769 return( 0 );
6770 }
6771
Teppo Järvelin91d79382019-10-02 09:09:31 +03006772 mbedtls_platform_memcpy( hs->buffering.future_record.data, rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006773
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006774 hs->buffering.total_bytes_buffered += rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006775 return( 0 );
6776}
6777
6778#endif /* MBEDTLS_SSL_PROTO_DTLS */
6779
Hanno Beckere74d5562018-08-15 14:26:08 +01006780static int ssl_get_next_record( mbedtls_ssl_context *ssl )
Hanno Becker1097b342018-08-15 14:09:41 +01006781{
6782 int ret;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006783 mbedtls_record rec;
Hanno Becker1097b342018-08-15 14:09:41 +01006784
Hanno Becker5f066e72018-08-16 14:56:31 +01006785#if defined(MBEDTLS_SSL_PROTO_DTLS)
6786 /* We might have buffered a future record; if so,
6787 * and if the epoch matches now, load it.
6788 * On success, this call will set ssl->in_left to
6789 * the length of the buffered record, so that
6790 * the calls to ssl_fetch_input() below will
6791 * essentially be no-ops. */
6792 ret = ssl_load_buffered_record( ssl );
6793 if( ret != 0 )
6794 return( ret );
6795#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker4a810fb2017-05-24 16:27:30 +01006796
Hanno Becker8b09b732019-05-08 12:03:28 +01006797 /* Ensure that we have enough space available for the default form
6798 * of TLS / DTLS record headers (5 Bytes for TLS, 13 Bytes for DTLS,
6799 * with no space for CIDs counted in). */
6800 ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_in_hdr_len( ssl ) );
6801 if( ret != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006802 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006803 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006804 return( ret );
6805 }
6806
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006807 ret = ssl_parse_record_header( ssl, ssl->in_hdr, ssl->in_left, &rec );
6808 if( ret != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006809 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006810#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker87b56262019-07-10 14:37:41 +01006811 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006812 {
Hanno Becker5f066e72018-08-16 14:56:31 +01006813 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6814 {
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006815 ret = ssl_buffer_future_record( ssl, &rec );
Hanno Becker5f066e72018-08-16 14:56:31 +01006816 if( ret != 0 )
6817 return( ret );
6818
6819 /* Fall through to handling of unexpected records */
6820 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
6821 }
6822
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006823 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
6824 {
Hanno Becker87b56262019-07-10 14:37:41 +01006825#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker68379722019-07-12 09:23:47 +01006826 /* Reset in pointers to default state for TLS/DTLS records,
6827 * assuming no CID and no offset between record content and
6828 * record plaintext. */
6829 ssl_update_in_pointers( ssl );
6830
Hanno Becker69412452019-07-12 08:33:49 +01006831 /* Setup internal message pointers from record structure. */
6832 ssl->in_msgtype = rec.type;
6833#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6834 ssl->in_len = ssl->in_cid + rec.cid_len;
6835#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006836 ssl->in_msg = ssl->in_len + 2;
Hanno Becker69412452019-07-12 08:33:49 +01006837 ssl->in_msglen = rec.data_len;
6838
Hanno Becker87b56262019-07-10 14:37:41 +01006839 ret = ssl_check_client_reconnect( ssl );
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02006840 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_client_reconnect", ret );
Hanno Becker87b56262019-07-10 14:37:41 +01006841 if( ret != 0 )
6842 return( ret );
6843#endif
6844
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006845 /* Skip unexpected record (but not whole datagram) */
Hanno Becker2528ee02019-07-11 12:48:53 +01006846 ssl->next_record_offset = rec.buf_len;
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006847
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006848 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
6849 "(header)" ) );
6850 }
6851 else
6852 {
6853 /* Skip invalid record and the rest of the datagram */
6854 ssl->next_record_offset = 0;
6855 ssl->in_left = 0;
6856
6857 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
6858 "(header)" ) );
6859 }
6860
6861 /* Get next record */
Hanno Becker90333da2017-10-10 11:27:13 +01006862 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006863 }
Hanno Becker87b56262019-07-10 14:37:41 +01006864 else
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006865#endif
Hanno Becker87b56262019-07-10 14:37:41 +01006866 {
6867 return( ret );
6868 }
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006869 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006870
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006871#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006872 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckere65ce782017-05-22 14:47:48 +01006873 {
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006874 /* Remember offset of next record within datagram. */
Hanno Becker2720f4c2019-07-11 12:50:10 +01006875 ssl->next_record_offset = rec.buf_len;
Hanno Beckere65ce782017-05-22 14:47:48 +01006876 if( ssl->next_record_offset < ssl->in_left )
6877 {
6878 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
6879 }
6880 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006881 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006882#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006883#if defined(MBEDTLS_SSL_PROTO_TLS)
6884 {
Hanno Beckere0452772019-07-10 17:12:07 +01006885 /*
6886 * Fetch record contents from underlying transport.
6887 */
Hanno Becker9babbf72019-07-11 12:50:29 +01006888 ret = mbedtls_ssl_fetch_input( ssl, rec.buf_len );
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006889 if( ret != 0 )
6890 {
6891 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
6892 return( ret );
6893 }
6894
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006895 ssl->in_left = 0;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006896 }
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006897#endif /* MBEDTLS_SSL_PROTO_TLS */
6898
6899 /*
6900 * Decrypt record contents.
6901 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006902
Hanno Beckera89610a2019-07-11 13:07:45 +01006903 if( ( ret = ssl_prepare_record_content( ssl, &rec ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006904 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006905#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006906 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006907 {
6908 /* Silently discard invalid records */
Hanno Becker16e9ae22019-05-03 16:36:59 +01006909 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006910 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006911 /* Except when waiting for Finished as a bad mac here
6912 * probably means something went wrong in the handshake
6913 * (eg wrong psk used, mitm downgrade attempt, etc.) */
6914 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
6915 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
6916 {
6917#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6918 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
6919 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006920 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006921 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
6922 }
6923#endif
6924 return( ret );
6925 }
6926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006927#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Hanno Beckerde671542019-06-12 16:30:46 +01006928 if( mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) != 0 &&
6929 ++ssl->badmac_seen >= mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006930 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006931 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
6932 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006933 }
6934#endif
6935
Hanno Becker4a810fb2017-05-24 16:27:30 +01006936 /* As above, invalid records cause
6937 * dismissal of the whole datagram. */
6938
6939 ssl->next_record_offset = 0;
6940 ssl->in_left = 0;
6941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006942 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Hanno Becker90333da2017-10-10 11:27:13 +01006943 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006944 }
6945
6946 return( ret );
6947 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006948 MBEDTLS_SSL_TRANSPORT_ELSE
6949#endif /* MBEDTLS_SSL_PROTO_DTLS */
6950#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006951 {
6952 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006953#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6954 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006955 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006956 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006957 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006958 }
6959#endif
6960 return( ret );
6961 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006962#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006963 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006964
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006965
6966 /* Reset in pointers to default state for TLS/DTLS records,
6967 * assuming no CID and no offset between record content and
6968 * record plaintext. */
6969 ssl_update_in_pointers( ssl );
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006970#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6971 ssl->in_len = ssl->in_cid + rec.cid_len;
6972#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006973 ssl->in_msg = ssl->in_len + 2;
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006974
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006975 /* The record content type may change during decryption,
6976 * so re-read it. */
6977 ssl->in_msgtype = rec.type;
6978 /* Also update the input buffer, because unfortunately
6979 * the server-side ssl_parse_client_hello() reparses the
6980 * record header when receiving a ClientHello initiating
6981 * a renegotiation. */
6982 ssl->in_hdr[0] = rec.type;
6983 ssl->in_msg = rec.buf + rec.data_offset;
6984 ssl->in_msglen = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03006985 (void)mbedtls_platform_put_uint16_be( ssl->in_len, rec.data_len );
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006986
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01006987#if defined(MBEDTLS_ZLIB_SUPPORT)
6988 if( ssl->transform_in != NULL &&
6989 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
6990 {
6991 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
6992 {
6993 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
6994 return( ret );
6995 }
6996
6997 /* Check actual (decompress) record content length against
6998 * configured maximum. */
6999 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
7000 {
7001 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
7002 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7003 }
7004 }
7005#endif /* MBEDTLS_ZLIB_SUPPORT */
7006
Simon Butcher99000142016-10-13 17:21:01 +01007007 return( 0 );
7008}
7009
7010int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
7011{
7012 int ret;
7013
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007014 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02007015 * Handle particular types of records
7016 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007017 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007018 {
Simon Butcher99000142016-10-13 17:21:01 +01007019 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
7020 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01007021 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01007022 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007023 }
7024
Hanno Beckere678eaa2018-08-21 14:57:46 +01007025 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007026 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01007027 if( ssl->in_msglen != 1 )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007028 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01007029 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %d",
7030 ssl->in_msglen ) );
7031 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007032 }
7033
Hanno Beckere678eaa2018-08-21 14:57:46 +01007034 if( ssl->in_msg[0] != 1 )
7035 {
7036 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
7037 ssl->in_msg[0] ) );
7038 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7039 }
7040
7041#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02007042 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckere678eaa2018-08-21 14:57:46 +01007043 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
7044 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
7045 {
7046 if( ssl->handshake == NULL )
7047 {
7048 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
7049 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
7050 }
7051
7052 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
7053 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
7054 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007055#endif
Hanno Beckere678eaa2018-08-21 14:57:46 +01007056 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007058 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00007059 {
Angus Gratton1a7a17e2018-06-20 15:43:50 +10007060 if( ssl->in_msglen != 2 )
7061 {
7062 /* Note: Standard allows for more than one 2 byte alert
7063 to be packed in a single message, but Mbed TLS doesn't
7064 currently support this. */
7065 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
7066 ssl->in_msglen ) );
7067 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7068 }
7069
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007070 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00007071 ssl->in_msg[0], ssl->in_msg[1] ) );
7072
7073 /*
Simon Butcher459a9502015-10-27 16:09:03 +00007074 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00007075 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007076 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007077 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007078 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00007079 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007080 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007081 }
7082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007083 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7084 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00007085 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007086 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
7087 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00007088 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007089
7090#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
7091 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7092 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
7093 {
Hanno Becker90333da2017-10-10 11:27:13 +01007094 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no renegotiation alert" ) );
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007095 /* Will be handled when trying to parse ServerHello */
7096 return( 0 );
7097 }
7098#endif
7099
7100#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2881d802019-05-22 14:44:53 +01007101 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007102 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7103 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007104 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7105 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7106 {
7107 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
7108 /* Will be handled in mbedtls_ssl_parse_certificate() */
7109 return( 0 );
7110 }
7111#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
7112
7113 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01007114 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00007115 }
7116
Hanno Beckerc76c6192017-06-06 10:03:17 +01007117#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02007118 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckerc76c6192017-06-06 10:03:17 +01007119 {
Hanno Becker74dd3a72019-05-03 16:54:26 +01007120 /* Drop unexpected ApplicationData records,
7121 * except at the beginning of renegotiations */
7122 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
7123 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
7124#if defined(MBEDTLS_SSL_RENEGOTIATION)
7125 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
7126 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
Hanno Beckerc76c6192017-06-06 10:03:17 +01007127#endif
Hanno Becker74dd3a72019-05-03 16:54:26 +01007128 )
7129 {
7130 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
7131 return( MBEDTLS_ERR_SSL_NON_FATAL );
7132 }
7133
7134 if( ssl->handshake != NULL &&
7135 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
7136 {
7137 ssl_handshake_wrapup_free_hs_transform( ssl );
7138 }
7139 }
Hanno Beckerf65ad822019-05-08 16:26:21 +01007140#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Beckerc76c6192017-06-06 10:03:17 +01007141
Paul Bakker5121ce52009-01-03 21:22:43 +00007142 return( 0 );
7143}
7144
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007145int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007146{
7147 int ret;
7148
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007149 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
7150 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7151 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007152 {
7153 return( ret );
7154 }
7155
7156 return( 0 );
7157}
7158
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007159int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Hanno Becker1facd552019-07-03 13:57:23 +01007160 unsigned char level,
7161 unsigned char message )
Paul Bakker0a925182012-04-16 06:46:41 +00007162{
7163 int ret;
7164
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02007165 if( ssl == NULL || ssl->conf == NULL )
7166 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7167
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007168 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007169 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00007170
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007171 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00007172 ssl->out_msglen = 2;
7173 ssl->out_msg[0] = level;
7174 ssl->out_msg[1] = message;
7175
Hanno Becker67bc7c32018-08-06 11:33:50 +01007176 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00007177 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007178 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00007179 return( ret );
7180 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007181 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00007182
7183 return( 0 );
7184}
7185
Hanno Becker17572472019-02-08 07:19:04 +00007186#if defined(MBEDTLS_X509_CRT_PARSE_C)
7187static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
7188{
7189#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7190 if( session->peer_cert != NULL )
7191 {
7192 mbedtls_x509_crt_free( session->peer_cert );
7193 mbedtls_free( session->peer_cert );
7194 session->peer_cert = NULL;
7195 }
Hanno Becker5882dd02019-06-06 16:25:57 +01007196#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker17572472019-02-08 07:19:04 +00007197 if( session->peer_cert_digest != NULL )
7198 {
7199 /* Zeroization is not necessary. */
7200 mbedtls_free( session->peer_cert_digest );
7201 session->peer_cert_digest = NULL;
7202 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
7203 session->peer_cert_digest_len = 0;
7204 }
Hanno Becker5882dd02019-06-06 16:25:57 +01007205#else
7206 ((void) session);
7207#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker17572472019-02-08 07:19:04 +00007208}
7209#endif /* MBEDTLS_X509_CRT_PARSE_C */
7210
Paul Bakker5121ce52009-01-03 21:22:43 +00007211/*
7212 * Handshake functions
7213 */
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007214#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02007215/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007216int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007217{
Hanno Beckerdf645962019-06-26 13:02:22 +01007218 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7219 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker5121ce52009-01-03 21:22:43 +00007220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007221 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007222
Hanno Becker5097cba2019-02-05 13:36:46 +00007223 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007224 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007225 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007226 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7227 {
7228 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7229 }
7230 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7231 {
7232 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7233 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007234 else
7235 {
7236 ssl->state = MBEDTLS_SSL_INVALID;
7237 }
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007238 return( 0 );
7239 }
7240
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007241 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7242 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007243}
7244
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007245int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007246{
Hanno Beckerdf645962019-06-26 13:02:22 +01007247 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7248 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007249
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007250 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007251
Hanno Becker5097cba2019-02-05 13:36:46 +00007252 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007253 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007254 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007255 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7256 {
7257 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7258 }
7259 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7260 {
7261 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7262 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007263 else
7264 {
7265 ssl->state = MBEDTLS_SSL_INVALID;
7266 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007267 return( 0 );
7268 }
7269
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007270 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7271 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007272}
Gilles Peskinef9828522017-05-03 12:28:43 +02007273
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007274#else /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Gilles Peskinef9828522017-05-03 12:28:43 +02007275/* Some certificate support -> implement write and parse */
7276
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007277int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007278{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007279 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007280 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007281 const mbedtls_x509_crt *crt;
Hanno Beckerdf645962019-06-26 13:02:22 +01007282 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7283 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007284
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007285 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007286
Hanno Becker5097cba2019-02-05 13:36:46 +00007287 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007288 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007289 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007290 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7291 {
7292 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7293 }
7294 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7295 {
7296 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7297 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007298 else
7299 {
7300 ssl->state = MBEDTLS_SSL_INVALID;
7301 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007302 return( 0 );
7303 }
7304
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007305#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007306 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7307 MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00007308 {
7309 if( ssl->client_auth == 0 )
7310 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007311 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007312 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7313 {
7314 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7315 }
7316 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7317 {
7318 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7319 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007320 else
7321 {
7322 ssl->state = MBEDTLS_SSL_INVALID;
7323 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007324 return( 0 );
7325 }
7326
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007327#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00007328 /*
7329 * If using SSLv3 and got no cert, send an Alert message
7330 * (otherwise an empty Certificate message will be sent).
7331 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007332 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
Hanno Becker2881d802019-05-22 14:44:53 +01007333 mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007334 {
7335 ssl->out_msglen = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007336 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
7337 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
7338 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
Paul Bakker5121ce52009-01-03 21:22:43 +00007339
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007340 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007341 goto write_msg;
7342 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007343#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00007344 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007345#endif /* MBEDTLS_SSL_CLI_C */
7346#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007347 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00007348 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007349 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007350 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
7352 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00007353 }
7354 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01007355#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007357 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007358
7359 /*
7360 * 0 . 0 handshake type
7361 * 1 . 3 handshake length
7362 * 4 . 6 length of all certs
7363 * 7 . 9 length of cert. 1
7364 * 10 . n-1 peer certificate
7365 * n . n+2 length of cert. 2
7366 * n+3 . ... upper level cert, etc.
7367 */
7368 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007369 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00007370
Paul Bakker29087132010-03-21 21:03:34 +00007371 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007372 {
7373 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10007374 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00007375 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007376 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
Angus Grattond8213d02016-05-25 20:56:48 +10007377 i + 3 + n, MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007378 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007379 }
7380
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007381 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[i], n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007382
Teppo Järvelin91d79382019-10-02 09:09:31 +03007383 i += 3; mbedtls_platform_memcpy( ssl->out_msg + i, crt->raw.p, n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007384 i += n; crt = crt->next;
7385 }
7386
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007387 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[4], ( i - 7 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007388
7389 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007390 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7391 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00007392
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02007393#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00007394write_msg:
Paul Bakkerd2f068e2013-08-27 21:19:20 +02007395#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007396
Jarno Lamsa2b205162019-11-12 15:36:21 +02007397 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7398 {
7399 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7400 }
7401 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7402 {
7403 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7404 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007405 else
7406 {
7407 ssl->state = MBEDTLS_SSL_INVALID;
7408 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007409
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007410 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007411 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007412 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007413 return( ret );
7414 }
7415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007416 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007417
Paul Bakkered27a042013-04-18 22:46:23 +02007418 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007419}
7420
Hanno Becker285ff0c2019-01-31 07:44:03 +00007421#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerdf759382019-02-05 17:02:46 +00007422
7423#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007424#define PEER_CRT_CHANGED 0x75555555
Hanno Becker33c3dc82019-01-30 14:46:46 +00007425static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7426 unsigned char *crt_buf,
7427 size_t crt_buf_len )
7428{
7429 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
7430
7431 if( peer_crt == NULL )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007432 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007433
7434 if( peer_crt->raw.len != crt_buf_len )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007435 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007436
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02007437 return( mbedtls_platform_memequal( peer_crt->raw.p, crt_buf, crt_buf_len ) );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007438}
Hanno Becker5882dd02019-06-06 16:25:57 +01007439#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007440#define PEER_CRT_CHANGED 0x75555555
Hanno Beckerdf759382019-02-05 17:02:46 +00007441static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7442 unsigned char *crt_buf,
7443 size_t crt_buf_len )
7444{
7445 int ret;
7446 unsigned char const * const peer_cert_digest =
7447 ssl->session->peer_cert_digest;
7448 mbedtls_md_type_t const peer_cert_digest_type =
7449 ssl->session->peer_cert_digest_type;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007450 mbedtls_md_handle_t digest_info =
Hanno Beckerdf759382019-02-05 17:02:46 +00007451 mbedtls_md_info_from_type( peer_cert_digest_type );
7452 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
7453 size_t digest_len;
7454
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007455 if( peer_cert_digest == NULL ||
7456 digest_info == MBEDTLS_MD_INVALID_HANDLE )
7457 {
Andrzej Kurek0919b142020-07-06 15:28:59 -04007458 return( PEER_CRT_CHANGED );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007459 }
Hanno Beckerdf759382019-02-05 17:02:46 +00007460
7461 digest_len = mbedtls_md_get_size( digest_info );
7462 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
Andrzej Kurek45e71992020-07-08 10:09:44 -04007463 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007464
7465 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
7466 if( ret != 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007467 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007468
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02007469 return( mbedtls_platform_memequal( tmp_digest, peer_cert_digest, digest_len ) );
Hanno Beckerdf759382019-02-05 17:02:46 +00007470}
Hanno Becker5882dd02019-06-06 16:25:57 +01007471#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker285ff0c2019-01-31 07:44:03 +00007472#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Hanno Becker33c3dc82019-01-30 14:46:46 +00007473
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007474/*
7475 * Once the certificate message is read, parse it into a cert chain and
7476 * perform basic checks, but leave actual verification to the caller
7477 */
Hanno Becker35e41772019-02-05 15:37:23 +00007478static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
7479 mbedtls_x509_crt *chain )
Paul Bakker5121ce52009-01-03 21:22:43 +00007480{
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007481 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker35e41772019-02-05 15:37:23 +00007482#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7483 int crt_cnt=0;
7484#endif
Paul Bakker23986e52011-04-24 08:57:21 +00007485 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02007486 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00007487
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007488 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007489 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007490 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007491 mbedtls_ssl_pend_fatal_alert( ssl,
7492 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007493 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007494 }
7495
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007496 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
7497 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007498 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007499 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007500 mbedtls_ssl_pend_fatal_alert( ssl,
7501 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007502 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007503 }
7504
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007505 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007506
Paul Bakker5121ce52009-01-03 21:22:43 +00007507 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007508 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00007509 */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007510 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007511
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007512 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007513 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00007514 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007515 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007516 mbedtls_ssl_pend_fatal_alert( ssl,
7517 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007518 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007519 }
7520
Hanno Becker33c3dc82019-01-30 14:46:46 +00007521 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
7522 i += 3;
7523
Hanno Becker33c3dc82019-01-30 14:46:46 +00007524 /* Iterate through and parse the CRTs in the provided chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007525 while( i < ssl->in_hslen )
7526 {
Hanno Becker33c3dc82019-01-30 14:46:46 +00007527 /* Check that there's room for the next CRT's length fields. */
Philippe Antoine747fd532018-05-30 09:13:21 +02007528 if ( i + 3 > ssl->in_hslen ) {
7529 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007530 mbedtls_ssl_pend_fatal_alert( ssl,
7531 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +02007532 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
7533 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007534 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
7535 * anything beyond 2**16 ~ 64K. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007536 if( ssl->in_msg[i] != 0 )
7537 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007538 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007539 mbedtls_ssl_pend_fatal_alert( ssl,
7540 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007541 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007542 }
7543
Hanno Becker33c3dc82019-01-30 14:46:46 +00007544 /* Read length of the next CRT in the chain. */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007545 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007546 i += 3;
7547
7548 if( n < 128 || i + n > ssl->in_hslen )
7549 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007550 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007551 mbedtls_ssl_pend_fatal_alert( ssl,
7552 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007553 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007554 }
7555
Hanno Becker33c3dc82019-01-30 14:46:46 +00007556 /* Check if we're handling the first CRT in the chain. */
Hanno Becker35e41772019-02-05 15:37:23 +00007557#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7558 if( crt_cnt++ == 0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007559 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7560 MBEDTLS_SSL_IS_CLIENT &&
Hanno Becker35e41772019-02-05 15:37:23 +00007561 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007562 {
Hanno Becker68b856d2019-02-08 14:00:04 +00007563 /* During client-side renegotiation, check that the server's
7564 * end-CRTs hasn't changed compared to the initial handshake,
7565 * mitigating the triple handshake attack. On success, reuse
7566 * the original end-CRT instead of parsing it again. */
Hanno Becker35e41772019-02-05 15:37:23 +00007567 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
7568 if( ssl_check_peer_crt_unchanged( ssl,
7569 &ssl->in_msg[i],
7570 n ) != 0 )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007571 {
Hanno Becker35e41772019-02-05 15:37:23 +00007572 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007573 mbedtls_ssl_pend_fatal_alert( ssl,
7574 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Hanno Becker35e41772019-02-05 15:37:23 +00007575 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007576 }
Hanno Becker35e41772019-02-05 15:37:23 +00007577
7578 /* Now we can safely free the original chain. */
7579 ssl_clear_peer_cert( ssl->session );
7580 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007581#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7582
Hanno Becker33c3dc82019-01-30 14:46:46 +00007583 /* Parse the next certificate in the chain. */
Hanno Becker0cc7af52019-02-08 14:39:16 +00007584#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker35e41772019-02-05 15:37:23 +00007585 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
Hanno Becker0cc7af52019-02-08 14:39:16 +00007586#else
Hanno Becker42de8f82019-02-26 11:51:34 +00007587 /* If we don't need to store the CRT chain permanently, parse
Hanno Becker0cc7af52019-02-08 14:39:16 +00007588 * it in-place from the input buffer instead of making a copy. */
7589 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
7590#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007591 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00007592 {
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007593 case 0: /* ok */
7594 mbedtls_platform_random_delay();
7595 if( ret != 0 )
7596 {
7597 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7598 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7599 goto crt_parse_der_failed;
7600 }
7601 break;
Hanno Becker33c3dc82019-01-30 14:46:46 +00007602 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7603 /* Ignore certificate with an unknown algorithm: maybe a
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007604 * prior certificate was already trusted. */
7605 mbedtls_platform_random_delay();
7606 if( ret != MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND )
7607 {
7608 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7609 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7610 goto crt_parse_der_failed;
7611 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007612 break;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007613
Hanno Becker33c3dc82019-01-30 14:46:46 +00007614 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7615 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7616 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007617
Hanno Becker33c3dc82019-01-30 14:46:46 +00007618 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7619 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7620 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007621
Hanno Becker33c3dc82019-01-30 14:46:46 +00007622 default:
7623 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7624 crt_parse_der_failed:
Hanno Beckerde62da92019-07-24 13:23:50 +01007625 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007626 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
7627 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007628 }
7629
7630 i += n;
7631 }
7632
Hanno Becker35e41772019-02-05 15:37:23 +00007633 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007634 return( 0 );
7635}
7636
Hanno Beckerb8a08572019-02-05 12:49:06 +00007637#if defined(MBEDTLS_SSL_SRV_C)
7638static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
7639{
Hanno Becker2d9623f2019-06-13 12:07:05 +01007640 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007641 return( -1 );
7642
7643#if defined(MBEDTLS_SSL_PROTO_SSL3)
7644 /*
7645 * Check if the client sent an empty certificate
7646 */
Hanno Becker2881d802019-05-22 14:44:53 +01007647 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007648 {
7649 if( ssl->in_msglen == 2 &&
7650 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
7651 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7652 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7653 {
7654 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
7655 return( 0 );
7656 }
7657
7658 return( -1 );
7659 }
7660#endif /* MBEDTLS_SSL_PROTO_SSL3 */
7661
7662#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
7663 defined(MBEDTLS_SSL_PROTO_TLS1_2)
7664 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
7665 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7666 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
Teppo Järvelin0efac532019-10-04 13:21:08 +03007667 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 ) // use regular memcmp as comparing public data
Hanno Beckerb8a08572019-02-05 12:49:06 +00007668 {
7669 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
7670 return( 0 );
7671 }
7672
Hanno Beckerb8a08572019-02-05 12:49:06 +00007673#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
7674 MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker17daaa52019-06-18 12:31:45 +01007675
7676 return( -1 );
Hanno Beckerb8a08572019-02-05 12:49:06 +00007677}
7678#endif /* MBEDTLS_SSL_SRV_C */
7679
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007680/* Check if a certificate message is expected.
7681 * Return either
7682 * - SSL_CERTIFICATE_EXPECTED, or
7683 * - SSL_CERTIFICATE_SKIP
7684 * indicating whether a Certificate message is expected or not.
7685 */
7686#define SSL_CERTIFICATE_EXPECTED 0
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02007687#define SSL_CERTIFICATE_SKIP 0xff
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007688static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
7689 int authmode )
7690{
Hanno Becker473f98f2019-06-26 10:27:32 +01007691 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007692 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007693
7694 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
7695 return( SSL_CERTIFICATE_SKIP );
7696
7697#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007698 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007699 {
Hanno Becker473f98f2019-06-26 10:27:32 +01007700 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
7701 MBEDTLS_KEY_EXCHANGE_RSA_PSK )
7702 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007703 return( SSL_CERTIFICATE_SKIP );
Hanno Becker473f98f2019-06-26 10:27:32 +01007704 }
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007705
7706 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
7707 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007708 ssl->session_negotiate->verify_result =
7709 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
7710 return( SSL_CERTIFICATE_SKIP );
7711 }
7712 }
Hanno Beckerfd5dc8a2019-03-01 08:10:46 +00007713#else
7714 ((void) authmode);
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007715#endif /* MBEDTLS_SSL_SRV_C */
7716
7717 return( SSL_CERTIFICATE_EXPECTED );
7718}
7719
Hanno Becker3cf50612019-02-05 14:36:34 +00007720static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007721 volatile int authmode,
Hanno Becker3cf50612019-02-05 14:36:34 +00007722 mbedtls_x509_crt *chain,
7723 void *rs_ctx )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007724{
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007725 volatile int verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Andrzej Kurekfd56f402020-05-25 11:52:05 -04007726 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007727 volatile int flow_counter = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01007728 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007729 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker3cf50612019-02-05 14:36:34 +00007730 mbedtls_x509_crt *ca_chain;
7731 mbedtls_x509_crl *ca_crl;
7732
7733 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
Jarno Lamsae1621d42019-12-19 08:58:56 +02007734 {
Hanno Becker3cf50612019-02-05 14:36:34 +00007735 return( 0 );
Jarno Lamsae1621d42019-12-19 08:58:56 +02007736 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007737
Jarno Lamsae1621d42019-12-19 08:58:56 +02007738 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Hanno Becker3cf50612019-02-05 14:36:34 +00007739#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7740 if( ssl->handshake->sni_ca_chain != NULL )
7741 {
7742 ca_chain = ssl->handshake->sni_ca_chain;
7743 ca_crl = ssl->handshake->sni_ca_crl;
7744 }
7745 else
7746#endif
7747 {
7748 ca_chain = ssl->conf->ca_chain;
7749 ca_crl = ssl->conf->ca_crl;
7750 }
7751
7752 /*
7753 * Main check: verify certificate
7754 */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007755 verify_ret = mbedtls_x509_crt_verify_restartable(
Hanno Becker3cf50612019-02-05 14:36:34 +00007756 chain,
7757 ca_chain, ca_crl,
7758 ssl->conf->cert_profile,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007759#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Hanno Becker3cf50612019-02-05 14:36:34 +00007760 ssl->hostname,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007761#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Hanno Becker3cf50612019-02-05 14:36:34 +00007762 &ssl->session_negotiate->verify_result,
Hanno Becker9ec3fe02019-07-01 17:36:12 +01007763#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
7764 ssl->conf->f_vrfy, ssl->conf->p_vrfy,
7765#endif /* MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
7766 rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00007767
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007768 if( verify_ret == 0 )
7769 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007770 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007771 if( verify_ret == 0 )
7772 {
7773 flow_counter++;
7774 }
7775 else
7776 {
7777 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7778 }
7779 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007780 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007781 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007782 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", verify_ret );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007783 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007784 }
7785
7786#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Hanno Becker8c13ee62019-02-26 16:48:17 +00007787 if( verify_ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Hanno Becker3cf50612019-02-05 14:36:34 +00007788 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
7789#endif
7790
7791 /*
7792 * Secondary checks: always done, but change 'ret' only if it was 0
7793 */
7794
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007795#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
Hanno Becker3cf50612019-02-05 14:36:34 +00007796 {
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007797#if defined(MBEDTLS_USE_TINYCRYPT)
Hanno Beckeree902df2019-08-23 13:47:47 +01007798 ret = mbedtls_ssl_check_curve_uecc( ssl, MBEDTLS_UECC_DP_SECP256R1 );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007799#else /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007800 mbedtls_pk_context *pk;
7801 ret = mbedtls_x509_crt_pk_acquire( chain, &pk );
7802 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +01007803 {
7804 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007805 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +01007806 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007807
7808 /* If certificate uses an EC key, make sure the curve is OK */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007809 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) )
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007810 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007811 ret = mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007812 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007813
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00007814 mbedtls_x509_crt_pk_release( chain );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007815#endif /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007816
7817 if( ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007818 {
7819 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
7820
7821 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007822 if( verify_ret == 0 )
7823 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007824 flow_counter++;
7825 }
7826 if( ret == 0 )
7827 {
7828 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007829 }
7830 }
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007831#endif /* MBEDTLS_ECP_C || MEDTLS_USE_TINYCRYPT */
Hanno Becker3cf50612019-02-05 14:36:34 +00007832
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007833 ret = mbedtls_ssl_check_cert_usage( chain,
Hanno Becker3cf50612019-02-05 14:36:34 +00007834 ciphersuite_info,
Hanno Becker2d9623f2019-06-13 12:07:05 +01007835 ( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7836 MBEDTLS_SSL_IS_CLIENT ),
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007837 &ssl->session_negotiate->verify_result );
7838 if( ret == 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007839 {
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007840 flow_counter++;
7841 }
7842 else
7843 {
7844 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007845 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007846 if( verify_ret == 0 )
7847 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Hanno Becker3cf50612019-02-05 14:36:34 +00007848 }
7849
7850 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
7851 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
7852 * with details encoded in the verification flags. All other kinds
7853 * of error codes, including those from the user provided f_vrfy
7854 * functions, are treated as fatal and lead to a failure of
7855 * ssl_parse_certificate even if verification was optional. */
7856 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
Hanno Becker8c13ee62019-02-26 16:48:17 +00007857 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7858 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
Hanno Becker3cf50612019-02-05 14:36:34 +00007859 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007860 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007861 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
7862 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7863 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
7864 {
7865 verify_ret = 0;
7866 flow_counter++;
7867 }
7868 else
7869 {
7870 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7871 }
7872 } else {
7873 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007874 }
7875
7876 if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
7877 {
7878 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007879 verify_ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007880 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007881 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007882 else
7883 {
7884 flow_counter++;
7885 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007886
Hanno Becker8c13ee62019-02-26 16:48:17 +00007887 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007888 {
7889 uint8_t alert;
7890
7891 /* The certificate may have been rejected for several reasons.
7892 Pick one and send the corresponding alert. Which alert to send
7893 may be a subject of debate in some cases. */
7894 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
7895 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
7896 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
7897 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7898 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
7899 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7900 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
7901 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7902 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
7903 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7904 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
7905 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7906 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
7907 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7908 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
7909 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
7910 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
7911 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
7912 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
7913 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
7914 else
7915 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Hanno Beckerde62da92019-07-24 13:23:50 +01007916 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker3cf50612019-02-05 14:36:34 +00007917 }
7918
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007919 if( verify_ret == 0 &&
7920#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7921 flow_counter == 5 )
7922#else
7923 flow_counter == 4 )
7924#endif
7925 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007926 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007927 if( verify_ret == 0 &&
7928#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7929 flow_counter == 5 )
7930#else
7931 flow_counter == 4 )
7932#endif
7933 {
Jarno Lamsae1621d42019-12-19 08:58:56 +02007934 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER AUTHENTICATED" ) );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007935 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
7936 }
7937 else
7938 {
7939 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7940 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007941 } else {
7942 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER NOT AUTHENTICATED, %d", flow_counter));
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007943 }
7944
Hanno Becker3cf50612019-02-05 14:36:34 +00007945#if defined(MBEDTLS_DEBUG_C)
7946 if( ssl->session_negotiate->verify_result != 0 )
7947 {
7948 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
7949 ssl->session_negotiate->verify_result ) );
7950 }
7951 else
7952 {
7953 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
7954 }
7955#endif /* MBEDTLS_DEBUG_C */
7956
Hanno Becker8c13ee62019-02-26 16:48:17 +00007957 return( verify_ret );
Hanno Becker3cf50612019-02-05 14:36:34 +00007958}
7959
Hanno Becker34106f62019-02-08 14:59:05 +00007960#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker5882dd02019-06-06 16:25:57 +01007961
7962#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00007963static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
7964 unsigned char *start, size_t len )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007965{
7966 int ret;
Hanno Becker34106f62019-02-08 14:59:05 +00007967 /* Remember digest of the peer's end-CRT. */
7968 ssl->session_negotiate->peer_cert_digest =
7969 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
7970 if( ssl->session_negotiate->peer_cert_digest == NULL )
7971 {
7972 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
7973 sizeof( MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007974 mbedtls_ssl_pend_fatal_alert( ssl,
7975 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Becker34106f62019-02-08 14:59:05 +00007976
7977 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7978 }
7979
7980 ret = mbedtls_md( mbedtls_md_info_from_type(
7981 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
7982 start, len,
7983 ssl->session_negotiate->peer_cert_digest );
7984
7985 ssl->session_negotiate->peer_cert_digest_type =
7986 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
7987 ssl->session_negotiate->peer_cert_digest_len =
7988 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
7989
7990 return( ret );
7991}
Hanno Becker5882dd02019-06-06 16:25:57 +01007992#endif /* MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker34106f62019-02-08 14:59:05 +00007993
7994static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
7995 unsigned char *start, size_t len )
7996{
7997 unsigned char *end = start + len;
7998 int ret;
7999
8000 /* Make a copy of the peer's raw public key. */
8001 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
8002 ret = mbedtls_pk_parse_subpubkey( &start, end,
8003 &ssl->handshake->peer_pubkey );
8004 if( ret != 0 )
8005 {
8006 /* We should have parsed the public key before. */
8007 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
8008 }
8009
Manuel Pégourié-Gonnard2829bbf2019-09-19 10:45:14 +02008010 ssl->handshake->got_peer_pubkey = 1;
Hanno Becker34106f62019-02-08 14:59:05 +00008011 return( 0 );
8012}
8013#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8014
Hanno Becker3cf50612019-02-05 14:36:34 +00008015int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
8016{
8017 int ret = 0;
Hanno Becker6b9a6f32019-02-07 10:11:07 +00008018 int crt_expected;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008019#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8020 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
8021 ? ssl->handshake->sni_authmode
Hanno Beckeracd4fc02019-06-12 16:40:50 +01008022 : mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008023#else
Hanno Beckeracd4fc02019-06-12 16:40:50 +01008024 const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008025#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008026 void *rs_ctx = NULL;
Hanno Beckere4aeb762019-02-05 17:19:52 +00008027 mbedtls_x509_crt *chain = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008028
8029 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
8030
Hanno Becker6b9a6f32019-02-07 10:11:07 +00008031 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
8032 if( crt_expected == SSL_CERTIFICATE_SKIP )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008033 {
8034 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Hanno Becker613d4902019-02-05 13:11:17 +00008035 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008036 }
8037
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008038#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8039 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02008040 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008041 {
Hanno Beckere4aeb762019-02-05 17:19:52 +00008042 chain = ssl->handshake->ecrs_peer_cert;
8043 ssl->handshake->ecrs_peer_cert = NULL;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008044 goto crt_verify;
8045 }
8046#endif
8047
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02008048 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008049 {
8050 /* mbedtls_ssl_read_record may have sent an alert already. We
8051 let it decide whether to alert. */
8052 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Hanno Beckere4aeb762019-02-05 17:19:52 +00008053 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008054 }
8055
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008056#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerb8a08572019-02-05 12:49:06 +00008057 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
8058 {
8059 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008060
Hanno Beckerb8a08572019-02-05 12:49:06 +00008061 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
Hanno Becker613d4902019-02-05 13:11:17 +00008062 ret = 0;
8063 else
8064 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Hanno Beckerb8a08572019-02-05 12:49:06 +00008065
Hanno Becker613d4902019-02-05 13:11:17 +00008066 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008067 }
Hanno Beckerb8a08572019-02-05 12:49:06 +00008068#endif /* MBEDTLS_SSL_SRV_C */
8069
Hanno Becker35e41772019-02-05 15:37:23 +00008070 /* Clear existing peer CRT structure in case we tried to
8071 * reuse a session but it failed, and allocate a new one. */
Hanno Beckera46c2872019-02-05 13:08:01 +00008072 ssl_clear_peer_cert( ssl->session_negotiate );
Hanno Beckere4aeb762019-02-05 17:19:52 +00008073
8074 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
8075 if( chain == NULL )
Hanno Becker35e41772019-02-05 15:37:23 +00008076 {
8077 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
8078 sizeof( mbedtls_x509_crt ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008079 mbedtls_ssl_pend_fatal_alert( ssl,
8080 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Beckera46c2872019-02-05 13:08:01 +00008081
Hanno Beckere4aeb762019-02-05 17:19:52 +00008082 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
8083 goto exit;
8084 }
8085 mbedtls_x509_crt_init( chain );
8086
8087 ret = ssl_parse_certificate_chain( ssl, chain );
Hanno Becker35e41772019-02-05 15:37:23 +00008088 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00008089 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008090
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008091#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8092 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02008093 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008094
8095crt_verify:
8096 if( ssl->handshake->ecrs_enabled)
8097 rs_ctx = &ssl->handshake->ecrs_ctx;
8098#endif
8099
Hanno Becker3cf50612019-02-05 14:36:34 +00008100 ret = ssl_parse_certificate_verify( ssl, authmode,
Hanno Beckere4aeb762019-02-05 17:19:52 +00008101 chain, rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00008102 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00008103 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00008104
Hanno Becker3008d282019-02-05 17:02:28 +00008105#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakker5121ce52009-01-03 21:22:43 +00008106 {
Hanno Becker5882dd02019-06-06 16:25:57 +01008107 size_t pk_len;
8108 unsigned char *pk_start;
Paul Bakker5121ce52009-01-03 21:22:43 +00008109
Hanno Becker34106f62019-02-08 14:59:05 +00008110 /* We parse the CRT chain without copying, so
8111 * these pointers point into the input buffer,
8112 * and are hence still valid after freeing the
8113 * CRT chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00008114
Hanno Becker5882dd02019-06-06 16:25:57 +01008115#if defined(MBEDTLS_SSL_RENEGOTIATION)
8116 unsigned char *crt_start;
8117 size_t crt_len;
8118
Hanno Becker34106f62019-02-08 14:59:05 +00008119 crt_start = chain->raw.p;
8120 crt_len = chain->raw.len;
Hanno Becker5882dd02019-06-06 16:25:57 +01008121#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008122
Hanno Becker8c13ee62019-02-26 16:48:17 +00008123 pk_start = chain->cache->pk_raw.p;
8124 pk_len = chain->cache->pk_raw.len;
Hanno Becker34106f62019-02-08 14:59:05 +00008125
8126 /* Free the CRT structures before computing
8127 * digest and copying the peer's public key. */
8128 mbedtls_x509_crt_free( chain );
8129 mbedtls_free( chain );
8130 chain = NULL;
8131
Hanno Becker5882dd02019-06-06 16:25:57 +01008132#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00008133 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008134 if( ret != 0 )
Hanno Beckercf291d62019-02-06 16:19:04 +00008135 goto exit;
Hanno Becker5882dd02019-06-06 16:25:57 +01008136#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008137
Hanno Becker34106f62019-02-08 14:59:05 +00008138 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008139 if( ret != 0 )
Hanno Becker34106f62019-02-08 14:59:05 +00008140 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00008141 }
Hanno Becker34106f62019-02-08 14:59:05 +00008142#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8143 /* Pass ownership to session structure. */
Hanno Beckere4aeb762019-02-05 17:19:52 +00008144 ssl->session_negotiate->peer_cert = chain;
8145 chain = NULL;
Hanno Becker34106f62019-02-08 14:59:05 +00008146#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008147
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008148 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008149
Hanno Becker613d4902019-02-05 13:11:17 +00008150exit:
8151
Hanno Beckere4aeb762019-02-05 17:19:52 +00008152 if( ret == 0 )
Jarno Lamsa2b205162019-11-12 15:36:21 +02008153 {
8154 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
8155 {
8156 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
8157 }
8158 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
8159 {
8160 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
8161 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008162 else
8163 {
8164 ssl->state = MBEDTLS_SSL_INVALID;
8165 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008166 }
Hanno Beckere4aeb762019-02-05 17:19:52 +00008167
8168#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8169 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
8170 {
8171 ssl->handshake->ecrs_peer_cert = chain;
8172 chain = NULL;
8173 }
8174#endif
8175
8176 if( chain != NULL )
8177 {
8178 mbedtls_x509_crt_free( chain );
8179 mbedtls_free( chain );
8180 }
8181
Paul Bakker5121ce52009-01-03 21:22:43 +00008182 return( ret );
8183}
Hanno Beckerb71e90a2019-02-05 13:20:55 +00008184#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00008185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008186int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008187{
8188 int ret;
8189
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008190 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008191
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008192 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00008193 ssl->out_msglen = 1;
8194 ssl->out_msg[0] = 1;
8195
Jarno Lamsa2b205162019-11-12 15:36:21 +02008196 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
8197 {
8198 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
8199 }
8200 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
8201 {
8202 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
8203 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008204 else
8205 {
8206 ssl->state = MBEDTLS_SSL_INVALID;
8207 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008208
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008209 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008210 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008211 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008212 return( ret );
8213 }
8214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008215 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008216
8217 return( 0 );
8218}
8219
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008220int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008221{
8222 int ret;
8223
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008224 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008225
Hanno Becker327c93b2018-08-15 13:56:18 +01008226 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008227 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008228 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008229 return( ret );
8230 }
8231
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008232 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00008233 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008234 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008235 mbedtls_ssl_pend_fatal_alert( ssl,
8236 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008237 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008238 }
8239
Hanno Beckere678eaa2018-08-21 14:57:46 +01008240 /* CCS records are only accepted if they have length 1 and content '1',
8241 * so we don't need to check this here. */
Paul Bakker5121ce52009-01-03 21:22:43 +00008242
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008243 /*
8244 * Switch to our negotiated transform and session parameters for inbound
8245 * data.
8246 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008247 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008248 ssl->transform_in = ssl->transform_negotiate;
8249 ssl->session_in = ssl->session_negotiate;
8250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008251#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008252 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008253 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008254#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008255 ssl_dtls_replay_reset( ssl );
8256#endif
8257
8258 /* Increment epoch */
8259 if( ++ssl->in_epoch == 0 )
8260 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008261 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02008262 /* This is highly unlikely to happen for legitimate reasons, so
8263 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008264 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008265 }
8266 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008267 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008268#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008269#if defined(MBEDTLS_SSL_PROTO_TLS)
8270 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008271 mbedtls_platform_memset( ssl->in_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008272 }
8273#endif
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008274
Hanno Beckerf5970a02019-05-08 09:38:41 +01008275 ssl_update_in_pointers( ssl );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008276
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008277#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8278 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008279 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008280 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008281 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008282 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
Hanno Beckerde62da92019-07-24 13:23:50 +01008283 mbedtls_ssl_pend_fatal_alert( ssl,
8284 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008285 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008286 }
8287 }
8288#endif
8289
Jarno Lamsa2b205162019-11-12 15:36:21 +02008290 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
8291 {
8292 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
8293 }
8294 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
8295 {
8296 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
8297 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008298 else
8299 {
8300 ssl->state = MBEDTLS_SSL_INVALID;
8301 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008302
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008303 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008304
8305 return( 0 );
8306}
8307
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008308void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008309{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008310#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8311 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker533f5b12019-08-15 16:56:35 +01008312 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008313 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008314#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008315#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8316#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008317 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008318#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008319#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008320 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008321#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008322#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008323}
8324
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008325static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008326{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008327 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008328
8329 /*
8330 * Free our handshake params
8331 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02008332 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008333 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00008334 ssl->handshake = NULL;
8335
8336 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008337 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00008338 */
8339 if( ssl->transform )
8340 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008341 mbedtls_ssl_transform_free( ssl->transform );
8342 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00008343 }
8344 ssl->transform = ssl->transform_negotiate;
8345 ssl->transform_negotiate = NULL;
8346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008347 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008348}
8349
Jarno Lamsae1621d42019-12-19 08:58:56 +02008350int mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008351{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04008352 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008353
8354#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Jarno Lamsa015aa442019-12-20 12:09:37 +02008355 volatile const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008356 ? ssl->handshake->sni_authmode
8357 : mbedtls_ssl_conf_get_authmode( ssl->conf );
8358#else
Jarno Lamsa015aa442019-12-20 12:09:37 +02008359 volatile const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008360#endif
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008361#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8362 volatile int crt_expected = SSL_CERTIFICATE_EXPECTED;
8363 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
8364#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008365 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008366
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008367#if defined(MBEDTLS_SSL_RENEGOTIATION)
8368 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008369 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008370 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008371 ssl->renego_records_seen = 0;
8372 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008373#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008374
8375 /*
8376 * Free the previous session and switch in the current one
8377 */
Paul Bakker0a597072012-09-25 21:55:46 +00008378 if( ssl->session )
8379 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008380#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01008381 /* RFC 7366 3.1: keep the EtM state */
8382 ssl->session_negotiate->encrypt_then_mac =
8383 ssl->session->encrypt_then_mac;
8384#endif
8385
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008386 mbedtls_ssl_session_free( ssl->session );
8387 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00008388 }
8389 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00008390 ssl->session_negotiate = NULL;
8391
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008392#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Paul Bakker0a597072012-09-25 21:55:46 +00008393 /*
8394 * Add cache entry
8395 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008396 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02008397 ssl->session->id_len != 0 &&
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008398 ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_UNSET )
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008399 {
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01008400 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008401 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008402 }
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008403#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker0a597072012-09-25 21:55:46 +00008404
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008405 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8406 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8407#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8408 crt_expected == SSL_CERTIFICATE_SKIP )
8409#else
8410 1 )
8411#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008412 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008413 mbedtls_platform_random_delay();
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008414 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8415 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8416#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8417 crt_expected == SSL_CERTIFICATE_SKIP )
8418#else
8419 1 )
8420#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008421 {
8422 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
8423 }
8424 else
8425 {
8426 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8427 goto cleanup;
8428 }
8429 }
8430
Jarno Lamsae1621d42019-12-19 08:58:56 +02008431#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008432 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008433 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008434 mbedtls_platform_random_delay();
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008435 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008436 {
Jarno Lamsa06164052019-12-19 14:40:36 +02008437 /* When doing session resume, no premaster or peer authentication */
Jarno Lamsae1621d42019-12-19 08:58:56 +02008438 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsa06164052019-12-19 14:40:36 +02008439 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008440 }
8441 else
8442 {
8443 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008444 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008445 }
8446 }
8447#endif
8448
8449 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8450 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008451 mbedtls_platform_random_delay();
Jarno Lamsae1621d42019-12-19 08:58:56 +02008452 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8453 {
8454 ret = 0;
8455 }
8456 else
8457 {
8458 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008459 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008460 }
8461 }
8462 else
8463 {
8464 ret = MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008465 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008466 }
8467
Jarno Lamsa06164052019-12-19 14:40:36 +02008468 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8469 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8470 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8471 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008472 mbedtls_platform_random_delay();
Jarno Lamsa06164052019-12-19 14:40:36 +02008473 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8474 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8475 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8476 {
8477 ret = 0;
8478 }
8479 else
8480 {
8481 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8482 goto cleanup;
8483 }
8484 }
8485 else
8486 {
8487 MBEDTLS_SSL_DEBUG_MSG( 3, ( "hello random %d", ssl->handshake->hello_random_set ) );
8488 MBEDTLS_SSL_DEBUG_MSG( 3, ( "key_derivation_done %d", ssl->handshake->key_derivation_done ) );
8489 MBEDTLS_SSL_DEBUG_MSG( 3, ( "premaster_generated %d", ssl->handshake->premaster_generated ) );
8490 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8491 }
8492
8493cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008494#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008495 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008496 ssl->handshake->flight != NULL )
8497 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008498 /* Cancel handshake timer */
8499 ssl_set_timer( ssl, 0 );
8500
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008501 /* Keep last flight around in case we need to resend it:
8502 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008503 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008504 }
8505 else
8506#endif
8507 ssl_handshake_wrapup_free_hs_transform( ssl );
8508
Jarno Lamsa2b205162019-11-12 15:36:21 +02008509 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Paul Bakker48916f92012-09-16 19:57:18 +00008510
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008511 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Jarno Lamsae1621d42019-12-19 08:58:56 +02008512 return ret;
Paul Bakker48916f92012-09-16 19:57:18 +00008513}
8514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008515int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00008516{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008517 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00008518
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008519 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008520
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008521 ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01008522
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008523 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8524 mbedtls_ssl_suite_get_mac(
8525 mbedtls_ssl_ciphersuite_from_id(
8526 mbedtls_ssl_session_get_ciphersuite(
8527 ssl->session_negotiate ) ) ),
8528 ssl, ssl->out_msg + 4,
8529 mbedtls_ssl_conf_get_endpoint( ssl->conf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008530
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01008531 /*
8532 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
8533 * may define some other value. Currently (early 2016), no defined
8534 * ciphersuite does this (and this is unlikely to change as activity has
8535 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
8536 */
Hanno Becker2881d802019-05-22 14:44:53 +01008537 hash_len = ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008538
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008539#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008540 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008541 mbedtls_platform_memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008542#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008543
Paul Bakker5121ce52009-01-03 21:22:43 +00008544 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008545 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8546 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00008547
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008548#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Paul Bakker5121ce52009-01-03 21:22:43 +00008549 /*
8550 * In case of session resuming, invert the client and server
8551 * ChangeCipherSpec messages order.
8552 */
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008553 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008555#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008556 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8557 MBEDTLS_SSL_IS_CLIENT )
8558 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008559 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008560 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008561#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008562#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008563 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8564 MBEDTLS_SSL_IS_SERVER )
8565 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008566 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008567 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008568#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008569 }
8570 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008571#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008572 {
8573 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8574 {
8575 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8576 }
8577 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8578 {
8579 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8580 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008581 else
8582 {
8583 ssl->state = MBEDTLS_SSL_INVALID;
8584 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008585 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008586
Paul Bakker48916f92012-09-16 19:57:18 +00008587 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02008588 * Switch to our negotiated transform and session parameters for outbound
8589 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00008590 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008591 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01008592
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008593#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008594 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008595 {
8596 unsigned char i;
8597
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008598 /* Remember current epoch settings for resending */
8599 ssl->handshake->alt_transform_out = ssl->transform_out;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008600 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008601
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008602 /* Set sequence_number to zero */
Hanno Becker19859472018-08-06 09:40:20 +01008603 memset( ssl->cur_out_ctr + 2, 0, 6 );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008604
8605 /* Increment epoch */
8606 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01008607 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008608 break;
8609
8610 /* The loop goes to its end iff the counter is wrapping */
8611 if( i == 0 )
8612 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008613 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
8614 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008615 }
8616 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008617 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008618#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008619#if defined(MBEDTLS_SSL_PROTO_TLS)
8620 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008621 mbedtls_platform_memset( ssl->cur_out_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008622 }
8623#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008624
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008625 ssl->transform_out = ssl->transform_negotiate;
8626 ssl->session_out = ssl->session_negotiate;
8627
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008628#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8629 if( mbedtls_ssl_hw_record_activate != NULL )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008630 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008631 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008632 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008633 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
8634 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker07eb38b2012-12-19 14:42:06 +01008635 }
8636 }
8637#endif
8638
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008639#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008640 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008641 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02008642#endif
8643
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008644 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008645 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008646 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008647 return( ret );
8648 }
8649
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008650#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008651 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008652 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
8653 {
8654 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
8655 return( ret );
8656 }
8657#endif
8658
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008659 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008660
8661 return( 0 );
8662}
8663
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008664#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008665#define SSL_MAX_HASH_LEN 36
8666#else
8667#define SSL_MAX_HASH_LEN 12
8668#endif
8669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008670int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008671{
Paul Bakker23986e52011-04-24 08:57:21 +00008672 int ret;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008673 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008674 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00008675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008676 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008677
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008678 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8679 mbedtls_ssl_suite_get_mac(
8680 mbedtls_ssl_ciphersuite_from_id(
8681 mbedtls_ssl_session_get_ciphersuite(
8682 ssl->session_negotiate ) ) ),
8683 ssl, buf,
8684 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00008685
Hanno Becker327c93b2018-08-15 13:56:18 +01008686 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008687 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008688 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008689 return( ret );
8690 }
8691
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008692 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00008693 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008694 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008695 mbedtls_ssl_pend_fatal_alert( ssl,
8696 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008697 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008698 }
8699
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008700 /* There is currently no ciphersuite using another length with TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008701#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +01008702 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008703 hash_len = 36;
8704 else
8705#endif
8706 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008707
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008708 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
8709 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00008710 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008711 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008712 mbedtls_ssl_pend_fatal_alert( ssl,
8713 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008714 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008715 }
8716
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02008717 if( mbedtls_platform_memequal( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
8718 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008719 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008720 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008721 mbedtls_ssl_pend_fatal_alert( ssl,
8722 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008723 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008724 }
8725
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008726#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008727 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008728 mbedtls_platform_memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008729#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008730
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008731#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008732 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008733 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008734#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008735 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008736 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008737#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008738#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008739 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008740 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008741#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008742 }
8743 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008744#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008745 {
8746 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8747 {
8748 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8749 }
8750 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8751 {
8752 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8753 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008754 else
8755 {
8756 ssl->state = MBEDTLS_SSL_INVALID;
8757 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008758 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008759
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008760#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008761 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008762 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008763#endif
8764
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008765 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008766
8767 return( 0 );
8768}
8769
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008770static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008771{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008772 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008773
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008774#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8775 defined(MBEDTLS_SSL_PROTO_TLS1_1)
8776 mbedtls_md5_init( &handshake->fin_md5 );
8777 mbedtls_sha1_init( &handshake->fin_sha1 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008778 mbedtls_md5_starts_ret( &handshake->fin_md5 );
8779 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008780#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008781#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8782#if defined(MBEDTLS_SHA256_C)
8783 mbedtls_sha256_init( &handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008784 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008785#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008786#if defined(MBEDTLS_SHA512_C)
8787 mbedtls_sha512_init( &handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008788 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008789#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008790#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008791
Hanno Becker7e5437a2017-04-28 17:15:26 +01008792#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
8793 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8794 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
8795#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008796
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008797#if defined(MBEDTLS_DHM_C)
8798 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008799#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008800#if defined(MBEDTLS_ECDH_C)
8801 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008802#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02008803#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008804 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02008805#if defined(MBEDTLS_SSL_CLI_C)
8806 handshake->ecjpake_cache = NULL;
8807 handshake->ecjpake_cache_len = 0;
8808#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008809#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008810
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008811#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02008812 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008813#endif
8814
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008815#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8816 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
8817#endif
Hanno Becker3bf8cdf2019-02-06 16:18:31 +00008818
8819#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
8820 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8821 mbedtls_pk_init( &handshake->peer_pubkey );
8822#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008823}
8824
Hanno Becker611a83b2018-01-03 14:27:32 +00008825void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008826{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008827 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Andrzej Kurek11750442020-09-17 07:12:06 -04008828#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
8829 mbedtls_cipher_init( &transform->cipher_ctx );
8830#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008831 mbedtls_cipher_init( &transform->cipher_ctx_enc );
8832 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -04008833#endif
Paul Bakker84bbeb52014-07-01 14:53:22 +02008834
Hanno Becker92231322018-01-03 15:32:51 +00008835#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008836 mbedtls_md_init( &transform->md_ctx_enc );
8837 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +00008838#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008839}
8840
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008841void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008842{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008843 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008844}
8845
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008846static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008847{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008848 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00008849 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008850 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008851 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008852 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008853 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02008854 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008855
8856 /*
8857 * Either the pointers are now NULL or cleared properly and can be freed.
8858 * Now allocate missing structures.
8859 */
8860 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008861 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008862 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008863 }
Paul Bakker48916f92012-09-16 19:57:18 +00008864
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008865 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008866 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008867 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008868 }
Paul Bakker48916f92012-09-16 19:57:18 +00008869
Paul Bakker82788fb2014-10-20 13:59:19 +02008870 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008871 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008872 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008873 }
Paul Bakker48916f92012-09-16 19:57:18 +00008874
Andrzej Kurekf3844952020-10-16 23:03:01 +02008875#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
8876 /* If the buffers are too small - reallocate */
Andrzej Kurek79db2f12020-10-20 17:10:38 +02008877 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
8878 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurekf3844952020-10-16 23:03:01 +02008879#endif
8880
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008881 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00008882 if( ssl->handshake == NULL ||
8883 ssl->transform_negotiate == NULL ||
8884 ssl->session_negotiate == NULL )
8885 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02008886 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008887
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008888 mbedtls_free( ssl->handshake );
8889 mbedtls_free( ssl->transform_negotiate );
8890 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008891
8892 ssl->handshake = NULL;
8893 ssl->transform_negotiate = NULL;
8894 ssl->session_negotiate = NULL;
8895
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02008896 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00008897 }
8898
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008899 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008900 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Becker611a83b2018-01-03 14:27:32 +00008901 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02008902 ssl_handshake_params_init( ssl->handshake );
8903
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008904#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008905 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008906 {
8907 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008908
Hanno Becker2d9623f2019-06-13 12:07:05 +01008909 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008910 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
8911 else
8912 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
8913 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008914#endif
8915
Paul Bakker48916f92012-09-16 19:57:18 +00008916 return( 0 );
8917}
8918
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008919#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008920/* Dummy cookie callbacks for defaults */
8921static int ssl_cookie_write_dummy( void *ctx,
8922 unsigned char **p, unsigned char *end,
8923 const unsigned char *cli_id, size_t cli_id_len )
8924{
8925 ((void) ctx);
8926 ((void) p);
8927 ((void) end);
8928 ((void) cli_id);
8929 ((void) cli_id_len);
8930
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008931 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008932}
8933
8934static int ssl_cookie_check_dummy( void *ctx,
8935 const unsigned char *cookie, size_t cookie_len,
8936 const unsigned char *cli_id, size_t cli_id_len )
8937{
8938 ((void) ctx);
8939 ((void) cookie);
8940 ((void) cookie_len);
8941 ((void) cli_id);
8942 ((void) cli_id_len);
8943
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008944 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008945}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008946#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008947
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008948/* Once ssl->out_hdr as the address of the beginning of the
8949 * next outgoing record is set, deduce the other pointers.
8950 *
8951 * Note: For TLS, we save the implicit record sequence number
8952 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
8953 * and the caller has to make sure there's space for this.
8954 */
8955
8956static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
8957 mbedtls_ssl_transform *transform )
8958{
8959#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008960 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008961 {
8962 ssl->out_ctr = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008963#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01008964 ssl->out_cid = ssl->out_ctr + 8;
8965 ssl->out_len = ssl->out_cid;
8966 if( transform != NULL )
8967 ssl->out_len += transform->out_cid_len;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008968#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008969 ssl->out_len = ssl->out_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008970#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008971 ssl->out_iv = ssl->out_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008972 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008973 MBEDTLS_SSL_TRANSPORT_ELSE
8974#endif /* MBEDTLS_SSL_PROTO_DTLS */
8975#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008976 {
8977 ssl->out_ctr = ssl->out_hdr - 8;
8978 ssl->out_len = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008979#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01008980 ssl->out_cid = ssl->out_len;
8981#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008982 ssl->out_iv = ssl->out_hdr + 5;
8983 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008984#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008985
8986 /* Adjust out_msg to make space for explicit IV, if used. */
8987 if( transform != NULL &&
Hanno Becker7bcf2b52019-07-26 09:02:40 +01008988 mbedtls_ssl_ver_geq(
8989 mbedtls_ssl_get_minor_ver( ssl ),
8990 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008991 {
8992 ssl->out_msg = ssl->out_iv + transform->ivlen - transform->fixed_ivlen;
8993 }
8994 else
8995 ssl->out_msg = ssl->out_iv;
8996}
8997
8998/* Once ssl->in_hdr as the address of the beginning of the
8999 * next incoming record is set, deduce the other pointers.
9000 *
9001 * Note: For TLS, we save the implicit record sequence number
9002 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
9003 * and the caller has to make sure there's space for this.
9004 */
9005
Hanno Beckerf5970a02019-05-08 09:38:41 +01009006static void ssl_update_in_pointers( mbedtls_ssl_context *ssl )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009007{
Hanno Beckerf5970a02019-05-08 09:38:41 +01009008 /* This function sets the pointers to match the case
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009009 * of unprotected TLS/DTLS records, with ssl->in_msg
9010 * pointing to the beginning of the record content.
Hanno Beckerf5970a02019-05-08 09:38:41 +01009011 *
9012 * When decrypting a protected record, ssl->in_msg
9013 * will be shifted to point to the beginning of the
9014 * record plaintext.
9015 */
9016
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009017#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009018 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009019 {
Hanno Becker70e79282019-05-03 14:34:53 +01009020 /* This sets the header pointers to match records
9021 * without CID. When we receive a record containing
9022 * a CID, the fields are shifted accordingly in
9023 * ssl_parse_record_header(). */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009024 ssl->in_ctr = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009025#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01009026 ssl->in_cid = ssl->in_ctr + 8;
9027 ssl->in_len = ssl->in_cid; /* Default: no CID */
Hanno Beckera5a2b082019-05-15 14:03:01 +01009028#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01009029 ssl->in_len = ssl->in_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009030#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009031 ssl->in_msg = ssl->in_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009032 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009033 MBEDTLS_SSL_TRANSPORT_ELSE
9034#endif /* MBEDTLS_SSL_PROTO_DTLS */
9035#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009036 {
9037 ssl->in_ctr = ssl->in_hdr - 8;
9038 ssl->in_len = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009039#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01009040 ssl->in_cid = ssl->in_len;
9041#endif
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009042 ssl->in_msg = ssl->in_hdr + 5;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009043 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009044#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009045}
9046
Paul Bakker5121ce52009-01-03 21:22:43 +00009047/*
9048 * Initialize an SSL context
9049 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02009050void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
9051{
9052 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
9053}
9054
9055/*
9056 * Setup an SSL context
9057 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009058
9059static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl )
9060{
9061 /* Set the incoming and outgoing record pointers. */
9062#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009063 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009064 {
9065 ssl->out_hdr = ssl->out_buf;
9066 ssl->in_hdr = ssl->in_buf;
9067 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009068 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009069#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009070#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009071 {
9072 ssl->out_hdr = ssl->out_buf + 8;
9073 ssl->in_hdr = ssl->in_buf + 8;
9074 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009075#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009076
9077 /* Derive other internal pointers. */
9078 ssl_update_out_pointers( ssl, NULL /* no transform enabled */ );
Hanno Beckerf5970a02019-05-08 09:38:41 +01009079 ssl_update_in_pointers ( ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009080}
9081
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02009082int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02009083 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00009084{
Paul Bakker48916f92012-09-16 19:57:18 +00009085 int ret;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009086 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
9087 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00009088
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02009089 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00009090
Hanno Beckeref982d52019-07-23 15:56:18 +01009091#if defined(MBEDTLS_USE_TINYCRYPT)
9092 uECC_set_rng( &uecc_rng_wrapper );
9093#endif
9094
Paul Bakker62f2dee2012-09-28 07:31:51 +00009095 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01009096 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00009097 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02009098
9099 /* Set to NULL in case of an error condition */
9100 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02009101
Andrzej Kurekf3844952020-10-16 23:03:01 +02009102#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9103 ssl->in_buf_len = in_buf_len;
9104#endif
9105 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10009106 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009107 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02009108 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", in_buf_len) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02009109 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02009110 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10009111 }
9112
Andrzej Kurekf3844952020-10-16 23:03:01 +02009113#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9114 ssl->out_buf_len = out_buf_len;
9115#endif
9116
9117 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10009118 if( ssl->out_buf == NULL )
9119 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02009120 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", out_buf_len) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02009121 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02009122 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00009123 }
9124
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009125 ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02009126
Paul Bakker48916f92012-09-16 19:57:18 +00009127 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02009128 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00009129
Hanno Beckerc8f52992019-07-25 11:15:08 +01009130 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
Hanno Beckerf46e1ce2019-07-03 13:56:59 +01009131
Paul Bakker5121ce52009-01-03 21:22:43 +00009132 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02009133
9134error:
9135 mbedtls_free( ssl->in_buf );
9136 mbedtls_free( ssl->out_buf );
9137
9138 ssl->conf = NULL;
9139
Andrzej Kurekf3844952020-10-16 23:03:01 +02009140#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9141 ssl->in_buf_len = 0;
9142 ssl->out_buf_len = 0;
9143#endif
9144
k-stachowiaka47911c2018-07-04 17:41:58 +02009145 ssl->in_buf = NULL;
9146 ssl->out_buf = NULL;
9147
9148 ssl->in_hdr = NULL;
9149 ssl->in_ctr = NULL;
9150 ssl->in_len = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02009151 ssl->in_msg = NULL;
9152
9153 ssl->out_hdr = NULL;
9154 ssl->out_ctr = NULL;
9155 ssl->out_len = NULL;
9156 ssl->out_iv = NULL;
9157 ssl->out_msg = NULL;
9158
k-stachowiak9f7798e2018-07-31 16:52:32 +02009159 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00009160}
9161
9162/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00009163 * Reset an initialized and used SSL context for re-use while retaining
9164 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009165 *
9166 * If partial is non-zero, keep data in the input buffer and client ID.
9167 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00009168 */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009169static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00009170{
Paul Bakker48916f92012-09-16 19:57:18 +00009171 int ret;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009172#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9173 size_t in_buf_len = ssl->in_buf_len;
9174 size_t out_buf_len = ssl->out_buf_len;
9175#else
9176 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
9177 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
9178#endif
Paul Bakker48916f92012-09-16 19:57:18 +00009179
Hanno Becker7e772132018-08-10 12:38:21 +01009180#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
9181 !defined(MBEDTLS_SSL_SRV_C)
9182 ((void) partial);
9183#endif
9184
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009185 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009186
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009187 /* Cancel any possibly running timer */
9188 ssl_set_timer( ssl, 0 );
9189
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009190#if defined(MBEDTLS_SSL_RENEGOTIATION)
9191 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009192 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00009193
9194 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02009195 mbedtls_platform_memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
9196 mbedtls_platform_memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009197#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009198 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00009199
Paul Bakker7eb013f2011-10-06 12:37:39 +00009200 ssl->in_offt = NULL;
Hanno Beckerf29d4702018-08-10 11:31:15 +01009201 ssl_reset_in_out_pointers( ssl );
Paul Bakker7eb013f2011-10-06 12:37:39 +00009202
9203 ssl->in_msgtype = 0;
9204 ssl->in_msglen = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009205#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02009206 ssl->next_record_offset = 0;
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02009207 ssl->in_epoch = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02009208#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009209#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02009210 ssl_dtls_replay_reset( ssl );
9211#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00009212
9213 ssl->in_hslen = 0;
9214 ssl->nb_zero = 0;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01009215
9216 ssl->keep_current_message = 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00009217
9218 ssl->out_msgtype = 0;
9219 ssl->out_msglen = 0;
9220 ssl->out_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009221#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
9222 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009223 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009224#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00009225
Hanno Becker19859472018-08-06 09:40:20 +01009226 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
9227
Paul Bakker48916f92012-09-16 19:57:18 +00009228 ssl->transform_in = NULL;
9229 ssl->transform_out = NULL;
Paul Bakker7eb013f2011-10-06 12:37:39 +00009230
Hanno Becker78640902018-08-13 16:35:15 +01009231 ssl->session_in = NULL;
9232 ssl->session_out = NULL;
9233
Andrzej Kurekf3844952020-10-16 23:03:01 +02009234 mbedtls_platform_memset( ssl->out_buf, 0, out_buf_len );
Hanno Becker4ccbf062018-08-10 11:20:38 +01009235
9236#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009237 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01009238#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
9239 {
9240 ssl->in_left = 0;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009241 mbedtls_platform_memset( ssl->in_buf, 0, in_buf_len );
Hanno Becker4ccbf062018-08-10 11:20:38 +01009242 }
Paul Bakker05ef8352012-05-08 09:17:57 +00009243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009244#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
9245 if( mbedtls_ssl_hw_record_reset != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00009246 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009247 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
9248 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
Paul Bakker2770fbd2012-07-03 13:30:23 +00009249 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009250 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
9251 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00009252 }
Paul Bakker05ef8352012-05-08 09:17:57 +00009253 }
9254#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00009255
Paul Bakker48916f92012-09-16 19:57:18 +00009256 if( ssl->transform )
Paul Bakker2770fbd2012-07-03 13:30:23 +00009257 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009258 mbedtls_ssl_transform_free( ssl->transform );
9259 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00009260 ssl->transform = NULL;
Paul Bakker2770fbd2012-07-03 13:30:23 +00009261 }
Paul Bakker48916f92012-09-16 19:57:18 +00009262
Paul Bakkerc0463502013-02-14 11:19:38 +01009263 if( ssl->session )
9264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009265 mbedtls_ssl_session_free( ssl->session );
9266 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01009267 ssl->session = NULL;
9268 }
9269
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009270#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009271 ssl->alpn_chosen = NULL;
9272#endif
9273
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02009274#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01009275#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009276 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01009277#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009278 {
9279 mbedtls_free( ssl->cli_id );
9280 ssl->cli_id = NULL;
9281 ssl->cli_id_len = 0;
9282 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02009283#endif
9284
Paul Bakker48916f92012-09-16 19:57:18 +00009285 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
9286 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00009287
9288 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00009289}
9290
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02009291/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009292 * Reset an initialized and used SSL context for re-use while retaining
9293 * all application-set variables, function pointers and data.
9294 */
9295int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
9296{
9297 return( ssl_session_reset_int( ssl, 0 ) );
9298}
9299
9300/*
Paul Bakker5121ce52009-01-03 21:22:43 +00009301 * SSL set accessors
9302 */
Hanno Becker2d9623f2019-06-13 12:07:05 +01009303#if !defined(MBEDTLS_SSL_CONF_ENDPOINT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009304void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00009305{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009306 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00009307}
Hanno Becker2d9623f2019-06-13 12:07:05 +01009308#endif /* MBEDTLS_SSL_CONF_ENDPOINT */
Paul Bakker5121ce52009-01-03 21:22:43 +00009309
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009310void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01009311{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009312 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01009313}
9314
Hanno Becker7f376f42019-06-12 16:20:48 +01009315#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
9316 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009317void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009318{
Hanno Becker7f376f42019-06-12 16:20:48 +01009319 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009320}
Hanno Becker7f376f42019-06-12 16:20:48 +01009321#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY && !MBEDTLS_SSL_CONF_ANTI_REPLAY */
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009322
Hanno Beckerde671542019-06-12 16:30:46 +01009323#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
9324 !defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
9325void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf,
9326 unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009327{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009328 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009329}
Hanno Beckerde671542019-06-12 16:30:46 +01009330#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT && !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009331
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009332#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01009333
Hanno Becker1841b0a2018-08-24 11:13:57 +01009334void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
9335 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01009336{
9337 ssl->disable_datagram_packing = !allow_packing;
9338}
9339
Hanno Becker1f835fa2019-06-13 10:14:59 +01009340#if !( defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX) && \
9341 defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN) )
Hanno Becker04da1892018-08-14 13:22:10 +01009342void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
9343 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009344{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009345 conf->hs_timeout_min = min;
9346 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009347}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009348#else /* !( MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
9349 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX ) */
9350void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
9351 uint32_t min, uint32_t max )
9352{
9353 ((void) conf);
9354 ((void) min);
9355 ((void) max);
9356}
9357#endif /* MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
9358 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
9359
9360#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009361
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009362void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00009363{
Hanno Beckeracd4fc02019-06-12 16:40:50 +01009364#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
9365 conf->authmode = authmode;
9366#else
9367 ((void) conf);
9368 ((void) authmode);
9369#endif /* MBEDTLS_SSL_CONF_AUTHMODE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009370}
9371
Hanno Becker9ec3fe02019-07-01 17:36:12 +01009372#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
9373 !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009374void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02009375 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009376 void *p_vrfy )
9377{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009378 conf->f_vrfy = f_vrfy;
9379 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009380}
Hanno Becker9ec3fe02019-07-01 17:36:12 +01009381#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009382
Hanno Beckerece325c2019-06-13 15:39:27 +01009383#if !defined(MBEDTLS_SSL_CONF_RNG)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009384void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00009385 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00009386 void *p_rng )
9387{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01009388 conf->f_rng = f_rng;
9389 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00009390}
Hanno Beckerece325c2019-06-13 15:39:27 +01009391#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00009392
Hanno Becker14a4a442019-07-02 17:00:34 +01009393#if defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009394void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02009395 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00009396 void *p_dbg )
9397{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009398 conf->f_dbg = f_dbg;
9399 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00009400}
Hanno Becker14a4a442019-07-02 17:00:34 +01009401#endif /* MBEDTLS_DEBUG_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00009402
Hanno Beckera58a8962019-06-13 16:11:15 +01009403#if !defined(MBEDTLS_SSL_CONF_RECV) && \
9404 !defined(MBEDTLS_SSL_CONF_SEND) && \
9405 !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009406void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009407 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00009408 mbedtls_ssl_send_t *f_send,
9409 mbedtls_ssl_recv_t *f_recv,
9410 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009411{
Hanno Beckera58a8962019-06-13 16:11:15 +01009412 ssl->p_bio = p_bio;
9413 ssl->f_send = f_send;
9414 ssl->f_recv = f_recv;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009415 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009416}
Hanno Beckera58a8962019-06-13 16:11:15 +01009417#else
9418void mbedtls_ssl_set_bio_ctx( mbedtls_ssl_context *ssl,
9419 void *p_bio )
9420{
9421 ssl->p_bio = p_bio;
9422}
9423#endif
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009424
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02009425#if defined(MBEDTLS_SSL_PROTO_DTLS)
9426void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
9427{
9428 ssl->mtu = mtu;
9429}
9430#endif
9431
Hanno Becker1f835fa2019-06-13 10:14:59 +01009432#if !defined(MBEDTLS_SSL_CONF_READ_TIMEOUT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009433void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009434{
9435 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009436}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009437#endif /* MBEDTLS_SSL_CONF_READ_TIMEOUT */
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009438
Hanno Becker0ae6b242019-06-13 16:45:36 +01009439#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && \
9440 !defined(MBEDTLS_SSL_CONF_GET_TIMER)
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009441void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
9442 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00009443 mbedtls_ssl_set_timer_t *f_set_timer,
9444 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009445{
9446 ssl->p_timer = p_timer;
9447 ssl->f_set_timer = f_set_timer;
9448 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009449 /* Make sure we start with no timer running */
9450 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009451}
Hanno Becker0ae6b242019-06-13 16:45:36 +01009452#else
9453void mbedtls_ssl_set_timer_cb_ctx( mbedtls_ssl_context *ssl,
9454 void *p_timer )
9455{
9456 ssl->p_timer = p_timer;
9457 /* Make sure we start with no timer running */
9458 ssl_set_timer( ssl, 0 );
9459}
9460#endif
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009461
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009462#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009463void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009464 void *p_cache,
9465 int (*f_get_cache)(void *, mbedtls_ssl_session *),
9466 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
Paul Bakker5121ce52009-01-03 21:22:43 +00009467{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009468 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009469 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009470 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00009471}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009472#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009473
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009474#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009475int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00009476{
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009477 int ret;
9478
9479 if( ssl == NULL ||
9480 session == NULL ||
9481 ssl->session_negotiate == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +01009482 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009483 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009484 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009485 }
9486
Hanno Becker58fccf22019-02-06 14:30:46 +00009487 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
9488 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009489 return( ret );
9490
Jarno Lamsa8d09e572019-12-19 15:20:19 +02009491 ssl->handshake->resume = MBEDTLS_SSL_FI_FLAG_SET;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009492
9493 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00009494}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009495#endif /* MBEDTLS_SSL_CLI_C && !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009496
Hanno Becker73f4cb12019-06-27 13:51:07 +01009497#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009498void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009499 const int *ciphersuites )
Paul Bakker5121ce52009-01-03 21:22:43 +00009500{
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009501 conf->ciphersuite_list[0] = ciphersuites;
9502 conf->ciphersuite_list[1] = ciphersuites;
9503 conf->ciphersuite_list[2] = ciphersuites;
9504 conf->ciphersuite_list[3] = ciphersuites;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009505}
9506
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009507void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02009508 const int *ciphersuites,
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009509 int major, int minor )
9510{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009511 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009512 return;
9513
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009514 if( mbedtls_ssl_ver_lt( minor, MBEDTLS_SSL_MINOR_VERSION_0 ) ||
9515 mbedtls_ssl_ver_gt( minor, MBEDTLS_SSL_MINOR_VERSION_3 ) )
9516 {
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009517 return;
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009518 }
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009519
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009520 conf->ciphersuite_list[mbedtls_ssl_minor_ver_index( minor )] =
9521 ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00009522}
Hanno Becker73f4cb12019-06-27 13:51:07 +01009523#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009524
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009525#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009526void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01009527 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009528{
9529 conf->cert_profile = profile;
9530}
9531
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009532/* Append a new keycert entry to a (possibly empty) list */
9533static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
9534 mbedtls_x509_crt *cert,
9535 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009536{
niisato8ee24222018-06-25 19:05:48 +09009537 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009538
niisato8ee24222018-06-25 19:05:48 +09009539 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
9540 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009541 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009542
niisato8ee24222018-06-25 19:05:48 +09009543 new_cert->cert = cert;
9544 new_cert->key = key;
9545 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009546
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009547 /* Update head is the list was null, else add to the end */
9548 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01009549 {
niisato8ee24222018-06-25 19:05:48 +09009550 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01009551 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009552 else
9553 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009554 mbedtls_ssl_key_cert *cur = *head;
9555 while( cur->next != NULL )
9556 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09009557 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009558 }
9559
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009560 return( 0 );
9561}
9562
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009563int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009564 mbedtls_x509_crt *own_cert,
9565 mbedtls_pk_context *pk_key )
9566{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02009567 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009568}
9569
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009570void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009571 mbedtls_x509_crt *ca_chain,
9572 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009573{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009574 conf->ca_chain = ca_chain;
9575 conf->ca_crl = ca_crl;
Paul Bakker5121ce52009-01-03 21:22:43 +00009576}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009577#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00009578
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009579#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
9580int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
9581 mbedtls_x509_crt *own_cert,
9582 mbedtls_pk_context *pk_key )
9583{
9584 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
9585 own_cert, pk_key ) );
9586}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02009587
9588void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
9589 mbedtls_x509_crt *ca_chain,
9590 mbedtls_x509_crl *ca_crl )
9591{
9592 ssl->handshake->sni_ca_chain = ca_chain;
9593 ssl->handshake->sni_ca_crl = ca_crl;
9594}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02009595
9596void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
9597 int authmode )
9598{
9599 ssl->handshake->sni_authmode = authmode;
9600}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009601#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9602
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009603#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009604/*
9605 * Set EC J-PAKE password for current handshake
9606 */
9607int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
9608 const unsigned char *pw,
9609 size_t pw_len )
9610{
9611 mbedtls_ecjpake_role role;
9612
Janos Follath8eb64132016-06-03 15:40:57 +01009613 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009614 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9615
Hanno Becker2d9623f2019-06-13 12:07:05 +01009616 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009617 role = MBEDTLS_ECJPAKE_SERVER;
9618 else
9619 role = MBEDTLS_ECJPAKE_CLIENT;
9620
9621 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
9622 role,
9623 MBEDTLS_MD_SHA256,
9624 MBEDTLS_ECP_DP_SECP256R1,
9625 pw, pw_len ) );
9626}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009627#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009628
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009629#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009630int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009631 const unsigned char *psk, size_t psk_len,
9632 const unsigned char *psk_identity, size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009633{
Paul Bakker6db455e2013-09-18 17:29:31 +02009634 if( psk == NULL || psk_identity == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009635 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker6db455e2013-09-18 17:29:31 +02009636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009637 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9638 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01009639
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009640 /* Identity len will be encoded on two bytes */
9641 if( ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10009642 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009643 {
9644 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9645 }
9646
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009647 if( conf->psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02009648 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009649 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009650
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009651 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009652 conf->psk = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009653 conf->psk_len = 0;
9654 }
9655 if( conf->psk_identity != NULL )
9656 {
9657 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009658 conf->psk_identity = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009659 conf->psk_identity_len = 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02009660 }
9661
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009662 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
9663 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
Mansour Moufidf81088b2015-02-17 13:10:21 -05009664 {
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009665 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009666 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009667 conf->psk = NULL;
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009668 conf->psk_identity = NULL;
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009669 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Mansour Moufidf81088b2015-02-17 13:10:21 -05009670 }
Paul Bakker6db455e2013-09-18 17:29:31 +02009671
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009672 conf->psk_len = psk_len;
9673 conf->psk_identity_len = psk_identity_len;
Paul Bakker6db455e2013-09-18 17:29:31 +02009674
Teppo Järvelin91d79382019-10-02 09:09:31 +03009675 mbedtls_platform_memcpy( conf->psk, psk, conf->psk_len );
9676 mbedtls_platform_memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker6db455e2013-09-18 17:29:31 +02009677
9678 return( 0 );
9679}
9680
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009681int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
9682 const unsigned char *psk, size_t psk_len )
9683{
9684 if( psk == NULL || ssl->handshake == NULL )
9685 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9686
9687 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9688 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9689
9690 if( ssl->handshake->psk != NULL )
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009691 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009692 mbedtls_platform_zeroize( ssl->handshake->psk,
9693 ssl->handshake->psk_len );
Simon Butcher5b8d1d62015-10-04 22:06:51 +01009694 mbedtls_free( ssl->handshake->psk );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009695 ssl->handshake->psk_len = 0;
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009696 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009697
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009698 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009699 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009700
9701 ssl->handshake->psk_len = psk_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03009702 mbedtls_platform_memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009703
9704 return( 0 );
9705}
9706
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009707void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009708 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02009709 size_t),
9710 void *p_psk )
9711{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009712 conf->f_psk = f_psk;
9713 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009714}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009715#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00009716
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009717#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker470a8c42017-10-04 15:28:46 +01009718
9719#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009720int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
Paul Bakker5121ce52009-01-03 21:22:43 +00009721{
9722 int ret;
9723
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009724 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
9725 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
9726 {
9727 mbedtls_mpi_free( &conf->dhm_P );
9728 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker5121ce52009-01-03 21:22:43 +00009729 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009730 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009731
9732 return( 0 );
9733}
Hanno Becker470a8c42017-10-04 15:28:46 +01009734#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker5121ce52009-01-03 21:22:43 +00009735
Hanno Beckera90658f2017-10-04 15:29:08 +01009736int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
9737 const unsigned char *dhm_P, size_t P_len,
9738 const unsigned char *dhm_G, size_t G_len )
9739{
9740 int ret;
9741
9742 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
9743 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
9744 {
9745 mbedtls_mpi_free( &conf->dhm_P );
9746 mbedtls_mpi_free( &conf->dhm_G );
9747 return( ret );
9748 }
9749
9750 return( 0 );
9751}
Paul Bakker5121ce52009-01-03 21:22:43 +00009752
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009753int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00009754{
9755 int ret;
9756
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009757 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
9758 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
9759 {
9760 mbedtls_mpi_free( &conf->dhm_P );
9761 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00009762 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009763 }
Paul Bakker1b57b062011-01-06 15:48:19 +00009764
9765 return( 0 );
9766}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009767#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00009768
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02009769#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
9770/*
9771 * Set the minimum length for Diffie-Hellman parameters
9772 */
9773void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
9774 unsigned int bitlen )
9775{
9776 conf->dhm_min_bitlen = bitlen;
9777}
9778#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
9779
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009780#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009781/*
9782 * Set allowed/preferred hashes for handshake signatures
9783 */
9784void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
9785 const int *hashes )
9786{
Hanno Becker56595f42019-06-19 16:31:38 +01009787#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009788 conf->sig_hashes = hashes;
Hanno Becker56595f42019-06-19 16:31:38 +01009789#else
9790 ((void) conf);
9791 ((void) hashes);
9792#endif /* MBEDTLS_SSL_CONF_SINGLE_SIG_HASH */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009793}
Hanno Becker947194e2017-04-07 13:25:49 +01009794#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009795
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02009796#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +01009797#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009798/*
9799 * Set the allowed elliptic curves
9800 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009801void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009802 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009803{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009804 conf->curve_list = curve_list;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009805}
Hanno Beckerc1096e72019-06-19 12:30:41 +01009806#endif /* MBEDTLS_SSL_CONF_SINGLE_EC */
Hanno Becker947194e2017-04-07 13:25:49 +01009807#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009808
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009809#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009810int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00009811{
Hanno Becker947194e2017-04-07 13:25:49 +01009812 /* Initialize to suppress unnecessary compiler warning */
9813 size_t hostname_len = 0;
9814
9815 /* Check if new hostname is valid before
9816 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01009817 if( hostname != NULL )
9818 {
9819 hostname_len = strlen( hostname );
9820
9821 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
9822 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9823 }
9824
9825 /* Now it's clear that we will overwrite the old hostname,
9826 * so we can free it safely */
9827
9828 if( ssl->hostname != NULL )
9829 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009830 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01009831 mbedtls_free( ssl->hostname );
9832 }
9833
9834 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01009835
Paul Bakker5121ce52009-01-03 21:22:43 +00009836 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01009837 {
9838 ssl->hostname = NULL;
9839 }
9840 else
9841 {
9842 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01009843 if( ssl->hostname == NULL )
9844 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009845
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03009846 /* Not using more secure mbedtls_platform_memcpy as hostname is public in initial handshake */
9847 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009848
Hanno Becker947194e2017-04-07 13:25:49 +01009849 ssl->hostname[hostname_len] = '\0';
9850 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009851
9852 return( 0 );
9853}
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009854#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009855
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009856#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009857void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009858 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00009859 const unsigned char *, size_t),
9860 void *p_sni )
9861{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009862 conf->f_sni = f_sni;
9863 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00009864}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009865#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00009866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009867#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009868int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009869{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009870 size_t cur_len, tot_len;
9871 const char **p;
9872
9873 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08009874 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
9875 * MUST NOT be truncated."
9876 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009877 */
9878 tot_len = 0;
9879 for( p = protos; *p != NULL; p++ )
9880 {
9881 cur_len = strlen( *p );
9882 tot_len += cur_len;
9883
9884 if( cur_len == 0 || cur_len > 255 || tot_len > 65535 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009885 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009886 }
9887
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009888 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009889
9890 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009891}
9892
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009893const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009894{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02009895 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009896}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009897#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009898
Hanno Becker33b9b252019-07-05 11:23:25 +01009899#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || \
9900 !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
9901void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf,
9902 int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00009903{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009904 conf->max_major_ver = major;
9905 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00009906}
Hanno Becker33b9b252019-07-05 11:23:25 +01009907#endif /* MBEDTLS_SSL_CONF_MAX_MINOR_VER ||
9908 MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
Paul Bakker490ecc82011-10-06 13:04:09 +00009909
Hanno Becker33b9b252019-07-05 11:23:25 +01009910#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || \
9911 !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
9912void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf,
9913 int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00009914{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009915 conf->min_major_ver = major;
9916 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00009917}
Hanno Becker33b9b252019-07-05 11:23:25 +01009918#endif /* MBEDTLS_SSL_CONF_MIN_MINOR_VER ||
9919 MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
Paul Bakker1d29fb52012-09-28 13:28:45 +00009920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009921#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009922void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009923{
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01009924 conf->fallback = fallback;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009925}
9926#endif
9927
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +01009928#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +01009929void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
9930 char cert_req_ca_list )
9931{
9932 conf->cert_req_ca_list = cert_req_ca_list;
9933}
9934#endif
9935
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009936#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009937void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009938{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009939 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009940}
9941#endif
9942
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009943#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckerf765ce62019-06-21 13:17:14 +01009944#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009945void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009946{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009947 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009948}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009949#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
9950#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009951void mbedtls_ssl_conf_extended_master_secret_enforce( mbedtls_ssl_config *conf,
Jarno Lamsa842be162019-06-10 15:05:33 +03009952 char ems_enf )
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009953{
9954 conf->enforce_extended_master_secret = ems_enf;
9955}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009956#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Hanno Beckeraabbb582019-06-11 13:43:27 +01009957#endif /* !MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009958
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009959#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009960void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009961{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009962 conf->arc4_disabled = arc4;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009963}
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009964#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009965
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009966#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009967int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009968{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009969 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10009970 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009971 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009972 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009973 }
9974
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01009975 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009976
9977 return( 0 );
9978}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009979#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009980
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009981#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009982void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009983{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009984 conf->trunc_hmac = truncate;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009985}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009986#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009987
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009988#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009989void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009990{
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01009991 conf->cbc_record_splitting = split;
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009992}
9993#endif
9994
Hanno Beckerb0b2b672019-06-12 16:58:10 +01009995#if !defined(MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009996void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00009997{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009998 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00009999}
Hanno Beckerb0b2b672019-06-12 16:58:10 +010010000#endif /* !MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000010001
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010002#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010003void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +010010004{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010005 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +010010006}
10007
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010008void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020010009{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010010 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020010011}
10012
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010013void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +010010014 const unsigned char period[8] )
10015{
Teppo Järvelin91d79382019-10-02 09:09:31 +030010016 mbedtls_platform_memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +010010017}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010018#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000010019
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010020#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010021#if defined(MBEDTLS_SSL_CLI_C)
10022void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010023{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +010010024 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010025}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010026#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +020010027
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010028#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +020010029void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
10030 mbedtls_ssl_ticket_write_t *f_ticket_write,
10031 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
10032 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +020010033{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +020010034 conf->f_ticket_write = f_ticket_write;
10035 conf->f_ticket_parse = f_ticket_parse;
10036 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +020010037}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010038#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010039#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010040
Robert Cragie4feb7ae2015-10-02 13:33:37 +010010041#if defined(MBEDTLS_SSL_EXPORT_KEYS)
10042void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
10043 mbedtls_ssl_export_keys_t *f_export_keys,
10044 void *p_export_keys )
10045{
10046 conf->f_export_keys = f_export_keys;
10047 conf->p_export_keys = p_export_keys;
10048}
10049#endif
10050
Gilles Peskineb74a1c72018-04-24 13:09:22 +020010051#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010052void mbedtls_ssl_conf_async_private_cb(
10053 mbedtls_ssl_config *conf,
10054 mbedtls_ssl_async_sign_t *f_async_sign,
10055 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
10056 mbedtls_ssl_async_resume_t *f_async_resume,
10057 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010058 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010059{
10060 conf->f_async_sign_start = f_async_sign;
10061 conf->f_async_decrypt_start = f_async_decrypt;
10062 conf->f_async_resume = f_async_resume;
10063 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010064 conf->p_async_config_data = async_config_data;
10065}
10066
Gilles Peskine8f97af72018-04-26 11:46:10 +020010067void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
10068{
10069 return( conf->p_async_config_data );
10070}
10071
Gilles Peskine1febfef2018-04-30 11:54:39 +020010072void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010073{
10074 if( ssl->handshake == NULL )
10075 return( NULL );
10076 else
10077 return( ssl->handshake->user_async_ctx );
10078}
10079
Gilles Peskine1febfef2018-04-30 11:54:39 +020010080void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010081 void *ctx )
10082{
10083 if( ssl->handshake != NULL )
10084 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010085}
Gilles Peskineb74a1c72018-04-24 13:09:22 +020010086#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010087
Paul Bakker5121ce52009-01-03 21:22:43 +000010088/*
10089 * SSL get accessors
10090 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010091size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010092{
10093 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
10094}
10095
Hanno Becker8b170a02017-10-10 11:51:19 +010010096int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
10097{
10098 /*
10099 * Case A: We're currently holding back
10100 * a message for further processing.
10101 */
10102
10103 if( ssl->keep_current_message == 1 )
10104 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010105 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010106 return( 1 );
10107 }
10108
10109 /*
10110 * Case B: Further records are pending in the current datagram.
10111 */
10112
10113#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010114 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker8b170a02017-10-10 11:51:19 +010010115 ssl->in_left > ssl->next_record_offset )
10116 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010117 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010118 return( 1 );
10119 }
10120#endif /* MBEDTLS_SSL_PROTO_DTLS */
10121
10122 /*
10123 * Case C: A handshake message is being processed.
10124 */
10125
Hanno Becker8b170a02017-10-10 11:51:19 +010010126 if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
10127 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010128 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010129 return( 1 );
10130 }
10131
10132 /*
10133 * Case D: An application data message is being processed
10134 */
10135 if( ssl->in_offt != NULL )
10136 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010137 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010138 return( 1 );
10139 }
10140
10141 /*
10142 * In all other cases, the rest of the message can be dropped.
Hanno Beckerc573ac32018-08-28 17:15:25 +010010143 * As in ssl_get_next_record, this needs to be adapted if
Hanno Becker8b170a02017-10-10 11:51:19 +010010144 * we implement support for multiple alerts in single records.
10145 */
10146
10147 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
10148 return( 0 );
10149}
10150
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020010151uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010152{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +000010153 if( ssl->session != NULL )
10154 return( ssl->session->verify_result );
10155
10156 if( ssl->session_negotiate != NULL )
10157 return( ssl->session_negotiate->verify_result );
10158
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +020010159 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +000010160}
10161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010162const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +000010163{
Hanno Beckere02758c2019-06-26 15:31:31 +010010164 int suite;
10165
Paul Bakker926c8e42013-03-06 10:23:34 +010010166 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010167 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +010010168
Hanno Beckere02758c2019-06-26 15:31:31 +010010169 suite = mbedtls_ssl_session_get_ciphersuite( ssl->session );
10170 return( mbedtls_ssl_get_ciphersuite_name( suite ) );
Paul Bakker72f62662011-01-16 21:27:44 +000010171}
10172
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010173const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +000010174{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010175#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010176 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010177 {
Hanno Becker2881d802019-05-22 14:44:53 +010010178 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010179 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010180 case MBEDTLS_SSL_MINOR_VERSION_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010181 return( "DTLSv1.0" );
10182
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010183 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010184 return( "DTLSv1.2" );
10185
10186 default:
10187 return( "unknown (DTLS)" );
10188 }
10189 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010190 MBEDTLS_SSL_TRANSPORT_ELSE
10191#endif /* MBEDTLS_SSL_PROTO_DTLS */
10192#if defined(MBEDTLS_SSL_PROTO_TLS)
Paul Bakker43ca69c2011-01-15 17:35:19 +000010193 {
Hanno Becker2881d802019-05-22 14:44:53 +010010194 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010195 {
10196 case MBEDTLS_SSL_MINOR_VERSION_0:
10197 return( "SSLv3.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010198
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010199 case MBEDTLS_SSL_MINOR_VERSION_1:
10200 return( "TLSv1.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010201
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010202 case MBEDTLS_SSL_MINOR_VERSION_2:
10203 return( "TLSv1.1" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010204
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010205 case MBEDTLS_SSL_MINOR_VERSION_3:
10206 return( "TLSv1.2" );
Paul Bakker1ef83d62012-04-11 12:09:53 +000010207
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010208 default:
10209 return( "unknown" );
10210 }
Paul Bakker43ca69c2011-01-15 17:35:19 +000010211 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010212#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker43ca69c2011-01-15 17:35:19 +000010213}
10214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010215int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010216{
Hanno Becker3136ede2018-08-17 15:28:19 +010010217 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010218 const mbedtls_ssl_transform *transform = ssl->transform_out;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010219
Hanno Becker43395762019-05-03 14:46:38 +010010220 size_t out_hdr_len = mbedtls_ssl_out_hdr_len( ssl );
10221
Hanno Becker78640902018-08-13 16:35:15 +010010222 if( transform == NULL )
Hanno Becker43395762019-05-03 14:46:38 +010010223 return( (int) out_hdr_len );
Hanno Becker78640902018-08-13 16:35:15 +010010224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010225#if defined(MBEDTLS_ZLIB_SUPPORT)
10226 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
10227 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010228#endif
Andrzej Kurek11750442020-09-17 07:12:06 -040010229#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
10230 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx ) )
10231#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010232 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Andrzej Kurek11750442020-09-17 07:12:06 -040010233#endif
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010234 {
Hanno Beckera9d5c452019-07-25 16:47:12 +010010235#if defined(MBEDTLS_GCM_C) || \
10236 defined(MBEDTLS_CCM_C) || \
10237 defined(MBEDTLS_CHACHAPOLY_C)
10238#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010239 case MBEDTLS_MODE_GCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010240#endif
10241#if defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010242 case MBEDTLS_MODE_CCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010243#endif
10244#if defined(MBEDTLS_CHACHAPOLY_C)
Hanno Becker5b559ac2018-08-03 09:40:07 +010010245 case MBEDTLS_MODE_CHACHAPOLY:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010246#endif
10247 transform_expansion =
10248 transform->ivlen - transform->fixed_ivlen + transform->taglen;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010249 break;
10250
Hanno Beckera9d5c452019-07-25 16:47:12 +010010251#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C ||
10252 MBEDTLS_CHACHAPOLY_C */
10253
10254#if defined(MBEDTLS_CIPHER_MODE_STREAM)
10255 case MBEDTLS_MODE_STREAM:
10256 transform_expansion = transform->maclen;
10257 break;
10258#endif /* MBEDTLS_CIPHER_MODE_STREAM */
10259
10260#if defined(MBEDTLS_CIPHER_MODE_CBC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010261 case MBEDTLS_MODE_CBC:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010262 {
10263 size_t block_size;
Andrzej Kurek11750442020-09-17 07:12:06 -040010264#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
10265 block_size = mbedtls_cipher_get_block_size(
10266 &transform->cipher_ctx );
10267#else
Hanno Becker5b559ac2018-08-03 09:40:07 +010010268 block_size = mbedtls_cipher_get_block_size(
10269 &transform->cipher_ctx_enc );
Andrzej Kurek11750442020-09-17 07:12:06 -040010270#endif
Hanno Becker3136ede2018-08-17 15:28:19 +010010271 /* Expansion due to the addition of the MAC. */
10272 transform_expansion += transform->maclen;
10273
10274 /* Expansion due to the addition of CBC padding;
10275 * Theoretically up to 256 bytes, but we never use
10276 * more than the block size of the underlying cipher. */
10277 transform_expansion += block_size;
10278
10279 /* For TLS 1.1 or higher, an explicit IV is added
10280 * after the record header. */
Hanno Becker5b559ac2018-08-03 09:40:07 +010010281#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010010282 if( mbedtls_ssl_ver_geq(
10283 mbedtls_ssl_get_minor_ver( ssl ),
10284 MBEDTLS_SSL_MINOR_VERSION_2 ) )
10285 {
Hanno Becker3136ede2018-08-17 15:28:19 +010010286 transform_expansion += block_size;
Hanno Becker7bcf2b52019-07-26 09:02:40 +010010287 }
Hanno Becker5b559ac2018-08-03 09:40:07 +010010288#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker3136ede2018-08-17 15:28:19 +010010289
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010290 break;
Hanno Beckera9d5c452019-07-25 16:47:12 +010010291 }
10292#endif /* MBEDTLS_CIPHER_MODE_CBC */
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010293
10294 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020010295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010296 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010297 }
10298
Hanno Beckera5a2b082019-05-15 14:03:01 +010010299#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckeradd01902019-05-08 15:40:11 +010010300 if( transform->out_cid_len != 0 )
10301 transform_expansion += MBEDTLS_SSL_MAX_CID_EXPANSION;
Hanno Beckera5a2b082019-05-15 14:03:01 +010010302#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckeradd01902019-05-08 15:40:11 +010010303
Hanno Becker43395762019-05-03 14:46:38 +010010304 return( (int)( out_hdr_len + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010305}
10306
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010307#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +020010308size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
10309{
10310 size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
10311 size_t read_mfl;
10312
10313 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
10314 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
10315 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
10316 {
10317 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
10318 }
10319
10320 /* Check if a smaller max length was negotiated */
10321 if( ssl->session_out != NULL )
10322 {
10323 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
10324 if( read_mfl < max_len )
10325 {
10326 max_len = read_mfl;
10327 }
10328 }
10329
10330 // During a handshake, use the value being negotiated
10331 if( ssl->session_negotiate != NULL )
10332 {
10333 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
10334 if( read_mfl < max_len )
10335 {
10336 max_len = read_mfl;
10337 }
10338 }
10339
10340 return( max_len );
10341}
10342
10343size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010344{
10345 size_t max_len;
10346
10347 /*
10348 * Assume mfl_code is correct since it was checked when set
10349 */
Angus Grattond8213d02016-05-25 20:56:48 +100010350 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010351
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +020010352 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010353 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +100010354 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010355 {
Angus Grattond8213d02016-05-25 20:56:48 +100010356 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010357 }
10358
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +020010359 /* During a handshake, use the value being negotiated */
10360 if( ssl->session_negotiate != NULL &&
10361 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
10362 {
10363 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
10364 }
10365
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010366 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010367}
Andrzej Kurekf3844952020-10-16 23:03:01 +020010368
10369#if !defined(MBEDTLS_DEPRECATED_REMOVED)
10370size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
10371{
10372 return mbedtls_ssl_get_output_max_frag_len( ssl );
10373}
10374#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010375#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10376
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010377#if defined(MBEDTLS_SSL_PROTO_DTLS)
10378static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
10379{
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010380 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
Hanno Becker2d9623f2019-06-13 12:07:05 +010010381 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT &&
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010382 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
10383 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010384 return( 0 );
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010385
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010386 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
10387 return( ssl->mtu );
10388
10389 if( ssl->mtu == 0 )
10390 return( ssl->handshake->mtu );
10391
10392 return( ssl->mtu < ssl->handshake->mtu ?
10393 ssl->mtu : ssl->handshake->mtu );
10394}
10395#endif /* MBEDTLS_SSL_PROTO_DTLS */
10396
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010397int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
10398{
10399 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
10400
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +020010401#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
10402 !defined(MBEDTLS_SSL_PROTO_DTLS)
10403 (void) ssl;
10404#endif
10405
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010406#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +020010407 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010408
10409 if( max_len > mfl )
10410 max_len = mfl;
10411#endif
10412
10413#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010414 if( ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010415 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010416 const size_t mtu = ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010417 const int ret = mbedtls_ssl_get_record_expansion( ssl );
10418 const size_t overhead = (size_t) ret;
10419
10420 if( ret < 0 )
10421 return( ret );
10422
10423 if( mtu <= overhead )
10424 {
10425 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
10426 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
10427 }
10428
10429 if( max_len > mtu - overhead )
10430 max_len = mtu - overhead;
10431 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010432#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010433
Hanno Becker0defedb2018-08-10 12:35:02 +010010434#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
10435 !defined(MBEDTLS_SSL_PROTO_DTLS)
10436 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010437#endif
10438
10439 return( (int) max_len );
10440}
10441
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010442#if defined(MBEDTLS_X509_CRT_PARSE_C)
10443const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +000010444{
10445 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010446 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +000010447
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010448#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010449 return( ssl->session->peer_cert );
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010450#else
10451 return( NULL );
10452#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010453}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010454#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010455
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010456#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker933b9fc2019-02-05 11:42:30 +000010457int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
10458 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010459{
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010460 if( ssl == NULL ||
10461 dst == NULL ||
10462 ssl->session == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +010010463 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010464 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010465 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010466 }
10467
Hanno Becker58fccf22019-02-06 14:30:46 +000010468 return( mbedtls_ssl_session_copy( dst, ssl->session ) );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010469}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010470#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010471
Manuel Pégourié-Gonnard37a53242019-05-20 11:12:28 +020010472const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl )
10473{
10474 if( ssl == NULL )
10475 return( NULL );
10476
10477 return( ssl->session );
10478}
10479
Paul Bakker5121ce52009-01-03 21:22:43 +000010480/*
Hanno Beckerb5352f02019-05-16 12:39:07 +010010481 * Define ticket header determining Mbed TLS version
10482 * and structure of the ticket.
10483 */
10484
Hanno Becker41527622019-05-16 12:50:45 +010010485/*
Hanno Becker26829e92019-05-28 14:30:45 +010010486 * Define bitflag determining compile-time settings influencing
10487 * structure of serialized SSL sessions.
Hanno Becker41527622019-05-16 12:50:45 +010010488 */
10489
Hanno Becker26829e92019-05-28 14:30:45 +010010490#if defined(MBEDTLS_HAVE_TIME)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010491#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker26829e92019-05-28 14:30:45 +010010492#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010493#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker41527622019-05-16 12:50:45 +010010494#endif /* MBEDTLS_HAVE_TIME */
10495
10496#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010497#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker41527622019-05-16 12:50:45 +010010498#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010499#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker41527622019-05-16 12:50:45 +010010500#endif /* MBEDTLS_X509_CRT_PARSE_C */
10501
10502#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010503#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker41527622019-05-16 12:50:45 +010010504#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010505#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker41527622019-05-16 12:50:45 +010010506#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
10507
10508#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010509#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker41527622019-05-16 12:50:45 +010010510#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010511#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker41527622019-05-16 12:50:45 +010010512#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10513
10514#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010515#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 1
Hanno Becker41527622019-05-16 12:50:45 +010010516#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010517#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 0
Hanno Becker41527622019-05-16 12:50:45 +010010518#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
10519
10520#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010521#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker41527622019-05-16 12:50:45 +010010522#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010523#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker41527622019-05-16 12:50:45 +010010524#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
10525
Hanno Becker41527622019-05-16 12:50:45 +010010526#if defined(MBEDTLS_SSL_SESSION_TICKETS)
10527#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
10528#else
10529#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
10530#endif /* MBEDTLS_SSL_SESSION_TICKETS */
10531
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010532#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
10533#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 1
10534#else
10535#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 0
10536#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10537
Hanno Becker88440552019-07-03 14:16:13 +010010538#if defined(MBEDTLS_ZLIB_SUPPORT)
10539#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 1
10540#else
10541#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 0
10542#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10543
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010544#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
10545#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
10546#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
10547#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
10548#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT 4
10549#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 5
10550#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 6
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010551#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT 7
Hanno Becker88440552019-07-03 14:16:13 +010010552#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT 8
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010553
Hanno Becker26829e92019-05-28 14:30:45 +010010554#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010555 ( (uint16_t) ( \
10556 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
10557 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
10558 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
10559 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
10560 ( SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC << SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT ) | \
10561 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010562 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) | \
Hanno Becker88440552019-07-03 14:16:13 +010010563 ( SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION << SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010564 ( SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT << SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT ) ) )
Hanno Becker41527622019-05-16 12:50:45 +010010565
Hanno Becker557fe9f2019-05-16 12:41:07 +010010566static unsigned char ssl_serialized_session_header[] = {
Hanno Becker41527622019-05-16 12:50:45 +010010567 MBEDTLS_VERSION_MAJOR,
10568 MBEDTLS_VERSION_MINOR,
10569 MBEDTLS_VERSION_PATCH,
Hanno Becker26829e92019-05-28 14:30:45 +010010570 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
10571 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Hanno Becker557fe9f2019-05-16 12:41:07 +010010572};
Hanno Beckerb5352f02019-05-16 12:39:07 +010010573
10574/*
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010575 * Serialize a session in the following format:
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010576 * (in the presentation language of TLS, RFC 8446 section 3)
10577 *
Hanno Becker26829e92019-05-28 14:30:45 +010010578 * opaque mbedtls_version[3]; // major, minor, patch
10579 * opaque session_format[2]; // version-specific 16-bit field determining
10580 * // the format of the remaining
10581 * // serialized data.
Hanno Beckerb36db4f2019-05-29 11:08:00 +010010582 *
10583 * Note: When updating the format, remember to keep
10584 * these version+format bytes.
10585 *
Hanno Becker7bf77102019-06-04 09:43:16 +010010586 * // In this version, `session_format` determines
10587 * // the setting of those compile-time
10588 * // configuration options which influence
Hanno Becker26829e92019-05-28 14:30:45 +010010589 * // the structure of mbedtls_ssl_session.
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010590 * uint64 start_time;
Hanno Becker26829e92019-05-28 14:30:45 +010010591 * uint8 ciphersuite[2]; // defined by the standard
10592 * uint8 compression; // 0 or 1
10593 * uint8 session_id_len; // at most 32
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010594 * opaque session_id[32];
Hanno Becker26829e92019-05-28 14:30:45 +010010595 * opaque master[48]; // fixed length in the standard
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010596 * uint32 verify_result;
Hanno Becker0528f822019-06-18 12:45:31 +010010597 * select (MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) {
10598 * case enabled: opaque peer_cert<0..2^24-1>; // length 0 means no cert
10599 * case disabled: uint8_t peer_cert_digest_type;
10600 * opaque peer_cert_digest<0..2^8-1>;
10601 * }
Hanno Becker26829e92019-05-28 14:30:45 +010010602 * opaque ticket<0..2^24-1>; // length 0 means no ticket
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010603 * uint32 ticket_lifetime;
Hanno Becker26829e92019-05-28 14:30:45 +010010604 * uint8 mfl_code; // up to 255 according to standard
10605 * uint8 trunc_hmac; // 0 or 1
10606 * uint8 encrypt_then_mac; // 0 or 1
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010607 *
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010608 * The order is the same as in the definition of the structure, except
10609 * verify_result is put before peer_cert so that all mandatory fields come
10610 * together in one block.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010611 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010612static int ssl_session_save( const mbedtls_ssl_session *session,
10613 unsigned char omit_header,
10614 unsigned char *buf,
10615 size_t buf_len,
10616 size_t *olen )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010617{
10618 unsigned char *p = buf;
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010619 size_t used = 0;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010620#if defined(MBEDTLS_HAVE_TIME)
10621 uint64_t start;
10622#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010623#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010624#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010625 size_t cert_len;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010626#endif
Hanno Becker2e6d3472019-02-06 15:40:27 +000010627#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010628
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010629 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010630 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010631 /*
10632 * Add version identifier
10633 */
10634
10635 used += sizeof( ssl_serialized_session_header );
10636
10637 if( used <= buf_len )
10638 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010639 mbedtls_platform_memcpy( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010640 sizeof( ssl_serialized_session_header ) );
10641 p += sizeof( ssl_serialized_session_header );
10642 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010643 }
10644
10645 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010646 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010647 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010648#if defined(MBEDTLS_HAVE_TIME)
10649 used += 8;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010650
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010651 if( used <= buf_len )
10652 {
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010653 start = (uint64_t) session->start;
10654
10655 *p++ = (unsigned char)( ( start >> 56 ) & 0xFF );
10656 *p++ = (unsigned char)( ( start >> 48 ) & 0xFF );
10657 *p++ = (unsigned char)( ( start >> 40 ) & 0xFF );
10658 *p++ = (unsigned char)( ( start >> 32 ) & 0xFF );
10659 *p++ = (unsigned char)( ( start >> 24 ) & 0xFF );
10660 *p++ = (unsigned char)( ( start >> 16 ) & 0xFF );
10661 *p++ = (unsigned char)( ( start >> 8 ) & 0xFF );
10662 *p++ = (unsigned char)( ( start ) & 0xFF );
10663 }
10664#endif /* MBEDTLS_HAVE_TIME */
10665
10666 /*
10667 * Basic mandatory fields
10668 */
Hanno Becker88440552019-07-03 14:16:13 +010010669 {
10670 size_t const ciphersuite_len = 2;
10671#if defined(MBEDTLS_ZLIB_SUPPORT)
10672 size_t const compression_len = 1;
10673#else
10674 size_t const compression_len = 0;
10675#endif
10676 size_t const id_len_len = 1;
10677 size_t const id_len = 32;
10678 size_t const master_len = 48;
10679 size_t const verif_result_len = 4;
10680
10681 size_t const basic_len =
10682 ciphersuite_len +
10683 compression_len +
10684 id_len_len +
10685 id_len +
10686 master_len +
10687 verif_result_len;
10688
10689 used += basic_len;
10690 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010691
10692 if( used <= buf_len )
10693 {
Hanno Beckere02758c2019-06-26 15:31:31 +010010694 const int ciphersuite =
10695 mbedtls_ssl_session_get_ciphersuite( session );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010696 p = mbedtls_platform_put_uint16_be( p, ciphersuite );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010697
Hanno Becker88440552019-07-03 14:16:13 +010010698#if defined(MBEDTLS_ZLIB_SUPPORT)
10699 *p++ = (unsigned char)(
10700 mbedtls_ssl_session_get_compression( session ) );
10701#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010702
10703 *p++ = (unsigned char)( session->id_len & 0xFF );
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010704 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10705 memcpy( p, session->id, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010706 p += 32;
10707
Teppo Järvelin91d79382019-10-02 09:09:31 +030010708 mbedtls_platform_memcpy( p, session->master, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010709 p += 48;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010710 p = mbedtls_platform_put_uint32_be( p, session->verify_result );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010711 }
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010712
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010713 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010714 * Peer's end-entity certificate
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010715 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010716#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010717#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010718 if( session->peer_cert == NULL )
10719 cert_len = 0;
10720 else
10721 cert_len = session->peer_cert->raw.len;
10722
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010723 used += 3 + cert_len;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010724
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010725 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010726 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010727 p = mbedtls_platform_put_uint24_be( p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010728
10729 if( session->peer_cert != NULL )
10730 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010731 mbedtls_platform_memcpy( p, session->peer_cert->raw.p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010732 p += cert_len;
10733 }
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010734 }
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010735
Hanno Becker5882dd02019-06-06 16:25:57 +010010736#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010737 /* Digest of peer certificate */
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010738 if( session->peer_cert_digest != NULL )
10739 {
10740 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
10741 if( used <= buf_len )
10742 {
10743 *p++ = (unsigned char) session->peer_cert_digest_type;
10744 *p++ = (unsigned char) session->peer_cert_digest_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +030010745 mbedtls_platform_memcpy( p, session->peer_cert_digest,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010746 session->peer_cert_digest_len );
10747 p += session->peer_cert_digest_len;
10748 }
10749 }
10750 else
10751 {
10752 used += 2;
10753 if( used <= buf_len )
10754 {
10755 *p++ = (unsigned char) MBEDTLS_MD_NONE;
10756 *p++ = 0;
10757 }
10758 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010759#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010760#endif /* MBEDTLS_X509_CRT_PARSE_C */
10761
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010762 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010763 * Session ticket if any, plus associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010764 */
10765#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010766 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010767
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010768 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010769 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010770 p = mbedtls_platform_put_uint24_be( p, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010771
10772 if( session->ticket != NULL )
10773 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010774 mbedtls_platform_memcpy( p, session->ticket, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010775 p += session->ticket_len;
10776 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010777
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010778 p = mbedtls_platform_put_uint32_be( p, session->ticket_lifetime );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010779 }
10780#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
10781
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010782 /*
10783 * Misc extension-related info
10784 */
10785#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
10786 used += 1;
10787
10788 if( used <= buf_len )
10789 *p++ = session->mfl_code;
10790#endif
10791
10792#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
10793 used += 1;
10794
10795 if( used <= buf_len )
10796 *p++ = (unsigned char)( ( session->trunc_hmac ) & 0xFF );
10797#endif
10798
10799#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
10800 used += 1;
10801
10802 if( used <= buf_len )
10803 *p++ = (unsigned char)( ( session->encrypt_then_mac ) & 0xFF );
10804#endif
10805
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010806 /* Done */
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010807 *olen = used;
10808
10809 if( used > buf_len )
10810 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010811
10812 return( 0 );
10813}
10814
10815/*
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010816 * Public wrapper for ssl_session_save()
10817 */
10818int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
10819 unsigned char *buf,
10820 size_t buf_len,
10821 size_t *olen )
10822{
10823 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
10824}
10825
10826/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020010827 * Deserialize session, see mbedtls_ssl_session_save() for format.
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010828 *
10829 * This internal version is wrapped by a public function that cleans up in
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010830 * case of error, and has an extra option omit_header.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010831 */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010832static int ssl_session_load( mbedtls_ssl_session *session,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010833 unsigned char omit_header,
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010834 const unsigned char *buf,
10835 size_t len )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010836{
10837 const unsigned char *p = buf;
10838 const unsigned char * const end = buf + len;
Hanno Beckere02758c2019-06-26 15:31:31 +010010839 int ciphersuite;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010840#if defined(MBEDTLS_HAVE_TIME)
10841 uint64_t start;
10842#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010843#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010844#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010845 size_t cert_len;
Hanno Becker2e6d3472019-02-06 15:40:27 +000010846#endif
10847#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010848
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010849 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010850 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010851 /*
10852 * Check version identifier
10853 */
10854
10855 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
10856 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10857
Teppo Järvelin0efac532019-10-04 13:21:08 +030010858 // use regular memcmp as session header is public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030010859 if( memcmp( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010860 sizeof( ssl_serialized_session_header ) ) != 0 )
10861 {
10862 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10863 }
10864 p += sizeof( ssl_serialized_session_header );
Hanno Beckerb5352f02019-05-16 12:39:07 +010010865 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010866
10867 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010868 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010869 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010870#if defined(MBEDTLS_HAVE_TIME)
10871 if( 8 > (size_t)( end - p ) )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010872 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10873
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010874 start = ( (uint64_t) p[0] << 56 ) |
10875 ( (uint64_t) p[1] << 48 ) |
10876 ( (uint64_t) p[2] << 40 ) |
10877 ( (uint64_t) p[3] << 32 ) |
10878 ( (uint64_t) p[4] << 24 ) |
10879 ( (uint64_t) p[5] << 16 ) |
10880 ( (uint64_t) p[6] << 8 ) |
10881 ( (uint64_t) p[7] );
10882 p += 8;
10883
10884 session->start = (time_t) start;
10885#endif /* MBEDTLS_HAVE_TIME */
10886
10887 /*
10888 * Basic mandatory fields
10889 */
Hanno Becker88440552019-07-03 14:16:13 +010010890 {
10891 size_t const ciphersuite_len = 2;
10892#if defined(MBEDTLS_ZLIB_SUPPORT)
10893 size_t const compression_len = 1;
10894#else
10895 size_t const compression_len = 0;
10896#endif
10897 size_t const id_len_len = 1;
10898 size_t const id_len = 32;
10899 size_t const master_len = 48;
10900 size_t const verif_result_len = 4;
Hanno Beckere02758c2019-06-26 15:31:31 +010010901
Hanno Becker88440552019-07-03 14:16:13 +010010902 size_t const basic_len =
10903 ciphersuite_len +
10904 compression_len +
10905 id_len_len +
10906 id_len +
10907 master_len +
10908 verif_result_len;
10909
10910 if( basic_len > (size_t)( end - p ) )
10911 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10912 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010913
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010914 ciphersuite = (int)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010915 p += 2;
10916
Hanno Becker73f4cb12019-06-27 13:51:07 +010010917#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Beckere02758c2019-06-26 15:31:31 +010010918 session->ciphersuite = ciphersuite;
10919#else
10920 if( ciphersuite !=
Hanno Becker73f4cb12019-06-27 13:51:07 +010010921 MBEDTLS_SSL_SUITE_ID( MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE ) )
Hanno Beckere02758c2019-06-26 15:31:31 +010010922 {
10923 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10924 }
10925#endif
10926
Hanno Becker88440552019-07-03 14:16:13 +010010927#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010928 session->compression = *p++;
Hanno Becker88440552019-07-03 14:16:13 +010010929#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010930
10931 session->id_len = *p++;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010932 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10933 memcpy( session->id, p, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010934 p += 32;
10935
Teppo Järvelin91d79382019-10-02 09:09:31 +030010936 mbedtls_platform_memcpy( session->master, p, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010937 p += 48;
10938
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010939 session->verify_result = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010940 p += 4;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010941
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010942 /* Immediately clear invalid pointer values that have been read, in case
10943 * we exit early before we replaced them with valid ones. */
10944#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010945#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010946 session->peer_cert = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010947#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010948 session->peer_cert_digest = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010949#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010950#endif
10951#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
10952 session->ticket = NULL;
10953#endif
10954
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010955 /*
10956 * Peer certificate
10957 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010958#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010959#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010960 if( 3 > (size_t)( end - p ) )
10961 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10962
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010963 cert_len = mbedtls_platform_get_uint24_be( &p[0] );
10964
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010965 p += 3;
10966
10967 if( cert_len == 0 )
10968 {
10969 session->peer_cert = NULL;
10970 }
10971 else
10972 {
10973 int ret;
10974
10975 if( cert_len > (size_t)( end - p ) )
10976 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10977
10978 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
10979
10980 if( session->peer_cert == NULL )
10981 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
10982
10983 mbedtls_x509_crt_init( session->peer_cert );
10984
10985 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
10986 p, cert_len ) ) != 0 )
10987 {
10988 mbedtls_x509_crt_free( session->peer_cert );
10989 mbedtls_free( session->peer_cert );
10990 session->peer_cert = NULL;
10991 return( ret );
10992 }
10993
10994 p += cert_len;
10995 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010996#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010997 /* Deserialize CRT digest from the end of the ticket. */
10998 if( 2 > (size_t)( end - p ) )
10999 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11000
11001 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
11002 session->peer_cert_digest_len = (size_t) *p++;
11003
11004 if( session->peer_cert_digest_len != 0 )
11005 {
Hanno Beckera5cedbc2019-07-17 11:21:02 +010011006 mbedtls_md_handle_t md_info =
Hanno Becker2326d202019-06-06 14:54:55 +010011007 mbedtls_md_info_from_type( session->peer_cert_digest_type );
Hanno Beckera5cedbc2019-07-17 11:21:02 +010011008 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Hanno Becker2326d202019-06-06 14:54:55 +010011009 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11010 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
11011 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11012
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011013 if( session->peer_cert_digest_len > (size_t)( end - p ) )
11014 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11015
11016 session->peer_cert_digest =
11017 mbedtls_calloc( 1, session->peer_cert_digest_len );
11018 if( session->peer_cert_digest == NULL )
11019 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
11020
Teppo Järvelin91d79382019-10-02 09:09:31 +030011021 mbedtls_platform_memcpy( session->peer_cert_digest, p,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011022 session->peer_cert_digest_len );
11023 p += session->peer_cert_digest_len;
11024 }
Hanno Becker5882dd02019-06-06 16:25:57 +010011025#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020011026#endif /* MBEDTLS_X509_CRT_PARSE_C */
11027
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011028 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011029 * Session ticket and associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011030 */
11031#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
11032 if( 3 > (size_t)( end - p ) )
11033 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11034
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030011035 session->ticket_len = mbedtls_platform_get_uint24_be( &p[0] );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011036 p += 3;
11037
11038 if( session->ticket_len != 0 )
11039 {
11040 if( session->ticket_len > (size_t)( end - p ) )
11041 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11042
11043 session->ticket = mbedtls_calloc( 1, session->ticket_len );
11044 if( session->ticket == NULL )
11045 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
11046
Teppo Järvelin91d79382019-10-02 09:09:31 +030011047 mbedtls_platform_memcpy( session->ticket, p, session->ticket_len );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011048 p += session->ticket_len;
11049 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011050
11051 if( 4 > (size_t)( end - p ) )
11052 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11053
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030011054 session->ticket_lifetime = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011055 p += 4;
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011056#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
11057
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011058 /*
11059 * Misc extension-related info
11060 */
11061#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
11062 if( 1 > (size_t)( end - p ) )
11063 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11064
11065 session->mfl_code = *p++;
11066#endif
11067
11068#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
11069 if( 1 > (size_t)( end - p ) )
11070 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11071
11072 session->trunc_hmac = *p++;
11073#endif
11074
11075#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
11076 if( 1 > (size_t)( end - p ) )
11077 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11078
11079 session->encrypt_then_mac = *p++;
11080#endif
11081
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011082 /* Done, should have consumed entire buffer */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020011083 if( p != end )
11084 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11085
11086 return( 0 );
11087}
11088
11089/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020011090 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020011091 */
11092int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
11093 const unsigned char *buf,
11094 size_t len )
11095{
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011096 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020011097
11098 if( ret != 0 )
11099 mbedtls_ssl_session_free( session );
11100
11101 return( ret );
11102}
11103
11104/*
Paul Bakker1961b702013-01-25 14:49:24 +010011105 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +000011106 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011107int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011108{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011109 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker5121ce52009-01-03 21:22:43 +000011110
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011111 if( ssl == NULL || ssl->conf == NULL )
11112 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11113
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011114#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011115 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011116 ret = mbedtls_ssl_handshake_client_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000011117#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011118#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011119 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011120 ret = mbedtls_ssl_handshake_server_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000011121#endif
11122
Hanno Beckerb82350b2019-07-26 07:24:05 +010011123 ssl_send_pending_fatal_alert( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010011124 return( ret );
11125}
11126
11127/*
11128 * Perform the SSL handshake
11129 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011130int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +010011131{
11132 int ret = 0;
11133
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011134 if( ssl == NULL || ssl->conf == NULL )
11135 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11136
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011137 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +010011138
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011139 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +010011140 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011141 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010011142
11143 if( ret != 0 )
11144 break;
11145 }
11146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011147 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011148
11149 return( ret );
11150}
11151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011152#if defined(MBEDTLS_SSL_RENEGOTIATION)
11153#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000011154/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011155 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +000011156 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011157static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011158{
11159 int ret;
11160
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011161 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011162
11163 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011164 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
11165 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011166
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020011167 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011168 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020011169 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011170 return( ret );
11171 }
11172
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011173 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011174
11175 return( 0 );
11176}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011177#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011178
11179/*
11180 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011181 * - any side: calling mbedtls_ssl_renegotiate(),
11182 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
11183 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +020011184 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011185 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011186 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011187 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011188static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011189{
11190 int ret;
11191
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011192 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011193
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011194 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
11195 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011196
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011197 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
11198 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011199#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011200 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011201 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011202 {
Hanno Becker2d9623f2019-06-13 12:07:05 +010011203 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11204 MBEDTLS_SSL_IS_SERVER )
11205 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011206 ssl->handshake->out_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010011207 }
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011208 else
Hanno Becker2d9623f2019-06-13 12:07:05 +010011209 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011210 ssl->handshake->in_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010011211 }
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011212 }
11213#endif
11214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011215 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
11216 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +000011217
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011218 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011219 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011220 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011221 return( ret );
11222 }
11223
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011224 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011225
11226 return( 0 );
11227}
11228
11229/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011230 * Renegotiate current connection on client,
11231 * or request renegotiation on server
11232 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011233int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011234{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011235 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011236
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011237 if( ssl == NULL || ssl->conf == NULL )
11238 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11239
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011240#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011241 /* On server, just send the request */
Hanno Becker2d9623f2019-06-13 12:07:05 +010011242 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011243 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011244 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
11245 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011246
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011247 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020011248
11249 /* Did we already try/start sending HelloRequest? */
11250 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011251 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020011252
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011253 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011254 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011255#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011257#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011258 /*
11259 * On client, either start the renegotiation process or,
11260 * if already in progress, continue the handshake
11261 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011262 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011263 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011264 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
11265 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011266
11267 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
11268 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011269 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011270 return( ret );
11271 }
11272 }
11273 else
11274 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011275 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011276 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011277 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011278 return( ret );
11279 }
11280 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011281#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011282
Paul Bakker37ce0ff2013-10-31 14:32:04 +010011283 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011284}
11285
11286/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011287 * Check record counters and renegotiate if they're above the limit.
11288 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011289static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011290{
Andres AG2196c7f2016-12-15 17:01:16 +000011291 size_t ep_len = ssl_ep_len( ssl );
11292 int in_ctr_cmp;
11293 int out_ctr_cmp;
11294
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011295 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
11296 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020011297 ! mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011298 {
11299 return( 0 );
11300 }
11301
Teppo Järvelin0efac532019-10-04 13:21:08 +030011302 // use regular memcmp as counters are public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030011303 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000011304 ssl->conf->renego_period + ep_len, 8 - ep_len );
Teppo Järvelin650343c2019-10-03 15:36:59 +030011305 out_ctr_cmp = memcmp( ssl->cur_out_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000011306 ssl->conf->renego_period + ep_len, 8 - ep_len );
11307
11308 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011309 {
11310 return( 0 );
11311 }
11312
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020011313 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011314 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011315}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011316#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000011317
11318/*
11319 * Receive application data decrypted from the SSL layer
11320 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011321int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011322{
Hanno Becker4a810fb2017-05-24 16:27:30 +010011323 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +000011324 size_t n;
Andrzej Kurek84bde412020-07-06 15:27:34 -040011325 volatile unsigned char *buf_dup = buf;
11326 volatile size_t len_dup = len;
Paul Bakker5121ce52009-01-03 21:22:43 +000011327
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011328 if( ssl == NULL || ssl->conf == NULL )
11329 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011331 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011332
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011333#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011334 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011335 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011336 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011337 return( ret );
11338
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011339 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011340 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011341 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +020011342 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011343 return( ret );
11344 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011345 }
11346#endif
11347
Hanno Becker4a810fb2017-05-24 16:27:30 +010011348 /*
11349 * Check if renegotiation is necessary and/or handshake is
11350 * in process. If yes, perform/continue, and fall through
11351 * if an unexpected packet is received while the client
11352 * is waiting for the ServerHello.
11353 *
11354 * (There is no equivalent to the last condition on
11355 * the server-side as it is not treated as within
11356 * a handshake while waiting for the ClientHello
11357 * after a renegotiation request.)
11358 */
11359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011360#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011361 ret = ssl_check_ctr_renegotiate( ssl );
11362 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11363 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011364 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011365 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011366 return( ret );
11367 }
11368#endif
11369
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011370 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011371 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011372 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +010011373 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11374 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011375 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011376 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011377 return( ret );
11378 }
11379 }
11380
Hanno Beckere41158b2017-10-23 13:30:32 +010011381 /* Loop as long as no application data record is available */
Hanno Becker90333da2017-10-10 11:27:13 +010011382 while( ssl->in_offt == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000011383 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011384 /* Start timer if not already running */
Hanno Becker0ae6b242019-06-13 16:45:36 +010011385 if( mbedtls_ssl_get_get_timer( ssl ) != NULL &&
11386 mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == -1 )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020011387 {
Hanno Becker1f835fa2019-06-13 10:14:59 +010011388 ssl_set_timer( ssl,
11389 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020011390 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011391
Hanno Becker327c93b2018-08-15 13:56:18 +010011392 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011393 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011394 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
11395 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +000011396
Hanno Becker4a810fb2017-05-24 16:27:30 +010011397 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
11398 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011399 }
11400
11401 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011402 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011403 {
11404 /*
11405 * OpenSSL sends empty messages to randomize the IV
11406 */
Hanno Becker327c93b2018-08-15 13:56:18 +010011407 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011408 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011409 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +000011410 return( 0 );
11411
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011412 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011413 return( ret );
11414 }
11415 }
11416
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011417 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +000011418 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011419 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011420
Hanno Becker4a810fb2017-05-24 16:27:30 +010011421 /*
11422 * - For client-side, expect SERVER_HELLO_REQUEST.
11423 * - For server-side, expect CLIENT_HELLO.
11424 * - Fail (TLS) or silently drop record (DTLS) in other cases.
11425 */
11426
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011427#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011428 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11429 MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011430 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
Hanno Becker4a810fb2017-05-24 16:27:30 +010011431 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
Paul Bakker48916f92012-09-16 19:57:18 +000011432 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011433 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011434
11435 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011436#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011437 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011438 {
11439 continue;
11440 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011441 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011442#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011443#if defined(MBEDTLS_SSL_PROTO_TLS)
11444 {
11445 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11446 }
11447#endif
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011448 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011449#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011450
Hanno Becker4a810fb2017-05-24 16:27:30 +010011451#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011452 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11453 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011454 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011455 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011456 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011457
11458 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011459#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011460 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011461 {
11462 continue;
11463 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011464 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011465#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011466#if defined(MBEDTLS_SSL_PROTO_TLS)
11467 {
11468 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11469 }
11470#endif
Paul Bakker48916f92012-09-16 19:57:18 +000011471 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011472#endif /* MBEDTLS_SSL_SRV_C */
11473
Hanno Becker21df7f92017-10-17 11:03:26 +010011474#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011475 /* Determine whether renegotiation attempt should be accepted */
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011476 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
11477 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +010011478 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011479 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
11480 {
11481 /*
11482 * Accept renegotiation request
11483 */
Paul Bakker48916f92012-09-16 19:57:18 +000011484
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011485 /* DTLS clients need to know renego is server-initiated */
11486#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011487 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker2d9623f2019-06-13 12:07:05 +010011488 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11489 MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011490 {
11491 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
11492 }
11493#endif
11494 ret = ssl_start_renegotiation( ssl );
11495 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11496 ret != 0 )
11497 {
11498 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
11499 return( ret );
11500 }
11501 }
11502 else
Hanno Becker21df7f92017-10-17 11:03:26 +010011503#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000011504 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011505 /*
11506 * Refuse renegotiation
11507 */
11508
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011509 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011510
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011511#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +010011512 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011513 {
Gilles Peskine92e44262017-05-10 17:27:49 +020011514 /* SSLv3 does not have a "no_renegotiation" warning, so
11515 we send a fatal alert and abort the connection. */
11516 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
11517 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
11518 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011519 }
11520 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011521#endif /* MBEDTLS_SSL_PROTO_SSL3 */
11522#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
11523 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011524 if( mbedtls_ssl_ver_geq(
11525 mbedtls_ssl_get_minor_ver( ssl ),
11526 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011527 {
Hanno Becker2e8d1332019-07-25 10:27:36 +010011528 ret = mbedtls_ssl_send_alert_message( ssl,
11529 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11530 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION );
11531 if( ret != 0 )
11532 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011533 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +020011534 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011535#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
11536 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +020011537 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011538 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
11539 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +020011540 }
Paul Bakker48916f92012-09-16 19:57:18 +000011541 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011542
Hanno Becker90333da2017-10-10 11:27:13 +010011543 /* At this point, we don't know whether the renegotiation has been
11544 * completed or not. The cases to consider are the following:
11545 * 1) The renegotiation is complete. In this case, no new record
11546 * has been read yet.
11547 * 2) The renegotiation is incomplete because the client received
11548 * an application data record while awaiting the ServerHello.
11549 * 3) The renegotiation is incomplete because the client received
11550 * a non-handshake, non-application data message while awaiting
11551 * the ServerHello.
11552 * In each of these case, looping will be the proper action:
11553 * - For 1), the next iteration will read a new record and check
11554 * if it's application data.
11555 * - For 2), the loop condition isn't satisfied as application data
11556 * is present, hence continue is the same as break
11557 * - For 3), the loop condition is satisfied and read_record
11558 * will re-deliver the message that was held back by the client
11559 * when expecting the ServerHello.
11560 */
11561 continue;
Paul Bakker48916f92012-09-16 19:57:18 +000011562 }
Hanno Becker21df7f92017-10-17 11:03:26 +010011563#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011564 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011565 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011566 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011567 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011568 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011569 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011570 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011571 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011572 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011573 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011574 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011575 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011576#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011578 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
11579 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011580 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011581 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +010011582 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011583 }
11584
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011585 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011586 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011587 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
11588 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +000011589 }
11590
11591 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011592
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011593 /* We're going to return something now, cancel timer,
11594 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011595 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011596 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011597
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020011598#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011599 /* If we requested renego but received AppData, resend HelloRequest.
11600 * Do it now, after setting in_offt, to avoid taking this branch
11601 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011602#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011603 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11604 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011605 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011606 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011607 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011608 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011609 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011610 return( ret );
11611 }
11612 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011613#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +010011614#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +000011615 }
11616
11617 n = ( len < ssl->in_msglen )
11618 ? len : ssl->in_msglen;
11619
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011620 if( mbedtls_platform_memcpy( buf, ssl->in_offt, n ) !=
11621 buf )
11622 {
11623 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11624 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011625 ssl->in_msglen -= n;
11626
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011627 // clear incoming data after it's copied to buffer
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011628 if( mbedtls_platform_memset( ssl->in_offt, 0, n ) !=
11629 ssl->in_offt )
11630 {
11631 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11632 }
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011633
Paul Bakker5121ce52009-01-03 21:22:43 +000011634 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +010011635 {
11636 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +000011637 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +010011638 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011639 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011640 else
Hanno Becker4a810fb2017-05-24 16:27:30 +010011641 {
Paul Bakker5121ce52009-01-03 21:22:43 +000011642 /* more data available */
11643 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011644 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011645
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011647
Andrzej Kurek84bde412020-07-06 15:27:34 -040011648 /* Secure against buffer substitution */
11649 if( buf_dup == buf && len_dup == len )
11650 {
11651 return( (int) n );
11652 }
11653 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +000011654}
11655
11656/*
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011657 * Send application data to be encrypted by the SSL layer, taking care of max
11658 * fragment length and buffer size.
11659 *
11660 * According to RFC 5246 Section 6.2.1:
11661 *
11662 * Zero-length fragments of Application data MAY be sent as they are
11663 * potentially useful as a traffic analysis countermeasure.
11664 *
11665 * Therefore, it is possible that the input message length is 0 and the
11666 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +000011667 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011668static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011669 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011670{
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020011671 int ret = mbedtls_ssl_get_max_out_record_payload( ssl );
11672 const size_t max_len = (size_t) ret;
11673
11674 if( ret < 0 )
11675 {
11676 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
11677 return( ret );
11678 }
11679
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011680 if( len > max_len )
11681 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011682#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011683 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011684 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011685 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011686 "maximum fragment length: %d > %d",
11687 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011688 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011689 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011690 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011691#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011692#if defined(MBEDTLS_SSL_PROTO_TLS)
11693 {
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011694 len = max_len;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011695 }
11696#endif
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011697 }
Paul Bakker887bd502011-06-08 13:10:54 +000011698
Paul Bakker5121ce52009-01-03 21:22:43 +000011699 if( ssl->out_left != 0 )
11700 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011701 /*
11702 * The user has previously tried to send the data and
11703 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
11704 * written. In this case, we expect the high-level write function
11705 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
11706 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011707 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011708 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011709 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011710 return( ret );
11711 }
11712 }
Paul Bakker887bd502011-06-08 13:10:54 +000011713 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +000011714 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011715 /*
11716 * The user is trying to send a message the first time, so we need to
11717 * copy the data into the internal buffers and setup the data structure
11718 * to keep track of partial writes
11719 */
shelib014062d6c2020-07-21 11:54:52 +030011720 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011721 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011722 if( mbedtls_platform_memcpy( ssl->out_msg, buf, len ) != ssl->out_msg )
11723 {
11724 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11725 }
Paul Bakker887bd502011-06-08 13:10:54 +000011726
shelib014062d6c2020-07-21 11:54:52 +030011727#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011728 /*
11729 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11730 * After splitting pointers and data size will not be the same as initaly provides by user.
11731 */
shelib014062d6c2020-07-21 11:54:52 +030011732 /* Secure against buffer substitution */
Shelly Liberman3799fc12020-08-05 15:52:58 +030011733 if( buf == ssl->out_msg_dup &&
shelib014062d6c2020-07-21 11:54:52 +030011734 ssl->out_msglen == ssl->out_msglen_dup &&
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011735 ssl->out_msg_dup[0] == ssl->out_msg[0] )
shelib014062d6c2020-07-21 11:54:52 +030011736 {/*write record only if data was copied from correct user pointer */
11737#endif
Shelly Liberman3799fc12020-08-05 15:52:58 +030011738 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
shelib014062d6c2020-07-21 11:54:52 +030011739 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011740 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
11741 return( ret );
shelib014062d6c2020-07-21 11:54:52 +030011742 }
11743
11744#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Paul Bakker887bd502011-06-08 13:10:54 +000011745 }
shelib014062d6c2020-07-21 11:54:52 +030011746 else
11747 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011748 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011749 }
11750#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000011751 }
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011752 if ( ret == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -040011753 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011754 return( (int) len );
Andrzej Kurek84bde412020-07-06 15:27:34 -040011755 }
shelib014062d6c2020-07-21 11:54:52 +030011756 else
11757 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011758 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011759 }
11760
Paul Bakker5121ce52009-01-03 21:22:43 +000011761}
11762
11763/*
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011764 * Write application data, doing 1/n-1 splitting if necessary.
11765 *
11766 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011767 * then the caller will call us again with the same arguments, so
Hanno Becker2b187c42017-09-18 14:58:11 +010011768 * remember whether we already did the split or not.
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011769 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011770#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011771static int ssl_write_split( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011772 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011773{
11774 int ret;
11775
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010011776 if( ssl->conf->cbc_record_splitting ==
11777 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011778 len <= 1 ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011779 mbedtls_ssl_ver_gt(
11780 mbedtls_ssl_get_minor_ver( ssl ),
11781 MBEDTLS_SSL_MINOR_VERSION_1 ) ||
Andrzej Kurek11750442020-09-17 07:12:06 -040011782#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
11783 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx )
11784 != MBEDTLS_MODE_CBC )
11785#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011786 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
11787 != MBEDTLS_MODE_CBC )
Andrzej Kurek11750442020-09-17 07:12:06 -040011788#endif
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011789 {
11790 return( ssl_write_real( ssl, buf, len ) );
11791 }
11792
11793 if( ssl->split_done == 0 )
11794 {
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011795 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011796 return( ret );
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011797 ssl->split_done = 1;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011798 }
11799
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011800 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
11801 return( ret );
11802 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011803
11804 return( ret + 1 );
11805}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011806#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011807
11808/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011809 * Write application data (public-facing wrapper)
11810 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011811int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011812{
shelib014062d6c2020-07-21 11:54:52 +030011813 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
11814#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011815 /*
11816 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11817 * After splitting pointers and data size will not be the same as initaly provides by user.
11818 */
Andrzej Kurek84bde412020-07-06 15:27:34 -040011819 volatile const unsigned char *buf_dup = buf;
11820 volatile size_t len_dup = len;
shelib014062d6c2020-07-21 11:54:52 +030011821#endif
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011822 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011823
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011824 if( ssl == NULL || ssl->conf == NULL )
11825 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11826
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011827#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011828 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
11829 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011830 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011831 return( ret );
11832 }
11833#endif
11834
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011835 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011836 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011837 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011838 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +020011839 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011840 return( ret );
11841 }
11842 }
11843
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011844#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011845 ret = ssl_write_split( ssl, buf, len );
11846#else
shelib014062d6c2020-07-21 11:54:52 +030011847#if defined(MBEDTLS_FI_COUNTERMEASURES)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011848 /* Add const user pointers to context. We will be able to check its validity before copy to context */
shelib014062d6c2020-07-21 11:54:52 +030011849 ssl->out_msg_dup = (unsigned char*)buf_dup;
11850 ssl->out_msglen_dup = len_dup;
11851#endif //MBEDTLS_FI_COUNTERMEASURES
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011852 ret = ssl_write_real( ssl, buf, len );
11853#endif
11854
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011855 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011856
shelib014062d6c2020-07-21 11:54:52 +030011857
11858 return( ret );
11859
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011860}
11861
11862/*
Paul Bakker5121ce52009-01-03 21:22:43 +000011863 * Notify the peer that the connection is being closed
11864 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011865int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011866{
11867 int ret;
11868
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011869 if( ssl == NULL || ssl->conf == NULL )
11870 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11871
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011872 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011873
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011874 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011875 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011877 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011878 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011879 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
11880 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11881 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011882 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011883 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011884 return( ret );
11885 }
11886 }
11887
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011888 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011889
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011890 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +000011891}
11892
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011893void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +000011894{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011895 if( transform == NULL )
11896 return;
11897
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011898#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +000011899 deflateEnd( &transform->ctx_deflate );
11900 inflateEnd( &transform->ctx_inflate );
11901#endif
Andrzej Kurek11750442020-09-17 07:12:06 -040011902#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
11903 mbedtls_cipher_free( &transform->cipher_ctx );
11904 if( transform->key_dec != NULL )
11905 mbedtls_free( transform->key_dec );
11906 if( transform->key_enc != NULL )
11907 mbedtls_free( transform->key_enc );
11908#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011909 mbedtls_cipher_free( &transform->cipher_ctx_enc );
11910 mbedtls_cipher_free( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -040011911#endif
Hanno Becker92231322018-01-03 15:32:51 +000011912#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011913 mbedtls_md_free( &transform->md_ctx_enc );
11914 mbedtls_md_free( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +000011915#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020011916
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050011917 mbedtls_platform_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011918}
11919
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011920#if defined(MBEDTLS_X509_CRT_PARSE_C)
11921static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011922{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011923 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011924
11925 while( cur != NULL )
11926 {
11927 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011928 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011929 cur = next;
11930 }
11931}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011932#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011933
Hanno Becker0271f962018-08-16 13:23:47 +010011934#if defined(MBEDTLS_SSL_PROTO_DTLS)
11935
11936static void ssl_buffering_free( mbedtls_ssl_context *ssl )
11937{
11938 unsigned offset;
11939 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11940
11941 if( hs == NULL )
11942 return;
11943
Hanno Becker283f5ef2018-08-24 09:34:47 +010011944 ssl_free_buffered_record( ssl );
11945
Hanno Becker0271f962018-08-16 13:23:47 +010011946 for( offset = 0; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
Hanno Beckere605b192018-08-21 15:59:07 +010011947 ssl_buffering_free_slot( ssl, offset );
11948}
11949
11950static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
11951 uint8_t slot )
11952{
11953 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11954 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot];
Hanno Beckerb309b922018-08-23 13:18:05 +010011955
11956 if( slot >= MBEDTLS_SSL_MAX_BUFFERED_HS )
11957 return;
11958
Hanno Beckere605b192018-08-21 15:59:07 +010011959 if( hs_buf->is_valid == 1 )
Hanno Becker0271f962018-08-16 13:23:47 +010011960 {
Hanno Beckere605b192018-08-21 15:59:07 +010011961 hs->buffering.total_bytes_buffered -= hs_buf->data_len;
Hanno Becker805f2e12018-10-12 16:31:41 +010011962 mbedtls_platform_zeroize( hs_buf->data, hs_buf->data_len );
Hanno Beckere605b192018-08-21 15:59:07 +010011963 mbedtls_free( hs_buf->data );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020011964 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Hanno Becker0271f962018-08-16 13:23:47 +010011965 }
11966}
11967
11968#endif /* MBEDTLS_SSL_PROTO_DTLS */
11969
Gilles Peskine9b562d52018-04-25 20:32:43 +020011970void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011971{
Gilles Peskine9b562d52018-04-25 20:32:43 +020011972 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
11973
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011974 if( handshake == NULL )
11975 return;
11976
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011977#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
11978 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
11979 {
Gilles Peskine8f97af72018-04-26 11:46:10 +020011980 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011981 handshake->async_in_progress = 0;
11982 }
11983#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
11984
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +020011985#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
11986 defined(MBEDTLS_SSL_PROTO_TLS1_1)
11987 mbedtls_md5_free( &handshake->fin_md5 );
11988 mbedtls_sha1_free( &handshake->fin_sha1 );
11989#endif
11990#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
11991#if defined(MBEDTLS_SHA256_C)
11992 mbedtls_sha256_free( &handshake->fin_sha256 );
11993#endif
11994#if defined(MBEDTLS_SHA512_C)
11995 mbedtls_sha512_free( &handshake->fin_sha512 );
11996#endif
11997#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
11998
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011999#if defined(MBEDTLS_DHM_C)
12000 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +000012001#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012002#if defined(MBEDTLS_ECDH_C)
12003 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +020012004#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +020012005#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020012006 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +020012007#if defined(MBEDTLS_SSL_CLI_C)
12008 mbedtls_free( handshake->ecjpake_cache );
12009 handshake->ecjpake_cache = NULL;
12010 handshake->ecjpake_cache_len = 0;
12011#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020012012#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020012013
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010012014#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
12015 if( handshake->psk != NULL )
12016 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012017 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010012018 mbedtls_free( handshake->psk );
12019 }
12020#endif
12021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012022#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
12023 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012024 /*
12025 * Free only the linked list wrapper, not the keys themselves
12026 * since the belong to the SNI callback
12027 */
12028 if( handshake->sni_key_cert != NULL )
12029 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012030 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012031
12032 while( cur != NULL )
12033 {
12034 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012035 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012036 cur = next;
12037 }
12038 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012039#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020012040
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020012041#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +020012042 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Beckere4aeb762019-02-05 17:19:52 +000012043 if( handshake->ecrs_peer_cert != NULL )
12044 {
12045 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
12046 mbedtls_free( handshake->ecrs_peer_cert );
12047 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020012048#endif
12049
Hanno Becker3bf8cdf2019-02-06 16:18:31 +000012050#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
12051 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
12052 mbedtls_pk_free( &handshake->peer_pubkey );
12053#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
12054
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012055#if defined(MBEDTLS_SSL_PROTO_DTLS)
12056 mbedtls_free( handshake->verify_cookie );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +020012057 ssl_flight_free( handshake->flight );
Hanno Becker0271f962018-08-16 13:23:47 +010012058 ssl_buffering_free( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +020012059#endif
12060
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012061 mbedtls_platform_zeroize( handshake,
12062 sizeof( mbedtls_ssl_handshake_params ) );
Andrzej Kurekf3844952020-10-16 23:03:01 +020012063
12064#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12065 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
12066 * processes datagrams and the fact that a datagram is allowed to have
12067 * several records in it, it is possible that the I/O buffers are not
12068 * empty at this stage */
Andrzej Kurek79db2f12020-10-20 17:10:38 +020012069 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
12070 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurekf3844952020-10-16 23:03:01 +020012071#endif
Paul Bakker48916f92012-09-16 19:57:18 +000012072}
12073
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012074void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +000012075{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012076 if( session == NULL )
12077 return;
12078
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012079#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker22141592019-02-05 12:38:15 +000012080 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +020012081#endif
Paul Bakker0a597072012-09-25 21:55:46 +000012082
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020012083#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012084 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +020012085#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +020012086
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012087 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +000012088}
12089
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012090#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012091
12092#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12093#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
12094#else
12095#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
12096#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12097
12098#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12099#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
12100#else
12101#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 0u
12102#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12103
12104#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12105#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
12106#else
12107#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
12108#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12109
12110#if defined(MBEDTLS_SSL_ALPN)
12111#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
12112#else
12113#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
12114#endif /* MBEDTLS_SSL_ALPN */
12115
12116#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
12117#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
12118#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
12119#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
12120
12121#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
12122 ( (uint32_t) ( \
12123 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
12124 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
12125 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
12126 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
12127 0u ) )
12128
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012129static unsigned char ssl_serialized_context_header[] = {
12130 MBEDTLS_VERSION_MAJOR,
12131 MBEDTLS_VERSION_MINOR,
12132 MBEDTLS_VERSION_PATCH,
12133 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
12134 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012135 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 16 ) & 0xFF,
12136 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 8 ) & 0xFF,
12137 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012138};
12139
Paul Bakker5121ce52009-01-03 21:22:43 +000012140/*
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012141 * Serialize a full SSL context
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012142 *
12143 * The format of the serialized data is:
12144 * (in the presentation language of TLS, RFC 8446 section 3)
12145 *
12146 * // header
12147 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012148 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012149 * // the format of the remaining
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012150 * // serialized data.
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012151 * Note: When updating the format, remember to keep these
12152 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012153 *
12154 * // session sub-structure
12155 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
12156 * // transform sub-structure
12157 * uint8 random[64]; // ServerHello.random+ClientHello.random
12158 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
12159 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
12160 * // fields from ssl_context
12161 * uint32 badmac_seen; // DTLS: number of records with failing MAC
12162 * uint64 in_window_top; // DTLS: last validated record seq_num
12163 * uint64 in_window; // DTLS: bitmask for replay protection
12164 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
12165 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
12166 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
12167 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
12168 *
12169 * Note that many fields of the ssl_context or sub-structures are not
12170 * serialized, as they fall in one of the following categories:
12171 *
12172 * 1. forced value (eg in_left must be 0)
12173 * 2. pointer to dynamically-allocated memory (eg session, transform)
12174 * 3. value can be re-derived from other data (eg session keys from MS)
12175 * 4. value was temporary (eg content of input buffer)
12176 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012177 */
12178int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
12179 unsigned char *buf,
12180 size_t buf_len,
12181 size_t *olen )
12182{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012183 unsigned char *p = buf;
12184 size_t used = 0;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012185 size_t session_len;
12186 int ret = 0;
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012187
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012188 /*
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012189 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
12190 * this function's documentation.
12191 *
12192 * These are due to assumptions/limitations in the implementation. Some of
12193 * them are likely to stay (no handshake in progress) some might go away
12194 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012195 */
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012196 /* The initial handshake must be over */
12197 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012198 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012199 if( ssl->handshake != NULL )
12200 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12201 /* Double-check that sub-structures are indeed ready */
12202 if( ssl->transform == NULL || ssl->session == NULL )
12203 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12204 /* There must be no pending incoming or outgoing data */
12205 if( mbedtls_ssl_check_pending( ssl ) != 0 )
12206 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12207 if( ssl->out_left != 0 )
12208 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12209 /* Protocol must be DLTS, not TLS */
12210 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
12211 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12212 /* Version must be 1.2 */
12213 if( mbedtls_ssl_get_major_ver( ssl ) != MBEDTLS_SSL_MAJOR_VERSION_3 )
12214 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12215 if( mbedtls_ssl_get_minor_ver( ssl ) != MBEDTLS_SSL_MINOR_VERSION_3 )
12216 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12217 /* We must be using an AEAD ciphersuite */
12218 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
12219 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12220 /* Renegotiation must not be enabled */
12221 if( mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
12222 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012223
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012224 /*
12225 * Version and format identifier
12226 */
12227 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012228
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012229 if( used <= buf_len )
12230 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012231 mbedtls_platform_memcpy( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012232 sizeof( ssl_serialized_context_header ) );
12233 p += sizeof( ssl_serialized_context_header );
12234 }
12235
12236 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012237 * Session (length + data)
12238 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012239 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012240 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
12241 return( ret );
12242
12243 used += 4 + session_len;
12244 if( used <= buf_len )
12245 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012246 p = mbedtls_platform_put_uint32_be( p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012247
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012248 ret = ssl_session_save( ssl->session, 1,
12249 p, session_len, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012250 if( ret != 0 )
12251 return( ret );
12252
12253 p += session_len;
12254 }
12255
12256 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012257 * Transform
12258 */
12259 used += sizeof( ssl->transform->randbytes );
12260 if( used <= buf_len )
12261 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012262 mbedtls_platform_memcpy( p, ssl->transform->randbytes,
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012263 sizeof( ssl->transform->randbytes ) );
12264 p += sizeof( ssl->transform->randbytes );
12265 }
12266
12267#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12268 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
12269 if( used <= buf_len )
12270 {
12271 *p++ = ssl->transform->in_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012272 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12273 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012274 p += ssl->transform->in_cid_len;
12275
12276 *p++ = ssl->transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012277 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12278 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012279 p += ssl->transform->out_cid_len;
12280 }
12281#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12282
12283 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012284 * Saved fields from top-level ssl_context structure
12285 */
12286#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12287 used += 4;
12288 if( used <= buf_len )
12289 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012290 p = mbedtls_platform_put_uint32_be( p, ssl->badmac_seen );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012291 }
12292#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12293
12294#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12295 used += 16;
12296 if( used <= buf_len )
12297 {
12298 *p++ = (unsigned char)( ( ssl->in_window_top >> 56 ) & 0xFF );
12299 *p++ = (unsigned char)( ( ssl->in_window_top >> 48 ) & 0xFF );
12300 *p++ = (unsigned char)( ( ssl->in_window_top >> 40 ) & 0xFF );
12301 *p++ = (unsigned char)( ( ssl->in_window_top >> 32 ) & 0xFF );
12302 *p++ = (unsigned char)( ( ssl->in_window_top >> 24 ) & 0xFF );
12303 *p++ = (unsigned char)( ( ssl->in_window_top >> 16 ) & 0xFF );
12304 *p++ = (unsigned char)( ( ssl->in_window_top >> 8 ) & 0xFF );
12305 *p++ = (unsigned char)( ( ssl->in_window_top ) & 0xFF );
12306
12307 *p++ = (unsigned char)( ( ssl->in_window >> 56 ) & 0xFF );
12308 *p++ = (unsigned char)( ( ssl->in_window >> 48 ) & 0xFF );
12309 *p++ = (unsigned char)( ( ssl->in_window >> 40 ) & 0xFF );
12310 *p++ = (unsigned char)( ( ssl->in_window >> 32 ) & 0xFF );
12311 *p++ = (unsigned char)( ( ssl->in_window >> 24 ) & 0xFF );
12312 *p++ = (unsigned char)( ( ssl->in_window >> 16 ) & 0xFF );
12313 *p++ = (unsigned char)( ( ssl->in_window >> 8 ) & 0xFF );
12314 *p++ = (unsigned char)( ( ssl->in_window ) & 0xFF );
12315 }
12316#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12317
12318#if defined(MBEDTLS_SSL_PROTO_DTLS)
12319 used += 1;
12320 if( used <= buf_len )
12321 {
12322 *p++ = ssl->disable_datagram_packing;
12323 }
12324#endif /* MBEDTLS_SSL_PROTO_DTLS */
12325
12326 used += 8;
12327 if( used <= buf_len )
12328 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012329 mbedtls_platform_memcpy( p, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012330 p += 8;
12331 }
12332
12333#if defined(MBEDTLS_SSL_PROTO_DTLS)
12334 used += 2;
12335 if( used <= buf_len )
12336 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012337 p = mbedtls_platform_put_uint16_be( p, ssl->mtu );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012338 }
12339#endif /* MBEDTLS_SSL_PROTO_DTLS */
12340
12341#if defined(MBEDTLS_SSL_ALPN)
12342 {
12343 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnard7af73752019-07-24 00:58:27 +020012344 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012345 : 0;
12346
12347 used += 1 + alpn_len;
12348 if( used <= buf_len )
12349 {
12350 *p++ = alpn_len;
12351
12352 if( ssl->alpn_chosen != NULL )
12353 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012354 mbedtls_platform_memcpy( p, ssl->alpn_chosen, alpn_len );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012355 p += alpn_len;
12356 }
12357 }
12358 }
12359#endif /* MBEDTLS_SSL_ALPN */
12360
12361 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012362 * Done
12363 */
12364 *olen = used;
12365
12366 if( used > buf_len )
12367 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012368
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012369 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
12370
Manuel Pégourié-Gonnardbc847ca2019-07-23 14:51:09 +020012371 return( ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012372}
12373
12374/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012375 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012376 *
12377 * This internal version is wrapped by a public function that cleans up in
12378 * case of error.
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012379 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012380static int ssl_context_load( mbedtls_ssl_context *ssl,
12381 const unsigned char *buf,
12382 size_t len )
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012383{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012384 const unsigned char *p = buf;
12385 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012386 size_t session_len;
12387 int ret;
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012388
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012389 /*
12390 * The context should have been freshly setup or reset.
12391 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard14e2a8a2019-07-26 16:31:53 +020012392 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012393 * renegotiating, or if the user mistakenly loaded a session first.)
12394 */
12395 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
12396 ssl->session != NULL )
12397 {
12398 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12399 }
12400
12401 /*
12402 * We can't check that the config matches the initial one, but we can at
12403 * least check it matches the requirements for serializing.
12404 */
12405 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012406 mbedtls_ssl_ver_lt(
12407 mbedtls_ssl_conf_get_max_major_ver( ssl->conf ),
12408 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
12409 mbedtls_ssl_ver_gt(
12410 mbedtls_ssl_conf_get_min_major_ver( ssl->conf ),
12411 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
12412 mbedtls_ssl_ver_lt(
12413 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ),
12414 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
12415 mbedtls_ssl_ver_gt(
12416 mbedtls_ssl_conf_get_min_minor_ver( ssl->conf ),
12417 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020012418 mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012419 {
12420 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12421 }
12422
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012423 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
12424
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012425 /*
12426 * Check version identifier
12427 */
12428 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
12429 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12430
Teppo Järvelin650343c2019-10-03 15:36:59 +030012431 // use regular memcmp as header is not that critical
12432 if( memcmp( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012433 sizeof( ssl_serialized_context_header ) ) != 0 )
12434 {
12435 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
12436 }
12437 p += sizeof( ssl_serialized_context_header );
12438
12439 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012440 * Session
12441 */
12442 if( (size_t)( end - p ) < 4 )
12443 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12444
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012445 session_len = mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012446 p += 4;
12447
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012448 /* This has been allocated by ssl_handshake_init(), called by
12449 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12450 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012451 ssl->session_in = ssl->session;
12452 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012453 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012454
12455 if( (size_t)( end - p ) < session_len )
12456 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12457
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012458 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012459 if( ret != 0 )
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012460 {
12461 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012462 return( ret );
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012463 }
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012464
12465 p += session_len;
12466
12467 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012468 * Transform
12469 */
12470
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012471 /* This has been allocated by ssl_handshake_init(), called by
12472 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12473 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012474 ssl->transform_in = ssl->transform;
12475 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012476 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012477
12478 /* Read random bytes and populate structure */
12479 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
12480 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12481
12482 ret = ssl_populate_transform( ssl->transform,
12483 mbedtls_ssl_session_get_ciphersuite( ssl->session ),
12484 ssl->session->master,
12485#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
12486#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12487 ssl->session->encrypt_then_mac,
12488#endif
12489#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
12490 ssl->session->trunc_hmac,
12491#endif
12492#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
12493#if defined(MBEDTLS_ZLIB_SUPPORT)
12494 ssl->session->compression,
12495#endif
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012496 p, /* currently pointing to randbytes */
12497 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
12498 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
12499 ssl );
12500 if( ret != 0 )
12501 return( ret );
12502
12503 p += sizeof( ssl->transform->randbytes );
12504
12505#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12506 /* Read connection IDs and store them */
12507 if( (size_t)( end - p ) < 1 )
12508 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12509
12510 ssl->transform->in_cid_len = *p++;
12511
Manuel Pégourié-Gonnard2f3fa622019-07-23 15:02:54 +020012512 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012513 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12514
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012515 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12516 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012517 p += ssl->transform->in_cid_len;
12518
12519 ssl->transform->out_cid_len = *p++;
12520
12521 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
12522 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12523
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012524 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12525 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012526 p += ssl->transform->out_cid_len;
12527#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12528
12529 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012530 * Saved fields from top-level ssl_context structure
12531 */
12532#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12533 if( (size_t)( end - p ) < 4 )
12534 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12535
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012536 ssl->badmac_seen = (unsigned)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012537 p += 4;
12538#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12539
12540#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12541 if( (size_t)( end - p ) < 16 )
12542 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12543
12544 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
12545 ( (uint64_t) p[1] << 48 ) |
12546 ( (uint64_t) p[2] << 40 ) |
12547 ( (uint64_t) p[3] << 32 ) |
12548 ( (uint64_t) p[4] << 24 ) |
12549 ( (uint64_t) p[5] << 16 ) |
12550 ( (uint64_t) p[6] << 8 ) |
12551 ( (uint64_t) p[7] );
12552 p += 8;
12553
12554 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
12555 ( (uint64_t) p[1] << 48 ) |
12556 ( (uint64_t) p[2] << 40 ) |
12557 ( (uint64_t) p[3] << 32 ) |
12558 ( (uint64_t) p[4] << 24 ) |
12559 ( (uint64_t) p[5] << 16 ) |
12560 ( (uint64_t) p[6] << 8 ) |
12561 ( (uint64_t) p[7] );
12562 p += 8;
12563#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12564
12565#if defined(MBEDTLS_SSL_PROTO_DTLS)
12566 if( (size_t)( end - p ) < 1 )
12567 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12568
12569 ssl->disable_datagram_packing = *p++;
12570#endif /* MBEDTLS_SSL_PROTO_DTLS */
12571
12572 if( (size_t)( end - p ) < 8 )
12573 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12574
Teppo Järvelin91d79382019-10-02 09:09:31 +030012575 mbedtls_platform_memcpy( ssl->cur_out_ctr, p, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012576 p += 8;
12577
12578#if defined(MBEDTLS_SSL_PROTO_DTLS)
12579 if( (size_t)( end - p ) < 2 )
12580 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012581 ssl->mtu = (uint16_t)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012582 p += 2;
12583#endif /* MBEDTLS_SSL_PROTO_DTLS */
12584
12585#if defined(MBEDTLS_SSL_ALPN)
12586 {
12587 uint8_t alpn_len;
12588 const char **cur;
12589
12590 if( (size_t)( end - p ) < 1 )
12591 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12592
12593 alpn_len = *p++;
12594
12595 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
12596 {
12597 /* alpn_chosen should point to an item in the configured list */
12598 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
12599 {
12600 if( strlen( *cur ) == alpn_len &&
Piotr Nowickie3c4ee52020-06-23 12:59:56 +020012601 mbedtls_platform_memequal( p, cur, alpn_len ) == 0 )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012602 {
12603 ssl->alpn_chosen = *cur;
12604 break;
12605 }
12606 }
12607 }
12608
12609 /* can only happen on conf mismatch */
12610 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
12611 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12612
12613 p += alpn_len;
12614 }
12615#endif /* MBEDTLS_SSL_ALPN */
12616
12617 /*
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012618 * Forced fields from top-level ssl_context structure
12619 *
12620 * Most of them already set to the correct value by mbedtls_ssl_init() and
12621 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
12622 */
12623 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
12624
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012625#if !defined(MBEDTLS_SSL_CONF_FIXED_MAJOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012626 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012627#endif /* !MBEDTLS_SSL_CONF_FIXED_MAJOR_VER */
12628#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012629 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012630#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012631
Hanno Becker83985822019-08-30 10:42:49 +010012632 /* Adjust pointers for header fields of outgoing records to
12633 * the given transform, accounting for explicit IV and CID. */
12634 ssl_update_out_pointers( ssl, ssl->transform );
12635
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012636#if defined(MBEDTLS_SSL_PROTO_DTLS)
12637 ssl->in_epoch = 1;
12638#endif
12639
12640 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
12641 * which we don't want - otherwise we'd end up freeing the wrong transform
12642 * by calling ssl_handshake_wrapup_free_hs_transform() inappropriately. */
12643 if( ssl->handshake != NULL )
12644 {
12645 mbedtls_ssl_handshake_free( ssl );
12646 mbedtls_free( ssl->handshake );
12647 ssl->handshake = NULL;
12648 }
12649
12650 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012651 * Done - should have consumed entire buffer
12652 */
12653 if( p != end )
12654 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012655
12656 return( 0 );
12657}
12658
12659/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012660 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012661 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012662int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012663 const unsigned char *buf,
12664 size_t len )
12665{
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012666 int ret = ssl_context_load( context, buf, len );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012667
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012668 if( ret != 0 )
12669 mbedtls_ssl_free( context );
12670
12671 return( ret );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012672}
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012673#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012674
12675/*
Paul Bakker5121ce52009-01-03 21:22:43 +000012676 * Free an SSL context
12677 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012678void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000012679{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012680 if( ssl == NULL )
12681 return;
12682
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012683 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012684
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012685 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012686 {
Andrzej Kurekf3844952020-10-16 23:03:01 +020012687#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12688 size_t out_buf_len = ssl->out_buf_len;
12689#else
12690 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
12691#endif
12692 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012693 mbedtls_free( ssl->out_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012694 }
12695
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012696 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012697 {
Andrzej Kurekf3844952020-10-16 23:03:01 +020012698#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12699 size_t in_buf_len = ssl->in_buf_len;
12700#else
12701 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
12702#endif
12703 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012704 mbedtls_free( ssl->in_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012705 }
12706
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012707#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker16770332013-10-11 09:59:44 +020012708 if( ssl->compress_buf != NULL )
12709 {
Angus Grattond8213d02016-05-25 20:56:48 +100012710 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012711 mbedtls_free( ssl->compress_buf );
Paul Bakker16770332013-10-11 09:59:44 +020012712 }
12713#endif
12714
Paul Bakker48916f92012-09-16 19:57:18 +000012715 if( ssl->transform )
12716 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012717 mbedtls_ssl_transform_free( ssl->transform );
12718 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +000012719 }
12720
12721 if( ssl->handshake )
12722 {
Gilles Peskine9b562d52018-04-25 20:32:43 +020012723 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012724 mbedtls_ssl_transform_free( ssl->transform_negotiate );
12725 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012726
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012727 mbedtls_free( ssl->handshake );
12728 mbedtls_free( ssl->transform_negotiate );
12729 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012730 }
12731
Paul Bakkerc0463502013-02-14 11:19:38 +010012732 if( ssl->session )
12733 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012734 mbedtls_ssl_session_free( ssl->session );
12735 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +010012736 }
12737
Teppo Järvelin4009d8f2019-08-19 14:48:09 +030012738#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Paul Bakker66d5d072014-06-17 16:39:18 +020012739 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012740 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012741 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012742 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +000012743 }
Paul Bakker0be444a2013-08-27 21:55:01 +020012744#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000012745
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012746#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
12747 if( mbedtls_ssl_hw_record_finish != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +000012748 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012749 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
12750 mbedtls_ssl_hw_record_finish( ssl );
Paul Bakker05ef8352012-05-08 09:17:57 +000012751 }
12752#endif
12753
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012754#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012755 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020012756#endif
12757
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012758 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +000012759
Paul Bakker86f04f42013-02-14 11:20:09 +010012760 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012761 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012762}
12763
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012764/*
12765 * Initialze mbedtls_ssl_config
12766 */
12767void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
12768{
12769 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnarde744eab2019-03-18 10:51:18 +010012770
12771#if !defined(MBEDTLS_SSL_PROTO_TLS)
12772 conf->transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
12773#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012774}
12775
Simon Butcherc97b6972015-12-27 23:48:17 +000012776#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012777#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012778static int ssl_preset_default_hashes[] = {
12779#if defined(MBEDTLS_SHA512_C)
12780 MBEDTLS_MD_SHA512,
12781 MBEDTLS_MD_SHA384,
12782#endif
12783#if defined(MBEDTLS_SHA256_C)
12784 MBEDTLS_MD_SHA256,
12785 MBEDTLS_MD_SHA224,
12786#endif
Gilles Peskine5d2511c2017-05-12 13:16:40 +020012787#if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012788 MBEDTLS_MD_SHA1,
12789#endif
12790 MBEDTLS_MD_NONE
12791};
Simon Butcherc97b6972015-12-27 23:48:17 +000012792#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012793#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012794
Hanno Becker73f4cb12019-06-27 13:51:07 +010012795#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012796static int ssl_preset_suiteb_ciphersuites[] = {
12797 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
12798 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
12799 0
12800};
Hanno Becker73f4cb12019-06-27 13:51:07 +010012801#endif /* !MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012802
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012803#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012804#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012805static int ssl_preset_suiteb_hashes[] = {
12806 MBEDTLS_MD_SHA256,
12807 MBEDTLS_MD_SHA384,
12808 MBEDTLS_MD_NONE
12809};
12810#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012811#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012812
Hanno Beckerc1096e72019-06-19 12:30:41 +010012813#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012814static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
Jaeden Amero16529b22019-06-03 08:27:16 +010012815#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012816 MBEDTLS_ECP_DP_SECP256R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012817#endif
12818#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012819 MBEDTLS_ECP_DP_SECP384R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012820#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012821 MBEDTLS_ECP_DP_NONE
12822};
12823#endif
12824
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012825/*
Tillmann Karras588ad502015-09-25 04:27:22 +020012826 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012827 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012828int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012829 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012830{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012831#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012832 int ret;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012833#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012834
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +020012835 /* Use the functions here so that they are covered in tests,
12836 * but otherwise access member directly for efficiency */
12837 mbedtls_ssl_conf_endpoint( conf, endpoint );
12838 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012839
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012840 /*
12841 * Things that are common to all presets
12842 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012843#if defined(MBEDTLS_SSL_CLI_C)
12844 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
12845 {
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012846#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012847 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012848#endif /* !MBEDTLS_SSL_CONF_AUTHMODE */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012849#if defined(MBEDTLS_SSL_SESSION_TICKETS)
12850 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
12851#endif
12852 }
12853#endif
12854
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012855#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012856 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012857#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012858
12859#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12860 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
12861#endif
12862
12863#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckeraabbb582019-06-11 13:43:27 +010012864#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012865 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012866#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
12867#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsad9382f82019-06-10 10:27:14 +030012868 conf->enforce_extended_master_secret =
Jarno Lamsa18b9a492019-06-10 15:23:29 +030012869 MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012870#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012871#endif
12872
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010012873#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
12874 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
12875#endif
12876
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012877#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012878 conf->f_cookie_write = ssl_cookie_write_dummy;
12879 conf->f_cookie_check = ssl_cookie_check_dummy;
12880#endif
12881
Hanno Becker7f376f42019-06-12 16:20:48 +010012882#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
12883 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012884 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
12885#endif
12886
Janos Follath088ce432017-04-10 12:42:31 +010012887#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012888#if !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +010012889 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012890#endif /* !MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST */
12891#endif /* MBEDTLS_SSL_SRV_C */
Janos Follath088ce432017-04-10 12:42:31 +010012892
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012893#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker1f835fa2019-06-13 10:14:59 +010012894#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012895 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012896#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN */
12897#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012898 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012899#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
12900#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012901
12902#if defined(MBEDTLS_SSL_RENEGOTIATION)
12903 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020012904 mbedtls_platform_memset( conf->renego_period, 0x00, 2 );
12905 mbedtls_platform_memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012906#endif
12907
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012908#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
12909 if( endpoint == MBEDTLS_SSL_IS_SERVER )
12910 {
Hanno Becker00d0a682017-10-04 13:14:29 +010012911 const unsigned char dhm_p[] =
12912 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
12913 const unsigned char dhm_g[] =
12914 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
12915
Hanno Beckera90658f2017-10-04 15:29:08 +010012916 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
12917 dhm_p, sizeof( dhm_p ),
12918 dhm_g, sizeof( dhm_g ) ) ) != 0 )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012919 {
12920 return( ret );
12921 }
12922 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +020012923#endif
12924
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012925 /*
12926 * Preset-specific defaults
12927 */
12928 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012929 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012930 /*
12931 * NSA Suite B
12932 */
12933 case MBEDTLS_SSL_PRESET_SUITEB:
Hanno Beckere965bd32019-06-12 14:04:34 +010012934#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012935 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Hanno Beckere965bd32019-06-12 14:04:34 +010012936#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12937#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012938 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
Hanno Beckere965bd32019-06-12 14:04:34 +010012939#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
12940#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012941 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012942#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
12943#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012944 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012945#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012946
Hanno Becker73f4cb12019-06-27 13:51:07 +010012947#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012948 conf->ciphersuite_list[0] =
12949 conf->ciphersuite_list[1] =
12950 conf->ciphersuite_list[2] =
12951 conf->ciphersuite_list[3] =
12952 ssl_preset_suiteb_ciphersuites;
Hanno Becker73f4cb12019-06-27 13:51:07 +010012953#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012954
12955#if defined(MBEDTLS_X509_CRT_PARSE_C)
12956 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012957#endif
12958
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012959#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012960#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012961 conf->sig_hashes = ssl_preset_suiteb_hashes;
12962#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012963#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012964
12965#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010012966#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012967 conf->curve_list = ssl_preset_suiteb_curves;
12968#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010012969#endif
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +020012970 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012971
12972 /*
12973 * Default
12974 */
12975 default:
Hanno Beckere965bd32019-06-12 14:04:34 +010012976#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030012977 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
12978 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
12979 MBEDTLS_SSL_MIN_MAJOR_VERSION :
12980 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012981#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12982#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030012983 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
12984 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
12985 MBEDTLS_SSL_MIN_MINOR_VERSION :
12986 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012987#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020012988 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( transport ) )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012989 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
12990#endif
Hanno Beckere965bd32019-06-12 14:04:34 +010012991#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
12992#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
12993 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
12994#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
12995#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
12996 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
12997#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012998
Hanno Becker73f4cb12019-06-27 13:51:07 +010012999#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010013000 conf->ciphersuite_list[0] =
13001 conf->ciphersuite_list[1] =
13002 conf->ciphersuite_list[2] =
13003 conf->ciphersuite_list[3] =
13004 mbedtls_ssl_list_ciphersuites();
Hanno Becker73f4cb12019-06-27 13:51:07 +010013005#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013006
13007#if defined(MBEDTLS_X509_CRT_PARSE_C)
13008 conf->cert_profile = &mbedtls_x509_crt_profile_default;
13009#endif
13010
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013011#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010013012#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010013013 conf->sig_hashes = ssl_preset_default_hashes;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013014#endif
Hanno Becker56595f42019-06-19 16:31:38 +010013015#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013016
13017#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010013018#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013019 conf->curve_list = mbedtls_ecp_grp_id_list();
13020#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010013021#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013022
13023#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
13024 conf->dhm_min_bitlen = 1024;
13025#endif
13026 }
13027
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013028 return( 0 );
13029}
13030
13031/*
13032 * Free mbedtls_ssl_config
13033 */
13034void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
13035{
13036#if defined(MBEDTLS_DHM_C)
13037 mbedtls_mpi_free( &conf->dhm_P );
13038 mbedtls_mpi_free( &conf->dhm_G );
13039#endif
13040
13041#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
13042 if( conf->psk != NULL )
13043 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013044 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013045 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +000013046 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013047 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +090013048 }
13049
13050 if( conf->psk_identity != NULL )
13051 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013052 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +090013053 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +000013054 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013055 conf->psk_identity_len = 0;
13056 }
13057#endif
13058
13059#if defined(MBEDTLS_X509_CRT_PARSE_C)
13060 ssl_key_cert_free( conf->key_cert );
13061#endif
13062
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013063 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013064}
13065
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020013066#if defined(MBEDTLS_PK_C) && \
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013067 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) ) || \
13068 ( defined(MBEDTLS_USE_TINYCRYPT) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013069/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013070 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013071 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013072unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013073{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013074#if defined(MBEDTLS_RSA_C)
13075 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
13076 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013077#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013078#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013079 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
13080 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013081#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013082 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013083}
13084
Hanno Becker7e5437a2017-04-28 17:15:26 +010013085unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
13086{
13087 switch( type ) {
13088 case MBEDTLS_PK_RSA:
13089 return( MBEDTLS_SSL_SIG_RSA );
13090 case MBEDTLS_PK_ECDSA:
13091 case MBEDTLS_PK_ECKEY:
13092 return( MBEDTLS_SSL_SIG_ECDSA );
13093 default:
13094 return( MBEDTLS_SSL_SIG_ANON );
13095 }
13096}
13097
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013098mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013099{
13100 switch( sig )
13101 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013102#if defined(MBEDTLS_RSA_C)
13103 case MBEDTLS_SSL_SIG_RSA:
13104 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013105#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013106#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013107 case MBEDTLS_SSL_SIG_ECDSA:
13108 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013109#endif
13110 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013111 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013112 }
13113}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020013114#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013115
Hanno Becker7e5437a2017-04-28 17:15:26 +010013116#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
13117 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
13118
13119/* Find an entry in a signature-hash set matching a given hash algorithm. */
13120mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
13121 mbedtls_pk_type_t sig_alg )
13122{
13123 switch( sig_alg )
13124 {
13125 case MBEDTLS_PK_RSA:
13126 return( set->rsa );
13127 case MBEDTLS_PK_ECDSA:
13128 return( set->ecdsa );
13129 default:
13130 return( MBEDTLS_MD_NONE );
13131 }
13132}
13133
13134/* Add a signature-hash-pair to a signature-hash set */
13135void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
13136 mbedtls_pk_type_t sig_alg,
13137 mbedtls_md_type_t md_alg )
13138{
13139 switch( sig_alg )
13140 {
13141 case MBEDTLS_PK_RSA:
13142 if( set->rsa == MBEDTLS_MD_NONE )
13143 set->rsa = md_alg;
13144 break;
13145
13146 case MBEDTLS_PK_ECDSA:
13147 if( set->ecdsa == MBEDTLS_MD_NONE )
13148 set->ecdsa = md_alg;
13149 break;
13150
13151 default:
13152 break;
13153 }
13154}
13155
13156/* Allow exactly one hash algorithm for each signature. */
13157void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
13158 mbedtls_md_type_t md_alg )
13159{
13160 set->rsa = md_alg;
13161 set->ecdsa = md_alg;
13162}
13163
13164#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
13165 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
13166
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020013167/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013168 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020013169 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013170mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013171{
13172 switch( hash )
13173 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013174#if defined(MBEDTLS_MD5_C)
13175 case MBEDTLS_SSL_HASH_MD5:
13176 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013177#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013178#if defined(MBEDTLS_SHA1_C)
13179 case MBEDTLS_SSL_HASH_SHA1:
13180 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013181#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013182#if defined(MBEDTLS_SHA256_C)
13183 case MBEDTLS_SSL_HASH_SHA224:
13184 return( MBEDTLS_MD_SHA224 );
13185 case MBEDTLS_SSL_HASH_SHA256:
13186 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013187#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013188#if defined(MBEDTLS_SHA512_C)
13189 case MBEDTLS_SSL_HASH_SHA384:
13190 return( MBEDTLS_MD_SHA384 );
13191 case MBEDTLS_SSL_HASH_SHA512:
13192 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013193#endif
13194 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013195 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013196 }
13197}
13198
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013199/*
13200 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
13201 */
13202unsigned char mbedtls_ssl_hash_from_md_alg( int md )
13203{
13204 switch( md )
13205 {
13206#if defined(MBEDTLS_MD5_C)
13207 case MBEDTLS_MD_MD5:
13208 return( MBEDTLS_SSL_HASH_MD5 );
13209#endif
13210#if defined(MBEDTLS_SHA1_C)
13211 case MBEDTLS_MD_SHA1:
13212 return( MBEDTLS_SSL_HASH_SHA1 );
13213#endif
13214#if defined(MBEDTLS_SHA256_C)
13215 case MBEDTLS_MD_SHA224:
13216 return( MBEDTLS_SSL_HASH_SHA224 );
13217 case MBEDTLS_MD_SHA256:
13218 return( MBEDTLS_SSL_HASH_SHA256 );
13219#endif
13220#if defined(MBEDTLS_SHA512_C)
13221 case MBEDTLS_MD_SHA384:
13222 return( MBEDTLS_SSL_HASH_SHA384 );
13223 case MBEDTLS_MD_SHA512:
13224 return( MBEDTLS_SSL_HASH_SHA512 );
13225#endif
13226 default:
13227 return( MBEDTLS_SSL_HASH_NONE );
13228 }
13229}
13230
Hanno Beckeree902df2019-08-23 13:47:47 +010013231#if defined(MBEDTLS_USE_TINYCRYPT)
13232/*
13233 * Check if a curve proposed by the peer is in our list.
13234 * Return 0 if we're willing to use it, -1 otherwise.
13235 */
13236int mbedtls_ssl_check_curve_uecc( const mbedtls_ssl_context *ssl,
13237 mbedtls_uecc_group_id grp_id )
13238{
13239 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_UECC_GRP_ID( own_ec_id )
13240 if( own_ec_id == grp_id )
13241 return( 0 );
13242 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_UECC_GRP_ID
13243
13244 return( -1 );
13245}
13246#endif /* MBEDTLS_USE_TINYCRYPT */
13247
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020013248#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013249/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013250 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020013251 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013252 */
Hanno Beckeree902df2019-08-23 13:47:47 +010013253int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl,
13254 mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013255{
Hanno Beckera4a9c692019-06-18 16:55:47 +010013256 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_EC_GRP_ID( own_ec_id )
13257 if( own_ec_id == grp_id )
13258 return( 0 );
13259 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_EC_GRP_ID
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013260
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020013261 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013262}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020013263#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013264
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013265#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013266/*
13267 * Check if a hash proposed by the peer is in our list.
13268 * Return 0 if we're willing to use it, -1 otherwise.
13269 */
13270int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
13271 mbedtls_md_type_t md )
13272{
Hanno Beckerf1bc9e12019-06-19 16:23:21 +010013273 MBEDTLS_SSL_BEGIN_FOR_EACH_SIG_HASH( md_alg )
13274 if( md_alg == md )
13275 return( 0 );
13276 MBEDTLS_SSL_END_FOR_EACH_SIG_HASH
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013277
13278 return( -1 );
13279}
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013280#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013281
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013282#if defined(MBEDTLS_X509_CRT_PARSE_C)
13283int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
Hanno Becker473f98f2019-06-26 10:27:32 +010013284 mbedtls_ssl_ciphersuite_handle_t ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013285 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020013286 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013287{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013288 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013289#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013290 int usage = 0;
13291#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013292#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013293 const char *ext_oid;
13294 size_t ext_len;
13295#endif
13296
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013297#if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
13298 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013299 ((void) cert);
13300 ((void) cert_endpoint);
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013301 ((void) flags);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013302#endif
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013303
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013304#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
13305 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013306 {
13307 /* Server part of the key exchange */
Hanno Becker473f98f2019-06-26 10:27:32 +010013308 switch( mbedtls_ssl_suite_get_key_exchange( ciphersuite ) )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013309 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013310 case MBEDTLS_KEY_EXCHANGE_RSA:
13311 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013312 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013313 break;
13314
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013315 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
13316 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
13317 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
13318 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013319 break;
13320
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013321 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
13322 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013323 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013324 break;
13325
13326 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013327 case MBEDTLS_KEY_EXCHANGE_NONE:
13328 case MBEDTLS_KEY_EXCHANGE_PSK:
13329 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
13330 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +020013331 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013332 usage = 0;
13333 }
13334 }
13335 else
13336 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013337 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
13338 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013339 }
13340
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013341 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013342 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013343 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013344 ret = -1;
13345 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013346#else
13347 ((void) ciphersuite);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013348#endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013349
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013350#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
13351 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013352 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013353 ext_oid = MBEDTLS_OID_SERVER_AUTH;
13354 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013355 }
13356 else
13357 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013358 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
13359 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013360 }
13361
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013362 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013363 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013364 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013365 ret = -1;
13366 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013367#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013368
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013369 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013370}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013371#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +020013372
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013373#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
13374 defined(MBEDTLS_SSL_PROTO_TLS1_1)
13375int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
13376 unsigned char *output,
13377 unsigned char *data, size_t data_len )
13378{
13379 int ret = 0;
13380 mbedtls_md5_context mbedtls_md5;
13381 mbedtls_sha1_context mbedtls_sha1;
13382
13383 mbedtls_md5_init( &mbedtls_md5 );
13384 mbedtls_sha1_init( &mbedtls_sha1 );
13385
13386 /*
13387 * digitally-signed struct {
13388 * opaque md5_hash[16];
13389 * opaque sha_hash[20];
13390 * };
13391 *
13392 * md5_hash
13393 * MD5(ClientHello.random + ServerHello.random
13394 * + ServerParams);
13395 * sha_hash
13396 * SHA(ClientHello.random + ServerHello.random
13397 * + ServerParams);
13398 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013399 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013400 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013401 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013402 goto exit;
13403 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013404 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013405 ssl->handshake->randbytes, 64 ) ) != 0 )
13406 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013407 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013408 goto exit;
13409 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013410 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013411 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013412 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013413 goto exit;
13414 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013415 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013416 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013417 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013418 goto exit;
13419 }
13420
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013421 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013422 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013423 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013424 goto exit;
13425 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013426 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013427 ssl->handshake->randbytes, 64 ) ) != 0 )
13428 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013429 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013430 goto exit;
13431 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013432 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013433 data_len ) ) != 0 )
13434 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013435 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013436 goto exit;
13437 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013438 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013439 output + 16 ) ) != 0 )
13440 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013441 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013442 goto exit;
13443 }
13444
13445exit:
13446 mbedtls_md5_free( &mbedtls_md5 );
13447 mbedtls_sha1_free( &mbedtls_sha1 );
13448
13449 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013450 mbedtls_ssl_pend_fatal_alert( ssl,
13451 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013452
13453 return( ret );
13454
13455}
13456#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
13457 MBEDTLS_SSL_PROTO_TLS1_1 */
13458
13459#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
13460 defined(MBEDTLS_SSL_PROTO_TLS1_2)
13461int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +020013462 unsigned char *hash, size_t *hashlen,
13463 unsigned char *data, size_t data_len,
13464 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013465{
13466 int ret = 0;
13467 mbedtls_md_context_t ctx;
Andrzej Kurek84bde412020-07-06 15:27:34 -040013468
Hanno Beckera5cedbc2019-07-17 11:21:02 +010013469 mbedtls_md_handle_t md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +020013470 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013471
13472 mbedtls_md_init( &ctx );
13473
13474 /*
13475 * digitally-signed struct {
13476 * opaque client_random[32];
13477 * opaque server_random[32];
13478 * ServerDHParams params;
13479 * };
13480 */
13481 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
13482 {
13483 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
13484 goto exit;
13485 }
13486 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
13487 {
13488 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
13489 goto exit;
13490 }
13491 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
13492 {
13493 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13494 goto exit;
13495 }
13496 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
13497 {
13498 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13499 goto exit;
13500 }
Gilles Peskineca1d7422018-04-24 11:53:22 +020013501 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013502 {
13503 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
13504 goto exit;
13505 }
13506
13507exit:
13508 mbedtls_md_free( &ctx );
13509
13510 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013511 mbedtls_ssl_pend_fatal_alert( ssl,
13512 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013513
Andrzej Kurekafec8852020-07-15 16:31:27 -040013514 return( ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013515}
13516#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
13517 MBEDTLS_SSL_PROTO_TLS1_2 */
13518
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013519#endif /* MBEDTLS_SSL_TLS_C */