blob: fdec4904ef12c96bbbf8da1c0ca6e8ddeeb8ce14 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Jerry Yub476a442022-01-21 18:14:45 +080028#include <assert.h>
29
SimonBd5800b72016-04-26 07:43:27 +010030#include "mbedtls/platform.h"
SimonBd5800b72016-04-26 07:43:27 +010031
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000032#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010033#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010034#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000035#include "ssl_misc.h"
Andrzej Kurek25f27152022-08-17 16:09:31 -040036
Janos Follath73c616b2019-12-18 15:07:04 +000037#include "mbedtls/debug.h"
38#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050039#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010040#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020041#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020042
Rich Evans00ab4702015-02-06 13:43:58 +000043#include <string.h>
44
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050045#if defined(MBEDTLS_USE_PSA_CRYPTO)
46#include "mbedtls/psa_util.h"
47#include "psa/crypto.h"
48#endif
Manuel Pégourié-Gonnard07018f92022-09-15 11:29:35 +020049#include "mbedtls/legacy_or_psa.h"
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050050
Janos Follath23bdca02016-10-07 14:47:14 +010051#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000052#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020053#endif
54
Ronald Cronad8c17b2022-06-10 17:18:09 +020055#if defined(MBEDTLS_TEST_HOOKS)
56static mbedtls_ssl_chk_buf_ptr_args chk_buf_ptr_fail_args;
57
58void mbedtls_ssl_set_chk_buf_ptr_fail_args(
Gilles Peskine449bd832023-01-11 14:50:10 +010059 const uint8_t *cur, const uint8_t *end, size_t need)
Ronald Cronad8c17b2022-06-10 17:18:09 +020060{
61 chk_buf_ptr_fail_args.cur = cur;
62 chk_buf_ptr_fail_args.end = end;
63 chk_buf_ptr_fail_args.need = need;
64}
65
Gilles Peskine449bd832023-01-11 14:50:10 +010066void mbedtls_ssl_reset_chk_buf_ptr_fail_args(void)
Ronald Cronad8c17b2022-06-10 17:18:09 +020067{
Gilles Peskine449bd832023-01-11 14:50:10 +010068 memset(&chk_buf_ptr_fail_args, 0, sizeof(chk_buf_ptr_fail_args));
Ronald Cronad8c17b2022-06-10 17:18:09 +020069}
70
Gilles Peskine449bd832023-01-11 14:50:10 +010071int mbedtls_ssl_cmp_chk_buf_ptr_fail_args(mbedtls_ssl_chk_buf_ptr_args *args)
Ronald Cronad8c17b2022-06-10 17:18:09 +020072{
Gilles Peskine449bd832023-01-11 14:50:10 +010073 return (chk_buf_ptr_fail_args.cur != args->cur) ||
74 (chk_buf_ptr_fail_args.end != args->end) ||
75 (chk_buf_ptr_fail_args.need != args->need);
Ronald Cronad8c17b2022-06-10 17:18:09 +020076}
77#endif /* MBEDTLS_TEST_HOOKS */
78
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020079#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010080
Hanno Beckera0e20d02019-05-15 14:03:01 +010081#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010082/* Top-level Connection ID API */
83
Gilles Peskine449bd832023-01-11 14:50:10 +010084int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf,
85 size_t len,
86 int ignore_other_cid)
Hanno Beckerad4a1372019-05-03 13:06:44 +010087{
Gilles Peskine449bd832023-01-11 14:50:10 +010088 if (len > MBEDTLS_SSL_CID_IN_LEN_MAX) {
89 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
90 }
Hanno Beckerad4a1372019-05-03 13:06:44 +010091
Gilles Peskine449bd832023-01-11 14:50:10 +010092 if (ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
93 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE) {
94 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker611ac772019-05-14 11:45:26 +010095 }
96
97 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010098 conf->cid_len = len;
Gilles Peskine449bd832023-01-11 14:50:10 +010099 return 0;
Hanno Beckerad4a1372019-05-03 13:06:44 +0100100}
101
Gilles Peskine449bd832023-01-11 14:50:10 +0100102int mbedtls_ssl_set_cid(mbedtls_ssl_context *ssl,
103 int enable,
104 unsigned char const *own_cid,
105 size_t own_cid_len)
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100106{
Gilles Peskine449bd832023-01-11 14:50:10 +0100107 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
108 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
109 }
Hanno Becker76a79ab2019-05-03 14:38:32 +0100110
Hanno Beckerca092242019-04-25 16:01:49 +0100111 ssl->negotiate_cid = enable;
Gilles Peskine449bd832023-01-11 14:50:10 +0100112 if (enable == MBEDTLS_SSL_CID_DISABLED) {
113 MBEDTLS_SSL_DEBUG_MSG(3, ("Disable use of CID extension."));
114 return 0;
Hanno Beckerca092242019-04-25 16:01:49 +0100115 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100116 MBEDTLS_SSL_DEBUG_MSG(3, ("Enable use of CID extension."));
117 MBEDTLS_SSL_DEBUG_BUF(3, "Own CID", own_cid, own_cid_len);
Hanno Beckerca092242019-04-25 16:01:49 +0100118
Gilles Peskine449bd832023-01-11 14:50:10 +0100119 if (own_cid_len != ssl->conf->cid_len) {
120 MBEDTLS_SSL_DEBUG_MSG(3, ("CID length %u does not match CID length %u in config",
121 (unsigned) own_cid_len,
122 (unsigned) ssl->conf->cid_len));
123 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerca092242019-04-25 16:01:49 +0100124 }
125
Gilles Peskine449bd832023-01-11 14:50:10 +0100126 memcpy(ssl->own_cid, own_cid, own_cid_len);
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100127 /* Truncation is not an issue here because
128 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
129 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100130
Gilles Peskine449bd832023-01-11 14:50:10 +0100131 return 0;
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100132}
133
Gilles Peskine449bd832023-01-11 14:50:10 +0100134int mbedtls_ssl_get_own_cid(mbedtls_ssl_context *ssl,
135 int *enabled,
136 unsigned char own_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
137 size_t *own_cid_len)
Paul Elliott0113cf12022-03-11 20:26:47 +0000138{
139 *enabled = MBEDTLS_SSL_CID_DISABLED;
140
Gilles Peskine449bd832023-01-11 14:50:10 +0100141 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
142 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
143 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000144
145 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID length is
146 * zero as this is indistinguishable from not requesting to use
147 * the CID extension. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100148 if (ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) {
149 return 0;
150 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000151
Gilles Peskine449bd832023-01-11 14:50:10 +0100152 if (own_cid_len != NULL) {
Paul Elliott0113cf12022-03-11 20:26:47 +0000153 *own_cid_len = ssl->own_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100154 if (own_cid != NULL) {
155 memcpy(own_cid, ssl->own_cid, ssl->own_cid_len);
156 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000157 }
158
159 *enabled = MBEDTLS_SSL_CID_ENABLED;
160
Gilles Peskine449bd832023-01-11 14:50:10 +0100161 return 0;
Paul Elliott0113cf12022-03-11 20:26:47 +0000162}
163
Gilles Peskine449bd832023-01-11 14:50:10 +0100164int mbedtls_ssl_get_peer_cid(mbedtls_ssl_context *ssl,
165 int *enabled,
166 unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
167 size_t *peer_cid_len)
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100168{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100169 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100170
Gilles Peskine449bd832023-01-11 14:50:10 +0100171 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
172 mbedtls_ssl_is_handshake_over(ssl) == 0) {
173 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker76a79ab2019-05-03 14:38:32 +0100174 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100175
Hanno Beckerc5f24222019-05-03 12:54:52 +0100176 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
177 * were used, but client and server requested the empty CID.
178 * This is indistinguishable from not using the CID extension
179 * in the first place. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100180 if (ssl->transform_in->in_cid_len == 0 &&
181 ssl->transform_in->out_cid_len == 0) {
182 return 0;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100183 }
184
Gilles Peskine449bd832023-01-11 14:50:10 +0100185 if (peer_cid_len != NULL) {
Hanno Becker615ef172019-05-22 16:50:35 +0100186 *peer_cid_len = ssl->transform_in->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100187 if (peer_cid != NULL) {
188 memcpy(peer_cid, ssl->transform_in->out_cid,
189 ssl->transform_in->out_cid_len);
Hanno Becker615ef172019-05-22 16:50:35 +0100190 }
191 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100192
193 *enabled = MBEDTLS_SSL_CID_ENABLED;
194
Gilles Peskine449bd832023-01-11 14:50:10 +0100195 return 0;
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100196}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100197#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100198
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200199#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200200
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200201#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200202/*
203 * Convert max_fragment_length codes to length.
204 * RFC 6066 says:
205 * enum{
206 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
207 * } MaxFragmentLength;
208 * and we add 0 -> extension unused
209 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100210static unsigned int ssl_mfl_code_to_length(int mfl)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200211{
Gilles Peskine449bd832023-01-11 14:50:10 +0100212 switch (mfl) {
213 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
214 return MBEDTLS_TLS_EXT_ADV_CONTENT_LEN;
215 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
216 return 512;
217 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
218 return 1024;
219 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
220 return 2048;
221 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
222 return 4096;
223 default:
224 return MBEDTLS_TLS_EXT_ADV_CONTENT_LEN;
Angus Grattond8213d02016-05-25 20:56:48 +1000225 }
226}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200228
Gilles Peskine449bd832023-01-11 14:50:10 +0100229int mbedtls_ssl_session_copy(mbedtls_ssl_session *dst,
230 const mbedtls_ssl_session *src)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200231{
Gilles Peskine449bd832023-01-11 14:50:10 +0100232 mbedtls_ssl_session_free(dst);
233 memcpy(dst, src, sizeof(mbedtls_ssl_session));
吴敬辉0b716112021-11-29 10:46:35 +0800234#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
235 dst->ticket = NULL;
Xiaokang Qian87306442022-10-12 09:47:38 +0000236#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
237 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000238 dst->hostname = NULL;
吴敬辉0b716112021-11-29 10:46:35 +0800239#endif
Xiaokang Qian87306442022-10-12 09:47:38 +0000240#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
吴敬辉0b716112021-11-29 10:46:35 +0800241
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200242#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000243
244#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100245 if (src->peer_cert != NULL) {
Janos Follath865b3eb2019-12-16 11:46:15 +0000246 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200247
Gilles Peskine449bd832023-01-11 14:50:10 +0100248 dst->peer_cert = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
249 if (dst->peer_cert == NULL) {
250 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
251 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200252
Gilles Peskine449bd832023-01-11 14:50:10 +0100253 mbedtls_x509_crt_init(dst->peer_cert);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200254
Gilles Peskine449bd832023-01-11 14:50:10 +0100255 if ((ret = mbedtls_x509_crt_parse_der(dst->peer_cert, src->peer_cert->raw.p,
256 src->peer_cert->raw.len)) != 0) {
257 mbedtls_free(dst->peer_cert);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200258 dst->peer_cert = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100259 return ret;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200260 }
261 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000262#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +0100263 if (src->peer_cert_digest != NULL) {
Hanno Becker9198ad12019-02-05 17:00:50 +0000264 dst->peer_cert_digest =
Gilles Peskine449bd832023-01-11 14:50:10 +0100265 mbedtls_calloc(1, src->peer_cert_digest_len);
266 if (dst->peer_cert_digest == NULL) {
267 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
268 }
Hanno Becker9198ad12019-02-05 17:00:50 +0000269
Gilles Peskine449bd832023-01-11 14:50:10 +0100270 memcpy(dst->peer_cert_digest, src->peer_cert_digest,
271 src->peer_cert_digest_len);
Hanno Becker9198ad12019-02-05 17:00:50 +0000272 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000273 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000274 }
275#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
276
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200277#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200278
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200279#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100280 if (src->ticket != NULL) {
281 dst->ticket = mbedtls_calloc(1, src->ticket_len);
282 if (dst->ticket == NULL) {
283 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
284 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200285
Gilles Peskine449bd832023-01-11 14:50:10 +0100286 memcpy(dst->ticket, src->ticket, src->ticket_len);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200287 }
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000288
289#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
290 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +0100291 if (src->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000292 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100293 ret = mbedtls_ssl_session_set_hostname(dst, src->hostname);
294 if (ret != 0) {
295 return ret;
296 }
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000297 }
298#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
299 MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200300#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200301
Gilles Peskine449bd832023-01-11 14:50:10 +0100302 return 0;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200303}
304
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500305#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200306MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100307static int resize_buffer(unsigned char **buffer, size_t len_new, size_t *len_old)
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500308{
Gilles Peskine449bd832023-01-11 14:50:10 +0100309 unsigned char *resized_buffer = mbedtls_calloc(1, len_new);
310 if (resized_buffer == NULL) {
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500311 return -1;
Gilles Peskine449bd832023-01-11 14:50:10 +0100312 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500313
314 /* We want to copy len_new bytes when downsizing the buffer, and
315 * len_old bytes when upsizing, so we choose the smaller of two sizes,
316 * to fit one buffer into another. Size checks, ensuring that no data is
317 * lost, are done outside of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100318 memcpy(resized_buffer, *buffer,
319 (len_new < *len_old) ? len_new : *len_old);
320 mbedtls_platform_zeroize(*buffer, *len_old);
321 mbedtls_free(*buffer);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500322
323 *buffer = resized_buffer;
324 *len_old = len_new;
325
326 return 0;
327}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200328
Gilles Peskine449bd832023-01-11 14:50:10 +0100329static void handle_buffer_resizing(mbedtls_ssl_context *ssl, int downsizing,
330 size_t in_buf_new_len,
331 size_t out_buf_new_len)
Andrzej Kurek4a063792020-10-21 15:08:44 +0200332{
333 int modified = 0;
334 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
335 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100336 if (ssl->in_buf != NULL) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200337 written_in = ssl->in_msg - ssl->in_buf;
338 iv_offset_in = ssl->in_iv - ssl->in_buf;
339 len_offset_in = ssl->in_len - ssl->in_buf;
Gilles Peskine449bd832023-01-11 14:50:10 +0100340 if (downsizing ?
Andrzej Kurek4a063792020-10-21 15:08:44 +0200341 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
Gilles Peskine449bd832023-01-11 14:50:10 +0100342 ssl->in_buf_len < in_buf_new_len) {
343 if (resize_buffer(&ssl->in_buf, in_buf_new_len, &ssl->in_buf_len) != 0) {
344 MBEDTLS_SSL_DEBUG_MSG(1, ("input buffer resizing failed - out of memory"));
345 } else {
346 MBEDTLS_SSL_DEBUG_MSG(2, ("Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
347 in_buf_new_len));
Andrzej Kurek4a063792020-10-21 15:08:44 +0200348 modified = 1;
349 }
350 }
351 }
352
Gilles Peskine449bd832023-01-11 14:50:10 +0100353 if (ssl->out_buf != NULL) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200354 written_out = ssl->out_msg - ssl->out_buf;
355 iv_offset_out = ssl->out_iv - ssl->out_buf;
356 len_offset_out = ssl->out_len - ssl->out_buf;
Gilles Peskine449bd832023-01-11 14:50:10 +0100357 if (downsizing ?
Andrzej Kurek4a063792020-10-21 15:08:44 +0200358 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
Gilles Peskine449bd832023-01-11 14:50:10 +0100359 ssl->out_buf_len < out_buf_new_len) {
360 if (resize_buffer(&ssl->out_buf, out_buf_new_len, &ssl->out_buf_len) != 0) {
361 MBEDTLS_SSL_DEBUG_MSG(1, ("output buffer resizing failed - out of memory"));
362 } else {
363 MBEDTLS_SSL_DEBUG_MSG(2, ("Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
364 out_buf_new_len));
Andrzej Kurek4a063792020-10-21 15:08:44 +0200365 modified = 1;
366 }
367 }
368 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100369 if (modified) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200370 /* Update pointers here to avoid doing it twice. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100371 mbedtls_ssl_reset_in_out_pointers(ssl);
Andrzej Kurek4a063792020-10-21 15:08:44 +0200372 /* Fields below might not be properly updated with record
373 * splitting or with CID, so they are manually updated here. */
374 ssl->out_msg = ssl->out_buf + written_out;
375 ssl->out_len = ssl->out_buf + len_offset_out;
376 ssl->out_iv = ssl->out_buf + iv_offset_out;
377
378 ssl->in_msg = ssl->in_buf + written_in;
379 ssl->in_len = ssl->in_buf + len_offset_in;
380 ssl->in_iv = ssl->in_buf + iv_offset_in;
381 }
382}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500383#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
384
Jerry Yudb8c48a2022-01-27 14:54:54 +0800385#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800386
387#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Gilles Peskine449bd832023-01-11 14:50:10 +0100388typedef int (*tls_prf_fn)(const unsigned char *secret, size_t slen,
389 const char *label,
390 const unsigned char *random, size_t rlen,
391 unsigned char *dstbuf, size_t dlen);
Jerry Yued14c932022-02-17 13:40:45 +0800392
Gilles Peskine449bd832023-01-11 14:50:10 +0100393static tls_prf_fn ssl_tls12prf_from_cs(int ciphersuite_id);
Jerry Yued14c932022-02-17 13:40:45 +0800394
395#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
396
397/* Type for the TLS PRF */
398typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
399 const unsigned char *, size_t,
400 unsigned char *, size_t);
401
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200402MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100403static int ssl_tls12_populate_transform(mbedtls_ssl_transform *transform,
404 int ciphersuite,
405 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200406#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +0100407 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200408#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +0100409 ssl_tls_prf_t tls_prf,
410 const unsigned char randbytes[64],
411 mbedtls_ssl_protocol_version tls_version,
412 unsigned endpoint,
413 const mbedtls_ssl_context *ssl);
Jerry Yued14c932022-02-17 13:40:45 +0800414
Andrzej Kurek25f27152022-08-17 16:09:31 -0400415#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200416MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100417static int tls_prf_sha256(const unsigned char *secret, size_t slen,
Ron Eldor51d3ab52019-05-12 14:54:30 +0300418 const char *label,
419 const unsigned char *random, size_t rlen,
Gilles Peskine449bd832023-01-11 14:50:10 +0100420 unsigned char *dstbuf, size_t dlen);
421static void ssl_calc_verify_tls_sha256(const mbedtls_ssl_context *, unsigned char *, size_t *);
422static void ssl_calc_finished_tls_sha256(mbedtls_ssl_context *, unsigned char *, int);
423
424#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
425
426#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
427MBEDTLS_CHECK_RETURN_CRITICAL
428static int tls_prf_sha384(const unsigned char *secret, size_t slen,
429 const char *label,
430 const unsigned char *random, size_t rlen,
431 unsigned char *dstbuf, size_t dlen);
432
433static void ssl_calc_verify_tls_sha384(const mbedtls_ssl_context *, unsigned char *, size_t *);
434static void ssl_calc_finished_tls_sha384(mbedtls_ssl_context *, unsigned char *, int);
435#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
436
437static size_t ssl_tls12_session_save(const mbedtls_ssl_session *session,
438 unsigned char *buf,
439 size_t buf_len);
440
441MBEDTLS_CHECK_RETURN_CRITICAL
442static int ssl_tls12_session_load(mbedtls_ssl_session *session,
443 const unsigned char *buf,
444 size_t len);
445#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
446
447static void ssl_update_checksum_start(mbedtls_ssl_context *, const unsigned char *, size_t);
448
449#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
450static void ssl_update_checksum_sha256(mbedtls_ssl_context *, const unsigned char *, size_t);
451#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
452
453#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
454static void ssl_update_checksum_sha384(mbedtls_ssl_context *, const unsigned char *, size_t);
455#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
456
457int mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf,
458 const unsigned char *secret, size_t slen,
459 const char *label,
460 const unsigned char *random, size_t rlen,
461 unsigned char *dstbuf, size_t dlen)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300462{
463 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
464
Gilles Peskine449bd832023-01-11 14:50:10 +0100465 switch (prf) {
Ron Eldord2f25f72019-05-15 14:54:22 +0300466#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek25f27152022-08-17 16:09:31 -0400467#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300468 case MBEDTLS_SSL_TLS_PRF_SHA384:
469 tls_prf = tls_prf_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +0100470 break;
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400471#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -0400472#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300473 case MBEDTLS_SSL_TLS_PRF_SHA256:
474 tls_prf = tls_prf_sha256;
Gilles Peskine449bd832023-01-11 14:50:10 +0100475 break;
Andrzej Kurekcccb0442022-08-19 03:42:11 -0400476#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Ron Eldord2f25f72019-05-15 14:54:22 +0300477#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100478 default:
479 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Ron Eldor51d3ab52019-05-12 14:54:30 +0300480 }
481
Gilles Peskine449bd832023-01-11 14:50:10 +0100482 return tls_prf(secret, slen, label, random, rlen, dstbuf, dlen);
Ron Eldor51d3ab52019-05-12 14:54:30 +0300483}
484
Jerry Yuc73c6182022-02-08 20:29:25 +0800485#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100486static void ssl_clear_peer_cert(mbedtls_ssl_session *session)
Jerry Yuc73c6182022-02-08 20:29:25 +0800487{
488#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100489 if (session->peer_cert != NULL) {
490 mbedtls_x509_crt_free(session->peer_cert);
491 mbedtls_free(session->peer_cert);
Jerry Yuc73c6182022-02-08 20:29:25 +0800492 session->peer_cert = NULL;
493 }
494#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +0100495 if (session->peer_cert_digest != NULL) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800496 /* Zeroization is not necessary. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100497 mbedtls_free(session->peer_cert_digest);
Jerry Yuc73c6182022-02-08 20:29:25 +0800498 session->peer_cert_digest = NULL;
499 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
500 session->peer_cert_digest_len = 0;
501 }
502#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
503}
504#endif /* MBEDTLS_X509_CRT_PARSE_C */
505
Gilles Peskine449bd832023-01-11 14:50:10 +0100506uint32_t mbedtls_ssl_get_extension_id(unsigned int extension_type)
Jerry Yu7a485c12022-10-31 13:08:18 +0800507{
Gilles Peskine449bd832023-01-11 14:50:10 +0100508 switch (extension_type) {
Jerry Yu7a485c12022-10-31 13:08:18 +0800509 case MBEDTLS_TLS_EXT_SERVERNAME:
Gilles Peskine449bd832023-01-11 14:50:10 +0100510 return MBEDTLS_SSL_EXT_ID_SERVERNAME;
Jerry Yu7a485c12022-10-31 13:08:18 +0800511
512 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100513 return MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800514
515 case MBEDTLS_TLS_EXT_STATUS_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100516 return MBEDTLS_SSL_EXT_ID_STATUS_REQUEST;
Jerry Yu7a485c12022-10-31 13:08:18 +0800517
518 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100519 return MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800520
521 case MBEDTLS_TLS_EXT_SIG_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100522 return MBEDTLS_SSL_EXT_ID_SIG_ALG;
Jerry Yu7a485c12022-10-31 13:08:18 +0800523
524 case MBEDTLS_TLS_EXT_USE_SRTP:
Gilles Peskine449bd832023-01-11 14:50:10 +0100525 return MBEDTLS_SSL_EXT_ID_USE_SRTP;
Jerry Yu7a485c12022-10-31 13:08:18 +0800526
527 case MBEDTLS_TLS_EXT_HEARTBEAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100528 return MBEDTLS_SSL_EXT_ID_HEARTBEAT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800529
530 case MBEDTLS_TLS_EXT_ALPN:
Gilles Peskine449bd832023-01-11 14:50:10 +0100531 return MBEDTLS_SSL_EXT_ID_ALPN;
Jerry Yu7a485c12022-10-31 13:08:18 +0800532
533 case MBEDTLS_TLS_EXT_SCT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100534 return MBEDTLS_SSL_EXT_ID_SCT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800535
536 case MBEDTLS_TLS_EXT_CLI_CERT_TYPE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100537 return MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800538
539 case MBEDTLS_TLS_EXT_SERV_CERT_TYPE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100540 return MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800541
542 case MBEDTLS_TLS_EXT_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100543 return MBEDTLS_SSL_EXT_ID_PADDING;
Jerry Yu7a485c12022-10-31 13:08:18 +0800544
545 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100546 return MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY;
Jerry Yu7a485c12022-10-31 13:08:18 +0800547
548 case MBEDTLS_TLS_EXT_EARLY_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100549 return MBEDTLS_SSL_EXT_ID_EARLY_DATA;
Jerry Yu7a485c12022-10-31 13:08:18 +0800550
551 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100552 return MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800553
554 case MBEDTLS_TLS_EXT_COOKIE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100555 return MBEDTLS_SSL_EXT_ID_COOKIE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800556
557 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100558 return MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES;
Jerry Yu7a485c12022-10-31 13:08:18 +0800559
560 case MBEDTLS_TLS_EXT_CERT_AUTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100561 return MBEDTLS_SSL_EXT_ID_CERT_AUTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800562
563 case MBEDTLS_TLS_EXT_OID_FILTERS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100564 return MBEDTLS_SSL_EXT_ID_OID_FILTERS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800565
566 case MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100567 return MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800568
569 case MBEDTLS_TLS_EXT_SIG_ALG_CERT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100570 return MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800571
572 case MBEDTLS_TLS_EXT_KEY_SHARE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100573 return MBEDTLS_SSL_EXT_ID_KEY_SHARE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800574
575 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
Gilles Peskine449bd832023-01-11 14:50:10 +0100576 return MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC;
Jerry Yu7a485c12022-10-31 13:08:18 +0800577
578 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100579 return MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800580
581 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
Gilles Peskine449bd832023-01-11 14:50:10 +0100582 return MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC;
Jerry Yu7a485c12022-10-31 13:08:18 +0800583
584 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100585 return MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET;
Jerry Yu7a485c12022-10-31 13:08:18 +0800586
587 case MBEDTLS_TLS_EXT_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100588 return MBEDTLS_SSL_EXT_ID_SESSION_TICKET;
Jerry Yu7a485c12022-10-31 13:08:18 +0800589
590 }
591
Gilles Peskine449bd832023-01-11 14:50:10 +0100592 return MBEDTLS_SSL_EXT_ID_UNRECOGNIZED;
Jerry Yu7a485c12022-10-31 13:08:18 +0800593}
594
Gilles Peskine449bd832023-01-11 14:50:10 +0100595uint32_t mbedtls_ssl_get_extension_mask(unsigned int extension_type)
Jerry Yu7a485c12022-10-31 13:08:18 +0800596{
Gilles Peskine449bd832023-01-11 14:50:10 +0100597 return 1 << mbedtls_ssl_get_extension_id(extension_type);
Jerry Yu7a485c12022-10-31 13:08:18 +0800598}
599
Jerry Yud25cab02022-10-31 12:48:30 +0800600#if defined(MBEDTLS_DEBUG_C)
601static const char *extension_name_table[] = {
Jerry Yuea52ed92022-11-08 21:01:17 +0800602 [MBEDTLS_SSL_EXT_ID_UNRECOGNIZED] = "unrecognized",
Jerry Yud25cab02022-10-31 12:48:30 +0800603 [MBEDTLS_SSL_EXT_ID_SERVERNAME] = "server_name",
604 [MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH] = "max_fragment_length",
605 [MBEDTLS_SSL_EXT_ID_STATUS_REQUEST] = "status_request",
606 [MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS] = "supported_groups",
607 [MBEDTLS_SSL_EXT_ID_SIG_ALG] = "signature_algorithms",
608 [MBEDTLS_SSL_EXT_ID_USE_SRTP] = "use_srtp",
609 [MBEDTLS_SSL_EXT_ID_HEARTBEAT] = "heartbeat",
610 [MBEDTLS_SSL_EXT_ID_ALPN] = "application_layer_protocol_negotiation",
611 [MBEDTLS_SSL_EXT_ID_SCT] = "signed_certificate_timestamp",
612 [MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE] = "client_certificate_type",
613 [MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE] = "server_certificate_type",
614 [MBEDTLS_SSL_EXT_ID_PADDING] = "padding",
615 [MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY] = "pre_shared_key",
616 [MBEDTLS_SSL_EXT_ID_EARLY_DATA] = "early_data",
617 [MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS] = "supported_versions",
618 [MBEDTLS_SSL_EXT_ID_COOKIE] = "cookie",
619 [MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES] = "psk_key_exchange_modes",
620 [MBEDTLS_SSL_EXT_ID_CERT_AUTH] = "certificate_authorities",
621 [MBEDTLS_SSL_EXT_ID_OID_FILTERS] = "oid_filters",
622 [MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH] = "post_handshake_auth",
623 [MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT] = "signature_algorithms_cert",
624 [MBEDTLS_SSL_EXT_ID_KEY_SHARE] = "key_share",
625 [MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC] = "truncated_hmac",
626 [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = "supported_point_formats",
627 [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = "encrypt_then_mac",
628 [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = "extended_master_secret",
629 [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = "session_ticket"
630};
631
Gilles Peskine449bd832023-01-11 14:50:10 +0100632static unsigned int extension_type_table[] = {
Jerry Yud25cab02022-10-31 12:48:30 +0800633 [MBEDTLS_SSL_EXT_ID_UNRECOGNIZED] = 0xff,
634 [MBEDTLS_SSL_EXT_ID_SERVERNAME] = MBEDTLS_TLS_EXT_SERVERNAME,
635 [MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH] = MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH,
636 [MBEDTLS_SSL_EXT_ID_STATUS_REQUEST] = MBEDTLS_TLS_EXT_STATUS_REQUEST,
637 [MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS] = MBEDTLS_TLS_EXT_SUPPORTED_GROUPS,
638 [MBEDTLS_SSL_EXT_ID_SIG_ALG] = MBEDTLS_TLS_EXT_SIG_ALG,
639 [MBEDTLS_SSL_EXT_ID_USE_SRTP] = MBEDTLS_TLS_EXT_USE_SRTP,
640 [MBEDTLS_SSL_EXT_ID_HEARTBEAT] = MBEDTLS_TLS_EXT_HEARTBEAT,
641 [MBEDTLS_SSL_EXT_ID_ALPN] = MBEDTLS_TLS_EXT_ALPN,
642 [MBEDTLS_SSL_EXT_ID_SCT] = MBEDTLS_TLS_EXT_SCT,
643 [MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE] = MBEDTLS_TLS_EXT_CLI_CERT_TYPE,
644 [MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE] = MBEDTLS_TLS_EXT_SERV_CERT_TYPE,
645 [MBEDTLS_SSL_EXT_ID_PADDING] = MBEDTLS_TLS_EXT_PADDING,
646 [MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY] = MBEDTLS_TLS_EXT_PRE_SHARED_KEY,
647 [MBEDTLS_SSL_EXT_ID_EARLY_DATA] = MBEDTLS_TLS_EXT_EARLY_DATA,
648 [MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS] = MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS,
649 [MBEDTLS_SSL_EXT_ID_COOKIE] = MBEDTLS_TLS_EXT_COOKIE,
650 [MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES] = MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES,
651 [MBEDTLS_SSL_EXT_ID_CERT_AUTH] = MBEDTLS_TLS_EXT_CERT_AUTH,
652 [MBEDTLS_SSL_EXT_ID_OID_FILTERS] = MBEDTLS_TLS_EXT_OID_FILTERS,
653 [MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH] = MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH,
654 [MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT] = MBEDTLS_TLS_EXT_SIG_ALG_CERT,
655 [MBEDTLS_SSL_EXT_ID_KEY_SHARE] = MBEDTLS_TLS_EXT_KEY_SHARE,
656 [MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC] = MBEDTLS_TLS_EXT_TRUNCATED_HMAC,
657 [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS,
658 [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC,
659 [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET,
660 [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = MBEDTLS_TLS_EXT_SESSION_TICKET
661};
662
Gilles Peskine449bd832023-01-11 14:50:10 +0100663const char *mbedtls_ssl_get_extension_name(unsigned int extension_type)
Jerry Yud25cab02022-10-31 12:48:30 +0800664{
Gilles Peskine449bd832023-01-11 14:50:10 +0100665 return extension_name_table[
666 mbedtls_ssl_get_extension_id(extension_type)];
Jerry Yud25cab02022-10-31 12:48:30 +0800667}
668
Gilles Peskine449bd832023-01-11 14:50:10 +0100669static const char *ssl_tls13_get_hs_msg_name(int hs_msg_type)
Jerry Yud25cab02022-10-31 12:48:30 +0800670{
Gilles Peskine449bd832023-01-11 14:50:10 +0100671 switch (hs_msg_type) {
Jerry Yud25cab02022-10-31 12:48:30 +0800672 case MBEDTLS_SSL_HS_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100673 return "ClientHello";
Jerry Yud25cab02022-10-31 12:48:30 +0800674 case MBEDTLS_SSL_HS_SERVER_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100675 return "ServerHello";
Jerry Yud25cab02022-10-31 12:48:30 +0800676 case MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100677 return "HelloRetryRequest";
Jerry Yud25cab02022-10-31 12:48:30 +0800678 case MBEDTLS_SSL_HS_NEW_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100679 return "NewSessionTicket";
Jerry Yud25cab02022-10-31 12:48:30 +0800680 case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100681 return "EncryptedExtensions";
Jerry Yud25cab02022-10-31 12:48:30 +0800682 case MBEDTLS_SSL_HS_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100683 return "Certificate";
Jerry Yud25cab02022-10-31 12:48:30 +0800684 case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100685 return "CertificateRequest";
Jerry Yud25cab02022-10-31 12:48:30 +0800686 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100687 return "Unknown";
Jerry Yud25cab02022-10-31 12:48:30 +0800688}
689
Gilles Peskine449bd832023-01-11 14:50:10 +0100690void mbedtls_ssl_print_extension(const mbedtls_ssl_context *ssl,
691 int level, const char *file, int line,
692 int hs_msg_type, unsigned int extension_type,
693 const char *extra_msg0, const char *extra_msg1)
Jerry Yud25cab02022-10-31 12:48:30 +0800694{
695 const char *extra_msg;
Gilles Peskine449bd832023-01-11 14:50:10 +0100696 if (extra_msg0 && extra_msg1) {
Jerry Yud25cab02022-10-31 12:48:30 +0800697 mbedtls_debug_print_msg(
698 ssl, level, file, line,
699 "%s: %s(%u) extension %s %s.",
Gilles Peskine449bd832023-01-11 14:50:10 +0100700 ssl_tls13_get_hs_msg_name(hs_msg_type),
701 mbedtls_ssl_get_extension_name(extension_type),
Jerry Yud25cab02022-10-31 12:48:30 +0800702 extension_type,
Gilles Peskine449bd832023-01-11 14:50:10 +0100703 extra_msg0, extra_msg1);
Jerry Yud25cab02022-10-31 12:48:30 +0800704 return;
705 }
706
707 extra_msg = extra_msg0 ? extra_msg0 : extra_msg1;
Gilles Peskine449bd832023-01-11 14:50:10 +0100708 if (extra_msg) {
Jerry Yud25cab02022-10-31 12:48:30 +0800709 mbedtls_debug_print_msg(
710 ssl, level, file, line,
Gilles Peskine449bd832023-01-11 14:50:10 +0100711 "%s: %s(%u) extension %s.", ssl_tls13_get_hs_msg_name(hs_msg_type),
712 mbedtls_ssl_get_extension_name(extension_type), extension_type,
713 extra_msg);
Jerry Yud25cab02022-10-31 12:48:30 +0800714 return;
715 }
716
717 mbedtls_debug_print_msg(
718 ssl, level, file, line,
Gilles Peskine449bd832023-01-11 14:50:10 +0100719 "%s: %s(%u) extension.", ssl_tls13_get_hs_msg_name(hs_msg_type),
720 mbedtls_ssl_get_extension_name(extension_type), extension_type);
Jerry Yud25cab02022-10-31 12:48:30 +0800721}
722
Gilles Peskine449bd832023-01-11 14:50:10 +0100723void mbedtls_ssl_print_extensions(const mbedtls_ssl_context *ssl,
724 int level, const char *file, int line,
725 int hs_msg_type, uint32_t extensions_mask,
726 const char *extra)
Jerry Yud25cab02022-10-31 12:48:30 +0800727{
728
Gilles Peskine449bd832023-01-11 14:50:10 +0100729 for (unsigned i = 0;
730 i < sizeof(extension_name_table) / sizeof(extension_name_table[0]);
731 i++) {
Jerry Yu79aa7212022-11-08 21:30:21 +0800732 mbedtls_ssl_print_extension(
Jerry Yuea52ed92022-11-08 21:01:17 +0800733 ssl, level, file, line, hs_msg_type, extension_type_table[i],
Gilles Peskine449bd832023-01-11 14:50:10 +0100734 extensions_mask & (1 << i) ? "exists" : "does not exist", extra);
Jerry Yud25cab02022-10-31 12:48:30 +0800735 }
736}
737
Pengyu Lvee455c02023-01-12 14:37:24 +0800738#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
739#define ARRAY_LENGTH(a) (sizeof(a) / sizeof(*(a)))
740
741static const char *ticket_flag_name_table[] =
742{
743 [0] = "ALLOW_PSK_RESUMPTION",
744 [2] = "ALLOW_PSK_EPHEMERAL_RESUMPTION",
745 [3] = "ALLOW_EARLY_DATA",
746};
747
748void mbedtls_debug_print_ticket_flags(
749 const mbedtls_ssl_context *ssl, int level,
Pengyu Lvacecf9c2023-01-16 11:23:24 +0800750 const char *file, int line, unsigned int flag)
Pengyu Lvee455c02023-01-12 14:37:24 +0800751{
752 size_t i;
753
754 mbedtls_debug_print_msg(ssl, level, file, line,
755 "print ticket_flags (0x%02x)", flag);
756
757 for (i = 0; i < ARRAY_LENGTH(ticket_flag_name_table); i++) {
758 if ((flag & (1 << i)) & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK) {
759 mbedtls_debug_print_msg(ssl, level, file, line, "- %s is set.",
760 ticket_flag_name_table[i]);
761 }
762 }
763}
764#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */
765
Jerry Yud25cab02022-10-31 12:48:30 +0800766#endif /* MBEDTLS_DEBUG_C */
767
Gilles Peskine449bd832023-01-11 14:50:10 +0100768void mbedtls_ssl_optimize_checksum(mbedtls_ssl_context *ssl,
769 const mbedtls_ssl_ciphersuite_t *ciphersuite_info)
Jerry Yuc73c6182022-02-08 20:29:25 +0800770{
771 ((void) ciphersuite_info);
772
Andrzej Kurek25f27152022-08-17 16:09:31 -0400773#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +0100774 if (ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800775 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +0100776 } else
Jerry Yuc73c6182022-02-08 20:29:25 +0800777#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400778#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +0100779 if (ciphersuite_info->mac != MBEDTLS_MD_SHA384) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800780 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
Gilles Peskine449bd832023-01-11 14:50:10 +0100781 } else
Jerry Yuc73c6182022-02-08 20:29:25 +0800782#endif
783 {
Gilles Peskine449bd832023-01-11 14:50:10 +0100784 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yuc73c6182022-02-08 20:29:25 +0800785 return;
786 }
787}
788
Gilles Peskine449bd832023-01-11 14:50:10 +0100789void mbedtls_ssl_add_hs_hdr_to_checksum(mbedtls_ssl_context *ssl,
790 unsigned hs_type,
791 size_t total_hs_len)
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100792{
793 unsigned char hs_hdr[4];
794
795 /* Build HS header for checksum update. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100796 hs_hdr[0] = MBEDTLS_BYTE_0(hs_type);
797 hs_hdr[1] = MBEDTLS_BYTE_2(total_hs_len);
798 hs_hdr[2] = MBEDTLS_BYTE_1(total_hs_len);
799 hs_hdr[3] = MBEDTLS_BYTE_0(total_hs_len);
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100800
Gilles Peskine449bd832023-01-11 14:50:10 +0100801 ssl->handshake->update_checksum(ssl, hs_hdr, sizeof(hs_hdr));
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100802}
803
Gilles Peskine449bd832023-01-11 14:50:10 +0100804void mbedtls_ssl_add_hs_msg_to_checksum(mbedtls_ssl_context *ssl,
805 unsigned hs_type,
806 unsigned char const *msg,
807 size_t msg_len)
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100808{
Gilles Peskine449bd832023-01-11 14:50:10 +0100809 mbedtls_ssl_add_hs_hdr_to_checksum(ssl, hs_type, msg_len);
810 ssl->handshake->update_checksum(ssl, msg, msg_len);
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100811}
812
Gilles Peskine449bd832023-01-11 14:50:10 +0100813void mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl)
Jerry Yuc73c6182022-02-08 20:29:25 +0800814{
815 ((void) ssl);
Andrzej Kurek25f27152022-08-17 16:09:31 -0400816#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800817#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100818 psa_hash_abort(&ssl->handshake->fin_sha256_psa);
819 psa_hash_setup(&ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256);
Jerry Yuc73c6182022-02-08 20:29:25 +0800820#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100821 mbedtls_sha256_starts(&ssl->handshake->fin_sha256, 0);
Jerry Yuc73c6182022-02-08 20:29:25 +0800822#endif
823#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400824#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800825#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100826 psa_hash_abort(&ssl->handshake->fin_sha384_psa);
827 psa_hash_setup(&ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384);
Jerry Yuc73c6182022-02-08 20:29:25 +0800828#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100829 mbedtls_sha512_starts(&ssl->handshake->fin_sha384, 1);
Jerry Yuc73c6182022-02-08 20:29:25 +0800830#endif
831#endif
832}
833
Gilles Peskine449bd832023-01-11 14:50:10 +0100834static void ssl_update_checksum_start(mbedtls_ssl_context *ssl,
835 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800836{
Andrzej Kurek25f27152022-08-17 16:09:31 -0400837#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800838#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100839 psa_hash_update(&ssl->handshake->fin_sha256_psa, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800840#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100841 mbedtls_sha256_update(&ssl->handshake->fin_sha256, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800842#endif
843#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400844#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuc73c6182022-02-08 20:29:25 +0800845#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100846 psa_hash_update(&ssl->handshake->fin_sha384_psa, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800847#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100848 mbedtls_sha512_update(&ssl->handshake->fin_sha384, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800849#endif
850#endif
Andrzej Kurekeabeb302022-10-17 07:52:51 -0400851#if !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
852 !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
853 (void) ssl;
854 (void) buf;
855 (void) len;
856#endif
Jerry Yuc73c6182022-02-08 20:29:25 +0800857}
858
Andrzej Kurek25f27152022-08-17 16:09:31 -0400859#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +0100860static void ssl_update_checksum_sha256(mbedtls_ssl_context *ssl,
861 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800862{
863#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100864 psa_hash_update(&ssl->handshake->fin_sha256_psa, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800865#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100866 mbedtls_sha256_update(&ssl->handshake->fin_sha256, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800867#endif
868}
869#endif
870
Andrzej Kurek25f27152022-08-17 16:09:31 -0400871#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +0100872static void ssl_update_checksum_sha384(mbedtls_ssl_context *ssl,
873 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800874{
875#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100876 psa_hash_update(&ssl->handshake->fin_sha384_psa, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800877#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100878 mbedtls_sha512_update(&ssl->handshake->fin_sha384, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800879#endif
880}
881#endif
882
Gilles Peskine449bd832023-01-11 14:50:10 +0100883static void ssl_handshake_params_init(mbedtls_ssl_handshake_params *handshake)
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200884{
Gilles Peskine449bd832023-01-11 14:50:10 +0100885 memset(handshake, 0, sizeof(mbedtls_ssl_handshake_params));
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200886
Andrzej Kurek25f27152022-08-17 16:09:31 -0400887#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500888#if defined(MBEDTLS_USE_PSA_CRYPTO)
889 handshake->fin_sha256_psa = psa_hash_operation_init();
Gilles Peskine449bd832023-01-11 14:50:10 +0100890 psa_hash_setup(&handshake->fin_sha256_psa, PSA_ALG_SHA_256);
Andrzej Kurekeb342242019-01-29 09:14:33 -0500891#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100892 mbedtls_sha256_init(&handshake->fin_sha256);
893 mbedtls_sha256_starts(&handshake->fin_sha256, 0);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200894#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500895#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -0400896#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500897#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500898 handshake->fin_sha384_psa = psa_hash_operation_init();
Gilles Peskine449bd832023-01-11 14:50:10 +0100899 psa_hash_setup(&handshake->fin_sha384_psa, PSA_ALG_SHA_384);
Andrzej Kurekeb342242019-01-29 09:14:33 -0500900#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100901 mbedtls_sha512_init(&handshake->fin_sha384);
902 mbedtls_sha512_starts(&handshake->fin_sha384, 1);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200903#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500904#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200905
906 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100907
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200908#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100909 mbedtls_dhm_init(&handshake->dhm_ctx);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200910#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +0200911#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100912 mbedtls_ecdh_init(&handshake->ecdh_ctx);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200913#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200914#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +0200915#if defined(MBEDTLS_USE_PSA_CRYPTO)
916 handshake->psa_pake_ctx = psa_pake_operation_init();
917 handshake->psa_pake_password = MBEDTLS_SVC_KEY_ID_INIT;
918#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100919 mbedtls_ecjpake_init(&handshake->ecjpake_ctx);
Neil Armstrongca7d5062022-05-31 14:43:23 +0200920#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +0200921#if defined(MBEDTLS_SSL_CLI_C)
922 handshake->ecjpake_cache = NULL;
923 handshake->ecjpake_cache_len = 0;
924#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200925#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200926
Gilles Peskineeccd8882020-03-10 12:19:08 +0100927#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +0100928 mbedtls_x509_crt_restart_init(&handshake->ecrs_ctx);
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +0200929#endif
930
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200931#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
932 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
933#endif
Hanno Becker75173122019-02-06 16:18:31 +0000934
935#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
936 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100937 mbedtls_pk_init(&handshake->peer_pubkey);
Hanno Becker75173122019-02-06 16:18:31 +0000938#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200939}
940
Gilles Peskine449bd832023-01-11 14:50:10 +0100941void mbedtls_ssl_transform_init(mbedtls_ssl_transform *transform)
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200942{
Gilles Peskine449bd832023-01-11 14:50:10 +0100943 memset(transform, 0, sizeof(mbedtls_ssl_transform));
Paul Bakker84bbeb52014-07-01 14:53:22 +0200944
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100945#if defined(MBEDTLS_USE_PSA_CRYPTO)
946 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
947 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100948#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100949 mbedtls_cipher_init(&transform->cipher_ctx_enc);
950 mbedtls_cipher_init(&transform->cipher_ctx_dec);
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100951#endif
952
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000953#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +0100954#if defined(MBEDTLS_USE_PSA_CRYPTO)
955 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
956 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100957#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100958 mbedtls_md_init(&transform->md_ctx_enc);
959 mbedtls_md_init(&transform->md_ctx_dec);
Hanno Beckerd56ed242018-01-03 15:32:51 +0000960#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100961#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200962}
963
Gilles Peskine449bd832023-01-11 14:50:10 +0100964void mbedtls_ssl_session_init(mbedtls_ssl_session *session)
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200965{
Gilles Peskine449bd832023-01-11 14:50:10 +0100966 memset(session, 0, sizeof(mbedtls_ssl_session));
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200967}
968
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200969MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100970static int ssl_handshake_init(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +0000971{
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200972 /* Clear old handshake information if present */
Jerry Yu2e199812022-12-01 18:57:19 +0800973#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +0100974 if (ssl->transform_negotiate) {
975 mbedtls_ssl_transform_free(ssl->transform_negotiate);
976 }
Jerry Yu2e199812022-12-01 18:57:19 +0800977#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100978 if (ssl->session_negotiate) {
979 mbedtls_ssl_session_free(ssl->session_negotiate);
980 }
981 if (ssl->handshake) {
982 mbedtls_ssl_handshake_free(ssl);
983 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200984
Jerry Yu2e199812022-12-01 18:57:19 +0800985#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200986 /*
987 * Either the pointers are now NULL or cleared properly and can be freed.
988 * Now allocate missing structures.
989 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100990 if (ssl->transform_negotiate == NULL) {
991 ssl->transform_negotiate = mbedtls_calloc(1, sizeof(mbedtls_ssl_transform));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200992 }
Jerry Yu2e199812022-12-01 18:57:19 +0800993#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48916f92012-09-16 19:57:18 +0000994
Gilles Peskine449bd832023-01-11 14:50:10 +0100995 if (ssl->session_negotiate == NULL) {
996 ssl->session_negotiate = mbedtls_calloc(1, sizeof(mbedtls_ssl_session));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200997 }
Paul Bakker48916f92012-09-16 19:57:18 +0000998
Gilles Peskine449bd832023-01-11 14:50:10 +0100999 if (ssl->handshake == NULL) {
1000 ssl->handshake = mbedtls_calloc(1, sizeof(mbedtls_ssl_handshake_params));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001001 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05001002#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1003 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -04001004
Gilles Peskine449bd832023-01-11 14:50:10 +01001005 handle_buffer_resizing(ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
1006 MBEDTLS_SSL_OUT_BUFFER_LEN);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05001007#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001008
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001009 /* All pointers should exist and can be directly freed without issue */
Gilles Peskine449bd832023-01-11 14:50:10 +01001010 if (ssl->handshake == NULL ||
Jerry Yu2e199812022-12-01 18:57:19 +08001011#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker48916f92012-09-16 19:57:18 +00001012 ssl->transform_negotiate == NULL ||
Jerry Yu2e199812022-12-01 18:57:19 +08001013#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001014 ssl->session_negotiate == NULL) {
1015 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc() of ssl sub-contexts failed"));
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001016
Gilles Peskine449bd832023-01-11 14:50:10 +01001017 mbedtls_free(ssl->handshake);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001018 ssl->handshake = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08001019
1020#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001021 mbedtls_free(ssl->transform_negotiate);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001022 ssl->transform_negotiate = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08001023#endif
1024
Gilles Peskine449bd832023-01-11 14:50:10 +01001025 mbedtls_free(ssl->session_negotiate);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001026 ssl->session_negotiate = NULL;
1027
Gilles Peskine449bd832023-01-11 14:50:10 +01001028 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Paul Bakker48916f92012-09-16 19:57:18 +00001029 }
1030
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001031 /* Initialize structures */
Gilles Peskine449bd832023-01-11 14:50:10 +01001032 mbedtls_ssl_session_init(ssl->session_negotiate);
1033 ssl_handshake_params_init(ssl->handshake);
Paul Bakker968afaa2014-07-09 11:09:24 +02001034
Jerry Yu2e199812022-12-01 18:57:19 +08001035#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001036 mbedtls_ssl_transform_init(ssl->transform_negotiate);
Jerry Yu2e199812022-12-01 18:57:19 +08001037#endif
1038
Jerry Yud0766ec2022-09-22 10:46:57 +08001039#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
1040 defined(MBEDTLS_SSL_SRV_C) && \
1041 defined(MBEDTLS_SSL_SESSION_TICKETS)
1042 ssl->handshake->new_session_tickets_count =
Gilles Peskine449bd832023-01-11 14:50:10 +01001043 ssl->conf->new_session_tickets_count;
Jerry Yud0766ec2022-09-22 10:46:57 +08001044#endif
1045
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001046#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01001047 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001048 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001049
Gilles Peskine449bd832023-01-11 14:50:10 +01001050 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001051 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Gilles Peskine449bd832023-01-11 14:50:10 +01001052 } else {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001053 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Gilles Peskine449bd832023-01-11 14:50:10 +01001054 }
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001055
Gilles Peskine449bd832023-01-11 14:50:10 +01001056 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001057 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001058#endif
1059
Brett Warrene0edc842021-08-17 09:53:13 +01001060/*
1061 * curve_list is translated to IANA TLS group identifiers here because
1062 * mbedtls_ssl_conf_curves returns void and so can't return
1063 * any error codes.
1064 */
1065#if defined(MBEDTLS_ECP_C)
1066#if !defined(MBEDTLS_DEPRECATED_REMOVED)
1067 /* Heap allocate and translate curve_list from internal to IANA group ids */
Gilles Peskine449bd832023-01-11 14:50:10 +01001068 if (ssl->conf->curve_list != NULL) {
Brett Warrene0edc842021-08-17 09:53:13 +01001069 size_t length;
1070 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
1071
Gilles Peskine449bd832023-01-11 14:50:10 +01001072 for (length = 0; (curve_list[length] != MBEDTLS_ECP_DP_NONE) &&
1073 (length < MBEDTLS_ECP_DP_MAX); length++) {
1074 }
Brett Warrene0edc842021-08-17 09:53:13 +01001075
1076 /* Leave room for zero termination */
Gilles Peskine449bd832023-01-11 14:50:10 +01001077 uint16_t *group_list = mbedtls_calloc(length + 1, sizeof(uint16_t));
1078 if (group_list == NULL) {
1079 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1080 }
Brett Warrene0edc842021-08-17 09:53:13 +01001081
Gilles Peskine449bd832023-01-11 14:50:10 +01001082 for (size_t i = 0; i < length; i++) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01001083 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
Gilles Peskine449bd832023-01-11 14:50:10 +01001084 curve_list[i]);
1085 if (tls_id == 0) {
1086 mbedtls_free(group_list);
1087 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Brett Warrene0edc842021-08-17 09:53:13 +01001088 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01001089 group_list[i] = tls_id;
Brett Warrene0edc842021-08-17 09:53:13 +01001090 }
1091
1092 group_list[length] = 0;
1093
1094 ssl->handshake->group_list = group_list;
1095 ssl->handshake->group_list_heap_allocated = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001096 } else {
Brett Warrene0edc842021-08-17 09:53:13 +01001097 ssl->handshake->group_list = ssl->conf->group_list;
1098 ssl->handshake->group_list_heap_allocated = 0;
1099 }
1100#endif /* MBEDTLS_DEPRECATED_REMOVED */
1101#endif /* MBEDTLS_ECP_C */
1102
Ronald Crone68ab4f2022-10-05 12:46:29 +02001103#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08001104#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +08001105#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +08001106 /* Heap allocate and translate sig_hashes from internal hash identifiers to
1107 signature algorithms IANA identifiers. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001108 if (mbedtls_ssl_conf_is_tls12_only(ssl->conf) &&
1109 ssl->conf->sig_hashes != NULL) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001110 const int *md;
1111 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +08001112 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +08001113 uint16_t *p;
1114
Jerry Yub476a442022-01-21 18:14:45 +08001115#if defined(static_assert)
Gilles Peskine449bd832023-01-11 14:50:10 +01001116 static_assert(MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
1117 <= (SIZE_MAX - (2 * sizeof(uint16_t))),
1118 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big");
Jerry Yua68dca22022-01-20 16:28:27 +08001119#endif
1120
Gilles Peskine449bd832023-01-11 14:50:10 +01001121 for (md = sig_hashes; *md != MBEDTLS_MD_NONE; md++) {
1122 if (mbedtls_ssl_hash_from_md_alg(*md) == MBEDTLS_SSL_HASH_NONE) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001123 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001124 }
Jerry Yub476a442022-01-21 18:14:45 +08001125#if defined(MBEDTLS_ECDSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001126 sig_algs_len += sizeof(uint16_t);
Jerry Yub476a442022-01-21 18:14:45 +08001127#endif
Jerry Yua68dca22022-01-20 16:28:27 +08001128
Jerry Yub476a442022-01-21 18:14:45 +08001129#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001130 sig_algs_len += sizeof(uint16_t);
Jerry Yub476a442022-01-21 18:14:45 +08001131#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001132 if (sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN) {
1133 return MBEDTLS_ERR_SSL_BAD_CONFIG;
1134 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001135 }
1136
Gilles Peskine449bd832023-01-11 14:50:10 +01001137 if (sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN) {
1138 return MBEDTLS_ERR_SSL_BAD_CONFIG;
1139 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001140
Gilles Peskine449bd832023-01-11 14:50:10 +01001141 ssl->handshake->sig_algs = mbedtls_calloc(1, sig_algs_len +
1142 sizeof(uint16_t));
1143 if (ssl->handshake->sig_algs == NULL) {
1144 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1145 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001146
Gilles Peskine449bd832023-01-11 14:50:10 +01001147 p = (uint16_t *) ssl->handshake->sig_algs;
1148 for (md = sig_hashes; *md != MBEDTLS_MD_NONE; md++) {
1149 unsigned char hash = mbedtls_ssl_hash_from_md_alg(*md);
1150 if (hash == MBEDTLS_SSL_HASH_NONE) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001151 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001152 }
Jerry Yu6106fdc2022-01-12 16:36:14 +08001153#if defined(MBEDTLS_ECDSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001154 *p = ((hash << 8) | MBEDTLS_SSL_SIG_ECDSA);
Jerry Yuf017ee42022-01-12 15:49:48 +08001155 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001156#endif
1157#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001158 *p = ((hash << 8) | MBEDTLS_SSL_SIG_RSA);
Jerry Yuf017ee42022-01-12 15:49:48 +08001159 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001160#endif
Jerry Yuf017ee42022-01-12 15:49:48 +08001161 }
Gabor Mezei15b95a62022-05-09 16:37:58 +02001162 *p = MBEDTLS_TLS_SIG_NONE;
Jerry Yuf017ee42022-01-12 15:49:48 +08001163 ssl->handshake->sig_algs_heap_allocated = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001164 } else
Jerry Yua69269a2022-01-17 21:06:01 +08001165#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +08001166 {
Jerry Yuf017ee42022-01-12 15:49:48 +08001167 ssl->handshake->sig_algs_heap_allocated = 0;
1168 }
Jerry Yucc539102022-06-27 16:27:35 +08001169#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Ronald Crone68ab4f2022-10-05 12:46:29 +02001170#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Gilles Peskine449bd832023-01-11 14:50:10 +01001171 return 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001172}
1173
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001174#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001175/* Dummy cookie callbacks for defaults */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001176MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001177static int ssl_cookie_write_dummy(void *ctx,
1178 unsigned char **p, unsigned char *end,
1179 const unsigned char *cli_id, size_t cli_id_len)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001180{
1181 ((void) ctx);
1182 ((void) p);
1183 ((void) end);
1184 ((void) cli_id);
1185 ((void) cli_id_len);
1186
Gilles Peskine449bd832023-01-11 14:50:10 +01001187 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001188}
1189
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001190MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001191static int ssl_cookie_check_dummy(void *ctx,
1192 const unsigned char *cookie, size_t cookie_len,
1193 const unsigned char *cli_id, size_t cli_id_len)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001194{
1195 ((void) ctx);
1196 ((void) cookie);
1197 ((void) cookie_len);
1198 ((void) cli_id);
1199 ((void) cli_id_len);
1200
Gilles Peskine449bd832023-01-11 14:50:10 +01001201 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001202}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001203#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001204
Paul Bakker5121ce52009-01-03 21:22:43 +00001205/*
1206 * Initialize an SSL context
1207 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001208void mbedtls_ssl_init(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001209{
Gilles Peskine449bd832023-01-11 14:50:10 +01001210 memset(ssl, 0, sizeof(mbedtls_ssl_context));
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001211}
1212
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001213MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001214static int ssl_conf_version_check(const mbedtls_ssl_context *ssl)
Jerry Yu60835a82021-08-04 10:13:52 +08001215{
Ronald Cron086ee0b2022-03-15 15:18:51 +01001216 const mbedtls_ssl_config *conf = ssl->conf;
1217
Ronald Cron6f135e12021-12-08 16:57:54 +01001218#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001219 if (mbedtls_ssl_conf_is_tls13_only(conf)) {
1220 if (conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1221 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS 1.3 is not yet supported."));
1222 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQianed582dd2022-04-13 08:21:05 +00001223 }
1224
Gilles Peskine449bd832023-01-11 14:50:10 +01001225 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is tls13 only."));
1226 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001227 }
1228#endif
1229
1230#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001231 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
1232 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is tls12 only."));
1233 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001234 }
1235#endif
1236
Ronald Cron6f135e12021-12-08 16:57:54 +01001237#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001238 if (mbedtls_ssl_conf_is_hybrid_tls12_tls13(conf)) {
1239 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1240 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2"));
1241 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQianed582dd2022-04-13 08:21:05 +00001242 }
1243
Gilles Peskine449bd832023-01-11 14:50:10 +01001244 if (conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
1245 MBEDTLS_SSL_DEBUG_MSG(1, ("TLS 1.3 server is not supported yet."));
1246 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian8f9dfe42022-04-15 02:52:39 +00001247 }
1248
1249
Gilles Peskine449bd832023-01-11 14:50:10 +01001250 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is TLS 1.3 or TLS 1.2."));
1251 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001252 }
1253#endif
1254
Gilles Peskine449bd832023-01-11 14:50:10 +01001255 MBEDTLS_SSL_DEBUG_MSG(1, ("The SSL configuration is invalid."));
1256 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Jerry Yu60835a82021-08-04 10:13:52 +08001257}
1258
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001259MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +08001260static int ssl_conf_check(const mbedtls_ssl_context *ssl)
1261{
1262 int ret;
Gilles Peskine449bd832023-01-11 14:50:10 +01001263 ret = ssl_conf_version_check(ssl);
1264 if (ret != 0) {
1265 return ret;
1266 }
Jerry Yu60835a82021-08-04 10:13:52 +08001267
Jerry Yudef7ae42022-10-30 14:13:19 +08001268#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1269 /* RFC 8446 section 4.4.3
1270 *
1271 * If the verification fails, the receiver MUST terminate the handshake with
1272 * a "decrypt_error" alert.
1273 *
1274 * If the client is configured as TLS 1.3 only with optional verify, return
1275 * bad config.
1276 *
1277 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001278 if (mbedtls_ssl_conf_tls13_ephemeral_enabled(
1279 (mbedtls_ssl_context *) ssl) &&
Jerry Yudef7ae42022-10-30 14:13:19 +08001280 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
1281 ssl->conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
1282 ssl->conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
Gilles Peskine449bd832023-01-11 14:50:10 +01001283 ssl->conf->authmode == MBEDTLS_SSL_VERIFY_OPTIONAL) {
Jerry Yudef7ae42022-10-30 14:13:19 +08001284 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01001285 1, ("Optional verify auth mode "
1286 "is not available for TLS 1.3 client"));
1287 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Jerry Yudef7ae42022-10-30 14:13:19 +08001288 }
1289#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1290
Jerry Yu60835a82021-08-04 10:13:52 +08001291 /* Space for further checks */
1292
Gilles Peskine449bd832023-01-11 14:50:10 +01001293 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001294}
1295
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001296/*
1297 * Setup an SSL context
1298 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01001299
Gilles Peskine449bd832023-01-11 14:50:10 +01001300int mbedtls_ssl_setup(mbedtls_ssl_context *ssl,
1301 const mbedtls_ssl_config *conf)
Paul Bakker5121ce52009-01-03 21:22:43 +00001302{
Janos Follath865b3eb2019-12-16 11:46:15 +00001303 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +00001304 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1305 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00001306
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001307 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00001308
Gilles Peskine449bd832023-01-11 14:50:10 +01001309 if ((ret = ssl_conf_check(ssl)) != 0) {
1310 return ret;
1311 }
Jerry Yu60835a82021-08-04 10:13:52 +08001312
Paul Bakker62f2dee2012-09-28 07:31:51 +00001313 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01001314 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00001315 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02001316
1317 /* Set to NULL in case of an error condition */
1318 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02001319
Darryl Greenb33cc762019-11-28 14:29:44 +00001320#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1321 ssl->in_buf_len = in_buf_len;
1322#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001323 ssl->in_buf = mbedtls_calloc(1, in_buf_len);
1324 if (ssl->in_buf == NULL) {
1325 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len));
k-stachowiak9f7798e2018-07-31 16:52:32 +02001326 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001327 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10001328 }
1329
Darryl Greenb33cc762019-11-28 14:29:44 +00001330#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1331 ssl->out_buf_len = out_buf_len;
1332#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001333 ssl->out_buf = mbedtls_calloc(1, out_buf_len);
1334 if (ssl->out_buf == NULL) {
1335 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len));
k-stachowiak9f7798e2018-07-31 16:52:32 +02001336 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001337 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001338 }
1339
Gilles Peskine449bd832023-01-11 14:50:10 +01001340 mbedtls_ssl_reset_in_out_pointers(ssl);
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001341
Johan Pascalb62bb512015-12-03 21:56:45 +01001342#if defined(MBEDTLS_SSL_DTLS_SRTP)
Gilles Peskine449bd832023-01-11 14:50:10 +01001343 memset(&ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info));
Johan Pascalb62bb512015-12-03 21:56:45 +01001344#endif
1345
Gilles Peskine449bd832023-01-11 14:50:10 +01001346 if ((ret = ssl_handshake_init(ssl)) != 0) {
k-stachowiaka47911c2018-07-04 17:41:58 +02001347 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +01001348 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001349
Gilles Peskine449bd832023-01-11 14:50:10 +01001350 return 0;
k-stachowiaka47911c2018-07-04 17:41:58 +02001351
1352error:
Gilles Peskine449bd832023-01-11 14:50:10 +01001353 mbedtls_free(ssl->in_buf);
1354 mbedtls_free(ssl->out_buf);
k-stachowiaka47911c2018-07-04 17:41:58 +02001355
1356 ssl->conf = NULL;
1357
Darryl Greenb33cc762019-11-28 14:29:44 +00001358#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1359 ssl->in_buf_len = 0;
1360 ssl->out_buf_len = 0;
1361#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001362 ssl->in_buf = NULL;
1363 ssl->out_buf = NULL;
1364
1365 ssl->in_hdr = NULL;
1366 ssl->in_ctr = NULL;
1367 ssl->in_len = NULL;
1368 ssl->in_iv = NULL;
1369 ssl->in_msg = NULL;
1370
1371 ssl->out_hdr = NULL;
1372 ssl->out_ctr = NULL;
1373 ssl->out_len = NULL;
1374 ssl->out_iv = NULL;
1375 ssl->out_msg = NULL;
1376
Gilles Peskine449bd832023-01-11 14:50:10 +01001377 return ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00001378}
1379
1380/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001381 * Reset an initialized and used SSL context for re-use while retaining
1382 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001383 *
1384 * If partial is non-zero, keep data in the input buffer and client ID.
1385 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001386 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001387void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl,
1388 int partial)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001389{
Darryl Greenb33cc762019-11-28 14:29:44 +00001390#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1391 size_t in_buf_len = ssl->in_buf_len;
1392 size_t out_buf_len = ssl->out_buf_len;
1393#else
1394 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1395 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1396#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001397
Hanno Beckerb0302c42021-08-03 09:39:42 +01001398#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1399 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001400#endif
1401
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001402 /* Cancel any possibly running timer */
Gilles Peskine449bd832023-01-11 14:50:10 +01001403 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001404
Gilles Peskine449bd832023-01-11 14:50:10 +01001405 mbedtls_ssl_reset_in_out_pointers(ssl);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001406
1407 /* Reset incoming message parsing */
1408 ssl->in_offt = NULL;
1409 ssl->nb_zero = 0;
1410 ssl->in_msgtype = 0;
1411 ssl->in_msglen = 0;
1412 ssl->in_hslen = 0;
1413 ssl->keep_current_message = 0;
1414 ssl->transform_in = NULL;
1415
1416#if defined(MBEDTLS_SSL_PROTO_DTLS)
1417 ssl->next_record_offset = 0;
1418 ssl->in_epoch = 0;
1419#endif
1420
1421 /* Keep current datagram if partial == 1 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001422 if (partial == 0) {
Hanno Beckerb0302c42021-08-03 09:39:42 +01001423 ssl->in_left = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001424 memset(ssl->in_buf, 0, in_buf_len);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001425 }
1426
Ronald Cronad8c17b2022-06-10 17:18:09 +02001427 ssl->send_alert = 0;
1428
Hanno Beckerb0302c42021-08-03 09:39:42 +01001429 /* Reset outgoing message writing */
1430 ssl->out_msgtype = 0;
1431 ssl->out_msglen = 0;
1432 ssl->out_left = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001433 memset(ssl->out_buf, 0, out_buf_len);
1434 memset(ssl->cur_out_ctr, 0, sizeof(ssl->cur_out_ctr));
Hanno Beckerb0302c42021-08-03 09:39:42 +01001435 ssl->transform_out = NULL;
1436
1437#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01001438 mbedtls_ssl_dtls_replay_reset(ssl);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001439#endif
1440
XiaokangQian2b01dc32022-01-21 02:53:13 +00001441#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001442 if (ssl->transform) {
1443 mbedtls_ssl_transform_free(ssl->transform);
1444 mbedtls_free(ssl->transform);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001445 ssl->transform = NULL;
1446 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001447#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1448
XiaokangQian2b01dc32022-01-21 02:53:13 +00001449#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001450 mbedtls_ssl_transform_free(ssl->transform_application);
1451 mbedtls_free(ssl->transform_application);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001452 ssl->transform_application = NULL;
1453
Gilles Peskine449bd832023-01-11 14:50:10 +01001454 if (ssl->handshake != NULL) {
Jerry Yu3d9b5902022-11-04 14:07:25 +08001455#if defined(MBEDTLS_SSL_EARLY_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01001456 mbedtls_ssl_transform_free(ssl->handshake->transform_earlydata);
1457 mbedtls_free(ssl->handshake->transform_earlydata);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001458 ssl->handshake->transform_earlydata = NULL;
Jerry Yu3d9b5902022-11-04 14:07:25 +08001459#endif
XiaokangQian2b01dc32022-01-21 02:53:13 +00001460
Gilles Peskine449bd832023-01-11 14:50:10 +01001461 mbedtls_ssl_transform_free(ssl->handshake->transform_handshake);
1462 mbedtls_free(ssl->handshake->transform_handshake);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001463 ssl->handshake->transform_handshake = NULL;
1464 }
1465
XiaokangQian2b01dc32022-01-21 02:53:13 +00001466#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001467}
1468
Gilles Peskine449bd832023-01-11 14:50:10 +01001469int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001470{
1471 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1472
1473 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
1474
Gilles Peskine449bd832023-01-11 14:50:10 +01001475 mbedtls_ssl_session_reset_msg_layer(ssl, partial);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001476
1477 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001478#if defined(MBEDTLS_SSL_RENEGOTIATION)
1479 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001480 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001481
1482 ssl->verify_data_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001483 memset(ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN);
1484 memset(ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN);
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001485#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001486 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001487
Hanno Beckerb0302c42021-08-03 09:39:42 +01001488 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001489 ssl->session_out = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001490 if (ssl->session) {
1491 mbedtls_ssl_session_free(ssl->session);
1492 mbedtls_free(ssl->session);
Paul Bakkerc0463502013-02-14 11:19:38 +01001493 ssl->session = NULL;
1494 }
1495
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001496#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001497 ssl->alpn_chosen = NULL;
1498#endif
1499
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001500#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
David Horstmann3b2276a2022-10-06 14:49:08 +01001501 int free_cli_id = 1;
Hanno Becker4ccbf062018-08-10 11:20:38 +01001502#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Gilles Peskine449bd832023-01-11 14:50:10 +01001503 free_cli_id = (partial == 0);
Hanno Becker4ccbf062018-08-10 11:20:38 +01001504#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001505 if (free_cli_id) {
1506 mbedtls_free(ssl->cli_id);
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001507 ssl->cli_id = NULL;
1508 ssl->cli_id_len = 0;
1509 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001510#endif
1511
Gilles Peskine449bd832023-01-11 14:50:10 +01001512 if ((ret = ssl_handshake_init(ssl)) != 0) {
1513 return ret;
1514 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001515
Gilles Peskine449bd832023-01-11 14:50:10 +01001516 return 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00001517}
1518
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001519/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001520 * Reset an initialized and used SSL context for re-use while retaining
1521 * all application-set variables, function pointers and data.
1522 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001523int mbedtls_ssl_session_reset(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001524{
Gilles Peskine449bd832023-01-11 14:50:10 +01001525 return mbedtls_ssl_session_reset_int(ssl, 0);
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001526}
1527
1528/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001529 * SSL set accessors
1530 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001531void mbedtls_ssl_conf_endpoint(mbedtls_ssl_config *conf, int endpoint)
Paul Bakker5121ce52009-01-03 21:22:43 +00001532{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001533 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001534}
1535
Gilles Peskine449bd832023-01-11 14:50:10 +01001536void mbedtls_ssl_conf_transport(mbedtls_ssl_config *conf, int transport)
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001537{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001538 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001539}
1540
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001541#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01001542void mbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config *conf, char mode)
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001543{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001544 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001545}
1546#endif
1547
Gilles Peskine449bd832023-01-11 14:50:10 +01001548void mbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config *conf, unsigned limit)
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001549{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001550 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001551}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001553#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001554
Gilles Peskine449bd832023-01-11 14:50:10 +01001555void mbedtls_ssl_set_datagram_packing(mbedtls_ssl_context *ssl,
1556 unsigned allow_packing)
Hanno Becker04da1892018-08-14 13:22:10 +01001557{
1558 ssl->disable_datagram_packing = !allow_packing;
1559}
1560
Gilles Peskine449bd832023-01-11 14:50:10 +01001561void mbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config *conf,
1562 uint32_t min, uint32_t max)
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001563{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001564 conf->hs_timeout_min = min;
1565 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001566}
1567#endif
1568
Gilles Peskine449bd832023-01-11 14:50:10 +01001569void mbedtls_ssl_conf_authmode(mbedtls_ssl_config *conf, int authmode)
Paul Bakker5121ce52009-01-03 21:22:43 +00001570{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001571 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001572}
1573
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001574#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001575void mbedtls_ssl_conf_verify(mbedtls_ssl_config *conf,
1576 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1577 void *p_vrfy)
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001578{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001579 conf->f_vrfy = f_vrfy;
1580 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001581}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001582#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001583
Gilles Peskine449bd832023-01-11 14:50:10 +01001584void mbedtls_ssl_conf_rng(mbedtls_ssl_config *conf,
1585 int (*f_rng)(void *, unsigned char *, size_t),
1586 void *p_rng)
Paul Bakker5121ce52009-01-03 21:22:43 +00001587{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001588 conf->f_rng = f_rng;
1589 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001590}
1591
Gilles Peskine449bd832023-01-11 14:50:10 +01001592void mbedtls_ssl_conf_dbg(mbedtls_ssl_config *conf,
1593 void (*f_dbg)(void *, int, const char *, int, const char *),
1594 void *p_dbg)
Paul Bakker5121ce52009-01-03 21:22:43 +00001595{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001596 conf->f_dbg = f_dbg;
1597 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001598}
1599
Gilles Peskine449bd832023-01-11 14:50:10 +01001600void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl,
1601 void *p_bio,
1602 mbedtls_ssl_send_t *f_send,
1603 mbedtls_ssl_recv_t *f_recv,
1604 mbedtls_ssl_recv_timeout_t *f_recv_timeout)
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001605{
1606 ssl->p_bio = p_bio;
1607 ssl->f_send = f_send;
1608 ssl->f_recv = f_recv;
1609 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001610}
1611
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001612#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01001613void mbedtls_ssl_set_mtu(mbedtls_ssl_context *ssl, uint16_t mtu)
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001614{
1615 ssl->mtu = mtu;
1616}
1617#endif
1618
Gilles Peskine449bd832023-01-11 14:50:10 +01001619void mbedtls_ssl_conf_read_timeout(mbedtls_ssl_config *conf, uint32_t timeout)
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001620{
1621 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001622}
1623
Gilles Peskine449bd832023-01-11 14:50:10 +01001624void mbedtls_ssl_set_timer_cb(mbedtls_ssl_context *ssl,
1625 void *p_timer,
1626 mbedtls_ssl_set_timer_t *f_set_timer,
1627 mbedtls_ssl_get_timer_t *f_get_timer)
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001628{
1629 ssl->p_timer = p_timer;
1630 ssl->f_set_timer = f_set_timer;
1631 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001632
1633 /* Make sure we start with no timer running */
Gilles Peskine449bd832023-01-11 14:50:10 +01001634 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001635}
1636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001637#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001638void mbedtls_ssl_conf_session_cache(mbedtls_ssl_config *conf,
1639 void *p_cache,
1640 mbedtls_ssl_cache_get_t *f_get_cache,
1641 mbedtls_ssl_cache_set_t *f_set_cache)
Paul Bakker5121ce52009-01-03 21:22:43 +00001642{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001643 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001644 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001645 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001646}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001647#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001649#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001650int mbedtls_ssl_set_session(mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session)
Paul Bakker5121ce52009-01-03 21:22:43 +00001651{
Janos Follath865b3eb2019-12-16 11:46:15 +00001652 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001653
Gilles Peskine449bd832023-01-11 14:50:10 +01001654 if (ssl == NULL ||
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001655 session == NULL ||
1656 ssl->session_negotiate == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01001657 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT) {
1658 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001659 }
1660
Gilles Peskine449bd832023-01-11 14:50:10 +01001661 if (ssl->handshake->resume == 1) {
1662 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1663 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01001664
Jerry Yu21092062022-10-10 21:21:31 +08001665#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001666 if (session->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Jerry Yu21092062022-10-10 21:21:31 +08001667 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01001668 mbedtls_ssl_ciphersuite_from_id(session->ciphersuite);
Jerry Yu21092062022-10-10 21:21:31 +08001669
Gilles Peskine449bd832023-01-11 14:50:10 +01001670 if (mbedtls_ssl_validate_ciphersuite(
Jerry Yu21092062022-10-10 21:21:31 +08001671 ssl, ciphersuite_info, MBEDTLS_SSL_VERSION_TLS1_3,
Gilles Peskine449bd832023-01-11 14:50:10 +01001672 MBEDTLS_SSL_VERSION_TLS1_3) != 0) {
1673 MBEDTLS_SSL_DEBUG_MSG(4, ("%d is not a valid TLS 1.3 ciphersuite.",
1674 session->ciphersuite));
1675 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu21092062022-10-10 21:21:31 +08001676 }
Jerry Yu40afab62022-10-08 10:42:13 +08001677 }
Jerry Yu21092062022-10-10 21:21:31 +08001678#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu40afab62022-10-08 10:42:13 +08001679
Gilles Peskine449bd832023-01-11 14:50:10 +01001680 if ((ret = mbedtls_ssl_session_copy(ssl->session_negotiate,
1681 session)) != 0) {
1682 return ret;
1683 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001684
Paul Bakker0a597072012-09-25 21:55:46 +00001685 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001686
Gilles Peskine449bd832023-01-11 14:50:10 +01001687 return 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001688}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001689#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001690
Gilles Peskine449bd832023-01-11 14:50:10 +01001691void mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config *conf,
1692 const int *ciphersuites)
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001693{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001694 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001695}
1696
Ronald Cron6f135e12021-12-08 16:57:54 +01001697#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001698void mbedtls_ssl_conf_tls13_key_exchange_modes(mbedtls_ssl_config *conf,
1699 const int kex_modes)
Hanno Becker71f1ed62021-07-24 06:01:47 +01001700{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001701 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001702}
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001703
1704#if defined(MBEDTLS_SSL_EARLY_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01001705void mbedtls_ssl_tls13_conf_early_data(mbedtls_ssl_config *conf,
1706 int early_data_enabled)
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001707{
1708 conf->early_data_enabled = early_data_enabled;
1709}
Jerry Yucc4e0072022-11-22 17:22:22 +08001710
1711#if defined(MBEDTLS_SSL_SRV_C)
1712void mbedtls_ssl_tls13_conf_max_early_data_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01001713 mbedtls_ssl_config *conf, uint32_t max_early_data_size)
Jerry Yucc4e0072022-11-22 17:22:22 +08001714{
Jerry Yu39da9852022-12-06 16:58:36 +08001715 conf->max_early_data_size = max_early_data_size;
Jerry Yucc4e0072022-11-22 17:22:22 +08001716}
1717#endif /* MBEDTLS_SSL_SRV_C */
1718
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001719#endif /* MBEDTLS_SSL_EARLY_DATA */
Ronald Cron6f135e12021-12-08 16:57:54 +01001720#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001721
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001722#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001723void mbedtls_ssl_conf_cert_profile(mbedtls_ssl_config *conf,
1724 const mbedtls_x509_crt_profile *profile)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001725{
1726 conf->cert_profile = profile;
1727}
1728
Gilles Peskine449bd832023-01-11 14:50:10 +01001729static void ssl_key_cert_free(mbedtls_ssl_key_cert *key_cert)
Glenn Strauss36872db2022-01-22 05:06:31 -05001730{
1731 mbedtls_ssl_key_cert *cur = key_cert, *next;
1732
Gilles Peskine449bd832023-01-11 14:50:10 +01001733 while (cur != NULL) {
Glenn Strauss36872db2022-01-22 05:06:31 -05001734 next = cur->next;
Gilles Peskine449bd832023-01-11 14:50:10 +01001735 mbedtls_free(cur);
Glenn Strauss36872db2022-01-22 05:06:31 -05001736 cur = next;
1737 }
1738}
1739
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001740/* Append a new keycert entry to a (possibly empty) list */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001741MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001742static int ssl_append_key_cert(mbedtls_ssl_key_cert **head,
1743 mbedtls_x509_crt *cert,
1744 mbedtls_pk_context *key)
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001745{
niisato8ee24222018-06-25 19:05:48 +09001746 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001747
Gilles Peskine449bd832023-01-11 14:50:10 +01001748 if (cert == NULL) {
Glenn Strauss36872db2022-01-22 05:06:31 -05001749 /* Free list if cert is null */
Gilles Peskine449bd832023-01-11 14:50:10 +01001750 ssl_key_cert_free(*head);
Glenn Strauss36872db2022-01-22 05:06:31 -05001751 *head = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001752 return 0;
Glenn Strauss36872db2022-01-22 05:06:31 -05001753 }
1754
Gilles Peskine449bd832023-01-11 14:50:10 +01001755 new_cert = mbedtls_calloc(1, sizeof(mbedtls_ssl_key_cert));
1756 if (new_cert == NULL) {
1757 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1758 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001759
niisato8ee24222018-06-25 19:05:48 +09001760 new_cert->cert = cert;
1761 new_cert->key = key;
1762 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001763
Glenn Strauss36872db2022-01-22 05:06:31 -05001764 /* Update head if the list was null, else add to the end */
Gilles Peskine449bd832023-01-11 14:50:10 +01001765 if (*head == NULL) {
niisato8ee24222018-06-25 19:05:48 +09001766 *head = new_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001767 } else {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001768 mbedtls_ssl_key_cert *cur = *head;
Gilles Peskine449bd832023-01-11 14:50:10 +01001769 while (cur->next != NULL) {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001770 cur = cur->next;
Gilles Peskine449bd832023-01-11 14:50:10 +01001771 }
niisato8ee24222018-06-25 19:05:48 +09001772 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001773 }
1774
Gilles Peskine449bd832023-01-11 14:50:10 +01001775 return 0;
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001776}
1777
Gilles Peskine449bd832023-01-11 14:50:10 +01001778int mbedtls_ssl_conf_own_cert(mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001779 mbedtls_x509_crt *own_cert,
Gilles Peskine449bd832023-01-11 14:50:10 +01001780 mbedtls_pk_context *pk_key)
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001781{
Gilles Peskine449bd832023-01-11 14:50:10 +01001782 return ssl_append_key_cert(&conf->key_cert, own_cert, pk_key);
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001783}
1784
Gilles Peskine449bd832023-01-11 14:50:10 +01001785void mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001786 mbedtls_x509_crt *ca_chain,
Gilles Peskine449bd832023-01-11 14:50:10 +01001787 mbedtls_x509_crl *ca_crl)
Paul Bakker5121ce52009-01-03 21:22:43 +00001788{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001789 conf->ca_chain = ca_chain;
1790 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001791
1792#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1793 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1794 * cannot be used together. */
1795 conf->f_ca_cb = NULL;
1796 conf->p_ca_cb = NULL;
1797#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001798}
Hanno Becker5adaad92019-03-27 16:54:37 +00001799
1800#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
Gilles Peskine449bd832023-01-11 14:50:10 +01001801void mbedtls_ssl_conf_ca_cb(mbedtls_ssl_config *conf,
1802 mbedtls_x509_crt_ca_cb_t f_ca_cb,
1803 void *p_ca_cb)
Hanno Becker5adaad92019-03-27 16:54:37 +00001804{
1805 conf->f_ca_cb = f_ca_cb;
1806 conf->p_ca_cb = p_ca_cb;
1807
1808 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1809 * cannot be used together. */
1810 conf->ca_chain = NULL;
1811 conf->ca_crl = NULL;
1812}
1813#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001814#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001815
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001816#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01001817const unsigned char *mbedtls_ssl_get_hs_sni(mbedtls_ssl_context *ssl,
1818 size_t *name_len)
Glenn Strauss69894072022-01-24 12:58:00 -05001819{
1820 *name_len = ssl->handshake->sni_name_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01001821 return ssl->handshake->sni_name;
Glenn Strauss69894072022-01-24 12:58:00 -05001822}
1823
Gilles Peskine449bd832023-01-11 14:50:10 +01001824int mbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context *ssl,
1825 mbedtls_x509_crt *own_cert,
1826 mbedtls_pk_context *pk_key)
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001827{
Gilles Peskine449bd832023-01-11 14:50:10 +01001828 return ssl_append_key_cert(&ssl->handshake->sni_key_cert,
1829 own_cert, pk_key);
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001830}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001831
Gilles Peskine449bd832023-01-11 14:50:10 +01001832void mbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context *ssl,
1833 mbedtls_x509_crt *ca_chain,
1834 mbedtls_x509_crl *ca_crl)
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001835{
1836 ssl->handshake->sni_ca_chain = ca_chain;
1837 ssl->handshake->sni_ca_crl = ca_crl;
1838}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001839
Glenn Strauss999ef702022-03-11 01:37:23 -05001840#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001841void mbedtls_ssl_set_hs_dn_hints(mbedtls_ssl_context *ssl,
1842 const mbedtls_x509_crt *crt)
Glenn Strauss999ef702022-03-11 01:37:23 -05001843{
1844 ssl->handshake->dn_hints = crt;
1845}
1846#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
1847
Gilles Peskine449bd832023-01-11 14:50:10 +01001848void mbedtls_ssl_set_hs_authmode(mbedtls_ssl_context *ssl,
1849 int authmode)
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001850{
1851 ssl->handshake->sni_authmode = authmode;
1852}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001853#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1854
Hanno Becker8927c832019-04-03 12:52:50 +01001855#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001856void mbedtls_ssl_set_verify(mbedtls_ssl_context *ssl,
1857 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1858 void *p_vrfy)
Hanno Becker8927c832019-04-03 12:52:50 +01001859{
1860 ssl->f_vrfy = f_vrfy;
1861 ssl->p_vrfy = p_vrfy;
1862}
1863#endif
1864
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001865#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001866
Valerio Setti016f6822022-12-09 14:17:50 +01001867#if defined(MBEDTLS_USE_PSA_CRYPTO)
1868static psa_status_t mbedtls_ssl_set_hs_ecjpake_password_common(
Gilles Peskine449bd832023-01-11 14:50:10 +01001869 mbedtls_ssl_context *ssl,
1870 mbedtls_svc_key_id_t pwd)
Valerio Setti016f6822022-12-09 14:17:50 +01001871{
1872 psa_status_t status;
1873 psa_pake_role_t psa_role;
1874 psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
1875
Gilles Peskine449bd832023-01-11 14:50:10 +01001876 psa_pake_cs_set_algorithm(&cipher_suite, PSA_ALG_JPAKE);
1877 psa_pake_cs_set_primitive(&cipher_suite,
1878 PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC,
1879 PSA_ECC_FAMILY_SECP_R1,
1880 256));
1881 psa_pake_cs_set_hash(&cipher_suite, PSA_ALG_SHA_256);
Valerio Setti016f6822022-12-09 14:17:50 +01001882
Gilles Peskine449bd832023-01-11 14:50:10 +01001883 status = psa_pake_setup(&ssl->handshake->psa_pake_ctx, &cipher_suite);
1884 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01001885 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001886 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001887
Gilles Peskine449bd832023-01-11 14:50:10 +01001888 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Neil Armstrongca7d5062022-05-31 14:43:23 +02001889 psa_role = PSA_PAKE_ROLE_SERVER;
Gilles Peskine449bd832023-01-11 14:50:10 +01001890 } else {
Neil Armstrongca7d5062022-05-31 14:43:23 +02001891 psa_role = PSA_PAKE_ROLE_CLIENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001892 }
Neil Armstrongca7d5062022-05-31 14:43:23 +02001893
Gilles Peskine449bd832023-01-11 14:50:10 +01001894 status = psa_pake_set_role(&ssl->handshake->psa_pake_ctx, psa_role);
1895 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01001896 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001897 }
Valerio Setti016f6822022-12-09 14:17:50 +01001898
Gilles Peskine449bd832023-01-11 14:50:10 +01001899 status = psa_pake_set_password_key(&ssl->handshake->psa_pake_ctx, pwd);
1900 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01001901 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001902 }
Valerio Setti016f6822022-12-09 14:17:50 +01001903
1904 ssl->handshake->psa_pake_ctx_is_ok = 1;
1905
Gilles Peskine449bd832023-01-11 14:50:10 +01001906 return PSA_SUCCESS;
Valerio Setti016f6822022-12-09 14:17:50 +01001907}
1908
Gilles Peskine449bd832023-01-11 14:50:10 +01001909int mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context *ssl,
1910 const unsigned char *pw,
1911 size_t pw_len)
Valerio Setti016f6822022-12-09 14:17:50 +01001912{
1913 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1914 psa_status_t status;
1915
Gilles Peskine449bd832023-01-11 14:50:10 +01001916 if (ssl->handshake == NULL || ssl->conf == NULL) {
1917 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstrongca7d5062022-05-31 14:43:23 +02001918 }
1919
Gilles Peskine449bd832023-01-11 14:50:10 +01001920 /* Empty password is not valid */
1921 if ((pw == NULL) || (pw_len == 0)) {
1922 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
1923 }
1924
1925 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE);
1926 psa_set_key_algorithm(&attributes, PSA_ALG_JPAKE);
1927 psa_set_key_type(&attributes, PSA_KEY_TYPE_PASSWORD);
1928
1929 status = psa_import_key(&attributes, pw, pw_len,
1930 &ssl->handshake->psa_pake_password);
1931 if (status != PSA_SUCCESS) {
1932 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
1933 }
1934
1935 status = mbedtls_ssl_set_hs_ecjpake_password_common(ssl,
1936 ssl->handshake->psa_pake_password);
1937 if (status != PSA_SUCCESS) {
1938 psa_destroy_key(ssl->handshake->psa_pake_password);
1939 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
1940 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
1941 }
1942
1943 return 0;
Valerio Setti02c25b52022-11-15 14:08:42 +01001944}
Valerio Settia9a97dc2022-11-28 18:26:16 +01001945
Gilles Peskine449bd832023-01-11 14:50:10 +01001946int mbedtls_ssl_set_hs_ecjpake_password_opaque(mbedtls_ssl_context *ssl,
1947 mbedtls_svc_key_id_t pwd)
Valerio Settia9a97dc2022-11-28 18:26:16 +01001948{
Valerio Settia9a97dc2022-11-28 18:26:16 +01001949 psa_status_t status;
1950
Gilles Peskine449bd832023-01-11 14:50:10 +01001951 if (ssl->handshake == NULL || ssl->conf == NULL) {
1952 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstrongca7d5062022-05-31 14:43:23 +02001953 }
1954
Gilles Peskine449bd832023-01-11 14:50:10 +01001955 if (mbedtls_svc_key_id_is_null(pwd)) {
1956 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
1957 }
1958
1959 status = mbedtls_ssl_set_hs_ecjpake_password_common(ssl, pwd);
1960 if (status != PSA_SUCCESS) {
1961 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
1962 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
1963 }
1964
1965 return 0;
Valerio Setti02c25b52022-11-15 14:08:42 +01001966}
1967#else /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001968int mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context *ssl,
1969 const unsigned char *pw,
1970 size_t pw_len)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001971{
1972 mbedtls_ecjpake_role role;
1973
Gilles Peskine449bd832023-01-11 14:50:10 +01001974 if (ssl->handshake == NULL || ssl->conf == NULL) {
1975 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
1976 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001977
Valerio Settic689ed82022-12-07 14:40:38 +01001978 /* Empty password is not valid */
Gilles Peskine449bd832023-01-11 14:50:10 +01001979 if ((pw == NULL) || (pw_len == 0)) {
1980 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
1981 }
Valerio Settic689ed82022-12-07 14:40:38 +01001982
Gilles Peskine449bd832023-01-11 14:50:10 +01001983 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001984 role = MBEDTLS_ECJPAKE_SERVER;
Gilles Peskine449bd832023-01-11 14:50:10 +01001985 } else {
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001986 role = MBEDTLS_ECJPAKE_CLIENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001987 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001988
Gilles Peskine449bd832023-01-11 14:50:10 +01001989 return mbedtls_ecjpake_setup(&ssl->handshake->ecjpake_ctx,
1990 role,
1991 MBEDTLS_MD_SHA256,
1992 MBEDTLS_ECP_DP_SECP256R1,
1993 pw, pw_len);
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001994}
Valerio Setti02c25b52022-11-15 14:08:42 +01001995#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001996#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001997
Ronald Cron73fe8df2022-10-05 14:31:43 +02001998#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001999int mbedtls_ssl_conf_has_static_psk(mbedtls_ssl_config const *conf)
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002000{
Gilles Peskine449bd832023-01-11 14:50:10 +01002001 if (conf->psk_identity == NULL ||
2002 conf->psk_identity_len == 0) {
2003 return 0;
Ronald Crond29e13e2022-10-19 10:33:48 +02002004 }
2005
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002006#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002007 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
2008 return 1;
2009 }
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002010#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Crond29e13e2022-10-19 10:33:48 +02002011
Gilles Peskine449bd832023-01-11 14:50:10 +01002012 if (conf->psk != NULL && conf->psk_len != 0) {
2013 return 1;
2014 }
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002015
Gilles Peskine449bd832023-01-11 14:50:10 +01002016 return 0;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002017}
2018
Gilles Peskine449bd832023-01-11 14:50:10 +01002019static void ssl_conf_remove_psk(mbedtls_ssl_config *conf)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002020{
2021 /* Remove reference to existing PSK, if any. */
2022#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002023 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002024 /* The maintenance of the PSK key slot is the
2025 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02002026 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002027 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002028#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01002029 if (conf->psk != NULL) {
2030 mbedtls_platform_zeroize(conf->psk, conf->psk_len);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002031
Gilles Peskine449bd832023-01-11 14:50:10 +01002032 mbedtls_free(conf->psk);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002033 conf->psk = NULL;
2034 conf->psk_len = 0;
2035 }
2036
2037 /* Remove reference to PSK identity, if any. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002038 if (conf->psk_identity != NULL) {
2039 mbedtls_free(conf->psk_identity);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002040 conf->psk_identity = NULL;
2041 conf->psk_identity_len = 0;
2042 }
2043}
2044
Hanno Becker7390c712018-11-15 13:33:04 +00002045/* This function assumes that PSK identity in the SSL config is unset.
2046 * It checks that the provided identity is well-formed and attempts
2047 * to make a copy of it in the SSL config.
2048 * On failure, the PSK identity in the config remains unset. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002049MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002050static int ssl_conf_set_psk_identity(mbedtls_ssl_config *conf,
2051 unsigned char const *psk_identity,
2052 size_t psk_identity_len)
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002053{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002054 /* Identity len will be encoded on two bytes */
Gilles Peskine449bd832023-01-11 14:50:10 +01002055 if (psk_identity == NULL ||
Ronald Cron2a87e9b2022-10-19 10:55:26 +02002056 psk_identity_len == 0 ||
Gilles Peskine449bd832023-01-11 14:50:10 +01002057 (psk_identity_len >> 16) != 0 ||
2058 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN) {
2059 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002060 }
2061
Gilles Peskine449bd832023-01-11 14:50:10 +01002062 conf->psk_identity = mbedtls_calloc(1, psk_identity_len);
2063 if (conf->psk_identity == NULL) {
2064 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2065 }
Paul Bakker6db455e2013-09-18 17:29:31 +02002066
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01002067 conf->psk_identity_len = psk_identity_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002068 memcpy(conf->psk_identity, psk_identity, conf->psk_identity_len);
Paul Bakker5ad403f2013-09-18 21:21:30 +02002069
Gilles Peskine449bd832023-01-11 14:50:10 +01002070 return 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02002071}
2072
Gilles Peskine449bd832023-01-11 14:50:10 +01002073int mbedtls_ssl_conf_psk(mbedtls_ssl_config *conf,
2074 const unsigned char *psk, size_t psk_len,
2075 const unsigned char *psk_identity, size_t psk_identity_len)
Hanno Becker7390c712018-11-15 13:33:04 +00002076{
Janos Follath865b3eb2019-12-16 11:46:15 +00002077 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002078
2079 /* We currently only support one PSK, raw or opaque. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002080 if (mbedtls_ssl_conf_has_static_psk(conf)) {
2081 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2082 }
Hanno Becker7390c712018-11-15 13:33:04 +00002083
2084 /* Check and set raw PSK */
Gilles Peskine449bd832023-01-11 14:50:10 +01002085 if (psk == NULL) {
2086 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2087 }
2088 if (psk_len == 0) {
2089 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2090 }
2091 if (psk_len > MBEDTLS_PSK_MAX_LEN) {
2092 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2093 }
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01002094
Gilles Peskine449bd832023-01-11 14:50:10 +01002095 if ((conf->psk = mbedtls_calloc(1, psk_len)) == NULL) {
2096 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2097 }
Hanno Becker7390c712018-11-15 13:33:04 +00002098 conf->psk_len = psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002099 memcpy(conf->psk, psk, conf->psk_len);
Hanno Becker7390c712018-11-15 13:33:04 +00002100
2101 /* Check and set PSK Identity */
Gilles Peskine449bd832023-01-11 14:50:10 +01002102 ret = ssl_conf_set_psk_identity(conf, psk_identity, psk_identity_len);
2103 if (ret != 0) {
2104 ssl_conf_remove_psk(conf);
2105 }
Hanno Becker7390c712018-11-15 13:33:04 +00002106
Gilles Peskine449bd832023-01-11 14:50:10 +01002107 return ret;
Hanno Becker7390c712018-11-15 13:33:04 +00002108}
2109
Gilles Peskine449bd832023-01-11 14:50:10 +01002110static void ssl_remove_psk(mbedtls_ssl_context *ssl)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002111{
2112#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002113 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02002114 /* The maintenance of the external PSK key slot is the
2115 * user's responsibility. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002116 if (ssl->handshake->psk_opaque_is_internal) {
2117 psa_destroy_key(ssl->handshake->psk_opaque);
Neil Armstrong501c9322022-05-03 09:35:09 +02002118 ssl->handshake->psk_opaque_is_internal = 0;
2119 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02002120 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002121 }
Neil Armstronge952a302022-05-03 10:22:14 +02002122#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002123 if (ssl->handshake->psk != NULL) {
2124 mbedtls_platform_zeroize(ssl->handshake->psk,
2125 ssl->handshake->psk_len);
2126 mbedtls_free(ssl->handshake->psk);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002127 ssl->handshake->psk_len = 0;
2128 }
Neil Armstronge952a302022-05-03 10:22:14 +02002129#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002130}
2131
Gilles Peskine449bd832023-01-11 14:50:10 +01002132int mbedtls_ssl_set_hs_psk(mbedtls_ssl_context *ssl,
2133 const unsigned char *psk, size_t psk_len)
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002134{
Neil Armstrong501c9322022-05-03 09:35:09 +02002135#if defined(MBEDTLS_USE_PSA_CRYPTO)
2136 psa_key_attributes_t key_attributes = psa_key_attributes_init();
Jerry Yu5d01c052022-08-17 10:18:10 +08002137 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Jerry Yu24b8c812022-08-20 19:06:56 +08002138 psa_algorithm_t alg = PSA_ALG_NONE;
Jerry Yu5d01c052022-08-17 10:18:10 +08002139 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrong501c9322022-05-03 09:35:09 +02002140#endif /* MBEDTLS_USE_PSA_CRYPTO */
2141
Gilles Peskine449bd832023-01-11 14:50:10 +01002142 if (psk == NULL || ssl->handshake == NULL) {
2143 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2144 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002145
Gilles Peskine449bd832023-01-11 14:50:10 +01002146 if (psk_len > MBEDTLS_PSK_MAX_LEN) {
2147 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2148 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002149
Gilles Peskine449bd832023-01-11 14:50:10 +01002150 ssl_remove_psk(ssl);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002151
Neil Armstrong501c9322022-05-03 09:35:09 +02002152#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yuccc68a42022-07-26 16:39:20 +08002153#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01002154 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
2155 if (ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
2156 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
2157 } else {
2158 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
2159 }
2160 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
Jerry Yuccc68a42022-07-26 16:39:20 +08002161 }
2162#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Neil Armstrong501c9322022-05-03 09:35:09 +02002163
Jerry Yu568ec252022-07-22 21:27:34 +08002164#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01002165 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
2166 alg = PSA_ALG_HKDF_EXTRACT(PSA_ALG_ANY_HASH);
2167 psa_set_key_usage_flags(&key_attributes,
2168 PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_EXPORT);
Jerry Yuccc68a42022-07-26 16:39:20 +08002169 }
2170#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2171
Gilles Peskine449bd832023-01-11 14:50:10 +01002172 psa_set_key_algorithm(&key_attributes, alg);
2173 psa_set_key_type(&key_attributes, PSA_KEY_TYPE_DERIVE);
Neil Armstrong501c9322022-05-03 09:35:09 +02002174
Gilles Peskine449bd832023-01-11 14:50:10 +01002175 status = psa_import_key(&key_attributes, psk, psk_len, &key);
2176 if (status != PSA_SUCCESS) {
2177 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2178 }
Neil Armstrong501c9322022-05-03 09:35:09 +02002179
2180 /* Allow calling psa_destroy_key() on psk remove */
2181 ssl->handshake->psk_opaque_is_internal = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01002182 return mbedtls_ssl_set_hs_psk_opaque(ssl, key);
Neil Armstrong501c9322022-05-03 09:35:09 +02002183#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002184 if ((ssl->handshake->psk = mbedtls_calloc(1, psk_len)) == NULL) {
2185 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2186 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002187
2188 ssl->handshake->psk_len = psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002189 memcpy(ssl->handshake->psk, psk, ssl->handshake->psk_len);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002190
Gilles Peskine449bd832023-01-11 14:50:10 +01002191 return 0;
Neil Armstrong501c9322022-05-03 09:35:09 +02002192#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002193}
2194
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002195#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002196int mbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config *conf,
2197 mbedtls_svc_key_id_t psk,
2198 const unsigned char *psk_identity,
2199 size_t psk_identity_len)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002200{
Janos Follath865b3eb2019-12-16 11:46:15 +00002201 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002202
2203 /* We currently only support one PSK, raw or opaque. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002204 if (mbedtls_ssl_conf_has_static_psk(conf)) {
2205 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2206 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002207
Hanno Becker7390c712018-11-15 13:33:04 +00002208 /* Check and set opaque PSK */
Gilles Peskine449bd832023-01-11 14:50:10 +01002209 if (mbedtls_svc_key_id_is_null(psk)) {
2210 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2211 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02002212 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00002213
2214 /* Check and set PSK Identity */
Gilles Peskine449bd832023-01-11 14:50:10 +01002215 ret = ssl_conf_set_psk_identity(conf, psk_identity,
2216 psk_identity_len);
2217 if (ret != 0) {
2218 ssl_conf_remove_psk(conf);
2219 }
Hanno Becker7390c712018-11-15 13:33:04 +00002220
Gilles Peskine449bd832023-01-11 14:50:10 +01002221 return ret;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002222}
2223
Gilles Peskine449bd832023-01-11 14:50:10 +01002224int mbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context *ssl,
2225 mbedtls_svc_key_id_t psk)
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002226{
Gilles Peskine449bd832023-01-11 14:50:10 +01002227 if ((mbedtls_svc_key_id_is_null(psk)) ||
2228 (ssl->handshake == NULL)) {
2229 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2230 }
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002231
Gilles Peskine449bd832023-01-11 14:50:10 +01002232 ssl_remove_psk(ssl);
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002233 ssl->handshake->psk_opaque = psk;
Gilles Peskine449bd832023-01-11 14:50:10 +01002234 return 0;
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002235}
2236#endif /* MBEDTLS_USE_PSA_CRYPTO */
2237
Jerry Yu8897c072022-08-12 13:56:53 +08002238#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002239void mbedtls_ssl_conf_psk_cb(mbedtls_ssl_config *conf,
2240 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
2241 size_t),
2242 void *p_psk)
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002243{
2244 conf->f_psk = f_psk;
2245 conf->p_psk = p_psk;
2246}
Jerry Yu8897c072022-08-12 13:56:53 +08002247#endif /* MBEDTLS_SSL_SRV_C */
2248
Ronald Cron73fe8df2022-10-05 14:31:43 +02002249#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002250
2251#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine301711e2022-04-26 16:57:05 +02002252static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002253 psa_algorithm_t alg)
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002254{
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002255#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01002256 if (alg == PSA_ALG_CBC_NO_PADDING) {
2257 return MBEDTLS_SSL_MODE_CBC;
2258 }
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002259#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Gilles Peskine449bd832023-01-11 14:50:10 +01002260 if (PSA_ALG_IS_AEAD(alg)) {
2261 return MBEDTLS_SSL_MODE_AEAD;
2262 }
2263 return MBEDTLS_SSL_MODE_STREAM;
Gilles Peskine301711e2022-04-26 16:57:05 +02002264}
2265
2266#else /* MBEDTLS_USE_PSA_CRYPTO */
2267
2268static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002269 mbedtls_cipher_mode_t mode)
Gilles Peskine301711e2022-04-26 16:57:05 +02002270{
2271#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01002272 if (mode == MBEDTLS_MODE_CBC) {
2273 return MBEDTLS_SSL_MODE_CBC;
2274 }
Gilles Peskine301711e2022-04-26 16:57:05 +02002275#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
2276
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002277#if defined(MBEDTLS_GCM_C) || \
2278 defined(MBEDTLS_CCM_C) || \
2279 defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002280 if (mode == MBEDTLS_MODE_GCM ||
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002281 mode == MBEDTLS_MODE_CCM ||
Gilles Peskine449bd832023-01-11 14:50:10 +01002282 mode == MBEDTLS_MODE_CHACHAPOLY) {
2283 return MBEDTLS_SSL_MODE_AEAD;
2284 }
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002285#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002286
Gilles Peskine449bd832023-01-11 14:50:10 +01002287 return MBEDTLS_SSL_MODE_STREAM;
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002288}
Gilles Peskine301711e2022-04-26 16:57:05 +02002289#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002290
Gilles Peskinee108d982022-04-26 16:50:40 +02002291static mbedtls_ssl_mode_t mbedtls_ssl_get_actual_mode(
2292 mbedtls_ssl_mode_t base_mode,
Gilles Peskine449bd832023-01-11 14:50:10 +01002293 int encrypt_then_mac)
Gilles Peskinee108d982022-04-26 16:50:40 +02002294{
2295#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01002296 if (encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
2297 base_mode == MBEDTLS_SSL_MODE_CBC) {
2298 return MBEDTLS_SSL_MODE_CBC_ETM;
Gilles Peskinee108d982022-04-26 16:50:40 +02002299 }
2300#else
2301 (void) encrypt_then_mac;
2302#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002303 return base_mode;
Gilles Peskinee108d982022-04-26 16:50:40 +02002304}
2305
Neil Armstrongab555e02022-04-04 11:07:59 +02002306mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
Gilles Peskine449bd832023-01-11 14:50:10 +01002307 const mbedtls_ssl_transform *transform)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002308{
Gilles Peskinee108d982022-04-26 16:50:40 +02002309 mbedtls_ssl_mode_t base_mode = mbedtls_ssl_get_base_mode(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002310#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002311 transform->psa_alg
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002312#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002313 mbedtls_cipher_get_cipher_mode(&transform->cipher_ctx_enc)
Gilles Peskinee108d982022-04-26 16:50:40 +02002314#endif
2315 );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002316
Gilles Peskinee108d982022-04-26 16:50:40 +02002317 int encrypt_then_mac = 0;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002318#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskinee108d982022-04-26 16:50:40 +02002319 encrypt_then_mac = transform->encrypt_then_mac;
2320#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002321 return mbedtls_ssl_get_actual_mode(base_mode, encrypt_then_mac);
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002322}
2323
Neil Armstrongab555e02022-04-04 11:07:59 +02002324mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002325#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01002326 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002327#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01002328 const mbedtls_ssl_ciphersuite_t *suite)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002329{
Gilles Peskinee108d982022-04-26 16:50:40 +02002330 mbedtls_ssl_mode_t base_mode = MBEDTLS_SSL_MODE_STREAM;
2331
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002332#if defined(MBEDTLS_USE_PSA_CRYPTO)
2333 psa_status_t status;
2334 psa_algorithm_t alg;
2335 psa_key_type_t type;
2336 size_t size;
Gilles Peskine449bd832023-01-11 14:50:10 +01002337 status = mbedtls_ssl_cipher_to_psa(suite->cipher, 0, &alg, &type, &size);
2338 if (status == PSA_SUCCESS) {
2339 base_mode = mbedtls_ssl_get_base_mode(alg);
2340 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002341#else
2342 const mbedtls_cipher_info_t *cipher =
Gilles Peskine449bd832023-01-11 14:50:10 +01002343 mbedtls_cipher_info_from_type(suite->cipher);
2344 if (cipher != NULL) {
Gilles Peskinee108d982022-04-26 16:50:40 +02002345 base_mode =
2346 mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002347 mbedtls_cipher_info_get_mode(cipher));
Gilles Peskinee108d982022-04-26 16:50:40 +02002348 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002349#endif /* MBEDTLS_USE_PSA_CRYPTO */
2350
Gilles Peskinee108d982022-04-26 16:50:40 +02002351#if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
2352 int encrypt_then_mac = 0;
2353#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002354 return mbedtls_ssl_get_actual_mode(base_mode, encrypt_then_mac);
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002355}
2356
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002357#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu251a12e2022-07-13 15:15:48 +08002358
2359#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu438ddd82022-07-07 06:55:50 +00002360/* Serialization of TLS 1.3 sessions:
2361 *
2362 * struct {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002363 * opaque hostname<0..2^16-1>;
Jerry Yu438ddd82022-07-07 06:55:50 +00002364 * uint64 ticket_received;
2365 * uint32 ticket_lifetime;
Jerry Yu34191072022-08-18 10:32:09 +08002366 * opaque ticket<1..2^16-1>;
Jerry Yu438ddd82022-07-07 06:55:50 +00002367 * } ClientOnlyData;
2368 *
2369 * struct {
2370 * uint8 endpoint;
2371 * uint8 ciphersuite[2];
2372 * uint32 ticket_age_add;
2373 * uint8 ticket_flags;
2374 * opaque resumption_key<0..255>;
2375 * select ( endpoint ) {
2376 * case client: ClientOnlyData;
2377 * case server: uint64 start_time;
2378 * };
2379 * } serialized_session_tls13;
2380 *
2381 */
2382#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yue36fdd62022-08-17 21:31:36 +08002383MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002384static int ssl_tls13_session_save(const mbedtls_ssl_session *session,
2385 unsigned char *buf,
2386 size_t buf_len,
2387 size_t *olen)
Jerry Yu438ddd82022-07-07 06:55:50 +00002388{
2389 unsigned char *p = buf;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00002390#if defined(MBEDTLS_SSL_CLI_C) && \
2391 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002392 size_t hostname_len = (session->hostname == NULL) ?
2393 0 : strlen(session->hostname) + 1;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00002394#endif
Jerry Yubc7c1a42022-07-21 22:57:37 +08002395 size_t needed = 1 /* endpoint */
2396 + 2 /* ciphersuite */
2397 + 4 /* ticket_age_add */
Jerry Yu34191072022-08-18 10:32:09 +08002398 + 1 /* ticket_flags */
2399 + 1; /* resumption_key length */
Jerry Yue36fdd62022-08-17 21:31:36 +08002400 *olen = 0;
Jerry Yu34191072022-08-18 10:32:09 +08002401
Gilles Peskine449bd832023-01-11 14:50:10 +01002402 if (session->resumption_key_len > MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN) {
2403 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2404 }
Jerry Yu34191072022-08-18 10:32:09 +08002405 needed += session->resumption_key_len; /* resumption_key */
2406
Jerry Yu438ddd82022-07-07 06:55:50 +00002407#if defined(MBEDTLS_HAVE_TIME)
2408 needed += 8; /* start_time or ticket_received */
2409#endif
2410
2411#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002412 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002413#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00002414 needed += 2 /* hostname_len */
Gilles Peskine449bd832023-01-11 14:50:10 +01002415 + hostname_len; /* hostname */
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00002416#endif
2417
Jerry Yu438ddd82022-07-07 06:55:50 +00002418 needed += 4 /* ticket_lifetime */
Jerry Yue36fdd62022-08-17 21:31:36 +08002419 + 2; /* ticket_len */
Jerry Yu34191072022-08-18 10:32:09 +08002420
2421 /* Check size_t overflow */
Gilles Peskine449bd832023-01-11 14:50:10 +01002422 if (session->ticket_len > SIZE_MAX - needed) {
2423 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2424 }
Jerry Yu34191072022-08-18 10:32:09 +08002425
Jerry Yue28d9742022-08-18 15:44:03 +08002426 needed += session->ticket_len; /* ticket */
Jerry Yu438ddd82022-07-07 06:55:50 +00002427 }
2428#endif /* MBEDTLS_SSL_CLI_C */
2429
Jerry Yue36fdd62022-08-17 21:31:36 +08002430 *olen = needed;
Gilles Peskine449bd832023-01-11 14:50:10 +01002431 if (needed > buf_len) {
2432 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
2433 }
Jerry Yu438ddd82022-07-07 06:55:50 +00002434
2435 p[0] = session->endpoint;
Gilles Peskine449bd832023-01-11 14:50:10 +01002436 MBEDTLS_PUT_UINT16_BE(session->ciphersuite, p, 1);
2437 MBEDTLS_PUT_UINT32_BE(session->ticket_age_add, p, 3);
Jerry Yu438ddd82022-07-07 06:55:50 +00002438 p[7] = session->ticket_flags;
2439
2440 /* save resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002441 p[8] = session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002442 p += 9;
Gilles Peskine449bd832023-01-11 14:50:10 +01002443 memcpy(p, session->resumption_key, session->resumption_key_len);
Jerry Yubc7c1a42022-07-21 22:57:37 +08002444 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002445
2446#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002447 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
2448 MBEDTLS_PUT_UINT64_BE((uint64_t) session->start, p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002449 p += 8;
2450 }
2451#endif /* MBEDTLS_HAVE_TIME */
2452
2453#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002454 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002455#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002456 MBEDTLS_PUT_UINT16_BE(hostname_len, p, 0);
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002457 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002458 if (hostname_len > 0) {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002459 /* save host name */
Gilles Peskine449bd832023-01-11 14:50:10 +01002460 memcpy(p, session->hostname, hostname_len);
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002461 p += hostname_len;
2462 }
2463#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
2464
Jerry Yu438ddd82022-07-07 06:55:50 +00002465#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01002466 MBEDTLS_PUT_UINT64_BE((uint64_t) session->ticket_received, p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002467 p += 8;
2468#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002469 MBEDTLS_PUT_UINT32_BE(session->ticket_lifetime, p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002470 p += 4;
2471
Gilles Peskine449bd832023-01-11 14:50:10 +01002472 MBEDTLS_PUT_UINT16_BE(session->ticket_len, p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002473 p += 2;
Jerry Yu34191072022-08-18 10:32:09 +08002474
Gilles Peskine449bd832023-01-11 14:50:10 +01002475 if (session->ticket != NULL && session->ticket_len > 0) {
2476 memcpy(p, session->ticket, session->ticket_len);
Jerry Yu438ddd82022-07-07 06:55:50 +00002477 p += session->ticket_len;
2478 }
2479 }
2480#endif /* MBEDTLS_SSL_CLI_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01002481 return 0;
Jerry Yu438ddd82022-07-07 06:55:50 +00002482}
2483
2484MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002485static int ssl_tls13_session_load(mbedtls_ssl_session *session,
2486 const unsigned char *buf,
2487 size_t len)
Jerry Yu438ddd82022-07-07 06:55:50 +00002488{
2489 const unsigned char *p = buf;
2490 const unsigned char *end = buf + len;
2491
Gilles Peskine449bd832023-01-11 14:50:10 +01002492 if (end - p < 9) {
2493 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2494 }
Jerry Yu438ddd82022-07-07 06:55:50 +00002495 session->endpoint = p[0];
Gilles Peskine449bd832023-01-11 14:50:10 +01002496 session->ciphersuite = MBEDTLS_GET_UINT16_BE(p, 1);
2497 session->ticket_age_add = MBEDTLS_GET_UINT32_BE(p, 3);
Jerry Yu438ddd82022-07-07 06:55:50 +00002498 session->ticket_flags = p[7];
2499
2500 /* load resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002501 session->resumption_key_len = p[8];
Jerry Yu438ddd82022-07-07 06:55:50 +00002502 p += 9;
2503
Gilles Peskine449bd832023-01-11 14:50:10 +01002504 if (end - p < session->resumption_key_len) {
2505 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2506 }
Jerry Yu438ddd82022-07-07 06:55:50 +00002507
Gilles Peskine449bd832023-01-11 14:50:10 +01002508 if (sizeof(session->resumption_key) < session->resumption_key_len) {
2509 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2510 }
2511 memcpy(session->resumption_key, p, session->resumption_key_len);
Jerry Yubc7c1a42022-07-21 22:57:37 +08002512 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002513
2514#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002515 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
2516 if (end - p < 8) {
2517 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2518 }
2519 session->start = MBEDTLS_GET_UINT64_BE(p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002520 p += 8;
2521 }
2522#endif /* MBEDTLS_HAVE_TIME */
2523
2524#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002525 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002526#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01002527 defined(MBEDTLS_SSL_SESSION_TICKETS)
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002528 size_t hostname_len;
2529 /* load host name */
Gilles Peskine449bd832023-01-11 14:50:10 +01002530 if (end - p < 2) {
2531 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2532 }
2533 hostname_len = MBEDTLS_GET_UINT16_BE(p, 0);
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002534 p += 2;
2535
Gilles Peskine449bd832023-01-11 14:50:10 +01002536 if (end - p < (long int) hostname_len) {
2537 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2538 }
2539 if (hostname_len > 0) {
2540 session->hostname = mbedtls_calloc(1, hostname_len);
2541 if (session->hostname == NULL) {
2542 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2543 }
2544 memcpy(session->hostname, p, hostname_len);
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002545 p += hostname_len;
2546 }
2547#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION &&
2548 MBEDTLS_SSL_SESSION_TICKETS */
2549
Jerry Yu438ddd82022-07-07 06:55:50 +00002550#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01002551 if (end - p < 8) {
2552 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2553 }
2554 session->ticket_received = MBEDTLS_GET_UINT64_BE(p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002555 p += 8;
2556#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002557 if (end - p < 4) {
2558 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2559 }
2560 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE(p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002561 p += 4;
2562
Gilles Peskine449bd832023-01-11 14:50:10 +01002563 if (end - p < 2) {
2564 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2565 }
2566 session->ticket_len = MBEDTLS_GET_UINT16_BE(p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002567 p += 2;
2568
Gilles Peskine449bd832023-01-11 14:50:10 +01002569 if (end - p < (long int) session->ticket_len) {
2570 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2571 }
2572 if (session->ticket_len > 0) {
2573 session->ticket = mbedtls_calloc(1, session->ticket_len);
2574 if (session->ticket == NULL) {
2575 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2576 }
2577 memcpy(session->ticket, p, session->ticket_len);
Jerry Yu438ddd82022-07-07 06:55:50 +00002578 p += session->ticket_len;
2579 }
2580 }
2581#endif /* MBEDTLS_SSL_CLI_C */
2582
Gilles Peskine449bd832023-01-11 14:50:10 +01002583 return 0;
Jerry Yu438ddd82022-07-07 06:55:50 +00002584
2585}
2586#else /* MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yue36fdd62022-08-17 21:31:36 +08002587MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002588static int ssl_tls13_session_save(const mbedtls_ssl_session *session,
2589 unsigned char *buf,
2590 size_t buf_len,
2591 size_t *olen)
Jerry Yu251a12e2022-07-13 15:15:48 +08002592{
2593 ((void) session);
2594 ((void) buf);
2595 ((void) buf_len);
Jerry Yue36fdd62022-08-17 21:31:36 +08002596 *olen = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002597 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Jerry Yu251a12e2022-07-13 15:15:48 +08002598}
Jerry Yu438ddd82022-07-07 06:55:50 +00002599
Gilles Peskine449bd832023-01-11 14:50:10 +01002600static int ssl_tls13_session_load(const mbedtls_ssl_session *session,
2601 unsigned char *buf,
2602 size_t buf_len)
Jerry Yu438ddd82022-07-07 06:55:50 +00002603{
2604 ((void) session);
2605 ((void) buf);
2606 ((void) buf_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01002607 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Jerry Yu438ddd82022-07-07 06:55:50 +00002608}
2609#endif /* !MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yu251a12e2022-07-13 15:15:48 +08002610#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2611
Gilles Peskine449bd832023-01-11 14:50:10 +01002612psa_status_t mbedtls_ssl_cipher_to_psa(mbedtls_cipher_type_t mbedtls_cipher_type,
2613 size_t taglen,
2614 psa_algorithm_t *alg,
2615 psa_key_type_t *key_type,
2616 size_t *key_size)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002617{
Gilles Peskine449bd832023-01-11 14:50:10 +01002618 switch (mbedtls_cipher_type) {
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002619 case MBEDTLS_CIPHER_AES_128_CBC:
2620 *alg = PSA_ALG_CBC_NO_PADDING;
2621 *key_type = PSA_KEY_TYPE_AES;
2622 *key_size = 128;
2623 break;
2624 case MBEDTLS_CIPHER_AES_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002625 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002626 *key_type = PSA_KEY_TYPE_AES;
2627 *key_size = 128;
2628 break;
2629 case MBEDTLS_CIPHER_AES_128_GCM:
2630 *alg = PSA_ALG_GCM;
2631 *key_type = PSA_KEY_TYPE_AES;
2632 *key_size = 128;
2633 break;
2634 case MBEDTLS_CIPHER_AES_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002635 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002636 *key_type = PSA_KEY_TYPE_AES;
2637 *key_size = 192;
2638 break;
2639 case MBEDTLS_CIPHER_AES_192_GCM:
2640 *alg = PSA_ALG_GCM;
2641 *key_type = PSA_KEY_TYPE_AES;
2642 *key_size = 192;
2643 break;
2644 case MBEDTLS_CIPHER_AES_256_CBC:
2645 *alg = PSA_ALG_CBC_NO_PADDING;
2646 *key_type = PSA_KEY_TYPE_AES;
2647 *key_size = 256;
2648 break;
2649 case MBEDTLS_CIPHER_AES_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002650 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002651 *key_type = PSA_KEY_TYPE_AES;
2652 *key_size = 256;
2653 break;
2654 case MBEDTLS_CIPHER_AES_256_GCM:
2655 *alg = PSA_ALG_GCM;
2656 *key_type = PSA_KEY_TYPE_AES;
2657 *key_size = 256;
2658 break;
2659 case MBEDTLS_CIPHER_ARIA_128_CBC:
2660 *alg = PSA_ALG_CBC_NO_PADDING;
2661 *key_type = PSA_KEY_TYPE_ARIA;
2662 *key_size = 128;
2663 break;
2664 case MBEDTLS_CIPHER_ARIA_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002665 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002666 *key_type = PSA_KEY_TYPE_ARIA;
2667 *key_size = 128;
2668 break;
2669 case MBEDTLS_CIPHER_ARIA_128_GCM:
2670 *alg = PSA_ALG_GCM;
2671 *key_type = PSA_KEY_TYPE_ARIA;
2672 *key_size = 128;
2673 break;
2674 case MBEDTLS_CIPHER_ARIA_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002675 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002676 *key_type = PSA_KEY_TYPE_ARIA;
2677 *key_size = 192;
2678 break;
2679 case MBEDTLS_CIPHER_ARIA_192_GCM:
2680 *alg = PSA_ALG_GCM;
2681 *key_type = PSA_KEY_TYPE_ARIA;
2682 *key_size = 192;
2683 break;
2684 case MBEDTLS_CIPHER_ARIA_256_CBC:
2685 *alg = PSA_ALG_CBC_NO_PADDING;
2686 *key_type = PSA_KEY_TYPE_ARIA;
2687 *key_size = 256;
2688 break;
2689 case MBEDTLS_CIPHER_ARIA_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002690 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002691 *key_type = PSA_KEY_TYPE_ARIA;
2692 *key_size = 256;
2693 break;
2694 case MBEDTLS_CIPHER_ARIA_256_GCM:
2695 *alg = PSA_ALG_GCM;
2696 *key_type = PSA_KEY_TYPE_ARIA;
2697 *key_size = 256;
2698 break;
2699 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
2700 *alg = PSA_ALG_CBC_NO_PADDING;
2701 *key_type = PSA_KEY_TYPE_CAMELLIA;
2702 *key_size = 128;
2703 break;
2704 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002705 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002706 *key_type = PSA_KEY_TYPE_CAMELLIA;
2707 *key_size = 128;
2708 break;
2709 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
2710 *alg = PSA_ALG_GCM;
2711 *key_type = PSA_KEY_TYPE_CAMELLIA;
2712 *key_size = 128;
2713 break;
2714 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002715 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002716 *key_type = PSA_KEY_TYPE_CAMELLIA;
2717 *key_size = 192;
2718 break;
2719 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
2720 *alg = PSA_ALG_GCM;
2721 *key_type = PSA_KEY_TYPE_CAMELLIA;
2722 *key_size = 192;
2723 break;
2724 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
2725 *alg = PSA_ALG_CBC_NO_PADDING;
2726 *key_type = PSA_KEY_TYPE_CAMELLIA;
2727 *key_size = 256;
2728 break;
2729 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002730 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002731 *key_type = PSA_KEY_TYPE_CAMELLIA;
2732 *key_size = 256;
2733 break;
2734 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
2735 *alg = PSA_ALG_GCM;
2736 *key_type = PSA_KEY_TYPE_CAMELLIA;
2737 *key_size = 256;
2738 break;
2739 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
2740 *alg = PSA_ALG_CHACHA20_POLY1305;
2741 *key_type = PSA_KEY_TYPE_CHACHA20;
2742 *key_size = 256;
2743 break;
2744 case MBEDTLS_CIPHER_NULL:
2745 *alg = MBEDTLS_SSL_NULL_CIPHER;
2746 *key_type = 0;
2747 *key_size = 0;
2748 break;
2749 default:
2750 return PSA_ERROR_NOT_SUPPORTED;
2751 }
2752
2753 return PSA_SUCCESS;
2754}
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002755#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002756
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002757#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002758int mbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config *conf,
2759 const unsigned char *dhm_P, size_t P_len,
2760 const unsigned char *dhm_G, size_t G_len)
Hanno Beckera90658f2017-10-04 15:29:08 +01002761{
Janos Follath865b3eb2019-12-16 11:46:15 +00002762 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01002763
Gilles Peskine449bd832023-01-11 14:50:10 +01002764 mbedtls_mpi_free(&conf->dhm_P);
2765 mbedtls_mpi_free(&conf->dhm_G);
Glenn Strausscee11292021-12-20 01:43:17 -05002766
Gilles Peskine449bd832023-01-11 14:50:10 +01002767 if ((ret = mbedtls_mpi_read_binary(&conf->dhm_P, dhm_P, P_len)) != 0 ||
2768 (ret = mbedtls_mpi_read_binary(&conf->dhm_G, dhm_G, G_len)) != 0) {
2769 mbedtls_mpi_free(&conf->dhm_P);
2770 mbedtls_mpi_free(&conf->dhm_G);
2771 return ret;
Hanno Beckera90658f2017-10-04 15:29:08 +01002772 }
2773
Gilles Peskine449bd832023-01-11 14:50:10 +01002774 return 0;
Hanno Beckera90658f2017-10-04 15:29:08 +01002775}
Paul Bakker5121ce52009-01-03 21:22:43 +00002776
Gilles Peskine449bd832023-01-11 14:50:10 +01002777int mbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx)
Paul Bakker1b57b062011-01-06 15:48:19 +00002778{
Janos Follath865b3eb2019-12-16 11:46:15 +00002779 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00002780
Gilles Peskine449bd832023-01-11 14:50:10 +01002781 mbedtls_mpi_free(&conf->dhm_P);
2782 mbedtls_mpi_free(&conf->dhm_G);
Glenn Strausscee11292021-12-20 01:43:17 -05002783
Gilles Peskine449bd832023-01-11 14:50:10 +01002784 if ((ret = mbedtls_dhm_get_value(dhm_ctx, MBEDTLS_DHM_PARAM_P,
2785 &conf->dhm_P)) != 0 ||
2786 (ret = mbedtls_dhm_get_value(dhm_ctx, MBEDTLS_DHM_PARAM_G,
2787 &conf->dhm_G)) != 0) {
2788 mbedtls_mpi_free(&conf->dhm_P);
2789 mbedtls_mpi_free(&conf->dhm_G);
2790 return ret;
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002791 }
Paul Bakker1b57b062011-01-06 15:48:19 +00002792
Gilles Peskine449bd832023-01-11 14:50:10 +01002793 return 0;
Paul Bakker1b57b062011-01-06 15:48:19 +00002794}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002795#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00002796
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002797#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
2798/*
2799 * Set the minimum length for Diffie-Hellman parameters
2800 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002801void mbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config *conf,
2802 unsigned int bitlen)
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002803{
2804 conf->dhm_min_bitlen = bitlen;
2805}
2806#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
2807
Ronald Crone68ab4f2022-10-05 12:46:29 +02002808#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002809#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002810/*
2811 * Set allowed/preferred hashes for handshake signatures
2812 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002813void mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config *conf,
2814 const int *hashes)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002815{
2816 conf->sig_hashes = hashes;
2817}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002818#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002819
Jerry Yuf017ee42022-01-12 15:49:48 +08002820/* Configure allowed signature algorithms for handshake */
Gilles Peskine449bd832023-01-11 14:50:10 +01002821void mbedtls_ssl_conf_sig_algs(mbedtls_ssl_config *conf,
2822 const uint16_t *sig_algs)
Hanno Becker1cd6e002021-08-10 13:27:10 +01002823{
Jerry Yuf017ee42022-01-12 15:49:48 +08002824#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2825 conf->sig_hashes = NULL;
2826#endif /* !MBEDTLS_DEPRECATED_REMOVED */
2827 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01002828}
Ronald Crone68ab4f2022-10-05 12:46:29 +02002829#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002830
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02002831#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01002832#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002833/*
2834 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01002835 *
2836 * mbedtls_ssl_setup() takes the provided list
2837 * and translates it to a list of IANA TLS group identifiers,
2838 * stored in ssl->handshake->group_list.
2839 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002840 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002841void mbedtls_ssl_conf_curves(mbedtls_ssl_config *conf,
2842 const mbedtls_ecp_group_id *curve_list)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002843{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002844 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01002845 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002846}
Brett Warrene0edc842021-08-17 09:53:13 +01002847#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01002848#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002849
Brett Warrene0edc842021-08-17 09:53:13 +01002850/*
2851 * Set the allowed groups
2852 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002853void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf,
2854 const uint16_t *group_list)
Brett Warrene0edc842021-08-17 09:53:13 +01002855{
2856#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
2857 conf->curve_list = NULL;
2858#endif
2859 conf->group_list = group_list;
2860}
2861
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002862#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002863int mbedtls_ssl_set_hostname(mbedtls_ssl_context *ssl, const char *hostname)
Paul Bakker5121ce52009-01-03 21:22:43 +00002864{
Hanno Becker947194e2017-04-07 13:25:49 +01002865 /* Initialize to suppress unnecessary compiler warning */
2866 size_t hostname_len = 0;
2867
2868 /* Check if new hostname is valid before
2869 * making any change to current one */
Gilles Peskine449bd832023-01-11 14:50:10 +01002870 if (hostname != NULL) {
2871 hostname_len = strlen(hostname);
Hanno Becker947194e2017-04-07 13:25:49 +01002872
Gilles Peskine449bd832023-01-11 14:50:10 +01002873 if (hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN) {
2874 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2875 }
Hanno Becker947194e2017-04-07 13:25:49 +01002876 }
2877
2878 /* Now it's clear that we will overwrite the old hostname,
2879 * so we can free it safely */
2880
Gilles Peskine449bd832023-01-11 14:50:10 +01002881 if (ssl->hostname != NULL) {
2882 mbedtls_platform_zeroize(ssl->hostname, strlen(ssl->hostname));
2883 mbedtls_free(ssl->hostname);
Hanno Becker947194e2017-04-07 13:25:49 +01002884 }
2885
2886 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01002887
Gilles Peskine449bd832023-01-11 14:50:10 +01002888 if (hostname == NULL) {
Hanno Becker947194e2017-04-07 13:25:49 +01002889 ssl->hostname = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01002890 } else {
2891 ssl->hostname = mbedtls_calloc(1, hostname_len + 1);
2892 if (ssl->hostname == NULL) {
2893 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2894 }
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002895
Gilles Peskine449bd832023-01-11 14:50:10 +01002896 memcpy(ssl->hostname, hostname, hostname_len);
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002897
Hanno Becker947194e2017-04-07 13:25:49 +01002898 ssl->hostname[hostname_len] = '\0';
2899 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002900
Gilles Peskine449bd832023-01-11 14:50:10 +01002901 return 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00002902}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01002903#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002904
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002905#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002906void mbedtls_ssl_conf_sni(mbedtls_ssl_config *conf,
2907 int (*f_sni)(void *, mbedtls_ssl_context *,
2908 const unsigned char *, size_t),
2909 void *p_sni)
Paul Bakker5701cdc2012-09-27 21:49:42 +00002910{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002911 conf->f_sni = f_sni;
2912 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00002913}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002914#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00002915
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002916#if defined(MBEDTLS_SSL_ALPN)
Gilles Peskine449bd832023-01-11 14:50:10 +01002917int mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config *conf, const char **protos)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002918{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002919 size_t cur_len, tot_len;
2920 const char **p;
2921
2922 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08002923 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
2924 * MUST NOT be truncated."
2925 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002926 */
2927 tot_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002928 for (p = protos; *p != NULL; p++) {
2929 cur_len = strlen(*p);
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002930 tot_len += cur_len;
2931
Gilles Peskine449bd832023-01-11 14:50:10 +01002932 if ((cur_len == 0) ||
2933 (cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN) ||
2934 (tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN)) {
2935 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2936 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002937 }
2938
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002939 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002940
Gilles Peskine449bd832023-01-11 14:50:10 +01002941 return 0;
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002942}
2943
Gilles Peskine449bd832023-01-11 14:50:10 +01002944const char *mbedtls_ssl_get_alpn_protocol(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002945{
Gilles Peskine449bd832023-01-11 14:50:10 +01002946 return ssl->alpn_chosen;
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002947}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002948#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002949
Johan Pascalb62bb512015-12-03 21:56:45 +01002950#if defined(MBEDTLS_SSL_DTLS_SRTP)
Gilles Peskine449bd832023-01-11 14:50:10 +01002951void mbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config *conf,
2952 int support_mki_value)
Ron Eldor591f1622018-01-22 12:30:04 +02002953{
2954 conf->dtls_srtp_mki_support = support_mki_value;
2955}
2956
Gilles Peskine449bd832023-01-11 14:50:10 +01002957int mbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context *ssl,
2958 unsigned char *mki_value,
2959 uint16_t mki_len)
Ron Eldor591f1622018-01-22 12:30:04 +02002960{
Gilles Peskine449bd832023-01-11 14:50:10 +01002961 if (mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH) {
2962 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Ron Eldora9788042018-12-05 11:04:31 +02002963 }
Ron Eldor591f1622018-01-22 12:30:04 +02002964
Gilles Peskine449bd832023-01-11 14:50:10 +01002965 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED) {
2966 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Ron Eldora9788042018-12-05 11:04:31 +02002967 }
Ron Eldor591f1622018-01-22 12:30:04 +02002968
Gilles Peskine449bd832023-01-11 14:50:10 +01002969 memcpy(ssl->dtls_srtp_info.mki_value, mki_value, mki_len);
Ron Eldor591f1622018-01-22 12:30:04 +02002970 ssl->dtls_srtp_info.mki_len = mki_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002971 return 0;
Ron Eldor591f1622018-01-22 12:30:04 +02002972}
2973
Gilles Peskine449bd832023-01-11 14:50:10 +01002974int mbedtls_ssl_conf_dtls_srtp_protection_profiles(mbedtls_ssl_config *conf,
2975 const mbedtls_ssl_srtp_profile *profiles)
Johan Pascalb62bb512015-12-03 21:56:45 +01002976{
Johan Pascal253d0262020-09-22 13:04:45 +02002977 const mbedtls_ssl_srtp_profile *p;
2978 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002979
Johan Pascal253d0262020-09-22 13:04:45 +02002980 /* check the profiles list: all entry must be valid,
2981 * its size cannot be more than the total number of supported profiles, currently 4 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002982 for (p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
2983 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
2984 p++) {
2985 if (mbedtls_ssl_check_srtp_profile_value(*p) != MBEDTLS_TLS_SRTP_UNSET) {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002986 list_size++;
Gilles Peskine449bd832023-01-11 14:50:10 +01002987 } else {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002988 /* unsupported value, stop parsing and set the size to an error value */
2989 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01002990 }
2991 }
2992
Gilles Peskine449bd832023-01-11 14:50:10 +01002993 if (list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH) {
2994 conf->dtls_srtp_profile_list = NULL;
2995 conf->dtls_srtp_profile_list_len = 0;
2996 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Johan Pascal253d0262020-09-22 13:04:45 +02002997 }
2998
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002999 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02003000 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01003001
Gilles Peskine449bd832023-01-11 14:50:10 +01003002 return 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01003003}
3004
Gilles Peskine449bd832023-01-11 14:50:10 +01003005void mbedtls_ssl_get_dtls_srtp_negotiation_result(const mbedtls_ssl_context *ssl,
3006 mbedtls_dtls_srtp_info *dtls_srtp_info)
Johan Pascalb62bb512015-12-03 21:56:45 +01003007{
Johan Pascal2258a4f2020-10-28 13:53:09 +01003008 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
3009 /* do not copy the mki value if there is no chosen profile */
Gilles Peskine449bd832023-01-11 14:50:10 +01003010 if (dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET) {
Johan Pascal2258a4f2020-10-28 13:53:09 +01003011 dtls_srtp_info->mki_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003012 } else {
Johan Pascal2258a4f2020-10-28 13:53:09 +01003013 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01003014 memcpy(dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
3015 ssl->dtls_srtp_info.mki_len);
Johan Pascal2258a4f2020-10-28 13:53:09 +01003016 }
Johan Pascalb62bb512015-12-03 21:56:45 +01003017}
Johan Pascalb62bb512015-12-03 21:56:45 +01003018#endif /* MBEDTLS_SSL_DTLS_SRTP */
3019
Aditya Patwardhan3096f332022-07-26 14:31:46 +05303020#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01003021void mbedtls_ssl_conf_max_version(mbedtls_ssl_config *conf, int major, int minor)
Paul Bakker490ecc82011-10-06 13:04:09 +00003022{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04003023 conf->max_tls_version = (major << 8) | minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00003024}
3025
Gilles Peskine449bd832023-01-11 14:50:10 +01003026void mbedtls_ssl_conf_min_version(mbedtls_ssl_config *conf, int major, int minor)
Paul Bakker1d29fb52012-09-28 13:28:45 +00003027{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04003028 conf->min_tls_version = (major << 8) | minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00003029}
Aditya Patwardhan3096f332022-07-26 14:31:46 +05303030#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker1d29fb52012-09-28 13:28:45 +00003031
Janos Follath088ce432017-04-10 12:42:31 +01003032#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003033void mbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config *conf,
3034 char cert_req_ca_list)
Janos Follath088ce432017-04-10 12:42:31 +01003035{
3036 conf->cert_req_ca_list = cert_req_ca_list;
3037}
3038#endif
3039
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003040#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01003041void mbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config *conf, char etm)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01003042{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003043 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01003044}
3045#endif
3046
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003047#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Gilles Peskine449bd832023-01-11 14:50:10 +01003048void mbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config *conf, char ems)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02003049{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003050 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02003051}
3052#endif
3053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003054#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003055int mbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config *conf, unsigned char mfl_code)
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003056{
Gilles Peskine449bd832023-01-11 14:50:10 +01003057 if (mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
3058 ssl_mfl_code_to_length(mfl_code) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN) {
3059 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003060 }
3061
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01003062 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003063
Gilles Peskine449bd832023-01-11 14:50:10 +01003064 return 0;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003065}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003066#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003067
Gilles Peskine449bd832023-01-11 14:50:10 +01003068void mbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config *conf, int allow_legacy)
Paul Bakker48916f92012-09-16 19:57:18 +00003069{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003070 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00003071}
3072
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003073#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01003074void mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config *conf, int renegotiation)
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003075{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003076 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003077}
3078
Gilles Peskine449bd832023-01-11 14:50:10 +01003079void mbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config *conf, int max_records)
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02003080{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003081 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02003082}
3083
Gilles Peskine449bd832023-01-11 14:50:10 +01003084void mbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config *conf,
3085 const unsigned char period[8])
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01003086{
Gilles Peskine449bd832023-01-11 14:50:10 +01003087 memcpy(conf->renego_period, period, 8);
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01003088}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003089#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00003090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003091#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003092#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003093void mbedtls_ssl_conf_session_tickets(mbedtls_ssl_config *conf, int use_tickets)
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003094{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01003095 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003096}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003097#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02003098
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003099#if defined(MBEDTLS_SSL_SRV_C)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003100
Jerry Yud0766ec2022-09-22 10:46:57 +08003101#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003102void mbedtls_ssl_conf_new_session_tickets(mbedtls_ssl_config *conf,
3103 uint16_t num_tickets)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003104{
Jerry Yud0766ec2022-09-22 10:46:57 +08003105 conf->new_session_tickets_count = num_tickets;
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003106}
3107#endif
3108
Gilles Peskine449bd832023-01-11 14:50:10 +01003109void mbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config *conf,
3110 mbedtls_ssl_ticket_write_t *f_ticket_write,
3111 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
3112 void *p_ticket)
Paul Bakker606b4ba2013-08-14 16:52:14 +02003113{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02003114 conf->f_ticket_write = f_ticket_write;
3115 conf->f_ticket_parse = f_ticket_parse;
3116 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02003117}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003118#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003119#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003120
Gilles Peskine449bd832023-01-11 14:50:10 +01003121void mbedtls_ssl_set_export_keys_cb(mbedtls_ssl_context *ssl,
3122 mbedtls_ssl_export_keys_t *f_export_keys,
3123 void *p_export_keys)
Robert Cragie4feb7ae2015-10-02 13:33:37 +01003124{
Hanno Becker7e6c1782021-06-08 09:24:55 +01003125 ssl->f_export_keys = f_export_keys;
3126 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03003127}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01003128
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003129#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003130void mbedtls_ssl_conf_async_private_cb(
3131 mbedtls_ssl_config *conf,
3132 mbedtls_ssl_async_sign_t *f_async_sign,
3133 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
3134 mbedtls_ssl_async_resume_t *f_async_resume,
3135 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskine449bd832023-01-11 14:50:10 +01003136 void *async_config_data)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003137{
3138 conf->f_async_sign_start = f_async_sign;
3139 conf->f_async_decrypt_start = f_async_decrypt;
3140 conf->f_async_resume = f_async_resume;
3141 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003142 conf->p_async_config_data = async_config_data;
3143}
3144
Gilles Peskine449bd832023-01-11 14:50:10 +01003145void *mbedtls_ssl_conf_get_async_config_data(const mbedtls_ssl_config *conf)
Gilles Peskine8f97af72018-04-26 11:46:10 +02003146{
Gilles Peskine449bd832023-01-11 14:50:10 +01003147 return conf->p_async_config_data;
Gilles Peskine8f97af72018-04-26 11:46:10 +02003148}
3149
Gilles Peskine449bd832023-01-11 14:50:10 +01003150void *mbedtls_ssl_get_async_operation_data(const mbedtls_ssl_context *ssl)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003151{
Gilles Peskine449bd832023-01-11 14:50:10 +01003152 if (ssl->handshake == NULL) {
3153 return NULL;
3154 } else {
3155 return ssl->handshake->user_async_ctx;
3156 }
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003157}
3158
Gilles Peskine449bd832023-01-11 14:50:10 +01003159void mbedtls_ssl_set_async_operation_data(mbedtls_ssl_context *ssl,
3160 void *ctx)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003161{
Gilles Peskine449bd832023-01-11 14:50:10 +01003162 if (ssl->handshake != NULL) {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003163 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01003164 }
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003165}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003166#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003167
Paul Bakker5121ce52009-01-03 21:22:43 +00003168/*
3169 * SSL get accessors
3170 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003171uint32_t mbedtls_ssl_get_verify_result(const mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00003172{
Gilles Peskine449bd832023-01-11 14:50:10 +01003173 if (ssl->session != NULL) {
3174 return ssl->session->verify_result;
3175 }
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00003176
Gilles Peskine449bd832023-01-11 14:50:10 +01003177 if (ssl->session_negotiate != NULL) {
3178 return ssl->session_negotiate->verify_result;
3179 }
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00003180
Gilles Peskine449bd832023-01-11 14:50:10 +01003181 return 0xFFFFFFFF;
Paul Bakker5121ce52009-01-03 21:22:43 +00003182}
3183
Gilles Peskine449bd832023-01-11 14:50:10 +01003184int mbedtls_ssl_get_ciphersuite_id_from_ssl(const mbedtls_ssl_context *ssl)
Glenn Strauss8f526902022-01-13 00:04:49 -05003185{
Gilles Peskine449bd832023-01-11 14:50:10 +01003186 if (ssl == NULL || ssl->session == NULL) {
3187 return 0;
3188 }
Glenn Strauss8f526902022-01-13 00:04:49 -05003189
Gilles Peskine449bd832023-01-11 14:50:10 +01003190 return ssl->session->ciphersuite;
Glenn Strauss8f526902022-01-13 00:04:49 -05003191}
3192
Gilles Peskine449bd832023-01-11 14:50:10 +01003193const char *mbedtls_ssl_get_ciphersuite(const mbedtls_ssl_context *ssl)
Paul Bakker72f62662011-01-16 21:27:44 +00003194{
Gilles Peskine449bd832023-01-11 14:50:10 +01003195 if (ssl == NULL || ssl->session == NULL) {
3196 return NULL;
3197 }
Paul Bakker926c8e42013-03-06 10:23:34 +01003198
Gilles Peskine449bd832023-01-11 14:50:10 +01003199 return mbedtls_ssl_get_ciphersuite_name(ssl->session->ciphersuite);
Paul Bakker72f62662011-01-16 21:27:44 +00003200}
3201
Gilles Peskine449bd832023-01-11 14:50:10 +01003202const char *mbedtls_ssl_get_version(const mbedtls_ssl_context *ssl)
Paul Bakker43ca69c2011-01-15 17:35:19 +00003203{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003204#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003205 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
3206 switch (ssl->tls_version) {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003207 case MBEDTLS_SSL_VERSION_TLS1_2:
Gilles Peskine449bd832023-01-11 14:50:10 +01003208 return "DTLSv1.2";
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003209 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003210 return "unknown (DTLS)";
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003211 }
3212 }
3213#endif
3214
Gilles Peskine449bd832023-01-11 14:50:10 +01003215 switch (ssl->tls_version) {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003216 case MBEDTLS_SSL_VERSION_TLS1_2:
Gilles Peskine449bd832023-01-11 14:50:10 +01003217 return "TLSv1.2";
Glenn Strauss60bfe602022-03-14 19:04:24 -04003218 case MBEDTLS_SSL_VERSION_TLS1_3:
Gilles Peskine449bd832023-01-11 14:50:10 +01003219 return "TLSv1.3";
Paul Bakker43ca69c2011-01-15 17:35:19 +00003220 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003221 return "unknown";
Paul Bakker43ca69c2011-01-15 17:35:19 +00003222 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00003223}
3224
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003225#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003226size_t mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context *ssl)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003227{
David Horstmann95d516f2021-05-04 18:36:56 +01003228 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003229 size_t read_mfl;
3230
Jerry Yuddda0502022-12-01 19:43:12 +08003231#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003232 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
Gilles Peskine449bd832023-01-11 14:50:10 +01003233 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
3234 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE) {
3235 return ssl_mfl_code_to_length(ssl->conf->mfl_code);
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003236 }
Jerry Yuddda0502022-12-01 19:43:12 +08003237#endif
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003238
3239 /* Check if a smaller max length was negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003240 if (ssl->session_out != NULL) {
3241 read_mfl = ssl_mfl_code_to_length(ssl->session_out->mfl_code);
3242 if (read_mfl < max_len) {
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003243 max_len = read_mfl;
3244 }
3245 }
3246
Jerry Yuddda0502022-12-01 19:43:12 +08003247 /* During a handshake, use the value being negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003248 if (ssl->session_negotiate != NULL) {
3249 read_mfl = ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code);
3250 if (read_mfl < max_len) {
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003251 max_len = read_mfl;
3252 }
3253 }
3254
Gilles Peskine449bd832023-01-11 14:50:10 +01003255 return max_len;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003256}
3257
Gilles Peskine449bd832023-01-11 14:50:10 +01003258size_t mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003259{
3260 size_t max_len;
3261
3262 /*
3263 * Assume mfl_code is correct since it was checked when set
3264 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003265 max_len = ssl_mfl_code_to_length(ssl->conf->mfl_code);
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003266
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003267 /* Check if a smaller max length was negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003268 if (ssl->session_out != NULL &&
3269 ssl_mfl_code_to_length(ssl->session_out->mfl_code) < max_len) {
3270 max_len = ssl_mfl_code_to_length(ssl->session_out->mfl_code);
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003271 }
3272
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003273 /* During a handshake, use the value being negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003274 if (ssl->session_negotiate != NULL &&
3275 ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code) < max_len) {
3276 max_len = ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code);
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003277 }
3278
Gilles Peskine449bd832023-01-11 14:50:10 +01003279 return max_len;
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003280}
3281#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
3282
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003283#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003284size_t mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003285{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04003286 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003287 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
3288 (ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
3289 ssl->state == MBEDTLS_SSL_SERVER_HELLO)) {
3290 return 0;
3291 }
Andrzej Kurekef43ce62018-10-09 08:24:12 -04003292
Gilles Peskine449bd832023-01-11 14:50:10 +01003293 if (ssl->handshake == NULL || ssl->handshake->mtu == 0) {
3294 return ssl->mtu;
3295 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003296
Gilles Peskine449bd832023-01-11 14:50:10 +01003297 if (ssl->mtu == 0) {
3298 return ssl->handshake->mtu;
3299 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003300
Gilles Peskine449bd832023-01-11 14:50:10 +01003301 return ssl->mtu < ssl->handshake->mtu ?
3302 ssl->mtu : ssl->handshake->mtu;
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003303}
3304#endif /* MBEDTLS_SSL_PROTO_DTLS */
3305
Gilles Peskine449bd832023-01-11 14:50:10 +01003306int mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003307{
3308 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
3309
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02003310#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
3311 !defined(MBEDTLS_SSL_PROTO_DTLS)
3312 (void) ssl;
3313#endif
3314
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003315#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003316 const size_t mfl = mbedtls_ssl_get_output_max_frag_len(ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003317
Gilles Peskine449bd832023-01-11 14:50:10 +01003318 if (max_len > mfl) {
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003319 max_len = mfl;
Gilles Peskine449bd832023-01-11 14:50:10 +01003320 }
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003321#endif
3322
3323#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003324 if (mbedtls_ssl_get_current_mtu(ssl) != 0) {
3325 const size_t mtu = mbedtls_ssl_get_current_mtu(ssl);
3326 const int ret = mbedtls_ssl_get_record_expansion(ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003327 const size_t overhead = (size_t) ret;
3328
Gilles Peskine449bd832023-01-11 14:50:10 +01003329 if (ret < 0) {
3330 return ret;
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003331 }
3332
Gilles Peskine449bd832023-01-11 14:50:10 +01003333 if (mtu <= overhead) {
3334 MBEDTLS_SSL_DEBUG_MSG(1, ("MTU too low for record expansion"));
3335 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3336 }
3337
3338 if (max_len > mtu - overhead) {
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003339 max_len = mtu - overhead;
Gilles Peskine449bd832023-01-11 14:50:10 +01003340 }
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003341 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003342#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003343
Hanno Becker0defedb2018-08-10 12:35:02 +01003344#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
3345 !defined(MBEDTLS_SSL_PROTO_DTLS)
3346 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003347#endif
3348
Gilles Peskine449bd832023-01-11 14:50:10 +01003349 return (int) max_len;
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003350}
3351
Gilles Peskine449bd832023-01-11 14:50:10 +01003352int mbedtls_ssl_get_max_in_record_payload(const mbedtls_ssl_context *ssl)
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003353{
3354 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
3355
3356#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3357 (void) ssl;
3358#endif
3359
3360#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003361 const size_t mfl = mbedtls_ssl_get_input_max_frag_len(ssl);
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003362
Gilles Peskine449bd832023-01-11 14:50:10 +01003363 if (max_len > mfl) {
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003364 max_len = mfl;
Gilles Peskine449bd832023-01-11 14:50:10 +01003365 }
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003366#endif
3367
Gilles Peskine449bd832023-01-11 14:50:10 +01003368 return (int) max_len;
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003369}
3370
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003371#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003372const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert(const mbedtls_ssl_context *ssl)
Paul Bakkerb0550d92012-10-30 07:51:03 +00003373{
Gilles Peskine449bd832023-01-11 14:50:10 +01003374 if (ssl == NULL || ssl->session == NULL) {
3375 return NULL;
3376 }
Paul Bakkerb0550d92012-10-30 07:51:03 +00003377
Hanno Beckere6824572019-02-07 13:18:46 +00003378#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01003379 return ssl->session->peer_cert;
Hanno Beckere6824572019-02-07 13:18:46 +00003380#else
Gilles Peskine449bd832023-01-11 14:50:10 +01003381 return NULL;
Hanno Beckere6824572019-02-07 13:18:46 +00003382#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00003383}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003384#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00003385
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003386#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003387int mbedtls_ssl_get_session(const mbedtls_ssl_context *ssl,
3388 mbedtls_ssl_session *dst)
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003389{
Hanno Beckere810bbc2021-05-14 16:01:05 +01003390 int ret;
3391
Gilles Peskine449bd832023-01-11 14:50:10 +01003392 if (ssl == NULL ||
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003393 dst == NULL ||
3394 ssl->session == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01003395 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT) {
3396 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003397 }
3398
Hanno Beckere810bbc2021-05-14 16:01:05 +01003399 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
3400 * idempotent: Each session can only be exported once.
3401 *
3402 * (This is in preparation for TLS 1.3 support where we will
3403 * need the ability to export multiple sessions (aka tickets),
3404 * which will be achieved by calling mbedtls_ssl_get_session()
3405 * multiple times until it fails.)
3406 *
3407 * Check whether we have already exported the current session,
3408 * and fail if so.
3409 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003410 if (ssl->session->exported == 1) {
3411 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3412 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01003413
Gilles Peskine449bd832023-01-11 14:50:10 +01003414 ret = mbedtls_ssl_session_copy(dst, ssl->session);
3415 if (ret != 0) {
3416 return ret;
3417 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01003418
3419 /* Remember that we've exported the session. */
3420 ssl->session->exported = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003421 return 0;
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003422}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003423#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003424
Paul Bakker5121ce52009-01-03 21:22:43 +00003425/*
Hanno Beckera835da52019-05-16 12:39:07 +01003426 * Define ticket header determining Mbed TLS version
3427 * and structure of the ticket.
3428 */
3429
Hanno Becker94ef3b32019-05-16 12:50:45 +01003430/*
Hanno Becker50b59662019-05-28 14:30:45 +01003431 * Define bitflag determining compile-time settings influencing
3432 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01003433 */
3434
Hanno Becker50b59662019-05-28 14:30:45 +01003435#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01003436#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01003437#else
Hanno Becker3e088662019-05-29 11:10:18 +01003438#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003439#endif /* MBEDTLS_HAVE_TIME */
3440
3441#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01003442#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003443#else
Hanno Becker3e088662019-05-29 11:10:18 +01003444#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003445#endif /* MBEDTLS_X509_CRT_PARSE_C */
3446
3447#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01003448#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003449#else
Hanno Becker3e088662019-05-29 11:10:18 +01003450#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003451#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
3452
3453#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01003454#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003455#else
Hanno Becker3e088662019-05-29 11:10:18 +01003456#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003457#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
3458
Hanno Becker94ef3b32019-05-16 12:50:45 +01003459#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01003460#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003461#else
Hanno Becker3e088662019-05-29 11:10:18 +01003462#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003463#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
3464
Hanno Becker94ef3b32019-05-16 12:50:45 +01003465#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3466#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
3467#else
3468#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
3469#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3470
Hanno Becker3e088662019-05-29 11:10:18 +01003471#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
3472#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
3473#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
3474#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01003475#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
3476#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01003477
Hanno Becker50b59662019-05-28 14:30:45 +01003478#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Gilles Peskine449bd832023-01-11 14:50:10 +01003479 ((uint16_t) ( \
3480 (SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT) | \
3481 (SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT) | \
3482 (SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << \
3483 SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT) | \
3484 (SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT) | \
3485 (SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT) | \
3486 (SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT)))
Hanno Becker94ef3b32019-05-16 12:50:45 +01003487
Hanno Beckerf8787072019-05-16 12:41:07 +01003488static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01003489 MBEDTLS_VERSION_MAJOR,
3490 MBEDTLS_VERSION_MINOR,
3491 MBEDTLS_VERSION_PATCH,
Gilles Peskine449bd832023-01-11 14:50:10 +01003492 MBEDTLS_BYTE_1(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
3493 MBEDTLS_BYTE_0(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
Hanno Beckerf8787072019-05-16 12:41:07 +01003494};
Hanno Beckera835da52019-05-16 12:39:07 +01003495
3496/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003497 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02003498 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003499 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003500 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01003501 *
Hanno Beckerdce50972021-08-01 05:39:23 +01003502 * opaque mbedtls_version[3]; // library version: major, minor, patch
3503 * opaque session_format[2]; // library-version specific 16-bit field
3504 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003505 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01003506 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003507 * Note: When updating the format, remember to keep
3508 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003509 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003510 * // In this version, `session_format` determines
3511 * // the setting of those compile-time
3512 * // configuration options which influence
3513 * // the structure of mbedtls_ssl_session.
3514 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003515 * uint8_t minor_ver; // Protocol minor version. Possible values:
Jerry Yu0c2a7382022-12-06 13:27:25 +08003516 * // - TLS 1.2 (0x0303)
3517 * // - TLS 1.3 (0x0304)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003518 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003519 * select (serialized_session.tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003520 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003521 * case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003522 * serialized_session_tls12 data;
Jerry Yu0c2a7382022-12-06 13:27:25 +08003523 * case MBEDTLS_SSL_VERSION_TLS1_3:
Jerry Yuddda0502022-12-01 19:43:12 +08003524 * serialized_session_tls13 data;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003525 *
3526 * };
3527 *
3528 * } serialized_session;
3529 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003530 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003531
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003532MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003533static int ssl_session_save(const mbedtls_ssl_session *session,
3534 unsigned char omit_header,
3535 unsigned char *buf,
3536 size_t buf_len,
3537 size_t *olen)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003538{
3539 unsigned char *p = buf;
3540 size_t used = 0;
Jerry Yu251a12e2022-07-13 15:15:48 +08003541 size_t remaining_len;
Jerry Yue36fdd62022-08-17 21:31:36 +08003542#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3543 size_t out_len;
3544 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3545#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01003546 if (session == NULL) {
3547 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3548 }
Jerry Yu438ddd82022-07-07 06:55:50 +00003549
Gilles Peskine449bd832023-01-11 14:50:10 +01003550 if (!omit_header) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003551 /*
3552 * Add Mbed TLS version identifier
3553 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003554 used += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003555
Gilles Peskine449bd832023-01-11 14:50:10 +01003556 if (used <= buf_len) {
3557 memcpy(p, ssl_serialized_session_header,
3558 sizeof(ssl_serialized_session_header));
3559 p += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003560 }
3561 }
3562
3563 /*
3564 * TLS version identifier
3565 */
3566 used += 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003567 if (used <= buf_len) {
3568 *p++ = MBEDTLS_BYTE_0(session->tls_version);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003569 }
3570
3571 /* Forward to version-specific serialization routine. */
Jerry Yufca4d572022-07-21 10:37:48 +08003572 remaining_len = (buf_len >= used) ? buf_len - used : 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003573 switch (session->tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003574#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01003575 case MBEDTLS_SSL_VERSION_TLS1_2:
3576 used += ssl_tls12_session_save(session, p, remaining_len);
3577 break;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003578#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3579
Jerry Yu251a12e2022-07-13 15:15:48 +08003580#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01003581 case MBEDTLS_SSL_VERSION_TLS1_3:
3582 ret = ssl_tls13_session_save(session, p, remaining_len, &out_len);
3583 if (ret != 0 && ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) {
3584 return ret;
3585 }
3586 used += out_len;
3587 break;
Jerry Yu251a12e2022-07-13 15:15:48 +08003588#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3589
Gilles Peskine449bd832023-01-11 14:50:10 +01003590 default:
3591 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003592 }
3593
3594 *olen = used;
Gilles Peskine449bd832023-01-11 14:50:10 +01003595 if (used > buf_len) {
3596 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
3597 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003598
Gilles Peskine449bd832023-01-11 14:50:10 +01003599 return 0;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003600}
3601
3602/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003603 * Public wrapper for ssl_session_save()
3604 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003605int mbedtls_ssl_session_save(const mbedtls_ssl_session *session,
3606 unsigned char *buf,
3607 size_t buf_len,
3608 size_t *olen)
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003609{
Gilles Peskine449bd832023-01-11 14:50:10 +01003610 return ssl_session_save(session, 0, buf, buf_len, olen);
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003611}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003612
Jerry Yuf1b23ca2022-02-18 11:48:47 +08003613/*
3614 * Deserialize session, see mbedtls_ssl_session_save() for format.
3615 *
3616 * This internal version is wrapped by a public function that cleans up in
3617 * case of error, and has an extra option omit_header.
3618 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003619MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003620static int ssl_session_load(mbedtls_ssl_session *session,
3621 unsigned char omit_header,
3622 const unsigned char *buf,
3623 size_t len)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003624{
3625 const unsigned char *p = buf;
3626 const unsigned char * const end = buf + len;
Jerry Yu438ddd82022-07-07 06:55:50 +00003627 size_t remaining_len;
3628
3629
Gilles Peskine449bd832023-01-11 14:50:10 +01003630 if (session == NULL) {
3631 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3632 }
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003633
Gilles Peskine449bd832023-01-11 14:50:10 +01003634 if (!omit_header) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003635 /*
3636 * Check Mbed TLS version identifier
3637 */
3638
Gilles Peskine449bd832023-01-11 14:50:10 +01003639 if ((size_t) (end - p) < sizeof(ssl_serialized_session_header)) {
3640 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003641 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003642
3643 if (memcmp(p, ssl_serialized_session_header,
3644 sizeof(ssl_serialized_session_header)) != 0) {
3645 return MBEDTLS_ERR_SSL_VERSION_MISMATCH;
3646 }
3647 p += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003648 }
3649
3650 /*
3651 * TLS version identifier
3652 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003653 if (1 > (size_t) (end - p)) {
3654 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3655 }
Glenn Straussda7851c2022-03-14 13:29:48 -04003656 session->tls_version = 0x0300 | *p++;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003657
3658 /* Dispatch according to TLS version. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003659 remaining_len = (end - p);
3660 switch (session->tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003661#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01003662 case MBEDTLS_SSL_VERSION_TLS1_2:
3663 return ssl_tls12_session_load(session, p, remaining_len);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003664#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3665
Jerry Yu438ddd82022-07-07 06:55:50 +00003666#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01003667 case MBEDTLS_SSL_VERSION_TLS1_3:
3668 return ssl_tls13_session_load(session, p, remaining_len);
Jerry Yu438ddd82022-07-07 06:55:50 +00003669#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3670
Gilles Peskine449bd832023-01-11 14:50:10 +01003671 default:
3672 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003673 }
3674}
3675
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003676/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003677 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003678 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003679int mbedtls_ssl_session_load(mbedtls_ssl_session *session,
3680 const unsigned char *buf,
3681 size_t len)
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003682{
Gilles Peskine449bd832023-01-11 14:50:10 +01003683 int ret = ssl_session_load(session, 0, buf, len);
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003684
Gilles Peskine449bd832023-01-11 14:50:10 +01003685 if (ret != 0) {
3686 mbedtls_ssl_session_free(session);
3687 }
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003688
Gilles Peskine449bd832023-01-11 14:50:10 +01003689 return ret;
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003690}
3691
3692/*
Paul Bakker1961b702013-01-25 14:49:24 +01003693 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00003694 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003695MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003696static int ssl_prepare_handshake_step(mbedtls_ssl_context *ssl)
Hanno Becker41934dd2021-08-07 19:13:43 +01003697{
3698 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3699
Ronald Cron66dbf912022-02-02 15:33:46 +01003700 /*
3701 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01003702 * that were written into the output buffer by the previous handshake step,
3703 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01003704 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
3705 * We proceed to the next handshake step only when all data from the
3706 * previous one have been sent to the peer, thus we make sure that this is
3707 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
3708 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
3709 * we have to wait before to go ahead.
3710 * In the case of TLS 1.3, handshake step handlers do not send data to the
3711 * peer. Data are only sent here and through
3712 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
Andrzej Kurek5c65c572022-04-13 14:28:52 -04003713 * alert occurred.
Ronald Cron66dbf912022-02-02 15:33:46 +01003714 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003715 if ((ret = mbedtls_ssl_flush_output(ssl)) != 0) {
3716 return ret;
3717 }
Hanno Becker41934dd2021-08-07 19:13:43 +01003718
3719#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003720 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3721 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING) {
3722 if ((ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
3723 return ret;
3724 }
Hanno Becker41934dd2021-08-07 19:13:43 +01003725 }
3726#endif /* MBEDTLS_SSL_PROTO_DTLS */
3727
Gilles Peskine449bd832023-01-11 14:50:10 +01003728 return ret;
Hanno Becker41934dd2021-08-07 19:13:43 +01003729}
3730
Gilles Peskine449bd832023-01-11 14:50:10 +01003731int mbedtls_ssl_handshake_step(mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00003732{
Hanno Becker41934dd2021-08-07 19:13:43 +01003733 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00003734
Gilles Peskine449bd832023-01-11 14:50:10 +01003735 if (ssl == NULL ||
Hanno Becker41934dd2021-08-07 19:13:43 +01003736 ssl->conf == NULL ||
3737 ssl->handshake == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01003738 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER) {
3739 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker41934dd2021-08-07 19:13:43 +01003740 }
3741
Gilles Peskine449bd832023-01-11 14:50:10 +01003742 ret = ssl_prepare_handshake_step(ssl);
3743 if (ret != 0) {
3744 return ret;
3745 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003746
Gilles Peskine449bd832023-01-11 14:50:10 +01003747 ret = mbedtls_ssl_handle_pending_alert(ssl);
3748 if (ret != 0) {
Jerry Yue7047812021-09-13 19:26:39 +08003749 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01003750 }
Jerry Yue7047812021-09-13 19:26:39 +08003751
Tom Cosgrove2fdc7b32022-09-21 12:33:17 +01003752 /* If ssl->conf->endpoint is not one of MBEDTLS_SSL_IS_CLIENT or
3753 * MBEDTLS_SSL_IS_SERVER, this is the return code we give */
3754 ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3755
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003756#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003757 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
3758 MBEDTLS_SSL_DEBUG_MSG(2, ("client state: %s",
3759 mbedtls_ssl_states_str(ssl->state)));
Jerry Yub9930e72021-08-06 17:11:51 +08003760
Gilles Peskine449bd832023-01-11 14:50:10 +01003761 switch (ssl->state) {
Ronald Cron9f0fba32022-02-10 16:45:15 +01003762 case MBEDTLS_SSL_HELLO_REQUEST:
3763 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Tom Cosgrove87d9c6c2022-09-22 09:27:56 +01003764 ret = 0;
Ronald Cron9f0fba32022-02-10 16:45:15 +01003765 break;
Jerry Yub9930e72021-08-06 17:11:51 +08003766
Ronald Cron9f0fba32022-02-10 16:45:15 +01003767 case MBEDTLS_SSL_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01003768 ret = mbedtls_ssl_write_client_hello(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01003769 break;
3770
3771 default:
3772#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01003773 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
3774 ret = mbedtls_ssl_tls13_handshake_client_step(ssl);
3775 } else {
3776 ret = mbedtls_ssl_handshake_client_step(ssl);
3777 }
Ronald Cron9f0fba32022-02-10 16:45:15 +01003778#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01003779 ret = mbedtls_ssl_handshake_client_step(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01003780#else
Gilles Peskine449bd832023-01-11 14:50:10 +01003781 ret = mbedtls_ssl_tls13_handshake_client_step(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01003782#endif
3783 }
Jerry Yub9930e72021-08-06 17:11:51 +08003784 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003785#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003786#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003787 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Ronald Cron6f135e12021-12-08 16:57:54 +01003788#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01003789 if (mbedtls_ssl_conf_is_tls13_only(ssl->conf)) {
3790 ret = mbedtls_ssl_tls13_handshake_server_step(ssl);
3791 }
Ronald Cron6f135e12021-12-08 16:57:54 +01003792#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08003793
3794#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01003795 if (mbedtls_ssl_conf_is_tls12_only(ssl->conf)) {
3796 ret = mbedtls_ssl_handshake_server_step(ssl);
3797 }
Jerry Yub9930e72021-08-06 17:11:51 +08003798#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3799 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003800#endif
3801
Gilles Peskine449bd832023-01-11 14:50:10 +01003802 if (ret != 0) {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08003803 /* handshake_step return error. And it is same
3804 * with alert_reason.
3805 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003806 if (ssl->send_alert) {
3807 ret = mbedtls_ssl_handle_pending_alert(ssl);
Jerry Yue7047812021-09-13 19:26:39 +08003808 goto cleanup;
3809 }
3810 }
3811
3812cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01003813 return ret;
Paul Bakker1961b702013-01-25 14:49:24 +01003814}
3815
3816/*
3817 * Perform the SSL handshake
3818 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003819int mbedtls_ssl_handshake(mbedtls_ssl_context *ssl)
Paul Bakker1961b702013-01-25 14:49:24 +01003820{
3821 int ret = 0;
3822
Hanno Beckera817ea42020-10-20 15:20:23 +01003823 /* Sanity checks */
3824
Gilles Peskine449bd832023-01-11 14:50:10 +01003825 if (ssl == NULL || ssl->conf == NULL) {
3826 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3827 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003828
Hanno Beckera817ea42020-10-20 15:20:23 +01003829#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003830 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3831 (ssl->f_set_timer == NULL || ssl->f_get_timer == NULL)) {
3832 MBEDTLS_SSL_DEBUG_MSG(1, ("You must use "
3833 "mbedtls_ssl_set_timer_cb() for DTLS"));
3834 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckera817ea42020-10-20 15:20:23 +01003835 }
3836#endif /* MBEDTLS_SSL_PROTO_DTLS */
3837
Gilles Peskine449bd832023-01-11 14:50:10 +01003838 MBEDTLS_SSL_DEBUG_MSG(2, ("=> handshake"));
Paul Bakker1961b702013-01-25 14:49:24 +01003839
Hanno Beckera817ea42020-10-20 15:20:23 +01003840 /* Main handshake loop */
Gilles Peskine449bd832023-01-11 14:50:10 +01003841 while (ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER) {
3842 ret = mbedtls_ssl_handshake_step(ssl);
Paul Bakker1961b702013-01-25 14:49:24 +01003843
Gilles Peskine449bd832023-01-11 14:50:10 +01003844 if (ret != 0) {
Paul Bakker1961b702013-01-25 14:49:24 +01003845 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01003846 }
Paul Bakker1961b702013-01-25 14:49:24 +01003847 }
3848
Gilles Peskine449bd832023-01-11 14:50:10 +01003849 MBEDTLS_SSL_DEBUG_MSG(2, ("<= handshake"));
Paul Bakker5121ce52009-01-03 21:22:43 +00003850
Gilles Peskine449bd832023-01-11 14:50:10 +01003851 return ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00003852}
3853
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003854#if defined(MBEDTLS_SSL_RENEGOTIATION)
3855#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00003856/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003857 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00003858 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003859MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003860static int ssl_write_hello_request(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003861{
Janos Follath865b3eb2019-12-16 11:46:15 +00003862 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003863
Gilles Peskine449bd832023-01-11 14:50:10 +01003864 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello request"));
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003865
3866 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003867 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3868 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003869
Gilles Peskine449bd832023-01-11 14:50:10 +01003870 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
3871 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
3872 return ret;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003873 }
3874
Gilles Peskine449bd832023-01-11 14:50:10 +01003875 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello request"));
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003876
Gilles Peskine449bd832023-01-11 14:50:10 +01003877 return 0;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003878}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003879#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003880
3881/*
3882 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003883 * - any side: calling mbedtls_ssl_renegotiate(),
3884 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
3885 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02003886 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003887 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003888 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003889 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003890int mbedtls_ssl_start_renegotiation(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +00003891{
Janos Follath865b3eb2019-12-16 11:46:15 +00003892 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00003893
Gilles Peskine449bd832023-01-11 14:50:10 +01003894 MBEDTLS_SSL_DEBUG_MSG(2, ("=> renegotiate"));
Paul Bakker48916f92012-09-16 19:57:18 +00003895
Gilles Peskine449bd832023-01-11 14:50:10 +01003896 if ((ret = ssl_handshake_init(ssl)) != 0) {
3897 return ret;
3898 }
Paul Bakker48916f92012-09-16 19:57:18 +00003899
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003900 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
3901 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003902#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003903 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3904 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING) {
3905 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003906 ssl->handshake->out_msg_seq = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003907 } else {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003908 ssl->handshake->in_msg_seq = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003909 }
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003910 }
3911#endif
3912
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003913 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3914 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00003915
Gilles Peskine449bd832023-01-11 14:50:10 +01003916 if ((ret = mbedtls_ssl_handshake(ssl)) != 0) {
3917 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_handshake", ret);
3918 return ret;
Paul Bakker48916f92012-09-16 19:57:18 +00003919 }
3920
Gilles Peskine449bd832023-01-11 14:50:10 +01003921 MBEDTLS_SSL_DEBUG_MSG(2, ("<= renegotiate"));
Paul Bakker48916f92012-09-16 19:57:18 +00003922
Gilles Peskine449bd832023-01-11 14:50:10 +01003923 return 0;
Paul Bakker48916f92012-09-16 19:57:18 +00003924}
3925
3926/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003927 * Renegotiate current connection on client,
3928 * or request renegotiation on server
3929 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003930int mbedtls_ssl_renegotiate(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003931{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003932 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003933
Gilles Peskine449bd832023-01-11 14:50:10 +01003934 if (ssl == NULL || ssl->conf == NULL) {
3935 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3936 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003937
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003938#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003939 /* On server, just send the request */
Gilles Peskine449bd832023-01-11 14:50:10 +01003940 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
3941 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
3942 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3943 }
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003944
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003945 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003946
3947 /* Did we already try/start sending HelloRequest? */
Gilles Peskine449bd832023-01-11 14:50:10 +01003948 if (ssl->out_left != 0) {
3949 return mbedtls_ssl_flush_output(ssl);
3950 }
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003951
Gilles Peskine449bd832023-01-11 14:50:10 +01003952 return ssl_write_hello_request(ssl);
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003953 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003954#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003955
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003956#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003957 /*
3958 * On client, either start the renegotiation process or,
3959 * if already in progress, continue the handshake
3960 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003961 if (ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
3962 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
3963 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003964 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003965
3966 if ((ret = mbedtls_ssl_start_renegotiation(ssl)) != 0) {
3967 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_start_renegotiation", ret);
3968 return ret;
3969 }
3970 } else {
3971 if ((ret = mbedtls_ssl_handshake(ssl)) != 0) {
3972 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_handshake", ret);
3973 return ret;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003974 }
3975 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003976#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003977
Gilles Peskine449bd832023-01-11 14:50:10 +01003978 return ret;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003979}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003980#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003981
Gilles Peskine449bd832023-01-11 14:50:10 +01003982void mbedtls_ssl_handshake_free(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +00003983{
Gilles Peskine9b562d52018-04-25 20:32:43 +02003984 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3985
Gilles Peskine449bd832023-01-11 14:50:10 +01003986 if (handshake == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003987 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01003988 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003989
Brett Warrene0edc842021-08-17 09:53:13 +01003990#if defined(MBEDTLS_ECP_C)
3991#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01003992 if (ssl->handshake->group_list_heap_allocated) {
3993 mbedtls_free((void *) handshake->group_list);
3994 }
Brett Warrene0edc842021-08-17 09:53:13 +01003995 handshake->group_list = NULL;
3996#endif /* MBEDTLS_DEPRECATED_REMOVED */
3997#endif /* MBEDTLS_ECP_C */
3998
Ronald Crone68ab4f2022-10-05 12:46:29 +02003999#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004000#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004001 if (ssl->handshake->sig_algs_heap_allocated) {
4002 mbedtls_free((void *) handshake->sig_algs);
4003 }
Jerry Yuf017ee42022-01-12 15:49:48 +08004004 handshake->sig_algs = NULL;
4005#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00004006#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004007 if (ssl->handshake->certificate_request_context) {
4008 mbedtls_free((void *) handshake->certificate_request_context);
Xiaofei Baic234ecf2022-02-08 09:59:23 +00004009 }
4010#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02004011#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yuf017ee42022-01-12 15:49:48 +08004012
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004013#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01004014 if (ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0) {
4015 ssl->conf->f_async_cancel(ssl);
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004016 handshake->async_in_progress = 0;
4017 }
4018#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
4019
Andrzej Kurek25f27152022-08-17 16:09:31 -04004020#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -05004021#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004022 psa_hash_abort(&handshake->fin_sha256_psa);
Andrzej Kurekeb342242019-01-29 09:14:33 -05004023#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004024 mbedtls_sha256_free(&handshake->fin_sha256);
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004025#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05004026#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04004027#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Andrzej Kurekeb342242019-01-29 09:14:33 -05004028#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004029 psa_hash_abort(&handshake->fin_sha384_psa);
Andrzej Kurekeb342242019-01-29 09:14:33 -05004030#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004031 mbedtls_sha512_free(&handshake->fin_sha384);
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004032#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05004033#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004034
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004035#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004036 mbedtls_dhm_free(&handshake->dhm_ctx);
Paul Bakker48916f92012-09-16 19:57:18 +00004037#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +02004038#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004039 mbedtls_ecdh_free(&handshake->ecdh_ctx);
Paul Bakker61d113b2013-07-04 11:51:43 +02004040#endif
Valerio Setti02c25b52022-11-15 14:08:42 +01004041
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02004042#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +02004043#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004044 psa_pake_abort(&handshake->psa_pake_ctx);
Valerio Settieb3f7882022-12-08 18:42:58 +01004045 /*
4046 * Opaque keys are not stored in the handshake's data and it's the user
4047 * responsibility to destroy them. Clear ones, instead, are created by
4048 * the TLS library and should be destroyed at the same level
4049 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004050 if (!mbedtls_svc_key_id_is_null(handshake->psa_pake_password)) {
4051 psa_destroy_key(handshake->psa_pake_password);
Valerio Settieb3f7882022-12-08 18:42:58 +01004052 }
Neil Armstrongca7d5062022-05-31 14:43:23 +02004053 handshake->psa_pake_password = MBEDTLS_SVC_KEY_ID_INIT;
4054#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004055 mbedtls_ecjpake_free(&handshake->ecjpake_ctx);
Neil Armstrongca7d5062022-05-31 14:43:23 +02004056#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02004057#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004058 mbedtls_free(handshake->ecjpake_cache);
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02004059 handshake->ecjpake_cache = NULL;
4060 handshake->ecjpake_cache_len = 0;
4061#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02004062#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02004063
Janos Follath4ae5c292016-02-10 11:27:43 +00004064#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
4065 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02004066 /* explicit void pointer cast for buggy MS compiler */
Gilles Peskine449bd832023-01-11 14:50:10 +01004067 mbedtls_free((void *) handshake->curves_tls_id);
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02004068#endif
4069
Ronald Cron73fe8df2022-10-05 14:31:43 +02004070#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02004071#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004072 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02004073 /* The maintenance of the external PSK key slot is the
4074 * user's responsibility. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004075 if (ssl->handshake->psk_opaque_is_internal) {
4076 psa_destroy_key(ssl->handshake->psk_opaque);
Neil Armstrong501c9322022-05-03 09:35:09 +02004077 ssl->handshake->psk_opaque_is_internal = 0;
4078 }
4079 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4080 }
Neil Armstronge952a302022-05-03 10:22:14 +02004081#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004082 if (handshake->psk != NULL) {
4083 mbedtls_platform_zeroize(handshake->psk, handshake->psk_len);
4084 mbedtls_free(handshake->psk);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004085 }
Neil Armstronge952a302022-05-03 10:22:14 +02004086#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Cron73fe8df2022-10-05 14:31:43 +02004087#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004089#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
4090 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02004091 /*
4092 * Free only the linked list wrapper, not the keys themselves
4093 * since the belong to the SNI callback
4094 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004095 ssl_key_cert_free(handshake->sni_key_cert);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004096#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02004097
Gilles Peskineeccd8882020-03-10 12:19:08 +01004098#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004099 mbedtls_x509_crt_restart_free(&handshake->ecrs_ctx);
4100 if (handshake->ecrs_peer_cert != NULL) {
4101 mbedtls_x509_crt_free(handshake->ecrs_peer_cert);
4102 mbedtls_free(handshake->ecrs_peer_cert);
Hanno Becker3dad3112019-02-05 17:19:52 +00004103 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02004104#endif
4105
Hanno Becker75173122019-02-06 16:18:31 +00004106#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
4107 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01004108 mbedtls_pk_free(&handshake->peer_pubkey);
Hanno Becker75173122019-02-06 16:18:31 +00004109#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4110
XiaokangQian9b93c0d2022-02-09 06:02:25 +00004111#if defined(MBEDTLS_SSL_CLI_C) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01004112 (defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3))
4113 mbedtls_free(handshake->cookie);
XiaokangQian9b93c0d2022-02-09 06:02:25 +00004114#endif /* MBEDTLS_SSL_CLI_C &&
4115 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00004116
4117#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004118 mbedtls_ssl_flight_free(handshake->flight);
4119 mbedtls_ssl_buffering_free(ssl);
XiaokangQian8499b6c2022-01-27 09:00:11 +00004120#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02004121
Ronald Cronf12b81d2022-03-15 10:42:41 +01004122#if defined(MBEDTLS_ECDH_C) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01004123 (defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3))
4124 if (handshake->ecdh_psa_privkey_is_external == 0) {
4125 psa_destroy_key(handshake->ecdh_psa_privkey);
4126 }
Hanno Becker4a63ed42019-01-08 11:39:35 +00004127#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
4128
Ronald Cron6f135e12021-12-08 16:57:54 +01004129#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004130 mbedtls_ssl_transform_free(handshake->transform_handshake);
4131 mbedtls_free(handshake->transform_handshake);
Jerry Yu3d9b5902022-11-04 14:07:25 +08004132#if defined(MBEDTLS_SSL_EARLY_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01004133 mbedtls_ssl_transform_free(handshake->transform_earlydata);
4134 mbedtls_free(handshake->transform_earlydata);
Jerry Yu3d9b5902022-11-04 14:07:25 +08004135#endif
Ronald Cron6f135e12021-12-08 16:57:54 +01004136#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08004137
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004138
4139#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4140 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
4141 * processes datagrams and the fact that a datagram is allowed to have
4142 * several records in it, it is possible that the I/O buffers are not
4143 * empty at this stage */
Gilles Peskine449bd832023-01-11 14:50:10 +01004144 handle_buffer_resizing(ssl, 1, mbedtls_ssl_get_input_buflen(ssl),
4145 mbedtls_ssl_get_output_buflen(ssl));
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004146#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01004147
Jerry Yuba9c7272021-10-30 11:54:10 +08004148 /* mbedtls_platform_zeroize MUST be last one in this function */
Gilles Peskine449bd832023-01-11 14:50:10 +01004149 mbedtls_platform_zeroize(handshake,
4150 sizeof(mbedtls_ssl_handshake_params));
Paul Bakker48916f92012-09-16 19:57:18 +00004151}
4152
Gilles Peskine449bd832023-01-11 14:50:10 +01004153void mbedtls_ssl_session_free(mbedtls_ssl_session *session)
Paul Bakker48916f92012-09-16 19:57:18 +00004154{
Gilles Peskine449bd832023-01-11 14:50:10 +01004155 if (session == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004156 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01004157 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004158
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004159#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004160 ssl_clear_peer_cert(session);
Paul Bakkered27a042013-04-18 22:46:23 +02004161#endif
Paul Bakker0a597072012-09-25 21:55:46 +00004162
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004163#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00004164#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
4165 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01004166 mbedtls_free(session->hostname);
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00004167#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01004168 mbedtls_free(session->ticket);
Paul Bakkera503a632013-08-14 13:48:06 +02004169#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02004170
Gilles Peskine449bd832023-01-11 14:50:10 +01004171 mbedtls_platform_zeroize(session, sizeof(mbedtls_ssl_session));
Paul Bakker48916f92012-09-16 19:57:18 +00004172}
4173
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004174#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004175
4176#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4177#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
4178#else
4179#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
4180#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4181
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004182#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004183
4184#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4185#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
4186#else
4187#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
4188#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4189
4190#if defined(MBEDTLS_SSL_ALPN)
4191#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
4192#else
4193#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
4194#endif /* MBEDTLS_SSL_ALPN */
4195
4196#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
4197#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
4198#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
4199#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
4200
4201#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
Gilles Peskine449bd832023-01-11 14:50:10 +01004202 ((uint32_t) ( \
4203 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << \
4204 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT) | \
4205 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << \
4206 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT) | \
4207 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << \
4208 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT) | \
4209 (SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT) | \
4210 0u))
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004211
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004212static unsigned char ssl_serialized_context_header[] = {
4213 MBEDTLS_VERSION_MAJOR,
4214 MBEDTLS_VERSION_MINOR,
4215 MBEDTLS_VERSION_PATCH,
Gilles Peskine449bd832023-01-11 14:50:10 +01004216 MBEDTLS_BYTE_1(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
4217 MBEDTLS_BYTE_0(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
4218 MBEDTLS_BYTE_2(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
4219 MBEDTLS_BYTE_1(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
4220 MBEDTLS_BYTE_0(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004221};
4222
Paul Bakker5121ce52009-01-03 21:22:43 +00004223/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004224 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004225 *
4226 * The format of the serialized data is:
4227 * (in the presentation language of TLS, RFC 8446 section 3)
4228 *
4229 * // header
4230 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004231 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004232 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004233 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004234 * Note: When updating the format, remember to keep these
4235 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004236 *
4237 * // session sub-structure
4238 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
4239 * // transform sub-structure
4240 * uint8 random[64]; // ServerHello.random+ClientHello.random
4241 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
4242 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
4243 * // fields from ssl_context
4244 * uint32 badmac_seen; // DTLS: number of records with failing MAC
4245 * uint64 in_window_top; // DTLS: last validated record seq_num
4246 * uint64 in_window; // DTLS: bitmask for replay protection
4247 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
4248 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
4249 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
4250 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
4251 *
4252 * Note that many fields of the ssl_context or sub-structures are not
4253 * serialized, as they fall in one of the following categories:
4254 *
4255 * 1. forced value (eg in_left must be 0)
4256 * 2. pointer to dynamically-allocated memory (eg session, transform)
4257 * 3. value can be re-derived from other data (eg session keys from MS)
4258 * 4. value was temporary (eg content of input buffer)
4259 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004260 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004261int mbedtls_ssl_context_save(mbedtls_ssl_context *ssl,
4262 unsigned char *buf,
4263 size_t buf_len,
4264 size_t *olen)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004265{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004266 unsigned char *p = buf;
4267 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004268 size_t session_len;
4269 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004270
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02004271 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004272 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
4273 * this function's documentation.
4274 *
4275 * These are due to assumptions/limitations in the implementation. Some of
4276 * them are likely to stay (no handshake in progress) some might go away
4277 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02004278 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004279 /* The initial handshake must be over */
Gilles Peskine449bd832023-01-11 14:50:10 +01004280 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
4281 MBEDTLS_SSL_DEBUG_MSG(1, ("Initial handshake isn't over"));
4282 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004283 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004284 if (ssl->handshake != NULL) {
4285 MBEDTLS_SSL_DEBUG_MSG(1, ("Handshake isn't completed"));
4286 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004287 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004288 /* Double-check that sub-structures are indeed ready */
Gilles Peskine449bd832023-01-11 14:50:10 +01004289 if (ssl->transform == NULL || ssl->session == NULL) {
4290 MBEDTLS_SSL_DEBUG_MSG(1, ("Serialised structures aren't ready"));
4291 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004292 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004293 /* There must be no pending incoming or outgoing data */
Gilles Peskine449bd832023-01-11 14:50:10 +01004294 if (mbedtls_ssl_check_pending(ssl) != 0) {
4295 MBEDTLS_SSL_DEBUG_MSG(1, ("There is pending incoming data"));
4296 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004297 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004298 if (ssl->out_left != 0) {
4299 MBEDTLS_SSL_DEBUG_MSG(1, ("There is pending outgoing data"));
4300 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004301 }
Dave Rodgman556e8a32022-12-06 16:31:25 +00004302 /* Protocol must be DTLS, not TLS */
Gilles Peskine449bd832023-01-11 14:50:10 +01004303 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
4304 MBEDTLS_SSL_DEBUG_MSG(1, ("Only DTLS is supported"));
4305 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004306 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004307 /* Version must be 1.2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004308 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2) {
4309 MBEDTLS_SSL_DEBUG_MSG(1, ("Only version 1.2 supported"));
4310 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004311 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004312 /* We must be using an AEAD ciphersuite */
Gilles Peskine449bd832023-01-11 14:50:10 +01004313 if (mbedtls_ssl_transform_uses_aead(ssl->transform) != 1) {
4314 MBEDTLS_SSL_DEBUG_MSG(1, ("Only AEAD ciphersuites supported"));
4315 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004316 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004317 /* Renegotiation must not be enabled */
4318#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01004319 if (ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED) {
4320 MBEDTLS_SSL_DEBUG_MSG(1, ("Renegotiation must not be enabled"));
4321 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004322 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004323#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004324
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004325 /*
4326 * Version and format identifier
4327 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004328 used += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004329
Gilles Peskine449bd832023-01-11 14:50:10 +01004330 if (used <= buf_len) {
4331 memcpy(p, ssl_serialized_context_header,
4332 sizeof(ssl_serialized_context_header));
4333 p += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004334 }
4335
4336 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004337 * Session (length + data)
4338 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004339 ret = ssl_session_save(ssl->session, 1, NULL, 0, &session_len);
4340 if (ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) {
4341 return ret;
4342 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004343
4344 used += 4 + session_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004345 if (used <= buf_len) {
4346 MBEDTLS_PUT_UINT32_BE(session_len, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004347 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004348
Gilles Peskine449bd832023-01-11 14:50:10 +01004349 ret = ssl_session_save(ssl->session, 1,
4350 p, session_len, &session_len);
4351 if (ret != 0) {
4352 return ret;
4353 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004354
4355 p += session_len;
4356 }
4357
4358 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004359 * Transform
4360 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004361 used += sizeof(ssl->transform->randbytes);
4362 if (used <= buf_len) {
4363 memcpy(p, ssl->transform->randbytes,
4364 sizeof(ssl->transform->randbytes));
4365 p += sizeof(ssl->transform->randbytes);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004366 }
4367
4368#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4369 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004370 if (used <= buf_len) {
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004371 *p++ = ssl->transform->in_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004372 memcpy(p, ssl->transform->in_cid, ssl->transform->in_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004373 p += ssl->transform->in_cid_len;
4374
4375 *p++ = ssl->transform->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004376 memcpy(p, ssl->transform->out_cid, ssl->transform->out_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004377 p += ssl->transform->out_cid_len;
4378 }
4379#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4380
4381 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004382 * Saved fields from top-level ssl_context structure
4383 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004384 used += 4;
Gilles Peskine449bd832023-01-11 14:50:10 +01004385 if (used <= buf_len) {
4386 MBEDTLS_PUT_UINT32_BE(ssl->badmac_seen, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004387 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004388 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004389
4390#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4391 used += 16;
Gilles Peskine449bd832023-01-11 14:50:10 +01004392 if (used <= buf_len) {
4393 MBEDTLS_PUT_UINT64_BE(ssl->in_window_top, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004394 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004395
Gilles Peskine449bd832023-01-11 14:50:10 +01004396 MBEDTLS_PUT_UINT64_BE(ssl->in_window, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004397 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004398 }
4399#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4400
4401#if defined(MBEDTLS_SSL_PROTO_DTLS)
4402 used += 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004403 if (used <= buf_len) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004404 *p++ = ssl->disable_datagram_packing;
4405 }
4406#endif /* MBEDTLS_SSL_PROTO_DTLS */
4407
Jerry Yuae0b2e22021-10-08 15:21:19 +08004408 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Gilles Peskine449bd832023-01-11 14:50:10 +01004409 if (used <= buf_len) {
4410 memcpy(p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN);
Jerry Yuae0b2e22021-10-08 15:21:19 +08004411 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004412 }
4413
4414#if defined(MBEDTLS_SSL_PROTO_DTLS)
4415 used += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01004416 if (used <= buf_len) {
4417 MBEDTLS_PUT_UINT16_BE(ssl->mtu, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004418 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004419 }
4420#endif /* MBEDTLS_SSL_PROTO_DTLS */
4421
4422#if defined(MBEDTLS_SSL_ALPN)
4423 {
4424 const uint8_t alpn_len = ssl->alpn_chosen
Gilles Peskine449bd832023-01-11 14:50:10 +01004425 ? (uint8_t) strlen(ssl->alpn_chosen)
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004426 : 0;
4427
4428 used += 1 + alpn_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004429 if (used <= buf_len) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004430 *p++ = alpn_len;
4431
Gilles Peskine449bd832023-01-11 14:50:10 +01004432 if (ssl->alpn_chosen != NULL) {
4433 memcpy(p, ssl->alpn_chosen, alpn_len);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004434 p += alpn_len;
4435 }
4436 }
4437 }
4438#endif /* MBEDTLS_SSL_ALPN */
4439
4440 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004441 * Done
4442 */
4443 *olen = used;
4444
Gilles Peskine449bd832023-01-11 14:50:10 +01004445 if (used > buf_len) {
4446 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
4447 }
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004448
Gilles Peskine449bd832023-01-11 14:50:10 +01004449 MBEDTLS_SSL_DEBUG_BUF(4, "saved context", buf, used);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004450
Gilles Peskine449bd832023-01-11 14:50:10 +01004451 return mbedtls_ssl_session_reset_int(ssl, 0);
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004452}
4453
4454/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004455 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004456 *
4457 * This internal version is wrapped by a public function that cleans up in
4458 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004459 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004460MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01004461static int ssl_context_load(mbedtls_ssl_context *ssl,
4462 const unsigned char *buf,
4463 size_t len)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004464{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004465 const unsigned char *p = buf;
4466 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004467 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00004468 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004469#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek894edde2022-09-29 06:31:14 -04004470 tls_prf_fn prf_func = NULL;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004471#endif
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004472
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004473 /*
4474 * The context should have been freshly setup or reset.
4475 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02004476 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004477 * renegotiating, or if the user mistakenly loaded a session first.)
4478 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004479 if (ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
4480 ssl->session != NULL) {
4481 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004482 }
4483
4484 /*
4485 * We can't check that the config matches the initial one, but we can at
4486 * least check it matches the requirements for serializing.
4487 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004488 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004489 ssl->conf->max_tls_version < MBEDTLS_SSL_VERSION_TLS1_2 ||
4490 ssl->conf->min_tls_version > MBEDTLS_SSL_VERSION_TLS1_2 ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004491#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02004492 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004493#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01004494 0) {
4495 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004496 }
4497
Gilles Peskine449bd832023-01-11 14:50:10 +01004498 MBEDTLS_SSL_DEBUG_BUF(4, "context to load", buf, len);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004499
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004500 /*
4501 * Check version identifier
4502 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004503 if ((size_t) (end - p) < sizeof(ssl_serialized_context_header)) {
4504 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004505 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004506
4507 if (memcmp(p, ssl_serialized_context_header,
4508 sizeof(ssl_serialized_context_header)) != 0) {
4509 return MBEDTLS_ERR_SSL_VERSION_MISMATCH;
4510 }
4511 p += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004512
4513 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004514 * Session
4515 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004516 if ((size_t) (end - p) < 4) {
4517 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4518 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004519
Gilles Peskine449bd832023-01-11 14:50:10 +01004520 session_len = ((size_t) p[0] << 24) |
4521 ((size_t) p[1] << 16) |
4522 ((size_t) p[2] << 8) |
4523 ((size_t) p[3]);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004524 p += 4;
4525
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004526 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004527 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004528 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004529 ssl->session_in = ssl->session;
4530 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004531 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004532
Gilles Peskine449bd832023-01-11 14:50:10 +01004533 if ((size_t) (end - p) < session_len) {
4534 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4535 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004536
Gilles Peskine449bd832023-01-11 14:50:10 +01004537 ret = ssl_session_load(ssl->session, 1, p, session_len);
4538 if (ret != 0) {
4539 mbedtls_ssl_session_free(ssl->session);
4540 return ret;
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004541 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004542
4543 p += session_len;
4544
4545 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004546 * Transform
4547 */
4548
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004549 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004550 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Jerry Yu2e199812022-12-01 18:57:19 +08004551#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004552 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004553 ssl->transform_in = ssl->transform;
4554 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004555 ssl->transform_negotiate = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08004556#endif
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004557
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004558#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01004559 prf_func = ssl_tls12prf_from_cs(ssl->session->ciphersuite);
4560 if (prf_func == NULL) {
4561 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4562 }
Andrzej Kurek894edde2022-09-29 06:31:14 -04004563
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004564 /* Read random bytes and populate structure */
Gilles Peskine449bd832023-01-11 14:50:10 +01004565 if ((size_t) (end - p) < sizeof(ssl->transform->randbytes)) {
4566 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4567 }
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004568
Gilles Peskine449bd832023-01-11 14:50:10 +01004569 ret = ssl_tls12_populate_transform(ssl->transform,
4570 ssl->session->ciphersuite,
4571 ssl->session->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004572#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004573 ssl->session->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004574#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01004575 prf_func,
4576 p, /* currently pointing to randbytes */
4577 MBEDTLS_SSL_VERSION_TLS1_2, /* (D)TLS 1.2 is forced */
4578 ssl->conf->endpoint,
4579 ssl);
4580 if (ret != 0) {
4581 return ret;
4582 }
Jerry Yu840fbb22022-02-17 14:59:29 +08004583#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004584 p += sizeof(ssl->transform->randbytes);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004585
4586#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4587 /* Read connection IDs and store them */
Gilles Peskine449bd832023-01-11 14:50:10 +01004588 if ((size_t) (end - p) < 1) {
4589 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4590 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004591
4592 ssl->transform->in_cid_len = *p++;
4593
Gilles Peskine449bd832023-01-11 14:50:10 +01004594 if ((size_t) (end - p) < ssl->transform->in_cid_len + 1u) {
4595 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4596 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004597
Gilles Peskine449bd832023-01-11 14:50:10 +01004598 memcpy(ssl->transform->in_cid, p, ssl->transform->in_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004599 p += ssl->transform->in_cid_len;
4600
4601 ssl->transform->out_cid_len = *p++;
4602
Gilles Peskine449bd832023-01-11 14:50:10 +01004603 if ((size_t) (end - p) < ssl->transform->out_cid_len) {
4604 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4605 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004606
Gilles Peskine449bd832023-01-11 14:50:10 +01004607 memcpy(ssl->transform->out_cid, p, ssl->transform->out_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004608 p += ssl->transform->out_cid_len;
4609#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4610
4611 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004612 * Saved fields from top-level ssl_context structure
4613 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004614 if ((size_t) (end - p) < 4) {
4615 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4616 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004617
Gilles Peskine449bd832023-01-11 14:50:10 +01004618 ssl->badmac_seen = ((uint32_t) p[0] << 24) |
4619 ((uint32_t) p[1] << 16) |
4620 ((uint32_t) p[2] << 8) |
4621 ((uint32_t) p[3]);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004622 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004623
4624#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01004625 if ((size_t) (end - p) < 16) {
4626 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4627 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004628
Gilles Peskine449bd832023-01-11 14:50:10 +01004629 ssl->in_window_top = ((uint64_t) p[0] << 56) |
4630 ((uint64_t) p[1] << 48) |
4631 ((uint64_t) p[2] << 40) |
4632 ((uint64_t) p[3] << 32) |
4633 ((uint64_t) p[4] << 24) |
4634 ((uint64_t) p[5] << 16) |
4635 ((uint64_t) p[6] << 8) |
4636 ((uint64_t) p[7]);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004637 p += 8;
4638
Gilles Peskine449bd832023-01-11 14:50:10 +01004639 ssl->in_window = ((uint64_t) p[0] << 56) |
4640 ((uint64_t) p[1] << 48) |
4641 ((uint64_t) p[2] << 40) |
4642 ((uint64_t) p[3] << 32) |
4643 ((uint64_t) p[4] << 24) |
4644 ((uint64_t) p[5] << 16) |
4645 ((uint64_t) p[6] << 8) |
4646 ((uint64_t) p[7]);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004647 p += 8;
4648#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4649
4650#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004651 if ((size_t) (end - p) < 1) {
4652 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4653 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004654
4655 ssl->disable_datagram_packing = *p++;
4656#endif /* MBEDTLS_SSL_PROTO_DTLS */
4657
Gilles Peskine449bd832023-01-11 14:50:10 +01004658 if ((size_t) (end - p) < sizeof(ssl->cur_out_ctr)) {
4659 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4660 }
4661 memcpy(ssl->cur_out_ctr, p, sizeof(ssl->cur_out_ctr));
4662 p += sizeof(ssl->cur_out_ctr);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004663
4664#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004665 if ((size_t) (end - p) < 2) {
4666 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4667 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004668
Gilles Peskine449bd832023-01-11 14:50:10 +01004669 ssl->mtu = (p[0] << 8) | p[1];
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004670 p += 2;
4671#endif /* MBEDTLS_SSL_PROTO_DTLS */
4672
4673#if defined(MBEDTLS_SSL_ALPN)
4674 {
4675 uint8_t alpn_len;
4676 const char **cur;
4677
Gilles Peskine449bd832023-01-11 14:50:10 +01004678 if ((size_t) (end - p) < 1) {
4679 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4680 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004681
4682 alpn_len = *p++;
4683
Gilles Peskine449bd832023-01-11 14:50:10 +01004684 if (alpn_len != 0 && ssl->conf->alpn_list != NULL) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004685 /* alpn_chosen should point to an item in the configured list */
Gilles Peskine449bd832023-01-11 14:50:10 +01004686 for (cur = ssl->conf->alpn_list; *cur != NULL; cur++) {
4687 if (strlen(*cur) == alpn_len &&
4688 memcmp(p, cur, alpn_len) == 0) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004689 ssl->alpn_chosen = *cur;
4690 break;
4691 }
4692 }
4693 }
4694
4695 /* can only happen on conf mismatch */
Gilles Peskine449bd832023-01-11 14:50:10 +01004696 if (alpn_len != 0 && ssl->alpn_chosen == NULL) {
4697 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4698 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004699
4700 p += alpn_len;
4701 }
4702#endif /* MBEDTLS_SSL_ALPN */
4703
4704 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004705 * Forced fields from top-level ssl_context structure
4706 *
4707 * Most of them already set to the correct value by mbedtls_ssl_init() and
4708 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
4709 */
4710 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Glenn Strauss60bfe602022-03-14 19:04:24 -04004711 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004712
Hanno Becker361b10d2019-08-30 10:42:49 +01004713 /* Adjust pointers for header fields of outgoing records to
4714 * the given transform, accounting for explicit IV and CID. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004715 mbedtls_ssl_update_out_pointers(ssl, ssl->transform);
Hanno Becker361b10d2019-08-30 10:42:49 +01004716
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004717#if defined(MBEDTLS_SSL_PROTO_DTLS)
4718 ssl->in_epoch = 1;
4719#endif
4720
4721 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
4722 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00004723 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
4724 * inappropriately. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004725 if (ssl->handshake != NULL) {
4726 mbedtls_ssl_handshake_free(ssl);
4727 mbedtls_free(ssl->handshake);
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004728 ssl->handshake = NULL;
4729 }
4730
4731 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004732 * Done - should have consumed entire buffer
4733 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004734 if (p != end) {
4735 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4736 }
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004737
Gilles Peskine449bd832023-01-11 14:50:10 +01004738 return 0;
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004739}
4740
4741/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004742 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004743 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004744int mbedtls_ssl_context_load(mbedtls_ssl_context *context,
4745 const unsigned char *buf,
4746 size_t len)
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004747{
Gilles Peskine449bd832023-01-11 14:50:10 +01004748 int ret = ssl_context_load(context, buf, len);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004749
Gilles Peskine449bd832023-01-11 14:50:10 +01004750 if (ret != 0) {
4751 mbedtls_ssl_free(context);
4752 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004753
Gilles Peskine449bd832023-01-11 14:50:10 +01004754 return ret;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004755}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004756#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004757
4758/*
Paul Bakker5121ce52009-01-03 21:22:43 +00004759 * Free an SSL context
4760 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004761void mbedtls_ssl_free(mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00004762{
Gilles Peskine449bd832023-01-11 14:50:10 +01004763 if (ssl == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004764 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01004765 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004766
Gilles Peskine449bd832023-01-11 14:50:10 +01004767 MBEDTLS_SSL_DEBUG_MSG(2, ("=> free"));
Paul Bakker5121ce52009-01-03 21:22:43 +00004768
Gilles Peskine449bd832023-01-11 14:50:10 +01004769 if (ssl->out_buf != NULL) {
sander-visserb8aa2072020-05-06 22:05:13 +02004770#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4771 size_t out_buf_len = ssl->out_buf_len;
4772#else
4773 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4774#endif
4775
Gilles Peskine449bd832023-01-11 14:50:10 +01004776 mbedtls_platform_zeroize(ssl->out_buf, out_buf_len);
4777 mbedtls_free(ssl->out_buf);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004778 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004779 }
4780
Gilles Peskine449bd832023-01-11 14:50:10 +01004781 if (ssl->in_buf != NULL) {
sander-visserb8aa2072020-05-06 22:05:13 +02004782#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4783 size_t in_buf_len = ssl->in_buf_len;
4784#else
4785 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4786#endif
4787
Gilles Peskine449bd832023-01-11 14:50:10 +01004788 mbedtls_platform_zeroize(ssl->in_buf, in_buf_len);
4789 mbedtls_free(ssl->in_buf);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004790 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004791 }
4792
Gilles Peskine449bd832023-01-11 14:50:10 +01004793 if (ssl->transform) {
4794 mbedtls_ssl_transform_free(ssl->transform);
4795 mbedtls_free(ssl->transform);
Paul Bakker48916f92012-09-16 19:57:18 +00004796 }
4797
Gilles Peskine449bd832023-01-11 14:50:10 +01004798 if (ssl->handshake) {
4799 mbedtls_ssl_handshake_free(ssl);
4800 mbedtls_free(ssl->handshake);
Jerry Yu2e199812022-12-01 18:57:19 +08004801
4802#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01004803 mbedtls_ssl_transform_free(ssl->transform_negotiate);
4804 mbedtls_free(ssl->transform_negotiate);
Jerry Yu2e199812022-12-01 18:57:19 +08004805#endif
4806
Gilles Peskine449bd832023-01-11 14:50:10 +01004807 mbedtls_ssl_session_free(ssl->session_negotiate);
4808 mbedtls_free(ssl->session_negotiate);
Paul Bakker48916f92012-09-16 19:57:18 +00004809 }
4810
Ronald Cron6f135e12021-12-08 16:57:54 +01004811#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004812 mbedtls_ssl_transform_free(ssl->transform_application);
4813 mbedtls_free(ssl->transform_application);
Ronald Cron6f135e12021-12-08 16:57:54 +01004814#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01004815
Gilles Peskine449bd832023-01-11 14:50:10 +01004816 if (ssl->session) {
4817 mbedtls_ssl_session_free(ssl->session);
4818 mbedtls_free(ssl->session);
Paul Bakkerc0463502013-02-14 11:19:38 +01004819 }
4820
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02004821#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004822 if (ssl->hostname != NULL) {
4823 mbedtls_platform_zeroize(ssl->hostname, strlen(ssl->hostname));
4824 mbedtls_free(ssl->hostname);
Paul Bakker5121ce52009-01-03 21:22:43 +00004825 }
Paul Bakker0be444a2013-08-27 21:55:01 +02004826#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004827
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004828#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004829 mbedtls_free(ssl->cli_id);
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02004830#endif
4831
Gilles Peskine449bd832023-01-11 14:50:10 +01004832 MBEDTLS_SSL_DEBUG_MSG(2, ("<= free"));
Paul Bakker2da561c2009-02-05 18:00:28 +00004833
Paul Bakker86f04f42013-02-14 11:20:09 +01004834 /* Actually clear after last debug message */
Gilles Peskine449bd832023-01-11 14:50:10 +01004835 mbedtls_platform_zeroize(ssl, sizeof(mbedtls_ssl_context));
Paul Bakker5121ce52009-01-03 21:22:43 +00004836}
4837
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004838/*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08004839 * Initialize mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004840 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004841void mbedtls_ssl_config_init(mbedtls_ssl_config *conf)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004842{
Gilles Peskine449bd832023-01-11 14:50:10 +01004843 memset(conf, 0, sizeof(mbedtls_ssl_config));
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004844}
4845
Gilles Peskineae270bf2021-06-02 00:05:29 +02004846/* The selection should be the same as mbedtls_x509_crt_profile_default in
4847 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02004848 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02004849 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02004850 * about this list.
4851 */
Brett Warrene0edc842021-08-17 09:53:13 +01004852static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02004853#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004854 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004855#endif
4856#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004857 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004858#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004859#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004860 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004861#endif
4862#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004863 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004864#endif
4865#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004866 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004867#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02004868#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004869 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004870#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004871#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004872 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004873#endif
4874#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004875 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004876#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004877 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02004878};
Gilles Peskineae270bf2021-06-02 00:05:29 +02004879
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004880static int ssl_preset_suiteb_ciphersuites[] = {
4881 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
4882 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
4883 0
4884};
4885
Ronald Crone68ab4f2022-10-05 12:46:29 +02004886#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004887
Jerry Yu909df7b2022-01-22 11:56:27 +08004888/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08004889 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08004890 * rules SHOULD be upheld.
4891 * - No duplicate entries.
4892 * - But if there is a good reason, do not change the order of the algorithms.
Jerry Yu09a99fc2022-07-28 14:22:17 +08004893 * - ssl_tls12_preset* is for TLS 1.2 use only.
Jerry Yu370e1462022-01-25 10:36:53 +08004894 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08004895 */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004896static uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08004897
Andrzej Kurek25f27152022-08-17 16:09:31 -04004898#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yued5e9f42022-01-26 11:21:34 +08004899 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4900 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004901#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA &&
Jerry Yued5e9f42022-01-26 11:21:34 +08004902 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004903
Andrzej Kurek25f27152022-08-17 16:09:31 -04004904#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu909df7b2022-01-22 11:56:27 +08004905 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4906 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004907#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu909df7b2022-01-22 11:56:27 +08004908 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
4909
Andrzej Kurek25f27152022-08-17 16:09:31 -04004910#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yued5e9f42022-01-26 11:21:34 +08004911 defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
4912 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004913#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yued5e9f42022-01-26 11:21:34 +08004914 MBEDTLS_ECP_DP_SECP521R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004915
Gilles Peskine449bd832023-01-11 14:50:10 +01004916#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
4917 defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004918 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
Gilles Peskine449bd832023-01-11 14:50:10 +01004919#endif \
4920 /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004921
Gilles Peskine449bd832023-01-11 14:50:10 +01004922#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
4923 defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004924 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
Gilles Peskine449bd832023-01-11 14:50:10 +01004925#endif \
4926 /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004927
Gilles Peskine449bd832023-01-11 14:50:10 +01004928#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
4929 defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004930 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Gilles Peskine449bd832023-01-11 14:50:10 +01004931#endif \
4932 /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004933
Andrzej Kurek25f27152022-08-17 16:09:31 -04004934#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004935 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
4936#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */
4937
Andrzej Kurek25f27152022-08-17 16:09:31 -04004938#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004939 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
4940#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */
4941
Andrzej Kurek25f27152022-08-17 16:09:31 -04004942#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu693a47a2022-06-23 14:02:28 +08004943 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4944#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4945
Gabor Mezei15b95a62022-05-09 16:37:58 +02004946 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004947};
4948
4949/* NOTICE: see above */
4950#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4951static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Andrzej Kurek25f27152022-08-17 16:09:31 -04004952#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004953#if defined(MBEDTLS_ECDSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004954 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512),
Jerry Yu713013f2022-01-17 18:16:35 +08004955#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004956#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4957 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
4958#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004959#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004960 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512),
Gabor Mezeic1051b62022-05-10 13:13:58 +02004961#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004962#endif /* MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04004963#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004964#if defined(MBEDTLS_ECDSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004965 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004966#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004967#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4968 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
4969#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004970#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004971 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384),
Gabor Mezeic1051b62022-05-10 13:13:58 +02004972#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004973#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04004974#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004975#if defined(MBEDTLS_ECDSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004976 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004977#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004978#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4979 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4980#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004981#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004982 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256),
Gabor Mezeic1051b62022-05-10 13:13:58 +02004983#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004984#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Gabor Mezei15b95a62022-05-09 16:37:58 +02004985 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004986};
4987#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4988/* NOTICE: see above */
4989static uint16_t ssl_preset_suiteb_sig_algs[] = {
4990
Andrzej Kurek25f27152022-08-17 16:09:31 -04004991#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu909df7b2022-01-22 11:56:27 +08004992 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4993 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04004994#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu909df7b2022-01-22 11:56:27 +08004995 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
4996
Andrzej Kurek25f27152022-08-17 16:09:31 -04004997#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Jerry Yu53037892022-01-25 11:02:06 +08004998 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4999 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005000#endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
Jerry Yu53037892022-01-25 11:02:06 +08005001 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08005002
Gilles Peskine449bd832023-01-11 14:50:10 +01005003#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
5004 defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu909df7b2022-01-22 11:56:27 +08005005 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Gilles Peskine449bd832023-01-11 14:50:10 +01005006#endif \
5007 /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu1a8b4812022-01-20 17:56:50 +08005008
Andrzej Kurek25f27152022-08-17 16:09:31 -04005009#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu53037892022-01-25 11:02:06 +08005010 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005011#endif /* MBEDTLS_RSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu53037892022-01-25 11:02:06 +08005012
Gabor Mezei15b95a62022-05-09 16:37:58 +02005013 MBEDTLS_TLS_SIG_NONE
Jerry Yu713013f2022-01-17 18:16:35 +08005014};
Jerry Yu6106fdc2022-01-12 16:36:14 +08005015
Jerry Yu909df7b2022-01-22 11:56:27 +08005016/* NOTICE: see above */
5017#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5018static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005019#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02005020#if defined(MBEDTLS_ECDSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005021 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256),
Jerry Yu713013f2022-01-17 18:16:35 +08005022#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005023#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005024 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256),
Gabor Mezeic1051b62022-05-10 13:13:58 +02005025#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005026#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Andrzej Kurek25f27152022-08-17 16:09:31 -04005027#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gabor Mezeic1051b62022-05-10 13:13:58 +02005028#if defined(MBEDTLS_ECDSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005029 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384),
Jerry Yu18c833e2022-01-25 10:55:47 +08005030#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005031#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005032 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384),
Gabor Mezeic1051b62022-05-10 13:13:58 +02005033#endif
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005034#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Gabor Mezei15b95a62022-05-09 16:37:58 +02005035 MBEDTLS_TLS_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01005036};
Jerry Yu909df7b2022-01-22 11:56:27 +08005037#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5038
Ronald Crone68ab4f2022-10-05 12:46:29 +02005039#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005040
Brett Warrene0edc842021-08-17 09:53:13 +01005041static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01005042#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01005043 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01005044#endif
5045#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01005046 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01005047#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005048 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005049};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005050
Ronald Crone68ab4f2022-10-05 12:46:29 +02005051#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005052/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08005053 * to make sure there are no duplicated signature algorithm entries. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005054MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01005055static int ssl_check_no_sig_alg_duplication(uint16_t *sig_algs)
Jerry Yu1a8b4812022-01-20 17:56:50 +08005056{
5057 size_t i, j;
5058 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08005059
Gilles Peskine449bd832023-01-11 14:50:10 +01005060 for (i = 0; sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++) {
5061 for (j = 0; j < i; j++) {
5062 if (sig_algs[i] != sig_algs[j]) {
Jerry Yuf377d642022-01-25 10:43:59 +08005063 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01005064 }
5065 mbedtls_printf(" entry(%04x,%" MBEDTLS_PRINTF_SIZET
5066 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
5067 sig_algs[i], j, i);
Jerry Yuf377d642022-01-25 10:43:59 +08005068 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005069 }
5070 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005071 return ret;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005072}
5073
Ronald Crone68ab4f2022-10-05 12:46:29 +02005074#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08005075
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005076/*
Tillmann Karras588ad502015-09-25 04:27:22 +02005077 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005078 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005079int mbedtls_ssl_config_defaults(mbedtls_ssl_config *conf,
5080 int endpoint, int transport, int preset)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005081{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005082#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00005083 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005084#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005085
Ronald Crone68ab4f2022-10-05 12:46:29 +02005086#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005087 if (ssl_check_no_sig_alg_duplication(ssl_preset_suiteb_sig_algs)) {
5088 mbedtls_printf("ssl_preset_suiteb_sig_algs has duplicated entries\n");
5089 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005090 }
5091
Gilles Peskine449bd832023-01-11 14:50:10 +01005092 if (ssl_check_no_sig_alg_duplication(ssl_preset_default_sig_algs)) {
5093 mbedtls_printf("ssl_preset_default_sig_algs has duplicated entries\n");
5094 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005095 }
Jerry Yu909df7b2022-01-22 11:56:27 +08005096
5097#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005098 if (ssl_check_no_sig_alg_duplication(ssl_tls12_preset_suiteb_sig_algs)) {
5099 mbedtls_printf("ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n");
5100 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu909df7b2022-01-22 11:56:27 +08005101 }
5102
Gilles Peskine449bd832023-01-11 14:50:10 +01005103 if (ssl_check_no_sig_alg_duplication(ssl_tls12_preset_default_sig_algs)) {
5104 mbedtls_printf("ssl_tls12_preset_default_sig_algs has duplicated entries\n");
5105 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu909df7b2022-01-22 11:56:27 +08005106 }
5107#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02005108#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08005109
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02005110 /* Use the functions here so that they are covered in tests,
5111 * but otherwise access member directly for efficiency */
Gilles Peskine449bd832023-01-11 14:50:10 +01005112 mbedtls_ssl_conf_endpoint(conf, endpoint);
5113 mbedtls_ssl_conf_transport(conf, transport);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005114
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005115 /*
5116 * Things that are common to all presets
5117 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005118#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005119 if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005120 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
5121#if defined(MBEDTLS_SSL_SESSION_TICKETS)
5122 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
5123#endif
5124 }
5125#endif
5126
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005127#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5128 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
5129#endif
5130
5131#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5132 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
5133#endif
5134
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02005135#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005136 conf->f_cookie_write = ssl_cookie_write_dummy;
5137 conf->f_cookie_check = ssl_cookie_check_dummy;
5138#endif
5139
5140#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5141 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
5142#endif
5143
Janos Follath088ce432017-04-10 12:42:31 +01005144#if defined(MBEDTLS_SSL_SRV_C)
5145 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02005146 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01005147#endif
5148
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005149#if defined(MBEDTLS_SSL_PROTO_DTLS)
5150 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
5151 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
5152#endif
5153
5154#if defined(MBEDTLS_SSL_RENEGOTIATION)
5155 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005156 memset(conf->renego_period, 0x00, 2);
5157 memset(conf->renego_period + 2, 0xFF, 6);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005158#endif
5159
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005160#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005161 if (endpoint == MBEDTLS_SSL_IS_SERVER) {
Hanno Beckere2defad2021-07-24 05:59:17 +01005162 const unsigned char dhm_p[] =
5163 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
5164 const unsigned char dhm_g[] =
5165 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01005166
Gilles Peskine449bd832023-01-11 14:50:10 +01005167 if ((ret = mbedtls_ssl_conf_dh_param_bin(conf,
5168 dhm_p, sizeof(dhm_p),
5169 dhm_g, sizeof(dhm_g))) != 0) {
5170 return ret;
Hanno Beckere2defad2021-07-24 05:59:17 +01005171 }
5172 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02005173#endif
5174
Ronald Cron6f135e12021-12-08 16:57:54 +01005175#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005176
5177#if defined(MBEDTLS_SSL_EARLY_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01005178 mbedtls_ssl_tls13_conf_early_data(conf, MBEDTLS_SSL_EARLY_DATA_DISABLED);
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005179#if defined(MBEDTLS_SSL_SRV_C)
5180 mbedtls_ssl_tls13_conf_max_early_data_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01005181 conf, MBEDTLS_SSL_MAX_EARLY_DATA_SIZE);
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005182#endif
5183#endif /* MBEDTLS_SSL_EARLY_DATA */
5184
Jerry Yud0766ec2022-09-22 10:46:57 +08005185#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08005186 mbedtls_ssl_conf_new_session_tickets(
Gilles Peskine449bd832023-01-11 14:50:10 +01005187 conf, MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS);
Jerry Yu1ad7ace2022-08-09 13:28:39 +08005188#endif
Hanno Becker71f1ed62021-07-24 06:01:47 +01005189 /*
5190 * Allow all TLS 1.3 key exchange modes by default.
5191 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00005192 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01005193#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01005194
Gilles Peskine449bd832023-01-11 14:50:10 +01005195 if (transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Glenn Strauss2dfcea22022-03-14 17:26:42 -04005196#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
XiaokangQian4d3a6042022-04-21 13:46:17 +00005197 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian060d8672022-04-21 09:24:56 +00005198 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005199#else
Gilles Peskine449bd832023-01-11 14:50:10 +01005200 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian060d8672022-04-21 09:24:56 +00005201#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005202 } else {
XiaokangQian4d3a6042022-04-21 13:46:17 +00005203#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01005204 if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
XiaokangQian4d3a6042022-04-21 13:46:17 +00005205 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5206 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
Gilles Peskine449bd832023-01-11 14:50:10 +01005207 } else {
5208 /* Hybrid TLS 1.2 / 1.3 is not supported on server side yet */
XiaokangQian4d3a6042022-04-21 13:46:17 +00005209 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5210 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5211 }
5212#elif defined(MBEDTLS_SSL_PROTO_TLS1_3)
5213 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5214 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5215#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
5216 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5217 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5218#else
Gilles Peskine449bd832023-01-11 14:50:10 +01005219 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005220#endif
5221 }
Glenn Strauss2dfcea22022-03-14 17:26:42 -04005222
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005223 /*
5224 * Preset-specific defaults
5225 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005226 switch (preset) {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005227 /*
5228 * NSA Suite B
5229 */
5230 case MBEDTLS_SSL_PRESET_SUITEB:
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005231
Hanno Beckerd60b6c62021-04-29 12:04:11 +01005232 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005233
5234#if defined(MBEDTLS_X509_CRT_PARSE_C)
5235 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005236#endif
5237
Ronald Crone68ab4f2022-10-05 12:46:29 +02005238#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005239#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005240 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
Jerry Yu909df7b2022-01-22 11:56:27 +08005241 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
Gilles Peskine449bd832023-01-11 14:50:10 +01005242 } else
Jerry Yu909df7b2022-01-22 11:56:27 +08005243#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005244 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02005245#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005246
Brett Warrene0edc842021-08-17 09:53:13 +01005247#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
5248 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005249#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005250 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02005251 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005252
5253 /*
5254 * Default
5255 */
5256 default:
Ronald Cronf6606552022-03-15 11:23:25 +01005257
Hanno Beckerd60b6c62021-04-29 12:04:11 +01005258 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005259
5260#if defined(MBEDTLS_X509_CRT_PARSE_C)
5261 conf->cert_profile = &mbedtls_x509_crt_profile_default;
5262#endif
5263
Ronald Crone68ab4f2022-10-05 12:46:29 +02005264#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005265#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005266 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
Jerry Yu909df7b2022-01-22 11:56:27 +08005267 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
Gilles Peskine449bd832023-01-11 14:50:10 +01005268 } else
Jerry Yu909df7b2022-01-22 11:56:27 +08005269#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005270 conf->sig_algs = ssl_preset_default_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02005271#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005272
Brett Warrene0edc842021-08-17 09:53:13 +01005273#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
5274 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005275#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005276 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005277
5278#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
5279 conf->dhm_min_bitlen = 1024;
5280#endif
5281 }
5282
Gilles Peskine449bd832023-01-11 14:50:10 +01005283 return 0;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005284}
5285
5286/*
5287 * Free mbedtls_ssl_config
5288 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005289void mbedtls_ssl_config_free(mbedtls_ssl_config *conf)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005290{
5291#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005292 mbedtls_mpi_free(&conf->dhm_P);
5293 mbedtls_mpi_free(&conf->dhm_G);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005294#endif
5295
Ronald Cron73fe8df2022-10-05 14:31:43 +02005296#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02005297#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01005298 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02005299 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
5300 }
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005301#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01005302 if (conf->psk != NULL) {
5303 mbedtls_platform_zeroize(conf->psk, conf->psk_len);
5304 mbedtls_free(conf->psk);
Azim Khan27e8a122018-03-21 14:24:11 +00005305 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005306 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09005307 }
5308
Gilles Peskine449bd832023-01-11 14:50:10 +01005309 if (conf->psk_identity != NULL) {
5310 mbedtls_platform_zeroize(conf->psk_identity, conf->psk_identity_len);
5311 mbedtls_free(conf->psk_identity);
Azim Khan27e8a122018-03-21 14:24:11 +00005312 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005313 conf->psk_identity_len = 0;
5314 }
Ronald Cron73fe8df2022-10-05 14:31:43 +02005315#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005316
5317#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005318 ssl_key_cert_free(conf->key_cert);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005319#endif
5320
Gilles Peskine449bd832023-01-11 14:50:10 +01005321 mbedtls_platform_zeroize(conf, sizeof(mbedtls_ssl_config));
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005322}
5323
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02005324#if defined(MBEDTLS_PK_C) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01005325 (defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C))
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005326/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005327 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005328 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005329unsigned char mbedtls_ssl_sig_from_pk(mbedtls_pk_context *pk)
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005330{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005331#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005332 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_RSA)) {
5333 return MBEDTLS_SSL_SIG_RSA;
5334 }
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005335#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005336#if defined(MBEDTLS_ECDSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005337 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_ECDSA)) {
5338 return MBEDTLS_SSL_SIG_ECDSA;
5339 }
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005340#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005341 return MBEDTLS_SSL_SIG_ANON;
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005342}
5343
Gilles Peskine449bd832023-01-11 14:50:10 +01005344unsigned char mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type)
Hanno Becker7e5437a2017-04-28 17:15:26 +01005345{
Gilles Peskine449bd832023-01-11 14:50:10 +01005346 switch (type) {
Hanno Becker7e5437a2017-04-28 17:15:26 +01005347 case MBEDTLS_PK_RSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01005348 return MBEDTLS_SSL_SIG_RSA;
Hanno Becker7e5437a2017-04-28 17:15:26 +01005349 case MBEDTLS_PK_ECDSA:
5350 case MBEDTLS_PK_ECKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01005351 return MBEDTLS_SSL_SIG_ECDSA;
Hanno Becker7e5437a2017-04-28 17:15:26 +01005352 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005353 return MBEDTLS_SSL_SIG_ANON;
Hanno Becker7e5437a2017-04-28 17:15:26 +01005354 }
5355}
5356
Gilles Peskine449bd832023-01-11 14:50:10 +01005357mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig(unsigned char sig)
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005358{
Gilles Peskine449bd832023-01-11 14:50:10 +01005359 switch (sig) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005360#if defined(MBEDTLS_RSA_C)
5361 case MBEDTLS_SSL_SIG_RSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01005362 return MBEDTLS_PK_RSA;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005363#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005364#if defined(MBEDTLS_ECDSA_C)
5365 case MBEDTLS_SSL_SIG_ECDSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01005366 return MBEDTLS_PK_ECDSA;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005367#endif
5368 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005369 return MBEDTLS_PK_NONE;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005370 }
5371}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02005372#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005373
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02005374/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005375 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02005376 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005377mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash(unsigned char hash)
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005378{
Gilles Peskine449bd832023-01-11 14:50:10 +01005379 switch (hash) {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005380#if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005381 case MBEDTLS_SSL_HASH_MD5:
Gilles Peskine449bd832023-01-11 14:50:10 +01005382 return MBEDTLS_MD_MD5;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005383#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005384#if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005385 case MBEDTLS_SSL_HASH_SHA1:
Gilles Peskine449bd832023-01-11 14:50:10 +01005386 return MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005387#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005388#if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005389 case MBEDTLS_SSL_HASH_SHA224:
Gilles Peskine449bd832023-01-11 14:50:10 +01005390 return MBEDTLS_MD_SHA224;
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02005391#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005392#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005393 case MBEDTLS_SSL_HASH_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01005394 return MBEDTLS_MD_SHA256;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005395#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005396#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005397 case MBEDTLS_SSL_HASH_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01005398 return MBEDTLS_MD_SHA384;
Mateusz Starzyk3352a532021-04-06 14:28:22 +02005399#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005400#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005401 case MBEDTLS_SSL_HASH_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01005402 return MBEDTLS_MD_SHA512;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005403#endif
5404 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005405 return MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005406 }
5407}
5408
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005409/*
5410 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
5411 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005412unsigned char mbedtls_ssl_hash_from_md_alg(int md)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005413{
Gilles Peskine449bd832023-01-11 14:50:10 +01005414 switch (md) {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005415#if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005416 case MBEDTLS_MD_MD5:
Gilles Peskine449bd832023-01-11 14:50:10 +01005417 return MBEDTLS_SSL_HASH_MD5;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005418#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005419#if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005420 case MBEDTLS_MD_SHA1:
Gilles Peskine449bd832023-01-11 14:50:10 +01005421 return MBEDTLS_SSL_HASH_SHA1;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005422#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005423#if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005424 case MBEDTLS_MD_SHA224:
Gilles Peskine449bd832023-01-11 14:50:10 +01005425 return MBEDTLS_SSL_HASH_SHA224;
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02005426#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005427#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005428 case MBEDTLS_MD_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01005429 return MBEDTLS_SSL_HASH_SHA256;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005430#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005431#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005432 case MBEDTLS_MD_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01005433 return MBEDTLS_SSL_HASH_SHA384;
Mateusz Starzyk3352a532021-04-06 14:28:22 +02005434#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04005435#if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005436 case MBEDTLS_MD_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01005437 return MBEDTLS_SSL_HASH_SHA512;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005438#endif
5439 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005440 return MBEDTLS_SSL_HASH_NONE;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005441 }
5442}
5443
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005444/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005445 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005446 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005447 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005448int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005449{
Gilles Peskine449bd832023-01-11 14:50:10 +01005450 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl);
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005451
Gilles Peskine449bd832023-01-11 14:50:10 +01005452 if (group_list == NULL) {
5453 return -1;
Brett Warrene0edc842021-08-17 09:53:13 +01005454 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005455
Gilles Peskine449bd832023-01-11 14:50:10 +01005456 for (; *group_list != 0; group_list++) {
5457 if (*group_list == tls_id) {
5458 return 0;
5459 }
5460 }
5461
5462 return -1;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005463}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005464
5465#if defined(MBEDTLS_ECP_C)
5466/*
5467 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
5468 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005469int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id)
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005470{
Gilles Peskine449bd832023-01-11 14:50:10 +01005471 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id);
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005472
Gilles Peskine449bd832023-01-11 14:50:10 +01005473 if (tls_id == 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005474 return -1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005475 }
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005476
Gilles Peskine449bd832023-01-11 14:50:10 +01005477 return mbedtls_ssl_check_curve_tls_id(ssl, tls_id);
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005478}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02005479#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005480
Gilles Peskine449bd832023-01-11 14:50:10 +01005481#if defined(MBEDTLS_DEBUG_C)
Valerio Setti67419f02023-01-04 16:12:42 +01005482#define EC_NAME(_name_) _name_
5483#else
5484#define EC_NAME(_name_) NULL
5485#endif
5486
Valerio Setti18c9fed2022-12-30 17:44:24 +01005487static const struct {
5488 uint16_t tls_id;
5489 mbedtls_ecp_group_id ecp_group_id;
5490 psa_ecc_family_t psa_family;
5491 uint16_t bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01005492 const char *name;
Valerio Setti18c9fed2022-12-30 17:44:24 +01005493} tls_id_match_table[] =
5494{
5495#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_521)
Gilles Peskine449bd832023-01-11 14:50:10 +01005496 { 25, MBEDTLS_ECP_DP_SECP521R1, PSA_ECC_FAMILY_SECP_R1, 521, EC_NAME("secp521r1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005497#endif
5498#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
Gilles Peskine449bd832023-01-11 14:50:10 +01005499 { 28, MBEDTLS_ECP_DP_BP512R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512, EC_NAME("brainpoolP512r1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005500#endif
Valerio Setti67419f02023-01-04 16:12:42 +01005501#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_384)
Gilles Peskine449bd832023-01-11 14:50:10 +01005502 { 24, MBEDTLS_ECP_DP_SECP384R1, PSA_ECC_FAMILY_SECP_R1, 384, EC_NAME("secp384r1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005503#endif
Valerio Setti67419f02023-01-04 16:12:42 +01005504#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
Gilles Peskine449bd832023-01-11 14:50:10 +01005505 { 27, MBEDTLS_ECP_DP_BP384R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384, EC_NAME("brainpoolP384r1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005506#endif
Valerio Setti67419f02023-01-04 16:12:42 +01005507#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_256)
Gilles Peskine449bd832023-01-11 14:50:10 +01005508 { 23, MBEDTLS_ECP_DP_SECP256R1, PSA_ECC_FAMILY_SECP_R1, 256, EC_NAME("secp256r1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005509#endif
5510#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_256)
Gilles Peskine449bd832023-01-11 14:50:10 +01005511 { 22, MBEDTLS_ECP_DP_SECP256K1, PSA_ECC_FAMILY_SECP_K1, 256, EC_NAME("secp256k1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005512#endif
Valerio Setti67419f02023-01-04 16:12:42 +01005513#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
Gilles Peskine449bd832023-01-11 14:50:10 +01005514 { 26, MBEDTLS_ECP_DP_BP256R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256, EC_NAME("brainpoolP256r1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005515#endif
5516#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_224)
Gilles Peskine449bd832023-01-11 14:50:10 +01005517 { 21, MBEDTLS_ECP_DP_SECP224R1, PSA_ECC_FAMILY_SECP_R1, 224, EC_NAME("secp224r1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005518#endif
5519#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_224)
Gilles Peskine449bd832023-01-11 14:50:10 +01005520 { 20, MBEDTLS_ECP_DP_SECP224K1, PSA_ECC_FAMILY_SECP_K1, 224, EC_NAME("secp224k1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005521#endif
5522#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_192)
Gilles Peskine449bd832023-01-11 14:50:10 +01005523 { 19, MBEDTLS_ECP_DP_SECP192R1, PSA_ECC_FAMILY_SECP_R1, 192, EC_NAME("secp192r1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005524#endif
5525#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_192)
Gilles Peskine449bd832023-01-11 14:50:10 +01005526 { 18, MBEDTLS_ECP_DP_SECP192K1, PSA_ECC_FAMILY_SECP_K1, 192, EC_NAME("secp192k1") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005527#endif
5528#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || defined(PSA_WANT_ECC_MONTGOMERY_255)
Gilles Peskine449bd832023-01-11 14:50:10 +01005529 { 29, MBEDTLS_ECP_DP_CURVE25519, PSA_ECC_FAMILY_MONTGOMERY, 255, EC_NAME("x25519") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005530#endif
5531#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) || defined(PSA_WANT_ECC_MONTGOMERY_448)
Gilles Peskine449bd832023-01-11 14:50:10 +01005532 { 30, MBEDTLS_ECP_DP_CURVE448, PSA_ECC_FAMILY_MONTGOMERY, 448, EC_NAME("x448") },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005533#endif
5534 { 0, MBEDTLS_ECP_DP_NONE, 0, 0, NULL },
5535};
5536
Gilles Peskine449bd832023-01-11 14:50:10 +01005537int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id,
5538 psa_ecc_family_t *family,
5539 size_t *bits)
Valerio Setti18c9fed2022-12-30 17:44:24 +01005540{
Gilles Peskine449bd832023-01-11 14:50:10 +01005541 for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) {
5542 if (tls_id_match_table[i].tls_id == tls_id) {
5543 if (family != NULL) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01005544 *family = tls_id_match_table[i].psa_family;
Gilles Peskine449bd832023-01-11 14:50:10 +01005545 }
5546 if (bits != NULL) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01005547 *bits = tls_id_match_table[i].bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01005548 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01005549 return PSA_SUCCESS;
5550 }
5551 }
5552
5553 return PSA_ERROR_NOT_SUPPORTED;
5554}
5555
Gilles Peskine449bd832023-01-11 14:50:10 +01005556mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01005557{
Gilles Peskine449bd832023-01-11 14:50:10 +01005558 for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) {
5559 if (tls_id_match_table[i].tls_id == tls_id) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01005560 return tls_id_match_table[i].ecp_group_id;
Gilles Peskine449bd832023-01-11 14:50:10 +01005561 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01005562 }
5563
5564 return MBEDTLS_ECP_DP_NONE;
5565}
5566
Gilles Peskine449bd832023-01-11 14:50:10 +01005567uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01005568{
Gilles Peskine449bd832023-01-11 14:50:10 +01005569 for (int i = 0; tls_id_match_table[i].ecp_group_id != MBEDTLS_ECP_DP_NONE;
5570 i++) {
5571 if (tls_id_match_table[i].ecp_group_id == grp_id) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01005572 return tls_id_match_table[i].tls_id;
Gilles Peskine449bd832023-01-11 14:50:10 +01005573 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01005574 }
5575
5576 return 0;
5577}
5578
Valerio Setti67419f02023-01-04 16:12:42 +01005579#if defined(MBEDTLS_DEBUG_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005580const char *mbedtls_ssl_get_curve_name_from_tls_id(uint16_t tls_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01005581{
Gilles Peskine449bd832023-01-11 14:50:10 +01005582 for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) {
5583 if (tls_id_match_table[i].tls_id == tls_id) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01005584 return tls_id_match_table[i].name;
Gilles Peskine449bd832023-01-11 14:50:10 +01005585 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01005586 }
5587
5588 return NULL;
5589}
Valerio Setti67419f02023-01-04 16:12:42 +01005590#endif
Valerio Setti18c9fed2022-12-30 17:44:24 +01005591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005592#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005593int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert,
5594 const mbedtls_ssl_ciphersuite_t *ciphersuite,
5595 int cert_endpoint,
5596 uint32_t *flags)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005597{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005598 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005599 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005600 const char *ext_oid;
5601 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005602
Gilles Peskine449bd832023-01-11 14:50:10 +01005603 if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005604 /* Server part of the key exchange */
Gilles Peskine449bd832023-01-11 14:50:10 +01005605 switch (ciphersuite->key_exchange) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005606 case MBEDTLS_KEY_EXCHANGE_RSA:
5607 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005608 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005609 break;
5610
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005611 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
5612 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
5613 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
5614 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005615 break;
5616
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005617 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
5618 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005619 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005620 break;
5621
5622 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005623 case MBEDTLS_KEY_EXCHANGE_NONE:
5624 case MBEDTLS_KEY_EXCHANGE_PSK:
5625 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
5626 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02005627 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005628 usage = 0;
5629 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005630 } else {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005631 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
5632 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005633 }
5634
Gilles Peskine449bd832023-01-11 14:50:10 +01005635 if (mbedtls_x509_crt_check_key_usage(cert, usage) != 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005636 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005637 ret = -1;
5638 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005639
Gilles Peskine449bd832023-01-11 14:50:10 +01005640 if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005641 ext_oid = MBEDTLS_OID_SERVER_AUTH;
Gilles Peskine449bd832023-01-11 14:50:10 +01005642 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH);
5643 } else {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005644 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
Gilles Peskine449bd832023-01-11 14:50:10 +01005645 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_CLIENT_AUTH);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005646 }
5647
Gilles Peskine449bd832023-01-11 14:50:10 +01005648 if (mbedtls_x509_crt_check_extended_key_usage(cert, ext_oid, ext_len) != 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005649 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005650 ret = -1;
5651 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005652
Gilles Peskine449bd832023-01-11 14:50:10 +01005653 return ret;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005654}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005655#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02005656
Jerry Yu148165c2021-09-24 23:20:59 +08005657#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01005658int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl,
5659 const mbedtls_md_type_t md,
5660 unsigned char *dst,
5661 size_t dst_len,
5662 size_t *olen)
Jerry Yu148165c2021-09-24 23:20:59 +08005663{
Ronald Cronf6893e12022-01-07 22:09:01 +01005664 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5665 psa_hash_operation_t *hash_operation_to_clone;
5666 psa_hash_operation_t hash_operation = psa_hash_operation_init();
5667
Jerry Yu148165c2021-09-24 23:20:59 +08005668 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01005669
Gilles Peskine449bd832023-01-11 14:50:10 +01005670 switch (md) {
Andrzej Kurek25f27152022-08-17 16:09:31 -04005671#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01005672 case MBEDTLS_MD_SHA384:
5673 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
5674 break;
Ronald Cronf6893e12022-01-07 22:09:01 +01005675#endif
5676
Andrzej Kurek25f27152022-08-17 16:09:31 -04005677#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01005678 case MBEDTLS_MD_SHA256:
5679 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
5680 break;
Ronald Cronf6893e12022-01-07 22:09:01 +01005681#endif
5682
Gilles Peskine449bd832023-01-11 14:50:10 +01005683 default:
5684 goto exit;
5685 }
5686
5687 status = psa_hash_clone(hash_operation_to_clone, &hash_operation);
5688 if (status != PSA_SUCCESS) {
Ronald Cronf6893e12022-01-07 22:09:01 +01005689 goto exit;
5690 }
5691
Gilles Peskine449bd832023-01-11 14:50:10 +01005692 status = psa_hash_finish(&hash_operation, dst, dst_len, olen);
5693 if (status != PSA_SUCCESS) {
Ronald Cronf6893e12022-01-07 22:09:01 +01005694 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005695 }
Ronald Cronf6893e12022-01-07 22:09:01 +01005696
5697exit:
Andrzej Kurekeabeb302022-10-17 07:52:51 -04005698#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
5699 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
5700 (void) ssl;
5701#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005702 return psa_ssl_status_to_mbedtls(status);
Jerry Yu148165c2021-09-24 23:20:59 +08005703}
5704#else /* MBEDTLS_USE_PSA_CRYPTO */
5705
Andrzej Kurek25f27152022-08-17 16:09:31 -04005706#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005707MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01005708static int ssl_get_handshake_transcript_sha384(mbedtls_ssl_context *ssl,
5709 unsigned char *dst,
5710 size_t dst_len,
5711 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08005712{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005713 int ret;
5714 mbedtls_sha512_context sha512;
5715
Gilles Peskine449bd832023-01-11 14:50:10 +01005716 if (dst_len < 48) {
5717 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
5718 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08005719
Gilles Peskine449bd832023-01-11 14:50:10 +01005720 mbedtls_sha512_init(&sha512);
5721 mbedtls_sha512_clone(&sha512, &ssl->handshake->fin_sha384);
Jerry Yu24c0ec32021-09-09 14:21:07 +08005722
Gilles Peskine449bd832023-01-11 14:50:10 +01005723 if ((ret = mbedtls_sha512_finish(&sha512, dst)) != 0) {
5724 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_sha512_finish", ret);
Jerry Yu24c0ec32021-09-09 14:21:07 +08005725 goto exit;
5726 }
5727
5728 *olen = 48;
5729
5730exit:
5731
Gilles Peskine449bd832023-01-11 14:50:10 +01005732 mbedtls_sha512_free(&sha512);
5733 return ret;
Jerry Yu24c0ec32021-09-09 14:21:07 +08005734}
Andrzej Kurek25f27152022-08-17 16:09:31 -04005735#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005736
Andrzej Kurek25f27152022-08-17 16:09:31 -04005737#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005738MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01005739static int ssl_get_handshake_transcript_sha256(mbedtls_ssl_context *ssl,
5740 unsigned char *dst,
5741 size_t dst_len,
5742 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08005743{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005744 int ret;
5745 mbedtls_sha256_context sha256;
5746
Gilles Peskine449bd832023-01-11 14:50:10 +01005747 if (dst_len < 32) {
5748 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
5749 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08005750
Gilles Peskine449bd832023-01-11 14:50:10 +01005751 mbedtls_sha256_init(&sha256);
5752 mbedtls_sha256_clone(&sha256, &ssl->handshake->fin_sha256);
Jerry Yuc5aef882021-12-23 20:15:02 +08005753
Gilles Peskine449bd832023-01-11 14:50:10 +01005754 if ((ret = mbedtls_sha256_finish(&sha256, dst)) != 0) {
5755 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_sha256_finish", ret);
Jerry Yu24c0ec32021-09-09 14:21:07 +08005756 goto exit;
5757 }
5758
5759 *olen = 32;
5760
5761exit:
5762
Gilles Peskine449bd832023-01-11 14:50:10 +01005763 mbedtls_sha256_free(&sha256);
5764 return ret;
Jerry Yu24c0ec32021-09-09 14:21:07 +08005765}
Andrzej Kurek25f27152022-08-17 16:09:31 -04005766#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005767
Gilles Peskine449bd832023-01-11 14:50:10 +01005768int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl,
5769 const mbedtls_md_type_t md,
5770 unsigned char *dst,
5771 size_t dst_len,
5772 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08005773{
Gilles Peskine449bd832023-01-11 14:50:10 +01005774 switch (md) {
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005775
Andrzej Kurek25f27152022-08-17 16:09:31 -04005776#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01005777 case MBEDTLS_MD_SHA384:
5778 return ssl_get_handshake_transcript_sha384(ssl, dst, dst_len, olen);
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005779#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005780
Andrzej Kurek25f27152022-08-17 16:09:31 -04005781#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01005782 case MBEDTLS_MD_SHA256:
5783 return ssl_get_handshake_transcript_sha256(ssl, dst, dst_len, olen);
Andrzej Kurekcccb0442022-08-19 03:42:11 -04005784#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005785
Gilles Peskine449bd832023-01-11 14:50:10 +01005786 default:
Andrzej Kurek409248a2022-10-24 10:33:21 -04005787#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01005788 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
5789 (void) ssl;
5790 (void) dst;
5791 (void) dst_len;
5792 (void) olen;
Andrzej Kurek409248a2022-10-24 10:33:21 -04005793#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005794 break;
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005795 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005796 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu24c0ec32021-09-09 14:21:07 +08005797}
XiaokangQian647719a2021-12-07 09:16:29 +00005798
Jerry Yu148165c2021-09-24 23:20:59 +08005799#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005800
Ronald Crone68ab4f2022-10-05 12:46:29 +02005801#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Gabor Mezei078e8032022-04-27 21:17:56 +02005802/* mbedtls_ssl_parse_sig_alg_ext()
5803 *
5804 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
5805 * value (TLS 1.3 RFC8446):
5806 * enum {
5807 * ....
5808 * ecdsa_secp256r1_sha256( 0x0403 ),
5809 * ecdsa_secp384r1_sha384( 0x0503 ),
5810 * ecdsa_secp521r1_sha512( 0x0603 ),
5811 * ....
5812 * } SignatureScheme;
5813 *
5814 * struct {
5815 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
5816 * } SignatureSchemeList;
5817 *
5818 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
5819 * value (TLS 1.2 RFC5246):
5820 * enum {
5821 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
5822 * sha512(6), (255)
5823 * } HashAlgorithm;
5824 *
5825 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
5826 * SignatureAlgorithm;
5827 *
5828 * struct {
5829 * HashAlgorithm hash;
5830 * SignatureAlgorithm signature;
5831 * } SignatureAndHashAlgorithm;
5832 *
5833 * SignatureAndHashAlgorithm
5834 * supported_signature_algorithms<2..2^16-2>;
5835 *
5836 * The TLS 1.3 signature algorithm extension was defined to be a compatible
5837 * generalization of the TLS 1.2 signature algorithm extension.
5838 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
5839 * `SignatureScheme` field of TLS 1.3
5840 *
5841 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005842int mbedtls_ssl_parse_sig_alg_ext(mbedtls_ssl_context *ssl,
5843 const unsigned char *buf,
5844 const unsigned char *end)
Gabor Mezei078e8032022-04-27 21:17:56 +02005845{
5846 const unsigned char *p = buf;
5847 size_t supported_sig_algs_len = 0;
5848 const unsigned char *supported_sig_algs_end;
5849 uint16_t sig_alg;
5850 uint32_t common_idx = 0;
5851
Gilles Peskine449bd832023-01-11 14:50:10 +01005852 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
5853 supported_sig_algs_len = MBEDTLS_GET_UINT16_BE(p, 0);
Gabor Mezei078e8032022-04-27 21:17:56 +02005854 p += 2;
5855
Gilles Peskine449bd832023-01-11 14:50:10 +01005856 memset(ssl->handshake->received_sig_algs, 0,
5857 sizeof(ssl->handshake->received_sig_algs));
Gabor Mezei078e8032022-04-27 21:17:56 +02005858
Gilles Peskine449bd832023-01-11 14:50:10 +01005859 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, supported_sig_algs_len);
Gabor Mezei078e8032022-04-27 21:17:56 +02005860 supported_sig_algs_end = p + supported_sig_algs_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01005861 while (p < supported_sig_algs_end) {
5862 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, supported_sig_algs_end, 2);
5863 sig_alg = MBEDTLS_GET_UINT16_BE(p, 0);
Gabor Mezei078e8032022-04-27 21:17:56 +02005864 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01005865 MBEDTLS_SSL_DEBUG_MSG(4, ("received signature algorithm: 0x%x %s",
5866 sig_alg,
5867 mbedtls_ssl_sig_alg_to_str(sig_alg)));
Jerry Yu2fe6c632022-06-29 10:02:38 +08005868#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005869 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
5870 (!(mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg) &&
5871 mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)))) {
Gabor Mezei078e8032022-04-27 21:17:56 +02005872 continue;
Jerry Yu2fe6c632022-06-29 10:02:38 +08005873 }
5874#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gabor Mezei078e8032022-04-27 21:17:56 +02005875
Gilles Peskine449bd832023-01-11 14:50:10 +01005876 MBEDTLS_SSL_DEBUG_MSG(4, ("valid signature algorithm: %s",
5877 mbedtls_ssl_sig_alg_to_str(sig_alg)));
Gabor Mezei078e8032022-04-27 21:17:56 +02005878
Gilles Peskine449bd832023-01-11 14:50:10 +01005879 if (common_idx + 1 < MBEDTLS_RECEIVED_SIG_ALGS_SIZE) {
Gabor Mezei078e8032022-04-27 21:17:56 +02005880 ssl->handshake->received_sig_algs[common_idx] = sig_alg;
5881 common_idx += 1;
5882 }
5883 }
5884 /* Check that we consumed all the message. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005885 if (p != end) {
5886 MBEDTLS_SSL_DEBUG_MSG(1,
5887 ("Signature algorithms extension length misaligned"));
5888 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
5889 MBEDTLS_ERR_SSL_DECODE_ERROR);
5890 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Gabor Mezei078e8032022-04-27 21:17:56 +02005891 }
5892
Gilles Peskine449bd832023-01-11 14:50:10 +01005893 if (common_idx == 0) {
5894 MBEDTLS_SSL_DEBUG_MSG(3, ("no signature algorithm in common"));
5895 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
5896 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
5897 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Gabor Mezei078e8032022-04-27 21:17:56 +02005898 }
5899
Gabor Mezei15b95a62022-05-09 16:37:58 +02005900 ssl->handshake->received_sig_algs[common_idx] = MBEDTLS_TLS_SIG_NONE;
Gilles Peskine449bd832023-01-11 14:50:10 +01005901 return 0;
Gabor Mezei078e8032022-04-27 21:17:56 +02005902}
5903
Ronald Crone68ab4f2022-10-05 12:46:29 +02005904#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Gabor Mezei078e8032022-04-27 21:17:56 +02005905
Jerry Yudc7bd172022-02-17 13:44:15 +08005906#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5907
5908#if defined(MBEDTLS_USE_PSA_CRYPTO)
5909
Gilles Peskine449bd832023-01-11 14:50:10 +01005910static psa_status_t setup_psa_key_derivation(psa_key_derivation_operation_t *derivation,
5911 mbedtls_svc_key_id_t key,
5912 psa_algorithm_t alg,
5913 const unsigned char *raw_psk, size_t raw_psk_length,
5914 const unsigned char *seed, size_t seed_length,
5915 const unsigned char *label, size_t label_length,
5916 const unsigned char *other_secret,
5917 size_t other_secret_length,
5918 size_t capacity)
Jerry Yudc7bd172022-02-17 13:44:15 +08005919{
5920 psa_status_t status;
5921
Gilles Peskine449bd832023-01-11 14:50:10 +01005922 status = psa_key_derivation_setup(derivation, alg);
5923 if (status != PSA_SUCCESS) {
5924 return status;
5925 }
Jerry Yudc7bd172022-02-17 13:44:15 +08005926
Gilles Peskine449bd832023-01-11 14:50:10 +01005927 if (PSA_ALG_IS_TLS12_PRF(alg) || PSA_ALG_IS_TLS12_PSK_TO_MS(alg)) {
5928 status = psa_key_derivation_input_bytes(derivation,
5929 PSA_KEY_DERIVATION_INPUT_SEED,
5930 seed, seed_length);
5931 if (status != PSA_SUCCESS) {
5932 return status;
Przemek Stekiel1f027032022-04-05 17:12:11 +02005933 }
5934
Gilles Peskine449bd832023-01-11 14:50:10 +01005935 if (other_secret != NULL) {
5936 status = psa_key_derivation_input_bytes(derivation,
5937 PSA_KEY_DERIVATION_INPUT_OTHER_SECRET,
5938 other_secret, other_secret_length);
5939 if (status != PSA_SUCCESS) {
5940 return status;
5941 }
5942 }
5943
5944 if (mbedtls_svc_key_id_is_null(key)) {
Jerry Yudc7bd172022-02-17 13:44:15 +08005945 status = psa_key_derivation_input_bytes(
5946 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
Gilles Peskine449bd832023-01-11 14:50:10 +01005947 raw_psk, raw_psk_length);
5948 } else {
Jerry Yudc7bd172022-02-17 13:44:15 +08005949 status = psa_key_derivation_input_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01005950 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key);
Jerry Yudc7bd172022-02-17 13:44:15 +08005951 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005952 if (status != PSA_SUCCESS) {
5953 return status;
5954 }
Jerry Yudc7bd172022-02-17 13:44:15 +08005955
Gilles Peskine449bd832023-01-11 14:50:10 +01005956 status = psa_key_derivation_input_bytes(derivation,
5957 PSA_KEY_DERIVATION_INPUT_LABEL,
5958 label, label_length);
5959 if (status != PSA_SUCCESS) {
5960 return status;
5961 }
5962 } else {
5963 return PSA_ERROR_NOT_SUPPORTED;
Jerry Yudc7bd172022-02-17 13:44:15 +08005964 }
5965
Gilles Peskine449bd832023-01-11 14:50:10 +01005966 status = psa_key_derivation_set_capacity(derivation, capacity);
5967 if (status != PSA_SUCCESS) {
5968 return status;
5969 }
Jerry Yudc7bd172022-02-17 13:44:15 +08005970
Gilles Peskine449bd832023-01-11 14:50:10 +01005971 return PSA_SUCCESS;
Jerry Yudc7bd172022-02-17 13:44:15 +08005972}
5973
Andrzej Kurek57d10632022-10-24 10:32:01 -04005974#if defined(PSA_WANT_ALG_SHA_384) || \
5975 defined(PSA_WANT_ALG_SHA_256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005976MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01005977static int tls_prf_generic(mbedtls_md_type_t md_type,
5978 const unsigned char *secret, size_t slen,
5979 const char *label,
5980 const unsigned char *random, size_t rlen,
5981 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08005982{
5983 psa_status_t status;
5984 psa_algorithm_t alg;
5985 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
5986 psa_key_derivation_operation_t derivation =
5987 PSA_KEY_DERIVATION_OPERATION_INIT;
5988
Gilles Peskine449bd832023-01-11 14:50:10 +01005989 if (md_type == MBEDTLS_MD_SHA384) {
Jerry Yudc7bd172022-02-17 13:44:15 +08005990 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
Gilles Peskine449bd832023-01-11 14:50:10 +01005991 } else {
Jerry Yudc7bd172022-02-17 13:44:15 +08005992 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
Gilles Peskine449bd832023-01-11 14:50:10 +01005993 }
Jerry Yudc7bd172022-02-17 13:44:15 +08005994
5995 /* Normally a "secret" should be long enough to be impossible to
5996 * find by brute force, and in particular should not be empty. But
5997 * this PRF is also used to derive an IV, in particular in EAP-TLS,
5998 * and for this use case it makes sense to have a 0-length "secret".
5999 * Since the key API doesn't allow importing a key of length 0,
6000 * keep master_key=0, which setup_psa_key_derivation() understands
6001 * to mean a 0-length "secret" input. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006002 if (slen != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006003 psa_key_attributes_t key_attributes = psa_key_attributes_init();
Gilles Peskine449bd832023-01-11 14:50:10 +01006004 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
6005 psa_set_key_algorithm(&key_attributes, alg);
6006 psa_set_key_type(&key_attributes, PSA_KEY_TYPE_DERIVE);
Jerry Yudc7bd172022-02-17 13:44:15 +08006007
Gilles Peskine449bd832023-01-11 14:50:10 +01006008 status = psa_import_key(&key_attributes, secret, slen, &master_key);
6009 if (status != PSA_SUCCESS) {
6010 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6011 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006012 }
6013
Gilles Peskine449bd832023-01-11 14:50:10 +01006014 status = setup_psa_key_derivation(&derivation,
6015 master_key, alg,
6016 NULL, 0,
6017 random, rlen,
6018 (unsigned char const *) label,
6019 (size_t) strlen(label),
6020 NULL, 0,
6021 dlen);
6022 if (status != PSA_SUCCESS) {
6023 psa_key_derivation_abort(&derivation);
6024 psa_destroy_key(master_key);
6025 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006026 }
6027
Gilles Peskine449bd832023-01-11 14:50:10 +01006028 status = psa_key_derivation_output_bytes(&derivation, dstbuf, dlen);
6029 if (status != PSA_SUCCESS) {
6030 psa_key_derivation_abort(&derivation);
6031 psa_destroy_key(master_key);
6032 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006033 }
6034
Gilles Peskine449bd832023-01-11 14:50:10 +01006035 status = psa_key_derivation_abort(&derivation);
6036 if (status != PSA_SUCCESS) {
6037 psa_destroy_key(master_key);
6038 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006039 }
6040
Gilles Peskine449bd832023-01-11 14:50:10 +01006041 if (!mbedtls_svc_key_id_is_null(master_key)) {
6042 status = psa_destroy_key(master_key);
6043 }
6044 if (status != PSA_SUCCESS) {
6045 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6046 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006047
Gilles Peskine449bd832023-01-11 14:50:10 +01006048 return 0;
Jerry Yudc7bd172022-02-17 13:44:15 +08006049}
Andrzej Kurek57d10632022-10-24 10:32:01 -04006050#endif /* PSA_WANT_ALG_SHA_256 || PSA_WANT_ALG_SHA_384 */
Jerry Yudc7bd172022-02-17 13:44:15 +08006051#else /* MBEDTLS_USE_PSA_CRYPTO */
6052
Andrzej Kurek57d10632022-10-24 10:32:01 -04006053#if defined(MBEDTLS_MD_C) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01006054 (defined(MBEDTLS_SHA256_C) || \
6055 defined(MBEDTLS_SHA384_C))
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006056MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006057static int tls_prf_generic(mbedtls_md_type_t md_type,
6058 const unsigned char *secret, size_t slen,
6059 const char *label,
6060 const unsigned char *random, size_t rlen,
6061 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006062{
6063 size_t nb;
6064 size_t i, j, k, md_len;
6065 unsigned char *tmp;
6066 size_t tmp_len = 0;
6067 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
6068 const mbedtls_md_info_t *md_info;
6069 mbedtls_md_context_t md_ctx;
6070 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6071
Gilles Peskine449bd832023-01-11 14:50:10 +01006072 mbedtls_md_init(&md_ctx);
Jerry Yudc7bd172022-02-17 13:44:15 +08006073
Gilles Peskine449bd832023-01-11 14:50:10 +01006074 if ((md_info = mbedtls_md_info_from_type(md_type)) == NULL) {
6075 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
6076 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006077
Gilles Peskine449bd832023-01-11 14:50:10 +01006078 md_len = mbedtls_md_get_size(md_info);
Jerry Yudc7bd172022-02-17 13:44:15 +08006079
Gilles Peskine449bd832023-01-11 14:50:10 +01006080 tmp_len = md_len + strlen(label) + rlen;
6081 tmp = mbedtls_calloc(1, tmp_len);
6082 if (tmp == NULL) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006083 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
6084 goto exit;
6085 }
6086
Gilles Peskine449bd832023-01-11 14:50:10 +01006087 nb = strlen(label);
6088 memcpy(tmp + md_len, label, nb);
6089 memcpy(tmp + md_len + nb, random, rlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006090 nb += rlen;
6091
6092 /*
6093 * Compute P_<hash>(secret, label + random)[0..dlen]
6094 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006095 if ((ret = mbedtls_md_setup(&md_ctx, md_info, 1)) != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006096 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006097 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006098
Gilles Peskine449bd832023-01-11 14:50:10 +01006099 ret = mbedtls_md_hmac_starts(&md_ctx, secret, slen);
6100 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006101 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006102 }
6103 ret = mbedtls_md_hmac_update(&md_ctx, tmp + md_len, nb);
6104 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006105 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006106 }
6107 ret = mbedtls_md_hmac_finish(&md_ctx, tmp);
6108 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006109 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006110 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006111
Gilles Peskine449bd832023-01-11 14:50:10 +01006112 for (i = 0; i < dlen; i += md_len) {
6113 ret = mbedtls_md_hmac_reset(&md_ctx);
6114 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006115 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006116 }
6117 ret = mbedtls_md_hmac_update(&md_ctx, tmp, md_len + nb);
6118 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006119 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006120 }
6121 ret = mbedtls_md_hmac_finish(&md_ctx, h_i);
6122 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006123 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006124 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006125
Gilles Peskine449bd832023-01-11 14:50:10 +01006126 ret = mbedtls_md_hmac_reset(&md_ctx);
6127 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006128 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006129 }
6130 ret = mbedtls_md_hmac_update(&md_ctx, tmp, md_len);
6131 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006132 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006133 }
6134 ret = mbedtls_md_hmac_finish(&md_ctx, tmp);
6135 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006136 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006137 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006138
Gilles Peskine449bd832023-01-11 14:50:10 +01006139 k = (i + md_len > dlen) ? dlen % md_len : md_len;
Jerry Yudc7bd172022-02-17 13:44:15 +08006140
Gilles Peskine449bd832023-01-11 14:50:10 +01006141 for (j = 0; j < k; j++) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006142 dstbuf[i + j] = h_i[j];
Gilles Peskine449bd832023-01-11 14:50:10 +01006143 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006144 }
6145
6146exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006147 mbedtls_md_free(&md_ctx);
Jerry Yudc7bd172022-02-17 13:44:15 +08006148
Gilles Peskine449bd832023-01-11 14:50:10 +01006149 if (tmp != NULL) {
6150 mbedtls_platform_zeroize(tmp, tmp_len);
6151 }
Dave Rodgman29b9b2b2022-11-01 16:08:14 +00006152
Gilles Peskine449bd832023-01-11 14:50:10 +01006153 mbedtls_platform_zeroize(h_i, sizeof(h_i));
Jerry Yudc7bd172022-02-17 13:44:15 +08006154
Gilles Peskine449bd832023-01-11 14:50:10 +01006155 mbedtls_free(tmp);
Jerry Yudc7bd172022-02-17 13:44:15 +08006156
Gilles Peskine449bd832023-01-11 14:50:10 +01006157 return ret;
Jerry Yudc7bd172022-02-17 13:44:15 +08006158}
Andrzej Kurek57d10632022-10-24 10:32:01 -04006159#endif /* MBEDTLS_MD_C && ( MBEDTLS_SHA256_C || MBEDTLS_SHA384_C ) */
Jerry Yudc7bd172022-02-17 13:44:15 +08006160#endif /* MBEDTLS_USE_PSA_CRYPTO */
6161
Andrzej Kurek25f27152022-08-17 16:09:31 -04006162#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006163MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006164static int tls_prf_sha256(const unsigned char *secret, size_t slen,
6165 const char *label,
6166 const unsigned char *random, size_t rlen,
6167 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006168{
Gilles Peskine449bd832023-01-11 14:50:10 +01006169 return tls_prf_generic(MBEDTLS_MD_SHA256, secret, slen,
6170 label, random, rlen, dstbuf, dlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006171}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04006172#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yudc7bd172022-02-17 13:44:15 +08006173
Andrzej Kurek25f27152022-08-17 16:09:31 -04006174#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006175MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006176static int tls_prf_sha384(const unsigned char *secret, size_t slen,
6177 const char *label,
6178 const unsigned char *random, size_t rlen,
6179 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006180{
Gilles Peskine449bd832023-01-11 14:50:10 +01006181 return tls_prf_generic(MBEDTLS_MD_SHA384, secret, slen,
6182 label, random, rlen, dstbuf, dlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006183}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04006184#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yudc7bd172022-02-17 13:44:15 +08006185
Jerry Yuf009d862022-02-17 14:01:37 +08006186/*
6187 * Set appropriate PRF function and other SSL / TLS1.2 functions
6188 *
6189 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08006190 * - hash associated with the ciphersuite (only used by TLS 1.2)
6191 *
6192 * Outputs:
6193 * - the tls_prf, calc_verify and calc_finished members of handshake structure
6194 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006195MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006196static int ssl_set_handshake_prfs(mbedtls_ssl_handshake_params *handshake,
6197 mbedtls_md_type_t hash)
Jerry Yuf009d862022-02-17 14:01:37 +08006198{
Andrzej Kurek25f27152022-08-17 16:09:31 -04006199#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01006200 if (hash == MBEDTLS_MD_SHA384) {
Jerry Yuf009d862022-02-17 14:01:37 +08006201 handshake->tls_prf = tls_prf_sha384;
6202 handshake->calc_verify = ssl_calc_verify_tls_sha384;
6203 handshake->calc_finished = ssl_calc_finished_tls_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +01006204 } else
Jerry Yuf009d862022-02-17 14:01:37 +08006205#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04006206#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yuf009d862022-02-17 14:01:37 +08006207 {
Ronald Cron81591aa2022-03-07 09:05:51 +01006208 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08006209 handshake->tls_prf = tls_prf_sha256;
6210 handshake->calc_verify = ssl_calc_verify_tls_sha256;
6211 handshake->calc_finished = ssl_calc_finished_tls_sha256;
6212 }
Ronald Cron81591aa2022-03-07 09:05:51 +01006213#else
Jerry Yuf009d862022-02-17 14:01:37 +08006214 {
Jerry Yuf009d862022-02-17 14:01:37 +08006215 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01006216 (void) hash;
Gilles Peskine449bd832023-01-11 14:50:10 +01006217 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yuf009d862022-02-17 14:01:37 +08006218 }
Ronald Cron81591aa2022-03-07 09:05:51 +01006219#endif
Jerry Yuf009d862022-02-17 14:01:37 +08006220
Gilles Peskine449bd832023-01-11 14:50:10 +01006221 return 0;
Jerry Yuf009d862022-02-17 14:01:37 +08006222}
Jerry Yud6ab2352022-02-17 14:03:43 +08006223
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006224/*
6225 * Compute master secret if needed
6226 *
6227 * Parameters:
6228 * [in/out] handshake
6229 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
6230 * (PSA-PSK) ciphersuite_info, psk_opaque
6231 * [out] premaster (cleared)
6232 * [out] master
6233 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
6234 * debug: conf->f_dbg, conf->p_dbg
6235 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01006236 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006237 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006238MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006239static int ssl_compute_master(mbedtls_ssl_handshake_params *handshake,
6240 unsigned char *master,
6241 const mbedtls_ssl_context *ssl)
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006242{
6243 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6244
6245 /* cf. RFC 5246, Section 8.1:
6246 * "The master secret is always exactly 48 bytes in length." */
6247 size_t const master_secret_len = 48;
6248
6249#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6250 unsigned char session_hash[48];
6251#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
6252
6253 /* The label for the KDF used for key expansion.
6254 * This is either "master secret" or "extended master secret"
6255 * depending on whether the Extended Master Secret extension
6256 * is used. */
6257 char const *lbl = "master secret";
6258
Przemek Stekielae4ed302022-04-05 17:15:55 +02006259 /* The seed for the KDF used for key expansion.
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006260 * - If the Extended Master Secret extension is not used,
6261 * this is ClientHello.Random + ServerHello.Random
6262 * (see Sect. 8.1 in RFC 5246).
6263 * - If the Extended Master Secret extension is used,
6264 * this is the transcript of the handshake so far.
6265 * (see Sect. 4 in RFC 7627). */
Przemek Stekielae4ed302022-04-05 17:15:55 +02006266 unsigned char const *seed = handshake->randbytes;
6267 size_t seed_len = 64;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006268
6269#if !defined(MBEDTLS_DEBUG_C) && \
6270 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
6271 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01006272 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006273 ssl = NULL; /* make sure we don't use it except for those cases */
6274 (void) ssl;
6275#endif
6276
Gilles Peskine449bd832023-01-11 14:50:10 +01006277 if (handshake->resume != 0) {
6278 MBEDTLS_SSL_DEBUG_MSG(3, ("no premaster (session resumed)"));
6279 return 0;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006280 }
6281
6282#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Gilles Peskine449bd832023-01-11 14:50:10 +01006283 if (handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006284 lbl = "extended master secret";
Przemek Stekielae4ed302022-04-05 17:15:55 +02006285 seed = session_hash;
Gilles Peskine449bd832023-01-11 14:50:10 +01006286 handshake->calc_verify(ssl, session_hash, &seed_len);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006287
Gilles Peskine449bd832023-01-11 14:50:10 +01006288 MBEDTLS_SSL_DEBUG_BUF(3, "session hash for extended master secret",
6289 session_hash, seed_len);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006290 }
Przemek Stekiel169bf0b2022-04-29 07:53:29 +02006291#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006292
Przemek Stekiel99114f32022-04-22 11:20:09 +02006293#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Przemek Stekiel8a4b7fd2022-04-28 09:22:22 +02006294 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006295 if (mbedtls_ssl_ciphersuite_uses_psk(handshake->ciphersuite_info) == 1) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006296 /* Perform PSK-to-MS expansion in a single step. */
6297 psa_status_t status;
6298 psa_algorithm_t alg;
6299 mbedtls_svc_key_id_t psk;
6300 psa_key_derivation_operation_t derivation =
6301 PSA_KEY_DERIVATION_OPERATION_INIT;
6302 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
6303
Gilles Peskine449bd832023-01-11 14:50:10 +01006304 MBEDTLS_SSL_DEBUG_MSG(2, ("perform PSA-based PSK-to-MS expansion"));
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006305
Gilles Peskine449bd832023-01-11 14:50:10 +01006306 psk = mbedtls_ssl_get_opaque_psk(ssl);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006307
Gilles Peskine449bd832023-01-11 14:50:10 +01006308 if (hash_alg == MBEDTLS_MD_SHA384) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006309 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
Gilles Peskine449bd832023-01-11 14:50:10 +01006310 } else {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006311 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
Gilles Peskine449bd832023-01-11 14:50:10 +01006312 }
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006313
Przemek Stekiel51a1f362022-04-13 08:57:06 +02006314 size_t other_secret_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006315 unsigned char *other_secret = NULL;
Przemek Stekielc2033402022-04-05 17:19:41 +02006316
Gilles Peskine449bd832023-01-11 14:50:10 +01006317 switch (handshake->ciphersuite_info->key_exchange) {
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006318 /* Provide other secret.
Przemek Stekiel51a1f362022-04-13 08:57:06 +02006319 * Other secret is stored in premaster, where first 2 bytes hold the
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006320 * length of the other key.
Przemek Stekielc2033402022-04-05 17:19:41 +02006321 */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006322 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Przemek Stekiel8abcee92022-04-28 09:16:28 +02006323 /* For RSA-PSK other key length is always 48 bytes. */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006324 other_secret_len = 48;
6325 other_secret = handshake->premaster + 2;
6326 break;
6327 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006328 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006329 other_secret_len = MBEDTLS_GET_UINT16_BE(handshake->premaster, 0);
6330 other_secret = handshake->premaster + 2;
6331 break;
6332 default:
6333 break;
Przemek Stekielc2033402022-04-05 17:19:41 +02006334 }
6335
Gilles Peskine449bd832023-01-11 14:50:10 +01006336 status = setup_psa_key_derivation(&derivation, psk, alg,
6337 ssl->conf->psk, ssl->conf->psk_len,
6338 seed, seed_len,
6339 (unsigned char const *) lbl,
6340 (size_t) strlen(lbl),
6341 other_secret, other_secret_len,
6342 master_secret_len);
6343 if (status != PSA_SUCCESS) {
6344 psa_key_derivation_abort(&derivation);
6345 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006346 }
6347
Gilles Peskine449bd832023-01-11 14:50:10 +01006348 status = psa_key_derivation_output_bytes(&derivation,
6349 master,
6350 master_secret_len);
6351 if (status != PSA_SUCCESS) {
6352 psa_key_derivation_abort(&derivation);
6353 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006354 }
6355
Gilles Peskine449bd832023-01-11 14:50:10 +01006356 status = psa_key_derivation_abort(&derivation);
6357 if (status != PSA_SUCCESS) {
6358 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6359 }
6360 } else
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006361#endif
6362 {
Neil Armstrongca7d5062022-05-31 14:43:23 +02006363#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01006364 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
6365 if (handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
Neil Armstrongca7d5062022-05-31 14:43:23 +02006366 psa_status_t status;
6367 psa_algorithm_t alg = PSA_ALG_TLS12_ECJPAKE_TO_PMS;
6368 psa_key_derivation_operation_t derivation =
6369 PSA_KEY_DERIVATION_OPERATION_INIT;
6370
Gilles Peskine449bd832023-01-11 14:50:10 +01006371 MBEDTLS_SSL_DEBUG_MSG(2, ("perform PSA-based PMS KDF for ECJPAKE"));
Neil Armstrongca7d5062022-05-31 14:43:23 +02006372
6373 handshake->pmslen = PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE;
6374
Gilles Peskine449bd832023-01-11 14:50:10 +01006375 status = psa_key_derivation_setup(&derivation, alg);
6376 if (status != PSA_SUCCESS) {
6377 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02006378 }
6379
Gilles Peskine449bd832023-01-11 14:50:10 +01006380 status = psa_key_derivation_set_capacity(&derivation,
6381 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
6382 if (status != PSA_SUCCESS) {
6383 psa_key_derivation_abort(&derivation);
6384 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02006385 }
6386
Gilles Peskine449bd832023-01-11 14:50:10 +01006387 status = psa_pake_get_implicit_key(&handshake->psa_pake_ctx,
6388 &derivation);
6389 if (status != PSA_SUCCESS) {
6390 psa_key_derivation_abort(&derivation);
6391 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02006392 }
6393
Gilles Peskine449bd832023-01-11 14:50:10 +01006394 status = psa_key_derivation_output_bytes(&derivation,
6395 handshake->premaster,
6396 handshake->pmslen);
6397 if (status != PSA_SUCCESS) {
6398 psa_key_derivation_abort(&derivation);
6399 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6400 }
6401
6402 status = psa_key_derivation_abort(&derivation);
6403 if (status != PSA_SUCCESS) {
6404 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02006405 }
6406 }
6407#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006408 ret = handshake->tls_prf(handshake->premaster, handshake->pmslen,
6409 lbl, seed, seed_len,
6410 master,
6411 master_secret_len);
6412 if (ret != 0) {
6413 MBEDTLS_SSL_DEBUG_RET(1, "prf", ret);
6414 return ret;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006415 }
6416
Gilles Peskine449bd832023-01-11 14:50:10 +01006417 MBEDTLS_SSL_DEBUG_BUF(3, "premaster secret",
6418 handshake->premaster,
6419 handshake->pmslen);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006420
Gilles Peskine449bd832023-01-11 14:50:10 +01006421 mbedtls_platform_zeroize(handshake->premaster,
6422 sizeof(handshake->premaster));
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006423 }
6424
Gilles Peskine449bd832023-01-11 14:50:10 +01006425 return 0;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006426}
6427
Gilles Peskine449bd832023-01-11 14:50:10 +01006428int mbedtls_ssl_derive_keys(mbedtls_ssl_context *ssl)
Jerry Yud62f87e2022-02-17 14:09:02 +08006429{
6430 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6431 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
6432 ssl->handshake->ciphersuite_info;
6433
Gilles Peskine449bd832023-01-11 14:50:10 +01006434 MBEDTLS_SSL_DEBUG_MSG(2, ("=> derive keys"));
Jerry Yud62f87e2022-02-17 14:09:02 +08006435
6436 /* Set PRF, calc_verify and calc_finished function pointers */
Gilles Peskine449bd832023-01-11 14:50:10 +01006437 ret = ssl_set_handshake_prfs(ssl->handshake,
6438 ciphersuite_info->mac);
6439 if (ret != 0) {
6440 MBEDTLS_SSL_DEBUG_RET(1, "ssl_set_handshake_prfs", ret);
6441 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08006442 }
6443
6444 /* Compute master secret if needed */
Gilles Peskine449bd832023-01-11 14:50:10 +01006445 ret = ssl_compute_master(ssl->handshake,
6446 ssl->session_negotiate->master,
6447 ssl);
6448 if (ret != 0) {
6449 MBEDTLS_SSL_DEBUG_RET(1, "ssl_compute_master", ret);
6450 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08006451 }
6452
6453 /* Swap the client and server random values:
6454 * - MS derivation wanted client+server (RFC 5246 8.1)
6455 * - key derivation wants server+client (RFC 5246 6.3) */
6456 {
6457 unsigned char tmp[64];
Gilles Peskine449bd832023-01-11 14:50:10 +01006458 memcpy(tmp, ssl->handshake->randbytes, 64);
6459 memcpy(ssl->handshake->randbytes, tmp + 32, 32);
6460 memcpy(ssl->handshake->randbytes + 32, tmp, 32);
6461 mbedtls_platform_zeroize(tmp, sizeof(tmp));
Jerry Yud62f87e2022-02-17 14:09:02 +08006462 }
6463
6464 /* Populate transform structure */
Gilles Peskine449bd832023-01-11 14:50:10 +01006465 ret = ssl_tls12_populate_transform(ssl->transform_negotiate,
6466 ssl->session_negotiate->ciphersuite,
6467 ssl->session_negotiate->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02006468#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01006469 ssl->session_negotiate->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02006470#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01006471 ssl->handshake->tls_prf,
6472 ssl->handshake->randbytes,
6473 ssl->tls_version,
6474 ssl->conf->endpoint,
6475 ssl);
6476 if (ret != 0) {
6477 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls12_populate_transform", ret);
6478 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08006479 }
6480
6481 /* We no longer need Server/ClientHello.random values */
Gilles Peskine449bd832023-01-11 14:50:10 +01006482 mbedtls_platform_zeroize(ssl->handshake->randbytes,
6483 sizeof(ssl->handshake->randbytes));
Jerry Yud62f87e2022-02-17 14:09:02 +08006484
Gilles Peskine449bd832023-01-11 14:50:10 +01006485 MBEDTLS_SSL_DEBUG_MSG(2, ("<= derive keys"));
Jerry Yud62f87e2022-02-17 14:09:02 +08006486
Gilles Peskine449bd832023-01-11 14:50:10 +01006487 return 0;
Jerry Yud62f87e2022-02-17 14:09:02 +08006488}
Jerry Yu8392e0d2022-02-17 14:10:24 +08006489
Gilles Peskine449bd832023-01-11 14:50:10 +01006490int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md)
Ronald Cron4dcbca92022-03-07 10:21:40 +01006491{
Gilles Peskine449bd832023-01-11 14:50:10 +01006492 switch (md) {
Andrzej Kurek25f27152022-08-17 16:09:31 -04006493#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cron4dcbca92022-03-07 10:21:40 +01006494 case MBEDTLS_SSL_HASH_SHA384:
6495 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
6496 break;
6497#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04006498#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Ronald Cron4dcbca92022-03-07 10:21:40 +01006499 case MBEDTLS_SSL_HASH_SHA256:
6500 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
6501 break;
6502#endif
6503 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006504 return -1;
Ronald Cron4dcbca92022-03-07 10:21:40 +01006505 }
Andrzej Kurekeabeb302022-10-17 07:52:51 -04006506#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
6507 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
6508 (void) ssl;
6509#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006510 return 0;
Ronald Cron4dcbca92022-03-07 10:21:40 +01006511}
6512
Andrzej Kurek25f27152022-08-17 16:09:31 -04006513#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01006514void ssl_calc_verify_tls_sha256(const mbedtls_ssl_context *ssl,
6515 unsigned char *hash,
6516 size_t *hlen)
Jerry Yu8392e0d2022-02-17 14:10:24 +08006517{
6518#if defined(MBEDTLS_USE_PSA_CRYPTO)
6519 size_t hash_size;
6520 psa_status_t status;
6521 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
6522
Gilles Peskine449bd832023-01-11 14:50:10 +01006523 MBEDTLS_SSL_DEBUG_MSG(2, ("=> PSA calc verify sha256"));
6524 status = psa_hash_clone(&ssl->handshake->fin_sha256_psa, &sha256_psa);
6525 if (status != PSA_SUCCESS) {
6526 MBEDTLS_SSL_DEBUG_MSG(2, ("PSA hash clone failed"));
Jerry Yu8392e0d2022-02-17 14:10:24 +08006527 return;
6528 }
6529
Gilles Peskine449bd832023-01-11 14:50:10 +01006530 status = psa_hash_finish(&sha256_psa, hash, 32, &hash_size);
6531 if (status != PSA_SUCCESS) {
6532 MBEDTLS_SSL_DEBUG_MSG(2, ("PSA hash finish failed"));
Jerry Yu8392e0d2022-02-17 14:10:24 +08006533 return;
6534 }
6535
6536 *hlen = 32;
Gilles Peskine449bd832023-01-11 14:50:10 +01006537 MBEDTLS_SSL_DEBUG_BUF(3, "PSA calculated verify result", hash, *hlen);
6538 MBEDTLS_SSL_DEBUG_MSG(2, ("<= PSA calc verify"));
Jerry Yu8392e0d2022-02-17 14:10:24 +08006539#else
6540 mbedtls_sha256_context sha256;
6541
Gilles Peskine449bd832023-01-11 14:50:10 +01006542 mbedtls_sha256_init(&sha256);
Jerry Yu8392e0d2022-02-17 14:10:24 +08006543
Gilles Peskine449bd832023-01-11 14:50:10 +01006544 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc verify sha256"));
Jerry Yu8392e0d2022-02-17 14:10:24 +08006545
Gilles Peskine449bd832023-01-11 14:50:10 +01006546 mbedtls_sha256_clone(&sha256, &ssl->handshake->fin_sha256);
6547 mbedtls_sha256_finish(&sha256, hash);
Jerry Yu8392e0d2022-02-17 14:10:24 +08006548
6549 *hlen = 32;
6550
Gilles Peskine449bd832023-01-11 14:50:10 +01006551 MBEDTLS_SSL_DEBUG_BUF(3, "calculated verify result", hash, *hlen);
6552 MBEDTLS_SSL_DEBUG_MSG(2, ("<= calc verify"));
Jerry Yu8392e0d2022-02-17 14:10:24 +08006553
Gilles Peskine449bd832023-01-11 14:50:10 +01006554 mbedtls_sha256_free(&sha256);
Jerry Yu8392e0d2022-02-17 14:10:24 +08006555#endif /* MBEDTLS_USE_PSA_CRYPTO */
6556 return;
6557}
Andrzej Kurek25f27152022-08-17 16:09:31 -04006558#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yu8392e0d2022-02-17 14:10:24 +08006559
Andrzej Kurek25f27152022-08-17 16:09:31 -04006560#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01006561void ssl_calc_verify_tls_sha384(const mbedtls_ssl_context *ssl,
6562 unsigned char *hash,
6563 size_t *hlen)
Jerry Yuc1cb3842022-02-17 14:13:48 +08006564{
6565#if defined(MBEDTLS_USE_PSA_CRYPTO)
6566 size_t hash_size;
6567 psa_status_t status;
6568 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
6569
Gilles Peskine449bd832023-01-11 14:50:10 +01006570 MBEDTLS_SSL_DEBUG_MSG(2, ("=> PSA calc verify sha384"));
6571 status = psa_hash_clone(&ssl->handshake->fin_sha384_psa, &sha384_psa);
6572 if (status != PSA_SUCCESS) {
6573 MBEDTLS_SSL_DEBUG_MSG(2, ("PSA hash clone failed"));
Jerry Yuc1cb3842022-02-17 14:13:48 +08006574 return;
6575 }
6576
Gilles Peskine449bd832023-01-11 14:50:10 +01006577 status = psa_hash_finish(&sha384_psa, hash, 48, &hash_size);
6578 if (status != PSA_SUCCESS) {
6579 MBEDTLS_SSL_DEBUG_MSG(2, ("PSA hash finish failed"));
Jerry Yuc1cb3842022-02-17 14:13:48 +08006580 return;
6581 }
6582
6583 *hlen = 48;
Gilles Peskine449bd832023-01-11 14:50:10 +01006584 MBEDTLS_SSL_DEBUG_BUF(3, "PSA calculated verify result", hash, *hlen);
6585 MBEDTLS_SSL_DEBUG_MSG(2, ("<= PSA calc verify"));
Jerry Yuc1cb3842022-02-17 14:13:48 +08006586#else
6587 mbedtls_sha512_context sha512;
6588
Gilles Peskine449bd832023-01-11 14:50:10 +01006589 mbedtls_sha512_init(&sha512);
Jerry Yuc1cb3842022-02-17 14:13:48 +08006590
Gilles Peskine449bd832023-01-11 14:50:10 +01006591 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc verify sha384"));
Jerry Yuc1cb3842022-02-17 14:13:48 +08006592
Gilles Peskine449bd832023-01-11 14:50:10 +01006593 mbedtls_sha512_clone(&sha512, &ssl->handshake->fin_sha384);
6594 mbedtls_sha512_finish(&sha512, hash);
Jerry Yuc1cb3842022-02-17 14:13:48 +08006595
6596 *hlen = 48;
6597
Gilles Peskine449bd832023-01-11 14:50:10 +01006598 MBEDTLS_SSL_DEBUG_BUF(3, "calculated verify result", hash, *hlen);
6599 MBEDTLS_SSL_DEBUG_MSG(2, ("<= calc verify"));
Jerry Yuc1cb3842022-02-17 14:13:48 +08006600
Gilles Peskine449bd832023-01-11 14:50:10 +01006601 mbedtls_sha512_free(&sha512);
Jerry Yuc1cb3842022-02-17 14:13:48 +08006602#endif /* MBEDTLS_USE_PSA_CRYPTO */
6603 return;
6604}
Andrzej Kurek25f27152022-08-17 16:09:31 -04006605#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
Jerry Yuc1cb3842022-02-17 14:13:48 +08006606
Neil Armstrong80f6f322022-05-03 17:56:38 +02006607#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
6608 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006609int mbedtls_ssl_psk_derive_premaster(mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex)
Jerry Yuce3dca42022-02-17 14:16:37 +08006610{
6611 unsigned char *p = ssl->handshake->premaster;
Gilles Peskine449bd832023-01-11 14:50:10 +01006612 unsigned char *end = p + sizeof(ssl->handshake->premaster);
Jerry Yuce3dca42022-02-17 14:16:37 +08006613 const unsigned char *psk = NULL;
6614 size_t psk_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006615 int psk_ret = mbedtls_ssl_get_psk(ssl, &psk, &psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08006616
Gilles Peskine449bd832023-01-11 14:50:10 +01006617 if (psk_ret == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED) {
Jerry Yuce3dca42022-02-17 14:16:37 +08006618 /*
6619 * This should never happen because the existence of a PSK is always
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006620 * checked before calling this function.
6621 *
6622 * The exception is opaque DHE-PSK. For DHE-PSK fill premaster with
Przemek Stekiel8abcee92022-04-28 09:16:28 +02006623 * the shared secret without PSK.
Jerry Yuce3dca42022-02-17 14:16:37 +08006624 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006625 if (key_ex != MBEDTLS_KEY_EXCHANGE_DHE_PSK) {
6626 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
6627 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006628 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006629 }
6630
6631 /*
6632 * PMS = struct {
6633 * opaque other_secret<0..2^16-1>;
6634 * opaque psk<0..2^16-1>;
6635 * };
6636 * with "other_secret" depending on the particular key exchange
6637 */
6638#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006639 if (key_ex == MBEDTLS_KEY_EXCHANGE_PSK) {
6640 if (end - p < 2) {
6641 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6642 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006643
Gilles Peskine449bd832023-01-11 14:50:10 +01006644 MBEDTLS_PUT_UINT16_BE(psk_len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08006645 p += 2;
6646
Gilles Peskine449bd832023-01-11 14:50:10 +01006647 if (end < p || (size_t) (end - p) < psk_len) {
6648 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6649 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006650
Gilles Peskine449bd832023-01-11 14:50:10 +01006651 memset(p, 0, psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08006652 p += psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01006653 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08006654#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
6655#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006656 if (key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08006657 /*
6658 * other_secret already set by the ClientKeyExchange message,
6659 * and is 48 bytes long
6660 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006661 if (end - p < 2) {
6662 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6663 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006664
6665 *p++ = 0;
6666 *p++ = 48;
6667 p += 48;
Gilles Peskine449bd832023-01-11 14:50:10 +01006668 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08006669#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
6670#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006671 if (key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08006672 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6673 size_t len;
6674
6675 /* Write length only when we know the actual value */
Gilles Peskine449bd832023-01-11 14:50:10 +01006676 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx,
6677 p + 2, end - (p + 2), &len,
6678 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
6679 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret);
6680 return ret;
Jerry Yuce3dca42022-02-17 14:16:37 +08006681 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006682 MBEDTLS_PUT_UINT16_BE(len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08006683 p += 2 + len;
6684
Gilles Peskine449bd832023-01-11 14:50:10 +01006685 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K);
6686 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08006687#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Neil Armstrong80f6f322022-05-03 17:56:38 +02006688#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006689 if (key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08006690 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6691 size_t zlen;
6692
Gilles Peskine449bd832023-01-11 14:50:10 +01006693 if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx, &zlen,
6694 p + 2, end - (p + 2),
6695 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
6696 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret);
6697 return ret;
Jerry Yuce3dca42022-02-17 14:16:37 +08006698 }
6699
Gilles Peskine449bd832023-01-11 14:50:10 +01006700 MBEDTLS_PUT_UINT16_BE(zlen, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08006701 p += 2 + zlen;
6702
Gilles Peskine449bd832023-01-11 14:50:10 +01006703 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
6704 MBEDTLS_DEBUG_ECDH_Z);
6705 } else
Neil Armstrong80f6f322022-05-03 17:56:38 +02006706#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Jerry Yuce3dca42022-02-17 14:16:37 +08006707 {
Gilles Peskine449bd832023-01-11 14:50:10 +01006708 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
6709 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yuce3dca42022-02-17 14:16:37 +08006710 }
6711
6712 /* opaque psk<0..2^16-1>; */
Gilles Peskine449bd832023-01-11 14:50:10 +01006713 if (end - p < 2) {
6714 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6715 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006716
Gilles Peskine449bd832023-01-11 14:50:10 +01006717 MBEDTLS_PUT_UINT16_BE(psk_len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08006718 p += 2;
6719
Gilles Peskine449bd832023-01-11 14:50:10 +01006720 if (end < p || (size_t) (end - p) < psk_len) {
6721 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6722 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006723
Gilles Peskine449bd832023-01-11 14:50:10 +01006724 memcpy(p, psk, psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08006725 p += psk_len;
6726
6727 ssl->handshake->pmslen = p - ssl->handshake->premaster;
6728
Gilles Peskine449bd832023-01-11 14:50:10 +01006729 return 0;
Jerry Yuce3dca42022-02-17 14:16:37 +08006730}
Neil Armstrong80f6f322022-05-03 17:56:38 +02006731#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08006732
6733#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006734MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006735static int ssl_write_hello_request(mbedtls_ssl_context *ssl);
Jerry Yuc2c673d2022-02-17 14:20:39 +08006736
6737#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006738int mbedtls_ssl_resend_hello_request(mbedtls_ssl_context *ssl)
Jerry Yuc2c673d2022-02-17 14:20:39 +08006739{
6740 /* If renegotiation is not enforced, retransmit until we would reach max
6741 * timeout if we were using the usual handshake doubling scheme */
Gilles Peskine449bd832023-01-11 14:50:10 +01006742 if (ssl->conf->renego_max_records < 0) {
Jerry Yuc2c673d2022-02-17 14:20:39 +08006743 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
6744 unsigned char doublings = 1;
6745
Gilles Peskine449bd832023-01-11 14:50:10 +01006746 while (ratio != 0) {
Jerry Yuc2c673d2022-02-17 14:20:39 +08006747 ++doublings;
6748 ratio >>= 1;
6749 }
6750
Gilles Peskine449bd832023-01-11 14:50:10 +01006751 if (++ssl->renego_records_seen > doublings) {
6752 MBEDTLS_SSL_DEBUG_MSG(2, ("no longer retransmitting hello request"));
6753 return 0;
Jerry Yuc2c673d2022-02-17 14:20:39 +08006754 }
6755 }
6756
Gilles Peskine449bd832023-01-11 14:50:10 +01006757 return ssl_write_hello_request(ssl);
Jerry Yuc2c673d2022-02-17 14:20:39 +08006758}
6759#endif
6760#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08006761
Jerry Yud9526692022-02-17 14:23:47 +08006762/*
6763 * Handshake functions
6764 */
6765#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6766/* No certificate support -> dummy functions */
Gilles Peskine449bd832023-01-11 14:50:10 +01006767int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08006768{
6769 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6770 ssl->handshake->ciphersuite_info;
6771
Gilles Peskine449bd832023-01-11 14:50:10 +01006772 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08006773
Gilles Peskine449bd832023-01-11 14:50:10 +01006774 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
6775 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08006776 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01006777 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08006778 }
6779
Gilles Peskine449bd832023-01-11 14:50:10 +01006780 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
6781 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08006782}
6783
Gilles Peskine449bd832023-01-11 14:50:10 +01006784int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08006785{
6786 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6787 ssl->handshake->ciphersuite_info;
6788
Gilles Peskine449bd832023-01-11 14:50:10 +01006789 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08006790
Gilles Peskine449bd832023-01-11 14:50:10 +01006791 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
6792 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08006793 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01006794 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08006795 }
6796
Gilles Peskine449bd832023-01-11 14:50:10 +01006797 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
6798 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08006799}
6800
6801#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6802/* Some certificate support -> implement write and parse */
6803
Gilles Peskine449bd832023-01-11 14:50:10 +01006804int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08006805{
6806 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
6807 size_t i, n;
6808 const mbedtls_x509_crt *crt;
6809 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6810 ssl->handshake->ciphersuite_info;
6811
Gilles Peskine449bd832023-01-11 14:50:10 +01006812 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08006813
Gilles Peskine449bd832023-01-11 14:50:10 +01006814 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
6815 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08006816 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01006817 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08006818 }
6819
6820#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006821 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
6822 if (ssl->handshake->client_auth == 0) {
6823 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08006824 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01006825 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08006826 }
6827 }
6828#endif /* MBEDTLS_SSL_CLI_C */
6829#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006830 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
6831 if (mbedtls_ssl_own_cert(ssl) == NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08006832 /* Should never happen because we shouldn't have picked the
6833 * ciphersuite if we don't have a certificate. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006834 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08006835 }
6836 }
6837#endif
6838
Gilles Peskine449bd832023-01-11 14:50:10 +01006839 MBEDTLS_SSL_DEBUG_CRT(3, "own certificate", mbedtls_ssl_own_cert(ssl));
Jerry Yud9526692022-02-17 14:23:47 +08006840
6841 /*
6842 * 0 . 0 handshake type
6843 * 1 . 3 handshake length
6844 * 4 . 6 length of all certs
6845 * 7 . 9 length of cert. 1
6846 * 10 . n-1 peer certificate
6847 * n . n+2 length of cert. 2
6848 * n+3 . ... upper level cert, etc.
6849 */
6850 i = 7;
Gilles Peskine449bd832023-01-11 14:50:10 +01006851 crt = mbedtls_ssl_own_cert(ssl);
Jerry Yud9526692022-02-17 14:23:47 +08006852
Gilles Peskine449bd832023-01-11 14:50:10 +01006853 while (crt != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08006854 n = crt->raw.len;
Gilles Peskine449bd832023-01-11 14:50:10 +01006855 if (n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i) {
6856 MBEDTLS_SSL_DEBUG_MSG(1, ("certificate too large, %" MBEDTLS_PRINTF_SIZET
6857 " > %" MBEDTLS_PRINTF_SIZET,
6858 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN));
6859 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
Jerry Yud9526692022-02-17 14:23:47 +08006860 }
6861
Gilles Peskine449bd832023-01-11 14:50:10 +01006862 ssl->out_msg[i] = MBEDTLS_BYTE_2(n);
6863 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1(n);
6864 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0(n);
Jerry Yud9526692022-02-17 14:23:47 +08006865
Gilles Peskine449bd832023-01-11 14:50:10 +01006866 i += 3; memcpy(ssl->out_msg + i, crt->raw.p, n);
Jerry Yud9526692022-02-17 14:23:47 +08006867 i += n; crt = crt->next;
6868 }
6869
Gilles Peskine449bd832023-01-11 14:50:10 +01006870 ssl->out_msg[4] = MBEDTLS_BYTE_2(i - 7);
6871 ssl->out_msg[5] = MBEDTLS_BYTE_1(i - 7);
6872 ssl->out_msg[6] = MBEDTLS_BYTE_0(i - 7);
Jerry Yud9526692022-02-17 14:23:47 +08006873
6874 ssl->out_msglen = i;
6875 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6876 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
6877
6878 ssl->state++;
6879
Gilles Peskine449bd832023-01-11 14:50:10 +01006880 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
6881 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
6882 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08006883 }
6884
Gilles Peskine449bd832023-01-11 14:50:10 +01006885 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08006886
Gilles Peskine449bd832023-01-11 14:50:10 +01006887 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08006888}
6889
6890#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6891
6892#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006893MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006894static int ssl_check_peer_crt_unchanged(mbedtls_ssl_context *ssl,
6895 unsigned char *crt_buf,
6896 size_t crt_buf_len)
Jerry Yud9526692022-02-17 14:23:47 +08006897{
6898 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
6899
Gilles Peskine449bd832023-01-11 14:50:10 +01006900 if (peer_crt == NULL) {
6901 return -1;
6902 }
Jerry Yud9526692022-02-17 14:23:47 +08006903
Gilles Peskine449bd832023-01-11 14:50:10 +01006904 if (peer_crt->raw.len != crt_buf_len) {
6905 return -1;
6906 }
Jerry Yud9526692022-02-17 14:23:47 +08006907
Gilles Peskine449bd832023-01-11 14:50:10 +01006908 return memcmp(peer_crt->raw.p, crt_buf, peer_crt->raw.len);
Jerry Yud9526692022-02-17 14:23:47 +08006909}
6910#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006911MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006912static int ssl_check_peer_crt_unchanged(mbedtls_ssl_context *ssl,
6913 unsigned char *crt_buf,
6914 size_t crt_buf_len)
Jerry Yud9526692022-02-17 14:23:47 +08006915{
6916 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6917 unsigned char const * const peer_cert_digest =
6918 ssl->session->peer_cert_digest;
6919 mbedtls_md_type_t const peer_cert_digest_type =
6920 ssl->session->peer_cert_digest_type;
6921 mbedtls_md_info_t const * const digest_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01006922 mbedtls_md_info_from_type(peer_cert_digest_type);
Jerry Yud9526692022-02-17 14:23:47 +08006923 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
6924 size_t digest_len;
6925
Gilles Peskine449bd832023-01-11 14:50:10 +01006926 if (peer_cert_digest == NULL || digest_info == NULL) {
6927 return -1;
6928 }
Jerry Yud9526692022-02-17 14:23:47 +08006929
Gilles Peskine449bd832023-01-11 14:50:10 +01006930 digest_len = mbedtls_md_get_size(digest_info);
6931 if (digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN) {
6932 return -1;
6933 }
Jerry Yud9526692022-02-17 14:23:47 +08006934
Gilles Peskine449bd832023-01-11 14:50:10 +01006935 ret = mbedtls_md(digest_info, crt_buf, crt_buf_len, tmp_digest);
6936 if (ret != 0) {
6937 return -1;
6938 }
Jerry Yud9526692022-02-17 14:23:47 +08006939
Gilles Peskine449bd832023-01-11 14:50:10 +01006940 return memcmp(tmp_digest, peer_cert_digest, digest_len);
Jerry Yud9526692022-02-17 14:23:47 +08006941}
6942#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6943#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6944
6945/*
6946 * Once the certificate message is read, parse it into a cert chain and
6947 * perform basic checks, but leave actual verification to the caller
6948 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006949MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006950static int ssl_parse_certificate_chain(mbedtls_ssl_context *ssl,
6951 mbedtls_x509_crt *chain)
Jerry Yud9526692022-02-17 14:23:47 +08006952{
6953 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6954#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006955 int crt_cnt = 0;
Jerry Yud9526692022-02-17 14:23:47 +08006956#endif
6957 size_t i, n;
6958 uint8_t alert;
6959
Gilles Peskine449bd832023-01-11 14:50:10 +01006960 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
6961 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
6962 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6963 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
6964 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
Jerry Yud9526692022-02-17 14:23:47 +08006965 }
6966
Gilles Peskine449bd832023-01-11 14:50:10 +01006967 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE) {
6968 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6969 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
6970 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
Jerry Yud9526692022-02-17 14:23:47 +08006971 }
6972
Gilles Peskine449bd832023-01-11 14:50:10 +01006973 if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 3 + 3) {
6974 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
6975 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6976 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
6977 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08006978 }
6979
Gilles Peskine449bd832023-01-11 14:50:10 +01006980 i = mbedtls_ssl_hs_hdr_len(ssl);
Jerry Yud9526692022-02-17 14:23:47 +08006981
6982 /*
6983 * Same message structure as in mbedtls_ssl_write_certificate()
6984 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006985 n = (ssl->in_msg[i+1] << 8) | ssl->in_msg[i+2];
Jerry Yud9526692022-02-17 14:23:47 +08006986
Gilles Peskine449bd832023-01-11 14:50:10 +01006987 if (ssl->in_msg[i] != 0 ||
6988 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len(ssl)) {
6989 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
6990 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6991 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
6992 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08006993 }
6994
6995 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
6996 i += 3;
6997
6998 /* Iterate through and parse the CRTs in the provided chain. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006999 while (i < ssl->in_hslen) {
Jerry Yud9526692022-02-17 14:23:47 +08007000 /* Check that there's room for the next CRT's length fields. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007001 if (i + 3 > ssl->in_hslen) {
7002 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7003 mbedtls_ssl_send_alert_message(ssl,
7004 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7005 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7006 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007007 }
7008 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
7009 * anything beyond 2**16 ~ 64K. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007010 if (ssl->in_msg[i] != 0) {
7011 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7012 mbedtls_ssl_send_alert_message(ssl,
7013 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7014 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT);
7015 return MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Jerry Yud9526692022-02-17 14:23:47 +08007016 }
7017
7018 /* Read length of the next CRT in the chain. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007019 n = ((unsigned int) ssl->in_msg[i + 1] << 8)
Jerry Yud9526692022-02-17 14:23:47 +08007020 | (unsigned int) ssl->in_msg[i + 2];
7021 i += 3;
7022
Gilles Peskine449bd832023-01-11 14:50:10 +01007023 if (n < 128 || i + n > ssl->in_hslen) {
7024 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7025 mbedtls_ssl_send_alert_message(ssl,
7026 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7027 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7028 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007029 }
7030
7031 /* Check if we're handling the first CRT in the chain. */
7032#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007033 if (crt_cnt++ == 0 &&
Jerry Yud9526692022-02-17 14:23:47 +08007034 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Gilles Peskine449bd832023-01-11 14:50:10 +01007035 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
Jerry Yud9526692022-02-17 14:23:47 +08007036 /* During client-side renegotiation, check that the server's
7037 * end-CRTs hasn't changed compared to the initial handshake,
7038 * mitigating the triple handshake attack. On success, reuse
7039 * the original end-CRT instead of parsing it again. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007040 MBEDTLS_SSL_DEBUG_MSG(3, ("Check that peer CRT hasn't changed during renegotiation"));
7041 if (ssl_check_peer_crt_unchanged(ssl,
7042 &ssl->in_msg[i],
7043 n) != 0) {
7044 MBEDTLS_SSL_DEBUG_MSG(1, ("new server cert during renegotiation"));
7045 mbedtls_ssl_send_alert_message(ssl,
7046 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7047 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED);
7048 return MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Jerry Yud9526692022-02-17 14:23:47 +08007049 }
7050
7051 /* Now we can safely free the original chain. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007052 ssl_clear_peer_cert(ssl->session);
Jerry Yud9526692022-02-17 14:23:47 +08007053 }
7054#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7055
7056 /* Parse the next certificate in the chain. */
7057#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007058 ret = mbedtls_x509_crt_parse_der(chain, ssl->in_msg + i, n);
Jerry Yud9526692022-02-17 14:23:47 +08007059#else
7060 /* If we don't need to store the CRT chain permanently, parse
7061 * it in-place from the input buffer instead of making a copy. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007062 ret = mbedtls_x509_crt_parse_der_nocopy(chain, ssl->in_msg + i, n);
Jerry Yud9526692022-02-17 14:23:47 +08007063#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +01007064 switch (ret) {
Jerry Yud9526692022-02-17 14:23:47 +08007065 case 0: /*ok*/
7066 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7067 /* Ignore certificate with an unknown algorithm: maybe a
7068 prior certificate was already trusted. */
7069 break;
7070
7071 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7072 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7073 goto crt_parse_der_failed;
7074
7075 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7076 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7077 goto crt_parse_der_failed;
7078
7079 default:
7080 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007081crt_parse_der_failed:
7082 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert);
7083 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
7084 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007085 }
7086
7087 i += n;
7088 }
7089
Gilles Peskine449bd832023-01-11 14:50:10 +01007090 MBEDTLS_SSL_DEBUG_CRT(3, "peer certificate", chain);
7091 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007092}
7093
7094#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007095MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007096static int ssl_srv_check_client_no_crt_notification(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007097{
Gilles Peskine449bd832023-01-11 14:50:10 +01007098 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
7099 return -1;
7100 }
Jerry Yud9526692022-02-17 14:23:47 +08007101
Gilles Peskine449bd832023-01-11 14:50:10 +01007102 if (ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len(ssl) &&
Jerry Yud9526692022-02-17 14:23:47 +08007103 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7104 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
Gilles Peskine449bd832023-01-11 14:50:10 +01007105 memcmp(ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl), "\0\0\0", 3) == 0) {
7106 MBEDTLS_SSL_DEBUG_MSG(1, ("peer has no certificate"));
7107 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007108 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007109 return -1;
Jerry Yud9526692022-02-17 14:23:47 +08007110}
7111#endif /* MBEDTLS_SSL_SRV_C */
7112
7113/* Check if a certificate message is expected.
7114 * Return either
7115 * - SSL_CERTIFICATE_EXPECTED, or
7116 * - SSL_CERTIFICATE_SKIP
7117 * indicating whether a Certificate message is expected or not.
7118 */
7119#define SSL_CERTIFICATE_EXPECTED 0
7120#define SSL_CERTIFICATE_SKIP 1
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007121MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007122static int ssl_parse_certificate_coordinate(mbedtls_ssl_context *ssl,
7123 int authmode)
Jerry Yud9526692022-02-17 14:23:47 +08007124{
7125 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7126 ssl->handshake->ciphersuite_info;
7127
Gilles Peskine449bd832023-01-11 14:50:10 +01007128 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7129 return SSL_CERTIFICATE_SKIP;
7130 }
Jerry Yud9526692022-02-17 14:23:47 +08007131
7132#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007133 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
7134 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) {
7135 return SSL_CERTIFICATE_SKIP;
7136 }
Jerry Yud9526692022-02-17 14:23:47 +08007137
Gilles Peskine449bd832023-01-11 14:50:10 +01007138 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
Jerry Yud9526692022-02-17 14:23:47 +08007139 ssl->session_negotiate->verify_result =
7140 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
Gilles Peskine449bd832023-01-11 14:50:10 +01007141 return SSL_CERTIFICATE_SKIP;
Jerry Yud9526692022-02-17 14:23:47 +08007142 }
7143 }
7144#else
7145 ((void) authmode);
7146#endif /* MBEDTLS_SSL_SRV_C */
7147
Gilles Peskine449bd832023-01-11 14:50:10 +01007148 return SSL_CERTIFICATE_EXPECTED;
Jerry Yud9526692022-02-17 14:23:47 +08007149}
7150
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007151MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007152static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl,
7153 int authmode,
7154 mbedtls_x509_crt *chain,
7155 void *rs_ctx)
Jerry Yud9526692022-02-17 14:23:47 +08007156{
7157 int ret = 0;
7158 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7159 ssl->handshake->ciphersuite_info;
7160 int have_ca_chain = 0;
7161
7162 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
7163 void *p_vrfy;
7164
Gilles Peskine449bd832023-01-11 14:50:10 +01007165 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
7166 return 0;
7167 }
Jerry Yud9526692022-02-17 14:23:47 +08007168
Gilles Peskine449bd832023-01-11 14:50:10 +01007169 if (ssl->f_vrfy != NULL) {
7170 MBEDTLS_SSL_DEBUG_MSG(3, ("Use context-specific verification callback"));
Jerry Yud9526692022-02-17 14:23:47 +08007171 f_vrfy = ssl->f_vrfy;
7172 p_vrfy = ssl->p_vrfy;
Gilles Peskine449bd832023-01-11 14:50:10 +01007173 } else {
7174 MBEDTLS_SSL_DEBUG_MSG(3, ("Use configuration-specific verification callback"));
Jerry Yud9526692022-02-17 14:23:47 +08007175 f_vrfy = ssl->conf->f_vrfy;
7176 p_vrfy = ssl->conf->p_vrfy;
7177 }
7178
7179 /*
7180 * Main check: verify certificate
7181 */
7182#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
Gilles Peskine449bd832023-01-11 14:50:10 +01007183 if (ssl->conf->f_ca_cb != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007184 ((void) rs_ctx);
7185 have_ca_chain = 1;
7186
Gilles Peskine449bd832023-01-11 14:50:10 +01007187 MBEDTLS_SSL_DEBUG_MSG(3, ("use CA callback for X.509 CRT verification"));
Jerry Yud9526692022-02-17 14:23:47 +08007188 ret = mbedtls_x509_crt_verify_with_ca_cb(
7189 chain,
7190 ssl->conf->f_ca_cb,
7191 ssl->conf->p_ca_cb,
7192 ssl->conf->cert_profile,
7193 ssl->hostname,
7194 &ssl->session_negotiate->verify_result,
Gilles Peskine449bd832023-01-11 14:50:10 +01007195 f_vrfy, p_vrfy);
7196 } else
Jerry Yud9526692022-02-17 14:23:47 +08007197#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
7198 {
7199 mbedtls_x509_crt *ca_chain;
7200 mbedtls_x509_crl *ca_crl;
7201
7202#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01007203 if (ssl->handshake->sni_ca_chain != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007204 ca_chain = ssl->handshake->sni_ca_chain;
7205 ca_crl = ssl->handshake->sni_ca_crl;
Gilles Peskine449bd832023-01-11 14:50:10 +01007206 } else
Jerry Yud9526692022-02-17 14:23:47 +08007207#endif
7208 {
7209 ca_chain = ssl->conf->ca_chain;
7210 ca_crl = ssl->conf->ca_crl;
7211 }
7212
Gilles Peskine449bd832023-01-11 14:50:10 +01007213 if (ca_chain != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007214 have_ca_chain = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007215 }
Jerry Yud9526692022-02-17 14:23:47 +08007216
7217 ret = mbedtls_x509_crt_verify_restartable(
7218 chain,
7219 ca_chain, ca_crl,
7220 ssl->conf->cert_profile,
7221 ssl->hostname,
7222 &ssl->session_negotiate->verify_result,
Gilles Peskine449bd832023-01-11 14:50:10 +01007223 f_vrfy, p_vrfy, rs_ctx);
Jerry Yud9526692022-02-17 14:23:47 +08007224 }
7225
Gilles Peskine449bd832023-01-11 14:50:10 +01007226 if (ret != 0) {
7227 MBEDTLS_SSL_DEBUG_RET(1, "x509_verify_cert", ret);
Jerry Yud9526692022-02-17 14:23:47 +08007228 }
7229
7230#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007231 if (ret == MBEDTLS_ERR_ECP_IN_PROGRESS) {
7232 return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
7233 }
Jerry Yud9526692022-02-17 14:23:47 +08007234#endif
7235
7236 /*
7237 * Secondary checks: always done, but change 'ret' only if it was 0
7238 */
7239
7240#if defined(MBEDTLS_ECP_C)
7241 {
7242 const mbedtls_pk_context *pk = &chain->pk;
7243
Manuel Pégourié-Gonnard66b0d612022-06-17 10:49:29 +02007244 /* If certificate uses an EC key, make sure the curve is OK.
7245 * This is a public key, so it can't be opaque, so can_do() is a good
7246 * enough check to ensure pk_ec() is safe to use here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007247 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_ECKEY)) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007248 /* and in the unlikely case the above assumption no longer holds
7249 * we are making sure that pk_ec() here does not return a NULL
7250 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007251 const mbedtls_ecp_keypair *ec = mbedtls_pk_ec(*pk);
7252 if (ec == NULL) {
7253 MBEDTLS_SSL_DEBUG_MSG(1, ("mbedtls_pk_ec() returned NULL"));
7254 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007255 }
Jerry Yud9526692022-02-17 14:23:47 +08007256
Gilles Peskine449bd832023-01-11 14:50:10 +01007257 if (mbedtls_ssl_check_curve(ssl, ec->grp.id) != 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007258 ssl->session_negotiate->verify_result |=
7259 MBEDTLS_X509_BADCERT_BAD_KEY;
7260
Gilles Peskine449bd832023-01-11 14:50:10 +01007261 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (EC key curve)"));
7262 if (ret == 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007263 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01007264 }
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007265 }
Jerry Yud9526692022-02-17 14:23:47 +08007266 }
7267 }
7268#endif /* MBEDTLS_ECP_C */
7269
Gilles Peskine449bd832023-01-11 14:50:10 +01007270 if (mbedtls_ssl_check_cert_usage(chain,
7271 ciphersuite_info,
7272 !ssl->conf->endpoint,
7273 &ssl->session_negotiate->verify_result) != 0) {
7274 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (usage extensions)"));
7275 if (ret == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007276 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01007277 }
Jerry Yud9526692022-02-17 14:23:47 +08007278 }
7279
7280 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
7281 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
7282 * with details encoded in the verification flags. All other kinds
7283 * of error codes, including those from the user provided f_vrfy
7284 * functions, are treated as fatal and lead to a failure of
7285 * ssl_parse_certificate even if verification was optional. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007286 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
7287 (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7288 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE)) {
Jerry Yud9526692022-02-17 14:23:47 +08007289 ret = 0;
7290 }
7291
Gilles Peskine449bd832023-01-11 14:50:10 +01007292 if (have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED) {
7293 MBEDTLS_SSL_DEBUG_MSG(1, ("got no CA chain"));
Jerry Yud9526692022-02-17 14:23:47 +08007294 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
7295 }
7296
Gilles Peskine449bd832023-01-11 14:50:10 +01007297 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007298 uint8_t alert;
7299
7300 /* The certificate may have been rejected for several reasons.
7301 Pick one and send the corresponding alert. Which alert to send
7302 may be a subject of debate in some cases. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007303 if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER) {
Jerry Yud9526692022-02-17 14:23:47 +08007304 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007305 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH) {
Jerry Yud9526692022-02-17 14:23:47 +08007306 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007307 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE) {
Jerry Yud9526692022-02-17 14:23:47 +08007308 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007309 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE) {
Jerry Yud9526692022-02-17 14:23:47 +08007310 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007311 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE) {
Jerry Yud9526692022-02-17 14:23:47 +08007312 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007313 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK) {
Jerry Yud9526692022-02-17 14:23:47 +08007314 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007315 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY) {
Jerry Yud9526692022-02-17 14:23:47 +08007316 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007317 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED) {
Jerry Yud9526692022-02-17 14:23:47 +08007318 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007319 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED) {
Jerry Yud9526692022-02-17 14:23:47 +08007320 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007321 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
Jerry Yud9526692022-02-17 14:23:47 +08007322 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
Gilles Peskine449bd832023-01-11 14:50:10 +01007323 } else {
Jerry Yud9526692022-02-17 14:23:47 +08007324 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Gilles Peskine449bd832023-01-11 14:50:10 +01007325 }
7326 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7327 alert);
Jerry Yud9526692022-02-17 14:23:47 +08007328 }
7329
7330#if defined(MBEDTLS_DEBUG_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007331 if (ssl->session_negotiate->verify_result != 0) {
7332 MBEDTLS_SSL_DEBUG_MSG(3, ("! Certificate verification flags %08x",
7333 (unsigned int) ssl->session_negotiate->verify_result));
7334 } else {
7335 MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate verification flags clear"));
Jerry Yud9526692022-02-17 14:23:47 +08007336 }
7337#endif /* MBEDTLS_DEBUG_C */
7338
Gilles Peskine449bd832023-01-11 14:50:10 +01007339 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007340}
7341
7342#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007343MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007344static int ssl_remember_peer_crt_digest(mbedtls_ssl_context *ssl,
7345 unsigned char *start, size_t len)
Jerry Yud9526692022-02-17 14:23:47 +08007346{
7347 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7348 /* Remember digest of the peer's end-CRT. */
7349 ssl->session_negotiate->peer_cert_digest =
Gilles Peskine449bd832023-01-11 14:50:10 +01007350 mbedtls_calloc(1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN);
7351 if (ssl->session_negotiate->peer_cert_digest == NULL) {
7352 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%d bytes) failed",
7353 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN));
7354 mbedtls_ssl_send_alert_message(ssl,
7355 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7356 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
Jerry Yud9526692022-02-17 14:23:47 +08007357
Gilles Peskine449bd832023-01-11 14:50:10 +01007358 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Jerry Yud9526692022-02-17 14:23:47 +08007359 }
7360
Gilles Peskine449bd832023-01-11 14:50:10 +01007361 ret = mbedtls_md(mbedtls_md_info_from_type(
7362 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE),
7363 start, len,
7364 ssl->session_negotiate->peer_cert_digest);
Jerry Yud9526692022-02-17 14:23:47 +08007365
7366 ssl->session_negotiate->peer_cert_digest_type =
7367 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
7368 ssl->session_negotiate->peer_cert_digest_len =
7369 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
7370
Gilles Peskine449bd832023-01-11 14:50:10 +01007371 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007372}
7373
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007374MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007375static int ssl_remember_peer_pubkey(mbedtls_ssl_context *ssl,
7376 unsigned char *start, size_t len)
Jerry Yud9526692022-02-17 14:23:47 +08007377{
7378 unsigned char *end = start + len;
7379 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7380
7381 /* Make a copy of the peer's raw public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007382 mbedtls_pk_init(&ssl->handshake->peer_pubkey);
7383 ret = mbedtls_pk_parse_subpubkey(&start, end,
7384 &ssl->handshake->peer_pubkey);
7385 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007386 /* We should have parsed the public key before. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007387 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007388 }
7389
Gilles Peskine449bd832023-01-11 14:50:10 +01007390 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007391}
7392#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7393
Gilles Peskine449bd832023-01-11 14:50:10 +01007394int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007395{
7396 int ret = 0;
7397 int crt_expected;
7398#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7399 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
7400 ? ssl->handshake->sni_authmode
7401 : ssl->conf->authmode;
7402#else
7403 const int authmode = ssl->conf->authmode;
7404#endif
7405 void *rs_ctx = NULL;
7406 mbedtls_x509_crt *chain = NULL;
7407
Gilles Peskine449bd832023-01-11 14:50:10 +01007408 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007409
Gilles Peskine449bd832023-01-11 14:50:10 +01007410 crt_expected = ssl_parse_certificate_coordinate(ssl, authmode);
7411 if (crt_expected == SSL_CERTIFICATE_SKIP) {
7412 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007413 goto exit;
7414 }
7415
7416#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007417 if (ssl->handshake->ecrs_enabled &&
7418 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify) {
Jerry Yud9526692022-02-17 14:23:47 +08007419 chain = ssl->handshake->ecrs_peer_cert;
7420 ssl->handshake->ecrs_peer_cert = NULL;
7421 goto crt_verify;
7422 }
7423#endif
7424
Gilles Peskine449bd832023-01-11 14:50:10 +01007425 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007426 /* mbedtls_ssl_read_record may have sent an alert already. We
7427 let it decide whether to alert. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007428 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
Jerry Yud9526692022-02-17 14:23:47 +08007429 goto exit;
7430 }
7431
7432#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007433 if (ssl_srv_check_client_no_crt_notification(ssl) == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007434 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
7435
Gilles Peskine449bd832023-01-11 14:50:10 +01007436 if (authmode != MBEDTLS_SSL_VERIFY_OPTIONAL) {
Jerry Yud9526692022-02-17 14:23:47 +08007437 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01007438 }
Jerry Yud9526692022-02-17 14:23:47 +08007439
7440 goto exit;
7441 }
7442#endif /* MBEDTLS_SSL_SRV_C */
7443
7444 /* Clear existing peer CRT structure in case we tried to
7445 * reuse a session but it failed, and allocate a new one. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007446 ssl_clear_peer_cert(ssl->session_negotiate);
Jerry Yud9526692022-02-17 14:23:47 +08007447
Gilles Peskine449bd832023-01-11 14:50:10 +01007448 chain = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
7449 if (chain == NULL) {
7450 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
7451 sizeof(mbedtls_x509_crt)));
7452 mbedtls_ssl_send_alert_message(ssl,
7453 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7454 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
Jerry Yud9526692022-02-17 14:23:47 +08007455
7456 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
7457 goto exit;
7458 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007459 mbedtls_x509_crt_init(chain);
Jerry Yud9526692022-02-17 14:23:47 +08007460
Gilles Peskine449bd832023-01-11 14:50:10 +01007461 ret = ssl_parse_certificate_chain(ssl, chain);
7462 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007463 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007464 }
Jerry Yud9526692022-02-17 14:23:47 +08007465
7466#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007467 if (ssl->handshake->ecrs_enabled) {
Jerry Yud9526692022-02-17 14:23:47 +08007468 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Gilles Peskine449bd832023-01-11 14:50:10 +01007469 }
Jerry Yud9526692022-02-17 14:23:47 +08007470
7471crt_verify:
Gilles Peskine449bd832023-01-11 14:50:10 +01007472 if (ssl->handshake->ecrs_enabled) {
Jerry Yud9526692022-02-17 14:23:47 +08007473 rs_ctx = &ssl->handshake->ecrs_ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01007474 }
Jerry Yud9526692022-02-17 14:23:47 +08007475#endif
7476
Gilles Peskine449bd832023-01-11 14:50:10 +01007477 ret = ssl_parse_certificate_verify(ssl, authmode,
7478 chain, rs_ctx);
7479 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007480 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007481 }
Jerry Yud9526692022-02-17 14:23:47 +08007482
7483#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7484 {
7485 unsigned char *crt_start, *pk_start;
7486 size_t crt_len, pk_len;
7487
7488 /* We parse the CRT chain without copying, so
7489 * these pointers point into the input buffer,
7490 * and are hence still valid after freeing the
7491 * CRT chain. */
7492
7493 crt_start = chain->raw.p;
7494 crt_len = chain->raw.len;
7495
7496 pk_start = chain->pk_raw.p;
7497 pk_len = chain->pk_raw.len;
7498
7499 /* Free the CRT structures before computing
7500 * digest and copying the peer's public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007501 mbedtls_x509_crt_free(chain);
7502 mbedtls_free(chain);
Jerry Yud9526692022-02-17 14:23:47 +08007503 chain = NULL;
7504
Gilles Peskine449bd832023-01-11 14:50:10 +01007505 ret = ssl_remember_peer_crt_digest(ssl, crt_start, crt_len);
7506 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007507 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007508 }
Jerry Yud9526692022-02-17 14:23:47 +08007509
Gilles Peskine449bd832023-01-11 14:50:10 +01007510 ret = ssl_remember_peer_pubkey(ssl, pk_start, pk_len);
7511 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007512 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007513 }
Jerry Yud9526692022-02-17 14:23:47 +08007514 }
7515#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7516 /* Pass ownership to session structure. */
7517 ssl->session_negotiate->peer_cert = chain;
7518 chain = NULL;
7519#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7520
Gilles Peskine449bd832023-01-11 14:50:10 +01007521 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007522
7523exit:
7524
Gilles Peskine449bd832023-01-11 14:50:10 +01007525 if (ret == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007526 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007527 }
Jerry Yud9526692022-02-17 14:23:47 +08007528
7529#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007530 if (ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) {
Jerry Yud9526692022-02-17 14:23:47 +08007531 ssl->handshake->ecrs_peer_cert = chain;
7532 chain = NULL;
7533 }
7534#endif
7535
Gilles Peskine449bd832023-01-11 14:50:10 +01007536 if (chain != NULL) {
7537 mbedtls_x509_crt_free(chain);
7538 mbedtls_free(chain);
Jerry Yud9526692022-02-17 14:23:47 +08007539 }
7540
Gilles Peskine449bd832023-01-11 14:50:10 +01007541 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007542}
7543#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7544
Andrzej Kurek25f27152022-08-17 16:09:31 -04007545#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yu615bd6f2022-02-17 14:25:15 +08007546static void ssl_calc_finished_tls_sha256(
Gilles Peskine449bd832023-01-11 14:50:10 +01007547 mbedtls_ssl_context *ssl, unsigned char *buf, int from)
Jerry Yu615bd6f2022-02-17 14:25:15 +08007548{
7549 int len = 12;
7550 const char *sender;
7551 unsigned char padbuf[32];
7552#if defined(MBEDTLS_USE_PSA_CRYPTO)
7553 size_t hash_size;
7554 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
7555 psa_status_t status;
7556#else
7557 mbedtls_sha256_context sha256;
7558#endif
7559
7560 mbedtls_ssl_session *session = ssl->session_negotiate;
Gilles Peskine449bd832023-01-11 14:50:10 +01007561 if (!session) {
Jerry Yu615bd6f2022-02-17 14:25:15 +08007562 session = ssl->session;
Gilles Peskine449bd832023-01-11 14:50:10 +01007563 }
Jerry Yu615bd6f2022-02-17 14:25:15 +08007564
Gilles Peskine449bd832023-01-11 14:50:10 +01007565 sender = (from == MBEDTLS_SSL_IS_CLIENT)
Jerry Yu615bd6f2022-02-17 14:25:15 +08007566 ? "client finished"
7567 : "server finished";
7568
7569#if defined(MBEDTLS_USE_PSA_CRYPTO)
7570 sha256_psa = psa_hash_operation_init();
7571
Gilles Peskine449bd832023-01-11 14:50:10 +01007572 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc PSA finished tls sha256"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007573
Gilles Peskine449bd832023-01-11 14:50:10 +01007574 status = psa_hash_clone(&ssl->handshake->fin_sha256_psa, &sha256_psa);
7575 if (status != PSA_SUCCESS) {
7576 MBEDTLS_SSL_DEBUG_MSG(2, ("PSA hash clone failed"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007577 return;
7578 }
7579
Gilles Peskine449bd832023-01-11 14:50:10 +01007580 status = psa_hash_finish(&sha256_psa, padbuf, sizeof(padbuf), &hash_size);
7581 if (status != PSA_SUCCESS) {
7582 MBEDTLS_SSL_DEBUG_MSG(2, ("PSA hash finish failed"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007583 return;
7584 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007585 MBEDTLS_SSL_DEBUG_BUF(3, "PSA calculated padbuf", padbuf, 32);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007586#else
7587
Gilles Peskine449bd832023-01-11 14:50:10 +01007588 mbedtls_sha256_init(&sha256);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007589
Gilles Peskine449bd832023-01-11 14:50:10 +01007590 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc finished tls sha256"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007591
Gilles Peskine449bd832023-01-11 14:50:10 +01007592 mbedtls_sha256_clone(&sha256, &ssl->handshake->fin_sha256);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007593
7594 /*
7595 * TLSv1.2:
7596 * hash = PRF( master, finished_label,
7597 * Hash( handshake ) )[0.11]
7598 */
7599
7600#if !defined(MBEDTLS_SHA256_ALT)
Gilles Peskine449bd832023-01-11 14:50:10 +01007601 MBEDTLS_SSL_DEBUG_BUF(4, "finished sha2 state", (unsigned char *)
7602 sha256.state, sizeof(sha256.state));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007603#endif
7604
Gilles Peskine449bd832023-01-11 14:50:10 +01007605 mbedtls_sha256_finish(&sha256, padbuf);
7606 mbedtls_sha256_free(&sha256);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007607#endif /* MBEDTLS_USE_PSA_CRYPTO */
7608
Gilles Peskine449bd832023-01-11 14:50:10 +01007609 ssl->handshake->tls_prf(session->master, 48, sender,
7610 padbuf, 32, buf, len);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007611
Gilles Peskine449bd832023-01-11 14:50:10 +01007612 MBEDTLS_SSL_DEBUG_BUF(3, "calc finished result", buf, len);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007613
Gilles Peskine449bd832023-01-11 14:50:10 +01007614 mbedtls_platform_zeroize(padbuf, sizeof(padbuf));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007615
Gilles Peskine449bd832023-01-11 14:50:10 +01007616 MBEDTLS_SSL_DEBUG_MSG(2, ("<= calc finished"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007617}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04007618#endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yu615bd6f2022-02-17 14:25:15 +08007619
Jerry Yub7ba49e2022-02-17 14:25:53 +08007620
Andrzej Kurek25f27152022-08-17 16:09:31 -04007621#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Jerry Yub7ba49e2022-02-17 14:25:53 +08007622static void ssl_calc_finished_tls_sha384(
Gilles Peskine449bd832023-01-11 14:50:10 +01007623 mbedtls_ssl_context *ssl, unsigned char *buf, int from)
Jerry Yub7ba49e2022-02-17 14:25:53 +08007624{
7625 int len = 12;
7626 const char *sender;
7627 unsigned char padbuf[48];
7628#if defined(MBEDTLS_USE_PSA_CRYPTO)
7629 size_t hash_size;
7630 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
7631 psa_status_t status;
7632#else
7633 mbedtls_sha512_context sha512;
7634#endif
7635
7636 mbedtls_ssl_session *session = ssl->session_negotiate;
Gilles Peskine449bd832023-01-11 14:50:10 +01007637 if (!session) {
Jerry Yub7ba49e2022-02-17 14:25:53 +08007638 session = ssl->session;
Gilles Peskine449bd832023-01-11 14:50:10 +01007639 }
Jerry Yub7ba49e2022-02-17 14:25:53 +08007640
Gilles Peskine449bd832023-01-11 14:50:10 +01007641 sender = (from == MBEDTLS_SSL_IS_CLIENT)
Jerry Yub7ba49e2022-02-17 14:25:53 +08007642 ? "client finished"
7643 : "server finished";
7644
7645#if defined(MBEDTLS_USE_PSA_CRYPTO)
7646 sha384_psa = psa_hash_operation_init();
7647
Gilles Peskine449bd832023-01-11 14:50:10 +01007648 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc PSA finished tls sha384"));
Jerry Yub7ba49e2022-02-17 14:25:53 +08007649
Gilles Peskine449bd832023-01-11 14:50:10 +01007650 status = psa_hash_clone(&ssl->handshake->fin_sha384_psa, &sha384_psa);
7651 if (status != PSA_SUCCESS) {
7652 MBEDTLS_SSL_DEBUG_MSG(2, ("PSA hash clone failed"));
Jerry Yub7ba49e2022-02-17 14:25:53 +08007653 return;
7654 }
7655
Gilles Peskine449bd832023-01-11 14:50:10 +01007656 status = psa_hash_finish(&sha384_psa, padbuf, sizeof(padbuf), &hash_size);
7657 if (status != PSA_SUCCESS) {
7658 MBEDTLS_SSL_DEBUG_MSG(2, ("PSA hash finish failed"));
Jerry Yub7ba49e2022-02-17 14:25:53 +08007659 return;
7660 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007661 MBEDTLS_SSL_DEBUG_BUF(3, "PSA calculated padbuf", padbuf, 48);
Jerry Yub7ba49e2022-02-17 14:25:53 +08007662#else
Gilles Peskine449bd832023-01-11 14:50:10 +01007663 mbedtls_sha512_init(&sha512);
Jerry Yub7ba49e2022-02-17 14:25:53 +08007664
Gilles Peskine449bd832023-01-11 14:50:10 +01007665 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc finished tls sha384"));
Jerry Yub7ba49e2022-02-17 14:25:53 +08007666
Gilles Peskine449bd832023-01-11 14:50:10 +01007667 mbedtls_sha512_clone(&sha512, &ssl->handshake->fin_sha384);
Jerry Yub7ba49e2022-02-17 14:25:53 +08007668
7669 /*
7670 * TLSv1.2:
7671 * hash = PRF( master, finished_label,
7672 * Hash( handshake ) )[0.11]
7673 */
7674
7675#if !defined(MBEDTLS_SHA512_ALT)
Gilles Peskine449bd832023-01-11 14:50:10 +01007676 MBEDTLS_SSL_DEBUG_BUF(4, "finished sha512 state", (unsigned char *)
7677 sha512.state, sizeof(sha512.state));
Jerry Yub7ba49e2022-02-17 14:25:53 +08007678#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007679 mbedtls_sha512_finish(&sha512, padbuf);
Jerry Yub7ba49e2022-02-17 14:25:53 +08007680
Gilles Peskine449bd832023-01-11 14:50:10 +01007681 mbedtls_sha512_free(&sha512);
Jerry Yub7ba49e2022-02-17 14:25:53 +08007682#endif
7683
Gilles Peskine449bd832023-01-11 14:50:10 +01007684 ssl->handshake->tls_prf(session->master, 48, sender,
7685 padbuf, 48, buf, len);
Jerry Yub7ba49e2022-02-17 14:25:53 +08007686
Gilles Peskine449bd832023-01-11 14:50:10 +01007687 MBEDTLS_SSL_DEBUG_BUF(3, "calc finished result", buf, len);
Jerry Yub7ba49e2022-02-17 14:25:53 +08007688
Gilles Peskine449bd832023-01-11 14:50:10 +01007689 mbedtls_platform_zeroize(padbuf, sizeof(padbuf));
Jerry Yub7ba49e2022-02-17 14:25:53 +08007690
Gilles Peskine449bd832023-01-11 14:50:10 +01007691 MBEDTLS_SSL_DEBUG_MSG(2, ("<= calc finished"));
Jerry Yub7ba49e2022-02-17 14:25:53 +08007692}
Andrzej Kurekcccb0442022-08-19 03:42:11 -04007693#endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
Jerry Yub7ba49e2022-02-17 14:25:53 +08007694
Gilles Peskine449bd832023-01-11 14:50:10 +01007695void mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context *ssl)
Jerry Yuaef00152022-02-17 14:27:31 +08007696{
Gilles Peskine449bd832023-01-11 14:50:10 +01007697 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup: final free"));
Jerry Yuaef00152022-02-17 14:27:31 +08007698
7699 /*
7700 * Free our handshake params
7701 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007702 mbedtls_ssl_handshake_free(ssl);
7703 mbedtls_free(ssl->handshake);
Jerry Yuaef00152022-02-17 14:27:31 +08007704 ssl->handshake = NULL;
7705
7706 /*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08007707 * Free the previous transform and switch in the current one
Jerry Yuaef00152022-02-17 14:27:31 +08007708 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007709 if (ssl->transform) {
7710 mbedtls_ssl_transform_free(ssl->transform);
7711 mbedtls_free(ssl->transform);
Jerry Yuaef00152022-02-17 14:27:31 +08007712 }
7713 ssl->transform = ssl->transform_negotiate;
7714 ssl->transform_negotiate = NULL;
7715
Gilles Peskine449bd832023-01-11 14:50:10 +01007716 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup: final free"));
Jerry Yuaef00152022-02-17 14:27:31 +08007717}
7718
Gilles Peskine449bd832023-01-11 14:50:10 +01007719void mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context *ssl)
Jerry Yu2a9fff52022-02-17 14:28:51 +08007720{
7721 int resume = ssl->handshake->resume;
7722
Gilles Peskine449bd832023-01-11 14:50:10 +01007723 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup"));
Jerry Yu2a9fff52022-02-17 14:28:51 +08007724
7725#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01007726 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08007727 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
7728 ssl->renego_records_seen = 0;
7729 }
7730#endif
7731
7732 /*
7733 * Free the previous session and switch in the current one
7734 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007735 if (ssl->session) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08007736#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7737 /* RFC 7366 3.1: keep the EtM state */
7738 ssl->session_negotiate->encrypt_then_mac =
Gilles Peskine449bd832023-01-11 14:50:10 +01007739 ssl->session->encrypt_then_mac;
Jerry Yu2a9fff52022-02-17 14:28:51 +08007740#endif
7741
Gilles Peskine449bd832023-01-11 14:50:10 +01007742 mbedtls_ssl_session_free(ssl->session);
7743 mbedtls_free(ssl->session);
Jerry Yu2a9fff52022-02-17 14:28:51 +08007744 }
7745 ssl->session = ssl->session_negotiate;
7746 ssl->session_negotiate = NULL;
7747
7748 /*
7749 * Add cache entry
7750 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007751 if (ssl->conf->f_set_cache != NULL &&
Jerry Yu2a9fff52022-02-17 14:28:51 +08007752 ssl->session->id_len != 0 &&
Gilles Peskine449bd832023-01-11 14:50:10 +01007753 resume == 0) {
7754 if (ssl->conf->f_set_cache(ssl->conf->p_cache,
7755 ssl->session->id,
7756 ssl->session->id_len,
7757 ssl->session) != 0) {
7758 MBEDTLS_SSL_DEBUG_MSG(1, ("cache did not store session"));
7759 }
Jerry Yu2a9fff52022-02-17 14:28:51 +08007760 }
7761
7762#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007763 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7764 ssl->handshake->flight != NULL) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08007765 /* Cancel handshake timer */
Gilles Peskine449bd832023-01-11 14:50:10 +01007766 mbedtls_ssl_set_timer(ssl, 0);
Jerry Yu2a9fff52022-02-17 14:28:51 +08007767
7768 /* Keep last flight around in case we need to resend it:
7769 * we need the handshake and transform structures for that */
Gilles Peskine449bd832023-01-11 14:50:10 +01007770 MBEDTLS_SSL_DEBUG_MSG(3, ("skip freeing handshake and transform"));
7771 } else
Jerry Yu2a9fff52022-02-17 14:28:51 +08007772#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007773 mbedtls_ssl_handshake_wrapup_free_hs_transform(ssl);
Jerry Yu2a9fff52022-02-17 14:28:51 +08007774
Jerry Yu5ed73ff2022-10-27 13:08:42 +08007775 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Jerry Yu2a9fff52022-02-17 14:28:51 +08007776
Gilles Peskine449bd832023-01-11 14:50:10 +01007777 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup"));
Jerry Yu2a9fff52022-02-17 14:28:51 +08007778}
7779
Gilles Peskine449bd832023-01-11 14:50:10 +01007780int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl)
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007781{
7782 int ret, hash_len;
7783
Gilles Peskine449bd832023-01-11 14:50:10 +01007784 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007785
Gilles Peskine449bd832023-01-11 14:50:10 +01007786 mbedtls_ssl_update_out_pointers(ssl, ssl->transform_negotiate);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007787
Gilles Peskine449bd832023-01-11 14:50:10 +01007788 ssl->handshake->calc_finished(ssl, ssl->out_msg + 4, ssl->conf->endpoint);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007789
7790 /*
7791 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
7792 * may define some other value. Currently (early 2016), no defined
7793 * ciphersuite does this (and this is unlikely to change as activity has
7794 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
7795 */
7796 hash_len = 12;
7797
7798#if defined(MBEDTLS_SSL_RENEGOTIATION)
7799 ssl->verify_data_len = hash_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01007800 memcpy(ssl->own_verify_data, ssl->out_msg + 4, hash_len);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007801#endif
7802
7803 ssl->out_msglen = 4 + hash_len;
7804 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7805 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
7806
7807 /*
7808 * In case of session resuming, invert the client and server
7809 * ChangeCipherSpec messages order.
7810 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007811 if (ssl->handshake->resume != 0) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007812#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007813 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007814 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Gilles Peskine449bd832023-01-11 14:50:10 +01007815 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007816#endif
7817#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007818 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007819 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Gilles Peskine449bd832023-01-11 14:50:10 +01007820 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007821#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007822 } else {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007823 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007824 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007825
7826 /*
7827 * Switch to our negotiated transform and session parameters for outbound
7828 * data.
7829 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007830 MBEDTLS_SSL_DEBUG_MSG(3, ("switching to new transform spec for outbound data"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007831
7832#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007833 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007834 unsigned char i;
7835
7836 /* Remember current epoch settings for resending */
7837 ssl->handshake->alt_transform_out = ssl->transform_out;
Gilles Peskine449bd832023-01-11 14:50:10 +01007838 memcpy(ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
7839 sizeof(ssl->handshake->alt_out_ctr));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007840
7841 /* Set sequence_number to zero */
Gilles Peskine449bd832023-01-11 14:50:10 +01007842 memset(&ssl->cur_out_ctr[2], 0, sizeof(ssl->cur_out_ctr) - 2);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007843
7844
7845 /* Increment epoch */
Gilles Peskine449bd832023-01-11 14:50:10 +01007846 for (i = 2; i > 0; i--) {
7847 if (++ssl->cur_out_ctr[i - 1] != 0) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007848 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01007849 }
7850 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007851
7852 /* The loop goes to its end iff the counter is wrapping */
Gilles Peskine449bd832023-01-11 14:50:10 +01007853 if (i == 0) {
7854 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS epoch would wrap"));
7855 return MBEDTLS_ERR_SSL_COUNTER_WRAPPING;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007856 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007857 } else
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007858#endif /* MBEDTLS_SSL_PROTO_DTLS */
Gilles Peskine449bd832023-01-11 14:50:10 +01007859 memset(ssl->cur_out_ctr, 0, sizeof(ssl->cur_out_ctr));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007860
7861 ssl->transform_out = ssl->transform_negotiate;
7862 ssl->session_out = ssl->session_negotiate;
7863
7864#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007865 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
7866 mbedtls_ssl_send_flight_completed(ssl);
7867 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007868#endif
7869
Gilles Peskine449bd832023-01-11 14:50:10 +01007870 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
7871 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
7872 return ret;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007873 }
7874
7875#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007876 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7877 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
7878 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret);
7879 return ret;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007880 }
7881#endif
7882
Gilles Peskine449bd832023-01-11 14:50:10 +01007883 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write finished"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007884
Gilles Peskine449bd832023-01-11 14:50:10 +01007885 return 0;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007886}
7887
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007888#define SSL_MAX_HASH_LEN 12
7889
Gilles Peskine449bd832023-01-11 14:50:10 +01007890int mbedtls_ssl_parse_finished(mbedtls_ssl_context *ssl)
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007891{
7892 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7893 unsigned int hash_len = 12;
7894 unsigned char buf[SSL_MAX_HASH_LEN];
7895
Gilles Peskine449bd832023-01-11 14:50:10 +01007896 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished"));
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007897
Gilles Peskine449bd832023-01-11 14:50:10 +01007898 ssl->handshake->calc_finished(ssl, buf, ssl->conf->endpoint ^ 1);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007899
Gilles Peskine449bd832023-01-11 14:50:10 +01007900 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) {
7901 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007902 goto exit;
7903 }
7904
Gilles Peskine449bd832023-01-11 14:50:10 +01007905 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
7906 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
7907 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7908 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007909 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
7910 goto exit;
7911 }
7912
Gilles Peskine449bd832023-01-11 14:50:10 +01007913 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED) {
7914 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7915 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007916 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
7917 goto exit;
7918 }
7919
Gilles Peskine449bd832023-01-11 14:50:10 +01007920 if (ssl->in_hslen != mbedtls_ssl_hs_hdr_len(ssl) + hash_len) {
7921 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
7922 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7923 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007924 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
7925 goto exit;
7926 }
7927
Gilles Peskine449bd832023-01-11 14:50:10 +01007928 if (mbedtls_ct_memcmp(ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl),
7929 buf, hash_len) != 0) {
7930 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
7931 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7932 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007933 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
7934 goto exit;
7935 }
7936
7937#if defined(MBEDTLS_SSL_RENEGOTIATION)
7938 ssl->verify_data_len = hash_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01007939 memcpy(ssl->peer_verify_data, buf, hash_len);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007940#endif
7941
Gilles Peskine449bd832023-01-11 14:50:10 +01007942 if (ssl->handshake->resume != 0) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007943#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007944 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007945 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Gilles Peskine449bd832023-01-11 14:50:10 +01007946 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007947#endif
7948#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007949 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007950 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Gilles Peskine449bd832023-01-11 14:50:10 +01007951 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007952#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007953 } else {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007954 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007955 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007956
7957#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007958 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
7959 mbedtls_ssl_recv_flight_completed(ssl);
7960 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007961#endif
7962
Gilles Peskine449bd832023-01-11 14:50:10 +01007963 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse finished"));
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007964
7965exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007966 mbedtls_platform_zeroize(buf, hash_len);
7967 return ret;
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007968}
7969
Jerry Yu392112c2022-02-17 14:34:10 +08007970#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
7971/*
7972 * Helper to get TLS 1.2 PRF from ciphersuite
7973 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
7974 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007975static tls_prf_fn ssl_tls12prf_from_cs(int ciphersuite_id)
Jerry Yu392112c2022-02-17 14:34:10 +08007976{
Jerry Yu392112c2022-02-17 14:34:10 +08007977 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01007978 mbedtls_ssl_ciphersuite_from_id(ciphersuite_id);
Andrzej Kurek68327742022-10-03 06:18:18 -04007979#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01007980 if (ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
7981 return tls_prf_sha384;
7982 } else
Jerry Yu392112c2022-02-17 14:34:10 +08007983#endif
Andrzej Kurek894edde2022-09-29 06:31:14 -04007984#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
7985 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007986 if (ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA256) {
7987 return tls_prf_sha256;
7988 }
Andrzej Kurek894edde2022-09-29 06:31:14 -04007989 }
7990#endif
7991#if !defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
7992 !defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
7993 (void) ciphersuite_info;
7994#endif
Andrzej Kurekeabeb302022-10-17 07:52:51 -04007995
Gilles Peskine449bd832023-01-11 14:50:10 +01007996 return NULL;
Jerry Yu392112c2022-02-17 14:34:10 +08007997}
7998#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08007999
Gilles Peskine449bd832023-01-11 14:50:10 +01008000static mbedtls_tls_prf_types tls_prf_get_type(mbedtls_ssl_tls_prf_cb *tls_prf)
Jerry Yue93ffcd2022-02-17 14:37:06 +08008001{
8002 ((void) tls_prf);
Andrzej Kurek25f27152022-08-17 16:09:31 -04008003#if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01008004 if (tls_prf == tls_prf_sha384) {
8005 return MBEDTLS_SSL_TLS_PRF_SHA384;
8006 } else
Jerry Yue93ffcd2022-02-17 14:37:06 +08008007#endif
Andrzej Kurek25f27152022-08-17 16:09:31 -04008008#if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
Gilles Peskine449bd832023-01-11 14:50:10 +01008009 if (tls_prf == tls_prf_sha256) {
8010 return MBEDTLS_SSL_TLS_PRF_SHA256;
8011 } else
Jerry Yue93ffcd2022-02-17 14:37:06 +08008012#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008013 return MBEDTLS_SSL_TLS_PRF_NONE;
Jerry Yue93ffcd2022-02-17 14:37:06 +08008014}
8015
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008016/*
8017 * Populate a transform structure with session keys and all the other
8018 * necessary information.
8019 *
8020 * Parameters:
8021 * - [in/out]: transform: structure to populate
8022 * [in] must be just initialised with mbedtls_ssl_transform_init()
8023 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
8024 * - [in] ciphersuite
8025 * - [in] master
8026 * - [in] encrypt_then_mac
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008027 * - [in] tls_prf: pointer to PRF to use for key derivation
8028 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Glenn Strauss07c64162022-03-14 12:34:51 -04008029 * - [in] tls_version: TLS version
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008030 * - [in] endpoint: client or server
8031 * - [in] ssl: used for:
8032 * - ssl->conf->{f,p}_export_keys
8033 * [in] optionally used for:
8034 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
8035 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008036MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01008037static int ssl_tls12_populate_transform(mbedtls_ssl_transform *transform,
8038 int ciphersuite,
8039 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008040#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01008041 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008042#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01008043 ssl_tls_prf_t tls_prf,
8044 const unsigned char randbytes[64],
8045 mbedtls_ssl_protocol_version tls_version,
8046 unsigned endpoint,
8047 const mbedtls_ssl_context *ssl)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008048{
8049 int ret = 0;
8050 unsigned char keyblk[256];
8051 unsigned char *key1;
8052 unsigned char *key2;
8053 unsigned char *mac_enc;
8054 unsigned char *mac_dec;
8055 size_t mac_key_len = 0;
8056 size_t iv_copy_len;
8057 size_t keylen;
8058 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008059 mbedtls_ssl_mode_t ssl_mode;
Neil Armstronge4512952022-03-08 09:08:22 +01008060#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008061 const mbedtls_cipher_info_t *cipher_info;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008062 const mbedtls_md_info_t *md_info;
Neil Armstronge4512952022-03-08 09:08:22 +01008063#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008064
8065#if defined(MBEDTLS_USE_PSA_CRYPTO)
8066 psa_key_type_t key_type;
8067 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
8068 psa_algorithm_t alg;
Neil Armstronge4512952022-03-08 09:08:22 +01008069 psa_algorithm_t mac_alg = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008070 size_t key_bits;
8071 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
8072#endif
8073
8074#if !defined(MBEDTLS_DEBUG_C) && \
8075 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Gilles Peskine449bd832023-01-11 14:50:10 +01008076 if (ssl->f_export_keys == NULL) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008077 ssl = NULL; /* make sure we don't use it except for these cases */
8078 (void) ssl;
8079 }
8080#endif
8081
8082 /*
8083 * Some data just needs copying into the structure
8084 */
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008085#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008086 transform->encrypt_then_mac = encrypt_then_mac;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008087#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Glenn Strauss07c64162022-03-14 12:34:51 -04008088 transform->tls_version = tls_version;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008089
8090#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01008091 memcpy(transform->randbytes, randbytes, sizeof(transform->randbytes));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008092#endif
8093
8094#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01008095 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008096 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
8097 * generation separate. This should never happen. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008098 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008099 }
8100#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
8101
8102 /*
8103 * Get various info structures
8104 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008105 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(ciphersuite);
8106 if (ciphersuite_info == NULL) {
8107 MBEDTLS_SSL_DEBUG_MSG(1, ("ciphersuite info for %d not found",
8108 ciphersuite));
8109 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008110 }
8111
Neil Armstrongab555e02022-04-04 11:07:59 +02008112 ssl_mode = mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008113#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01008114 encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008115#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01008116 ciphersuite_info);
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008117
Gilles Peskine449bd832023-01-11 14:50:10 +01008118 if (ssl_mode == MBEDTLS_SSL_MODE_AEAD) {
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008119 transform->taglen =
8120 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Gilles Peskine449bd832023-01-11 14:50:10 +01008121 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008122
8123#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008124 if ((status = mbedtls_ssl_cipher_to_psa(ciphersuite_info->cipher,
8125 transform->taglen,
8126 &alg,
8127 &key_type,
8128 &key_bits)) != PSA_SUCCESS) {
8129 ret = psa_ssl_status_to_mbedtls(status);
8130 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_cipher_to_psa", ret);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008131 goto end;
8132 }
8133#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008134 cipher_info = mbedtls_cipher_info_from_type(ciphersuite_info->cipher);
8135 if (cipher_info == NULL) {
8136 MBEDTLS_SSL_DEBUG_MSG(1, ("cipher info for %u not found",
8137 ciphersuite_info->cipher));
8138 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008139 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008140#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008141
Neil Armstronge4512952022-03-08 09:08:22 +01008142#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008143 mac_alg = mbedtls_hash_info_psa_from_md(ciphersuite_info->mac);
8144 if (mac_alg == 0) {
8145 MBEDTLS_SSL_DEBUG_MSG(1, ("mbedtls_hash_info_psa_from_md for %u not found",
8146 (unsigned) ciphersuite_info->mac));
8147 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstronge4512952022-03-08 09:08:22 +01008148 }
8149#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008150 md_info = mbedtls_md_info_from_type(ciphersuite_info->mac);
8151 if (md_info == NULL) {
8152 MBEDTLS_SSL_DEBUG_MSG(1, ("mbedtls_md info for %u not found",
8153 (unsigned) ciphersuite_info->mac));
8154 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008155 }
Neil Armstronge4512952022-03-08 09:08:22 +01008156#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008157
8158#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
8159 /* Copy own and peer's CID if the use of the CID
8160 * extension has been negotiated. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008161 if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED) {
8162 MBEDTLS_SSL_DEBUG_MSG(3, ("Copy CIDs into SSL transform"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008163
8164 transform->in_cid_len = ssl->own_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008165 memcpy(transform->in_cid, ssl->own_cid, ssl->own_cid_len);
8166 MBEDTLS_SSL_DEBUG_BUF(3, "Incoming CID", transform->in_cid,
8167 transform->in_cid_len);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008168
8169 transform->out_cid_len = ssl->handshake->peer_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008170 memcpy(transform->out_cid, ssl->handshake->peer_cid,
8171 ssl->handshake->peer_cid_len);
8172 MBEDTLS_SSL_DEBUG_BUF(3, "Outgoing CID", transform->out_cid,
8173 transform->out_cid_len);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008174 }
8175#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
8176
8177 /*
8178 * Compute key block using the PRF
8179 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008180 ret = tls_prf(master, 48, "key expansion", randbytes, 64, keyblk, 256);
8181 if (ret != 0) {
8182 MBEDTLS_SSL_DEBUG_RET(1, "prf", ret);
8183 return ret;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008184 }
8185
Gilles Peskine449bd832023-01-11 14:50:10 +01008186 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite = %s",
8187 mbedtls_ssl_get_ciphersuite_name(ciphersuite)));
8188 MBEDTLS_SSL_DEBUG_BUF(3, "master secret", master, 48);
8189 MBEDTLS_SSL_DEBUG_BUF(4, "random bytes", randbytes, 64);
8190 MBEDTLS_SSL_DEBUG_BUF(4, "key block", keyblk, 256);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008191
8192 /*
8193 * Determine the appropriate key, IV and MAC length.
8194 */
8195
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008196#if defined(MBEDTLS_USE_PSA_CRYPTO)
8197 keylen = PSA_BITS_TO_BYTES(key_bits);
8198#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008199 keylen = mbedtls_cipher_info_get_key_bitlen(cipher_info) / 8;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008200#endif
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008201
8202#if defined(MBEDTLS_GCM_C) || \
8203 defined(MBEDTLS_CCM_C) || \
8204 defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008205 if (ssl_mode == MBEDTLS_SSL_MODE_AEAD) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008206 size_t explicit_ivlen;
8207
8208 transform->maclen = 0;
8209 mac_key_len = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008210
8211 /* All modes haves 96-bit IVs, but the length of the static parts vary
8212 * with mode and version:
8213 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
8214 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
8215 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
8216 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
8217 * sequence number).
8218 */
8219 transform->ivlen = 12;
David Horstmann3b2276a2022-10-06 14:49:08 +01008220
8221 int is_chachapoly = 0;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008222#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008223 is_chachapoly = (key_type == PSA_KEY_TYPE_CHACHA20);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008224#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008225 is_chachapoly = (mbedtls_cipher_info_get_mode(cipher_info)
8226 == MBEDTLS_MODE_CHACHAPOLY);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008227#endif /* MBEDTLS_USE_PSA_CRYPTO */
David Horstmann3b2276a2022-10-06 14:49:08 +01008228
Gilles Peskine449bd832023-01-11 14:50:10 +01008229 if (is_chachapoly) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008230 transform->fixed_ivlen = 12;
Gilles Peskine449bd832023-01-11 14:50:10 +01008231 } else {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008232 transform->fixed_ivlen = 4;
Gilles Peskine449bd832023-01-11 14:50:10 +01008233 }
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008234
8235 /* Minimum length of encrypted record */
8236 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
8237 transform->minlen = explicit_ivlen + transform->taglen;
Gilles Peskine449bd832023-01-11 14:50:10 +01008238 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008239#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
8240#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01008241 if (ssl_mode == MBEDTLS_SSL_MODE_STREAM ||
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008242 ssl_mode == MBEDTLS_SSL_MODE_CBC ||
Gilles Peskine449bd832023-01-11 14:50:10 +01008243 ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM) {
Neil Armstronge4512952022-03-08 09:08:22 +01008244#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008245 size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008246#else
8247 size_t block_size = cipher_info->block_size;
8248#endif /* MBEDTLS_USE_PSA_CRYPTO */
8249
8250#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01008251 /* Get MAC length */
8252 mac_key_len = PSA_HASH_LENGTH(mac_alg);
8253#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008254 /* Initialize HMAC contexts */
Gilles Peskine449bd832023-01-11 14:50:10 +01008255 if ((ret = mbedtls_md_setup(&transform->md_ctx_enc, md_info, 1)) != 0 ||
8256 (ret = mbedtls_md_setup(&transform->md_ctx_dec, md_info, 1)) != 0) {
8257 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008258 goto end;
8259 }
8260
8261 /* Get MAC length */
Gilles Peskine449bd832023-01-11 14:50:10 +01008262 mac_key_len = mbedtls_md_get_size(md_info);
Neil Armstronge4512952022-03-08 09:08:22 +01008263#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008264 transform->maclen = mac_key_len;
8265
8266 /* IV length */
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008267#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008268 transform->ivlen = PSA_CIPHER_IV_LENGTH(key_type, alg);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008269#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008270 transform->ivlen = cipher_info->iv_size;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008271#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008272
8273 /* Minimum length */
Gilles Peskine449bd832023-01-11 14:50:10 +01008274 if (ssl_mode == MBEDTLS_SSL_MODE_STREAM) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008275 transform->minlen = transform->maclen;
Gilles Peskine449bd832023-01-11 14:50:10 +01008276 } else {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008277 /*
8278 * GenericBlockCipher:
8279 * 1. if EtM is in use: one block plus MAC
8280 * otherwise: * first multiple of blocklen greater than maclen
8281 * 2. IV
8282 */
8283#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01008284 if (ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008285 transform->minlen = transform->maclen
Gilles Peskine449bd832023-01-11 14:50:10 +01008286 + block_size;
8287 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008288#endif
8289 {
8290 transform->minlen = transform->maclen
Gilles Peskine449bd832023-01-11 14:50:10 +01008291 + block_size
8292 - transform->maclen % block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008293 }
8294
Gilles Peskine449bd832023-01-11 14:50:10 +01008295 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008296 transform->minlen += transform->ivlen;
Gilles Peskine449bd832023-01-11 14:50:10 +01008297 } else {
8298 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008299 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8300 goto end;
8301 }
8302 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008303 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008304#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
8305 {
Gilles Peskine449bd832023-01-11 14:50:10 +01008306 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
8307 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008308 }
8309
Gilles Peskine449bd832023-01-11 14:50:10 +01008310 MBEDTLS_SSL_DEBUG_MSG(3, ("keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
8311 (unsigned) keylen,
8312 (unsigned) transform->minlen,
8313 (unsigned) transform->ivlen,
8314 (unsigned) transform->maclen));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008315
8316 /*
8317 * Finally setup the cipher contexts, IVs and MAC secrets.
8318 */
8319#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008320 if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008321 key1 = keyblk + mac_key_len * 2;
8322 key2 = keyblk + mac_key_len * 2 + keylen;
8323
8324 mac_enc = keyblk;
8325 mac_dec = keyblk + mac_key_len;
8326
Gilles Peskine449bd832023-01-11 14:50:10 +01008327 iv_copy_len = (transform->fixed_ivlen) ?
8328 transform->fixed_ivlen : transform->ivlen;
8329 memcpy(transform->iv_enc, key2 + keylen, iv_copy_len);
8330 memcpy(transform->iv_dec, key2 + keylen + iv_copy_len,
8331 iv_copy_len);
8332 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008333#endif /* MBEDTLS_SSL_CLI_C */
8334#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008335 if (endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008336 key1 = keyblk + mac_key_len * 2 + keylen;
8337 key2 = keyblk + mac_key_len * 2;
8338
8339 mac_enc = keyblk + mac_key_len;
8340 mac_dec = keyblk;
8341
Gilles Peskine449bd832023-01-11 14:50:10 +01008342 iv_copy_len = (transform->fixed_ivlen) ?
8343 transform->fixed_ivlen : transform->ivlen;
8344 memcpy(transform->iv_dec, key1 + keylen, iv_copy_len);
8345 memcpy(transform->iv_enc, key1 + keylen + iv_copy_len,
8346 iv_copy_len);
8347 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008348#endif /* MBEDTLS_SSL_SRV_C */
8349 {
Gilles Peskine449bd832023-01-11 14:50:10 +01008350 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008351 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8352 goto end;
8353 }
8354
Gilles Peskine449bd832023-01-11 14:50:10 +01008355 if (ssl != NULL && ssl->f_export_keys != NULL) {
8356 ssl->f_export_keys(ssl->p_export_keys,
8357 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
8358 master, 48,
8359 randbytes + 32,
8360 randbytes,
8361 tls_prf_get_type(tls_prf));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008362 }
8363
8364#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008365 transform->psa_alg = alg;
8366
Gilles Peskine449bd832023-01-11 14:50:10 +01008367 if (alg != MBEDTLS_SSL_NULL_CIPHER) {
8368 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
8369 psa_set_key_algorithm(&attributes, alg);
8370 psa_set_key_type(&attributes, key_type);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008371
Gilles Peskine449bd832023-01-11 14:50:10 +01008372 if ((status = psa_import_key(&attributes,
8373 key1,
8374 PSA_BITS_TO_BYTES(key_bits),
8375 &transform->psa_key_enc)) != PSA_SUCCESS) {
8376 MBEDTLS_SSL_DEBUG_RET(3, "psa_import_key", (int) status);
8377 ret = psa_ssl_status_to_mbedtls(status);
8378 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_key", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008379 goto end;
8380 }
8381
Gilles Peskine449bd832023-01-11 14:50:10 +01008382 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008383
Gilles Peskine449bd832023-01-11 14:50:10 +01008384 if ((status = psa_import_key(&attributes,
8385 key2,
8386 PSA_BITS_TO_BYTES(key_bits),
8387 &transform->psa_key_dec)) != PSA_SUCCESS) {
8388 ret = psa_ssl_status_to_mbedtls(status);
8389 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_key", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008390 goto end;
8391 }
8392 }
8393#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008394 if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_enc,
8395 cipher_info)) != 0) {
8396 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008397 goto end;
8398 }
8399
Gilles Peskine449bd832023-01-11 14:50:10 +01008400 if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_dec,
8401 cipher_info)) != 0) {
8402 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008403 goto end;
8404 }
8405
Gilles Peskine449bd832023-01-11 14:50:10 +01008406 if ((ret = mbedtls_cipher_setkey(&transform->cipher_ctx_enc, key1,
8407 (int) mbedtls_cipher_info_get_key_bitlen(cipher_info),
8408 MBEDTLS_ENCRYPT)) != 0) {
8409 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setkey", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008410 goto end;
8411 }
8412
Gilles Peskine449bd832023-01-11 14:50:10 +01008413 if ((ret = mbedtls_cipher_setkey(&transform->cipher_ctx_dec, key2,
8414 (int) mbedtls_cipher_info_get_key_bitlen(cipher_info),
8415 MBEDTLS_DECRYPT)) != 0) {
8416 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setkey", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008417 goto end;
8418 }
8419
8420#if defined(MBEDTLS_CIPHER_MODE_CBC)
Gilles Peskine449bd832023-01-11 14:50:10 +01008421 if (mbedtls_cipher_info_get_mode(cipher_info) == MBEDTLS_MODE_CBC) {
8422 if ((ret = mbedtls_cipher_set_padding_mode(&transform->cipher_ctx_enc,
8423 MBEDTLS_PADDING_NONE)) != 0) {
8424 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_set_padding_mode", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008425 goto end;
8426 }
8427
Gilles Peskine449bd832023-01-11 14:50:10 +01008428 if ((ret = mbedtls_cipher_set_padding_mode(&transform->cipher_ctx_dec,
8429 MBEDTLS_PADDING_NONE)) != 0) {
8430 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_set_padding_mode", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008431 goto end;
8432 }
8433 }
8434#endif /* MBEDTLS_CIPHER_MODE_CBC */
8435#endif /* MBEDTLS_USE_PSA_CRYPTO */
8436
Neil Armstrong29c0c042022-03-17 17:47:28 +01008437#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
8438 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
8439 For AEAD-based ciphersuites, there is nothing to do here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008440 if (mac_key_len != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01008441#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008442 transform->psa_mac_alg = PSA_ALG_HMAC(mac_alg);
Neil Armstrong29c0c042022-03-17 17:47:28 +01008443
Gilles Peskine449bd832023-01-11 14:50:10 +01008444 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
8445 psa_set_key_algorithm(&attributes, PSA_ALG_HMAC(mac_alg));
8446 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Neil Armstrong29c0c042022-03-17 17:47:28 +01008447
Gilles Peskine449bd832023-01-11 14:50:10 +01008448 if ((status = psa_import_key(&attributes,
8449 mac_enc, mac_key_len,
8450 &transform->psa_mac_enc)) != PSA_SUCCESS) {
8451 ret = psa_ssl_status_to_mbedtls(status);
8452 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_mac_key", ret);
Neil Armstrong29c0c042022-03-17 17:47:28 +01008453 goto end;
8454 }
8455
Gilles Peskine449bd832023-01-11 14:50:10 +01008456 if ((transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER) ||
8457 ((transform->psa_alg == PSA_ALG_CBC_NO_PADDING)
Andrzej Kurek8c95ac42022-08-17 16:17:00 -04008458#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01008459 && (transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED)
Andrzej Kurek8c95ac42022-08-17 16:17:00 -04008460#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008461 )) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01008462 /* mbedtls_ct_hmac() requires the key to be exportable */
Gilles Peskine449bd832023-01-11 14:50:10 +01008463 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT |
8464 PSA_KEY_USAGE_VERIFY_HASH);
8465 } else {
8466 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_VERIFY_HASH);
8467 }
Neil Armstrong29c0c042022-03-17 17:47:28 +01008468
Gilles Peskine449bd832023-01-11 14:50:10 +01008469 if ((status = psa_import_key(&attributes,
8470 mac_dec, mac_key_len,
8471 &transform->psa_mac_dec)) != PSA_SUCCESS) {
8472 ret = psa_ssl_status_to_mbedtls(status);
8473 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_mac_key", ret);
Neil Armstrong29c0c042022-03-17 17:47:28 +01008474 goto end;
8475 }
8476#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008477 ret = mbedtls_md_hmac_starts(&transform->md_ctx_enc, mac_enc, mac_key_len);
8478 if (ret != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01008479 goto end;
Gilles Peskine449bd832023-01-11 14:50:10 +01008480 }
8481 ret = mbedtls_md_hmac_starts(&transform->md_ctx_dec, mac_dec, mac_key_len);
8482 if (ret != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01008483 goto end;
Gilles Peskine449bd832023-01-11 14:50:10 +01008484 }
Neil Armstrong29c0c042022-03-17 17:47:28 +01008485#endif /* MBEDTLS_USE_PSA_CRYPTO */
8486 }
8487#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
8488
8489 ((void) mac_dec);
8490 ((void) mac_enc);
8491
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008492end:
Gilles Peskine449bd832023-01-11 14:50:10 +01008493 mbedtls_platform_zeroize(keyblk, sizeof(keyblk));
8494 return ret;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008495}
8496
Valerio Settia08b1a42022-11-17 15:10:02 +01008497#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
8498 defined(MBEDTLS_USE_PSA_CRYPTO)
Valerio Setti6b3dab02022-11-17 17:14:54 +01008499int mbedtls_psa_ecjpake_read_round(
Gilles Peskine449bd832023-01-11 14:50:10 +01008500 psa_pake_operation_t *pake_ctx,
8501 const unsigned char *buf,
8502 size_t len, mbedtls_ecjpake_rounds_t round)
Valerio Settia08b1a42022-11-17 15:10:02 +01008503{
8504 psa_status_t status;
8505 size_t input_offset = 0;
Valerio Setti819de862022-11-17 18:05:19 +01008506 /*
Valerio Setti6b3dab02022-11-17 17:14:54 +01008507 * At round one repeat the KEY_SHARE, ZK_PUBLIC & ZF_PROOF twice
8508 * At round two perform a single cycle
8509 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008510 unsigned int remaining_steps = (round == MBEDTLS_ECJPAKE_ROUND_ONE) ? 2 : 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008511
Gilles Peskine449bd832023-01-11 14:50:10 +01008512 for (; remaining_steps > 0; remaining_steps--) {
8513 for (psa_pake_step_t step = PSA_PAKE_STEP_KEY_SHARE;
Valerio Settia08b1a42022-11-17 15:10:02 +01008514 step <= PSA_PAKE_STEP_ZK_PROOF;
Gilles Peskine449bd832023-01-11 14:50:10 +01008515 ++step) {
Valerio Settia08b1a42022-11-17 15:10:02 +01008516 /* Length is stored at the first byte */
8517 size_t length = buf[input_offset];
8518 input_offset += 1;
8519
Gilles Peskine449bd832023-01-11 14:50:10 +01008520 if (input_offset + length > len) {
Valerio Settia08b1a42022-11-17 15:10:02 +01008521 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
8522 }
8523
Gilles Peskine449bd832023-01-11 14:50:10 +01008524 status = psa_pake_input(pake_ctx, step,
8525 buf + input_offset, length);
8526 if (status != PSA_SUCCESS) {
8527 return psa_ssl_status_to_mbedtls(status);
Valerio Settia08b1a42022-11-17 15:10:02 +01008528 }
8529
8530 input_offset += length;
8531 }
8532 }
8533
Gilles Peskine449bd832023-01-11 14:50:10 +01008534 if (input_offset != len) {
Valerio Setti61ea17d2022-11-18 12:11:00 +01008535 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01008536 }
Valerio Setti30ebe112022-11-17 16:23:34 +01008537
Gilles Peskine449bd832023-01-11 14:50:10 +01008538 return 0;
Valerio Settia08b1a42022-11-17 15:10:02 +01008539}
8540
Valerio Setti6b3dab02022-11-17 17:14:54 +01008541int mbedtls_psa_ecjpake_write_round(
Gilles Peskine449bd832023-01-11 14:50:10 +01008542 psa_pake_operation_t *pake_ctx,
8543 unsigned char *buf,
8544 size_t len, size_t *olen,
8545 mbedtls_ecjpake_rounds_t round)
Valerio Settia08b1a42022-11-17 15:10:02 +01008546{
8547 psa_status_t status;
8548 size_t output_offset = 0;
8549 size_t output_len;
Valerio Setti819de862022-11-17 18:05:19 +01008550 /*
Valerio Setti6b3dab02022-11-17 17:14:54 +01008551 * At round one repeat the KEY_SHARE, ZK_PUBLIC & ZF_PROOF twice
8552 * At round two perform a single cycle
8553 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008554 unsigned int remaining_steps = (round == MBEDTLS_ECJPAKE_ROUND_ONE) ? 2 : 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008555
Gilles Peskine449bd832023-01-11 14:50:10 +01008556 for (; remaining_steps > 0; remaining_steps--) {
8557 for (psa_pake_step_t step = PSA_PAKE_STEP_KEY_SHARE;
8558 step <= PSA_PAKE_STEP_ZK_PROOF;
8559 ++step) {
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008560 /*
Valerio Settid4a9b1a2022-11-22 11:11:10 +01008561 * For each step, prepend 1 byte with the length of the data as
8562 * given by psa_pake_output().
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008563 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008564 status = psa_pake_output(pake_ctx, step,
8565 buf + output_offset + 1,
8566 len - output_offset - 1,
8567 &output_len);
8568 if (status != PSA_SUCCESS) {
8569 return psa_ssl_status_to_mbedtls(status);
Valerio Settia08b1a42022-11-17 15:10:02 +01008570 }
8571
Valerio Setti99d88c12022-11-22 16:03:43 +01008572 *(buf + output_offset) = (uint8_t) output_len;
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008573
8574 output_offset += output_len + 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008575 }
8576 }
8577
8578 *olen = output_offset;
8579
Gilles Peskine449bd832023-01-11 14:50:10 +01008580 return 0;
Valerio Settia08b1a42022-11-17 15:10:02 +01008581}
Valerio Settia08b1a42022-11-17 15:10:02 +01008582#endif //MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED && MBEDTLS_USE_PSA_CRYPTO
8583
Jerry Yuee40f9d2022-02-17 14:55:16 +08008584#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008585int mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context *ssl,
8586 unsigned char *hash, size_t *hashlen,
8587 unsigned char *data, size_t data_len,
8588 mbedtls_md_type_t md_alg)
Jerry Yuee40f9d2022-02-17 14:55:16 +08008589{
8590 psa_status_t status;
8591 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01008592 psa_algorithm_t hash_alg = mbedtls_hash_info_psa_from_md(md_alg);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008593
Gilles Peskine449bd832023-01-11 14:50:10 +01008594 MBEDTLS_SSL_DEBUG_MSG(3, ("Perform PSA-based computation of digest of ServerKeyExchange"));
Jerry Yuee40f9d2022-02-17 14:55:16 +08008595
Gilles Peskine449bd832023-01-11 14:50:10 +01008596 if ((status = psa_hash_setup(&hash_operation,
8597 hash_alg)) != PSA_SUCCESS) {
8598 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_setup", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008599 goto exit;
8600 }
8601
Gilles Peskine449bd832023-01-11 14:50:10 +01008602 if ((status = psa_hash_update(&hash_operation, ssl->handshake->randbytes,
8603 64)) != PSA_SUCCESS) {
8604 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_update", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008605 goto exit;
8606 }
8607
Gilles Peskine449bd832023-01-11 14:50:10 +01008608 if ((status = psa_hash_update(&hash_operation,
8609 data, data_len)) != PSA_SUCCESS) {
8610 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_update", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008611 goto exit;
8612 }
8613
Gilles Peskine449bd832023-01-11 14:50:10 +01008614 if ((status = psa_hash_finish(&hash_operation, hash, PSA_HASH_MAX_SIZE,
8615 hashlen)) != PSA_SUCCESS) {
8616 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_finish", status);
8617 goto exit;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008618 }
8619
8620exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01008621 if (status != PSA_SUCCESS) {
8622 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8623 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
8624 switch (status) {
Jerry Yuee40f9d2022-02-17 14:55:16 +08008625 case PSA_ERROR_NOT_SUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +01008626 return MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008627 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
8628 case PSA_ERROR_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +01008629 return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008630 case PSA_ERROR_INSUFFICIENT_MEMORY:
Gilles Peskine449bd832023-01-11 14:50:10 +01008631 return MBEDTLS_ERR_MD_ALLOC_FAILED;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008632 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01008633 return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008634 }
8635 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008636 return 0;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008637}
8638
8639#else
8640
Gilles Peskine449bd832023-01-11 14:50:10 +01008641int mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context *ssl,
8642 unsigned char *hash, size_t *hashlen,
8643 unsigned char *data, size_t data_len,
8644 mbedtls_md_type_t md_alg)
Jerry Yuee40f9d2022-02-17 14:55:16 +08008645{
8646 int ret = 0;
8647 mbedtls_md_context_t ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01008648 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_alg);
8649 *hashlen = mbedtls_md_get_size(md_info);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008650
Gilles Peskine449bd832023-01-11 14:50:10 +01008651 MBEDTLS_SSL_DEBUG_MSG(3, ("Perform mbedtls-based computation of digest of ServerKeyExchange"));
Jerry Yuee40f9d2022-02-17 14:55:16 +08008652
Gilles Peskine449bd832023-01-11 14:50:10 +01008653 mbedtls_md_init(&ctx);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008654
8655 /*
8656 * digitally-signed struct {
8657 * opaque client_random[32];
8658 * opaque server_random[32];
8659 * ServerDHParams params;
8660 * };
8661 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008662 if ((ret = mbedtls_md_setup(&ctx, md_info, 0)) != 0) {
8663 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_setup", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008664 goto exit;
8665 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008666 if ((ret = mbedtls_md_starts(&ctx)) != 0) {
8667 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_starts", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008668 goto exit;
8669 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008670 if ((ret = mbedtls_md_update(&ctx, ssl->handshake->randbytes, 64)) != 0) {
8671 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_update", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008672 goto exit;
8673 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008674 if ((ret = mbedtls_md_update(&ctx, data, data_len)) != 0) {
8675 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_update", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008676 goto exit;
8677 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008678 if ((ret = mbedtls_md_finish(&ctx, hash)) != 0) {
8679 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_finish", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008680 goto exit;
8681 }
8682
8683exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01008684 mbedtls_md_free(&ctx);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008685
Gilles Peskine449bd832023-01-11 14:50:10 +01008686 if (ret != 0) {
8687 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8688 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
8689 }
Jerry Yuee40f9d2022-02-17 14:55:16 +08008690
Gilles Peskine449bd832023-01-11 14:50:10 +01008691 return ret;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008692}
8693#endif /* MBEDTLS_USE_PSA_CRYPTO */
8694
Jerry Yud9d91da2022-02-17 14:57:06 +08008695#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
8696
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008697/* Find the preferred hash for a given signature algorithm. */
8698unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01008699 mbedtls_ssl_context *ssl,
8700 unsigned int sig_alg)
Jerry Yud9d91da2022-02-17 14:57:06 +08008701{
Gabor Mezei078e8032022-04-27 21:17:56 +02008702 unsigned int i;
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008703 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
Gabor Mezei078e8032022-04-27 21:17:56 +02008704
Gilles Peskine449bd832023-01-11 14:50:10 +01008705 if (sig_alg == MBEDTLS_SSL_SIG_ANON) {
8706 return MBEDTLS_SSL_HASH_NONE;
8707 }
Gabor Mezei078e8032022-04-27 21:17:56 +02008708
Gilles Peskine449bd832023-01-11 14:50:10 +01008709 for (i = 0; received_sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008710 unsigned int hash_alg_received =
Gilles Peskine449bd832023-01-11 14:50:10 +01008711 MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(
8712 received_sig_algs[i]);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008713 unsigned int sig_alg_received =
Gilles Peskine449bd832023-01-11 14:50:10 +01008714 MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(
8715 received_sig_algs[i]);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008716
Gilles Peskine449bd832023-01-11 14:50:10 +01008717 if (sig_alg == sig_alg_received) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008718#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008719 if (ssl->handshake->key_cert && ssl->handshake->key_cert->key) {
Neil Armstrong96eceb82022-06-30 18:05:05 +02008720 psa_algorithm_t psa_hash_alg =
Gilles Peskine449bd832023-01-11 14:50:10 +01008721 mbedtls_hash_info_psa_from_md(hash_alg_received);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008722
Gilles Peskine449bd832023-01-11 14:50:10 +01008723 if (sig_alg_received == MBEDTLS_SSL_SIG_ECDSA &&
8724 !mbedtls_pk_can_do_ext(ssl->handshake->key_cert->key,
8725 PSA_ALG_ECDSA(psa_hash_alg),
8726 PSA_KEY_USAGE_SIGN_HASH)) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008727 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01008728 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008729
Gilles Peskine449bd832023-01-11 14:50:10 +01008730 if (sig_alg_received == MBEDTLS_SSL_SIG_RSA &&
8731 !mbedtls_pk_can_do_ext(ssl->handshake->key_cert->key,
8732 PSA_ALG_RSA_PKCS1V15_SIGN(
8733 psa_hash_alg),
8734 PSA_KEY_USAGE_SIGN_HASH)) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008735 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01008736 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008737 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008738#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong96eceb82022-06-30 18:05:05 +02008739
Gilles Peskine449bd832023-01-11 14:50:10 +01008740 return hash_alg_received;
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008741 }
Jerry Yud9d91da2022-02-17 14:57:06 +08008742 }
Jerry Yud9d91da2022-02-17 14:57:06 +08008743
Gilles Peskine449bd832023-01-11 14:50:10 +01008744 return MBEDTLS_SSL_HASH_NONE;
Jerry Yud9d91da2022-02-17 14:57:06 +08008745}
8746
8747#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
8748
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008749/* Serialization of TLS 1.2 sessions:
8750 *
8751 * struct {
8752 * uint64 start_time;
8753 * uint8 ciphersuite[2]; // defined by the standard
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008754 * uint8 session_id_len; // at most 32
8755 * opaque session_id[32];
8756 * opaque master[48]; // fixed length in the standard
8757 * uint32 verify_result;
8758 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
8759 * opaque ticket<0..2^24-1>; // length 0 means no ticket
8760 * uint32 ticket_lifetime;
8761 * uint8 mfl_code; // up to 255 according to standard
8762 * uint8 encrypt_then_mac; // 0 or 1
8763 * } serialized_session_tls12;
8764 *
8765 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008766static size_t ssl_tls12_session_save(const mbedtls_ssl_session *session,
8767 unsigned char *buf,
8768 size_t buf_len)
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008769{
8770 unsigned char *p = buf;
8771 size_t used = 0;
8772
8773#if defined(MBEDTLS_HAVE_TIME)
8774 uint64_t start;
8775#endif
8776#if defined(MBEDTLS_X509_CRT_PARSE_C)
8777#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8778 size_t cert_len;
8779#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8780#endif /* MBEDTLS_X509_CRT_PARSE_C */
8781
8782 /*
8783 * Time
8784 */
8785#if defined(MBEDTLS_HAVE_TIME)
8786 used += 8;
8787
Gilles Peskine449bd832023-01-11 14:50:10 +01008788 if (used <= buf_len) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008789 start = (uint64_t) session->start;
8790
Gilles Peskine449bd832023-01-11 14:50:10 +01008791 MBEDTLS_PUT_UINT64_BE(start, p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008792 p += 8;
8793 }
8794#endif /* MBEDTLS_HAVE_TIME */
8795
8796 /*
8797 * Basic mandatory fields
8798 */
8799 used += 2 /* ciphersuite */
Gilles Peskine449bd832023-01-11 14:50:10 +01008800 + 1 /* id_len */
8801 + sizeof(session->id)
8802 + sizeof(session->master)
8803 + 4; /* verify_result */
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008804
Gilles Peskine449bd832023-01-11 14:50:10 +01008805 if (used <= buf_len) {
8806 MBEDTLS_PUT_UINT16_BE(session->ciphersuite, p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008807 p += 2;
8808
Gilles Peskine449bd832023-01-11 14:50:10 +01008809 *p++ = MBEDTLS_BYTE_0(session->id_len);
8810 memcpy(p, session->id, 32);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008811 p += 32;
8812
Gilles Peskine449bd832023-01-11 14:50:10 +01008813 memcpy(p, session->master, 48);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008814 p += 48;
8815
Gilles Peskine449bd832023-01-11 14:50:10 +01008816 MBEDTLS_PUT_UINT32_BE(session->verify_result, p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008817 p += 4;
8818 }
8819
8820 /*
8821 * Peer's end-entity certificate
8822 */
8823#if defined(MBEDTLS_X509_CRT_PARSE_C)
8824#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01008825 if (session->peer_cert == NULL) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008826 cert_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01008827 } else {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008828 cert_len = session->peer_cert->raw.len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008829 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008830
8831 used += 3 + cert_len;
8832
Gilles Peskine449bd832023-01-11 14:50:10 +01008833 if (used <= buf_len) {
8834 *p++ = MBEDTLS_BYTE_2(cert_len);
8835 *p++ = MBEDTLS_BYTE_1(cert_len);
8836 *p++ = MBEDTLS_BYTE_0(cert_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008837
Gilles Peskine449bd832023-01-11 14:50:10 +01008838 if (session->peer_cert != NULL) {
8839 memcpy(p, session->peer_cert->raw.p, cert_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008840 p += cert_len;
8841 }
8842 }
8843#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +01008844 if (session->peer_cert_digest != NULL) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008845 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008846 if (used <= buf_len) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008847 *p++ = (unsigned char) session->peer_cert_digest_type;
8848 *p++ = (unsigned char) session->peer_cert_digest_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008849 memcpy(p, session->peer_cert_digest,
8850 session->peer_cert_digest_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008851 p += session->peer_cert_digest_len;
8852 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008853 } else {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008854 used += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01008855 if (used <= buf_len) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008856 *p++ = (unsigned char) MBEDTLS_MD_NONE;
8857 *p++ = 0;
8858 }
8859 }
8860#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8861#endif /* MBEDTLS_X509_CRT_PARSE_C */
8862
8863 /*
8864 * Session ticket if any, plus associated data
8865 */
8866#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8867 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
8868
Gilles Peskine449bd832023-01-11 14:50:10 +01008869 if (used <= buf_len) {
8870 *p++ = MBEDTLS_BYTE_2(session->ticket_len);
8871 *p++ = MBEDTLS_BYTE_1(session->ticket_len);
8872 *p++ = MBEDTLS_BYTE_0(session->ticket_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008873
Gilles Peskine449bd832023-01-11 14:50:10 +01008874 if (session->ticket != NULL) {
8875 memcpy(p, session->ticket, session->ticket_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008876 p += session->ticket_len;
8877 }
8878
Gilles Peskine449bd832023-01-11 14:50:10 +01008879 MBEDTLS_PUT_UINT32_BE(session->ticket_lifetime, p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008880 p += 4;
8881 }
8882#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8883
8884 /*
8885 * Misc extension-related info
8886 */
8887#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8888 used += 1;
8889
Gilles Peskine449bd832023-01-11 14:50:10 +01008890 if (used <= buf_len) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008891 *p++ = session->mfl_code;
Gilles Peskine449bd832023-01-11 14:50:10 +01008892 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008893#endif
8894
8895#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
8896 used += 1;
8897
Gilles Peskine449bd832023-01-11 14:50:10 +01008898 if (used <= buf_len) {
8899 *p++ = MBEDTLS_BYTE_0(session->encrypt_then_mac);
8900 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008901#endif
8902
Gilles Peskine449bd832023-01-11 14:50:10 +01008903 return used;
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008904}
8905
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008906MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01008907static int ssl_tls12_session_load(mbedtls_ssl_session *session,
8908 const unsigned char *buf,
8909 size_t len)
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008910{
8911#if defined(MBEDTLS_HAVE_TIME)
8912 uint64_t start;
8913#endif
8914#if defined(MBEDTLS_X509_CRT_PARSE_C)
8915#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8916 size_t cert_len;
8917#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8918#endif /* MBEDTLS_X509_CRT_PARSE_C */
8919
8920 const unsigned char *p = buf;
8921 const unsigned char * const end = buf + len;
8922
8923 /*
8924 * Time
8925 */
8926#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01008927 if (8 > (size_t) (end - p)) {
8928 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
8929 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008930
Gilles Peskine449bd832023-01-11 14:50:10 +01008931 start = ((uint64_t) p[0] << 56) |
8932 ((uint64_t) p[1] << 48) |
8933 ((uint64_t) p[2] << 40) |
8934 ((uint64_t) p[3] << 32) |
8935 ((uint64_t) p[4] << 24) |
8936 ((uint64_t) p[5] << 16) |
8937 ((uint64_t) p[6] << 8) |
8938 ((uint64_t) p[7]);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008939 p += 8;
8940
8941 session->start = (time_t) start;
8942#endif /* MBEDTLS_HAVE_TIME */
8943
8944 /*
8945 * Basic mandatory fields
8946 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008947 if (2 + 1 + 32 + 48 + 4 > (size_t) (end - p)) {
8948 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
8949 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008950
Gilles Peskine449bd832023-01-11 14:50:10 +01008951 session->ciphersuite = (p[0] << 8) | p[1];
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008952 p += 2;
8953
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008954 session->id_len = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +01008955 memcpy(session->id, p, 32);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008956 p += 32;
8957
Gilles Peskine449bd832023-01-11 14:50:10 +01008958 memcpy(session->master, p, 48);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008959 p += 48;
8960
Gilles Peskine449bd832023-01-11 14:50:10 +01008961 session->verify_result = ((uint32_t) p[0] << 24) |
8962 ((uint32_t) p[1] << 16) |
8963 ((uint32_t) p[2] << 8) |
8964 ((uint32_t) p[3]);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008965 p += 4;
8966
8967 /* Immediately clear invalid pointer values that have been read, in case
8968 * we exit early before we replaced them with valid ones. */
8969#if defined(MBEDTLS_X509_CRT_PARSE_C)
8970#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8971 session->peer_cert = NULL;
8972#else
8973 session->peer_cert_digest = NULL;
8974#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8975#endif /* MBEDTLS_X509_CRT_PARSE_C */
8976#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8977 session->ticket = NULL;
8978#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8979
8980 /*
8981 * Peer certificate
8982 */
8983#if defined(MBEDTLS_X509_CRT_PARSE_C)
8984#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8985 /* Deserialize CRT from the end of the ticket. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008986 if (3 > (size_t) (end - p)) {
8987 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
8988 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008989
Gilles Peskine449bd832023-01-11 14:50:10 +01008990 cert_len = (p[0] << 16) | (p[1] << 8) | p[2];
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008991 p += 3;
8992
Gilles Peskine449bd832023-01-11 14:50:10 +01008993 if (cert_len != 0) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008994 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8995
Gilles Peskine449bd832023-01-11 14:50:10 +01008996 if (cert_len > (size_t) (end - p)) {
8997 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
8998 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008999
Gilles Peskine449bd832023-01-11 14:50:10 +01009000 session->peer_cert = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009001
Gilles Peskine449bd832023-01-11 14:50:10 +01009002 if (session->peer_cert == NULL) {
9003 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9004 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009005
Gilles Peskine449bd832023-01-11 14:50:10 +01009006 mbedtls_x509_crt_init(session->peer_cert);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009007
Gilles Peskine449bd832023-01-11 14:50:10 +01009008 if ((ret = mbedtls_x509_crt_parse_der(session->peer_cert,
9009 p, cert_len)) != 0) {
9010 mbedtls_x509_crt_free(session->peer_cert);
9011 mbedtls_free(session->peer_cert);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009012 session->peer_cert = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01009013 return ret;
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009014 }
9015
9016 p += cert_len;
9017 }
9018#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9019 /* Deserialize CRT digest from the end of the ticket. */
Gilles Peskine449bd832023-01-11 14:50:10 +01009020 if (2 > (size_t) (end - p)) {
9021 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9022 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009023
9024 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
9025 session->peer_cert_digest_len = (size_t) *p++;
9026
Gilles Peskine449bd832023-01-11 14:50:10 +01009027 if (session->peer_cert_digest_len != 0) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009028 const mbedtls_md_info_t *md_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01009029 mbedtls_md_info_from_type(session->peer_cert_digest_type);
9030 if (md_info == NULL) {
9031 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9032 }
9033 if (session->peer_cert_digest_len != mbedtls_md_get_size(md_info)) {
9034 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9035 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009036
Gilles Peskine449bd832023-01-11 14:50:10 +01009037 if (session->peer_cert_digest_len > (size_t) (end - p)) {
9038 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9039 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009040
9041 session->peer_cert_digest =
Gilles Peskine449bd832023-01-11 14:50:10 +01009042 mbedtls_calloc(1, session->peer_cert_digest_len);
9043 if (session->peer_cert_digest == NULL) {
9044 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9045 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009046
Gilles Peskine449bd832023-01-11 14:50:10 +01009047 memcpy(session->peer_cert_digest, p,
9048 session->peer_cert_digest_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009049 p += session->peer_cert_digest_len;
9050 }
9051#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9052#endif /* MBEDTLS_X509_CRT_PARSE_C */
9053
9054 /*
9055 * Session ticket and associated data
9056 */
9057#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01009058 if (3 > (size_t) (end - p)) {
9059 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9060 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009061
Gilles Peskine449bd832023-01-11 14:50:10 +01009062 session->ticket_len = (p[0] << 16) | (p[1] << 8) | p[2];
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009063 p += 3;
9064
Gilles Peskine449bd832023-01-11 14:50:10 +01009065 if (session->ticket_len != 0) {
9066 if (session->ticket_len > (size_t) (end - p)) {
9067 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9068 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009069
Gilles Peskine449bd832023-01-11 14:50:10 +01009070 session->ticket = mbedtls_calloc(1, session->ticket_len);
9071 if (session->ticket == NULL) {
9072 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9073 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009074
Gilles Peskine449bd832023-01-11 14:50:10 +01009075 memcpy(session->ticket, p, session->ticket_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009076 p += session->ticket_len;
9077 }
9078
Gilles Peskine449bd832023-01-11 14:50:10 +01009079 if (4 > (size_t) (end - p)) {
9080 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9081 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009082
Gilles Peskine449bd832023-01-11 14:50:10 +01009083 session->ticket_lifetime = ((uint32_t) p[0] << 24) |
9084 ((uint32_t) p[1] << 16) |
9085 ((uint32_t) p[2] << 8) |
9086 ((uint32_t) p[3]);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009087 p += 4;
9088#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
9089
9090 /*
9091 * Misc extension-related info
9092 */
9093#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01009094 if (1 > (size_t) (end - p)) {
9095 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9096 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009097
9098 session->mfl_code = *p++;
9099#endif
9100
9101#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01009102 if (1 > (size_t) (end - p)) {
9103 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9104 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009105
9106 session->encrypt_then_mac = *p++;
9107#endif
9108
9109 /* Done, should have consumed entire buffer */
Gilles Peskine449bd832023-01-11 14:50:10 +01009110 if (p != end) {
9111 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9112 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009113
Gilles Peskine449bd832023-01-11 14:50:10 +01009114 return 0;
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009115}
Jerry Yudc7bd172022-02-17 13:44:15 +08009116#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9117
XiaokangQian75d40ef2022-04-20 11:05:24 +00009118int mbedtls_ssl_validate_ciphersuite(
9119 const mbedtls_ssl_context *ssl,
9120 const mbedtls_ssl_ciphersuite_t *suite_info,
9121 mbedtls_ssl_protocol_version min_tls_version,
Gilles Peskine449bd832023-01-11 14:50:10 +01009122 mbedtls_ssl_protocol_version max_tls_version)
XiaokangQian75d40ef2022-04-20 11:05:24 +00009123{
9124 (void) ssl;
9125
Gilles Peskine449bd832023-01-11 14:50:10 +01009126 if (suite_info == NULL) {
9127 return -1;
9128 }
XiaokangQian75d40ef2022-04-20 11:05:24 +00009129
Gilles Peskine449bd832023-01-11 14:50:10 +01009130 if ((suite_info->min_tls_version > max_tls_version) ||
9131 (suite_info->max_tls_version < min_tls_version)) {
9132 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009133 }
9134
XiaokangQian060d8672022-04-21 09:24:56 +00009135#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_CLI_C)
XiaokangQian75d40ef2022-04-20 11:05:24 +00009136#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009137#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01009138 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
9139 ssl->handshake->psa_pake_ctx_is_ok != 1)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009140#else
Gilles Peskine449bd832023-01-11 14:50:10 +01009141 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
9142 mbedtls_ecjpake_check(&ssl->handshake->ecjpake_ctx) != 0)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009143#endif /* MBEDTLS_USE_PSA_CRYPTO */
XiaokangQian75d40ef2022-04-20 11:05:24 +00009144 {
Gilles Peskine449bd832023-01-11 14:50:10 +01009145 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009146 }
9147#endif
9148
9149 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
9150#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01009151 if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) &&
9152 mbedtls_ssl_conf_has_static_psk(ssl->conf) == 0) {
9153 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009154 }
9155#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
9156#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9157
Gilles Peskine449bd832023-01-11 14:50:10 +01009158 return 0;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009159}
9160
Ronald Crone68ab4f2022-10-05 12:46:29 +02009161#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
XiaokangQianeaf36512022-04-24 09:07:44 +00009162/*
9163 * Function for writing a signature algorithm extension.
9164 *
9165 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
9166 * value (TLS 1.3 RFC8446):
9167 * enum {
9168 * ....
9169 * ecdsa_secp256r1_sha256( 0x0403 ),
9170 * ecdsa_secp384r1_sha384( 0x0503 ),
9171 * ecdsa_secp521r1_sha512( 0x0603 ),
9172 * ....
9173 * } SignatureScheme;
9174 *
9175 * struct {
9176 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
9177 * } SignatureSchemeList;
9178 *
9179 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
9180 * value (TLS 1.2 RFC5246):
9181 * enum {
9182 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
9183 * sha512(6), (255)
9184 * } HashAlgorithm;
9185 *
9186 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
9187 * SignatureAlgorithm;
9188 *
9189 * struct {
9190 * HashAlgorithm hash;
9191 * SignatureAlgorithm signature;
9192 * } SignatureAndHashAlgorithm;
9193 *
9194 * SignatureAndHashAlgorithm
9195 * supported_signature_algorithms<2..2^16-2>;
9196 *
9197 * The TLS 1.3 signature algorithm extension was defined to be a compatible
9198 * generalization of the TLS 1.2 signature algorithm extension.
9199 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
9200 * `SignatureScheme` field of TLS 1.3
9201 *
9202 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009203int mbedtls_ssl_write_sig_alg_ext(mbedtls_ssl_context *ssl, unsigned char *buf,
9204 const unsigned char *end, size_t *out_len)
XiaokangQianeaf36512022-04-24 09:07:44 +00009205{
9206 unsigned char *p = buf;
9207 unsigned char *supported_sig_alg; /* Start of supported_signature_algorithms */
9208 size_t supported_sig_alg_len = 0; /* Length of supported_signature_algorithms */
9209
9210 *out_len = 0;
9211
Gilles Peskine449bd832023-01-11 14:50:10 +01009212 MBEDTLS_SSL_DEBUG_MSG(3, ("adding signature_algorithms extension"));
XiaokangQianeaf36512022-04-24 09:07:44 +00009213
9214 /* Check if we have space for header and length field:
9215 * - extension_type (2 bytes)
9216 * - extension_data_length (2 bytes)
9217 * - supported_signature_algorithms_length (2 bytes)
9218 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009219 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
XiaokangQianeaf36512022-04-24 09:07:44 +00009220 p += 6;
9221
9222 /*
9223 * Write supported_signature_algorithms
9224 */
9225 supported_sig_alg = p;
Gilles Peskine449bd832023-01-11 14:50:10 +01009226 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl);
9227 if (sig_alg == NULL) {
9228 return MBEDTLS_ERR_SSL_BAD_CONFIG;
9229 }
XiaokangQianeaf36512022-04-24 09:07:44 +00009230
Gilles Peskine449bd832023-01-11 14:50:10 +01009231 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
9232 MBEDTLS_SSL_DEBUG_MSG(3, ("got signature scheme [%x] %s",
9233 *sig_alg,
9234 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
9235 if (!mbedtls_ssl_sig_alg_is_supported(ssl, *sig_alg)) {
XiaokangQianeaf36512022-04-24 09:07:44 +00009236 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01009237 }
9238 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
9239 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, 0);
XiaokangQianeaf36512022-04-24 09:07:44 +00009240 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01009241 MBEDTLS_SSL_DEBUG_MSG(3, ("sent signature scheme [%x] %s",
9242 *sig_alg,
9243 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
XiaokangQianeaf36512022-04-24 09:07:44 +00009244 }
9245
9246 /* Length of supported_signature_algorithms */
9247 supported_sig_alg_len = p - supported_sig_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01009248 if (supported_sig_alg_len == 0) {
9249 MBEDTLS_SSL_DEBUG_MSG(1, ("No signature algorithms defined."));
9250 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
XiaokangQianeaf36512022-04-24 09:07:44 +00009251 }
9252
Gilles Peskine449bd832023-01-11 14:50:10 +01009253 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SIG_ALG, buf, 0);
9254 MBEDTLS_PUT_UINT16_BE(supported_sig_alg_len + 2, buf, 2);
9255 MBEDTLS_PUT_UINT16_BE(supported_sig_alg_len, buf, 4);
XiaokangQianeaf36512022-04-24 09:07:44 +00009256
XiaokangQianeaf36512022-04-24 09:07:44 +00009257 *out_len = p - buf;
9258
9259#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01009260 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_SIG_ALG);
XiaokangQianeaf36512022-04-24 09:07:44 +00009261#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu0c354a22022-08-29 15:25:36 +08009262
Gilles Peskine449bd832023-01-11 14:50:10 +01009263 return 0;
XiaokangQianeaf36512022-04-24 09:07:44 +00009264}
Ronald Crone68ab4f2022-10-05 12:46:29 +02009265#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
XiaokangQianeaf36512022-04-24 09:07:44 +00009266
XiaokangQian40a35232022-05-07 09:02:40 +00009267#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
XiaokangQian9b2b7712022-05-17 02:57:00 +00009268/*
9269 * mbedtls_ssl_parse_server_name_ext
9270 *
9271 * Structure of server_name extension:
9272 *
9273 * enum {
9274 * host_name(0), (255)
9275 * } NameType;
9276 * opaque HostName<1..2^16-1>;
9277 *
9278 * struct {
9279 * NameType name_type;
9280 * select (name_type) {
9281 * case host_name: HostName;
9282 * } name;
9283 * } ServerName;
9284 * struct {
9285 * ServerName server_name_list<1..2^16-1>
9286 * } ServerNameList;
9287 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02009288MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01009289int mbedtls_ssl_parse_server_name_ext(mbedtls_ssl_context *ssl,
9290 const unsigned char *buf,
9291 const unsigned char *end)
XiaokangQian40a35232022-05-07 09:02:40 +00009292{
9293 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
9294 const unsigned char *p = buf;
XiaokangQian9b2b7712022-05-17 02:57:00 +00009295 size_t server_name_list_len, hostname_len;
9296 const unsigned char *server_name_list_end;
XiaokangQian40a35232022-05-07 09:02:40 +00009297
Gilles Peskine449bd832023-01-11 14:50:10 +01009298 MBEDTLS_SSL_DEBUG_MSG(3, ("parse ServerName extension"));
XiaokangQian40a35232022-05-07 09:02:40 +00009299
Gilles Peskine449bd832023-01-11 14:50:10 +01009300 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
9301 server_name_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian40a35232022-05-07 09:02:40 +00009302 p += 2;
9303
Gilles Peskine449bd832023-01-11 14:50:10 +01009304 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, server_name_list_len);
XiaokangQian9b2b7712022-05-17 02:57:00 +00009305 server_name_list_end = p + server_name_list_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009306 while (p < server_name_list_end) {
9307 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, server_name_list_end, 3);
9308 hostname_len = MBEDTLS_GET_UINT16_BE(p, 1);
9309 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, server_name_list_end,
9310 hostname_len + 3);
XiaokangQian40a35232022-05-07 09:02:40 +00009311
Gilles Peskine449bd832023-01-11 14:50:10 +01009312 if (p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME) {
XiaokangQian75fe8c72022-06-15 09:42:45 +00009313 /* sni_name is intended to be used only during the parsing of the
9314 * ClientHello message (it is reset to NULL before the end of
9315 * the message parsing). Thus it is ok to just point to the
9316 * reception buffer and not make a copy of it.
9317 */
XiaokangQianf2a94202022-05-20 06:44:24 +00009318 ssl->handshake->sni_name = p + 3;
9319 ssl->handshake->sni_name_len = hostname_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009320 if (ssl->conf->f_sni == NULL) {
9321 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009322 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009323 ret = ssl->conf->f_sni(ssl->conf->p_sni,
9324 ssl, p + 3, hostname_len);
9325 if (ret != 0) {
9326 MBEDTLS_SSL_DEBUG_RET(1, "ssl_sni_wrapper", ret);
9327 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME,
9328 MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME);
9329 return MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME;
9330 }
9331 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009332 }
9333
9334 p += hostname_len + 3;
9335 }
9336
Gilles Peskine449bd832023-01-11 14:50:10 +01009337 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009338}
9339#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9340
XiaokangQianacb39922022-06-17 10:18:48 +00009341#if defined(MBEDTLS_SSL_ALPN)
Ronald Cronce7d76e2022-07-08 18:56:49 +02009342MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01009343int mbedtls_ssl_parse_alpn_ext(mbedtls_ssl_context *ssl,
9344 const unsigned char *buf,
9345 const unsigned char *end)
XiaokangQianacb39922022-06-17 10:18:48 +00009346{
9347 const unsigned char *p = buf;
XiaokangQianc7403452022-06-23 03:24:12 +00009348 size_t protocol_name_list_len;
XiaokangQian95d5f542022-06-24 02:29:26 +00009349 const unsigned char *protocol_name_list;
9350 const unsigned char *protocol_name_list_end;
XiaokangQianc7403452022-06-23 03:24:12 +00009351 size_t protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009352
9353 /* If ALPN not configured, just ignore the extension */
Gilles Peskine449bd832023-01-11 14:50:10 +01009354 if (ssl->conf->alpn_list == NULL) {
9355 return 0;
9356 }
XiaokangQianacb39922022-06-17 10:18:48 +00009357
9358 /*
XiaokangQianc7403452022-06-23 03:24:12 +00009359 * RFC7301, section 3.1
9360 * opaque ProtocolName<1..2^8-1>;
XiaokangQianacb39922022-06-17 10:18:48 +00009361 *
XiaokangQianc7403452022-06-23 03:24:12 +00009362 * struct {
9363 * ProtocolName protocol_name_list<2..2^16-1>
9364 * } ProtocolNameList;
XiaokangQianacb39922022-06-17 10:18:48 +00009365 */
9366
XiaokangQianc7403452022-06-23 03:24:12 +00009367 /*
XiaokangQian0b776e22022-06-24 09:04:59 +00009368 * protocol_name_list_len 2 bytes
9369 * protocol_name_len 1 bytes
9370 * protocol_name >=1 byte
XiaokangQianc7403452022-06-23 03:24:12 +00009371 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009372 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 4);
XiaokangQianacb39922022-06-17 10:18:48 +00009373
Gilles Peskine449bd832023-01-11 14:50:10 +01009374 protocol_name_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQianacb39922022-06-17 10:18:48 +00009375 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01009376 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, protocol_name_list_len);
XiaokangQian95d5f542022-06-24 02:29:26 +00009377 protocol_name_list = p;
9378 protocol_name_list_end = p + protocol_name_list_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009379
9380 /* Validate peer's list (lengths) */
Gilles Peskine449bd832023-01-11 14:50:10 +01009381 while (p < protocol_name_list_end) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009382 protocol_name_len = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +01009383 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, protocol_name_list_end,
9384 protocol_name_len);
9385 if (protocol_name_len == 0) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009386 MBEDTLS_SSL_PEND_FATAL_ALERT(
9387 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01009388 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
9389 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
XiaokangQian95d5f542022-06-24 02:29:26 +00009390 }
9391
9392 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009393 }
9394
9395 /* Use our order of preference */
Gilles Peskine449bd832023-01-11 14:50:10 +01009396 for (const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++) {
9397 size_t const alpn_len = strlen(*alpn);
XiaokangQian95d5f542022-06-24 02:29:26 +00009398 p = protocol_name_list;
Gilles Peskine449bd832023-01-11 14:50:10 +01009399 while (p < protocol_name_list_end) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009400 protocol_name_len = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +01009401 if (protocol_name_len == alpn_len &&
9402 memcmp(p, *alpn, alpn_len) == 0) {
XiaokangQianacb39922022-06-17 10:18:48 +00009403 ssl->alpn_chosen = *alpn;
Gilles Peskine449bd832023-01-11 14:50:10 +01009404 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009405 }
XiaokangQian95d5f542022-06-24 02:29:26 +00009406
9407 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009408 }
9409 }
9410
XiaokangQian95d5f542022-06-24 02:29:26 +00009411 /* If we get here, no match was found */
XiaokangQianacb39922022-06-17 10:18:48 +00009412 MBEDTLS_SSL_PEND_FATAL_ALERT(
Gilles Peskine449bd832023-01-11 14:50:10 +01009413 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL,
9414 MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL);
9415 return MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL;
XiaokangQianacb39922022-06-17 10:18:48 +00009416}
9417
Gilles Peskine449bd832023-01-11 14:50:10 +01009418int mbedtls_ssl_write_alpn_ext(mbedtls_ssl_context *ssl,
9419 unsigned char *buf,
9420 unsigned char *end,
9421 size_t *out_len)
XiaokangQianacb39922022-06-17 10:18:48 +00009422{
9423 unsigned char *p = buf;
XiaokangQian95d5f542022-06-24 02:29:26 +00009424 size_t protocol_name_len;
XiaokangQianc7403452022-06-23 03:24:12 +00009425 *out_len = 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009426
Gilles Peskine449bd832023-01-11 14:50:10 +01009427 if (ssl->alpn_chosen == NULL) {
9428 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009429 }
9430
Gilles Peskine449bd832023-01-11 14:50:10 +01009431 protocol_name_len = strlen(ssl->alpn_chosen);
9432 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 7 + protocol_name_len);
XiaokangQianacb39922022-06-17 10:18:48 +00009433
Gilles Peskine449bd832023-01-11 14:50:10 +01009434 MBEDTLS_SSL_DEBUG_MSG(3, ("server side, adding alpn extension"));
XiaokangQianacb39922022-06-17 10:18:48 +00009435 /*
9436 * 0 . 1 ext identifier
9437 * 2 . 3 ext length
9438 * 4 . 5 protocol list length
9439 * 6 . 6 protocol name length
9440 * 7 . 7+n protocol name
9441 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009442 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ALPN, p, 0);
XiaokangQianacb39922022-06-17 10:18:48 +00009443
XiaokangQian95d5f542022-06-24 02:29:26 +00009444 *out_len = 7 + protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009445
Gilles Peskine449bd832023-01-11 14:50:10 +01009446 MBEDTLS_PUT_UINT16_BE(protocol_name_len + 3, p, 2);
9447 MBEDTLS_PUT_UINT16_BE(protocol_name_len + 1, p, 4);
XiaokangQian0b776e22022-06-24 09:04:59 +00009448 /* Note: the length of the chosen protocol has been checked to be less
9449 * than 255 bytes in `mbedtls_ssl_conf_alpn_protocols`.
9450 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009451 p[6] = MBEDTLS_BYTE_0(protocol_name_len);
XiaokangQianacb39922022-06-17 10:18:48 +00009452
Gilles Peskine449bd832023-01-11 14:50:10 +01009453 memcpy(p + 7, ssl->alpn_chosen, protocol_name_len);
Jerry Yub95dd362022-11-08 21:19:34 +08009454
9455#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01009456 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_ALPN);
Jerry Yub95dd362022-11-08 21:19:34 +08009457#endif
9458
Gilles Peskine449bd832023-01-11 14:50:10 +01009459 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009460}
9461#endif /* MBEDTLS_SSL_ALPN */
9462
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009463#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
Xiaokang Qian03409292022-10-12 02:49:52 +00009464 defined(MBEDTLS_SSL_SESSION_TICKETS) && \
Xiaokang Qianed0620c2022-10-12 06:58:13 +00009465 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00009466 defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01009467int mbedtls_ssl_session_set_hostname(mbedtls_ssl_session *session,
9468 const char *hostname)
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009469{
9470 /* Initialize to suppress unnecessary compiler warning */
9471 size_t hostname_len = 0;
9472
9473 /* Check if new hostname is valid before
9474 * making any change to current one */
Gilles Peskine449bd832023-01-11 14:50:10 +01009475 if (hostname != NULL) {
9476 hostname_len = strlen(hostname);
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009477
Gilles Peskine449bd832023-01-11 14:50:10 +01009478 if (hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN) {
9479 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9480 }
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009481 }
9482
9483 /* Now it's clear that we will overwrite the old hostname,
9484 * so we can free it safely */
Gilles Peskine449bd832023-01-11 14:50:10 +01009485 if (session->hostname != NULL) {
9486 mbedtls_platform_zeroize(session->hostname,
9487 strlen(session->hostname));
9488 mbedtls_free(session->hostname);
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009489 }
9490
9491 /* Passing NULL as hostname shall clear the old one */
Gilles Peskine449bd832023-01-11 14:50:10 +01009492 if (hostname == NULL) {
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009493 session->hostname = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01009494 } else {
9495 session->hostname = mbedtls_calloc(1, hostname_len + 1);
9496 if (session->hostname == NULL) {
9497 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9498 }
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009499
Gilles Peskine449bd832023-01-11 14:50:10 +01009500 memcpy(session->hostname, hostname, hostname_len);
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009501 }
9502
Gilles Peskine449bd832023-01-11 14:50:10 +01009503 return 0;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009504}
Xiaokang Qian03409292022-10-12 02:49:52 +00009505#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
9506 MBEDTLS_SSL_SESSION_TICKETS &&
Xiaokang Qianed0620c2022-10-12 06:58:13 +00009507 MBEDTLS_SSL_SERVER_NAME_INDICATION &&
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00009508 MBEDTLS_SSL_CLI_C */
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009510#endif /* MBEDTLS_SSL_TLS_C */