blob: adb82b4baa5d971f5ccd5ec2c23166e71c959672 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Hanno Beckerf1a38282020-02-05 16:14:29 +00002 * Generic SSL/TLS messaging layer functions
3 * (record layer + retransmission state machine)
Paul Bakker5121ce52009-01-03 21:22:43 +00004 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02006 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000019 */
20/*
Paul Bakker5121ce52009-01-03 21:22:43 +000021 * http://www.ietf.org/rfc/rfc2246.txt
22 * http://www.ietf.org/rfc/rfc4346.txt
23 */
24
Gilles Peskinedb09ef62020-06-03 01:43:33 +020025#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000026
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020027#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000028
SimonBd5800b72016-04-26 07:43:27 +010029#if defined(MBEDTLS_PLATFORM_C)
30#include "mbedtls/platform.h"
31#else
32#include <stdlib.h>
33#define mbedtls_calloc calloc
34#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010035#endif
36
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000037#include "mbedtls/ssl.h"
Chris Jones84a773f2021-03-05 18:38:47 +000038#include "ssl_misc.h"
Janos Follath73c616b2019-12-18 15:07:04 +000039#include "mbedtls/debug.h"
40#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050041#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010042#include "mbedtls/version.h"
Gabor Mezei22c9a6f2021-10-20 12:09:35 +020043#include "constant_time_internal.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020044#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020045
Rich Evans00ab4702015-02-06 13:43:58 +000046#include <string.h>
47
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050048#if defined(MBEDTLS_USE_PSA_CRYPTO)
49#include "mbedtls/psa_util.h"
50#include "psa/crypto.h"
51#endif
52
Janos Follath23bdca02016-10-07 14:47:14 +010053#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000054#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020055#endif
56
Hanno Beckercd9dcda2018-08-28 17:18:56 +010057static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +010058
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020059/*
60 * Start a timer.
61 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020062 */
Hanno Becker0f57a652020-02-05 10:37:26 +000063void mbedtls_ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020064{
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +020065 if( ssl->f_set_timer == NULL )
66 return;
67
68 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
69 ssl->f_set_timer( ssl->p_timer, millisecs / 4, millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020070}
71
72/*
73 * Return -1 is timer is expired, 0 if it isn't.
74 */
Hanno Becker7876d122020-02-05 10:39:31 +000075int mbedtls_ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020076{
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +020077 if( ssl->f_get_timer == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020078 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +020079
80 if( ssl->f_get_timer( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020081 {
82 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020083 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020084 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020085
86 return( 0 );
87}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020088
TRodziewicz4ca18aa2021-05-20 14:46:20 +020089static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
90 unsigned char *buf,
91 size_t len,
92 mbedtls_record *rec );
93
94int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl,
95 unsigned char *buf,
96 size_t buflen )
97{
98 int ret = 0;
99 MBEDTLS_SSL_DEBUG_MSG( 1, ( "=> mbedtls_ssl_check_record" ) );
100 MBEDTLS_SSL_DEBUG_BUF( 3, "record buffer", buf, buflen );
101
102 /* We don't support record checking in TLS because
TRodziewicz2abf03c2021-06-25 14:40:09 +0200103 * there doesn't seem to be a usecase for it.
TRodziewicz4ca18aa2021-05-20 14:46:20 +0200104 */
105 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
106 {
107 ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
108 goto exit;
109 }
110#if defined(MBEDTLS_SSL_PROTO_DTLS)
111 else
112 {
113 mbedtls_record rec;
114
115 ret = ssl_parse_record_header( ssl, buf, buflen, &rec );
116 if( ret != 0 )
117 {
118 MBEDTLS_SSL_DEBUG_RET( 3, "ssl_parse_record_header", ret );
119 goto exit;
120 }
121
122 if( ssl->transform_in != NULL )
123 {
124 ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in, &rec );
125 if( ret != 0 )
126 {
127 MBEDTLS_SSL_DEBUG_RET( 3, "mbedtls_ssl_decrypt_buf", ret );
128 goto exit;
129 }
130 }
131 }
132#endif /* MBEDTLS_SSL_PROTO_DTLS */
133
134exit:
135 /* On success, we have decrypted the buffer in-place, so make
136 * sure we don't leak any plaintext data. */
137 mbedtls_platform_zeroize( buf, buflen );
138
139 /* For the purpose of this API, treat messages with unexpected CID
140 * as well as such from future epochs as unexpected. */
141 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID ||
142 ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
143 {
144 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
145 }
146
147 MBEDTLS_SSL_DEBUG_MSG( 1, ( "<= mbedtls_ssl_check_record" ) );
148 return( ret );
149}
150
Hanno Becker67bc7c32018-08-06 11:33:50 +0100151#define SSL_DONT_FORCE_FLUSH 0
152#define SSL_FORCE_FLUSH 1
153
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200154#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +0100155
Hanno Beckerd5847772018-08-28 10:09:23 +0100156/* Forward declarations for functions related to message buffering. */
Hanno Beckerd5847772018-08-28 10:09:23 +0100157static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
158 uint8_t slot );
159static void ssl_free_buffered_record( mbedtls_ssl_context *ssl );
160static int ssl_load_buffered_message( mbedtls_ssl_context *ssl );
161static int ssl_load_buffered_record( mbedtls_ssl_context *ssl );
162static int ssl_buffer_message( mbedtls_ssl_context *ssl );
Hanno Becker519f15d2019-07-11 12:43:20 +0100163static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
164 mbedtls_record const *rec );
Hanno Beckeref7afdf2018-08-28 17:16:31 +0100165static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl );
Hanno Beckerd5847772018-08-28 10:09:23 +0100166
Hanno Becker11682cc2018-08-22 14:41:02 +0100167static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context const *ssl )
Hanno Becker2b1e3542018-08-06 11:19:13 +0100168{
Hanno Becker89490712020-02-05 10:50:12 +0000169 size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Darryl Greenb33cc762019-11-28 14:29:44 +0000170#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
171 size_t out_buf_len = ssl->out_buf_len;
172#else
173 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
174#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +0100175
Darryl Greenb33cc762019-11-28 14:29:44 +0000176 if( mtu != 0 && mtu < out_buf_len )
Hanno Becker11682cc2018-08-22 14:41:02 +0100177 return( mtu );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100178
Darryl Greenb33cc762019-11-28 14:29:44 +0000179 return( out_buf_len );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100180}
181
Hanno Becker67bc7c32018-08-06 11:33:50 +0100182static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
183{
Hanno Becker11682cc2018-08-22 14:41:02 +0100184 size_t const bytes_written = ssl->out_left;
185 size_t const mtu = ssl_get_maximum_datagram_size( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100186
187 /* Double-check that the write-index hasn't gone
188 * past what we can transmit in a single datagram. */
Hanno Becker11682cc2018-08-22 14:41:02 +0100189 if( bytes_written > mtu )
Hanno Becker67bc7c32018-08-06 11:33:50 +0100190 {
191 /* Should never happen... */
192 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
193 }
194
195 return( (int) ( mtu - bytes_written ) );
196}
197
198static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl )
199{
Janos Follath865b3eb2019-12-16 11:46:15 +0000200 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100201 size_t remaining, expansion;
Andrzej Kurek748face2018-10-11 07:20:19 -0400202 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100203
204#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -0400205 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100206
207 if( max_len > mfl )
208 max_len = mfl;
Hanno Beckerf4b010e2018-08-24 10:47:29 +0100209
210 /* By the standard (RFC 6066 Sect. 4), the MFL extension
211 * only limits the maximum record payload size, so in theory
212 * we would be allowed to pack multiple records of payload size
213 * MFL into a single datagram. However, this would mean that there's
214 * no way to explicitly communicate MTU restrictions to the peer.
215 *
216 * The following reduction of max_len makes sure that we never
217 * write datagrams larger than MFL + Record Expansion Overhead.
218 */
219 if( max_len <= ssl->out_left )
220 return( 0 );
221
222 max_len -= ssl->out_left;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100223#endif
224
225 ret = ssl_get_remaining_space_in_datagram( ssl );
226 if( ret < 0 )
227 return( ret );
228 remaining = (size_t) ret;
229
230 ret = mbedtls_ssl_get_record_expansion( ssl );
231 if( ret < 0 )
232 return( ret );
233 expansion = (size_t) ret;
234
235 if( remaining <= expansion )
236 return( 0 );
237
238 remaining -= expansion;
239 if( remaining >= max_len )
240 remaining = max_len;
241
242 return( (int) remaining );
243}
244
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200245/*
246 * Double the retransmit timeout value, within the allowed range,
247 * returning -1 if the maximum value has already been reached.
248 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200249static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200250{
251 uint32_t new_timeout;
252
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200253 if( ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200254 return( -1 );
255
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200256 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
257 * in the following way: after the initial transmission and a first
258 * retransmission, back off to a temporary estimated MTU of 508 bytes.
259 * This value is guaranteed to be deliverable (if not guaranteed to be
260 * delivered) of any compliant IPv4 (and IPv6) network, and should work
261 * on most non-IP stacks too. */
262 if( ssl->handshake->retransmit_timeout != ssl->conf->hs_timeout_min )
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400263 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200264 ssl->handshake->mtu = 508;
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400265 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl->handshake->mtu ) );
266 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200267
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200268 new_timeout = 2 * ssl->handshake->retransmit_timeout;
269
270 /* Avoid arithmetic overflow and range overflow */
271 if( new_timeout < ssl->handshake->retransmit_timeout ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200272 new_timeout > ssl->conf->hs_timeout_max )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200273 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200274 new_timeout = ssl->conf->hs_timeout_max;
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200275 }
276
277 ssl->handshake->retransmit_timeout = new_timeout;
Paul Elliott9f352112020-12-09 14:55:45 +0000278 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %lu millisecs",
279 (unsigned long) ssl->handshake->retransmit_timeout ) );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200280
281 return( 0 );
282}
283
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200284static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200285{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200286 ssl->handshake->retransmit_timeout = ssl->conf->hs_timeout_min;
Paul Elliott9f352112020-12-09 14:55:45 +0000287 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %lu millisecs",
288 (unsigned long) ssl->handshake->retransmit_timeout ) );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200289}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200290#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200291
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100292/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000293 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +0200294 */
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000295
Ronald Cron6f135e12021-12-08 16:57:54 +0100296#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker13996922020-05-28 16:15:19 +0100297
298static size_t ssl_compute_padding_length( size_t len,
299 size_t granularity )
300{
301 return( ( granularity - ( len + 1 ) % granularity ) % granularity );
302}
303
Hanno Becker581bc1b2020-05-04 12:20:03 +0100304/* This functions transforms a (D)TLS plaintext fragment and a record content
305 * type into an instance of the (D)TLSInnerPlaintext structure. This is used
306 * in DTLS 1.2 + CID and within TLS 1.3 to allow flexible padding and to protect
307 * a record's content type.
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100308 *
309 * struct {
310 * opaque content[DTLSPlaintext.length];
311 * ContentType real_type;
312 * uint8 zeros[length_of_padding];
Hanno Becker581bc1b2020-05-04 12:20:03 +0100313 * } (D)TLSInnerPlaintext;
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100314 *
315 * Input:
316 * - `content`: The beginning of the buffer holding the
317 * plaintext to be wrapped.
318 * - `*content_size`: The length of the plaintext in Bytes.
319 * - `max_len`: The number of Bytes available starting from
320 * `content`. This must be `>= *content_size`.
321 * - `rec_type`: The desired record content type.
322 *
323 * Output:
Hanno Becker581bc1b2020-05-04 12:20:03 +0100324 * - `content`: The beginning of the resulting (D)TLSInnerPlaintext structure.
325 * - `*content_size`: The length of the resulting (D)TLSInnerPlaintext structure.
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100326 *
327 * Returns:
328 * - `0` on success.
329 * - A negative error code if `max_len` didn't offer enough space
330 * for the expansion.
331 */
Hanno Becker581bc1b2020-05-04 12:20:03 +0100332static int ssl_build_inner_plaintext( unsigned char *content,
333 size_t *content_size,
334 size_t remaining,
Hanno Becker13996922020-05-28 16:15:19 +0100335 uint8_t rec_type,
336 size_t pad )
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100337{
338 size_t len = *content_size;
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100339
340 /* Write real content type */
341 if( remaining == 0 )
342 return( -1 );
343 content[ len ] = rec_type;
344 len++;
345 remaining--;
346
347 if( remaining < pad )
348 return( -1 );
349 memset( content + len, 0, pad );
350 len += pad;
351 remaining -= pad;
352
353 *content_size = len;
354 return( 0 );
355}
356
Hanno Becker581bc1b2020-05-04 12:20:03 +0100357/* This function parses a (D)TLSInnerPlaintext structure.
358 * See ssl_build_inner_plaintext() for details. */
359static int ssl_parse_inner_plaintext( unsigned char const *content,
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100360 size_t *content_size,
361 uint8_t *rec_type )
362{
363 size_t remaining = *content_size;
364
365 /* Determine length of padding by skipping zeroes from the back. */
366 do
367 {
368 if( remaining == 0 )
369 return( -1 );
370 remaining--;
371 } while( content[ remaining ] == 0 );
372
373 *content_size = remaining;
374 *rec_type = content[ remaining ];
375
376 return( 0 );
377}
Ronald Cron6f135e12021-12-08 16:57:54 +0100378#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID || MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100379
Hanno Beckerd5aeab12019-05-20 14:50:53 +0100380/* `add_data` must have size 13 Bytes if the CID extension is disabled,
Hanno Beckerc4a190b2019-05-08 18:15:21 +0100381 * and 13 + 1 + CID-length Bytes if the CID extension is enabled. */
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000382static void ssl_extract_add_data_from_record( unsigned char* add_data,
Hanno Beckercab87e62019-04-29 13:52:53 +0100383 size_t *add_data_len,
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100384 mbedtls_record *rec,
Hanno Becker79e2d1b2021-03-22 11:42:19 +0000385 unsigned minor_ver,
386 size_t taglen )
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000387{
Hanno Beckerd5aeab12019-05-20 14:50:53 +0100388 /* Quoting RFC 5246 (TLS 1.2):
Hanno Beckercab87e62019-04-29 13:52:53 +0100389 *
390 * additional_data = seq_num + TLSCompressed.type +
391 * TLSCompressed.version + TLSCompressed.length;
392 *
Hanno Beckerd5aeab12019-05-20 14:50:53 +0100393 * For the CID extension, this is extended as follows
394 * (quoting draft-ietf-tls-dtls-connection-id-05,
395 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05):
Hanno Beckercab87e62019-04-29 13:52:53 +0100396 *
397 * additional_data = seq_num + DTLSPlaintext.type +
398 * DTLSPlaintext.version +
Hanno Beckerd5aeab12019-05-20 14:50:53 +0100399 * cid +
400 * cid_length +
Hanno Beckercab87e62019-04-29 13:52:53 +0100401 * length_of_DTLSInnerPlaintext;
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100402 *
403 * For TLS 1.3, the record sequence number is dropped from the AAD
404 * and encoded within the nonce of the AEAD operation instead.
Hanno Becker79e2d1b2021-03-22 11:42:19 +0000405 * Moreover, the additional data involves the length of the TLS
406 * ciphertext, not the TLS plaintext as in earlier versions.
407 * Quoting RFC 8446 (TLS 1.3):
408 *
409 * additional_data = TLSCiphertext.opaque_type ||
410 * TLSCiphertext.legacy_record_version ||
411 * TLSCiphertext.length
412 *
413 * We pass the tag length to this function in order to compute the
414 * ciphertext length from the inner plaintext length rec->data_len via
415 *
416 * TLSCiphertext.length = TLSInnerPlaintext.length + taglen.
417 *
Hanno Beckercab87e62019-04-29 13:52:53 +0100418 */
419
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100420 unsigned char *cur = add_data;
Hanno Becker79e2d1b2021-03-22 11:42:19 +0000421 size_t ad_len_field = rec->data_len;
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100422
Ronald Cron6f135e12021-12-08 16:57:54 +0100423#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker79e2d1b2021-03-22 11:42:19 +0000424 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
425 {
426 /* In TLS 1.3, the AAD contains the length of the TLSCiphertext,
427 * which differs from the length of the TLSInnerPlaintext
428 * by the length of the authentication tag. */
429 ad_len_field += taglen;
430 }
431 else
Ronald Cron6f135e12021-12-08 16:57:54 +0100432#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100433 {
434 ((void) minor_ver);
Hanno Becker79e2d1b2021-03-22 11:42:19 +0000435 ((void) taglen);
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100436 memcpy( cur, rec->ctr, sizeof( rec->ctr ) );
437 cur += sizeof( rec->ctr );
438 }
439
440 *cur = rec->type;
441 cur++;
442
443 memcpy( cur, rec->ver, sizeof( rec->ver ) );
444 cur += sizeof( rec->ver );
Hanno Beckercab87e62019-04-29 13:52:53 +0100445
Hanno Beckera0e20d02019-05-15 14:03:01 +0100446#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker95e4bbc2019-05-09 11:38:24 +0100447 if( rec->cid_len != 0 )
448 {
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100449 memcpy( cur, rec->cid, rec->cid_len );
450 cur += rec->cid_len;
451
452 *cur = rec->cid_len;
453 cur++;
454
Joe Subbiani6dd73642021-07-19 11:56:54 +0100455 MBEDTLS_PUT_UINT16_BE( ad_len_field, cur, 0 );
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100456 cur += 2;
Hanno Becker95e4bbc2019-05-09 11:38:24 +0100457 }
458 else
Hanno Beckera0e20d02019-05-15 14:03:01 +0100459#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker95e4bbc2019-05-09 11:38:24 +0100460 {
Joe Subbiani6dd73642021-07-19 11:56:54 +0100461 MBEDTLS_PUT_UINT16_BE( ad_len_field, cur, 0 );
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100462 cur += 2;
Hanno Becker95e4bbc2019-05-09 11:38:24 +0100463 }
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100464
465 *add_data_len = cur - add_data;
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000466}
467
Hanno Becker67a37db2020-05-28 16:27:07 +0100468#if defined(MBEDTLS_GCM_C) || \
469 defined(MBEDTLS_CCM_C) || \
470 defined(MBEDTLS_CHACHAPOLY_C)
Hanno Becker17263802020-05-28 07:05:48 +0100471static int ssl_transform_aead_dynamic_iv_is_explicit(
472 mbedtls_ssl_transform const *transform )
Hanno Beckerdf8be222020-05-21 15:30:57 +0100473{
Hanno Becker17263802020-05-28 07:05:48 +0100474 return( transform->ivlen != transform->fixed_ivlen );
Hanno Beckerdf8be222020-05-21 15:30:57 +0100475}
476
Hanno Becker17263802020-05-28 07:05:48 +0100477/* Compute IV := ( fixed_iv || 0 ) XOR ( 0 || dynamic_IV )
478 *
479 * Concretely, this occurs in two variants:
480 *
481 * a) Fixed and dynamic IV lengths add up to total IV length, giving
482 * IV = fixed_iv || dynamic_iv
483 *
Hanno Becker15952812020-06-04 13:31:46 +0100484 * This variant is used in TLS 1.2 when used with GCM or CCM.
485 *
Hanno Becker17263802020-05-28 07:05:48 +0100486 * b) Fixed IV lengths matches total IV length, giving
487 * IV = fixed_iv XOR ( 0 || dynamic_iv )
Hanno Becker15952812020-06-04 13:31:46 +0100488 *
489 * This variant occurs in TLS 1.3 and for TLS 1.2 when using ChaChaPoly.
490 *
491 * See also the documentation of mbedtls_ssl_transform.
Hanno Beckerf486e282020-06-04 13:33:08 +0100492 *
493 * This function has the precondition that
494 *
495 * dst_iv_len >= max( fixed_iv_len, dynamic_iv_len )
496 *
497 * which has to be ensured by the caller. If this precondition
498 * violated, the behavior of this function is undefined.
Hanno Becker17263802020-05-28 07:05:48 +0100499 */
500static void ssl_build_record_nonce( unsigned char *dst_iv,
501 size_t dst_iv_len,
502 unsigned char const *fixed_iv,
503 size_t fixed_iv_len,
504 unsigned char const *dynamic_iv,
505 size_t dynamic_iv_len )
506{
507 size_t i;
Hanno Beckerdf8be222020-05-21 15:30:57 +0100508
509 /* Start with Fixed IV || 0 */
Hanno Becker17263802020-05-28 07:05:48 +0100510 memset( dst_iv, 0, dst_iv_len );
511 memcpy( dst_iv, fixed_iv, fixed_iv_len );
Hanno Beckerdf8be222020-05-21 15:30:57 +0100512
Hanno Becker17263802020-05-28 07:05:48 +0100513 dst_iv += dst_iv_len - dynamic_iv_len;
514 for( i = 0; i < dynamic_iv_len; i++ )
515 dst_iv[i] ^= dynamic_iv[i];
Hanno Beckerdf8be222020-05-21 15:30:57 +0100516}
Hanno Becker67a37db2020-05-28 16:27:07 +0100517#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Hanno Beckerdf8be222020-05-21 15:30:57 +0100518
Hanno Beckera18d1322018-01-03 14:27:32 +0000519int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl,
520 mbedtls_ssl_transform *transform,
521 mbedtls_record *rec,
522 int (*f_rng)(void *, unsigned char *, size_t),
523 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +0000524{
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100525#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200526 mbedtls_cipher_mode_t mode;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100527#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +0100528 int auth_done = 0;
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000529 unsigned char * data;
Hanno Becker92fb4fa2019-05-20 14:54:26 +0100530 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_OUT_LEN_MAX ];
Hanno Beckercab87e62019-04-29 13:52:53 +0100531 size_t add_data_len;
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000532 size_t post_avail;
533
534 /* The SSL context is only used for debugging purposes! */
Hanno Beckera18d1322018-01-03 14:27:32 +0000535#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnarda7505d12019-05-07 10:17:56 +0200536 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000537 ((void) ssl);
538#endif
539
540 /* The PRNG is used for dynamic IV generation that's used
TRodziewicz0f82ec62021-05-12 17:49:18 +0200541 * for CBC transformations in TLS 1.2. */
Manuel Pégourié-Gonnard2df1f1f2020-07-09 12:11:39 +0200542#if !( defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \
TRodziewicz0f82ec62021-05-12 17:49:18 +0200543 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000544 ((void) f_rng);
545 ((void) p_rng);
546#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000547
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200548 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000549
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000550 if( transform == NULL )
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +0100551 {
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000552 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to encrypt_buf" ) );
553 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
554 }
Hanno Becker43c24b82019-05-01 09:45:57 +0100555 if( rec == NULL
556 || rec->buf == NULL
557 || rec->buf_len < rec->data_offset
558 || rec->buf_len - rec->data_offset < rec->data_len
Hanno Beckera0e20d02019-05-15 14:03:01 +0100559#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker43c24b82019-05-01 09:45:57 +0100560 || rec->cid_len != 0
561#endif
562 )
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000563 {
564 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to encrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200565 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +0100566 }
567
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000568 data = rec->buf + rec->data_offset;
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100569 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200570 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000571 data, rec->data_len );
572
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100573#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000574 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc );
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100575#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000576
577 if( rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
578 {
Paul Elliottd48d5c62021-01-07 14:47:05 +0000579 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record content %" MBEDTLS_PRINTF_SIZET
580 " too large, maximum %" MBEDTLS_PRINTF_SIZET,
Paul Elliott3891caf2020-12-17 18:42:40 +0000581 rec->data_len,
582 (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000583 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
584 }
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +0100585
Hanno Becker92313402020-05-20 13:58:58 +0100586 /* The following two code paths implement the (D)TLSInnerPlaintext
587 * structure present in TLS 1.3 and DTLS 1.2 + CID.
588 *
589 * See ssl_build_inner_plaintext() for more information.
590 *
591 * Note that this changes `rec->data_len`, and hence
592 * `post_avail` needs to be recalculated afterwards.
593 *
594 * Note also that the two code paths cannot occur simultaneously
595 * since they apply to different versions of the protocol. There
596 * is hence no risk of double-addition of the inner plaintext.
597 */
Ronald Cron6f135e12021-12-08 16:57:54 +0100598#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Beckerccc13d02020-05-04 12:30:04 +0100599 if( transform->minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
600 {
Hanno Becker13996922020-05-28 16:15:19 +0100601 size_t padding =
602 ssl_compute_padding_length( rec->data_len,
TRodziewicze8dd7092021-05-12 14:19:11 +0200603 MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY );
Hanno Beckerccc13d02020-05-04 12:30:04 +0100604 if( ssl_build_inner_plaintext( data,
Hanno Becker13996922020-05-28 16:15:19 +0100605 &rec->data_len,
606 post_avail,
607 rec->type,
608 padding ) != 0 )
Hanno Beckerccc13d02020-05-04 12:30:04 +0100609 {
610 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
611 }
612
613 rec->type = MBEDTLS_SSL_MSG_APPLICATION_DATA;
614 }
Ronald Cron6f135e12021-12-08 16:57:54 +0100615#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerccc13d02020-05-04 12:30:04 +0100616
Hanno Beckera0e20d02019-05-15 14:03:01 +0100617#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckercab87e62019-04-29 13:52:53 +0100618 /*
619 * Add CID information
620 */
621 rec->cid_len = transform->out_cid_len;
622 memcpy( rec->cid, transform->out_cid, transform->out_cid_len );
623 MBEDTLS_SSL_DEBUG_BUF( 3, "CID", rec->cid, rec->cid_len );
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100624
625 if( rec->cid_len != 0 )
626 {
Hanno Becker13996922020-05-28 16:15:19 +0100627 size_t padding =
628 ssl_compute_padding_length( rec->data_len,
TRodziewicze8dd7092021-05-12 14:19:11 +0200629 MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY );
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100630 /*
Hanno Becker07dc97d2019-05-20 15:08:01 +0100631 * Wrap plaintext into DTLSInnerPlaintext structure.
Hanno Becker581bc1b2020-05-04 12:20:03 +0100632 * See ssl_build_inner_plaintext() for more information.
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100633 *
Hanno Becker07dc97d2019-05-20 15:08:01 +0100634 * Note that this changes `rec->data_len`, and hence
635 * `post_avail` needs to be recalculated afterwards.
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100636 */
Hanno Becker581bc1b2020-05-04 12:20:03 +0100637 if( ssl_build_inner_plaintext( data,
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100638 &rec->data_len,
639 post_avail,
Hanno Becker13996922020-05-28 16:15:19 +0100640 rec->type,
641 padding ) != 0 )
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100642 {
643 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
644 }
645
646 rec->type = MBEDTLS_SSL_MSG_CID;
647 }
Hanno Beckera0e20d02019-05-15 14:03:01 +0100648#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckercab87e62019-04-29 13:52:53 +0100649
Hanno Becker8b3eb5a2019-04-29 17:31:37 +0100650 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
651
Paul Bakker5121ce52009-01-03 21:22:43 +0000652 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100653 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +0000654 */
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000655#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100656#if defined(MBEDTLS_USE_PSA_CRYPTO)
657 if ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ||
658 ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING
659#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200660 if( mode == MBEDTLS_MODE_STREAM ||
661 ( mode == MBEDTLS_MODE_CBC
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100662#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200663#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000664 && transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +0100665#endif
666 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +0000667 {
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000668 if( post_avail < transform->maclen )
669 {
670 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
671 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
672 }
TRodziewicz0f82ec62021-05-12 17:49:18 +0200673#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
TRodziewicz345165c2021-07-06 13:42:11 +0200674 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
Gilles Peskineecf6beb2021-12-10 21:35:10 +0100675 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker992b6872017-11-09 18:57:39 +0000676
TRodziewicz345165c2021-07-06 13:42:11 +0200677 ssl_extract_add_data_from_record( add_data, &add_data_len, rec,
Hanno Becker79e2d1b2021-03-22 11:42:19 +0000678 transform->minor_ver,
679 transform->taglen );
Hanno Becker992b6872017-11-09 18:57:39 +0000680
Gilles Peskineecf6beb2021-12-10 21:35:10 +0100681 ret = mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
682 add_data_len );
683 if( ret != 0 )
684 goto hmac_failed_etm_disabled;
685 ret = mbedtls_md_hmac_update( &transform->md_ctx_enc, data, rec->data_len );
686 if( ret != 0 )
687 goto hmac_failed_etm_disabled;
688 ret = mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
689 if( ret != 0 )
690 goto hmac_failed_etm_disabled;
691 ret = mbedtls_md_hmac_reset( &transform->md_ctx_enc );
692 if( ret != 0 )
693 goto hmac_failed_etm_disabled;
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000694
TRodziewicz345165c2021-07-06 13:42:11 +0200695 memcpy( data + rec->data_len, mac, transform->maclen );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200696#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +0200697
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000698 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", data + rec->data_len,
699 transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +0200700
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000701 rec->data_len += transform->maclen;
702 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +0100703 auth_done++;
Gilles Peskineecf6beb2021-12-10 21:35:10 +0100704
705 hmac_failed_etm_disabled:
Gilles Peskined5ba50e2021-12-10 21:33:21 +0100706 mbedtls_platform_zeroize( mac, transform->maclen );
Gilles Peskineecf6beb2021-12-10 21:35:10 +0100707 if( ret != 0 )
708 {
709 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_hmac_xxx", ret );
710 return( ret );
711 }
Paul Bakker577e0062013-08-28 11:57:20 +0200712 }
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000713#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +0000714
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +0200715 /*
716 * Encrypt
717 */
Hanno Beckerd086bf02021-03-22 13:01:27 +0000718#if defined(MBEDTLS_SSL_SOME_SUITES_USE_STREAM)
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100719#if defined(MBEDTLS_USE_PSA_CRYPTO)
720 if ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER )
721#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200722 if( mode == MBEDTLS_MODE_STREAM )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100723#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000724 {
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000725 size_t olen;
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100726#if defined(MBEDTLS_USE_PSA_CRYPTO)
727 psa_status_t status;
728 size_t part_len;
729 psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT;
730
Przemyslaw Stekiel1fe065b2022-01-13 15:56:33 +0100731#else /* MBEDTLS_USE_PSA_CRYPTO */
732 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
733#endif
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100734
Paul Elliottd48d5c62021-01-07 14:47:05 +0000735 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %" MBEDTLS_PRINTF_SIZET ", "
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000736 "including %d bytes of padding",
737 rec->data_len, 0 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000738
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100739#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100740 /* Skip psa encryption for null cipher */
741 if ( transform->psa_alg != MBEDTLS_SSL_NULL_CIPHER )
742 {
743 status = psa_cipher_encrypt_setup( &cipher_op,
744 transform->psa_key_enc, transform->psa_alg );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100745
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100746 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +0100747 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100748
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100749 status = psa_cipher_set_iv( &cipher_op, transform->iv_enc, transform->ivlen );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100750
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100751 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +0100752 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100753
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100754 status = psa_cipher_update( &cipher_op,
755 data, rec->data_len,
756 data, rec->data_len, &olen );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100757
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100758 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +0100759 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100760
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100761 status = psa_cipher_finish( &cipher_op,
762 data + olen, rec->data_len - olen,
763 &part_len );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100764
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100765 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +0100766 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100767
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100768 olen += part_len;
769 } else {
770 olen = rec->data_len;
771 }
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100772#else
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000773 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
774 transform->iv_enc, transform->ivlen,
775 data, rec->data_len,
776 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +0200777 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200778 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +0200779 return( ret );
780 }
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100781#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakkerea6ad3f2013-09-02 14:57:01 +0200782
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000783 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +0200784 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200785 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
786 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +0200787 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000788 }
Paul Bakker68884e32013-01-07 18:20:04 +0100789 else
Hanno Beckerd086bf02021-03-22 13:01:27 +0000790#endif /* MBEDTLS_SSL_SOME_SUITES_USE_STREAM */
Hanno Becker2e24c3b2017-12-27 21:28:58 +0000791
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200792#if defined(MBEDTLS_GCM_C) || \
793 defined(MBEDTLS_CCM_C) || \
794 defined(MBEDTLS_CHACHAPOLY_C)
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100795#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekiele8847782022-01-24 23:19:21 +0100796 if ( PSA_ALG_IS_AEAD( transform->psa_alg ) )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100797#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200798 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200799 mode == MBEDTLS_MODE_CCM ||
800 mode == MBEDTLS_MODE_CHACHAPOLY )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100801#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakkerca4ab492012-04-18 14:23:57 +0000802 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200803 unsigned char iv[12];
Hanno Beckerdf8be222020-05-21 15:30:57 +0100804 unsigned char *dynamic_iv;
805 size_t dynamic_iv_len;
Hanno Becker17263802020-05-28 07:05:48 +0100806 int dynamic_iv_is_explicit =
807 ssl_transform_aead_dynamic_iv_is_explicit( transform );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100808#if defined(MBEDTLS_USE_PSA_CRYPTO)
809 psa_status_t status;
Przemyslaw Stekiel1fe065b2022-01-13 15:56:33 +0100810#else
811 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100812#endif /* MBEDTLS_USE_PSA_CRYPTO */
813
Paul Bakkerca4ab492012-04-18 14:23:57 +0000814
Hanno Beckerbd5ed1d2020-05-21 15:26:39 +0100815 /* Check that there's space for the authentication tag. */
816 if( post_avail < transform->taglen )
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000817 {
818 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
819 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
820 }
Paul Bakkerca4ab492012-04-18 14:23:57 +0000821
Paul Bakker68884e32013-01-07 18:20:04 +0100822 /*
Hanno Beckerdf8be222020-05-21 15:30:57 +0100823 * Build nonce for AEAD encryption.
824 *
825 * Note: In the case of CCM and GCM in TLS 1.2, the dynamic
826 * part of the IV is prepended to the ciphertext and
827 * can be chosen freely - in particular, it need not
828 * agree with the record sequence number.
829 * However, since ChaChaPoly as well as all AEAD modes
830 * in TLS 1.3 use the record sequence number as the
831 * dynamic part of the nonce, we uniformly use the
832 * record sequence number here in all cases.
Paul Bakker68884e32013-01-07 18:20:04 +0100833 */
Hanno Beckerdf8be222020-05-21 15:30:57 +0100834 dynamic_iv = rec->ctr;
835 dynamic_iv_len = sizeof( rec->ctr );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200836
Hanno Becker17263802020-05-28 07:05:48 +0100837 ssl_build_record_nonce( iv, sizeof( iv ),
838 transform->iv_enc,
839 transform->fixed_ivlen,
840 dynamic_iv,
841 dynamic_iv_len );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +0100842
Hanno Becker1cb6c2a2020-05-21 15:25:21 +0100843 /*
844 * Build additional data for AEAD encryption.
845 * This depends on the TLS version.
846 */
847 ssl_extract_add_data_from_record( add_data, &add_data_len, rec,
Hanno Becker79e2d1b2021-03-22 11:42:19 +0000848 transform->minor_ver,
849 transform->taglen );
Hanno Becker1f10d762019-04-26 13:34:37 +0100850
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200851 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
Hanno Becker7cca3582020-06-04 13:27:22 +0100852 iv, transform->ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200853 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
Hanno Becker16bf0e22020-06-04 13:27:34 +0100854 dynamic_iv,
855 dynamic_iv_is_explicit ? dynamic_iv_len : 0 );
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000856 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckercab87e62019-04-29 13:52:53 +0100857 add_data, add_data_len );
Paul Elliottd48d5c62021-01-07 14:47:05 +0000858 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %" MBEDTLS_PRINTF_SIZET ", "
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200859 "including 0 bytes of padding",
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000860 rec->data_len ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +0000861
Paul Bakker68884e32013-01-07 18:20:04 +0100862 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +0200863 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +0200864 */
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100865#if defined(MBEDTLS_USE_PSA_CRYPTO)
866 status = psa_aead_encrypt( transform->psa_key_enc,
867 transform->psa_alg,
868 iv, transform->ivlen,
869 add_data, add_data_len,
870 data, rec->data_len,
871 data, rec->buf_len - (data - rec->buf),
872 &rec->data_len );
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000873
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100874 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +0100875 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100876#else
Manuel Pégourié-Gonnardf5cf71e2020-12-01 11:43:40 +0100877 if( ( ret = mbedtls_cipher_auth_encrypt_ext( &transform->cipher_ctx_enc,
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000878 iv, transform->ivlen,
Manuel Pégourié-Gonnardf5cf71e2020-12-01 11:43:40 +0100879 add_data, add_data_len,
880 data, rec->data_len, /* src */
881 data, rec->buf_len - (data - rec->buf), /* dst */
882 &rec->data_len,
883 transform->taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +0200884 {
TRodziewicz18efb732021-04-29 23:12:19 +0200885 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt_ext", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +0200886 return( ret );
887 }
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100888#endif /* MBEDTLS_USE_PSA_CRYPTO */
889
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000890 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag",
Manuel Pégourié-Gonnardf5cf71e2020-12-01 11:43:40 +0100891 data + rec->data_len - transform->taglen,
892 transform->taglen );
Hanno Beckerdf8be222020-05-21 15:30:57 +0100893 /* Account for authentication tag. */
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000894 post_avail -= transform->taglen;
Hanno Beckerdf8be222020-05-21 15:30:57 +0100895
896 /*
897 * Prefix record content with dynamic IV in case it is explicit.
898 */
Hanno Becker1cda2662020-06-04 13:28:28 +0100899 if( dynamic_iv_is_explicit != 0 )
Hanno Beckerdf8be222020-05-21 15:30:57 +0100900 {
901 if( rec->data_offset < dynamic_iv_len )
902 {
903 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
904 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
905 }
906
907 memcpy( data - dynamic_iv_len, dynamic_iv, dynamic_iv_len );
908 rec->data_offset -= dynamic_iv_len;
909 rec->data_len += dynamic_iv_len;
910 }
911
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +0100912 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000913 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000914 else
Hanno Beckerc3f7b0b2020-05-28 16:27:16 +0100915#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnard2df1f1f2020-07-09 12:11:39 +0200916#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100917#if defined(MBEDTLS_USE_PSA_CRYPTO)
918 if ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING )
919#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200920 if( mode == MBEDTLS_MODE_CBC )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100921#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker5121ce52009-01-03 21:22:43 +0000922 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000923 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000924 size_t padlen, i;
925 size_t olen;
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100926#if defined(MBEDTLS_USE_PSA_CRYPTO)
927 psa_status_t status;
928 size_t part_len;
929 psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT;
930#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000931
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000932 /* Currently we're always using minimal padding
933 * (up to 255 bytes would be allowed). */
934 padlen = transform->ivlen - ( rec->data_len + 1 ) % transform->ivlen;
935 if( padlen == transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000936 padlen = 0;
937
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000938 /* Check there's enough space in the buffer for the padding. */
939 if( post_avail < padlen + 1 )
940 {
941 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
942 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
943 }
944
Paul Bakker5121ce52009-01-03 21:22:43 +0000945 for( i = 0; i <= padlen; i++ )
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000946 data[rec->data_len + i] = (unsigned char) padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +0000947
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000948 rec->data_len += padlen + 1;
949 post_avail -= padlen + 1;
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000950
TRodziewicz0f82ec62021-05-12 17:49:18 +0200951#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000952 /*
TRodziewicz2d8800e2021-05-13 19:14:19 +0200953 * Prepend per-record IV for block cipher in TLS v1.2 as per
Paul Bakker1ef83d62012-04-11 12:09:53 +0000954 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000955 */
TRodziewicz345165c2021-07-06 13:42:11 +0200956 if( f_rng == NULL )
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000957 {
TRodziewicz345165c2021-07-06 13:42:11 +0200958 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No PRNG provided to encrypt_record routine" ) );
959 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000960 }
TRodziewicz345165c2021-07-06 13:42:11 +0200961
962 if( rec->data_offset < transform->ivlen )
963 {
964 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
965 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
966 }
967
968 /*
969 * Generate IV
970 */
971 ret = f_rng( p_rng, transform->iv_enc, transform->ivlen );
972 if( ret != 0 )
973 return( ret );
974
975 memcpy( data - transform->ivlen, transform->iv_enc, transform->ivlen );
TRodziewicz0f82ec62021-05-12 17:49:18 +0200976#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000977
Paul Elliottd48d5c62021-01-07 14:47:05 +0000978 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %" MBEDTLS_PRINTF_SIZET ", "
979 "including %" MBEDTLS_PRINTF_SIZET
980 " bytes of IV and %" MBEDTLS_PRINTF_SIZET " bytes of padding",
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000981 rec->data_len, transform->ivlen,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +0200982 padlen + 1 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000983
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100984#if defined(MBEDTLS_USE_PSA_CRYPTO)
985 status = psa_cipher_encrypt_setup( &cipher_op,
Przemyslaw Stekield4eab572022-01-17 16:20:10 +0100986 transform->psa_key_enc, transform->psa_alg );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100987
988 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +0100989 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100990
991 status = psa_cipher_set_iv( &cipher_op, transform->iv_enc, transform->ivlen );
992
993 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +0100994 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +0100995
996 status = psa_cipher_update( &cipher_op,
997 data, rec->data_len,
998 data, rec->data_len, &olen );
999
1000 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001001 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +01001002
1003 status = psa_cipher_finish( &cipher_op,
1004 data + olen, rec->data_len - olen,
1005 &part_len );
1006
1007 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001008 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +01001009
1010 olen += part_len;
1011#else
Hanno Becker9eddaeb2017-12-27 21:37:21 +00001012 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
1013 transform->iv_enc,
1014 transform->ivlen,
1015 data, rec->data_len,
1016 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001017 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001018 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02001019 return( ret );
1020 }
Przemyslaw Stekielb37fae12022-01-13 14:28:44 +01001021#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001022
Hanno Becker9eddaeb2017-12-27 21:37:21 +00001023 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02001024 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001025 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1026 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02001027 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001028
TRodziewicz0f82ec62021-05-12 17:49:18 +02001029 data -= transform->ivlen;
1030 rec->data_offset -= transform->ivlen;
1031 rec->data_len += transform->ivlen;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001032
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001033#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001034 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001035 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00001036 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
1037
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001038 /*
1039 * MAC(MAC_write_key, seq_num +
1040 * TLSCipherText.type +
1041 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001042 * length_of( (IV +) ENC(...) ) +
TRodziewicz2abf03c2021-06-25 14:40:09 +02001043 * IV +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001044 * ENC(content + padding + padding_length));
1045 */
Hanno Becker9eddaeb2017-12-27 21:37:21 +00001046
1047 if( post_avail < transform->maclen)
1048 {
1049 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
1050 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
1051 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001052
Hanno Becker1cb6c2a2020-05-21 15:25:21 +01001053 ssl_extract_add_data_from_record( add_data, &add_data_len,
Hanno Becker79e2d1b2021-03-22 11:42:19 +00001054 rec, transform->minor_ver,
1055 transform->taglen );
Hanno Becker1f10d762019-04-26 13:34:37 +01001056
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001057 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Hanno Becker9eddaeb2017-12-27 21:37:21 +00001058 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
Hanno Beckercab87e62019-04-29 13:52:53 +01001059 add_data_len );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001060
Gilles Peskineecf6beb2021-12-10 21:35:10 +01001061 ret = mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
1062 add_data_len );
1063 if( ret != 0 )
1064 goto hmac_failed_etm_enabled;
1065 ret = mbedtls_md_hmac_update( &transform->md_ctx_enc,
1066 data, rec->data_len );
1067 if( ret != 0 )
1068 goto hmac_failed_etm_enabled;
1069 ret = mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
1070 if( ret != 0 )
1071 goto hmac_failed_etm_enabled;
1072 ret = mbedtls_md_hmac_reset( &transform->md_ctx_enc );
1073 if( ret != 0 )
1074 goto hmac_failed_etm_enabled;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001075
Hanno Becker9eddaeb2017-12-27 21:37:21 +00001076 memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001077
Hanno Becker9eddaeb2017-12-27 21:37:21 +00001078 rec->data_len += transform->maclen;
1079 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001080 auth_done++;
Gilles Peskineecf6beb2021-12-10 21:35:10 +01001081
1082 hmac_failed_etm_enabled:
Gilles Peskined5ba50e2021-12-10 21:33:21 +01001083 mbedtls_platform_zeroize( mac, transform->maclen );
Gilles Peskineecf6beb2021-12-10 21:35:10 +01001084 if( ret != 0 )
1085 {
1086 MBEDTLS_SSL_DEBUG_RET( 1, "HMAC calculation failed", ret );
1087 return( ret );
1088 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001089 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001090#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001091 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001092 else
Manuel Pégourié-Gonnard2df1f1f2020-07-09 12:11:39 +02001093#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001094 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001095 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1096 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001097 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001098
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001099 /* Make extra sure authentication was performed, exactly once */
1100 if( auth_done != 1 )
1101 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001102 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1103 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001104 }
1105
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001106 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001107
1108 return( 0 );
1109}
1110
Hanno Becker605949f2019-07-12 08:23:59 +01001111int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
Hanno Beckera18d1322018-01-03 14:27:32 +00001112 mbedtls_ssl_transform *transform,
1113 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00001114{
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001115 size_t olen;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001116#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001117 mbedtls_cipher_mode_t mode;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001118#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001119 int ret, auth_done = 0;
Hanno Beckerfd86ca82020-11-30 08:54:23 +00001120#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01001121 size_t padlen = 0, correct = 1;
1122#endif
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001123 unsigned char* data;
Hanno Becker92fb4fa2019-05-20 14:54:26 +01001124 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_IN_LEN_MAX ];
Hanno Beckercab87e62019-04-29 13:52:53 +01001125 size_t add_data_len;
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001126
Hanno Beckera18d1322018-01-03 14:27:32 +00001127#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnarda7505d12019-05-07 10:17:56 +02001128 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001129 ((void) ssl);
1130#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001131
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001132 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001133 if( rec == NULL ||
1134 rec->buf == NULL ||
1135 rec->buf_len < rec->data_offset ||
1136 rec->buf_len - rec->data_offset < rec->data_len )
1137 {
1138 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to decrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001139 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001140 }
1141
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001142 data = rec->buf + rec->data_offset;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001143#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001144 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_dec );
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001145#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker5121ce52009-01-03 21:22:43 +00001146
Hanno Beckera0e20d02019-05-15 14:03:01 +01001147#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckercab87e62019-04-29 13:52:53 +01001148 /*
1149 * Match record's CID with incoming CID.
1150 */
Hanno Becker938489a2019-05-08 13:02:22 +01001151 if( rec->cid_len != transform->in_cid_len ||
1152 memcmp( rec->cid, transform->in_cid, rec->cid_len ) != 0 )
1153 {
Hanno Becker8367ccc2019-05-14 11:30:10 +01001154 return( MBEDTLS_ERR_SSL_UNEXPECTED_CID );
Hanno Becker938489a2019-05-08 13:02:22 +01001155 }
Hanno Beckera0e20d02019-05-15 14:03:01 +01001156#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckercab87e62019-04-29 13:52:53 +01001157
Hanno Beckerd086bf02021-03-22 13:01:27 +00001158#if defined(MBEDTLS_SSL_SOME_SUITES_USE_STREAM)
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001159#if defined(MBEDTLS_USE_PSA_CRYPTO)
1160 if ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER )
1161#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001162 if( mode == MBEDTLS_MODE_STREAM )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001163#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker68884e32013-01-07 18:20:04 +01001164 {
1165 padlen = 0;
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001166#if defined(MBEDTLS_USE_PSA_CRYPTO)
1167 psa_status_t status;
1168 size_t part_len;
1169 psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT;
1170#endif /* MBEDTLS_USE_PSA_CRYPTO */
1171
1172#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001173 /* Skip psa decryption for null cipher */
1174 if ( transform->psa_alg != MBEDTLS_SSL_NULL_CIPHER )
1175 {
1176 status = psa_cipher_decrypt_setup( &cipher_op,
1177 transform->psa_key_dec, transform->psa_alg );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001178
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001179 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001180 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001181
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001182 status = psa_cipher_set_iv( &cipher_op, transform->iv_dec, transform->ivlen );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001183
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001184 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001185 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001186
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001187 status = psa_cipher_update( &cipher_op,
1188 data, rec->data_len,
1189 data, rec->data_len, &olen );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001190
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001191 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001192 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001193
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001194 status = psa_cipher_finish( &cipher_op,
1195 data + olen, rec->data_len - olen,
1196 &part_len );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001197
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001198 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001199 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001200
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001201 olen += part_len;
1202 } else {
1203 olen = rec->data_len;
1204 }
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001205#else
1206
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001207 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
1208 transform->iv_dec,
1209 transform->ivlen,
1210 data, rec->data_len,
1211 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001212 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001213 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001214 return( ret );
1215 }
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001216#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001217
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001218 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001219 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001220 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1221 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001222 }
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001223
Paul Bakker5121ce52009-01-03 21:22:43 +00001224 }
Paul Bakker68884e32013-01-07 18:20:04 +01001225 else
Hanno Beckerd086bf02021-03-22 13:01:27 +00001226#endif /* MBEDTLS_SSL_SOME_SUITES_USE_STREAM */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001227#if defined(MBEDTLS_GCM_C) || \
1228 defined(MBEDTLS_CCM_C) || \
1229 defined(MBEDTLS_CHACHAPOLY_C)
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001230#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekiele8847782022-01-24 23:19:21 +01001231 if ( PSA_ALG_IS_AEAD( transform->psa_alg ) )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001232#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001233 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001234 mode == MBEDTLS_MODE_CCM ||
1235 mode == MBEDTLS_MODE_CHACHAPOLY )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001236#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakkerca4ab492012-04-18 14:23:57 +00001237 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001238 unsigned char iv[12];
Hanno Beckerdf8be222020-05-21 15:30:57 +01001239 unsigned char *dynamic_iv;
1240 size_t dynamic_iv_len;
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001241#if defined(MBEDTLS_USE_PSA_CRYPTO)
1242 psa_status_t status;
1243#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakkerca4ab492012-04-18 14:23:57 +00001244
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001245 /*
Hanno Beckerdf8be222020-05-21 15:30:57 +01001246 * Extract dynamic part of nonce for AEAD decryption.
1247 *
1248 * Note: In the case of CCM and GCM in TLS 1.2, the dynamic
1249 * part of the IV is prepended to the ciphertext and
1250 * can be chosen freely - in particular, it need not
1251 * agree with the record sequence number.
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001252 */
Hanno Beckerdf8be222020-05-21 15:30:57 +01001253 dynamic_iv_len = sizeof( rec->ctr );
Hanno Becker17263802020-05-28 07:05:48 +01001254 if( ssl_transform_aead_dynamic_iv_is_explicit( transform ) == 1 )
Hanno Beckerdf8be222020-05-21 15:30:57 +01001255 {
1256 if( rec->data_len < dynamic_iv_len )
1257 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001258 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%" MBEDTLS_PRINTF_SIZET
1259 " ) < explicit_iv_len (%" MBEDTLS_PRINTF_SIZET ") ",
Hanno Beckerdf8be222020-05-21 15:30:57 +01001260 rec->data_len,
1261 dynamic_iv_len ) );
1262 return( MBEDTLS_ERR_SSL_INVALID_MAC );
1263 }
1264 dynamic_iv = data;
1265
1266 data += dynamic_iv_len;
1267 rec->data_offset += dynamic_iv_len;
1268 rec->data_len -= dynamic_iv_len;
1269 }
Hanno Becker17263802020-05-28 07:05:48 +01001270 else
1271 {
1272 dynamic_iv = rec->ctr;
1273 }
Hanno Beckerdf8be222020-05-21 15:30:57 +01001274
1275 /* Check that there's space for the authentication tag. */
1276 if( rec->data_len < transform->taglen )
1277 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001278 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%" MBEDTLS_PRINTF_SIZET
1279 ") < taglen (%" MBEDTLS_PRINTF_SIZET ") ",
Christian von Arnim883d3042020-12-01 11:58:29 +01001280 rec->data_len,
1281 transform->taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001282 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02001283 }
Hanno Beckerdf8be222020-05-21 15:30:57 +01001284 rec->data_len -= transform->taglen;
Paul Bakker68884e32013-01-07 18:20:04 +01001285
Hanno Beckerdf8be222020-05-21 15:30:57 +01001286 /*
1287 * Prepare nonce from dynamic and static parts.
1288 */
Hanno Becker17263802020-05-28 07:05:48 +01001289 ssl_build_record_nonce( iv, sizeof( iv ),
1290 transform->iv_dec,
1291 transform->fixed_ivlen,
1292 dynamic_iv,
1293 dynamic_iv_len );
Paul Bakker68884e32013-01-07 18:20:04 +01001294
Hanno Beckerdf8be222020-05-21 15:30:57 +01001295 /*
1296 * Build additional data for AEAD encryption.
1297 * This depends on the TLS version.
1298 */
Hanno Becker1cb6c2a2020-05-21 15:25:21 +01001299 ssl_extract_add_data_from_record( add_data, &add_data_len, rec,
Hanno Becker79e2d1b2021-03-22 11:42:19 +00001300 transform->minor_ver,
1301 transform->taglen );
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001302 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckercab87e62019-04-29 13:52:53 +01001303 add_data, add_data_len );
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001304
Hanno Beckerd96a6522019-07-10 13:55:25 +01001305 /* Because of the check above, we know that there are
1306 * explicit_iv_len Bytes preceeding data, and taglen
1307 * bytes following data + data_len. This justifies
Hanno Becker20016652019-07-10 11:44:13 +01001308 * the debug message and the invocation of
TRodziewicz18efb732021-04-29 23:12:19 +02001309 * mbedtls_cipher_auth_decrypt_ext() below. */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001310
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001311 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv, transform->ivlen );
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001312 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", data + rec->data_len,
Hanno Beckere694c3e2017-12-27 21:34:08 +00001313 transform->taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01001314
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001315 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001316 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001317 */
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001318#if defined(MBEDTLS_USE_PSA_CRYPTO)
1319 status = psa_aead_decrypt( transform->psa_key_dec,
1320 transform->psa_alg,
1321 iv, transform->ivlen,
1322 add_data, add_data_len,
1323 data, rec->data_len + transform->taglen,
1324 data, rec->buf_len - (data - rec->buf),
Przemyslaw Stekiel221b5272022-01-20 09:18:44 +01001325 &olen );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001326
1327 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001328 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001329#else
Manuel Pégourié-Gonnardf5cf71e2020-12-01 11:43:40 +01001330 if( ( ret = mbedtls_cipher_auth_decrypt_ext( &transform->cipher_ctx_dec,
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001331 iv, transform->ivlen,
Hanno Beckercab87e62019-04-29 13:52:53 +01001332 add_data, add_data_len,
Manuel Pégourié-Gonnardf5cf71e2020-12-01 11:43:40 +01001333 data, rec->data_len + transform->taglen, /* src */
1334 data, rec->buf_len - (data - rec->buf), &olen, /* dst */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001335 transform->taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00001336 {
TRodziewicz18efb732021-04-29 23:12:19 +02001337 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt_ext", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001339 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
1340 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001341
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001342 return( ret );
1343 }
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001344#endif /* MBEDTLS_USE_PSA_CRYPTO */
1345
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001346 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001347
Hanno Beckerd96a6522019-07-10 13:55:25 +01001348 /* Double-check that AEAD decryption doesn't change content length. */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001349 if( olen != rec->data_len )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001350 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1352 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001353 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00001354 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001355 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001356#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
Manuel Pégourié-Gonnard2df1f1f2020-07-09 12:11:39 +02001357#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001358#if defined(MBEDTLS_USE_PSA_CRYPTO)
1359 if ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING )
1360#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001361 if( mode == MBEDTLS_MODE_CBC )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001362#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker5121ce52009-01-03 21:22:43 +00001363 {
Paul Bakkere47b34b2013-02-27 14:48:00 +01001364 size_t minlen = 0;
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001365#if defined(MBEDTLS_USE_PSA_CRYPTO)
1366 psa_status_t status;
1367 size_t part_len;
1368 psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT;
1369#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001370
Paul Bakker5121ce52009-01-03 21:22:43 +00001371 /*
Paul Bakker45829992013-01-03 14:52:21 +01001372 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00001373 */
TRodziewicz0f82ec62021-05-12 17:49:18 +02001374#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
TRodziewicz345165c2021-07-06 13:42:11 +02001375 /* The ciphertext is prefixed with the CBC IV. */
1376 minlen += transform->ivlen;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001377#endif
Paul Bakker45829992013-01-03 14:52:21 +01001378
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001379 /* Size considerations:
1380 *
1381 * - The CBC cipher text must not be empty and hence
1382 * at least of size transform->ivlen.
1383 *
1384 * Together with the potential IV-prefix, this explains
1385 * the first of the two checks below.
1386 *
1387 * - The record must contain a MAC, either in plain or
1388 * encrypted, depending on whether Encrypt-then-MAC
1389 * is used or not.
1390 * - If it is, the message contains the IV-prefix,
1391 * the CBC ciphertext, and the MAC.
1392 * - If it is not, the padded plaintext, and hence
1393 * the CBC ciphertext, has at least length maclen + 1
1394 * because there is at least the padding length byte.
1395 *
1396 * As the CBC ciphertext is not empty, both cases give the
1397 * lower bound minlen + maclen + 1 on the record size, which
1398 * we test for in the second check below.
1399 */
1400 if( rec->data_len < minlen + transform->ivlen ||
1401 rec->data_len < minlen + transform->maclen + 1 )
Paul Bakker45829992013-01-03 14:52:21 +01001402 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001403 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%" MBEDTLS_PRINTF_SIZET
1404 ") < max( ivlen(%" MBEDTLS_PRINTF_SIZET
1405 "), maclen (%" MBEDTLS_PRINTF_SIZET ") "
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001406 "+ 1 ) ( + expl IV )", rec->data_len,
1407 transform->ivlen,
1408 transform->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001409 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01001410 }
1411
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001412 /*
1413 * Authenticate before decrypt if enabled
1414 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001415#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001416 if( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001417 {
Hanno Becker992b6872017-11-09 18:57:39 +00001418 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001419
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001420 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001421
Hanno Beckerd96a6522019-07-10 13:55:25 +01001422 /* Update data_len in tandem with add_data.
1423 *
1424 * The subtraction is safe because of the previous check
1425 * data_len >= minlen + maclen + 1.
1426 *
1427 * Afterwards, we know that data + data_len is followed by at
1428 * least maclen Bytes, which justifies the call to
Gabor Mezei90437e32021-10-20 11:59:27 +02001429 * mbedtls_ct_memcmp() below.
Hanno Beckerd96a6522019-07-10 13:55:25 +01001430 *
1431 * Further, we still know that data_len > minlen */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001432 rec->data_len -= transform->maclen;
Hanno Becker1cb6c2a2020-05-21 15:25:21 +01001433 ssl_extract_add_data_from_record( add_data, &add_data_len, rec,
Hanno Becker79e2d1b2021-03-22 11:42:19 +00001434 transform->minor_ver,
1435 transform->taglen );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001436
Hanno Beckerd96a6522019-07-10 13:55:25 +01001437 /* Calculate expected MAC. */
Hanno Beckercab87e62019-04-29 13:52:53 +01001438 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
1439 add_data_len );
Gilles Peskineecf6beb2021-12-10 21:35:10 +01001440 ret = mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
1441 add_data_len );
1442 if( ret != 0 )
1443 goto hmac_failed_etm_enabled;
1444 ret = mbedtls_md_hmac_update( &transform->md_ctx_dec,
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001445 data, rec->data_len );
Gilles Peskineecf6beb2021-12-10 21:35:10 +01001446 if( ret != 0 )
1447 goto hmac_failed_etm_enabled;
1448 ret = mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
1449 if( ret != 0 )
1450 goto hmac_failed_etm_enabled;
1451 ret = mbedtls_md_hmac_reset( &transform->md_ctx_dec );
1452 if( ret != 0 )
1453 goto hmac_failed_etm_enabled;
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001454
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001455 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len,
1456 transform->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00001457 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001458 transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001459
Hanno Beckerd96a6522019-07-10 13:55:25 +01001460 /* Compare expected MAC with MAC at the end of the record. */
Gabor Mezei90437e32021-10-20 11:59:27 +02001461 if( mbedtls_ct_memcmp( data + rec->data_len, mac_expect,
gabor-mezei-arm46025642021-07-19 15:19:19 +02001462 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001463 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001464 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Gilles Peskined5ba50e2021-12-10 21:33:21 +01001465 ret = MBEDTLS_ERR_SSL_INVALID_MAC;
1466 goto hmac_failed_etm_enabled;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001467 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001468 auth_done++;
Gilles Peskined5ba50e2021-12-10 21:33:21 +01001469
1470 hmac_failed_etm_enabled:
1471 mbedtls_platform_zeroize( mac_expect, transform->maclen );
1472 if( ret != 0 )
Gilles Peskineecf6beb2021-12-10 21:35:10 +01001473 {
1474 if( ret != MBEDTLS_ERR_SSL_INVALID_MAC )
1475 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_hmac_xxx", ret );
Gilles Peskined5ba50e2021-12-10 21:33:21 +01001476 return( ret );
Gilles Peskineecf6beb2021-12-10 21:35:10 +01001477 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001478 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001479#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001480
1481 /*
1482 * Check length sanity
1483 */
Hanno Beckerd96a6522019-07-10 13:55:25 +01001484
1485 /* We know from above that data_len > minlen >= 0,
1486 * so the following check in particular implies that
1487 * data_len >= minlen + ivlen ( = minlen or 2 * minlen ). */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001488 if( rec->data_len % transform->ivlen != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001489 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001490 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%" MBEDTLS_PRINTF_SIZET
1491 ") %% ivlen (%" MBEDTLS_PRINTF_SIZET ") != 0",
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001492 rec->data_len, transform->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001493 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001494 }
1495
TRodziewicz0f82ec62021-05-12 17:49:18 +02001496#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001497 /*
TRodziewicz0f82ec62021-05-12 17:49:18 +02001498 * Initialize for prepended IV for block cipher in TLS v1.2
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001499 */
TRodziewicz345165c2021-07-06 13:42:11 +02001500 /* Safe because data_len >= minlen + ivlen = 2 * ivlen. */
1501 memcpy( transform->iv_dec, data, transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001502
TRodziewicz345165c2021-07-06 13:42:11 +02001503 data += transform->ivlen;
1504 rec->data_offset += transform->ivlen;
1505 rec->data_len -= transform->ivlen;
TRodziewicz0f82ec62021-05-12 17:49:18 +02001506#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001507
Hanno Beckerd96a6522019-07-10 13:55:25 +01001508 /* We still have data_len % ivlen == 0 and data_len >= ivlen here. */
1509
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001510#if defined(MBEDTLS_USE_PSA_CRYPTO)
1511 status = psa_cipher_decrypt_setup( &cipher_op,
Przemyslaw Stekield4eab572022-01-17 16:20:10 +01001512 transform->psa_key_dec, transform->psa_alg );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001513
1514 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001515 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001516
1517 status = psa_cipher_set_iv( &cipher_op, transform->iv_dec, transform->ivlen );
1518
1519 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001520 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001521
1522 status = psa_cipher_update( &cipher_op,
1523 data, rec->data_len,
1524 data, rec->data_len, &olen );
1525
1526 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001527 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001528
1529 status = psa_cipher_finish( &cipher_op,
1530 data + olen, rec->data_len - olen,
1531 &part_len );
1532
1533 if( status != PSA_SUCCESS )
Przemyslaw Stekiel89dad932022-01-31 09:18:07 +01001534 return( ssl_psa_status_to_mbedtls( status ) );
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001535
1536 olen += part_len;
1537#else
1538
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001539 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
1540 transform->iv_dec, transform->ivlen,
1541 data, rec->data_len, data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001542 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001543 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02001544 return( ret );
1545 }
Przemyslaw Stekiel2e9711f2022-01-13 14:50:15 +01001546#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001547
Hanno Beckerd96a6522019-07-10 13:55:25 +01001548 /* Double-check that length hasn't changed during decryption. */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001549 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02001550 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001551 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1552 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02001553 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001554
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001555 /* Safe since data_len >= minlen + maclen + 1, so after having
1556 * subtracted at most minlen and maclen up to this point,
Hanno Beckerd96a6522019-07-10 13:55:25 +01001557 * data_len > 0 (because of data_len % ivlen == 0, it's actually
1558 * >= ivlen ). */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001559 padlen = data[rec->data_len - 1];
Paul Bakker45829992013-01-03 14:52:21 +01001560
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001561 if( auth_done == 1 )
1562 {
Gabor Mezei90437e32021-10-20 11:59:27 +02001563 const size_t mask = mbedtls_ct_size_mask_ge(
Manuel Pégourié-Gonnard2ddec432020-08-24 12:49:23 +02001564 rec->data_len,
1565 padlen + 1 );
1566 correct &= mask;
1567 padlen &= mask;
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001568 }
1569 else
Paul Bakker45829992013-01-03 14:52:21 +01001570 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001571#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001572 if( rec->data_len < transform->maclen + padlen + 1 )
1573 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001574 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%" MBEDTLS_PRINTF_SIZET
1575 ") < maclen (%" MBEDTLS_PRINTF_SIZET
1576 ") + padlen (%" MBEDTLS_PRINTF_SIZET ")",
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001577 rec->data_len,
1578 transform->maclen,
1579 padlen + 1 ) );
1580 }
Paul Bakkerd66f0702013-01-31 16:57:45 +01001581#endif
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001582
Gabor Mezei90437e32021-10-20 11:59:27 +02001583 const size_t mask = mbedtls_ct_size_mask_ge(
Manuel Pégourié-Gonnard2ddec432020-08-24 12:49:23 +02001584 rec->data_len,
1585 transform->maclen + padlen + 1 );
1586 correct &= mask;
1587 padlen &= mask;
Paul Bakker45829992013-01-03 14:52:21 +01001588 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001589
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001590 padlen++;
1591
1592 /* Regardless of the validity of the padding,
1593 * we have data_len >= padlen here. */
1594
TRodziewicz0f82ec62021-05-12 17:49:18 +02001595#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001596 /* The padding check involves a series of up to 256
1597 * consecutive memory reads at the end of the record
1598 * plaintext buffer. In order to hide the length and
1599 * validity of the padding, always perform exactly
1600 * `min(256,plaintext_len)` reads (but take into account
1601 * only the last `padlen` bytes for the padding check). */
1602 size_t pad_count = 0;
1603 volatile unsigned char* const check = data;
1604
1605 /* Index of first padding byte; it has been ensured above
1606 * that the subtraction is safe. */
1607 size_t const padding_idx = rec->data_len - padlen;
1608 size_t const num_checks = rec->data_len <= 256 ? rec->data_len : 256;
1609 size_t const start_idx = rec->data_len - num_checks;
1610 size_t idx;
1611
1612 for( idx = start_idx; idx < rec->data_len; idx++ )
Paul Bakker5121ce52009-01-03 21:22:43 +00001613 {
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001614 /* pad_count += (idx >= padding_idx) &&
1615 * (check[idx] == padlen - 1);
1616 */
Gabor Mezei90437e32021-10-20 11:59:27 +02001617 const size_t mask = mbedtls_ct_size_mask_ge( idx, padding_idx );
1618 const size_t equal = mbedtls_ct_size_bool_eq( check[idx],
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001619 padlen - 1 );
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001620 pad_count += mask & equal;
1621 }
Gabor Mezei90437e32021-10-20 11:59:27 +02001622 correct &= mbedtls_ct_size_bool_eq( pad_count, padlen );
Paul Bakkere47b34b2013-02-27 14:48:00 +01001623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001624#if defined(MBEDTLS_SSL_DEBUG_ALL)
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001625 if( padlen > 0 && correct == 0 )
1626 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01001627#endif
Gabor Mezei90437e32021-10-20 11:59:27 +02001628 padlen &= mbedtls_ct_size_mask( correct );
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001629
TRodziewicz0f82ec62021-05-12 17:49:18 +02001630#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001631
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001632 /* If the padding was found to be invalid, padlen == 0
1633 * and the subtraction is safe. If the padding was found valid,
1634 * padlen hasn't been changed and the previous assertion
1635 * data_len >= padlen still holds. */
1636 rec->data_len -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00001637 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001638 else
Manuel Pégourié-Gonnard2df1f1f2020-07-09 12:11:39 +02001639#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001640 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001641 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1642 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001643 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001644
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02001645#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001646 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001647 data, rec->data_len );
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02001648#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001649
1650 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001651 * Authenticate if not done yet.
1652 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00001653 */
Hanno Beckerfd86ca82020-11-30 08:54:23 +00001654#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001655 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001656 {
Hanno Becker992b6872017-11-09 18:57:39 +00001657 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard3c31afa2020-08-13 12:08:54 +02001658 unsigned char mac_peer[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01001659
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001660 /* If the initial value of padlen was such that
1661 * data_len < maclen + padlen + 1, then padlen
1662 * got reset to 1, and the initial check
1663 * data_len >= minlen + maclen + 1
1664 * guarantees that at this point we still
1665 * have at least data_len >= maclen.
1666 *
1667 * If the initial value of padlen was such that
1668 * data_len >= maclen + padlen + 1, then we have
1669 * subtracted either padlen + 1 (if the padding was correct)
1670 * or 0 (if the padding was incorrect) since then,
1671 * hence data_len >= maclen in any case.
1672 */
1673 rec->data_len -= transform->maclen;
Hanno Becker1cb6c2a2020-05-21 15:25:21 +01001674 ssl_extract_add_data_from_record( add_data, &add_data_len, rec,
Hanno Becker79e2d1b2021-03-22 11:42:19 +00001675 transform->minor_ver,
1676 transform->taglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00001677
TRodziewicz0f82ec62021-05-12 17:49:18 +02001678#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001679 /*
1680 * The next two sizes are the minimum and maximum values of
1681 * data_len over all padlen values.
1682 *
1683 * They're independent of padlen, since we previously did
1684 * data_len -= padlen.
1685 *
1686 * Note that max_len + maclen is never more than the buffer
1687 * length, as we previously did in_msglen -= maclen too.
1688 */
1689 const size_t max_len = rec->data_len + padlen;
1690 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
1691
Gabor Mezei90437e32021-10-20 11:59:27 +02001692 ret = mbedtls_ct_hmac( &transform->md_ctx_dec,
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001693 add_data, add_data_len,
1694 data, rec->data_len, min_len, max_len,
1695 mac_expect );
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001696 if( ret != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001697 {
Gabor Mezei90437e32021-10-20 11:59:27 +02001698 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ct_hmac", ret );
Gilles Peskined5ba50e2021-12-10 21:33:21 +01001699 goto hmac_failed_etm_disabled;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001700 }
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001701
Gabor Mezei90437e32021-10-20 11:59:27 +02001702 mbedtls_ct_memcpy_offset( mac_peer, data,
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001703 rec->data_len,
1704 min_len, max_len,
1705 transform->maclen );
TRodziewicz0f82ec62021-05-12 17:49:18 +02001706#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001707
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02001708#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker2e24c3b2017-12-27 21:28:58 +00001709 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, transform->maclen );
Manuel Pégourié-Gonnard3c31afa2020-08-13 12:08:54 +02001710 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", mac_peer, transform->maclen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02001711#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001712
Gabor Mezei90437e32021-10-20 11:59:27 +02001713 if( mbedtls_ct_memcmp( mac_peer, mac_expect,
gabor-mezei-arm46025642021-07-19 15:19:19 +02001714 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001715 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001716#if defined(MBEDTLS_SSL_DEBUG_ALL)
1717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01001718#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001719 correct = 0;
1720 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001721 auth_done++;
Gilles Peskined5ba50e2021-12-10 21:33:21 +01001722
1723 hmac_failed_etm_disabled:
1724 mbedtls_platform_zeroize( mac_peer, transform->maclen );
1725 mbedtls_platform_zeroize( mac_expect, transform->maclen );
1726 if( ret != 0 )
1727 return( ret );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001728 }
Hanno Beckerdd3ab132018-10-17 14:43:14 +01001729
1730 /*
1731 * Finally check the correct flag
1732 */
1733 if( correct == 0 )
1734 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Hanno Beckerfd86ca82020-11-30 08:54:23 +00001735#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001736
1737 /* Make extra sure authentication was performed, exactly once */
1738 if( auth_done != 1 )
1739 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001740 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1741 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001742 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001743
Ronald Cron6f135e12021-12-08 16:57:54 +01001744#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Beckerccc13d02020-05-04 12:30:04 +01001745 if( transform->minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
1746 {
1747 /* Remove inner padding and infer true content type. */
1748 ret = ssl_parse_inner_plaintext( data, &rec->data_len,
1749 &rec->type );
1750
1751 if( ret != 0 )
1752 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
1753 }
Ronald Cron6f135e12021-12-08 16:57:54 +01001754#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerccc13d02020-05-04 12:30:04 +01001755
Hanno Beckera0e20d02019-05-15 14:03:01 +01001756#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker8b3eb5a2019-04-29 17:31:37 +01001757 if( rec->cid_len != 0 )
1758 {
Hanno Becker581bc1b2020-05-04 12:20:03 +01001759 ret = ssl_parse_inner_plaintext( data, &rec->data_len,
1760 &rec->type );
Hanno Becker8b3eb5a2019-04-29 17:31:37 +01001761 if( ret != 0 )
1762 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
1763 }
Hanno Beckera0e20d02019-05-15 14:03:01 +01001764#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker8b3eb5a2019-04-29 17:31:37 +01001765
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001766 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001767
1768 return( 0 );
1769}
1770
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01001771#undef MAC_NONE
1772#undef MAC_PLAINTEXT
1773#undef MAC_CIPHERTEXT
1774
Paul Bakker5121ce52009-01-03 21:22:43 +00001775/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02001776 * Fill the input message buffer by appending data to it.
1777 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001778 *
1779 * If we return 0, is it guaranteed that (at least) nb_want bytes are
1780 * available (from this read and/or a previous one). Otherwise, an error code
1781 * is returned (possibly EOF or WANT_READ).
1782 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02001783 * With stream transport (TLS) on success ssl->in_left == nb_want, but
1784 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
1785 * since we always read a whole datagram at once.
1786 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02001787 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02001788 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00001789 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001790int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00001791{
Janos Follath865b3eb2019-12-16 11:46:15 +00001792 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker23986e52011-04-24 08:57:21 +00001793 size_t len;
Darryl Greenb33cc762019-11-28 14:29:44 +00001794#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1795 size_t in_buf_len = ssl->in_buf_len;
1796#else
1797 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1798#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001799
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001800 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001801
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02001802 if( ssl->f_recv == NULL && ssl->f_recv_timeout == NULL )
1803 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001804 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01001805 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001806 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02001807 }
1808
Darryl Greenb33cc762019-11-28 14:29:44 +00001809 if( nb_want > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02001810 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001811 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
1812 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02001813 }
1814
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001815#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001816 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00001817 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02001818 uint32_t timeout;
1819
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02001820 /*
1821 * The point is, we need to always read a full datagram at once, so we
1822 * sometimes read more then requested, and handle the additional data.
1823 * It could be the rest of the current record (while fetching the
1824 * header) and/or some other records in the same datagram.
1825 */
1826
1827 /*
1828 * Move to the next record in the already read datagram if applicable
1829 */
1830 if( ssl->next_record_offset != 0 )
1831 {
1832 if( ssl->in_left < ssl->next_record_offset )
1833 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001834 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1835 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02001836 }
1837
1838 ssl->in_left -= ssl->next_record_offset;
1839
1840 if( ssl->in_left != 0 )
1841 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001842 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %"
1843 MBEDTLS_PRINTF_SIZET,
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02001844 ssl->next_record_offset ) );
1845 memmove( ssl->in_hdr,
1846 ssl->in_hdr + ssl->next_record_offset,
1847 ssl->in_left );
1848 }
1849
1850 ssl->next_record_offset = 0;
1851 }
1852
Paul Elliottd48d5c62021-01-07 14:47:05 +00001853 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %" MBEDTLS_PRINTF_SIZET
1854 ", nb_want: %" MBEDTLS_PRINTF_SIZET,
Paul Bakker5121ce52009-01-03 21:22:43 +00001855 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001856
1857 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02001858 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001859 */
1860 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02001861 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001862 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001863 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02001864 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001865
1866 /*
Antonin Décimo36e89b52019-01-23 15:24:37 +01001867 * A record can't be split across datagrams. If we need to read but
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001868 * are not at the beginning of a new record, the caller did something
1869 * wrong.
1870 */
1871 if( ssl->in_left != 0 )
1872 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001873 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1874 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001875 }
1876
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001877 /*
1878 * Don't even try to read if time's out already.
1879 * This avoids by-passing the timer when repeatedly receiving messages
1880 * that will end up being dropped.
1881 */
Hanno Becker7876d122020-02-05 10:39:31 +00001882 if( mbedtls_ssl_check_timer( ssl ) != 0 )
Hanno Beckere65ce782017-05-22 14:47:48 +01001883 {
1884 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001885 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Hanno Beckere65ce782017-05-22 14:47:48 +01001886 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02001887 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02001888 {
Darryl Greenb33cc762019-11-28 14:29:44 +00001889 len = in_buf_len - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001891 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001892 timeout = ssl->handshake->retransmit_timeout;
1893 else
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001894 timeout = ssl->conf->read_timeout;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001895
Paul Elliott9f352112020-12-09 14:55:45 +00001896 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %lu ms", (unsigned long) timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001897
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02001898 if( ssl->f_recv_timeout != NULL )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001899 ret = ssl->f_recv_timeout( ssl->p_bio, ssl->in_hdr, len,
1900 timeout );
1901 else
1902 ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr, len );
1903
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001904 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001905
1906 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001907 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001908 }
1909
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001910 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02001911 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001912 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Hanno Becker0f57a652020-02-05 10:37:26 +00001913 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02001914
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001915 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02001916 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02001917 if( ssl_double_retransmit_timeout( ssl ) != 0 )
1918 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001919 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001920 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02001921 }
1922
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001923 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02001924 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001925 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02001926 return( ret );
1927 }
1928
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001929 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02001930 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001931#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001932 else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001933 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02001934 {
Hanno Becker786300f2020-02-05 10:46:40 +00001935 if( ( ret = mbedtls_ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02001936 {
Hanno Becker786300f2020-02-05 10:46:40 +00001937 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend_hello_request",
1938 ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02001939 return( ret );
1940 }
1941
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001942 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02001943 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001944#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02001945 }
1946
Paul Bakker5121ce52009-01-03 21:22:43 +00001947 if( ret < 0 )
1948 return( ret );
1949
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001950 ssl->in_left = ret;
1951 }
1952 else
1953#endif
1954 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001955 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %" MBEDTLS_PRINTF_SIZET
1956 ", nb_want: %" MBEDTLS_PRINTF_SIZET,
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02001957 ssl->in_left, nb_want ) );
1958
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001959 while( ssl->in_left < nb_want )
1960 {
1961 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001962
Hanno Becker7876d122020-02-05 10:39:31 +00001963 if( mbedtls_ssl_check_timer( ssl ) != 0 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001964 ret = MBEDTLS_ERR_SSL_TIMEOUT;
1965 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02001966 {
1967 if( ssl->f_recv_timeout != NULL )
1968 {
1969 ret = ssl->f_recv_timeout( ssl->p_bio,
1970 ssl->in_hdr + ssl->in_left, len,
1971 ssl->conf->read_timeout );
1972 }
1973 else
1974 {
1975 ret = ssl->f_recv( ssl->p_bio,
1976 ssl->in_hdr + ssl->in_left, len );
1977 }
1978 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001979
Paul Elliottd48d5c62021-01-07 14:47:05 +00001980 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %" MBEDTLS_PRINTF_SIZET
1981 ", nb_want: %" MBEDTLS_PRINTF_SIZET,
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02001982 ssl->in_left, nb_want ) );
1983 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001984
1985 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001986 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001987
1988 if( ret < 0 )
1989 return( ret );
1990
makise-homuraaf9513b2020-08-24 18:26:27 +03001991 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > (int)SIZE_MAX ) )
mohammad16035bd15cb2018-02-28 04:30:59 -08001992 {
Darryl Green11999bb2018-03-13 15:22:58 +00001993 MBEDTLS_SSL_DEBUG_MSG( 1,
Paul Elliottd48d5c62021-01-07 14:47:05 +00001994 ( "f_recv returned %d bytes but only %" MBEDTLS_PRINTF_SIZET " were requested",
Paul Elliott9f352112020-12-09 14:55:45 +00001995 ret, len ) );
mohammad16035bd15cb2018-02-28 04:30:59 -08001996 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1997 }
1998
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01001999 ssl->in_left += ret;
2000 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002001 }
2002
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002003 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002004
2005 return( 0 );
2006}
2007
2008/*
2009 * Flush any data not yet written
2010 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002011int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002012{
Janos Follath865b3eb2019-12-16 11:46:15 +00002013 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker04484622018-08-06 09:49:38 +01002014 unsigned char *buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00002015
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002016 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002017
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002018 if( ssl->f_send == NULL )
2019 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002020 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01002021 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002022 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002023 }
2024
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002025 /* Avoid incrementing counter if data is flushed */
2026 if( ssl->out_left == 0 )
2027 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002028 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002029 return( 0 );
2030 }
2031
Paul Bakker5121ce52009-01-03 21:22:43 +00002032 while( ssl->out_left > 0 )
2033 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00002034 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %" MBEDTLS_PRINTF_SIZET
2035 ", out_left: %" MBEDTLS_PRINTF_SIZET,
Hanno Becker5903de42019-05-03 14:46:38 +01002036 mbedtls_ssl_out_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002037
Hanno Becker2b1e3542018-08-06 11:19:13 +01002038 buf = ssl->out_hdr - ssl->out_left;
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002039 ret = ssl->f_send( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00002040
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002041 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002042
2043 if( ret <= 0 )
2044 return( ret );
2045
makise-homuraaf9513b2020-08-24 18:26:27 +03002046 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > (int)SIZE_MAX ) )
mohammad16034bbaeb42018-02-22 04:29:04 -08002047 {
Darryl Green11999bb2018-03-13 15:22:58 +00002048 MBEDTLS_SSL_DEBUG_MSG( 1,
Paul Elliottd48d5c62021-01-07 14:47:05 +00002049 ( "f_send returned %d bytes but only %" MBEDTLS_PRINTF_SIZET " bytes were sent",
Paul Elliott9f352112020-12-09 14:55:45 +00002050 ret, ssl->out_left ) );
mohammad16034bbaeb42018-02-22 04:29:04 -08002051 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2052 }
2053
Paul Bakker5121ce52009-01-03 21:22:43 +00002054 ssl->out_left -= ret;
2055 }
2056
Hanno Becker2b1e3542018-08-06 11:19:13 +01002057#if defined(MBEDTLS_SSL_PROTO_DTLS)
2058 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002059 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01002060 ssl->out_hdr = ssl->out_buf;
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002061 }
Hanno Becker2b1e3542018-08-06 11:19:13 +01002062 else
2063#endif
2064 {
2065 ssl->out_hdr = ssl->out_buf + 8;
2066 }
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00002067 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002068
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002069 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002070
2071 return( 0 );
2072}
2073
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002074/*
2075 * Functions to handle the DTLS retransmission state machine
2076 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002077#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002078/*
2079 * Append current handshake message to current outgoing flight
2080 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002081static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002082{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002083 mbedtls_ssl_flight_item *msg;
Hanno Becker3b235902018-08-06 09:54:53 +01002084 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
2085 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
2086 ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002087
2088 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02002089 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002090 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00002091 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %" MBEDTLS_PRINTF_SIZET " bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002092 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002093 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002094 }
2095
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02002096 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002097 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00002098 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %" MBEDTLS_PRINTF_SIZET " bytes failed",
2099 ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002100 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002101 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002102 }
2103
2104 /* Copy current handshake message with headers */
2105 memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
2106 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002107 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002108 msg->next = NULL;
2109
2110 /* Append to the current flight */
2111 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002112 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002113 else
2114 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002115 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002116 while( cur->next != NULL )
2117 cur = cur->next;
2118 cur->next = msg;
2119 }
2120
Hanno Becker3b235902018-08-06 09:54:53 +01002121 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002122 return( 0 );
2123}
2124
2125/*
2126 * Free the current flight of handshake messages
2127 */
Hanno Becker533ab5f2020-02-05 10:49:13 +00002128void mbedtls_ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002129{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002130 mbedtls_ssl_flight_item *cur = flight;
2131 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002132
2133 while( cur != NULL )
2134 {
2135 next = cur->next;
2136
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002137 mbedtls_free( cur->p );
2138 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002139
2140 cur = next;
2141 }
2142}
2143
2144/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002145 * Swap transform_out and out_ctr with the alternative ones
2146 */
Manuel Pégourié-Gonnarde07bc202020-02-26 09:53:42 +01002147static int ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002148{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002149 mbedtls_ssl_transform *tmp_transform;
Jerry Yuae0b2e22021-10-08 15:21:19 +08002150 unsigned char tmp_out_ctr[MBEDTLS_SSL_SEQUENCE_NUMBER_LEN];
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002151
2152 if( ssl->transform_out == ssl->handshake->alt_transform_out )
2153 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002154 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Manuel Pégourié-Gonnarde07bc202020-02-26 09:53:42 +01002155 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002156 }
2157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002158 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002159
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002160 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002161 tmp_transform = ssl->transform_out;
2162 ssl->transform_out = ssl->handshake->alt_transform_out;
2163 ssl->handshake->alt_transform_out = tmp_transform;
2164
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002165 /* Swap epoch + sequence_number */
Jerry Yud96a5c22021-09-29 17:46:51 +08002166 memcpy( tmp_out_ctr, ssl->cur_out_ctr, sizeof( tmp_out_ctr ) );
2167 memcpy( ssl->cur_out_ctr, ssl->handshake->alt_out_ctr,
2168 sizeof( ssl->cur_out_ctr ) );
2169 memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr,
2170 sizeof( ssl->handshake->alt_out_ctr ) );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002171
2172 /* Adjust to the newly activated transform */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00002173 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002174
Manuel Pégourié-Gonnarde07bc202020-02-26 09:53:42 +01002175 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002176}
2177
2178/*
2179 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002180 */
2181int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
2182{
2183 int ret = 0;
2184
2185 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
2186
2187 ret = mbedtls_ssl_flight_transmit( ssl );
2188
2189 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
2190
2191 return( ret );
2192}
2193
2194/*
2195 * Transmit or retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002196 *
2197 * Need to remember the current message in case flush_output returns
2198 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002199 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002200 */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002201int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002202{
Janos Follath865b3eb2019-12-16 11:46:15 +00002203 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002204 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002206 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002207 {
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02002208 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002209
2210 ssl->handshake->cur_msg = ssl->handshake->flight;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002211 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
Manuel Pégourié-Gonnarde07bc202020-02-26 09:53:42 +01002212 ret = ssl_swap_epochs( ssl );
2213 if( ret != 0 )
2214 return( ret );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002215
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002216 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002217 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002218
2219 while( ssl->handshake->cur_msg != NULL )
2220 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01002221 size_t max_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002222 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg;
Hanno Becker67bc7c32018-08-06 11:33:50 +01002223
Hanno Beckere1dcb032018-08-17 16:47:58 +01002224 int const is_finished =
2225 ( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
2226 cur->p[0] == MBEDTLS_SSL_HS_FINISHED );
2227
Hanno Becker04da1892018-08-14 13:22:10 +01002228 uint8_t const force_flush = ssl->disable_datagram_packing == 1 ?
2229 SSL_FORCE_FLUSH : SSL_DONT_FORCE_FLUSH;
2230
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002231 /* Swap epochs before sending Finished: we can't do it after
2232 * sending ChangeCipherSpec, in case write returns WANT_READ.
2233 * Must be done before copying, may change out_msg pointer */
Hanno Beckere1dcb032018-08-17 16:47:58 +01002234 if( is_finished && ssl->handshake->cur_msg_p == ( cur->p + 12 ) )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002235 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01002236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
Manuel Pégourié-Gonnarde07bc202020-02-26 09:53:42 +01002237 ret = ssl_swap_epochs( ssl );
2238 if( ret != 0 )
2239 return( ret );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002240 }
2241
Hanno Becker67bc7c32018-08-06 11:33:50 +01002242 ret = ssl_get_remaining_payload_in_datagram( ssl );
2243 if( ret < 0 )
2244 return( ret );
2245 max_frag_len = (size_t) ret;
2246
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002247 /* CCS is copied as is, while HS messages may need fragmentation */
2248 if( cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
2249 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01002250 if( max_frag_len == 0 )
2251 {
2252 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
2253 return( ret );
2254
2255 continue;
2256 }
2257
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002258 memcpy( ssl->out_msg, cur->p, cur->len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01002259 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002260 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002261
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002262 /* Update position inside current message */
2263 ssl->handshake->cur_msg_p += cur->len;
2264 }
2265 else
2266 {
2267 const unsigned char * const p = ssl->handshake->cur_msg_p;
2268 const size_t hs_len = cur->len - 12;
2269 const size_t frag_off = p - ( cur->p + 12 );
2270 const size_t rem_len = hs_len - frag_off;
Hanno Becker67bc7c32018-08-06 11:33:50 +01002271 size_t cur_hs_frag_len, max_hs_frag_len;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002272
Hanno Beckere1dcb032018-08-17 16:47:58 +01002273 if( ( max_frag_len < 12 ) || ( max_frag_len == 12 && hs_len != 0 ) )
Manuel Pégourié-Gonnarda1071a52018-08-20 11:56:14 +02002274 {
Hanno Beckere1dcb032018-08-17 16:47:58 +01002275 if( is_finished )
Manuel Pégourié-Gonnarde07bc202020-02-26 09:53:42 +01002276 {
2277 ret = ssl_swap_epochs( ssl );
2278 if( ret != 0 )
2279 return( ret );
2280 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002281
Hanno Becker67bc7c32018-08-06 11:33:50 +01002282 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
2283 return( ret );
2284
2285 continue;
2286 }
2287 max_hs_frag_len = max_frag_len - 12;
2288
2289 cur_hs_frag_len = rem_len > max_hs_frag_len ?
2290 max_hs_frag_len : rem_len;
2291
2292 if( frag_off == 0 && cur_hs_frag_len != hs_len )
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02002293 {
2294 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
Hanno Becker67bc7c32018-08-06 11:33:50 +01002295 (unsigned) cur_hs_frag_len,
2296 (unsigned) max_hs_frag_len ) );
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02002297 }
Manuel Pégourié-Gonnardb747c6c2018-08-12 13:28:53 +02002298
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002299 /* Messages are stored with handshake headers as if not fragmented,
2300 * copy beginning of headers then fill fragmentation fields.
2301 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
2302 memcpy( ssl->out_msg, cur->p, 6 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002303
Joe Subbiani5ecac212021-06-24 13:00:03 +01002304 ssl->out_msg[6] = MBEDTLS_BYTE_2( frag_off );
2305 ssl->out_msg[7] = MBEDTLS_BYTE_1( frag_off );
2306 ssl->out_msg[8] = MBEDTLS_BYTE_0( frag_off );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002307
Joe Subbiani5ecac212021-06-24 13:00:03 +01002308 ssl->out_msg[ 9] = MBEDTLS_BYTE_2( cur_hs_frag_len );
2309 ssl->out_msg[10] = MBEDTLS_BYTE_1( cur_hs_frag_len );
2310 ssl->out_msg[11] = MBEDTLS_BYTE_0( cur_hs_frag_len );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002311
2312 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl->out_msg, 12 );
2313
Hanno Becker3f7b9732018-08-28 09:53:25 +01002314 /* Copy the handshake message content and set records fields */
Hanno Becker67bc7c32018-08-06 11:33:50 +01002315 memcpy( ssl->out_msg + 12, p, cur_hs_frag_len );
2316 ssl->out_msglen = cur_hs_frag_len + 12;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002317 ssl->out_msgtype = cur->type;
2318
2319 /* Update position inside current message */
Hanno Becker67bc7c32018-08-06 11:33:50 +01002320 ssl->handshake->cur_msg_p += cur_hs_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002321 }
2322
2323 /* If done with the current message move to the next one if any */
2324 if( ssl->handshake->cur_msg_p >= cur->p + cur->len )
2325 {
2326 if( cur->next != NULL )
2327 {
2328 ssl->handshake->cur_msg = cur->next;
2329 ssl->handshake->cur_msg_p = cur->next->p + 12;
2330 }
2331 else
2332 {
2333 ssl->handshake->cur_msg = NULL;
2334 ssl->handshake->cur_msg_p = NULL;
2335 }
2336 }
2337
2338 /* Actually send the message out */
Hanno Becker04da1892018-08-14 13:22:10 +01002339 if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002340 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002341 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002342 return( ret );
2343 }
2344 }
2345
Hanno Becker67bc7c32018-08-06 11:33:50 +01002346 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
2347 return( ret );
2348
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02002349 /* Update state and set timer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002350 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
2351 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02002352 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002353 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002354 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Hanno Becker0f57a652020-02-05 10:37:26 +00002355 mbedtls_ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002356 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002357
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002358 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002359
2360 return( 0 );
2361}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002362
2363/*
2364 * To be called when the last message of an incoming flight is received.
2365 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002366void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002367{
2368 /* We won't need to resend that one any more */
Hanno Becker533ab5f2020-02-05 10:49:13 +00002369 mbedtls_ssl_flight_free( ssl->handshake->flight );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002370 ssl->handshake->flight = NULL;
2371 ssl->handshake->cur_msg = NULL;
2372
2373 /* The next incoming flight will start with this msg_seq */
2374 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
2375
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01002376 /* We don't want to remember CCS's across flight boundaries. */
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01002377 ssl->handshake->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01002378
Hanno Becker0271f962018-08-16 13:23:47 +01002379 /* Clear future message buffering structure. */
Hanno Becker533ab5f2020-02-05 10:49:13 +00002380 mbedtls_ssl_buffering_free( ssl );
Hanno Becker0271f962018-08-16 13:23:47 +01002381
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02002382 /* Cancel timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00002383 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002384
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002385 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2386 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002387 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002388 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002389 }
2390 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002391 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002392}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002393
2394/*
2395 * To be called when the last message of an outgoing flight is send.
2396 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002397void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002398{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02002399 ssl_reset_retransmit_timeout( ssl );
Hanno Becker0f57a652020-02-05 10:37:26 +00002400 mbedtls_ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002401
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002402 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2403 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002404 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002405 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002406 }
2407 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002408 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002409}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002410#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002411
Paul Bakker5121ce52009-01-03 21:22:43 +00002412/*
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002413 * Handshake layer functions
Paul Bakker5121ce52009-01-03 21:22:43 +00002414 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002415
2416/*
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002417 * Write (DTLS: or queue) current handshake (including CCS) message.
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002418 *
2419 * - fill in handshake headers
2420 * - update handshake checksum
2421 * - DTLS: save message for resending
2422 * - then pass to the record layer
2423 *
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002424 * DTLS: except for HelloRequest, messages are only queued, and will only be
2425 * actually sent when calling flight_transmit() or resend().
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002426 *
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002427 * Inputs:
2428 * - ssl->out_msglen: 4 + actual handshake message len
2429 * (4 is the size of handshake headers for TLS)
2430 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
2431 * - ssl->out_msg + 4: the handshake message body
2432 *
Manuel Pégourié-Gonnard065a2a32018-08-20 11:09:26 +02002433 * Outputs, ie state before passing to flight_append() or write_record():
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002434 * - ssl->out_msglen: the length of the record contents
2435 * (including handshake headers but excluding record headers)
2436 * - ssl->out_msg: the record contents (handshake headers + content)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002437 */
Hanno Beckerf3cce8b2021-08-07 14:29:49 +01002438int mbedtls_ssl_write_handshake_msg_ext( mbedtls_ssl_context *ssl,
2439 int update_checksum )
Paul Bakker5121ce52009-01-03 21:22:43 +00002440{
Janos Follath865b3eb2019-12-16 11:46:15 +00002441 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002442 const size_t hs_len = ssl->out_msglen - 4;
2443 const unsigned char hs_type = ssl->out_msg[0];
Paul Bakker5121ce52009-01-03 21:22:43 +00002444
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002445 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
2446
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002447 /*
2448 * Sanity checks
2449 */
Hanno Beckerc83d2b32018-08-22 16:05:47 +01002450 if( ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002451 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
2452 {
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002453 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2454 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002455 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002456
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002457 /* Whenever we send anything different from a
2458 * HelloRequest we should be in a handshake - double check. */
2459 if( ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2460 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) &&
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002461 ssl->handshake == NULL )
2462 {
2463 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2464 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2465 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002466
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002467#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002468 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002469 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002470 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002471 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002472 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2473 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002474 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002475#endif
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002476
Hanno Beckerb50a2532018-08-06 11:52:54 +01002477 /* Double-check that we did not exceed the bounds
2478 * of the outgoing record buffer.
2479 * This should never fail as the various message
2480 * writing functions must obey the bounds of the
2481 * outgoing record buffer, but better be safe.
2482 *
2483 * Note: We deliberately do not check for the MTU or MFL here.
2484 */
2485 if( ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN )
2486 {
2487 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
Paul Elliottd48d5c62021-01-07 14:47:05 +00002488 "size %" MBEDTLS_PRINTF_SIZET
2489 ", maximum %" MBEDTLS_PRINTF_SIZET,
Paul Elliott3891caf2020-12-17 18:42:40 +00002490 ssl->out_msglen,
2491 (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Hanno Beckerb50a2532018-08-06 11:52:54 +01002492 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2493 }
2494
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002495 /*
2496 * Fill handshake headers
2497 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002498 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002499 {
Joe Subbianifbeb6922021-07-16 14:27:50 +01002500 ssl->out_msg[1] = MBEDTLS_BYTE_2( hs_len );
2501 ssl->out_msg[2] = MBEDTLS_BYTE_1( hs_len );
2502 ssl->out_msg[3] = MBEDTLS_BYTE_0( hs_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00002503
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002504 /*
2505 * DTLS has additional fields in the Handshake layer,
2506 * between the length field and the actual payload:
2507 * uint16 message_seq;
2508 * uint24 fragment_offset;
2509 * uint24 fragment_length;
2510 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002511#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002512 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002513 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01002514 /* Make room for the additional DTLS fields */
Angus Grattond8213d02016-05-25 20:56:48 +10002515 if( MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8 )
Hanno Becker9648f8b2017-09-18 10:55:54 +01002516 {
2517 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
Paul Elliottd48d5c62021-01-07 14:47:05 +00002518 "size %" MBEDTLS_PRINTF_SIZET ", maximum %" MBEDTLS_PRINTF_SIZET,
Paul Elliott3891caf2020-12-17 18:42:40 +00002519 hs_len,
2520 (size_t) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
Hanno Becker9648f8b2017-09-18 10:55:54 +01002521 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2522 }
2523
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002524 memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002525 ssl->out_msglen += 8;
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002526
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02002527 /* Write message_seq and update it, except for HelloRequest */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002528 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02002529 {
Joe Subbiani6dd73642021-07-19 11:56:54 +01002530 MBEDTLS_PUT_UINT16_BE( ssl->handshake->out_msg_seq, ssl->out_msg, 4 );
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02002531 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02002532 }
2533 else
2534 {
2535 ssl->out_msg[4] = 0;
2536 ssl->out_msg[5] = 0;
2537 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01002538
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002539 /* Handshake hashes are computed without fragmentation,
2540 * so set frag_offset = 0 and frag_len = hs_len for now */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01002541 memset( ssl->out_msg + 6, 0x00, 3 );
2542 memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002543 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002544#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002545
Hanno Becker0207e532018-08-28 10:28:28 +01002546 /* Update running hashes of handshake messages seen */
Hanno Beckerf3cce8b2021-08-07 14:29:49 +01002547 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST && update_checksum != 0 )
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02002548 ssl->handshake->update_checksum( ssl, ssl->out_msg, ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00002549 }
2550
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002551 /* Either send now, or just save to be sent (and resent) later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002552#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002553 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002554 ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2555 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002556 {
2557 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
2558 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002559 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002560 return( ret );
2561 }
2562 }
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002563 else
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002564#endif
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002565 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01002566 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002567 {
2568 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2569 return( ret );
2570 }
2571 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002572
2573 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
2574
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002575 return( 0 );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002576}
2577
2578/*
2579 * Record layer functions
2580 */
2581
2582/*
2583 * Write current record.
2584 *
2585 * Uses:
2586 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
2587 * - ssl->out_msglen: length of the record content (excl headers)
2588 * - ssl->out_msg: record content
2589 */
Hanno Becker67bc7c32018-08-06 11:33:50 +01002590int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush )
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002591{
2592 int ret, done = 0;
2593 size_t len = ssl->out_msglen;
Hanno Becker67bc7c32018-08-06 11:33:50 +01002594 uint8_t flush = force_flush;
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002595
2596 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002597
Paul Bakker05ef8352012-05-08 09:17:57 +00002598 if( !done )
2599 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01002600 unsigned i;
2601 size_t protected_record_size;
Darryl Greenb33cc762019-11-28 14:29:44 +00002602#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
2603 size_t out_buf_len = ssl->out_buf_len;
2604#else
2605 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
2606#endif
Hanno Becker6430faf2019-05-08 11:57:13 +01002607 /* Skip writing the record content type to after the encryption,
2608 * as it may change when using the CID extension. */
Jerry Yu47413c22021-10-29 17:19:41 +08002609 int minor_ver = ssl->minor_ver;
Ronald Cron6f135e12021-12-08 16:57:54 +01002610#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu1ca80f72021-11-08 10:30:54 +08002611 /* TLS 1.3 still uses the TLS 1.2 version identifier
2612 * for backwards compatibility. */
Jerry Yu47413c22021-10-29 17:19:41 +08002613 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
2614 minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Ronald Cron6f135e12021-12-08 16:57:54 +01002615#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu47413c22021-10-29 17:19:41 +08002616 mbedtls_ssl_write_version( ssl->major_ver, minor_ver,
2617 ssl->conf->transport, ssl->out_hdr + 1 );
Hanno Becker6430faf2019-05-08 11:57:13 +01002618
Jerry Yuae0b2e22021-10-08 15:21:19 +08002619 memcpy( ssl->out_ctr, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
Joe Subbiani6dd73642021-07-19 11:56:54 +01002620 MBEDTLS_PUT_UINT16_BE( len, ssl->out_len, 0);
Paul Bakker05ef8352012-05-08 09:17:57 +00002621
Paul Bakker48916f92012-09-16 19:57:18 +00002622 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00002623 {
Hanno Becker9eddaeb2017-12-27 21:37:21 +00002624 mbedtls_record rec;
2625
2626 rec.buf = ssl->out_iv;
Darryl Greenb33cc762019-11-28 14:29:44 +00002627 rec.buf_len = out_buf_len - ( ssl->out_iv - ssl->out_buf );
Hanno Becker9eddaeb2017-12-27 21:37:21 +00002628 rec.data_len = ssl->out_msglen;
2629 rec.data_offset = ssl->out_msg - rec.buf;
2630
Jerry Yud96a5c22021-09-29 17:46:51 +08002631 memcpy( &rec.ctr[0], ssl->out_ctr, sizeof( rec.ctr ) );
Jerry Yu47413c22021-10-29 17:19:41 +08002632 mbedtls_ssl_write_version( ssl->major_ver, minor_ver,
Hanno Becker9eddaeb2017-12-27 21:37:21 +00002633 ssl->conf->transport, rec.ver );
2634 rec.type = ssl->out_msgtype;
2635
Hanno Beckera0e20d02019-05-15 14:03:01 +01002636#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker43c24b82019-05-01 09:45:57 +01002637 /* The CID is set by mbedtls_ssl_encrypt_buf(). */
Hanno Beckercab87e62019-04-29 13:52:53 +01002638 rec.cid_len = 0;
Hanno Beckera0e20d02019-05-15 14:03:01 +01002639#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckercab87e62019-04-29 13:52:53 +01002640
Hanno Beckera18d1322018-01-03 14:27:32 +00002641 if( ( ret = mbedtls_ssl_encrypt_buf( ssl, ssl->transform_out, &rec,
Hanno Becker9eddaeb2017-12-27 21:37:21 +00002642 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00002643 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002644 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00002645 return( ret );
2646 }
2647
Hanno Becker9eddaeb2017-12-27 21:37:21 +00002648 if( rec.data_offset != 0 )
2649 {
2650 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2651 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2652 }
2653
Hanno Becker6430faf2019-05-08 11:57:13 +01002654 /* Update the record content type and CID. */
2655 ssl->out_msgtype = rec.type;
Hanno Beckera0e20d02019-05-15 14:03:01 +01002656#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID )
Hanno Beckerf9c6a4b2019-05-03 14:34:53 +01002657 memcpy( ssl->out_cid, rec.cid, rec.cid_len );
Hanno Beckera0e20d02019-05-15 14:03:01 +01002658#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker78f839d2019-03-14 12:56:23 +00002659 ssl->out_msglen = len = rec.data_len;
Joe Subbiani6dd73642021-07-19 11:56:54 +01002660 MBEDTLS_PUT_UINT16_BE( rec.data_len, ssl->out_len, 0 );
Paul Bakker05ef8352012-05-08 09:17:57 +00002661 }
2662
Hanno Becker5903de42019-05-03 14:46:38 +01002663 protected_record_size = len + mbedtls_ssl_out_hdr_len( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01002664
2665#if defined(MBEDTLS_SSL_PROTO_DTLS)
2666 /* In case of DTLS, double-check that we don't exceed
2667 * the remaining space in the datagram. */
2668 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2669 {
Hanno Becker554b0af2018-08-22 20:33:41 +01002670 ret = ssl_get_remaining_space_in_datagram( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01002671 if( ret < 0 )
2672 return( ret );
2673
2674 if( protected_record_size > (size_t) ret )
2675 {
2676 /* Should never happen */
2677 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2678 }
2679 }
2680#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker05ef8352012-05-08 09:17:57 +00002681
Hanno Becker6430faf2019-05-08 11:57:13 +01002682 /* Now write the potentially updated record content type. */
2683 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
2684
Paul Elliott9f352112020-12-09 14:55:45 +00002685 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %u, "
Paul Elliottd48d5c62021-01-07 14:47:05 +00002686 "version = [%u:%u], msglen = %" MBEDTLS_PRINTF_SIZET,
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01002687 ssl->out_hdr[0], ssl->out_hdr[1],
2688 ssl->out_hdr[2], len ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00002689
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002690 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01002691 ssl->out_hdr, protected_record_size );
Hanno Becker2b1e3542018-08-06 11:19:13 +01002692
2693 ssl->out_left += protected_record_size;
2694 ssl->out_hdr += protected_record_size;
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00002695 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_out );
Hanno Becker2b1e3542018-08-06 11:19:13 +01002696
Hanno Beckerdd772292020-02-05 10:38:31 +00002697 for( i = 8; i > mbedtls_ssl_ep_len( ssl ); i-- )
Hanno Becker04484622018-08-06 09:49:38 +01002698 if( ++ssl->cur_out_ctr[i - 1] != 0 )
2699 break;
2700
2701 /* The loop goes to its end iff the counter is wrapping */
Hanno Beckerdd772292020-02-05 10:38:31 +00002702 if( i == mbedtls_ssl_ep_len( ssl ) )
Hanno Becker04484622018-08-06 09:49:38 +01002703 {
2704 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
2705 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
2706 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002707 }
2708
Hanno Becker67bc7c32018-08-06 11:33:50 +01002709#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker47db8772018-08-21 13:32:13 +01002710 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2711 flush == SSL_DONT_FORCE_FLUSH )
Hanno Becker67bc7c32018-08-06 11:33:50 +01002712 {
Hanno Becker1f5a15d2018-08-21 13:31:31 +01002713 size_t remaining;
2714 ret = ssl_get_remaining_payload_in_datagram( ssl );
2715 if( ret < 0 )
2716 {
2717 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
2718 ret );
2719 return( ret );
2720 }
2721
2722 remaining = (size_t) ret;
Hanno Becker67bc7c32018-08-06 11:33:50 +01002723 if( remaining == 0 )
Hanno Beckerf0da6672018-08-28 09:55:10 +01002724 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01002725 flush = SSL_FORCE_FLUSH;
Hanno Beckerf0da6672018-08-28 09:55:10 +01002726 }
Hanno Becker67bc7c32018-08-06 11:33:50 +01002727 else
2728 {
Hanno Becker513815a2018-08-20 11:56:09 +01002729 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining ) );
Hanno Becker67bc7c32018-08-06 11:33:50 +01002730 }
2731 }
2732#endif /* MBEDTLS_SSL_PROTO_DTLS */
2733
2734 if( ( flush == SSL_FORCE_FLUSH ) &&
2735 ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002736 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002737 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002738 return( ret );
2739 }
2740
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002741 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002742
2743 return( 0 );
2744}
2745
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002746#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckere25e3b72018-08-16 09:30:53 +01002747
2748static int ssl_hs_is_proper_fragment( mbedtls_ssl_context *ssl )
2749{
2750 if( ssl->in_msglen < ssl->in_hslen ||
2751 memcmp( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
2752 memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
2753 {
2754 return( 1 );
2755 }
2756 return( 0 );
2757}
Hanno Becker44650b72018-08-16 12:51:11 +01002758
Hanno Beckercd9dcda2018-08-28 17:18:56 +01002759static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01002760{
2761 return( ( ssl->in_msg[9] << 16 ) |
2762 ( ssl->in_msg[10] << 8 ) |
2763 ssl->in_msg[11] );
2764}
2765
Hanno Beckercd9dcda2018-08-28 17:18:56 +01002766static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01002767{
2768 return( ( ssl->in_msg[6] << 16 ) |
2769 ( ssl->in_msg[7] << 8 ) |
2770 ssl->in_msg[8] );
2771}
2772
Hanno Beckercd9dcda2018-08-28 17:18:56 +01002773static int ssl_check_hs_header( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01002774{
2775 uint32_t msg_len, frag_off, frag_len;
2776
2777 msg_len = ssl_get_hs_total_len( ssl );
2778 frag_off = ssl_get_hs_frag_off( ssl );
2779 frag_len = ssl_get_hs_frag_len( ssl );
2780
2781 if( frag_off > msg_len )
2782 return( -1 );
2783
2784 if( frag_len > msg_len - frag_off )
2785 return( -1 );
2786
2787 if( frag_len + 12 > ssl->in_msglen )
2788 return( -1 );
2789
2790 return( 0 );
2791}
2792
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002793/*
2794 * Mark bits in bitmask (used for DTLS HS reassembly)
2795 */
2796static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
2797{
2798 unsigned int start_bits, end_bits;
2799
2800 start_bits = 8 - ( offset % 8 );
2801 if( start_bits != 8 )
2802 {
2803 size_t first_byte_idx = offset / 8;
2804
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02002805 /* Special case */
2806 if( len <= start_bits )
2807 {
2808 for( ; len != 0; len-- )
2809 mask[first_byte_idx] |= 1 << ( start_bits - len );
2810
2811 /* Avoid potential issues with offset or len becoming invalid */
2812 return;
2813 }
2814
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002815 offset += start_bits; /* Now offset % 8 == 0 */
2816 len -= start_bits;
2817
2818 for( ; start_bits != 0; start_bits-- )
2819 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
2820 }
2821
2822 end_bits = len % 8;
2823 if( end_bits != 0 )
2824 {
2825 size_t last_byte_idx = ( offset + len ) / 8;
2826
2827 len -= end_bits; /* Now len % 8 == 0 */
2828
2829 for( ; end_bits != 0; end_bits-- )
2830 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
2831 }
2832
2833 memset( mask + offset / 8, 0xFF, len / 8 );
2834}
2835
2836/*
2837 * Check that bitmask is full
2838 */
2839static int ssl_bitmask_check( unsigned char *mask, size_t len )
2840{
2841 size_t i;
2842
2843 for( i = 0; i < len / 8; i++ )
2844 if( mask[i] != 0xFF )
2845 return( -1 );
2846
2847 for( i = 0; i < len % 8; i++ )
2848 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
2849 return( -1 );
2850
2851 return( 0 );
2852}
2853
Hanno Becker56e205e2018-08-16 09:06:12 +01002854/* msg_len does not include the handshake header */
Hanno Becker65dc8852018-08-23 09:40:49 +01002855static size_t ssl_get_reassembly_buffer_size( size_t msg_len,
Hanno Becker2a97b0e2018-08-21 15:47:49 +01002856 unsigned add_bitmap )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002857{
Hanno Becker56e205e2018-08-16 09:06:12 +01002858 size_t alloc_len;
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002859
Hanno Becker56e205e2018-08-16 09:06:12 +01002860 alloc_len = 12; /* Handshake header */
2861 alloc_len += msg_len; /* Content buffer */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002862
Hanno Beckerd07df862018-08-16 09:14:58 +01002863 if( add_bitmap )
2864 alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap */
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002865
Hanno Becker2a97b0e2018-08-21 15:47:49 +01002866 return( alloc_len );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002867}
Hanno Becker56e205e2018-08-16 09:06:12 +01002868
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002869#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002870
Hanno Beckercd9dcda2018-08-28 17:18:56 +01002871static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl )
Hanno Becker12555c62018-08-16 12:47:53 +01002872{
2873 return( ( ssl->in_msg[1] << 16 ) |
2874 ( ssl->in_msg[2] << 8 ) |
2875 ssl->in_msg[3] );
2876}
Hanno Beckere25e3b72018-08-16 09:30:53 +01002877
Simon Butcher99000142016-10-13 17:21:01 +01002878int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01002879{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002880 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02002881 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00002882 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %" MBEDTLS_PRINTF_SIZET,
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02002883 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002884 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02002885 }
2886
Hanno Becker12555c62018-08-16 12:47:53 +01002887 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01002888
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002889 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Paul Elliottd48d5c62021-01-07 14:47:05 +00002890 " %" MBEDTLS_PRINTF_SIZET ", type = %u, hslen = %" MBEDTLS_PRINTF_SIZET,
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01002891 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01002892
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002893#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002894 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01002895 {
Janos Follath865b3eb2019-12-16 11:46:15 +00002896 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02002897 unsigned int recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002898
Hanno Becker44650b72018-08-16 12:51:11 +01002899 if( ssl_check_hs_header( ssl ) != 0 )
2900 {
2901 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
2902 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
2903 }
2904
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02002905 if( ssl->handshake != NULL &&
Hanno Beckerc76c6192017-06-06 10:03:17 +01002906 ( ( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
2907 recv_msg_seq != ssl->handshake->in_msg_seq ) ||
2908 ( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
2909 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) ) )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02002910 {
Hanno Becker9e1ec222018-08-15 15:54:43 +01002911 if( recv_msg_seq > ssl->handshake->in_msg_seq )
2912 {
2913 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
2914 recv_msg_seq,
2915 ssl->handshake->in_msg_seq ) );
2916 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
2917 }
2918
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02002919 /* Retransmit only on last message from previous flight, to avoid
2920 * too many retransmissions.
2921 * Besides, No sane server ever retransmits HelloVerifyRequest */
2922 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002923 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002924 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002925 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Paul Elliott9f352112020-12-09 14:55:45 +00002926 "message_seq = %u, start_of_flight = %u",
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002927 recv_msg_seq,
2928 ssl->handshake->in_flight_start_seq ) );
2929
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002930 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002931 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002932 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002933 return( ret );
2934 }
2935 }
2936 else
2937 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002938 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Paul Elliott9f352112020-12-09 14:55:45 +00002939 "message_seq = %u, expected = %u",
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002940 recv_msg_seq,
2941 ssl->handshake->in_msg_seq ) );
2942 }
2943
Hanno Becker90333da2017-10-10 11:27:13 +01002944 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02002945 }
2946 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002947
Hanno Becker6d97ef52018-08-16 13:09:04 +01002948 /* Message reassembly is handled alongside buffering of future
2949 * messages; the commonality is that both handshake fragments and
Hanno Becker83ab41c2018-08-28 17:19:38 +01002950 * future messages cannot be forwarded immediately to the
Hanno Becker6d97ef52018-08-16 13:09:04 +01002951 * handshake logic layer. */
Hanno Beckere25e3b72018-08-16 09:30:53 +01002952 if( ssl_hs_is_proper_fragment( ssl ) == 1 )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002953 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002954 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Hanno Becker6d97ef52018-08-16 13:09:04 +01002955 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002956 }
2957 }
2958 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002959#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02002960 /* With TLS we don't handle fragmentation (for now) */
2961 if( ssl->in_msglen < ssl->in_hslen )
2962 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002963 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
2964 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01002965 }
2966
Simon Butcher99000142016-10-13 17:21:01 +01002967 return( 0 );
2968}
2969
2970void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
2971{
Hanno Becker0271f962018-08-16 13:23:47 +01002972 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Simon Butcher99000142016-10-13 17:21:01 +01002973
Hanno Becker0271f962018-08-16 13:23:47 +01002974 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && hs != NULL )
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02002975 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01002976 ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02002977 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01002978
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02002979 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002980#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002981 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02002982 ssl->handshake != NULL )
2983 {
Hanno Becker0271f962018-08-16 13:23:47 +01002984 unsigned offset;
2985 mbedtls_ssl_hs_buffer *hs_buf;
Hanno Beckere25e3b72018-08-16 09:30:53 +01002986
Hanno Becker0271f962018-08-16 13:23:47 +01002987 /* Increment handshake sequence number */
2988 hs->in_msg_seq++;
2989
2990 /*
2991 * Clear up handshake buffering and reassembly structure.
2992 */
2993
2994 /* Free first entry */
Hanno Beckere605b192018-08-21 15:59:07 +01002995 ssl_buffering_free_slot( ssl, 0 );
Hanno Becker0271f962018-08-16 13:23:47 +01002996
2997 /* Shift all other entries */
Hanno Beckere605b192018-08-21 15:59:07 +01002998 for( offset = 0, hs_buf = &hs->buffering.hs[0];
2999 offset + 1 < MBEDTLS_SSL_MAX_BUFFERED_HS;
Hanno Becker0271f962018-08-16 13:23:47 +01003000 offset++, hs_buf++ )
3001 {
3002 *hs_buf = *(hs_buf + 1);
3003 }
3004
3005 /* Create a fresh last entry */
3006 memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003007 }
3008#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003009}
3010
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003011/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003012 * DTLS anti-replay: RFC 6347 4.1.2.6
3013 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003014 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
3015 * Bit n is set iff record number in_window_top - n has been seen.
3016 *
3017 * Usually, in_window_top is the last record number seen and the lsb of
3018 * in_window is set. The only exception is the initial state (record number 0
3019 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003020 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003021#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Hanno Becker7e8e6a62020-02-05 10:45:48 +00003022void mbedtls_ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003023{
3024 ssl->in_window_top = 0;
3025 ssl->in_window = 0;
3026}
3027
3028static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
3029{
3030 return( ( (uint64_t) buf[0] << 40 ) |
3031 ( (uint64_t) buf[1] << 32 ) |
3032 ( (uint64_t) buf[2] << 24 ) |
3033 ( (uint64_t) buf[3] << 16 ) |
3034 ( (uint64_t) buf[4] << 8 ) |
3035 ( (uint64_t) buf[5] ) );
3036}
3037
Arto Kinnunen7f8089b2019-10-29 11:13:33 +02003038static int mbedtls_ssl_dtls_record_replay_check( mbedtls_ssl_context *ssl, uint8_t *record_in_ctr )
3039{
Janos Follath865b3eb2019-12-16 11:46:15 +00003040 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Arto Kinnunen7f8089b2019-10-29 11:13:33 +02003041 unsigned char *original_in_ctr;
3042
3043 // save original in_ctr
3044 original_in_ctr = ssl->in_ctr;
3045
3046 // use counter from record
3047 ssl->in_ctr = record_in_ctr;
3048
3049 ret = mbedtls_ssl_dtls_replay_check( (mbedtls_ssl_context const *) ssl );
3050
3051 // restore the counter
3052 ssl->in_ctr = original_in_ctr;
3053
3054 return ret;
3055}
3056
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003057/*
3058 * Return 0 if sequence number is acceptable, -1 otherwise
3059 */
Hanno Becker0183d692019-07-12 08:50:37 +01003060int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context const *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003061{
3062 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
3063 uint64_t bit;
3064
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003065 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003066 return( 0 );
3067
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003068 if( rec_seqnum > ssl->in_window_top )
3069 return( 0 );
3070
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003071 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003072
3073 if( bit >= 64 )
3074 return( -1 );
3075
3076 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
3077 return( -1 );
3078
3079 return( 0 );
3080}
3081
3082/*
3083 * Update replay window on new validated record
3084 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003085void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003086{
3087 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
3088
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003089 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003090 return;
3091
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003092 if( rec_seqnum > ssl->in_window_top )
3093 {
3094 /* Update window_top and the contents of the window */
3095 uint64_t shift = rec_seqnum - ssl->in_window_top;
3096
3097 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003098 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003099 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003100 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003101 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003102 ssl->in_window |= 1;
3103 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003104
3105 ssl->in_window_top = rec_seqnum;
3106 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003107 else
3108 {
3109 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003110 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003111
3112 if( bit < 64 ) /* Always true, but be extra sure */
3113 ssl->in_window |= (uint64_t) 1 << bit;
3114 }
3115}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003116#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003117
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02003118#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003119/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003120 * Without any SSL context, check if a datagram looks like a ClientHello with
3121 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01003122 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003123 *
3124 * - if cookie is valid, return 0
3125 * - if ClientHello looks superficially valid but cookie is not,
3126 * fill obuf and set olen, then
3127 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
3128 * - otherwise return a specific error code
3129 */
3130static int ssl_check_dtls_clihlo_cookie(
3131 mbedtls_ssl_cookie_write_t *f_cookie_write,
3132 mbedtls_ssl_cookie_check_t *f_cookie_check,
3133 void *p_cookie,
3134 const unsigned char *cli_id, size_t cli_id_len,
3135 const unsigned char *in, size_t in_len,
3136 unsigned char *obuf, size_t buf_len, size_t *olen )
3137{
3138 size_t sid_len, cookie_len;
3139 unsigned char *p;
3140
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003141 /*
3142 * Structure of ClientHello with record and handshake headers,
3143 * and expected values. We don't need to check a lot, more checks will be
3144 * done when actually parsing the ClientHello - skipping those checks
3145 * avoids code duplication and does not make cookie forging any easier.
3146 *
3147 * 0-0 ContentType type; copied, must be handshake
3148 * 1-2 ProtocolVersion version; copied
3149 * 3-4 uint16 epoch; copied, must be 0
3150 * 5-10 uint48 sequence_number; copied
3151 * 11-12 uint16 length; (ignored)
3152 *
3153 * 13-13 HandshakeType msg_type; (ignored)
3154 * 14-16 uint24 length; (ignored)
3155 * 17-18 uint16 message_seq; copied
3156 * 19-21 uint24 fragment_offset; copied, must be 0
3157 * 22-24 uint24 fragment_length; (ignored)
3158 *
3159 * 25-26 ProtocolVersion client_version; (ignored)
3160 * 27-58 Random random; (ignored)
3161 * 59-xx SessionID session_id; 1 byte len + sid_len content
3162 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
3163 * ...
3164 *
3165 * Minimum length is 61 bytes.
3166 */
3167 if( in_len < 61 ||
3168 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
3169 in[3] != 0 || in[4] != 0 ||
3170 in[19] != 0 || in[20] != 0 || in[21] != 0 )
3171 {
Hanno Becker90d59dd2021-06-24 11:17:13 +01003172 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003173 }
3174
3175 sid_len = in[59];
3176 if( sid_len > in_len - 61 )
Hanno Becker90d59dd2021-06-24 11:17:13 +01003177 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003178
3179 cookie_len = in[60 + sid_len];
3180 if( cookie_len > in_len - 60 )
Hanno Becker90d59dd2021-06-24 11:17:13 +01003181 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003182
3183 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
3184 cli_id, cli_id_len ) == 0 )
3185 {
3186 /* Valid cookie */
3187 return( 0 );
3188 }
3189
3190 /*
3191 * If we get here, we've got an invalid cookie, let's prepare HVR.
3192 *
3193 * 0-0 ContentType type; copied
3194 * 1-2 ProtocolVersion version; copied
3195 * 3-4 uint16 epoch; copied
3196 * 5-10 uint48 sequence_number; copied
3197 * 11-12 uint16 length; olen - 13
3198 *
3199 * 13-13 HandshakeType msg_type; hello_verify_request
3200 * 14-16 uint24 length; olen - 25
3201 * 17-18 uint16 message_seq; copied
3202 * 19-21 uint24 fragment_offset; copied
3203 * 22-24 uint24 fragment_length; olen - 25
3204 *
3205 * 25-26 ProtocolVersion server_version; 0xfe 0xff
3206 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
3207 *
3208 * Minimum length is 28.
3209 */
3210 if( buf_len < 28 )
3211 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3212
3213 /* Copy most fields and adapt others */
3214 memcpy( obuf, in, 25 );
3215 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
3216 obuf[25] = 0xfe;
3217 obuf[26] = 0xff;
3218
3219 /* Generate and write actual cookie */
3220 p = obuf + 28;
3221 if( f_cookie_write( p_cookie,
3222 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
3223 {
3224 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3225 }
3226
3227 *olen = p - obuf;
3228
3229 /* Go back and fill length fields */
3230 obuf[27] = (unsigned char)( *olen - 28 );
3231
Joe Subbianifbeb6922021-07-16 14:27:50 +01003232 obuf[14] = obuf[22] = MBEDTLS_BYTE_2( *olen - 25 );
3233 obuf[15] = obuf[23] = MBEDTLS_BYTE_1( *olen - 25 );
3234 obuf[16] = obuf[24] = MBEDTLS_BYTE_0( *olen - 25 );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003235
Joe Subbiani6dd73642021-07-19 11:56:54 +01003236 MBEDTLS_PUT_UINT16_BE( *olen - 13, obuf, 11 );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003237
3238 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
3239}
3240
3241/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003242 * Handle possible client reconnect with the same UDP quadruplet
3243 * (RFC 6347 Section 4.2.8).
3244 *
3245 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
3246 * that looks like a ClientHello.
3247 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003248 * - if the input looks like a ClientHello without cookies,
Manuel Pégourié-Gonnard824655c2020-03-11 12:51:42 +01003249 * send back HelloVerifyRequest, then return 0
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003250 * - if the input looks like a ClientHello with a valid cookie,
3251 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02003252 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003253 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003254 *
Manuel Pégourié-Gonnard824655c2020-03-11 12:51:42 +01003255 * This function is called (through ssl_check_client_reconnect()) when an
3256 * unexpected record is found in ssl_get_next_record(), which will discard the
3257 * record if we return 0, and bubble up the return value otherwise (this
3258 * includes the case of MBEDTLS_ERR_SSL_CLIENT_RECONNECT and of unexpected
3259 * errors, and is the right thing to do in both cases).
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003260 */
3261static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
3262{
Janos Follath865b3eb2019-12-16 11:46:15 +00003263 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003264 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003265
Hanno Becker2fddd372019-07-10 14:37:41 +01003266 if( ssl->conf->f_cookie_write == NULL ||
3267 ssl->conf->f_cookie_check == NULL )
3268 {
3269 /* If we can't use cookies to verify reachability of the peer,
3270 * drop the record. */
Manuel Pégourié-Gonnard243d70f2020-03-31 12:07:47 +02003271 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no cookie callbacks, "
3272 "can't check reconnect validity" ) );
Hanno Becker2fddd372019-07-10 14:37:41 +01003273 return( 0 );
3274 }
3275
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003276 ret = ssl_check_dtls_clihlo_cookie(
3277 ssl->conf->f_cookie_write,
3278 ssl->conf->f_cookie_check,
3279 ssl->conf->p_cookie,
3280 ssl->cli_id, ssl->cli_id_len,
3281 ssl->in_buf, ssl->in_left,
Angus Grattond8213d02016-05-25 20:56:48 +10003282 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003283
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003284 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
3285
3286 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003287 {
Manuel Pégourié-Gonnard243d70f2020-03-31 12:07:47 +02003288 int send_ret;
3289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
3290 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
3291 ssl->out_buf, len );
Brian J Murray1903fb32016-11-06 04:45:15 -08003292 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003293 * If the error is permanent we'll catch it later,
3294 * if it's not, then hopefully it'll work next time. */
Manuel Pégourié-Gonnard243d70f2020-03-31 12:07:47 +02003295 send_ret = ssl->f_send( ssl->p_bio, ssl->out_buf, len );
3296 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", send_ret );
3297 (void) send_ret;
3298
Manuel Pégourié-Gonnard824655c2020-03-11 12:51:42 +01003299 return( 0 );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003300 }
3301
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003302 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003303 {
Manuel Pégourié-Gonnard243d70f2020-03-31 12:07:47 +02003304 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
Hanno Becker43aefe22020-02-05 10:44:56 +00003305 if( ( ret = mbedtls_ssl_session_reset_int( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003306 {
3307 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
3308 return( ret );
3309 }
3310
3311 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003312 }
3313
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003314 return( ret );
3315}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02003316#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003317
Hanno Beckerf661c9c2019-05-03 13:25:54 +01003318static int ssl_check_record_type( uint8_t record_type )
3319{
3320 if( record_type != MBEDTLS_SSL_MSG_HANDSHAKE &&
3321 record_type != MBEDTLS_SSL_MSG_ALERT &&
3322 record_type != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
3323 record_type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
3324 {
3325 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3326 }
3327
3328 return( 0 );
3329}
3330
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003331/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003332 * ContentType type;
3333 * ProtocolVersion version;
3334 * uint16 epoch; // DTLS only
3335 * uint48 sequence_number; // DTLS only
3336 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003337 *
3338 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00003339 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003340 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
3341 *
3342 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00003343 * 1. proceed with the record if this function returns 0
3344 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
3345 * 3. return CLIENT_RECONNECT if this function return that value
3346 * 4. drop the whole datagram if this function returns anything else.
3347 * Point 2 is needed when the peer is resending, and we have already received
3348 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003349 */
Hanno Becker331de3d2019-07-12 11:10:16 +01003350static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
Hanno Beckere5e7e782019-07-11 12:29:35 +01003351 unsigned char *buf,
3352 size_t len,
3353 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00003354{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01003355 int major_ver, minor_ver;
Paul Bakker5121ce52009-01-03 21:22:43 +00003356
Hanno Beckere5e7e782019-07-11 12:29:35 +01003357 size_t const rec_hdr_type_offset = 0;
3358 size_t const rec_hdr_type_len = 1;
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003359
Hanno Beckere5e7e782019-07-11 12:29:35 +01003360 size_t const rec_hdr_version_offset = rec_hdr_type_offset +
3361 rec_hdr_type_len;
3362 size_t const rec_hdr_version_len = 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00003363
Hanno Beckere5e7e782019-07-11 12:29:35 +01003364 size_t const rec_hdr_ctr_len = 8;
3365#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckerf5466252019-07-25 10:13:02 +01003366 uint32_t rec_epoch;
Hanno Beckere5e7e782019-07-11 12:29:35 +01003367 size_t const rec_hdr_ctr_offset = rec_hdr_version_offset +
3368 rec_hdr_version_len;
3369
Hanno Beckera0e20d02019-05-15 14:03:01 +01003370#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere5e7e782019-07-11 12:29:35 +01003371 size_t const rec_hdr_cid_offset = rec_hdr_ctr_offset +
3372 rec_hdr_ctr_len;
Hanno Beckerf5466252019-07-25 10:13:02 +01003373 size_t rec_hdr_cid_len = 0;
Hanno Beckere5e7e782019-07-11 12:29:35 +01003374#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3375#endif /* MBEDTLS_SSL_PROTO_DTLS */
3376
3377 size_t rec_hdr_len_offset; /* To be determined */
3378 size_t const rec_hdr_len_len = 2;
3379
3380 /*
3381 * Check minimum lengths for record header.
3382 */
3383
3384#if defined(MBEDTLS_SSL_PROTO_DTLS)
3385 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3386 {
3387 rec_hdr_len_offset = rec_hdr_ctr_offset + rec_hdr_ctr_len;
3388 }
3389 else
3390#endif /* MBEDTLS_SSL_PROTO_DTLS */
3391 {
3392 rec_hdr_len_offset = rec_hdr_version_offset + rec_hdr_version_len;
3393 }
3394
3395 if( len < rec_hdr_len_offset + rec_hdr_len_len )
3396 {
3397 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header of length %u",
3398 (unsigned) len,
3399 (unsigned)( rec_hdr_len_len + rec_hdr_len_len ) ) );
3400 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3401 }
3402
3403 /*
3404 * Parse and validate record content type
3405 */
3406
3407 rec->type = buf[ rec_hdr_type_offset ];
Hanno Beckere5e7e782019-07-11 12:29:35 +01003408
3409 /* Check record content type */
3410#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3411 rec->cid_len = 0;
3412
Hanno Beckerca59c2b2019-05-08 12:03:28 +01003413 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Hanno Beckere5e7e782019-07-11 12:29:35 +01003414 ssl->conf->cid_len != 0 &&
3415 rec->type == MBEDTLS_SSL_MSG_CID )
Hanno Beckerca59c2b2019-05-08 12:03:28 +01003416 {
3417 /* Shift pointers to account for record header including CID
3418 * struct {
3419 * ContentType special_type = tls12_cid;
3420 * ProtocolVersion version;
3421 * uint16 epoch;
3422 * uint48 sequence_number;
Hanno Becker8e55b0f2019-05-23 17:03:19 +01003423 * opaque cid[cid_length]; // Additional field compared to
3424 * // default DTLS record format
Hanno Beckerca59c2b2019-05-08 12:03:28 +01003425 * uint16 length;
3426 * opaque enc_content[DTLSCiphertext.length];
3427 * } DTLSCiphertext;
3428 */
3429
3430 /* So far, we only support static CID lengths
3431 * fixed in the configuration. */
Hanno Beckere5e7e782019-07-11 12:29:35 +01003432 rec_hdr_cid_len = ssl->conf->cid_len;
3433 rec_hdr_len_offset += rec_hdr_cid_len;
Hanno Beckere538d822019-07-10 14:50:10 +01003434
Hanno Beckere5e7e782019-07-11 12:29:35 +01003435 if( len < rec_hdr_len_offset + rec_hdr_len_len )
Hanno Beckere538d822019-07-10 14:50:10 +01003436 {
Hanno Beckere5e7e782019-07-11 12:29:35 +01003437 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header including CID, length %u",
3438 (unsigned) len,
3439 (unsigned)( rec_hdr_len_offset + rec_hdr_len_len ) ) );
Hanno Becker59be60e2019-07-10 14:53:43 +01003440 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Beckere538d822019-07-10 14:50:10 +01003441 }
Hanno Beckere5e7e782019-07-11 12:29:35 +01003442
Manuel Pégourié-Gonnard7e821b52019-08-02 10:17:15 +02003443 /* configured CID len is guaranteed at most 255, see
3444 * MBEDTLS_SSL_CID_OUT_LEN_MAX in check_config.h */
3445 rec->cid_len = (uint8_t) rec_hdr_cid_len;
Hanno Beckere5e7e782019-07-11 12:29:35 +01003446 memcpy( rec->cid, buf + rec_hdr_cid_offset, rec_hdr_cid_len );
Hanno Beckerca59c2b2019-05-08 12:03:28 +01003447 }
3448 else
Hanno Beckera0e20d02019-05-15 14:03:01 +01003449#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02003450 {
Hanno Beckere5e7e782019-07-11 12:29:35 +01003451 if( ssl_check_record_type( rec->type ) )
3452 {
Hanno Becker54229812019-07-12 14:40:00 +01003453 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type %u",
3454 (unsigned) rec->type ) );
Hanno Beckere5e7e782019-07-11 12:29:35 +01003455 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3456 }
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02003457 }
3458
Hanno Beckere5e7e782019-07-11 12:29:35 +01003459 /*
3460 * Parse and validate record version
3461 */
3462
Hanno Beckerd0b66d02019-07-26 08:07:03 +01003463 rec->ver[0] = buf[ rec_hdr_version_offset + 0 ];
3464 rec->ver[1] = buf[ rec_hdr_version_offset + 1 ];
Hanno Beckere5e7e782019-07-11 12:29:35 +01003465 mbedtls_ssl_read_version( &major_ver, &minor_ver,
3466 ssl->conf->transport,
Hanno Beckerd0b66d02019-07-26 08:07:03 +01003467 &rec->ver[0] );
Hanno Beckere5e7e782019-07-11 12:29:35 +01003468
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01003469 if( major_ver != ssl->major_ver )
Paul Bakker5121ce52009-01-03 21:22:43 +00003470 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003471 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
3472 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00003473 }
3474
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003475 if( minor_ver > ssl->conf->max_minor_ver )
Paul Bakker5121ce52009-01-03 21:22:43 +00003476 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003477 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
3478 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00003479 }
3480
Hanno Beckere5e7e782019-07-11 12:29:35 +01003481 /*
3482 * Parse/Copy record sequence number.
3483 */
Hanno Beckerca59c2b2019-05-08 12:03:28 +01003484
Hanno Beckere5e7e782019-07-11 12:29:35 +01003485#if defined(MBEDTLS_SSL_PROTO_DTLS)
3486 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02003487 {
Hanno Beckere5e7e782019-07-11 12:29:35 +01003488 /* Copy explicit record sequence number from input buffer. */
3489 memcpy( &rec->ctr[0], buf + rec_hdr_ctr_offset,
3490 rec_hdr_ctr_len );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02003491 }
Hanno Beckere5e7e782019-07-11 12:29:35 +01003492 else
3493#endif /* MBEDTLS_SSL_PROTO_DTLS */
3494 {
3495 /* Copy implicit record sequence number from SSL context structure. */
3496 memcpy( &rec->ctr[0], ssl->in_ctr, rec_hdr_ctr_len );
3497 }
Paul Bakker40e46942009-01-03 21:51:57 +00003498
Hanno Beckere5e7e782019-07-11 12:29:35 +01003499 /*
3500 * Parse record length.
3501 */
3502
Hanno Beckere5e7e782019-07-11 12:29:35 +01003503 rec->data_offset = rec_hdr_len_offset + rec_hdr_len_len;
Hanno Becker9eca2762019-07-25 10:16:37 +01003504 rec->data_len = ( (size_t) buf[ rec_hdr_len_offset + 0 ] << 8 ) |
3505 ( (size_t) buf[ rec_hdr_len_offset + 1 ] << 0 );
Hanno Beckere5e7e782019-07-11 12:29:35 +01003506 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", buf, rec->data_offset );
Paul Bakker5121ce52009-01-03 21:22:43 +00003507
Paul Elliott9f352112020-12-09 14:55:45 +00003508 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %u, "
Paul Elliottd48d5c62021-01-07 14:47:05 +00003509 "version = [%d:%d], msglen = %" MBEDTLS_PRINTF_SIZET,
Hanno Beckere5e7e782019-07-11 12:29:35 +01003510 rec->type,
3511 major_ver, minor_ver, rec->data_len ) );
3512
3513 rec->buf = buf;
3514 rec->buf_len = rec->data_offset + rec->data_len;
Hanno Beckerca59c2b2019-05-08 12:03:28 +01003515
Hanno Beckerd417cc92019-07-26 08:20:27 +01003516 if( rec->data_len == 0 )
3517 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00003518
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003519 /*
Hanno Becker52c6dc62017-05-26 16:07:36 +01003520 * DTLS-related tests.
3521 * Check epoch before checking length constraint because
3522 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
3523 * message gets duplicated before the corresponding Finished message,
3524 * the second ChangeCipherSpec should be discarded because it belongs
3525 * to an old epoch, but not because its length is shorter than
3526 * the minimum record length for packets using the new record transform.
3527 * Note that these two kinds of failures are handled differently,
3528 * as an unexpected record is silently skipped but an invalid
3529 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003530 */
3531#if defined(MBEDTLS_SSL_PROTO_DTLS)
3532 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3533 {
Hanno Beckere5e7e782019-07-11 12:29:35 +01003534 rec_epoch = ( rec->ctr[0] << 8 ) | rec->ctr[1];
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003535
Hanno Becker955a5c92019-07-10 17:12:07 +01003536 /* Check that the datagram is large enough to contain a record
3537 * of the advertised length. */
Hanno Beckere5e7e782019-07-11 12:29:35 +01003538 if( len < rec->data_offset + rec->data_len )
Hanno Becker955a5c92019-07-10 17:12:07 +01003539 {
Hanno Beckere5e7e782019-07-11 12:29:35 +01003540 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Datagram of length %u too small to contain record of advertised length %u.",
3541 (unsigned) len,
3542 (unsigned)( rec->data_offset + rec->data_len ) ) );
Hanno Becker955a5c92019-07-10 17:12:07 +01003543 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3544 }
Hanno Becker37cfe732019-07-10 17:20:01 +01003545
Hanno Becker37cfe732019-07-10 17:20:01 +01003546 /* Records from other, non-matching epochs are silently discarded.
3547 * (The case of same-port Client reconnects must be considered in
3548 * the caller). */
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003549 if( rec_epoch != ssl->in_epoch )
3550 {
3551 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
Paul Elliott9f352112020-12-09 14:55:45 +00003552 "expected %u, received %lu",
3553 ssl->in_epoch, (unsigned long) rec_epoch ) );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003554
Hanno Becker552f7472019-07-19 10:59:12 +01003555 /* Records from the next epoch are considered for buffering
3556 * (concretely: early Finished messages). */
3557 if( rec_epoch == (unsigned) ssl->in_epoch + 1 )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003558 {
Hanno Becker552f7472019-07-19 10:59:12 +01003559 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
3560 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003561 }
Hanno Becker5f066e72018-08-16 14:56:31 +01003562
Hanno Becker2fddd372019-07-10 14:37:41 +01003563 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003564 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003565#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Hanno Becker37cfe732019-07-10 17:20:01 +01003566 /* For records from the correct epoch, check whether their
3567 * sequence number has been seen before. */
Arto Kinnunen7f8089b2019-10-29 11:13:33 +02003568 else if( mbedtls_ssl_dtls_record_replay_check( (mbedtls_ssl_context *) ssl,
3569 &rec->ctr[0] ) != 0 )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01003570 {
3571 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
3572 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
3573 }
3574#endif
3575 }
3576#endif /* MBEDTLS_SSL_PROTO_DTLS */
3577
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003578 return( 0 );
3579}
Paul Bakker5121ce52009-01-03 21:22:43 +00003580
Paul Bakker5121ce52009-01-03 21:22:43 +00003581
Hanno Becker2fddd372019-07-10 14:37:41 +01003582#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
3583static int ssl_check_client_reconnect( mbedtls_ssl_context *ssl )
3584{
3585 unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
3586
3587 /*
3588 * Check for an epoch 0 ClientHello. We can't use in_msg here to
3589 * access the first byte of record content (handshake type), as we
3590 * have an active transform (possibly iv_len != 0), so use the
3591 * fact that the record header len is 13 instead.
3592 */
3593 if( rec_epoch == 0 &&
3594 ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
3595 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
3596 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3597 ssl->in_left > 13 &&
3598 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
3599 {
3600 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
3601 "from the same port" ) );
3602 return( ssl_handle_possible_reconnect( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003603 }
3604
3605 return( 0 );
3606}
Hanno Becker2fddd372019-07-10 14:37:41 +01003607#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00003608
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003609/*
Manuel Pégourié-Gonnardc40b6852020-01-03 12:18:49 +01003610 * If applicable, decrypt record content
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003611 */
Hanno Beckerfdf66042019-07-11 13:07:45 +01003612static int ssl_prepare_record_content( mbedtls_ssl_context *ssl,
3613 mbedtls_record *rec )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003614{
3615 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003616
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003617 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
Hanno Beckerfdf66042019-07-11 13:07:45 +01003618 rec->buf, rec->buf_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00003619
Ronald Cron7e38cba2021-11-24 12:43:39 +01003620 /*
3621 * In TLS 1.3, always treat ChangeCipherSpec records
3622 * as unencrypted. The only thing we do with them is
3623 * check the length and content and ignore them.
3624 */
Ronald Cron6f135e12021-12-08 16:57:54 +01003625#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron7e38cba2021-11-24 12:43:39 +01003626 if( ssl->transform_in != NULL &&
3627 ssl->transform_in->minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
3628 {
3629 if( rec->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
3630 done = 1;
3631 }
Ronald Cron6f135e12021-12-08 16:57:54 +01003632#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Ronald Cron7e38cba2021-11-24 12:43:39 +01003633
Paul Bakker48916f92012-09-16 19:57:18 +00003634 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003635 {
Hanno Becker58ef0bf2019-07-12 09:35:58 +01003636 unsigned char const old_msg_type = rec->type;
Hanno Becker2e24c3b2017-12-27 21:28:58 +00003637
Hanno Beckera18d1322018-01-03 14:27:32 +00003638 if( ( ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in,
Hanno Beckerfdf66042019-07-11 13:07:45 +01003639 rec ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003640 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003641 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Hanno Becker8367ccc2019-05-14 11:30:10 +01003642
Hanno Beckera0e20d02019-05-15 14:03:01 +01003643#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker8367ccc2019-05-14 11:30:10 +01003644 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID &&
3645 ssl->conf->ignore_unexpected_cid
3646 == MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
3647 {
Hanno Beckere8d6afd2019-05-24 10:11:06 +01003648 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ignoring unexpected CID" ) );
Hanno Becker16ded982019-05-08 13:02:55 +01003649 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
Hanno Becker8367ccc2019-05-14 11:30:10 +01003650 }
Hanno Beckera0e20d02019-05-15 14:03:01 +01003651#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker16ded982019-05-08 13:02:55 +01003652
Paul Bakker5121ce52009-01-03 21:22:43 +00003653 return( ret );
3654 }
3655
Hanno Becker58ef0bf2019-07-12 09:35:58 +01003656 if( old_msg_type != rec->type )
Hanno Becker6430faf2019-05-08 11:57:13 +01003657 {
3658 MBEDTLS_SSL_DEBUG_MSG( 4, ( "record type after decrypt (before %d): %d",
Hanno Becker58ef0bf2019-07-12 09:35:58 +01003659 old_msg_type, rec->type ) );
Hanno Becker6430faf2019-05-08 11:57:13 +01003660 }
3661
Hanno Becker1c0c37f2018-08-07 14:29:29 +01003662 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Hanno Becker58ef0bf2019-07-12 09:35:58 +01003663 rec->buf + rec->data_offset, rec->data_len );
Hanno Becker1c0c37f2018-08-07 14:29:29 +01003664
Hanno Beckera0e20d02019-05-15 14:03:01 +01003665#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker6430faf2019-05-08 11:57:13 +01003666 /* We have already checked the record content type
3667 * in ssl_parse_record_header(), failing or silently
3668 * dropping the record in the case of an unknown type.
3669 *
3670 * Since with the use of CIDs, the record content type
3671 * might change during decryption, re-check the record
3672 * content type, but treat a failure as fatal this time. */
Hanno Becker58ef0bf2019-07-12 09:35:58 +01003673 if( ssl_check_record_type( rec->type ) )
Hanno Becker6430faf2019-05-08 11:57:13 +01003674 {
3675 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
3676 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3677 }
Hanno Beckera0e20d02019-05-15 14:03:01 +01003678#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker6430faf2019-05-08 11:57:13 +01003679
Hanno Becker58ef0bf2019-07-12 09:35:58 +01003680 if( rec->data_len == 0 )
Hanno Becker2e24c3b2017-12-27 21:28:58 +00003681 {
3682#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3683 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3
Hanno Becker58ef0bf2019-07-12 09:35:58 +01003684 && rec->type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Hanno Becker2e24c3b2017-12-27 21:28:58 +00003685 {
3686 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
3687 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
3688 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3689 }
3690#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3691
3692 ssl->nb_zero++;
3693
3694 /*
3695 * Three or more empty messages may be a DoS attack
3696 * (excessive CPU consumption).
3697 */
3698 if( ssl->nb_zero > 3 )
3699 {
3700 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Hanno Becker6e7700d2019-05-08 10:38:32 +01003701 "messages, possible DoS attack" ) );
3702 /* Treat the records as if they were not properly authenticated,
3703 * thereby failing the connection if we see more than allowed
3704 * by the configured bad MAC threshold. */
Hanno Becker2e24c3b2017-12-27 21:28:58 +00003705 return( MBEDTLS_ERR_SSL_INVALID_MAC );
3706 }
3707 }
3708 else
3709 ssl->nb_zero = 0;
3710
3711#if defined(MBEDTLS_SSL_PROTO_DTLS)
3712 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3713 {
3714 ; /* in_ctr read from peer, not maintained internally */
3715 }
3716 else
3717#endif
3718 {
3719 unsigned i;
Jerry Yuae0b2e22021-10-08 15:21:19 +08003720 for( i = MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
3721 i > mbedtls_ssl_ep_len( ssl ); i-- )
3722 {
Hanno Becker2e24c3b2017-12-27 21:28:58 +00003723 if( ++ssl->in_ctr[i - 1] != 0 )
3724 break;
Jerry Yuae0b2e22021-10-08 15:21:19 +08003725 }
Hanno Becker2e24c3b2017-12-27 21:28:58 +00003726
3727 /* The loop goes to its end iff the counter is wrapping */
Hanno Beckerdd772292020-02-05 10:38:31 +00003728 if( i == mbedtls_ssl_ep_len( ssl ) )
Hanno Becker2e24c3b2017-12-27 21:28:58 +00003729 {
3730 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
3731 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
3732 }
3733 }
3734
Paul Bakker5121ce52009-01-03 21:22:43 +00003735 }
3736
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003737#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003738 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02003739 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003740 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02003741 }
3742#endif
3743
Hanno Beckerd96e10b2019-07-09 17:30:02 +01003744 /* Check actual (decrypted) record content length against
3745 * configured maximum. */
3746 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
3747 {
3748 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
3749 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3750 }
3751
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003752 return( 0 );
3753}
3754
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02003755/*
3756 * Read a record.
3757 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02003758 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
3759 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
3760 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02003761 */
Hanno Becker1097b342018-08-15 14:09:41 +01003762
3763/* Helper functions for mbedtls_ssl_read_record(). */
3764static int ssl_consume_current_message( mbedtls_ssl_context *ssl );
Hanno Beckere74d5562018-08-15 14:26:08 +01003765static int ssl_get_next_record( mbedtls_ssl_context *ssl );
3766static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl );
Hanno Becker4162b112018-08-15 14:05:04 +01003767
Hanno Becker327c93b2018-08-15 13:56:18 +01003768int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
Hanno Becker3a0aad12018-08-20 09:44:02 +01003769 unsigned update_hs_digest )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003770{
Janos Follath865b3eb2019-12-16 11:46:15 +00003771 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003772
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003773 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003774
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003775 if( ssl->keep_current_message == 0 )
3776 {
3777 do {
Simon Butcher99000142016-10-13 17:21:01 +01003778
Hanno Becker26994592018-08-15 14:14:59 +01003779 ret = ssl_consume_current_message( ssl );
Hanno Becker90333da2017-10-10 11:27:13 +01003780 if( ret != 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003781 return( ret );
Hanno Becker26994592018-08-15 14:14:59 +01003782
Hanno Beckere74d5562018-08-15 14:26:08 +01003783 if( ssl_record_is_in_progress( ssl ) == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003784 {
Hanno Becker40f50842018-08-15 14:48:01 +01003785#if defined(MBEDTLS_SSL_PROTO_DTLS)
3786 int have_buffered = 0;
Hanno Beckere74d5562018-08-15 14:26:08 +01003787
Hanno Becker40f50842018-08-15 14:48:01 +01003788 /* We only check for buffered messages if the
3789 * current datagram is fully consumed. */
3790 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Hanno Beckeref7afdf2018-08-28 17:16:31 +01003791 ssl_next_record_is_in_datagram( ssl ) == 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01003792 {
Hanno Becker40f50842018-08-15 14:48:01 +01003793 if( ssl_load_buffered_message( ssl ) == 0 )
3794 have_buffered = 1;
3795 }
3796
3797 if( have_buffered == 0 )
3798#endif /* MBEDTLS_SSL_PROTO_DTLS */
3799 {
3800 ret = ssl_get_next_record( ssl );
3801 if( ret == MBEDTLS_ERR_SSL_CONTINUE_PROCESSING )
3802 continue;
3803
3804 if( ret != 0 )
3805 {
Hanno Beckerc573ac32018-08-28 17:15:25 +01003806 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
Hanno Becker40f50842018-08-15 14:48:01 +01003807 return( ret );
3808 }
Hanno Beckere74d5562018-08-15 14:26:08 +01003809 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003810 }
3811
3812 ret = mbedtls_ssl_handle_message_type( ssl );
3813
Hanno Becker40f50842018-08-15 14:48:01 +01003814#if defined(MBEDTLS_SSL_PROTO_DTLS)
3815 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
3816 {
3817 /* Buffer future message */
3818 ret = ssl_buffer_message( ssl );
3819 if( ret != 0 )
3820 return( ret );
3821
3822 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
3823 }
3824#endif /* MBEDTLS_SSL_PROTO_DTLS */
3825
Hanno Becker90333da2017-10-10 11:27:13 +01003826 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret ||
3827 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING == ret );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003828
3829 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01003830 {
Hanno Becker05c4fc82017-11-09 14:34:06 +00003831 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
Simon Butcher99000142016-10-13 17:21:01 +01003832 return( ret );
3833 }
3834
Hanno Becker327c93b2018-08-15 13:56:18 +01003835 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
Hanno Becker3a0aad12018-08-20 09:44:02 +01003836 update_hs_digest == 1 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003837 {
3838 mbedtls_ssl_update_handshake_status( ssl );
3839 }
Simon Butcher99000142016-10-13 17:21:01 +01003840 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003841 else
Simon Butcher99000142016-10-13 17:21:01 +01003842 {
Hanno Becker02f59072018-08-15 14:00:24 +01003843 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003844 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01003845 }
3846
3847 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
3848
3849 return( 0 );
3850}
3851
Hanno Becker40f50842018-08-15 14:48:01 +01003852#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckeref7afdf2018-08-28 17:16:31 +01003853static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
Simon Butcher99000142016-10-13 17:21:01 +01003854{
Hanno Becker40f50842018-08-15 14:48:01 +01003855 if( ssl->in_left > ssl->next_record_offset )
3856 return( 1 );
Simon Butcher99000142016-10-13 17:21:01 +01003857
Hanno Becker40f50842018-08-15 14:48:01 +01003858 return( 0 );
3859}
3860
3861static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
3862{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003863 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker37f95322018-08-16 13:55:32 +01003864 mbedtls_ssl_hs_buffer * hs_buf;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003865 int ret = 0;
3866
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003867 if( hs == NULL )
3868 return( -1 );
3869
Hanno Beckere00ae372018-08-20 09:39:42 +01003870 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
3871
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003872 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC ||
3873 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
3874 {
3875 /* Check if we have seen a ChangeCipherSpec before.
3876 * If yes, synthesize a CCS record. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01003877 if( !hs->buffering.seen_ccs )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003878 {
3879 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
3880 ret = -1;
Hanno Becker0d4b3762018-08-20 09:36:59 +01003881 goto exit;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003882 }
3883
Hanno Becker39b8bc92018-08-28 17:17:13 +01003884 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003885 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
3886 ssl->in_msglen = 1;
3887 ssl->in_msg[0] = 1;
3888
3889 /* As long as they are equal, the exact value doesn't matter. */
3890 ssl->in_left = 0;
3891 ssl->next_record_offset = 0;
3892
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01003893 hs->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003894 goto exit;
3895 }
Hanno Becker37f95322018-08-16 13:55:32 +01003896
Hanno Beckerb8f50142018-08-28 10:01:34 +01003897#if defined(MBEDTLS_DEBUG_C)
Hanno Becker37f95322018-08-16 13:55:32 +01003898 /* Debug only */
3899 {
3900 unsigned offset;
3901 for( offset = 1; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
3902 {
3903 hs_buf = &hs->buffering.hs[offset];
3904 if( hs_buf->is_valid == 1 )
3905 {
3906 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
3907 hs->in_msg_seq + offset,
Hanno Beckera591c482018-08-28 17:20:00 +01003908 hs_buf->is_complete ? "fully" : "partially" ) );
Hanno Becker37f95322018-08-16 13:55:32 +01003909 }
3910 }
3911 }
Hanno Beckerb8f50142018-08-28 10:01:34 +01003912#endif /* MBEDTLS_DEBUG_C */
Hanno Becker37f95322018-08-16 13:55:32 +01003913
3914 /* Check if we have buffered and/or fully reassembled the
3915 * next handshake message. */
3916 hs_buf = &hs->buffering.hs[0];
3917 if( ( hs_buf->is_valid == 1 ) && ( hs_buf->is_complete == 1 ) )
3918 {
3919 /* Synthesize a record containing the buffered HS message. */
3920 size_t msg_len = ( hs_buf->data[1] << 16 ) |
3921 ( hs_buf->data[2] << 8 ) |
3922 hs_buf->data[3];
3923
3924 /* Double-check that we haven't accidentally buffered
3925 * a message that doesn't fit into the input buffer. */
3926 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
3927 {
3928 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3929 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3930 }
3931
3932 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
3933 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
3934 hs_buf->data, msg_len + 12 );
3935
3936 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3937 ssl->in_hslen = msg_len + 12;
3938 ssl->in_msglen = msg_len + 12;
3939 memcpy( ssl->in_msg, hs_buf->data, ssl->in_hslen );
3940
3941 ret = 0;
3942 goto exit;
3943 }
3944 else
3945 {
3946 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
3947 hs->in_msg_seq ) );
3948 }
3949
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003950 ret = -1;
3951
3952exit:
3953
3954 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
3955 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01003956}
3957
Hanno Beckera02b0b42018-08-21 17:20:27 +01003958static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
3959 size_t desired )
3960{
3961 int offset;
3962 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker6e12c1e2018-08-24 14:39:15 +01003963 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
3964 (unsigned) desired ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01003965
Hanno Becker01315ea2018-08-21 17:22:17 +01003966 /* Get rid of future records epoch first, if such exist. */
3967 ssl_free_buffered_record( ssl );
3968
3969 /* Check if we have enough space available now. */
3970 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
3971 hs->buffering.total_bytes_buffered ) )
3972 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01003973 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
Hanno Becker01315ea2018-08-21 17:22:17 +01003974 return( 0 );
3975 }
Hanno Beckera02b0b42018-08-21 17:20:27 +01003976
Hanno Becker4f432ad2018-08-28 10:02:32 +01003977 /* We don't have enough space to buffer the next expected handshake
3978 * message. Remove buffers used for future messages to gain space,
3979 * starting with the most distant one. */
Hanno Beckera02b0b42018-08-21 17:20:27 +01003980 for( offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1;
3981 offset >= 0; offset-- )
3982 {
3983 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
3984 offset ) );
3985
Hanno Beckerb309b922018-08-23 13:18:05 +01003986 ssl_buffering_free_slot( ssl, (uint8_t) offset );
Hanno Beckera02b0b42018-08-21 17:20:27 +01003987
3988 /* Check if we have enough space available now. */
3989 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
3990 hs->buffering.total_bytes_buffered ) )
3991 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01003992 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01003993 return( 0 );
3994 }
3995 }
3996
3997 return( -1 );
3998}
3999
Hanno Becker40f50842018-08-15 14:48:01 +01004000static int ssl_buffer_message( mbedtls_ssl_context *ssl )
4001{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004002 int ret = 0;
4003 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
4004
4005 if( hs == NULL )
4006 return( 0 );
4007
4008 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
4009
4010 switch( ssl->in_msgtype )
4011 {
4012 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC:
4013 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
Hanno Beckere678eaa2018-08-21 14:57:46 +01004014
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004015 hs->buffering.seen_ccs = 1;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004016 break;
4017
4018 case MBEDTLS_SSL_MSG_HANDSHAKE:
Hanno Becker37f95322018-08-16 13:55:32 +01004019 {
4020 unsigned recv_msg_seq_offset;
4021 unsigned recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
4022 mbedtls_ssl_hs_buffer *hs_buf;
4023 size_t msg_len = ssl->in_hslen - 12;
4024
4025 /* We should never receive an old handshake
4026 * message - double-check nonetheless. */
4027 if( recv_msg_seq < ssl->handshake->in_msg_seq )
4028 {
4029 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4030 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4031 }
4032
4033 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
4034 if( recv_msg_seq_offset >= MBEDTLS_SSL_MAX_BUFFERED_HS )
4035 {
4036 /* Silently ignore -- message too far in the future */
4037 MBEDTLS_SSL_DEBUG_MSG( 2,
4038 ( "Ignore future HS message with sequence number %u, "
4039 "buffering window %u - %u",
4040 recv_msg_seq, ssl->handshake->in_msg_seq,
4041 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - 1 ) );
4042
4043 goto exit;
4044 }
4045
4046 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
4047 recv_msg_seq, recv_msg_seq_offset ) );
4048
4049 hs_buf = &hs->buffering.hs[ recv_msg_seq_offset ];
4050
4051 /* Check if the buffering for this seq nr has already commenced. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01004052 if( !hs_buf->is_valid )
Hanno Becker37f95322018-08-16 13:55:32 +01004053 {
Hanno Becker2a97b0e2018-08-21 15:47:49 +01004054 size_t reassembly_buf_sz;
4055
Hanno Becker37f95322018-08-16 13:55:32 +01004056 hs_buf->is_fragmented =
4057 ( ssl_hs_is_proper_fragment( ssl ) == 1 );
4058
4059 /* We copy the message back into the input buffer
4060 * after reassembly, so check that it's not too large.
4061 * This is an implementation-specific limitation
4062 * and not one from the standard, hence it is not
4063 * checked in ssl_check_hs_header(). */
Hanno Becker96a6c692018-08-21 15:56:03 +01004064 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker37f95322018-08-16 13:55:32 +01004065 {
4066 /* Ignore message */
4067 goto exit;
4068 }
4069
Hanno Beckere0b150f2018-08-21 15:51:03 +01004070 /* Check if we have enough space to buffer the message. */
4071 if( hs->buffering.total_bytes_buffered >
4072 MBEDTLS_SSL_DTLS_MAX_BUFFERING )
4073 {
4074 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4075 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4076 }
4077
Hanno Becker2a97b0e2018-08-21 15:47:49 +01004078 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
4079 hs_buf->is_fragmented );
Hanno Beckere0b150f2018-08-21 15:51:03 +01004080
4081 if( reassembly_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
4082 hs->buffering.total_bytes_buffered ) )
4083 {
4084 if( recv_msg_seq_offset > 0 )
4085 {
4086 /* If we can't buffer a future message because
4087 * of space limitations -- ignore. */
Paul Elliottd48d5c62021-01-07 14:47:05 +00004088 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %" MBEDTLS_PRINTF_SIZET
4089 " would exceed the compile-time limit %" MBEDTLS_PRINTF_SIZET
4090 " (already %" MBEDTLS_PRINTF_SIZET
4091 " bytes buffered) -- ignore\n",
Paul Elliott3891caf2020-12-17 18:42:40 +00004092 msg_len, (size_t) MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Paul Elliott9f352112020-12-09 14:55:45 +00004093 hs->buffering.total_bytes_buffered ) );
Hanno Beckere0b150f2018-08-21 15:51:03 +01004094 goto exit;
4095 }
Hanno Beckere1801392018-08-21 16:51:05 +01004096 else
4097 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00004098 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %" MBEDTLS_PRINTF_SIZET
4099 " would exceed the compile-time limit %" MBEDTLS_PRINTF_SIZET
4100 " (already %" MBEDTLS_PRINTF_SIZET
4101 " bytes buffered) -- attempt to make space by freeing buffered future messages\n",
Paul Elliott3891caf2020-12-17 18:42:40 +00004102 msg_len, (size_t) MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Paul Elliott9f352112020-12-09 14:55:45 +00004103 hs->buffering.total_bytes_buffered ) );
Hanno Beckere1801392018-08-21 16:51:05 +01004104 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01004105
Hanno Beckera02b0b42018-08-21 17:20:27 +01004106 if( ssl_buffer_make_space( ssl, reassembly_buf_sz ) != 0 )
Hanno Becker55e9e2a2018-08-21 16:07:55 +01004107 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00004108 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %" MBEDTLS_PRINTF_SIZET
4109 " (%" MBEDTLS_PRINTF_SIZET " with bitmap) would exceed"
4110 " the compile-time limit %" MBEDTLS_PRINTF_SIZET
4111 " (already %" MBEDTLS_PRINTF_SIZET
4112 " bytes buffered) -- fail\n",
Paul Elliott9f352112020-12-09 14:55:45 +00004113 msg_len,
4114 reassembly_buf_sz,
Paul Elliott3891caf2020-12-17 18:42:40 +00004115 (size_t) MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Paul Elliott9f352112020-12-09 14:55:45 +00004116 hs->buffering.total_bytes_buffered ) );
Hanno Becker55e9e2a2018-08-21 16:07:55 +01004117 ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
4118 goto exit;
4119 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01004120 }
4121
Paul Elliottd48d5c62021-01-07 14:47:05 +00004122 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %" MBEDTLS_PRINTF_SIZET,
Hanno Beckere0b150f2018-08-21 15:51:03 +01004123 msg_len ) );
4124
Hanno Becker2a97b0e2018-08-21 15:47:49 +01004125 hs_buf->data = mbedtls_calloc( 1, reassembly_buf_sz );
4126 if( hs_buf->data == NULL )
Hanno Becker37f95322018-08-16 13:55:32 +01004127 {
Hanno Beckere0b150f2018-08-21 15:51:03 +01004128 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
Hanno Becker37f95322018-08-16 13:55:32 +01004129 goto exit;
4130 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01004131 hs_buf->data_len = reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01004132
4133 /* Prepare final header: copy msg_type, length and message_seq,
4134 * then add standardised fragment_offset and fragment_length */
4135 memcpy( hs_buf->data, ssl->in_msg, 6 );
4136 memset( hs_buf->data + 6, 0, 3 );
4137 memcpy( hs_buf->data + 9, hs_buf->data + 1, 3 );
4138
4139 hs_buf->is_valid = 1;
Hanno Beckere0b150f2018-08-21 15:51:03 +01004140
4141 hs->buffering.total_bytes_buffered += reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01004142 }
4143 else
4144 {
4145 /* Make sure msg_type and length are consistent */
4146 if( memcmp( hs_buf->data, ssl->in_msg, 4 ) != 0 )
4147 {
4148 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
4149 /* Ignore */
4150 goto exit;
4151 }
4152 }
4153
Hanno Becker4422bbb2018-08-20 09:40:19 +01004154 if( !hs_buf->is_complete )
Hanno Becker37f95322018-08-16 13:55:32 +01004155 {
4156 size_t frag_len, frag_off;
4157 unsigned char * const msg = hs_buf->data + 12;
4158
4159 /*
4160 * Check and copy current fragment
4161 */
4162
4163 /* Validation of header fields already done in
4164 * mbedtls_ssl_prepare_handshake_record(). */
4165 frag_off = ssl_get_hs_frag_off( ssl );
4166 frag_len = ssl_get_hs_frag_len( ssl );
4167
Paul Elliottd48d5c62021-01-07 14:47:05 +00004168 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %" MBEDTLS_PRINTF_SIZET
4169 ", length = %" MBEDTLS_PRINTF_SIZET,
Hanno Becker37f95322018-08-16 13:55:32 +01004170 frag_off, frag_len ) );
4171 memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
4172
4173 if( hs_buf->is_fragmented )
4174 {
4175 unsigned char * const bitmask = msg + msg_len;
4176 ssl_bitmask_set( bitmask, frag_off, frag_len );
4177 hs_buf->is_complete = ( ssl_bitmask_check( bitmask,
4178 msg_len ) == 0 );
4179 }
4180 else
4181 {
4182 hs_buf->is_complete = 1;
4183 }
4184
4185 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
4186 hs_buf->is_complete ? "" : "not yet " ) );
4187 }
4188
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004189 break;
Hanno Becker37f95322018-08-16 13:55:32 +01004190 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004191
4192 default:
Hanno Becker360bef32018-08-28 10:04:33 +01004193 /* We don't buffer other types of messages. */
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004194 break;
4195 }
4196
4197exit:
4198
4199 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
4200 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01004201}
4202#endif /* MBEDTLS_SSL_PROTO_DTLS */
4203
Hanno Becker1097b342018-08-15 14:09:41 +01004204static int ssl_consume_current_message( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004205{
Hanno Becker4a810fb2017-05-24 16:27:30 +01004206 /*
Hanno Becker4a810fb2017-05-24 16:27:30 +01004207 * Consume last content-layer message and potentially
4208 * update in_msglen which keeps track of the contents'
4209 * consumption state.
4210 *
4211 * (1) Handshake messages:
4212 * Remove last handshake message, move content
4213 * and adapt in_msglen.
4214 *
4215 * (2) Alert messages:
4216 * Consume whole record content, in_msglen = 0.
4217 *
Hanno Becker4a810fb2017-05-24 16:27:30 +01004218 * (3) Change cipher spec:
4219 * Consume whole record content, in_msglen = 0.
4220 *
4221 * (4) Application data:
4222 * Don't do anything - the record layer provides
4223 * the application data as a stream transport
4224 * and consumes through mbedtls_ssl_read only.
4225 *
4226 */
4227
4228 /* Case (1): Handshake messages */
4229 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004230 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01004231 /* Hard assertion to be sure that no application data
4232 * is in flight, as corrupting ssl->in_msglen during
4233 * ssl->in_offt != NULL is fatal. */
4234 if( ssl->in_offt != NULL )
4235 {
4236 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4237 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4238 }
4239
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004240 /*
4241 * Get next Handshake message in the current record
4242 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004243
Hanno Becker4a810fb2017-05-24 16:27:30 +01004244 /* Notes:
Hanno Beckere72489d2017-10-23 13:23:50 +01004245 * (1) in_hslen is not necessarily the size of the
Hanno Becker4a810fb2017-05-24 16:27:30 +01004246 * current handshake content: If DTLS handshake
4247 * fragmentation is used, that's the fragment
4248 * size instead. Using the total handshake message
Hanno Beckere72489d2017-10-23 13:23:50 +01004249 * size here is faulty and should be changed at
4250 * some point.
Hanno Becker4a810fb2017-05-24 16:27:30 +01004251 * (2) While it doesn't seem to cause problems, one
4252 * has to be very careful not to assume that in_hslen
4253 * is always <= in_msglen in a sensible communication.
4254 * Again, it's wrong for DTLS handshake fragmentation.
4255 * The following check is therefore mandatory, and
4256 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01004257 * Additionally, ssl->in_hslen might be arbitrarily out of
4258 * bounds after handling a DTLS message with an unexpected
4259 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01004260 */
4261 if( ssl->in_hslen < ssl->in_msglen )
4262 {
4263 ssl->in_msglen -= ssl->in_hslen;
4264 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
4265 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004266
Hanno Becker4a810fb2017-05-24 16:27:30 +01004267 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
4268 ssl->in_msg, ssl->in_msglen );
4269 }
4270 else
4271 {
4272 ssl->in_msglen = 0;
4273 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02004274
Hanno Becker4a810fb2017-05-24 16:27:30 +01004275 ssl->in_hslen = 0;
4276 }
4277 /* Case (4): Application data */
4278 else if( ssl->in_offt != NULL )
4279 {
4280 return( 0 );
4281 }
4282 /* Everything else (CCS & Alerts) */
4283 else
4284 {
4285 ssl->in_msglen = 0;
4286 }
4287
Hanno Becker1097b342018-08-15 14:09:41 +01004288 return( 0 );
4289}
Hanno Becker4a810fb2017-05-24 16:27:30 +01004290
Hanno Beckere74d5562018-08-15 14:26:08 +01004291static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
4292{
Hanno Becker4a810fb2017-05-24 16:27:30 +01004293 if( ssl->in_msglen > 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01004294 return( 1 );
4295
4296 return( 0 );
4297}
4298
Hanno Becker5f066e72018-08-16 14:56:31 +01004299#if defined(MBEDTLS_SSL_PROTO_DTLS)
4300
4301static void ssl_free_buffered_record( mbedtls_ssl_context *ssl )
4302{
4303 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
4304 if( hs == NULL )
4305 return;
4306
Hanno Becker01315ea2018-08-21 17:22:17 +01004307 if( hs->buffering.future_record.data != NULL )
Hanno Becker4a810fb2017-05-24 16:27:30 +01004308 {
Hanno Becker01315ea2018-08-21 17:22:17 +01004309 hs->buffering.total_bytes_buffered -=
4310 hs->buffering.future_record.len;
4311
4312 mbedtls_free( hs->buffering.future_record.data );
4313 hs->buffering.future_record.data = NULL;
4314 }
Hanno Becker5f066e72018-08-16 14:56:31 +01004315}
4316
4317static int ssl_load_buffered_record( mbedtls_ssl_context *ssl )
4318{
4319 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
4320 unsigned char * rec;
4321 size_t rec_len;
4322 unsigned rec_epoch;
Darryl Greenb33cc762019-11-28 14:29:44 +00004323#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4324 size_t in_buf_len = ssl->in_buf_len;
4325#else
4326 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4327#endif
Hanno Becker5f066e72018-08-16 14:56:31 +01004328 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4329 return( 0 );
4330
4331 if( hs == NULL )
4332 return( 0 );
4333
Hanno Becker5f066e72018-08-16 14:56:31 +01004334 rec = hs->buffering.future_record.data;
4335 rec_len = hs->buffering.future_record.len;
4336 rec_epoch = hs->buffering.future_record.epoch;
4337
4338 if( rec == NULL )
4339 return( 0 );
4340
Hanno Becker4cb782d2018-08-20 11:19:05 +01004341 /* Only consider loading future records if the
4342 * input buffer is empty. */
Hanno Beckeref7afdf2018-08-28 17:16:31 +01004343 if( ssl_next_record_is_in_datagram( ssl ) == 1 )
Hanno Becker4cb782d2018-08-20 11:19:05 +01004344 return( 0 );
4345
Hanno Becker5f066e72018-08-16 14:56:31 +01004346 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
4347
4348 if( rec_epoch != ssl->in_epoch )
4349 {
4350 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
4351 goto exit;
4352 }
4353
4354 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
4355
4356 /* Double-check that the record is not too large */
Darryl Greenb33cc762019-11-28 14:29:44 +00004357 if( rec_len > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01004358 {
4359 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4360 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4361 }
4362
4363 memcpy( ssl->in_hdr, rec, rec_len );
4364 ssl->in_left = rec_len;
4365 ssl->next_record_offset = 0;
4366
4367 ssl_free_buffered_record( ssl );
4368
4369exit:
4370 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
4371 return( 0 );
4372}
4373
Hanno Becker519f15d2019-07-11 12:43:20 +01004374static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
4375 mbedtls_record const *rec )
Hanno Becker5f066e72018-08-16 14:56:31 +01004376{
4377 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker5f066e72018-08-16 14:56:31 +01004378
4379 /* Don't buffer future records outside handshakes. */
4380 if( hs == NULL )
4381 return( 0 );
4382
4383 /* Only buffer handshake records (we are only interested
4384 * in Finished messages). */
Hanno Becker519f15d2019-07-11 12:43:20 +01004385 if( rec->type != MBEDTLS_SSL_MSG_HANDSHAKE )
Hanno Becker5f066e72018-08-16 14:56:31 +01004386 return( 0 );
4387
4388 /* Don't buffer more than one future epoch record. */
4389 if( hs->buffering.future_record.data != NULL )
4390 return( 0 );
4391
Hanno Becker01315ea2018-08-21 17:22:17 +01004392 /* Don't buffer record if there's not enough buffering space remaining. */
Hanno Becker519f15d2019-07-11 12:43:20 +01004393 if( rec->buf_len > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
Hanno Becker01315ea2018-08-21 17:22:17 +01004394 hs->buffering.total_bytes_buffered ) )
4395 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00004396 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %" MBEDTLS_PRINTF_SIZET
4397 " would exceed the compile-time limit %" MBEDTLS_PRINTF_SIZET
4398 " (already %" MBEDTLS_PRINTF_SIZET
4399 " bytes buffered) -- ignore\n",
Paul Elliott3891caf2020-12-17 18:42:40 +00004400 rec->buf_len, (size_t) MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Paul Elliott9f352112020-12-09 14:55:45 +00004401 hs->buffering.total_bytes_buffered ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004402 return( 0 );
4403 }
4404
Hanno Becker5f066e72018-08-16 14:56:31 +01004405 /* Buffer record */
4406 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
Paul Elliott9f352112020-12-09 14:55:45 +00004407 ssl->in_epoch + 1U ) );
Hanno Becker519f15d2019-07-11 12:43:20 +01004408 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01004409
4410 /* ssl_parse_record_header() only considers records
4411 * of the next epoch as candidates for buffering. */
4412 hs->buffering.future_record.epoch = ssl->in_epoch + 1;
Hanno Becker519f15d2019-07-11 12:43:20 +01004413 hs->buffering.future_record.len = rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01004414
4415 hs->buffering.future_record.data =
4416 mbedtls_calloc( 1, hs->buffering.future_record.len );
4417 if( hs->buffering.future_record.data == NULL )
4418 {
4419 /* If we run out of RAM trying to buffer a
4420 * record from the next epoch, just ignore. */
4421 return( 0 );
4422 }
4423
Hanno Becker519f15d2019-07-11 12:43:20 +01004424 memcpy( hs->buffering.future_record.data, rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01004425
Hanno Becker519f15d2019-07-11 12:43:20 +01004426 hs->buffering.total_bytes_buffered += rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01004427 return( 0 );
4428}
4429
4430#endif /* MBEDTLS_SSL_PROTO_DTLS */
4431
Hanno Beckere74d5562018-08-15 14:26:08 +01004432static int ssl_get_next_record( mbedtls_ssl_context *ssl )
Hanno Becker1097b342018-08-15 14:09:41 +01004433{
Janos Follath865b3eb2019-12-16 11:46:15 +00004434 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckere5e7e782019-07-11 12:29:35 +01004435 mbedtls_record rec;
Hanno Becker1097b342018-08-15 14:09:41 +01004436
Hanno Becker5f066e72018-08-16 14:56:31 +01004437#if defined(MBEDTLS_SSL_PROTO_DTLS)
4438 /* We might have buffered a future record; if so,
4439 * and if the epoch matches now, load it.
4440 * On success, this call will set ssl->in_left to
4441 * the length of the buffered record, so that
4442 * the calls to ssl_fetch_input() below will
4443 * essentially be no-ops. */
4444 ret = ssl_load_buffered_record( ssl );
4445 if( ret != 0 )
4446 return( ret );
4447#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker4a810fb2017-05-24 16:27:30 +01004448
Hanno Beckerca59c2b2019-05-08 12:03:28 +01004449 /* Ensure that we have enough space available for the default form
4450 * of TLS / DTLS record headers (5 Bytes for TLS, 13 Bytes for DTLS,
4451 * with no space for CIDs counted in). */
4452 ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_in_hdr_len( ssl ) );
4453 if( ret != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004454 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004455 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004456 return( ret );
4457 }
4458
Hanno Beckere5e7e782019-07-11 12:29:35 +01004459 ret = ssl_parse_record_header( ssl, ssl->in_hdr, ssl->in_left, &rec );
4460 if( ret != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004462#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2fddd372019-07-10 14:37:41 +01004463 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004464 {
Hanno Becker5f066e72018-08-16 14:56:31 +01004465 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
4466 {
Hanno Becker519f15d2019-07-11 12:43:20 +01004467 ret = ssl_buffer_future_record( ssl, &rec );
Hanno Becker5f066e72018-08-16 14:56:31 +01004468 if( ret != 0 )
4469 return( ret );
4470
4471 /* Fall through to handling of unexpected records */
4472 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
4473 }
4474
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004475 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
4476 {
Hanno Becker2fddd372019-07-10 14:37:41 +01004477#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerd8bf8ce2019-07-12 09:23:47 +01004478 /* Reset in pointers to default state for TLS/DTLS records,
4479 * assuming no CID and no offset between record content and
4480 * record plaintext. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004481 mbedtls_ssl_update_in_pointers( ssl );
Hanno Beckerd8bf8ce2019-07-12 09:23:47 +01004482
Hanno Becker7ae20e02019-07-12 08:33:49 +01004483 /* Setup internal message pointers from record structure. */
4484 ssl->in_msgtype = rec.type;
4485#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4486 ssl->in_len = ssl->in_cid + rec.cid_len;
4487#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4488 ssl->in_iv = ssl->in_msg = ssl->in_len + 2;
4489 ssl->in_msglen = rec.data_len;
4490
Hanno Becker2fddd372019-07-10 14:37:41 +01004491 ret = ssl_check_client_reconnect( ssl );
Manuel Pégourié-Gonnard243d70f2020-03-31 12:07:47 +02004492 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_client_reconnect", ret );
Hanno Becker2fddd372019-07-10 14:37:41 +01004493 if( ret != 0 )
4494 return( ret );
4495#endif
4496
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004497 /* Skip unexpected record (but not whole datagram) */
Hanno Becker4acada32019-07-11 12:48:53 +01004498 ssl->next_record_offset = rec.buf_len;
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004499
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004500 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
4501 "(header)" ) );
4502 }
4503 else
4504 {
4505 /* Skip invalid record and the rest of the datagram */
4506 ssl->next_record_offset = 0;
4507 ssl->in_left = 0;
4508
4509 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
4510 "(header)" ) );
4511 }
4512
4513 /* Get next record */
Hanno Becker90333da2017-10-10 11:27:13 +01004514 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004515 }
Hanno Becker2fddd372019-07-10 14:37:41 +01004516 else
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004517#endif
Hanno Becker2fddd372019-07-10 14:37:41 +01004518 {
4519 return( ret );
4520 }
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004521 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004523#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004524 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Beckere65ce782017-05-22 14:47:48 +01004525 {
Hanno Beckera8814792019-07-10 15:01:45 +01004526 /* Remember offset of next record within datagram. */
Hanno Beckerf50da502019-07-11 12:50:10 +01004527 ssl->next_record_offset = rec.buf_len;
Hanno Beckere65ce782017-05-22 14:47:48 +01004528 if( ssl->next_record_offset < ssl->in_left )
4529 {
4530 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
4531 }
4532 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004533 else
4534#endif
Hanno Beckera8814792019-07-10 15:01:45 +01004535 {
Hanno Becker955a5c92019-07-10 17:12:07 +01004536 /*
4537 * Fetch record contents from underlying transport.
4538 */
Hanno Beckera3175662019-07-11 12:50:29 +01004539 ret = mbedtls_ssl_fetch_input( ssl, rec.buf_len );
Hanno Beckera8814792019-07-10 15:01:45 +01004540 if( ret != 0 )
4541 {
4542 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
4543 return( ret );
4544 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004545
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004546 ssl->in_left = 0;
Hanno Beckera8814792019-07-10 15:01:45 +01004547 }
4548
4549 /*
4550 * Decrypt record contents.
4551 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004552
Hanno Beckerfdf66042019-07-11 13:07:45 +01004553 if( ( ret = ssl_prepare_record_content( ssl, &rec ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004555#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004556 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004557 {
4558 /* Silently discard invalid records */
Hanno Becker82e2a392019-05-03 16:36:59 +01004559 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004560 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02004561 /* Except when waiting for Finished as a bad mac here
4562 * probably means something went wrong in the handshake
4563 * (eg wrong psk used, mitm downgrade attempt, etc.) */
4564 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
4565 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
4566 {
4567#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
4568 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
4569 {
4570 mbedtls_ssl_send_alert_message( ssl,
4571 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4572 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
4573 }
4574#endif
4575 return( ret );
4576 }
4577
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004578 if( ssl->conf->badmac_limit != 0 &&
4579 ++ssl->badmac_seen >= ssl->conf->badmac_limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02004580 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004581 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
4582 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02004583 }
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02004584
Hanno Becker4a810fb2017-05-24 16:27:30 +01004585 /* As above, invalid records cause
4586 * dismissal of the whole datagram. */
4587
4588 ssl->next_record_offset = 0;
4589 ssl->in_left = 0;
4590
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004591 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Hanno Becker90333da2017-10-10 11:27:13 +01004592 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004593 }
4594
4595 return( ret );
4596 }
4597 else
4598#endif
4599 {
4600 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004601#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
4602 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004603 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004604 mbedtls_ssl_send_alert_message( ssl,
4605 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4606 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004607 }
4608#endif
4609 return( ret );
4610 }
4611 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004612
Hanno Becker44d89b22019-07-12 09:40:44 +01004613
4614 /* Reset in pointers to default state for TLS/DTLS records,
4615 * assuming no CID and no offset between record content and
4616 * record plaintext. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004617 mbedtls_ssl_update_in_pointers( ssl );
Hanno Becker44d89b22019-07-12 09:40:44 +01004618#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4619 ssl->in_len = ssl->in_cid + rec.cid_len;
4620#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
irwir89af51f2019-09-26 21:04:56 +03004621 ssl->in_iv = ssl->in_len + 2;
Hanno Becker44d89b22019-07-12 09:40:44 +01004622
Hanno Becker8685c822019-07-12 09:37:30 +01004623 /* The record content type may change during decryption,
4624 * so re-read it. */
4625 ssl->in_msgtype = rec.type;
4626 /* Also update the input buffer, because unfortunately
4627 * the server-side ssl_parse_client_hello() reparses the
4628 * record header when receiving a ClientHello initiating
4629 * a renegotiation. */
4630 ssl->in_hdr[0] = rec.type;
4631 ssl->in_msg = rec.buf + rec.data_offset;
4632 ssl->in_msglen = rec.data_len;
Joe Subbiani6dd73642021-07-19 11:56:54 +01004633 MBEDTLS_PUT_UINT16_BE( rec.data_len, ssl->in_len, 0 );
Hanno Becker8685c822019-07-12 09:37:30 +01004634
Simon Butcher99000142016-10-13 17:21:01 +01004635 return( 0 );
4636}
4637
4638int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
4639{
Janos Follath865b3eb2019-12-16 11:46:15 +00004640 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Simon Butcher99000142016-10-13 17:21:01 +01004641
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004642 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004643 * Handle particular types of records
4644 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004645 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004646 {
Simon Butcher99000142016-10-13 17:21:01 +01004647 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
4648 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004649 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01004650 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004651 }
4652
Hanno Beckere678eaa2018-08-21 14:57:46 +01004653 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004654 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01004655 if( ssl->in_msglen != 1 )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004656 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00004657 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %" MBEDTLS_PRINTF_SIZET,
Hanno Beckere678eaa2018-08-21 14:57:46 +01004658 ssl->in_msglen ) );
4659 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004660 }
4661
Hanno Beckere678eaa2018-08-21 14:57:46 +01004662 if( ssl->in_msg[0] != 1 )
4663 {
4664 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
4665 ssl->in_msg[0] ) );
4666 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4667 }
4668
4669#if defined(MBEDTLS_SSL_PROTO_DTLS)
4670 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4671 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
4672 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
4673 {
4674 if( ssl->handshake == NULL )
4675 {
4676 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
4677 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
4678 }
4679
4680 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
4681 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
4682 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004683#endif
Ronald Cron7e38cba2021-11-24 12:43:39 +01004684
Ronald Cron6f135e12021-12-08 16:57:54 +01004685#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron7e38cba2021-11-24 12:43:39 +01004686 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
4687 {
4688#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
4689 MBEDTLS_SSL_DEBUG_MSG( 1,
4690 ( "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" ) );
4691 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
4692#else
4693 MBEDTLS_SSL_DEBUG_MSG( 1,
4694 ( "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" ) );
4695 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4696#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
4697 }
Ronald Cron6f135e12021-12-08 16:57:54 +01004698#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckere678eaa2018-08-21 14:57:46 +01004699 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004700
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004701 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00004702 {
Angus Gratton1a7a17e2018-06-20 15:43:50 +10004703 if( ssl->in_msglen != 2 )
4704 {
4705 /* Note: Standard allows for more than one 2 byte alert
4706 to be packed in a single message, but Mbed TLS doesn't
4707 currently support this. */
Paul Elliottd48d5c62021-01-07 14:47:05 +00004708 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %" MBEDTLS_PRINTF_SIZET,
Angus Gratton1a7a17e2018-06-20 15:43:50 +10004709 ssl->in_msglen ) );
4710 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4711 }
4712
Paul Elliott9f352112020-12-09 14:55:45 +00004713 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%u:%u]",
Paul Bakker5121ce52009-01-03 21:22:43 +00004714 ssl->in_msg[0], ssl->in_msg[1] ) );
4715
4716 /*
Simon Butcher459a9502015-10-27 16:09:03 +00004717 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00004718 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004719 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004720 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004721 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00004722 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004723 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004724 }
4725
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004726 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
4727 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00004728 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004729 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
4730 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00004731 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02004732
4733#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
4734 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
4735 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
4736 {
Mateusz Starzykf5c53512021-04-15 13:28:52 +02004737 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a no renegotiation alert" ) );
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02004738 /* Will be handled when trying to parse ServerHello */
4739 return( 0 );
4740 }
4741#endif
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02004742 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01004743 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004744 }
4745
Hanno Beckerc76c6192017-06-06 10:03:17 +01004746#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker37ae9522019-05-03 16:54:26 +01004747 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Beckerc76c6192017-06-06 10:03:17 +01004748 {
Hanno Becker37ae9522019-05-03 16:54:26 +01004749 /* Drop unexpected ApplicationData records,
4750 * except at the beginning of renegotiations */
4751 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
4752 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
4753#if defined(MBEDTLS_SSL_RENEGOTIATION)
4754 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
4755 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
Hanno Beckerc76c6192017-06-06 10:03:17 +01004756#endif
Hanno Becker37ae9522019-05-03 16:54:26 +01004757 )
4758 {
4759 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
4760 return( MBEDTLS_ERR_SSL_NON_FATAL );
4761 }
4762
4763 if( ssl->handshake != NULL &&
4764 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
4765 {
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00004766 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
Hanno Becker37ae9522019-05-03 16:54:26 +01004767 }
4768 }
Hanno Becker4a4af9f2019-05-08 16:26:21 +01004769#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Beckerc76c6192017-06-06 10:03:17 +01004770
Paul Bakker5121ce52009-01-03 21:22:43 +00004771 return( 0 );
4772}
4773
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004774int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00004775{
irwir6c0da642019-09-26 21:07:41 +03004776 return( mbedtls_ssl_send_alert_message( ssl,
4777 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4778 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00004779}
4780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004781int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Paul Bakker0a925182012-04-16 06:46:41 +00004782 unsigned char level,
4783 unsigned char message )
4784{
Janos Follath865b3eb2019-12-16 11:46:15 +00004785 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker0a925182012-04-16 06:46:41 +00004786
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02004787 if( ssl == NULL || ssl->conf == NULL )
4788 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4789
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004790 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004791 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00004792
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004793 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00004794 ssl->out_msglen = 2;
4795 ssl->out_msg[0] = level;
4796 ssl->out_msg[1] = message;
4797
Hanno Becker67bc7c32018-08-06 11:33:50 +01004798 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00004799 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004800 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00004801 return( ret );
4802 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004803 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00004804
4805 return( 0 );
4806}
4807
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004808int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004809{
Janos Follath865b3eb2019-12-16 11:46:15 +00004810 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00004811
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004812 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004813
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004814 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00004815 ssl->out_msglen = 1;
4816 ssl->out_msg[0] = 1;
4817
Paul Bakker5121ce52009-01-03 21:22:43 +00004818 ssl->state++;
4819
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004820 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004821 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004822 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004823 return( ret );
4824 }
4825
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004826 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004827
4828 return( 0 );
4829}
4830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004831int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004832{
Janos Follath865b3eb2019-12-16 11:46:15 +00004833 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00004834
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004835 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004836
Hanno Becker327c93b2018-08-15 13:56:18 +01004837 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004838 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004839 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004840 return( ret );
4841 }
4842
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004843 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00004844 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004845 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004846 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4847 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004848 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004849 }
4850
Hanno Beckere678eaa2018-08-21 14:57:46 +01004851 /* CCS records are only accepted if they have length 1 and content '1',
4852 * so we don't need to check this here. */
Paul Bakker5121ce52009-01-03 21:22:43 +00004853
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02004854 /*
4855 * Switch to our negotiated transform and session parameters for inbound
4856 * data.
4857 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004858 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02004859 ssl->transform_in = ssl->transform_negotiate;
4860 ssl->session_in = ssl->session_negotiate;
4861
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004862#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004863 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02004864 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004865#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Hanno Becker7e8e6a62020-02-05 10:45:48 +00004866 mbedtls_ssl_dtls_replay_reset( ssl );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02004867#endif
4868
4869 /* Increment epoch */
4870 if( ++ssl->in_epoch == 0 )
4871 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004872 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004873 /* This is highly unlikely to happen for legitimate reasons, so
4874 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004875 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02004876 }
4877 }
4878 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004879#endif /* MBEDTLS_SSL_PROTO_DTLS */
Jerry Yufd320e92021-10-08 21:52:41 +08004880 memset( ssl->in_ctr, 0, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02004881
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004882 mbedtls_ssl_update_in_pointers( ssl );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02004883
Paul Bakker5121ce52009-01-03 21:22:43 +00004884 ssl->state++;
4885
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004886 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004887
4888 return( 0 );
4889}
4890
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004891/* Once ssl->out_hdr as the address of the beginning of the
4892 * next outgoing record is set, deduce the other pointers.
4893 *
4894 * Note: For TLS, we save the implicit record sequence number
4895 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
4896 * and the caller has to make sure there's space for this.
4897 */
4898
Hanno Beckerc0eefa82020-05-28 07:17:36 +01004899static size_t ssl_transform_get_explicit_iv_len(
4900 mbedtls_ssl_transform const *transform )
4901{
TRodziewiczef73f012021-05-13 14:53:36 +02004902 if( transform->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Hanno Beckerc0eefa82020-05-28 07:17:36 +01004903 return( 0 );
4904
4905 return( transform->ivlen - transform->fixed_ivlen );
4906}
4907
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004908void mbedtls_ssl_update_out_pointers( mbedtls_ssl_context *ssl,
4909 mbedtls_ssl_transform *transform )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004910{
4911#if defined(MBEDTLS_SSL_PROTO_DTLS)
4912 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4913 {
4914 ssl->out_ctr = ssl->out_hdr + 3;
Hanno Beckera0e20d02019-05-15 14:03:01 +01004915#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Jerry Yuae0b2e22021-10-08 15:21:19 +08004916 ssl->out_cid = ssl->out_ctr + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Hanno Beckerf9c6a4b2019-05-03 14:34:53 +01004917 ssl->out_len = ssl->out_cid;
4918 if( transform != NULL )
4919 ssl->out_len += transform->out_cid_len;
Hanno Beckera0e20d02019-05-15 14:03:01 +01004920#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Jerry Yuae0b2e22021-10-08 15:21:19 +08004921 ssl->out_len = ssl->out_ctr + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Hanno Beckera0e20d02019-05-15 14:03:01 +01004922#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf9c6a4b2019-05-03 14:34:53 +01004923 ssl->out_iv = ssl->out_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004924 }
4925 else
4926#endif
4927 {
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004928 ssl->out_len = ssl->out_hdr + 3;
Hanno Beckera0e20d02019-05-15 14:03:01 +01004929#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker4c3eb7c2019-05-08 16:43:21 +01004930 ssl->out_cid = ssl->out_len;
4931#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004932 ssl->out_iv = ssl->out_hdr + 5;
4933 }
4934
Hanno Beckerc0eefa82020-05-28 07:17:36 +01004935 ssl->out_msg = ssl->out_iv;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004936 /* Adjust out_msg to make space for explicit IV, if used. */
Hanno Beckerc0eefa82020-05-28 07:17:36 +01004937 if( transform != NULL )
4938 ssl->out_msg += ssl_transform_get_explicit_iv_len( transform );
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004939}
4940
4941/* Once ssl->in_hdr as the address of the beginning of the
4942 * next incoming record is set, deduce the other pointers.
4943 *
4944 * Note: For TLS, we save the implicit record sequence number
4945 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
4946 * and the caller has to make sure there's space for this.
4947 */
4948
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004949void mbedtls_ssl_update_in_pointers( mbedtls_ssl_context *ssl )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004950{
Hanno Becker79594fd2019-05-08 09:38:41 +01004951 /* This function sets the pointers to match the case
4952 * of unprotected TLS/DTLS records, with both ssl->in_iv
4953 * and ssl->in_msg pointing to the beginning of the record
4954 * content.
4955 *
4956 * When decrypting a protected record, ssl->in_msg
4957 * will be shifted to point to the beginning of the
4958 * record plaintext.
4959 */
4960
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004961#if defined(MBEDTLS_SSL_PROTO_DTLS)
4962 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4963 {
Hanno Beckerf9c6a4b2019-05-03 14:34:53 +01004964 /* This sets the header pointers to match records
4965 * without CID. When we receive a record containing
4966 * a CID, the fields are shifted accordingly in
4967 * ssl_parse_record_header(). */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004968 ssl->in_ctr = ssl->in_hdr + 3;
Hanno Beckera0e20d02019-05-15 14:03:01 +01004969#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Jerry Yuae0b2e22021-10-08 15:21:19 +08004970 ssl->in_cid = ssl->in_ctr + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Hanno Beckerf9c6a4b2019-05-03 14:34:53 +01004971 ssl->in_len = ssl->in_cid; /* Default: no CID */
Hanno Beckera0e20d02019-05-15 14:03:01 +01004972#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Jerry Yuae0b2e22021-10-08 15:21:19 +08004973 ssl->in_len = ssl->in_ctr + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Hanno Beckera0e20d02019-05-15 14:03:01 +01004974#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf9c6a4b2019-05-03 14:34:53 +01004975 ssl->in_iv = ssl->in_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004976 }
4977 else
4978#endif
4979 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08004980 ssl->in_ctr = ssl->in_hdr - MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004981 ssl->in_len = ssl->in_hdr + 3;
Hanno Beckera0e20d02019-05-15 14:03:01 +01004982#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker4c3eb7c2019-05-08 16:43:21 +01004983 ssl->in_cid = ssl->in_len;
4984#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004985 ssl->in_iv = ssl->in_hdr + 5;
4986 }
4987
Hanno Becker79594fd2019-05-08 09:38:41 +01004988 /* This will be adjusted at record decryption time. */
4989 ssl->in_msg = ssl->in_iv;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004990}
4991
Paul Bakker5121ce52009-01-03 21:22:43 +00004992/*
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02004993 * Setup an SSL context
4994 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01004995
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004996void mbedtls_ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl )
Hanno Becker2a43f6f2018-08-10 11:12:52 +01004997{
4998 /* Set the incoming and outgoing record pointers. */
4999#if defined(MBEDTLS_SSL_PROTO_DTLS)
5000 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5001 {
5002 ssl->out_hdr = ssl->out_buf;
5003 ssl->in_hdr = ssl->in_buf;
5004 }
5005 else
5006#endif /* MBEDTLS_SSL_PROTO_DTLS */
5007 {
Hanno Becker12078f42021-03-02 15:28:41 +00005008 ssl->out_ctr = ssl->out_buf;
Hanno Becker2a43f6f2018-08-10 11:12:52 +01005009 ssl->out_hdr = ssl->out_buf + 8;
5010 ssl->in_hdr = ssl->in_buf + 8;
5011 }
5012
5013 /* Derive other internal pointers. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00005014 mbedtls_ssl_update_out_pointers( ssl, NULL /* no transform enabled */ );
5015 mbedtls_ssl_update_in_pointers ( ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +01005016}
5017
Paul Bakker5121ce52009-01-03 21:22:43 +00005018/*
5019 * SSL get accessors
5020 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005021size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005022{
5023 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
5024}
5025
Hanno Becker8b170a02017-10-10 11:51:19 +01005026int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
5027{
5028 /*
5029 * Case A: We're currently holding back
5030 * a message for further processing.
5031 */
5032
5033 if( ssl->keep_current_message == 1 )
5034 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01005035 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01005036 return( 1 );
5037 }
5038
5039 /*
5040 * Case B: Further records are pending in the current datagram.
5041 */
5042
5043#if defined(MBEDTLS_SSL_PROTO_DTLS)
5044 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5045 ssl->in_left > ssl->next_record_offset )
5046 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01005047 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01005048 return( 1 );
5049 }
5050#endif /* MBEDTLS_SSL_PROTO_DTLS */
5051
5052 /*
5053 * Case C: A handshake message is being processed.
5054 */
5055
Hanno Becker8b170a02017-10-10 11:51:19 +01005056 if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
5057 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01005058 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01005059 return( 1 );
5060 }
5061
5062 /*
5063 * Case D: An application data message is being processed
5064 */
5065 if( ssl->in_offt != NULL )
5066 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01005067 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01005068 return( 1 );
5069 }
5070
5071 /*
5072 * In all other cases, the rest of the message can be dropped.
Hanno Beckerc573ac32018-08-28 17:15:25 +01005073 * As in ssl_get_next_record, this needs to be adapted if
Hanno Becker8b170a02017-10-10 11:51:19 +01005074 * we implement support for multiple alerts in single records.
5075 */
5076
5077 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
5078 return( 0 );
5079}
5080
Paul Bakker43ca69c2011-01-15 17:35:19 +00005081
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005082int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02005083{
Hanno Becker3136ede2018-08-17 15:28:19 +01005084 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005085 const mbedtls_ssl_transform *transform = ssl->transform_out;
Hanno Becker5b559ac2018-08-03 09:40:07 +01005086 unsigned block_size;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005087#if defined(MBEDTLS_USE_PSA_CRYPTO)
5088 psa_key_attributes_t attr = PSA_KEY_ATTRIBUTES_INIT;
5089 psa_key_type_t key_type;
5090#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02005091
Hanno Becker5903de42019-05-03 14:46:38 +01005092 size_t out_hdr_len = mbedtls_ssl_out_hdr_len( ssl );
5093
Hanno Becker78640902018-08-13 16:35:15 +01005094 if( transform == NULL )
Hanno Becker5903de42019-05-03 14:46:38 +01005095 return( (int) out_hdr_len );
Hanno Becker78640902018-08-13 16:35:15 +01005096
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005097
5098#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekielbe47ecf2022-01-31 13:53:11 +01005099 if ( transform->psa_alg == PSA_ALG_GCM ||
5100 transform->psa_alg == PSA_ALG_CCM ||
5101 transform->psa_alg == PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 8 ) ||
5102 transform->psa_alg == PSA_ALG_CHACHA20_POLY1305 ||
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005103 transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER )
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005104 {
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005105 transform_expansion = transform->minlen;
5106 }
Przemyslaw Stekiel399ed512022-01-31 08:38:00 +01005107 else if ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING )
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005108 {
5109 (void) psa_get_key_attributes( transform->psa_key_enc, &attr );
5110 key_type = psa_get_key_type( &attr );
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005111
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005112 block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type );
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005113
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005114 /* Expansion due to the addition of the MAC. */
5115 transform_expansion += transform->maclen;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005116
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005117 /* Expansion due to the addition of CBC padding;
5118 * Theoretically up to 256 bytes, but we never use
5119 * more than the block size of the underlying cipher. */
5120 transform_expansion += block_size;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005121
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005122 /* For TLS 1.2 or higher, an explicit IV is added
5123 * after the record header. */
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005124#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005125 transform_expansion += block_size;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005126#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Przemyslaw Stekiel1d714472022-01-24 23:46:50 +01005127 }
5128 else
5129 {
5130 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5131 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005132 }
5133#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005134 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02005135 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005136 case MBEDTLS_MODE_GCM:
5137 case MBEDTLS_MODE_CCM:
Hanno Becker5b559ac2018-08-03 09:40:07 +01005138 case MBEDTLS_MODE_CHACHAPOLY:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005139 case MBEDTLS_MODE_STREAM:
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02005140 transform_expansion = transform->minlen;
5141 break;
5142
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005143 case MBEDTLS_MODE_CBC:
Hanno Becker5b559ac2018-08-03 09:40:07 +01005144
5145 block_size = mbedtls_cipher_get_block_size(
5146 &transform->cipher_ctx_enc );
5147
Hanno Becker3136ede2018-08-17 15:28:19 +01005148 /* Expansion due to the addition of the MAC. */
5149 transform_expansion += transform->maclen;
5150
5151 /* Expansion due to the addition of CBC padding;
5152 * Theoretically up to 256 bytes, but we never use
5153 * more than the block size of the underlying cipher. */
5154 transform_expansion += block_size;
5155
TRodziewicz4ca18aa2021-05-20 14:46:20 +02005156 /* For TLS 1.2 or higher, an explicit IV is added
Hanno Becker3136ede2018-08-17 15:28:19 +01005157 * after the record header. */
TRodziewicz0f82ec62021-05-12 17:49:18 +02005158#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
TRodziewicz345165c2021-07-06 13:42:11 +02005159 transform_expansion += block_size;
TRodziewicz0f82ec62021-05-12 17:49:18 +02005160#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker3136ede2018-08-17 15:28:19 +01005161
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02005162 break;
5163
5164 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02005165 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005166 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02005167 }
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005168#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02005169
Hanno Beckera0e20d02019-05-15 14:03:01 +01005170#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker6cbad552019-05-08 15:40:11 +01005171 if( transform->out_cid_len != 0 )
5172 transform_expansion += MBEDTLS_SSL_MAX_CID_EXPANSION;
Hanno Beckera0e20d02019-05-15 14:03:01 +01005173#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker6cbad552019-05-08 15:40:11 +01005174
Hanno Becker5903de42019-05-03 14:46:38 +01005175 return( (int)( out_hdr_len + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02005176}
5177
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005178#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005179/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01005180 * Check record counters and renegotiate if they're above the limit.
5181 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005182static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01005183{
Hanno Beckerdd772292020-02-05 10:38:31 +00005184 size_t ep_len = mbedtls_ssl_ep_len( ssl );
Andres AG2196c7f2016-12-15 17:01:16 +00005185 int in_ctr_cmp;
5186 int out_ctr_cmp;
5187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005188 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
5189 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005190 ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01005191 {
5192 return( 0 );
5193 }
5194
Andres AG2196c7f2016-12-15 17:01:16 +00005195 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
Jerry Yud9a94fe2021-09-28 18:58:59 +08005196 &ssl->conf->renego_period[ep_len],
Jerry Yuae0b2e22021-10-08 15:21:19 +08005197 MBEDTLS_SSL_SEQUENCE_NUMBER_LEN - ep_len );
Jerry Yud9a94fe2021-09-28 18:58:59 +08005198 out_ctr_cmp = memcmp( &ssl->cur_out_ctr[ep_len],
5199 &ssl->conf->renego_period[ep_len],
5200 sizeof( ssl->cur_out_ctr ) - ep_len );
Andres AG2196c7f2016-12-15 17:01:16 +00005201
5202 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01005203 {
5204 return( 0 );
5205 }
5206
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02005207 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005208 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01005209}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005210#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +00005211
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005212/* This function is called from mbedtls_ssl_read() when a handshake message is
Hanno Beckerf26cc722021-04-21 07:30:13 +01005213 * received after the initial handshake. In this context, handshake messages
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005214 * may only be sent for the purpose of initiating renegotiations.
5215 *
5216 * This function is introduced as a separate helper since the handling
5217 * of post-handshake handshake messages changes significantly in TLS 1.3,
5218 * and having a helper function allows to distinguish between TLS <= 1.2 and
5219 * TLS 1.3 in the future without bloating the logic of mbedtls_ssl_read().
5220 */
Hanno Beckercad3dba2020-11-24 06:57:13 +00005221static int ssl_handle_hs_message_post_handshake( mbedtls_ssl_context *ssl )
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005222{
Hanno Beckerfae12cf2021-04-21 07:20:20 +01005223 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005224
5225 /*
5226 * - For client-side, expect SERVER_HELLO_REQUEST.
5227 * - For server-side, expect CLIENT_HELLO.
5228 * - Fail (TLS) or silently drop record (DTLS) in other cases.
5229 */
5230
5231#if defined(MBEDTLS_SSL_CLI_C)
5232 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
5233 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
5234 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
5235 {
5236 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
5237
5238 /* With DTLS, drop the packet (probably from last handshake) */
5239#if defined(MBEDTLS_SSL_PROTO_DTLS)
5240 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5241 {
5242 return( 0 );
5243 }
5244#endif
5245 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
5246 }
5247#endif /* MBEDTLS_SSL_CLI_C */
5248
5249#if defined(MBEDTLS_SSL_SRV_C)
5250 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
5251 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
5252 {
5253 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
5254
5255 /* With DTLS, drop the packet (probably from last handshake) */
5256#if defined(MBEDTLS_SSL_PROTO_DTLS)
5257 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5258 {
5259 return( 0 );
5260 }
5261#endif
5262 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
5263 }
5264#endif /* MBEDTLS_SSL_SRV_C */
5265
5266#if defined(MBEDTLS_SSL_RENEGOTIATION)
5267 /* Determine whether renegotiation attempt should be accepted */
5268 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
5269 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
5270 ssl->conf->allow_legacy_renegotiation ==
5271 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
5272 {
5273 /*
5274 * Accept renegotiation request
5275 */
5276
5277 /* DTLS clients need to know renego is server-initiated */
5278#if defined(MBEDTLS_SSL_PROTO_DTLS)
5279 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5280 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5281 {
5282 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
5283 }
5284#endif
5285 ret = mbedtls_ssl_start_renegotiation( ssl );
5286 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
5287 ret != 0 )
5288 {
5289 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation",
5290 ret );
5291 return( ret );
5292 }
5293 }
5294 else
5295#endif /* MBEDTLS_SSL_RENEGOTIATION */
5296 {
5297 /*
5298 * Refuse renegotiation
5299 */
5300
5301 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
5302
TRodziewicz0f82ec62021-05-12 17:49:18 +02005303#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
TRodziewicz345165c2021-07-06 13:42:11 +02005304 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
5305 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
5306 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005307 {
TRodziewicz345165c2021-07-06 13:42:11 +02005308 return( ret );
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005309 }
TRodziewicz0f82ec62021-05-12 17:49:18 +02005310#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005311 }
5312
5313 return( 0 );
5314}
5315
Paul Bakker48916f92012-09-16 19:57:18 +00005316/*
Paul Bakker5121ce52009-01-03 21:22:43 +00005317 * Receive application data decrypted from the SSL layer
5318 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005319int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +00005320{
Janos Follath865b3eb2019-12-16 11:46:15 +00005321 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker23986e52011-04-24 08:57:21 +00005322 size_t n;
Paul Bakker5121ce52009-01-03 21:22:43 +00005323
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005324 if( ssl == NULL || ssl->conf == NULL )
5325 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5326
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005327 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005328
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005329#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005330 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005331 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005332 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005333 return( ret );
5334
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02005335 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005336 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02005337 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02005338 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02005339 return( ret );
5340 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005341 }
5342#endif
5343
Hanno Becker4a810fb2017-05-24 16:27:30 +01005344 /*
5345 * Check if renegotiation is necessary and/or handshake is
5346 * in process. If yes, perform/continue, and fall through
5347 * if an unexpected packet is received while the client
5348 * is waiting for the ServerHello.
5349 *
5350 * (There is no equivalent to the last condition on
5351 * the server-side as it is not treated as within
5352 * a handshake while waiting for the ClientHello
5353 * after a renegotiation request.)
5354 */
5355
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005356#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +01005357 ret = ssl_check_ctr_renegotiate( ssl );
5358 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
5359 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01005360 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005361 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01005362 return( ret );
5363 }
5364#endif
5365
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005366 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00005367 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005368 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +01005369 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
5370 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005371 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005372 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005373 return( ret );
5374 }
5375 }
5376
Hanno Beckere41158b2017-10-23 13:30:32 +01005377 /* Loop as long as no application data record is available */
Hanno Becker90333da2017-10-10 11:27:13 +01005378 while( ssl->in_offt == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005379 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02005380 /* Start timer if not already running */
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +02005381 if( ssl->f_get_timer != NULL &&
5382 ssl->f_get_timer( ssl->p_timer ) == -1 )
5383 {
Hanno Becker0f57a652020-02-05 10:37:26 +00005384 mbedtls_ssl_set_timer( ssl, ssl->conf->read_timeout );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +02005385 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02005386
Hanno Becker327c93b2018-08-15 13:56:18 +01005387 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005388 {
Hanno Becker4a810fb2017-05-24 16:27:30 +01005389 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
5390 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +00005391
Hanno Becker4a810fb2017-05-24 16:27:30 +01005392 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
5393 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005394 }
5395
5396 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005397 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +00005398 {
5399 /*
5400 * OpenSSL sends empty messages to randomize the IV
5401 */
Hanno Becker327c93b2018-08-15 13:56:18 +01005402 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005403 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005404 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +00005405 return( 0 );
5406
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005407 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005408 return( ret );
5409 }
5410 }
5411
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005412 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +00005413 {
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005414 ret = ssl_handle_hs_message_post_handshake( ssl );
5415 if( ret != 0)
Paul Bakker48916f92012-09-16 19:57:18 +00005416 {
Hanno Beckerb03f88f2020-11-24 06:41:37 +00005417 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_handle_hs_message_post_handshake",
5418 ret );
5419 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00005420 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02005421
Hanno Beckerf26cc722021-04-21 07:30:13 +01005422 /* At this point, we don't know whether the renegotiation triggered
5423 * by the post-handshake message has been completed or not. The cases
5424 * to consider are the following:
Hanno Becker90333da2017-10-10 11:27:13 +01005425 * 1) The renegotiation is complete. In this case, no new record
5426 * has been read yet.
5427 * 2) The renegotiation is incomplete because the client received
5428 * an application data record while awaiting the ServerHello.
5429 * 3) The renegotiation is incomplete because the client received
5430 * a non-handshake, non-application data message while awaiting
5431 * the ServerHello.
Hanno Beckerf26cc722021-04-21 07:30:13 +01005432 *
5433 * In each of these cases, looping will be the proper action:
Hanno Becker90333da2017-10-10 11:27:13 +01005434 * - For 1), the next iteration will read a new record and check
5435 * if it's application data.
5436 * - For 2), the loop condition isn't satisfied as application data
5437 * is present, hence continue is the same as break
5438 * - For 3), the loop condition is satisfied and read_record
5439 * will re-deliver the message that was held back by the client
5440 * when expecting the ServerHello.
5441 */
Hanno Beckerf26cc722021-04-21 07:30:13 +01005442
Hanno Becker90333da2017-10-10 11:27:13 +01005443 continue;
Paul Bakker48916f92012-09-16 19:57:18 +00005444 }
Hanno Becker21df7f92017-10-17 11:03:26 +01005445#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005446 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +01005447 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005448 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02005449 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005450 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02005451 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005452 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02005453 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005454 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02005455 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02005456 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +01005457 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005458#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02005459
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005460 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
5461 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02005462 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005463 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01005464 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02005465 }
5466
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005467 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +00005468 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005469 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
5470 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005471 }
5472
5473 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02005474
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02005475 /* We're going to return something now, cancel timer,
5476 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005477 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Hanno Becker0f57a652020-02-05 10:37:26 +00005478 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02005479
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02005480#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02005481 /* If we requested renego but received AppData, resend HelloRequest.
5482 * Do it now, after setting in_offt, to avoid taking this branch
5483 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005484#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005485 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005486 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02005487 {
Hanno Becker786300f2020-02-05 10:46:40 +00005488 if( ( ret = mbedtls_ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02005489 {
Hanno Becker786300f2020-02-05 10:46:40 +00005490 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend_hello_request",
5491 ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02005492 return( ret );
5493 }
5494 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005495#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +01005496#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00005497 }
5498
5499 n = ( len < ssl->in_msglen )
5500 ? len : ssl->in_msglen;
5501
5502 memcpy( buf, ssl->in_offt, n );
5503 ssl->in_msglen -= n;
5504
gabor-mezei-arma3214132020-07-15 10:55:00 +02005505 /* Zeroising the plaintext buffer to erase unused application data
5506 from the memory. */
5507 mbedtls_platform_zeroize( ssl->in_offt, n );
5508
Paul Bakker5121ce52009-01-03 21:22:43 +00005509 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +01005510 {
5511 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +00005512 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +01005513 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +01005514 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005515 else
Hanno Becker4a810fb2017-05-24 16:27:30 +01005516 {
Paul Bakker5121ce52009-01-03 21:22:43 +00005517 /* more data available */
5518 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +01005519 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005520
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005521 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005522
Paul Bakker23986e52011-04-24 08:57:21 +00005523 return( (int) n );
Paul Bakker5121ce52009-01-03 21:22:43 +00005524}
5525
5526/*
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01005527 * Send application data to be encrypted by the SSL layer, taking care of max
5528 * fragment length and buffer size.
5529 *
5530 * According to RFC 5246 Section 6.2.1:
5531 *
5532 * Zero-length fragments of Application data MAY be sent as they are
5533 * potentially useful as a traffic analysis countermeasure.
5534 *
5535 * Therefore, it is possible that the input message length is 0 and the
5536 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +00005537 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02005538static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005539 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +00005540{
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02005541 int ret = mbedtls_ssl_get_max_out_record_payload( ssl );
5542 const size_t max_len = (size_t) ret;
5543
5544 if( ret < 0 )
5545 {
5546 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
5547 return( ret );
5548 }
5549
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02005550 if( len > max_len )
5551 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005552#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005553 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02005554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005555 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Paul Elliottd48d5c62021-01-07 14:47:05 +00005556 "maximum fragment length: %" MBEDTLS_PRINTF_SIZET
5557 " > %" MBEDTLS_PRINTF_SIZET,
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02005558 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005559 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02005560 }
5561 else
5562#endif
5563 len = max_len;
5564 }
Paul Bakker887bd502011-06-08 13:10:54 +00005565
Paul Bakker5121ce52009-01-03 21:22:43 +00005566 if( ssl->out_left != 0 )
5567 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01005568 /*
5569 * The user has previously tried to send the data and
5570 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
5571 * written. In this case, we expect the high-level write function
5572 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
5573 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005574 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005575 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005576 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005577 return( ret );
5578 }
5579 }
Paul Bakker887bd502011-06-08 13:10:54 +00005580 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +00005581 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01005582 /*
5583 * The user is trying to send a message the first time, so we need to
5584 * copy the data into the internal buffers and setup the data structure
5585 * to keep track of partial writes
5586 */
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02005587 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005588 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02005589 memcpy( ssl->out_msg, buf, len );
Paul Bakker887bd502011-06-08 13:10:54 +00005590
Hanno Becker67bc7c32018-08-06 11:33:50 +01005591 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker887bd502011-06-08 13:10:54 +00005592 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005593 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker887bd502011-06-08 13:10:54 +00005594 return( ret );
5595 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005596 }
5597
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02005598 return( (int) len );
Paul Bakker5121ce52009-01-03 21:22:43 +00005599}
5600
5601/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005602 * Write application data (public-facing wrapper)
5603 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02005604int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005605{
Janos Follath865b3eb2019-12-16 11:46:15 +00005606 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005607
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02005608 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005609
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005610 if( ssl == NULL || ssl->conf == NULL )
5611 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5612
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02005613#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005614 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
5615 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02005616 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005617 return( ret );
5618 }
5619#endif
5620
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02005621 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005622 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02005623 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005624 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +02005625 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005626 return( ret );
5627 }
5628 }
5629
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005630 ret = ssl_write_real( ssl, buf, len );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005631
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02005632 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02005633
5634 return( ret );
5635}
5636
5637/*
Paul Bakker5121ce52009-01-03 21:22:43 +00005638 * Notify the peer that the connection is being closed
5639 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005640int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005641{
Janos Follath865b3eb2019-12-16 11:46:15 +00005642 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00005643
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005644 if( ssl == NULL || ssl->conf == NULL )
5645 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5646
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005647 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005648
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +02005649 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005650 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005651
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005652 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00005653 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005654 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
5655 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
5656 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005657 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005658 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005659 return( ret );
5660 }
5661 }
5662
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005663 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005664
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +02005665 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00005666}
5667
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005668void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +00005669{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005670 if( transform == NULL )
5671 return;
5672
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +01005673#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekielce37d112022-01-13 14:53:52 +01005674 psa_destroy_key( transform->psa_key_enc );
5675 psa_destroy_key( transform->psa_key_dec );
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01005676#else
5677 mbedtls_cipher_free( &transform->cipher_ctx_enc );
5678 mbedtls_cipher_free( &transform->cipher_ctx_dec );
5679#endif /* MBEDTLS_USE_PSA_CRYPTO */
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +01005680
Hanno Beckerfd86ca82020-11-30 08:54:23 +00005681#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005682 mbedtls_md_free( &transform->md_ctx_enc );
5683 mbedtls_md_free( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +00005684#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02005685
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05005686 mbedtls_platform_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005687}
5688
Jerry Yuc7875b52021-09-05 21:05:50 +08005689void mbedtls_ssl_set_inbound_transform( mbedtls_ssl_context *ssl,
5690 mbedtls_ssl_transform *transform )
5691{
Jerry Yuc7875b52021-09-05 21:05:50 +08005692 ssl->transform_in = transform;
Jerry Yufd320e92021-10-08 21:52:41 +08005693 memset( ssl->in_ctr, 0, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
Jerry Yuc7875b52021-09-05 21:05:50 +08005694}
5695
5696void mbedtls_ssl_set_outbound_transform( mbedtls_ssl_context *ssl,
5697 mbedtls_ssl_transform *transform )
5698{
5699 ssl->transform_out = transform;
Jerry Yufd320e92021-10-08 21:52:41 +08005700 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
Jerry Yuc7875b52021-09-05 21:05:50 +08005701}
5702
Hanno Becker0271f962018-08-16 13:23:47 +01005703#if defined(MBEDTLS_SSL_PROTO_DTLS)
5704
Hanno Becker533ab5f2020-02-05 10:49:13 +00005705void mbedtls_ssl_buffering_free( mbedtls_ssl_context *ssl )
Hanno Becker0271f962018-08-16 13:23:47 +01005706{
5707 unsigned offset;
5708 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
5709
5710 if( hs == NULL )
5711 return;
5712
Hanno Becker283f5ef2018-08-24 09:34:47 +01005713 ssl_free_buffered_record( ssl );
5714
Hanno Becker0271f962018-08-16 13:23:47 +01005715 for( offset = 0; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
Hanno Beckere605b192018-08-21 15:59:07 +01005716 ssl_buffering_free_slot( ssl, offset );
5717}
5718
5719static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
5720 uint8_t slot )
5721{
5722 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
5723 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot];
Hanno Beckerb309b922018-08-23 13:18:05 +01005724
5725 if( slot >= MBEDTLS_SSL_MAX_BUFFERED_HS )
5726 return;
5727
Hanno Beckere605b192018-08-21 15:59:07 +01005728 if( hs_buf->is_valid == 1 )
Hanno Becker0271f962018-08-16 13:23:47 +01005729 {
Hanno Beckere605b192018-08-21 15:59:07 +01005730 hs->buffering.total_bytes_buffered -= hs_buf->data_len;
Hanno Becker805f2e12018-10-12 16:31:41 +01005731 mbedtls_platform_zeroize( hs_buf->data, hs_buf->data_len );
Hanno Beckere605b192018-08-21 15:59:07 +01005732 mbedtls_free( hs_buf->data );
5733 memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Hanno Becker0271f962018-08-16 13:23:47 +01005734 }
5735}
5736
5737#endif /* MBEDTLS_SSL_PROTO_DTLS */
5738
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005739/*
5740 * Convert version numbers to/from wire format
5741 * and, for DTLS, to/from TLS equivalent.
5742 *
5743 * For TLS this is the identity.
Brian J Murray1903fb32016-11-06 04:45:15 -08005744 * For DTLS, use 1's complement (v -> 255 - v, and then map as follows:
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005745 * 1.x <-> 3.x+1 for x != 0 (DTLS 1.2 based on TLS 1.2)
5746 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005747void mbedtls_ssl_write_version( int major, int minor, int transport,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005748 unsigned char ver[2] )
5749{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005750#if defined(MBEDTLS_SSL_PROTO_DTLS)
5751 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005752 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005753 if( minor == MBEDTLS_SSL_MINOR_VERSION_2 )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005754 --minor; /* DTLS 1.0 stored as TLS 1.1 internally */
5755
5756 ver[0] = (unsigned char)( 255 - ( major - 2 ) );
5757 ver[1] = (unsigned char)( 255 - ( minor - 1 ) );
5758 }
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01005759 else
5760#else
5761 ((void) transport);
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005762#endif
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01005763 {
5764 ver[0] = (unsigned char) major;
5765 ver[1] = (unsigned char) minor;
5766 }
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005767}
5768
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005769void mbedtls_ssl_read_version( int *major, int *minor, int transport,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005770 const unsigned char ver[2] )
5771{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005772#if defined(MBEDTLS_SSL_PROTO_DTLS)
5773 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005774 {
5775 *major = 255 - ver[0] + 2;
5776 *minor = 255 - ver[1] + 1;
5777
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005778 if( *minor == MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005779 ++*minor; /* DTLS 1.0 stored as TLS 1.1 internally */
5780 }
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01005781 else
5782#else
5783 ((void) transport);
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005784#endif
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01005785 {
5786 *major = ver[0];
5787 *minor = ver[1];
5788 }
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005789}
5790
Jerry Yue7047812021-09-13 19:26:39 +08005791/*
Jerry Yu3bf1f972021-09-22 21:37:18 +08005792 * Send pending fatal alert.
5793 * 0, No alert message.
5794 * !0, if mbedtls_ssl_send_alert_message() returned in error, the error code it
5795 * returned, ssl->alert_reason otherwise.
Jerry Yue7047812021-09-13 19:26:39 +08005796 */
5797int mbedtls_ssl_handle_pending_alert( mbedtls_ssl_context *ssl )
5798{
5799 int ret;
5800
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005801 /* No pending alert, return success*/
5802 if( ssl->send_alert == 0 )
5803 return( 0 );
Jerry Yu394ece62021-09-14 22:17:21 +08005804
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005805 ret = mbedtls_ssl_send_alert_message( ssl,
5806 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5807 ssl->alert_type );
5808
Jerry Yu3bf1f972021-09-22 21:37:18 +08005809 /* If mbedtls_ssl_send_alert_message() returned with MBEDTLS_ERR_SSL_WANT_WRITE,
5810 * do not clear the alert to be able to send it later.
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005811 */
5812 if( ret != MBEDTLS_ERR_SSL_WANT_WRITE )
5813 {
5814 ssl->send_alert = 0;
Jerry Yue7047812021-09-13 19:26:39 +08005815 }
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005816
5817 if( ret != 0 )
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005818 return( ret );
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005819
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005820 return( ssl->alert_reason );
Jerry Yue7047812021-09-13 19:26:39 +08005821}
5822
Jerry Yu394ece62021-09-14 22:17:21 +08005823/*
5824 * Set pending fatal alert flag.
5825 */
5826void mbedtls_ssl_pend_fatal_alert( mbedtls_ssl_context *ssl,
5827 unsigned char alert_type,
5828 int alert_reason )
5829{
5830 ssl->send_alert = 1;
5831 ssl->alert_type = alert_type;
5832 ssl->alert_reason = alert_reason;
5833}
5834
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005835#endif /* MBEDTLS_SSL_TLS_C */