blob: 4dd885f17ef8652c52fc494fa12c70041ece4bf4 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Jerry Yub476a442022-01-21 18:14:45 +080028#include <assert.h>
29
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
Jerry Yu6ade7432022-01-25 10:39:33 +080034#include <stdio.h>
SimonBd5800b72016-04-26 07:43:27 +010035#define mbedtls_calloc calloc
36#define mbedtls_free free
Jerry Yu6ade7432022-01-25 10:39:33 +080037#define mbedtls_printf printf
38#endif /* !MBEDTLS_PLATFORM_C */
SimonBd5800b72016-04-26 07:43:27 +010039
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000040#include "mbedtls/ssl.h"
Chris Jones84a773f2021-03-05 18:38:47 +000041#include "ssl_misc.h"
Janos Follath73c616b2019-12-18 15:07:04 +000042#include "mbedtls/debug.h"
43#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050044#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010045#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020046#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020047
Rich Evans00ab4702015-02-06 13:43:58 +000048#include <string.h>
49
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050050#if defined(MBEDTLS_USE_PSA_CRYPTO)
51#include "mbedtls/psa_util.h"
52#include "psa/crypto.h"
53#endif
54
Janos Follath23bdca02016-10-07 14:47:14 +010055#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000056#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020057#endif
58
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020059#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010060
Hanno Beckera0e20d02019-05-15 14:03:01 +010061#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010062/* Top-level Connection ID API */
63
Hanno Becker8367ccc2019-05-14 11:30:10 +010064int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
65 size_t len,
66 int ignore_other_cid )
Hanno Beckerad4a1372019-05-03 13:06:44 +010067{
68 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
69 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
70
Hanno Becker611ac772019-05-14 11:45:26 +010071 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
72 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
73 {
74 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
75 }
76
77 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010078 conf->cid_len = len;
79 return( 0 );
80}
81
Hanno Beckerf8542cf2019-04-09 15:22:03 +010082int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
83 int enable,
84 unsigned char const *own_cid,
85 size_t own_cid_len )
86{
Hanno Becker76a79ab2019-05-03 14:38:32 +010087 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
88 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
89
Hanno Beckerca092242019-04-25 16:01:49 +010090 ssl->negotiate_cid = enable;
91 if( enable == MBEDTLS_SSL_CID_DISABLED )
92 {
93 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
94 return( 0 );
95 }
96 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckerad4a1372019-05-03 13:06:44 +010097 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Beckerca092242019-04-25 16:01:49 +010098
Hanno Beckerad4a1372019-05-03 13:06:44 +010099 if( own_cid_len != ssl->conf->cid_len )
Hanno Beckerca092242019-04-25 16:01:49 +0100100 {
Hanno Beckerad4a1372019-05-03 13:06:44 +0100101 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
102 (unsigned) own_cid_len,
103 (unsigned) ssl->conf->cid_len ) );
Hanno Beckerca092242019-04-25 16:01:49 +0100104 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
105 }
106
107 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100108 /* Truncation is not an issue here because
109 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
110 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100111
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100112 return( 0 );
113}
114
115int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
116 int *enabled,
117 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
118 size_t *peer_cid_len )
119{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100120 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100121
Hanno Becker76a79ab2019-05-03 14:38:32 +0100122 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
123 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
124 {
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100125 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker76a79ab2019-05-03 14:38:32 +0100126 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100127
Hanno Beckerc5f24222019-05-03 12:54:52 +0100128 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
129 * were used, but client and server requested the empty CID.
130 * This is indistinguishable from not using the CID extension
131 * in the first place. */
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100132 if( ssl->transform_in->in_cid_len == 0 &&
133 ssl->transform_in->out_cid_len == 0 )
134 {
135 return( 0 );
136 }
137
Hanno Becker615ef172019-05-22 16:50:35 +0100138 if( peer_cid_len != NULL )
139 {
140 *peer_cid_len = ssl->transform_in->out_cid_len;
141 if( peer_cid != NULL )
142 {
143 memcpy( peer_cid, ssl->transform_in->out_cid,
144 ssl->transform_in->out_cid_len );
145 }
146 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100147
148 *enabled = MBEDTLS_SSL_CID_ENABLED;
149
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100150 return( 0 );
151}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100152#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100153
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200154#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200155
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200156#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200157/*
158 * Convert max_fragment_length codes to length.
159 * RFC 6066 says:
160 * enum{
161 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
162 * } MaxFragmentLength;
163 * and we add 0 -> extension unused
164 */
Angus Grattond8213d02016-05-25 20:56:48 +1000165static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200166{
Angus Grattond8213d02016-05-25 20:56:48 +1000167 switch( mfl )
168 {
169 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
170 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
171 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
172 return 512;
173 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
174 return 1024;
175 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
176 return 2048;
177 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
178 return 4096;
179 default:
180 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
181 }
182}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200183#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200184
Hanno Becker52055ae2019-02-06 14:30:46 +0000185int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
186 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200187{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188 mbedtls_ssl_session_free( dst );
189 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200190
吴敬辉0b716112021-11-29 10:46:35 +0800191#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
192 dst->ticket = NULL;
193#endif
194
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200195#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000196
197#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200198 if( src->peer_cert != NULL )
199 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000200 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200201
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200202 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200203 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200204 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200206 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200208 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200209 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200210 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200211 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200212 dst->peer_cert = NULL;
213 return( ret );
214 }
215 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000216#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker9198ad12019-02-05 17:00:50 +0000217 if( src->peer_cert_digest != NULL )
218 {
Hanno Becker9198ad12019-02-05 17:00:50 +0000219 dst->peer_cert_digest =
Hanno Beckeraccc5992019-02-25 10:06:59 +0000220 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9198ad12019-02-05 17:00:50 +0000221 if( dst->peer_cert_digest == NULL )
222 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
223
224 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
225 src->peer_cert_digest_len );
226 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000227 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000228 }
229#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200231#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200232
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200233#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200234 if( src->ticket != NULL )
235 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200236 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200237 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200238 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200239
240 memcpy( dst->ticket, src->ticket, src->ticket_len );
241 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200242#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200243
244 return( 0 );
245}
246
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500247#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
248static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
249{
250 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
251 if( resized_buffer == NULL )
252 return -1;
253
254 /* We want to copy len_new bytes when downsizing the buffer, and
255 * len_old bytes when upsizing, so we choose the smaller of two sizes,
256 * to fit one buffer into another. Size checks, ensuring that no data is
257 * lost, are done outside of this function. */
258 memcpy( resized_buffer, *buffer,
259 ( len_new < *len_old ) ? len_new : *len_old );
260 mbedtls_platform_zeroize( *buffer, *len_old );
261 mbedtls_free( *buffer );
262
263 *buffer = resized_buffer;
264 *len_old = len_new;
265
266 return 0;
267}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200268
269static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
Andrzej Kurek069fa962021-01-07 08:02:15 -0500270 size_t in_buf_new_len,
271 size_t out_buf_new_len )
Andrzej Kurek4a063792020-10-21 15:08:44 +0200272{
273 int modified = 0;
274 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
275 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
276 if( ssl->in_buf != NULL )
277 {
278 written_in = ssl->in_msg - ssl->in_buf;
279 iv_offset_in = ssl->in_iv - ssl->in_buf;
280 len_offset_in = ssl->in_len - ssl->in_buf;
281 if( downsizing ?
282 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
283 ssl->in_buf_len < in_buf_new_len )
284 {
285 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
286 {
287 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
288 }
289 else
290 {
Paul Elliottb7449902021-03-10 18:14:58 +0000291 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
292 in_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200293 modified = 1;
294 }
295 }
296 }
297
298 if( ssl->out_buf != NULL )
299 {
300 written_out = ssl->out_msg - ssl->out_buf;
301 iv_offset_out = ssl->out_iv - ssl->out_buf;
302 len_offset_out = ssl->out_len - ssl->out_buf;
303 if( downsizing ?
304 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
305 ssl->out_buf_len < out_buf_new_len )
306 {
307 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
308 {
309 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
310 }
311 else
312 {
Paul Elliottb7449902021-03-10 18:14:58 +0000313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
314 out_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200315 modified = 1;
316 }
317 }
318 }
319 if( modified )
320 {
321 /* Update pointers here to avoid doing it twice. */
322 mbedtls_ssl_reset_in_out_pointers( ssl );
323 /* Fields below might not be properly updated with record
324 * splitting or with CID, so they are manually updated here. */
325 ssl->out_msg = ssl->out_buf + written_out;
326 ssl->out_len = ssl->out_buf + len_offset_out;
327 ssl->out_iv = ssl->out_buf + iv_offset_out;
328
329 ssl->in_msg = ssl->in_buf + written_in;
330 ssl->in_len = ssl->in_buf + len_offset_in;
331 ssl->in_iv = ssl->in_buf + iv_offset_in;
332 }
333}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500334#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
335
Jerry Yudb8c48a2022-01-27 14:54:54 +0800336#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurekc929a822019-01-14 03:51:11 -0500337#if defined(MBEDTLS_USE_PSA_CRYPTO)
k-stachowiak81053a52019-08-17 10:30:28 +0200338
339static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
Andrzej Kurek03e01462022-01-03 12:53:24 +0100340 mbedtls_svc_key_id_t key,
k-stachowiak81053a52019-08-17 10:30:28 +0200341 psa_algorithm_t alg,
342 const unsigned char* seed, size_t seed_length,
343 const unsigned char* label, size_t label_length,
344 size_t capacity )
345{
346 psa_status_t status;
347
348 status = psa_key_derivation_setup( derivation, alg );
349 if( status != PSA_SUCCESS )
350 return( status );
351
352 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
353 {
354 status = psa_key_derivation_input_bytes( derivation,
355 PSA_KEY_DERIVATION_INPUT_SEED,
356 seed, seed_length );
357 if( status != PSA_SUCCESS )
358 return( status );
359
Ronald Croncf56a0a2020-08-04 09:51:30 +0200360 if( mbedtls_svc_key_id_is_null( key ) )
Gilles Peskine311f54d2019-09-23 18:19:22 +0200361 {
362 status = psa_key_derivation_input_bytes(
363 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
364 NULL, 0 );
365 }
366 else
367 {
368 status = psa_key_derivation_input_key(
Ronald Croncf56a0a2020-08-04 09:51:30 +0200369 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
Gilles Peskine311f54d2019-09-23 18:19:22 +0200370 }
k-stachowiak81053a52019-08-17 10:30:28 +0200371 if( status != PSA_SUCCESS )
372 return( status );
373
374 status = psa_key_derivation_input_bytes( derivation,
375 PSA_KEY_DERIVATION_INPUT_LABEL,
376 label, label_length );
377 if( status != PSA_SUCCESS )
378 return( status );
379 }
380 else
381 {
382 return( PSA_ERROR_NOT_SUPPORTED );
383 }
384
385 status = psa_key_derivation_set_capacity( derivation, capacity );
386 if( status != PSA_SUCCESS )
387 return( status );
388
389 return( PSA_SUCCESS );
390}
391
Andrzej Kurekc929a822019-01-14 03:51:11 -0500392static int tls_prf_generic( mbedtls_md_type_t md_type,
393 const unsigned char *secret, size_t slen,
394 const char *label,
395 const unsigned char *random, size_t rlen,
396 unsigned char *dstbuf, size_t dlen )
397{
398 psa_status_t status;
399 psa_algorithm_t alg;
Andrzej Kurek03e01462022-01-03 12:53:24 +0100400 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
Janos Follathda6ac012019-08-16 13:47:29 +0100401 psa_key_derivation_operation_t derivation =
Janos Follath8dee8772019-07-30 12:53:32 +0100402 PSA_KEY_DERIVATION_OPERATION_INIT;
Andrzej Kurekc929a822019-01-14 03:51:11 -0500403
Andrzej Kurekc929a822019-01-14 03:51:11 -0500404 if( md_type == MBEDTLS_MD_SHA384 )
405 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
406 else
407 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
408
Gilles Peskine311f54d2019-09-23 18:19:22 +0200409 /* Normally a "secret" should be long enough to be impossible to
410 * find by brute force, and in particular should not be empty. But
411 * this PRF is also used to derive an IV, in particular in EAP-TLS,
412 * and for this use case it makes sense to have a 0-length "secret".
413 * Since the key API doesn't allow importing a key of length 0,
Ronald Croncf56a0a2020-08-04 09:51:30 +0200414 * keep master_key=0, which setup_psa_key_derivation() understands
Gilles Peskine311f54d2019-09-23 18:19:22 +0200415 * to mean a 0-length "secret" input. */
416 if( slen != 0 )
417 {
418 psa_key_attributes_t key_attributes = psa_key_attributes_init();
419 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
420 psa_set_key_algorithm( &key_attributes, alg );
421 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500422
Ronald Croncf56a0a2020-08-04 09:51:30 +0200423 status = psa_import_key( &key_attributes, secret, slen, &master_key );
Gilles Peskine311f54d2019-09-23 18:19:22 +0200424 if( status != PSA_SUCCESS )
425 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
426 }
Andrzej Kurekc929a822019-01-14 03:51:11 -0500427
k-stachowiak81053a52019-08-17 10:30:28 +0200428 status = setup_psa_key_derivation( &derivation,
Ronald Croncf56a0a2020-08-04 09:51:30 +0200429 master_key, alg,
k-stachowiak81053a52019-08-17 10:30:28 +0200430 random, rlen,
431 (unsigned char const *) label,
432 (size_t) strlen( label ),
433 dlen );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500434 if( status != PSA_SUCCESS )
435 {
Janos Follathda6ac012019-08-16 13:47:29 +0100436 psa_key_derivation_abort( &derivation );
Ronald Croncf56a0a2020-08-04 09:51:30 +0200437 psa_destroy_key( master_key );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500438 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
439 }
440
Janos Follathda6ac012019-08-16 13:47:29 +0100441 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500442 if( status != PSA_SUCCESS )
443 {
Janos Follathda6ac012019-08-16 13:47:29 +0100444 psa_key_derivation_abort( &derivation );
Ronald Croncf56a0a2020-08-04 09:51:30 +0200445 psa_destroy_key( master_key );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500446 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
447 }
448
Janos Follathda6ac012019-08-16 13:47:29 +0100449 status = psa_key_derivation_abort( &derivation );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500450 if( status != PSA_SUCCESS )
Andrzej Kurek70737ca2019-01-14 05:37:13 -0500451 {
Ronald Croncf56a0a2020-08-04 09:51:30 +0200452 psa_destroy_key( master_key );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500453 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Andrzej Kurek70737ca2019-01-14 05:37:13 -0500454 }
Andrzej Kurekc929a822019-01-14 03:51:11 -0500455
Ronald Croncf56a0a2020-08-04 09:51:30 +0200456 if( ! mbedtls_svc_key_id_is_null( master_key ) )
457 status = psa_destroy_key( master_key );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500458 if( status != PSA_SUCCESS )
459 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
460
Andrzej Kurek33171262019-01-15 03:25:18 -0500461 return( 0 );
Andrzej Kurekc929a822019-01-14 03:51:11 -0500462}
463
464#else /* MBEDTLS_USE_PSA_CRYPTO */
465
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200466static int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100467 const unsigned char *secret, size_t slen,
468 const char *label,
469 const unsigned char *random, size_t rlen,
470 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000471{
472 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100473 size_t i, j, k, md_len;
Ron Eldor3b350852019-05-07 18:31:49 +0300474 unsigned char *tmp;
475 size_t tmp_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200476 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
477 const mbedtls_md_info_t *md_info;
478 mbedtls_md_context_t md_ctx;
Janos Follath865b3eb2019-12-16 11:46:15 +0000479 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100480
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200481 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000482
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200483 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
484 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100485
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200486 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100487
Ron Eldor3b350852019-05-07 18:31:49 +0300488 tmp_len = md_len + strlen( label ) + rlen;
489 tmp = mbedtls_calloc( 1, tmp_len );
490 if( tmp == NULL )
491 {
492 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
493 goto exit;
494 }
Paul Bakker1ef83d62012-04-11 12:09:53 +0000495
496 nb = strlen( label );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100497 memcpy( tmp + md_len, label, nb );
498 memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000499 nb += rlen;
500
501 /*
502 * Compute P_<hash>(secret, label + random)[0..dlen]
503 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200504 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Ron Eldor3b350852019-05-07 18:31:49 +0300505 goto exit;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100506
Gilles Peskineecf6beb2021-12-10 21:35:10 +0100507 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
508 if( ret != 0 )
509 goto exit;
510 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
511 if( ret != 0 )
512 goto exit;
513 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
514 if( ret != 0 )
515 goto exit;
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100516
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100517 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000518 {
Gilles Peskineecf6beb2021-12-10 21:35:10 +0100519 ret = mbedtls_md_hmac_reset ( &md_ctx );
520 if( ret != 0 )
521 goto exit;
522 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
523 if( ret != 0 )
524 goto exit;
525 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
526 if( ret != 0 )
527 goto exit;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100528
Gilles Peskineecf6beb2021-12-10 21:35:10 +0100529 ret = mbedtls_md_hmac_reset ( &md_ctx );
530 if( ret != 0 )
531 goto exit;
532 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
533 if( ret != 0 )
534 goto exit;
535 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
536 if( ret != 0 )
537 goto exit;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000538
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100539 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000540
541 for( j = 0; j < k; j++ )
542 dstbuf[i + j] = h_i[j];
543 }
544
Ron Eldor3b350852019-05-07 18:31:49 +0300545exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200546 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100547
Ron Eldor3b350852019-05-07 18:31:49 +0300548 mbedtls_platform_zeroize( tmp, tmp_len );
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500549 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000550
Ron Eldor3b350852019-05-07 18:31:49 +0300551 mbedtls_free( tmp );
552
553 return( ret );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000554}
Andrzej Kurekc929a822019-01-14 03:51:11 -0500555#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200556#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100557static int tls_prf_sha256( const unsigned char *secret, size_t slen,
558 const char *label,
559 const unsigned char *random, size_t rlen,
560 unsigned char *dstbuf, size_t dlen )
561{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200562 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100563 label, random, rlen, dstbuf, dlen ) );
564}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200565#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000566
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200567#if defined(MBEDTLS_SHA384_C)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200568static int tls_prf_sha384( const unsigned char *secret, size_t slen,
569 const char *label,
570 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000571 unsigned char *dstbuf, size_t dlen )
572{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200573 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100574 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +0000575}
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200576#endif /* MBEDTLS_SHA384_C */
Paul Bakkerca4ab492012-04-18 14:23:57 +0000577
Jerry Yudb8c48a2022-01-27 14:54:54 +0800578#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200579
Jerry Yudb8c48a2022-01-27 14:54:54 +0800580static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
581#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200582#if defined(MBEDTLS_SHA256_C)
Rodrigo Dias Correa2c424572020-11-10 01:38:00 -0300583static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200584static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200585#endif
Paul Bakker769075d2012-11-24 11:26:46 +0100586
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200587#if defined(MBEDTLS_SHA384_C)
Rodrigo Dias Correa2c424572020-11-10 01:38:00 -0300588static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200589static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakker769075d2012-11-24 11:26:46 +0100590#endif
Jerry Yudb8c48a2022-01-27 14:54:54 +0800591#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
592
593#if defined(MBEDTLS_SHA256_C)
594static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
595#endif
596
597#if defined(MBEDTLS_SHA384_C)
598static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
599#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +0000600
Manuel Pégourié-Gonnard45be3d82019-02-18 23:35:14 +0100601#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \
Hanno Becker7d0a5692018-10-23 15:26:22 +0100602 defined(MBEDTLS_USE_PSA_CRYPTO)
603static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
604{
605 if( ssl->conf->f_psk != NULL )
606 {
607 /* If we've used a callback to select the PSK,
608 * the static configuration is irrelevant. */
Ronald Croncf56a0a2020-08-04 09:51:30 +0200609 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Becker7d0a5692018-10-23 15:26:22 +0100610 return( 1 );
611
612 return( 0 );
613 }
614
Ronald Croncf56a0a2020-08-04 09:51:30 +0200615 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
Hanno Becker7d0a5692018-10-23 15:26:22 +0100616 return( 1 );
617
618 return( 0 );
619}
620#endif /* MBEDTLS_USE_PSA_CRYPTO &&
Manuel Pégourié-Gonnard45be3d82019-02-18 23:35:14 +0100621 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
Hanno Becker7d0a5692018-10-23 15:26:22 +0100622
Ron Eldorcf280092019-05-14 20:19:13 +0300623static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
624{
Jerry Yuc5aef882021-12-23 20:15:02 +0800625 ((void) tls_prf);
Ron Eldorcf280092019-05-14 20:19:13 +0300626#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200627#if defined(MBEDTLS_SHA384_C)
Ron Eldorcf280092019-05-14 20:19:13 +0300628 if( tls_prf == tls_prf_sha384 )
629 {
630 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
631 }
632 else
633#endif
634#if defined(MBEDTLS_SHA256_C)
635 if( tls_prf == tls_prf_sha256 )
636 {
637 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
638 }
639 else
640#endif
641#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
642 return( MBEDTLS_SSL_TLS_PRF_NONE );
643}
Ron Eldorcf280092019-05-14 20:19:13 +0300644
Ron Eldor51d3ab52019-05-12 14:54:30 +0300645int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
646 const unsigned char *secret, size_t slen,
647 const char *label,
648 const unsigned char *random, size_t rlen,
649 unsigned char *dstbuf, size_t dlen )
650{
651 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
652
653 switch( prf )
654 {
Ron Eldord2f25f72019-05-15 14:54:22 +0300655#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200656#if defined(MBEDTLS_SHA384_C)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300657 case MBEDTLS_SSL_TLS_PRF_SHA384:
658 tls_prf = tls_prf_sha384;
659 break;
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200660#endif /* MBEDTLS_SHA384_C */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300661#if defined(MBEDTLS_SHA256_C)
662 case MBEDTLS_SSL_TLS_PRF_SHA256:
663 tls_prf = tls_prf_sha256;
664 break;
Ron Eldord2f25f72019-05-15 14:54:22 +0300665#endif /* MBEDTLS_SHA256_C */
666#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300667 default:
668 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
669 }
670
671 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
672}
673
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200674/* Type for the TLS PRF */
675typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
676 const unsigned char *, size_t,
677 unsigned char *, size_t);
678
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +0200679/*
Manuel Pégourié-Gonnardcba40d92019-05-06 12:55:40 +0200680 * Populate a transform structure with session keys and all the other
681 * necessary information.
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +0200682 *
Manuel Pégourié-Gonnardcba40d92019-05-06 12:55:40 +0200683 * Parameters:
684 * - [in/out]: transform: structure to populate
685 * [in] must be just initialised with mbedtls_ssl_transform_init()
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200686 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200687 * - [in] ciphersuite
688 * - [in] master
689 * - [in] encrypt_then_mac
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200690 * - [in] compression
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200691 * - [in] tls_prf: pointer to PRF to use for key derivation
692 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200693 * - [in] minor_ver: SSL/TLS minor version
694 * - [in] endpoint: client or server
Andrzej Kurek5902cd62021-09-28 10:00:32 -0400695 * - [in] ssl: used for:
696 * - ssl->conf->{f,p}_export_keys
697 * [in] optionally used for:
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200698 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +0200699 */
Hanno Beckerbd257552021-03-22 06:59:27 +0000700static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200701 int ciphersuite,
702 const unsigned char master[48],
Hanno Beckerbd257552021-03-22 06:59:27 +0000703#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
704 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200705 int encrypt_then_mac,
Hanno Beckerbd257552021-03-22 06:59:27 +0000706#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
707 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200708 ssl_tls_prf_t tls_prf,
709 const unsigned char randbytes[64],
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200710 int minor_ver,
711 unsigned endpoint,
Mateusz Starzyke204dbf2021-03-15 17:57:20 +0100712 const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +0000713{
Paul Bakkerda02a7f2013-08-31 17:25:14 +0200714 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +0000715 unsigned char keyblk[256];
716 unsigned char *key1;
717 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +0100718 unsigned char *mac_enc;
719 unsigned char *mac_dec;
sander-visser3888b032020-05-06 21:49:46 +0200720 size_t mac_key_len = 0;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200721 size_t iv_copy_len;
Gilles Peskine88d681c2021-09-01 11:19:33 +0200722 size_t keylen;
Hanno Beckere694c3e2017-12-27 21:34:08 +0000723 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200724 const mbedtls_cipher_info_t *cipher_info;
725 const mbedtls_md_info_t *md_info;
Paul Bakker68884e32013-01-07 18:20:04 +0100726
Przemyslaw Stekielffccda42022-01-11 14:44:01 +0100727#if defined(MBEDTLS_USE_PSA_CRYPTO)
728 psa_key_type_t key_type;
729 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
730 psa_algorithm_t alg;
731 size_t key_bits;
Przemyslaw Stekield66387f2022-02-03 08:55:33 +0100732 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielffccda42022-01-11 14:44:01 +0100733#endif
734
Andrzej Kurek324f72e2021-09-29 04:21:21 -0400735#if !defined(MBEDTLS_DEBUG_C) && \
736 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Andrzej Kureka72fe642021-09-29 15:57:30 -0400737 if( ssl->f_export_keys == NULL )
738 {
739 ssl = NULL; /* make sure we don't use it except for these cases */
740 (void) ssl;
741 }
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200742#endif
743
Manuel Pégourié-Gonnard96fb0ee2019-07-09 12:54:17 +0200744 /*
745 * Some data just needs copying into the structure
746 */
Jaeden Amero2de07f12019-06-05 13:32:08 +0100747#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000748 defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200749 transform->encrypt_then_mac = encrypt_then_mac;
Hanno Becker9eddaeb2017-12-27 21:37:21 +0000750#endif
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200751 transform->minor_ver = minor_ver;
Hanno Beckere694c3e2017-12-27 21:34:08 +0000752
Manuel Pégourié-Gonnard96fb0ee2019-07-09 12:54:17 +0200753#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
754 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
755#endif
756
Ronald Cron6f135e12021-12-08 16:57:54 +0100757#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Beckerc0da10d2021-04-21 05:32:23 +0100758 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
759 {
760 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
761 * generation separate. This should never happen. */
762 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
763 }
Ronald Cron6f135e12021-12-08 16:57:54 +0100764#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerc0da10d2021-04-21 05:32:23 +0100765
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200766 /*
767 * Get various info structures
768 */
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200769 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200770 if( ciphersuite_info == NULL )
771 {
772 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200773 ciphersuite ) );
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200774 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
775 }
776
Hanno Beckere694c3e2017-12-27 21:34:08 +0000777 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
Paul Bakker68884e32013-01-07 18:20:04 +0100778 if( cipher_info == NULL )
779 {
Paul Elliott9f352112020-12-09 14:55:45 +0000780 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
Hanno Beckere694c3e2017-12-27 21:34:08 +0000781 ciphersuite_info->cipher ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200782 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100783 }
784
Hanno Beckere694c3e2017-12-27 21:34:08 +0000785 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
Paul Bakker68884e32013-01-07 18:20:04 +0100786 if( md_info == NULL )
787 {
Paul Elliott9f352112020-12-09 14:55:45 +0000788 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
Paul Elliott3891caf2020-12-17 18:42:40 +0000789 (unsigned) ciphersuite_info->mac ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200790 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100791 }
792
Hanno Beckera0e20d02019-05-15 14:03:01 +0100793#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker4bf74652019-04-26 16:22:27 +0100794 /* Copy own and peer's CID if the use of the CID
795 * extension has been negotiated. */
796 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
797 {
798 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
Hanno Becker8a7f9722019-04-30 13:52:29 +0100799
Hanno Becker05154c32019-05-03 15:23:51 +0100800 transform->in_cid_len = ssl->own_cid_len;
Hanno Becker05154c32019-05-03 15:23:51 +0100801 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
Hanno Becker1c1f0462019-05-03 12:55:51 +0100802 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
Hanno Becker4bf74652019-04-26 16:22:27 +0100803 transform->in_cid_len );
Hanno Beckerd1f20352019-05-15 10:21:55 +0100804
805 transform->out_cid_len = ssl->handshake->peer_cid_len;
806 memcpy( transform->out_cid, ssl->handshake->peer_cid,
807 ssl->handshake->peer_cid_len );
808 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
809 transform->out_cid_len );
Hanno Becker4bf74652019-04-26 16:22:27 +0100810 }
Hanno Beckera0e20d02019-05-15 14:03:01 +0100811#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker4bf74652019-04-26 16:22:27 +0100812
Paul Bakker5121ce52009-01-03 21:22:43 +0000813 /*
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200814 * Compute key block using the PRF
Paul Bakker5121ce52009-01-03 21:22:43 +0000815 */
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200816 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100817 if( ret != 0 )
818 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200819 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100820 return( ret );
821 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000822
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200823 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
Manuel Pégourié-Gonnardd91efa42019-05-20 10:27:20 +0200824 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200825 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
Manuel Pégourié-Gonnard9b108c22019-05-06 13:32:17 +0200826 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200827 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000828
Paul Bakker5121ce52009-01-03 21:22:43 +0000829 /*
830 * Determine the appropriate key, IV and MAC length.
831 */
Paul Bakker68884e32013-01-07 18:20:04 +0100832
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200833 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200834
Hanno Becker8031d062018-01-03 15:32:31 +0000835#if defined(MBEDTLS_GCM_C) || \
836 defined(MBEDTLS_CCM_C) || \
837 defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200838 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_GCM ||
839 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CCM ||
840 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +0000841 {
Hanno Beckerf704bef2018-11-16 15:21:18 +0000842 size_t explicit_ivlen;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200843
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200844 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +0000845 mac_key_len = 0;
Hanno Beckere694c3e2017-12-27 21:34:08 +0000846 transform->taglen =
847 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200848
Hanno Becker447558d2020-05-28 07:36:33 +0100849 /* All modes haves 96-bit IVs, but the length of the static parts vary
850 * with mode and version:
851 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
852 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
Hanno Beckerf93c2d72020-05-28 07:39:43 +0100853 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
854 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
855 * sequence number).
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200856 */
Paul Bakker68884e32013-01-07 18:20:04 +0100857 transform->ivlen = 12;
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200858 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200859 transform->fixed_ivlen = 12;
860 else
Hanno Beckerc0da10d2021-04-21 05:32:23 +0100861 transform->fixed_ivlen = 4;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200862
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200863 /* Minimum length of encrypted record */
864 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
Hanno Beckere694c3e2017-12-27 21:34:08 +0000865 transform->minlen = explicit_ivlen + transform->taglen;
Paul Bakker68884e32013-01-07 18:20:04 +0100866 }
867 else
Hanno Becker8031d062018-01-03 15:32:31 +0000868#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000869#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200870 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM ||
871 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
Paul Bakker68884e32013-01-07 18:20:04 +0100872 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200873 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200874 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
875 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +0100876 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200877 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Ron Eldore6992702019-05-07 18:27:13 +0300878 goto end;
Paul Bakker68884e32013-01-07 18:20:04 +0100879 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000880
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200881 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +0000882 mac_key_len = mbedtls_md_get_size( md_info );
883 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200884
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200885 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +0100886 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +0000887
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200888 /* Minimum length */
Gilles Peskinee720dbe2021-07-19 17:37:46 +0200889 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200890 transform->minlen = transform->maclen;
891 else
Paul Bakker68884e32013-01-07 18:20:04 +0100892 {
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200893 /*
894 * GenericBlockCipher:
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100895 * 1. if EtM is in use: one block plus MAC
896 * otherwise: * first multiple of blocklen greater than maclen
TRodziewicz2abf03c2021-06-25 14:40:09 +0200897 * 2. IV
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200898 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200899#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6fa57bf2019-05-10 10:50:04 +0200900 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100901 {
902 transform->minlen = transform->maclen
903 + cipher_info->block_size;
904 }
905 else
906#endif
907 {
908 transform->minlen = transform->maclen
909 + cipher_info->block_size
910 - transform->maclen % cipher_info->block_size;
911 }
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200912
TRodziewicz0f82ec62021-05-12 17:49:18 +0200913#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
914 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200915 {
916 transform->minlen += transform->ivlen;
917 }
918 else
919#endif
920 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200921 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Ron Eldore6992702019-05-07 18:27:13 +0300922 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
923 goto end;
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200924 }
Paul Bakker68884e32013-01-07 18:20:04 +0100925 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000926 }
Hanno Becker8031d062018-01-03 15:32:31 +0000927 else
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000928#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Hanno Becker8031d062018-01-03 15:32:31 +0000929 {
930 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
931 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
932 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000933
Hanno Becker88aaf652017-12-27 08:17:40 +0000934 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
935 (unsigned) keylen,
936 (unsigned) transform->minlen,
937 (unsigned) transform->ivlen,
938 (unsigned) transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000939
940 /*
941 * Finally setup the cipher contexts, IVs and MAC secrets.
942 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200943#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200944 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +0000945 {
Hanno Becker81c7b182017-11-09 18:39:33 +0000946 key1 = keyblk + mac_key_len * 2;
Hanno Becker88aaf652017-12-27 08:17:40 +0000947 key2 = keyblk + mac_key_len * 2 + keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +0000948
Paul Bakker68884e32013-01-07 18:20:04 +0100949 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +0000950 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +0000951
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000952 /*
953 * This is not used in TLS v1.1.
954 */
Paul Bakker48916f92012-09-16 19:57:18 +0000955 iv_copy_len = ( transform->fixed_ivlen ) ?
956 transform->fixed_ivlen : transform->ivlen;
Hanno Becker88aaf652017-12-27 08:17:40 +0000957 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
958 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000959 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +0000960 }
961 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200962#endif /* MBEDTLS_SSL_CLI_C */
963#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardc864f6a2019-05-06 13:48:22 +0200964 if( endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +0000965 {
Hanno Becker88aaf652017-12-27 08:17:40 +0000966 key1 = keyblk + mac_key_len * 2 + keylen;
Hanno Becker81c7b182017-11-09 18:39:33 +0000967 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000968
Hanno Becker81c7b182017-11-09 18:39:33 +0000969 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +0100970 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +0000971
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000972 /*
973 * This is not used in TLS v1.1.
974 */
Paul Bakker48916f92012-09-16 19:57:18 +0000975 iv_copy_len = ( transform->fixed_ivlen ) ?
976 transform->fixed_ivlen : transform->ivlen;
Hanno Becker88aaf652017-12-27 08:17:40 +0000977 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
978 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000979 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +0000980 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100981 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200982#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100983 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200984 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Ron Eldore6992702019-05-07 18:27:13 +0300985 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
986 goto end;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100987 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000988
TRodziewicz4ca18aa2021-05-20 14:46:20 +0200989#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
TRodziewicz0f82ec62021-05-12 17:49:18 +0200990#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
TRodziewicz345165c2021-07-06 13:42:11 +0200991 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
992 For AEAD-based ciphersuites, there is nothing to do here. */
993 if( mac_key_len != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +0100994 {
Gilles Peskineecf6beb2021-12-10 21:35:10 +0100995 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
996 if( ret != 0 )
997 goto end;
998 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
999 if( ret != 0 )
1000 goto end;
Paul Bakker68884e32013-01-07 18:20:04 +01001001 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001002#endif
Hanno Beckerfd86ca82020-11-30 08:54:23 +00001003#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Paul Bakker68884e32013-01-07 18:20:04 +01001004
Hanno Beckerd56ed242018-01-03 15:32:51 +00001005 ((void) mac_dec);
1006 ((void) mac_enc);
Paul Bakker05ef8352012-05-08 09:17:57 +00001007
Andrzej Kureka72fe642021-09-29 15:57:30 -04001008 if( ssl != NULL && ssl->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001009 {
Hanno Becker7e6c1782021-06-08 09:24:55 +01001010 ssl->f_export_keys( ssl->p_export_keys,
1011 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
1012 master, 48,
1013 randbytes + 32,
1014 randbytes,
1015 tls_prf_get_type( tls_prf ) );
Ron Eldorf5cc10d2019-05-07 18:33:40 +03001016 }
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001017
Hanno Beckerf704bef2018-11-16 15:21:18 +00001018#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01001019 if( ( status = mbedtls_ssl_cipher_to_psa( cipher_info->type,
Przemyslaw Stekielffccda42022-01-11 14:44:01 +01001020 transform->taglen,
1021 &alg,
1022 &key_type,
1023 &key_bits ) ) != PSA_SUCCESS )
1024 {
Przemyslaw Stekiel77aec8d2022-01-31 20:22:53 +01001025 ret = psa_ssl_status_to_mbedtls( status );
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01001026 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", ret );
Przemyslaw Stekielffccda42022-01-11 14:44:01 +01001027 goto end;
1028 }
1029
Przemyslaw Stekielffccda42022-01-11 14:44:01 +01001030 transform->psa_alg = alg;
1031
Przemyslaw Stekielf9cd6082022-02-01 11:25:55 +01001032 if ( alg != MBEDTLS_SSL_NULL_CIPHER )
Przemyslaw Stekielffccda42022-01-11 14:44:01 +01001033 {
Przemyslaw Stekielf9cd6082022-02-01 11:25:55 +01001034 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
1035 psa_set_key_algorithm( &attributes, alg );
1036 psa_set_key_type( &attributes, key_type );
Przemyslaw Stekielfe7397d2022-01-17 15:47:07 +01001037
Przemyslaw Stekielf9cd6082022-02-01 11:25:55 +01001038 if( ( status = psa_import_key( &attributes,
1039 key1,
1040 PSA_BITS_TO_BYTES( key_bits ),
1041 &transform->psa_key_enc ) ) != PSA_SUCCESS )
1042 {
1043 MBEDTLS_SSL_DEBUG_RET( 3, "psa_import_key", (int)status );
1044 ret = psa_ssl_status_to_mbedtls( status );
1045 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
1046 goto end;
1047 }
Przemyslaw Stekielfe7397d2022-01-17 15:47:07 +01001048
Przemyslaw Stekielf9cd6082022-02-01 11:25:55 +01001049 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
1050
1051 if( ( status = psa_import_key( &attributes,
1052 key2,
1053 PSA_BITS_TO_BYTES( key_bits ),
1054 &transform->psa_key_dec ) ) != PSA_SUCCESS )
1055 {
1056 ret = psa_ssl_status_to_mbedtls( status );
1057 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
1058 goto end;
1059 }
Przemyslaw Stekielffccda42022-01-11 14:44:01 +01001060 }
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001061#else
1062 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
1063 cipher_info ) ) != 0 )
1064 {
1065 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1066 goto end;
1067 }
1068
1069 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
1070 cipher_info ) ) != 0 )
1071 {
1072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1073 goto end;
1074 }
1075
1076 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
1077 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
1078 MBEDTLS_ENCRYPT ) ) != 0 )
1079 {
1080 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1081 goto end;
1082 }
1083
1084 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
1085 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
1086 MBEDTLS_DECRYPT ) ) != 0 )
1087 {
1088 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1089 goto end;
1090 }
Przemyslaw Stekielffccda42022-01-11 14:44:01 +01001091
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001092#if defined(MBEDTLS_CIPHER_MODE_CBC)
Gilles Peskinee720dbe2021-07-19 17:37:46 +02001093 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001094 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001095 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1096 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001097 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001098 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Ron Eldore6992702019-05-07 18:27:13 +03001099 goto end;
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001100 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001101
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001102 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1103 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001104 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Ron Eldore6992702019-05-07 18:27:13 +03001106 goto end;
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001107 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001108 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001109#endif /* MBEDTLS_CIPHER_MODE_CBC */
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001110#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker5121ce52009-01-03 21:22:43 +00001111
Ron Eldore6992702019-05-07 18:27:13 +03001112end:
Ron Eldora9f9a732019-05-07 18:29:02 +03001113 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Ron Eldore6992702019-05-07 18:27:13 +03001114 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001115}
1116
Jerry Yubef175d2022-01-28 10:52:05 +08001117#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001118/*
TRodziewicz0f82ec62021-05-12 17:49:18 +02001119 * Set appropriate PRF function and other SSL / TLS1.2 functions
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001120 *
1121 * Inputs:
1122 * - SSL/TLS minor version
1123 * - hash associated with the ciphersuite (only used by TLS 1.2)
1124 *
Manuel Pégourié-Gonnard31d3ef12019-05-10 10:25:00 +02001125 * Outputs:
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001126 * - the tls_prf, calc_verify and calc_finished members of handshake structure
1127 */
1128static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
1129 int minor_ver,
1130 mbedtls_md_type_t hash )
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001131{
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001132
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02001133#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001134 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1135 hash == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001136 {
1137 handshake->tls_prf = tls_prf_sha384;
1138 handshake->calc_verify = ssl_calc_verify_tls_sha384;
1139 handshake->calc_finished = ssl_calc_finished_tls_sha384;
1140 }
1141 else
1142#endif
1143#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001144 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001145 {
1146 handshake->tls_prf = tls_prf_sha256;
1147 handshake->calc_verify = ssl_calc_verify_tls_sha256;
1148 handshake->calc_finished = ssl_calc_finished_tls_sha256;
1149 }
1150 else
1151#endif
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001152 {
Jerry Yubef175d2022-01-28 10:52:05 +08001153 (void) hash;
1154 (void) minor_ver;
1155 (void) handshake;
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001156 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1157 }
Jerry Yubef175d2022-01-28 10:52:05 +08001158
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001159
1160 return( 0 );
1161}
1162
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001163/*
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001164 * Compute master secret if needed
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001165 *
1166 * Parameters:
1167 * [in/out] handshake
1168 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001169 * (PSA-PSK) ciphersuite_info, psk_opaque
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001170 * [out] premaster (cleared)
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001171 * [out] master
1172 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
1173 * debug: conf->f_dbg, conf->p_dbg
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001174 * EMS: passed to calc_verify (debug + session_negotiate)
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001175 * PSA-PSA: minor_ver, conf
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001176 */
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001177static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001178 unsigned char *master,
Manuel Pégourié-Gonnard0d56aaa2019-05-03 09:58:33 +02001179 const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001180{
Janos Follath865b3eb2019-12-16 11:46:15 +00001181 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001182
1183 /* cf. RFC 5246, Section 8.1:
1184 * "The master secret is always exactly 48 bytes in length." */
1185 size_t const master_secret_len = 48;
1186
1187#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1188 unsigned char session_hash[48];
1189#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1190
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001191 /* The label for the KDF used for key expansion.
1192 * This is either "master secret" or "extended master secret"
1193 * depending on whether the Extended Master Secret extension
1194 * is used. */
1195 char const *lbl = "master secret";
1196
1197 /* The salt for the KDF used for key expansion.
1198 * - If the Extended Master Secret extension is not used,
1199 * this is ClientHello.Random + ServerHello.Random
1200 * (see Sect. 8.1 in RFC 5246).
1201 * - If the Extended Master Secret extension is used,
1202 * this is the transcript of the handshake so far.
1203 * (see Sect. 4 in RFC 7627). */
1204 unsigned char const *salt = handshake->randbytes;
1205 size_t salt_len = 64;
1206
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001207#if !defined(MBEDTLS_DEBUG_C) && \
1208 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
1209 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
1210 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
Manuel Pégourié-Gonnarda7505d12019-05-07 10:17:56 +02001211 ssl = NULL; /* make sure we don't use it except for those cases */
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001212 (void) ssl;
1213#endif
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001214
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001215 if( handshake->resume != 0 )
1216 {
1217 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001218 return( 0 );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001219 }
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001220
1221#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001222 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001223 {
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001224 lbl = "extended master secret";
1225 salt = session_hash;
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001226 handshake->calc_verify( ssl, session_hash, &salt_len );
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001227
Manuel Pégourié-Gonnard8faa70e2019-05-20 12:09:50 +02001228 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
1229 session_hash, salt_len );
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001230 }
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001231#endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */
1232
1233#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001234 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1235 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001236 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001237 ssl_use_opaque_psk( ssl ) == 1 )
1238 {
1239 /* Perform PSK-to-MS expansion in a single step. */
1240 psa_status_t status;
1241 psa_algorithm_t alg;
Andrzej Kurek03e01462022-01-03 12:53:24 +01001242 mbedtls_svc_key_id_t psk;
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001243 psa_key_derivation_operation_t derivation =
1244 PSA_KEY_DERIVATION_OPERATION_INIT;
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001245 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001246
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001247 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001248
Guilhem Bryantc5285d82020-03-25 17:08:15 +00001249 psk = mbedtls_ssl_get_opaque_psk( ssl );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001250
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001251 if( hash_alg == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001252 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001253 else
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001254 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
1255
k-stachowiak81053a52019-08-17 10:30:28 +02001256 status = setup_psa_key_derivation( &derivation, psk, alg,
1257 salt, salt_len,
1258 (unsigned char const *) lbl,
1259 (size_t) strlen( lbl ),
1260 master_secret_len );
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001261 if( status != PSA_SUCCESS )
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001262 {
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001263 psa_key_derivation_abort( &derivation );
1264 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001265 }
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001266
1267 status = psa_key_derivation_output_bytes( &derivation,
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001268 master,
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001269 master_secret_len );
1270 if( status != PSA_SUCCESS )
1271 {
1272 psa_key_derivation_abort( &derivation );
1273 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1274 }
1275
1276 status = psa_key_derivation_abort( &derivation );
1277 if( status != PSA_SUCCESS )
1278 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1279 }
1280 else
1281#endif
1282 {
1283 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
1284 lbl, salt, salt_len,
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001285 master,
Manuel Pégourié-Gonnard85680c42019-05-03 09:16:16 +02001286 master_secret_len );
1287 if( ret != 0 )
1288 {
1289 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
1290 return( ret );
1291 }
1292
1293 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
1294 handshake->premaster,
1295 handshake->pmslen );
1296
1297 mbedtls_platform_zeroize( handshake->premaster,
1298 sizeof(handshake->premaster) );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001299 }
1300
1301 return( 0 );
1302}
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001303
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +02001304int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
1305{
Janos Follath865b3eb2019-12-16 11:46:15 +00001306 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001307 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
1308 ssl->handshake->ciphersuite_info;
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001309
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001310 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
1311
1312 /* Set PRF, calc_verify and calc_finished function pointers */
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001313 ret = ssl_set_handshake_prfs( ssl->handshake,
1314 ssl->minor_ver,
1315 ciphersuite_info->mac );
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001316 if( ret != 0 )
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001317 {
1318 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001319 return( ret );
Manuel Pégourié-Gonnard8d2805c2019-04-30 12:08:59 +02001320 }
Manuel Pégourié-Gonnard1b00c4f2019-04-30 11:54:22 +02001321
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001322 /* Compute master secret if needed */
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001323 ret = ssl_compute_master( ssl->handshake,
Manuel Pégourié-Gonnardde047ad2019-05-03 09:46:14 +02001324 ssl->session_negotiate->master,
1325 ssl );
Manuel Pégourié-Gonnard9951b712019-04-30 12:08:59 +02001326 if( ret != 0 )
1327 {
1328 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
1329 return( ret );
1330 }
1331
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001332 /* Swap the client and server random values:
1333 * - MS derivation wanted client+server (RFC 5246 8.1)
1334 * - key derivation wants server+client (RFC 5246 6.3) */
1335 {
1336 unsigned char tmp[64];
1337 memcpy( tmp, ssl->handshake->randbytes, 64 );
1338 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
1339 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
1340 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
1341 }
1342
1343 /* Populate transform structure */
Hanno Beckerbd257552021-03-22 06:59:27 +00001344 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
1345 ssl->session_negotiate->ciphersuite,
1346 ssl->session_negotiate->master,
1347#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
1348 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1349 ssl->session_negotiate->encrypt_then_mac,
1350#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
1351 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
1352 ssl->handshake->tls_prf,
1353 ssl->handshake->randbytes,
1354 ssl->minor_ver,
1355 ssl->conf->endpoint,
1356 ssl );
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001357 if( ret != 0 )
1358 {
Hanno Beckerbd257552021-03-22 06:59:27 +00001359 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
Manuel Pégourié-Gonnard040a9512019-05-06 12:05:58 +02001360 return( ret );
1361 }
1362
1363 /* We no longer need Server/ClientHello.random values */
1364 mbedtls_platform_zeroize( ssl->handshake->randbytes,
1365 sizeof( ssl->handshake->randbytes ) );
1366
1367 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
1368
1369 return( 0 );
Manuel Pégourié-Gonnarde59ae232019-04-30 11:41:40 +02001370}
1371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001372#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001373void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
Rodrigo Dias Correa2c424572020-11-10 01:38:00 -03001374 unsigned char *hash,
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001375 size_t *hlen )
Paul Bakker380da532012-04-18 16:10:25 +00001376{
Andrzej Kurekeb342242019-01-29 09:14:33 -05001377#if defined(MBEDTLS_USE_PSA_CRYPTO)
1378 size_t hash_size;
1379 psa_status_t status;
1380 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
1381
1382 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
1383 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
1384 if( status != PSA_SUCCESS )
1385 {
1386 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1387 return;
1388 }
1389
1390 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
1391 if( status != PSA_SUCCESS )
1392 {
1393 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1394 return;
1395 }
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001396
1397 *hlen = 32;
1398 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001399 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1400#else
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001401 mbedtls_sha256_context sha256;
Paul Bakker380da532012-04-18 16:10:25 +00001402
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001403 mbedtls_sha256_init( &sha256 );
1404
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001405 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001406
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001407 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +02001408 mbedtls_sha256_finish( &sha256, hash );
Paul Bakker380da532012-04-18 16:10:25 +00001409
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001410 *hlen = 32;
1411
1412 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001413 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001414
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001415 mbedtls_sha256_free( &sha256 );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001416#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker380da532012-04-18 16:10:25 +00001417 return;
1418}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001419#endif /* MBEDTLS_SHA256_C */
Paul Bakker380da532012-04-18 16:10:25 +00001420
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02001421#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001422void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
Rodrigo Dias Correa2c424572020-11-10 01:38:00 -03001423 unsigned char *hash,
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001424 size_t *hlen )
Paul Bakker380da532012-04-18 16:10:25 +00001425{
Andrzej Kurekeb342242019-01-29 09:14:33 -05001426#if defined(MBEDTLS_USE_PSA_CRYPTO)
1427 size_t hash_size;
1428 psa_status_t status;
Andrzej Kurek972fba52019-01-30 03:29:12 -05001429 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
Andrzej Kurekeb342242019-01-29 09:14:33 -05001430
1431 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
Andrzej Kurek972fba52019-01-30 03:29:12 -05001432 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001433 if( status != PSA_SUCCESS )
1434 {
1435 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1436 return;
1437 }
1438
Andrzej Kurek972fba52019-01-30 03:29:12 -05001439 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001440 if( status != PSA_SUCCESS )
1441 {
1442 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1443 return;
1444 }
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001445
1446 *hlen = 48;
1447 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001448 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1449#else
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001450 mbedtls_sha512_context sha512;
Paul Bakker380da532012-04-18 16:10:25 +00001451
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001452 mbedtls_sha512_init( &sha512 );
1453
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001454 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001455
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001456 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
TRodziewicz26371e42021-06-08 16:45:41 +02001457 mbedtls_sha512_finish( &sha512, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001458
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02001459 *hlen = 48;
1460
1461 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001462 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001463
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001464 mbedtls_sha512_free( &sha512 );
Andrzej Kurekeb342242019-01-29 09:14:33 -05001465#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker5121ce52009-01-03 21:22:43 +00001466 return;
1467}
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02001468#endif /* MBEDTLS_SHA384_C */
Jerry Yuc5aef882021-12-23 20:15:02 +08001469#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001470
Gilles Peskineeccd8882020-03-10 12:19:08 +01001471#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001472int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001473{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001474 unsigned char *p = ssl->handshake->premaster;
1475 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Guilhem Bryantb5f04e42020-04-01 11:23:58 +01001476 const unsigned char *psk = NULL;
Guilhem Bryant61b0fe62020-03-27 11:12:12 +00001477 size_t psk_len = 0;
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001478
Guilhem Bryantc5285d82020-03-25 17:08:15 +00001479 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
1480 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001481 {
Guilhem Bryantc5285d82020-03-25 17:08:15 +00001482 /*
1483 * This should never happen because the existence of a PSK is always
1484 * checked before calling this function
1485 */
Guilhem Bryant82194c82020-03-26 17:04:31 +00001486 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Guilhem Bryant0c9b1952020-04-08 11:02:38 +01001487 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001488 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001489
1490 /*
1491 * PMS = struct {
1492 * opaque other_secret<0..2^16-1>;
1493 * opaque psk<0..2^16-1>;
1494 * };
1495 * with "other_secret" depending on the particular key exchange
1496 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001497#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1498 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001499 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001500 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001501 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001502
Joe Subbiania5cb0d22021-08-23 11:35:25 +01001503 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
1504 p += 2;
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001505
1506 if( end < p || (size_t)( end - p ) < psk_len )
1507 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1508
1509 memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001510 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001511 }
1512 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001513#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1514#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1515 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001516 {
1517 /*
1518 * other_secret already set by the ClientKeyExchange message,
1519 * and is 48 bytes long
1520 */
Philippe Antoine747fd532018-05-30 09:13:21 +02001521 if( end - p < 2 )
1522 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1523
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001524 *p++ = 0;
1525 *p++ = 48;
1526 p += 48;
1527 }
1528 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001529#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1530#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1531 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001532 {
Janos Follath865b3eb2019-12-16 11:46:15 +00001533 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001534 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001535
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02001536 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001537 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001538 p + 2, end - ( p + 2 ), &len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001539 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001540 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001541 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001542 return( ret );
1543 }
Joe Subbiania5cb0d22021-08-23 11:35:25 +01001544 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
1545 p += 2 + len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001547 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001548 }
1549 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001550#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1551#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1552 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001553 {
Janos Follath865b3eb2019-12-16 11:46:15 +00001554 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001555 size_t zlen;
1556
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001557 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02001558 p + 2, end - ( p + 2 ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001559 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001560 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001561 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001562 return( ret );
1563 }
1564
Joe Subbiania5cb0d22021-08-23 11:35:25 +01001565 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
1566 p += 2 + zlen;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001567
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001568 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
1569 MBEDTLS_DEBUG_ECDH_Z );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001570 }
1571 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001572#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001573 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001574 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1575 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001576 }
1577
1578 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001579 if( end - p < 2 )
1580 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01001581
Joe Subbiania5cb0d22021-08-23 11:35:25 +01001582 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
1583 p += 2;
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001584
1585 if( end < p || (size_t)( end - p ) < psk_len )
1586 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1587
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001588 memcpy( p, psk, psk_len );
1589 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001590
1591 ssl->handshake->pmslen = p - ssl->handshake->premaster;
1592
1593 return( 0 );
1594}
Gilles Peskineeccd8882020-03-10 12:19:08 +01001595#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001596
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001597#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
1598static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001599
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001600#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker786300f2020-02-05 10:46:40 +00001601int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001602{
1603 /* If renegotiation is not enforced, retransmit until we would reach max
1604 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001605 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001606 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001607 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001608 unsigned char doublings = 1;
1609
1610 while( ratio != 0 )
1611 {
1612 ++doublings;
1613 ratio >>= 1;
1614 }
1615
1616 if( ++ssl->renego_records_seen > doublings )
1617 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02001618 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02001619 return( 0 );
1620 }
1621 }
1622
1623 return( ssl_write_hello_request( ssl ) );
1624}
1625#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001626#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02001627
Hanno Beckerb9d44792019-02-08 07:19:04 +00001628#if defined(MBEDTLS_X509_CRT_PARSE_C)
1629static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
1630{
1631#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
1632 if( session->peer_cert != NULL )
1633 {
1634 mbedtls_x509_crt_free( session->peer_cert );
1635 mbedtls_free( session->peer_cert );
1636 session->peer_cert = NULL;
1637 }
1638#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1639 if( session->peer_cert_digest != NULL )
1640 {
1641 /* Zeroization is not necessary. */
1642 mbedtls_free( session->peer_cert_digest );
1643 session->peer_cert_digest = NULL;
1644 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
1645 session->peer_cert_digest_len = 0;
1646 }
1647#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1648}
1649#endif /* MBEDTLS_X509_CRT_PARSE_C */
1650
Paul Bakker5121ce52009-01-03 21:22:43 +00001651/*
1652 * Handshake functions
1653 */
Gilles Peskineeccd8882020-03-10 12:19:08 +01001654#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02001655/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001656int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001657{
Hanno Beckere694c3e2017-12-27 21:34:08 +00001658 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1659 ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00001660
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001661 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001662
Hanno Becker7177a882019-02-05 13:36:46 +00001663 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001664 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001665 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001666 ssl->state++;
1667 return( 0 );
1668 }
1669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001670 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1671 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001672}
1673
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001674int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001675{
Hanno Beckere694c3e2017-12-27 21:34:08 +00001676 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1677 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001678
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001679 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001680
Hanno Becker7177a882019-02-05 13:36:46 +00001681 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001682 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001683 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001684 ssl->state++;
1685 return( 0 );
1686 }
1687
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001688 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1689 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001690}
Gilles Peskinef9828522017-05-03 12:28:43 +02001691
Gilles Peskineeccd8882020-03-10 12:19:08 +01001692#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Gilles Peskinef9828522017-05-03 12:28:43 +02001693/* Some certificate support -> implement write and parse */
1694
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001695int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001696{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001697 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001698 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001699 const mbedtls_x509_crt *crt;
Hanno Beckere694c3e2017-12-27 21:34:08 +00001700 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1701 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001702
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001703 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001704
Hanno Becker7177a882019-02-05 13:36:46 +00001705 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001706 {
Johan Pascal4f099262020-09-22 10:59:26 +02001707 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1708 ssl->state++;
1709 return( 0 );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001710 }
1711
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001712#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001713 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00001714 {
Jerry Yufb28b882022-01-28 11:05:58 +08001715 if( ssl->handshake->client_auth == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001716 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001717 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001718 ssl->state++;
1719 return( 0 );
1720 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001721 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001722#endif /* MBEDTLS_SSL_CLI_C */
1723#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001724 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00001725 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001726 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001727 {
Hanno Becker9cfe6e92021-04-30 05:38:24 +01001728 /* Should never happen because we shouldn't have picked the
1729 * ciphersuite if we don't have a certificate. */
1730 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00001731 }
1732 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001733#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001734
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001735 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001736
1737 /*
1738 * 0 . 0 handshake type
1739 * 1 . 3 handshake length
1740 * 4 . 6 length of all certs
1741 * 7 . 9 length of cert. 1
1742 * 10 . n-1 peer certificate
1743 * n . n+2 length of cert. 2
1744 * n+3 . ... upper level cert, etc.
1745 */
1746 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001747 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00001748
Paul Bakker29087132010-03-21 21:03:34 +00001749 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001750 {
1751 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10001752 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00001753 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001754 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
1755 " > %" MBEDTLS_PRINTF_SIZET,
Paul Elliott3891caf2020-12-17 18:42:40 +00001756 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Hanno Becker91e1cc32021-04-30 05:28:49 +01001757 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Paul Bakker5121ce52009-01-03 21:22:43 +00001758 }
1759
Joe Subbianifbeb6922021-07-16 14:27:50 +01001760 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
1761 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
1762 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
Paul Bakker5121ce52009-01-03 21:22:43 +00001763
1764 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
1765 i += n; crt = crt->next;
1766 }
1767
Joe Subbianifbeb6922021-07-16 14:27:50 +01001768 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
1769 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
1770 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001771
1772 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001773 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
1774 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00001775
Paul Bakker5121ce52009-01-03 21:22:43 +00001776 ssl->state++;
1777
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02001778 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001779 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02001780 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001781 return( ret );
1782 }
1783
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001784 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001785
Paul Bakkered27a042013-04-18 22:46:23 +02001786 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001787}
1788
Hanno Becker84879e32019-01-31 07:44:03 +00001789#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Hanno Becker177475a2019-02-05 17:02:46 +00001790
1791#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001792static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
1793 unsigned char *crt_buf,
1794 size_t crt_buf_len )
1795{
1796 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
1797
1798 if( peer_crt == NULL )
1799 return( -1 );
1800
1801 if( peer_crt->raw.len != crt_buf_len )
1802 return( -1 );
1803
k-stachowiak95b68ef2019-09-16 12:21:00 +02001804 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001805}
Hanno Becker177475a2019-02-05 17:02:46 +00001806#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1807static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
1808 unsigned char *crt_buf,
1809 size_t crt_buf_len )
1810{
Janos Follath865b3eb2019-12-16 11:46:15 +00001811 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker177475a2019-02-05 17:02:46 +00001812 unsigned char const * const peer_cert_digest =
1813 ssl->session->peer_cert_digest;
1814 mbedtls_md_type_t const peer_cert_digest_type =
1815 ssl->session->peer_cert_digest_type;
1816 mbedtls_md_info_t const * const digest_info =
1817 mbedtls_md_info_from_type( peer_cert_digest_type );
1818 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
1819 size_t digest_len;
1820
1821 if( peer_cert_digest == NULL || digest_info == NULL )
1822 return( -1 );
1823
1824 digest_len = mbedtls_md_get_size( digest_info );
1825 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
1826 return( -1 );
1827
1828 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
1829 if( ret != 0 )
1830 return( -1 );
1831
1832 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
1833}
1834#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker84879e32019-01-31 07:44:03 +00001835#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001836
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02001837/*
1838 * Once the certificate message is read, parse it into a cert chain and
1839 * perform basic checks, but leave actual verification to the caller
1840 */
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001841static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
1842 mbedtls_x509_crt *chain )
Paul Bakker5121ce52009-01-03 21:22:43 +00001843{
Janos Follath865b3eb2019-12-16 11:46:15 +00001844 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001845#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1846 int crt_cnt=0;
1847#endif
Paul Bakker23986e52011-04-24 08:57:21 +00001848 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02001849 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00001850
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001851 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001852 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001853 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001854 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1855 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001856 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00001857 }
1858
Hanno Becker9ed1ba52021-06-24 11:03:13 +01001859 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
1860 {
1861 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1862 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
1863 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1864 }
1865
1866 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001867 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001868 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001869 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1870 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker9ed1ba52021-06-24 11:03:13 +01001871 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00001872 }
1873
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001874 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00001875
Paul Bakker5121ce52009-01-03 21:22:43 +00001876 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001877 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00001878 */
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00001879 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
Paul Bakker5121ce52009-01-03 21:22:43 +00001880
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00001881 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001882 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00001883 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001884 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001885 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1886 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker9ed1ba52021-06-24 11:03:13 +01001887 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00001888 }
1889
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001890 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
1891 i += 3;
1892
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001893 /* Iterate through and parse the CRTs in the provided chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00001894 while( i < ssl->in_hslen )
1895 {
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001896 /* Check that there's room for the next CRT's length fields. */
Philippe Antoine747fd532018-05-30 09:13:21 +02001897 if ( i + 3 > ssl->in_hslen ) {
1898 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckere2734e22019-01-31 07:44:17 +00001899 mbedtls_ssl_send_alert_message( ssl,
1900 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1901 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Dave Rodgman43fcb8d2021-06-28 21:49:15 +01001902 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +02001903 }
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001904 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
1905 * anything beyond 2**16 ~ 64K. */
Paul Bakker5121ce52009-01-03 21:22:43 +00001906 if( ssl->in_msg[i] != 0 )
1907 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001908 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckere2734e22019-01-31 07:44:17 +00001909 mbedtls_ssl_send_alert_message( ssl,
1910 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Dave Rodgman43fcb8d2021-06-28 21:49:15 +01001911 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
1912 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00001913 }
1914
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001915 /* Read length of the next CRT in the chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00001916 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
1917 | (unsigned int) ssl->in_msg[i + 2];
1918 i += 3;
1919
1920 if( n < 128 || i + n > ssl->in_hslen )
1921 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001922 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckere2734e22019-01-31 07:44:17 +00001923 mbedtls_ssl_send_alert_message( ssl,
1924 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1925 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker9ed1ba52021-06-24 11:03:13 +01001926 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00001927 }
1928
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001929 /* Check if we're handling the first CRT in the chain. */
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001930#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1931 if( crt_cnt++ == 0 &&
1932 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
1933 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001934 {
Hanno Becker46f34d02019-02-08 14:00:04 +00001935 /* During client-side renegotiation, check that the server's
1936 * end-CRTs hasn't changed compared to the initial handshake,
1937 * mitigating the triple handshake attack. On success, reuse
1938 * the original end-CRT instead of parsing it again. */
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001939 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
1940 if( ssl_check_peer_crt_unchanged( ssl,
1941 &ssl->in_msg[i],
1942 n ) != 0 )
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001943 {
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001944 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
1945 mbedtls_ssl_send_alert_message( ssl,
1946 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Dave Rodgman43fcb8d2021-06-28 21:49:15 +01001947 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
1948 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001949 }
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001950
1951 /* Now we can safely free the original chain. */
1952 ssl_clear_peer_cert( ssl->session );
1953 }
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001954#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
1955
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001956 /* Parse the next certificate in the chain. */
Hanno Becker0056eab2019-02-08 14:39:16 +00001957#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001958 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
Hanno Becker0056eab2019-02-08 14:39:16 +00001959#else
Hanno Becker353a6f02019-02-26 11:51:34 +00001960 /* If we don't need to store the CRT chain permanently, parse
Hanno Becker0056eab2019-02-08 14:39:16 +00001961 * it in-place from the input buffer instead of making a copy. */
1962 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
1963#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001964 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00001965 {
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001966 case 0: /*ok*/
1967 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
1968 /* Ignore certificate with an unknown algorithm: maybe a
1969 prior certificate was already trusted. */
1970 break;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001971
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001972 case MBEDTLS_ERR_X509_ALLOC_FAILED:
1973 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
1974 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001975
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001976 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
1977 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
1978 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001979
Hanno Beckerdef9bdc2019-01-30 14:46:46 +00001980 default:
1981 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
1982 crt_parse_der_failed:
1983 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
1984 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
1985 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001986 }
1987
1988 i += n;
1989 }
1990
Hanno Beckerc7bd7802019-02-05 15:37:23 +00001991 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02001992 return( 0 );
1993}
1994
Hanno Becker4a55f632019-02-05 12:49:06 +00001995#if defined(MBEDTLS_SSL_SRV_C)
1996static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
1997{
1998 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
1999 return( -1 );
2000
TRodziewicz0f82ec62021-05-12 17:49:18 +02002001#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker4a55f632019-02-05 12:49:06 +00002002 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
2003 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2004 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
2005 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
2006 {
2007 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
2008 return( 0 );
2009 }
TRodziewicz0f82ec62021-05-12 17:49:18 +02002010#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuc3091b12021-12-23 14:57:39 +08002011 return( -1 );
Hanno Becker4a55f632019-02-05 12:49:06 +00002012}
2013#endif /* MBEDTLS_SSL_SRV_C */
2014
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002015/* Check if a certificate message is expected.
2016 * Return either
2017 * - SSL_CERTIFICATE_EXPECTED, or
2018 * - SSL_CERTIFICATE_SKIP
2019 * indicating whether a Certificate message is expected or not.
2020 */
2021#define SSL_CERTIFICATE_EXPECTED 0
2022#define SSL_CERTIFICATE_SKIP 1
2023static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
2024 int authmode )
2025{
2026 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00002027 ssl->handshake->ciphersuite_info;
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002028
2029 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2030 return( SSL_CERTIFICATE_SKIP );
2031
2032#if defined(MBEDTLS_SSL_SRV_C)
2033 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2034 {
2035 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2036 return( SSL_CERTIFICATE_SKIP );
2037
2038 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2039 {
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002040 ssl->session_negotiate->verify_result =
2041 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
2042 return( SSL_CERTIFICATE_SKIP );
2043 }
2044 }
Hanno Becker84d9d272019-03-01 08:10:46 +00002045#else
2046 ((void) authmode);
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002047#endif /* MBEDTLS_SSL_SRV_C */
2048
2049 return( SSL_CERTIFICATE_EXPECTED );
2050}
2051
Hanno Becker68636192019-02-05 14:36:34 +00002052static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
2053 int authmode,
2054 mbedtls_x509_crt *chain,
2055 void *rs_ctx )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002056{
Hanno Becker6bdfab22019-02-05 13:11:17 +00002057 int ret = 0;
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002058 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00002059 ssl->handshake->ciphersuite_info;
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002060 int have_ca_chain = 0;
Hanno Becker68636192019-02-05 14:36:34 +00002061
Hanno Becker8927c832019-04-03 12:52:50 +01002062 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
2063 void *p_vrfy;
2064
Hanno Becker68636192019-02-05 14:36:34 +00002065 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2066 return( 0 );
2067
Hanno Becker8927c832019-04-03 12:52:50 +01002068 if( ssl->f_vrfy != NULL )
2069 {
Hanno Beckerefb440a2019-04-03 13:04:33 +01002070 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
Hanno Becker8927c832019-04-03 12:52:50 +01002071 f_vrfy = ssl->f_vrfy;
2072 p_vrfy = ssl->p_vrfy;
2073 }
2074 else
2075 {
Hanno Beckerefb440a2019-04-03 13:04:33 +01002076 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
Hanno Becker8927c832019-04-03 12:52:50 +01002077 f_vrfy = ssl->conf->f_vrfy;
2078 p_vrfy = ssl->conf->p_vrfy;
2079 }
2080
Hanno Becker68636192019-02-05 14:36:34 +00002081 /*
2082 * Main check: verify certificate
2083 */
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002084#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
2085 if( ssl->conf->f_ca_cb != NULL )
2086 {
2087 ((void) rs_ctx);
2088 have_ca_chain = 1;
2089
2090 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
Jarno Lamsa9822c0d2019-04-01 16:59:48 +03002091 ret = mbedtls_x509_crt_verify_with_ca_cb(
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002092 chain,
2093 ssl->conf->f_ca_cb,
2094 ssl->conf->p_ca_cb,
2095 ssl->conf->cert_profile,
2096 ssl->hostname,
2097 &ssl->session_negotiate->verify_result,
Jaeden Amerofe710672019-04-16 15:03:12 +01002098 f_vrfy, p_vrfy );
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002099 }
2100 else
2101#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
2102 {
2103 mbedtls_x509_crt *ca_chain;
2104 mbedtls_x509_crl *ca_crl;
2105
2106#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2107 if( ssl->handshake->sni_ca_chain != NULL )
2108 {
2109 ca_chain = ssl->handshake->sni_ca_chain;
2110 ca_crl = ssl->handshake->sni_ca_crl;
2111 }
2112 else
2113#endif
2114 {
2115 ca_chain = ssl->conf->ca_chain;
2116 ca_crl = ssl->conf->ca_crl;
2117 }
2118
2119 if( ca_chain != NULL )
2120 have_ca_chain = 1;
2121
2122 ret = mbedtls_x509_crt_verify_restartable(
2123 chain,
2124 ca_chain, ca_crl,
2125 ssl->conf->cert_profile,
2126 ssl->hostname,
2127 &ssl->session_negotiate->verify_result,
Jaeden Amerofe710672019-04-16 15:03:12 +01002128 f_vrfy, p_vrfy, rs_ctx );
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002129 }
Hanno Becker68636192019-02-05 14:36:34 +00002130
2131 if( ret != 0 )
2132 {
2133 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
2134 }
2135
Gilles Peskineeccd8882020-03-10 12:19:08 +01002136#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Hanno Becker68636192019-02-05 14:36:34 +00002137 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2138 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
2139#endif
2140
2141 /*
2142 * Secondary checks: always done, but change 'ret' only if it was 0
2143 */
2144
2145#if defined(MBEDTLS_ECP_C)
2146 {
2147 const mbedtls_pk_context *pk = &chain->pk;
2148
2149 /* If certificate uses an EC key, make sure the curve is OK */
2150 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
2151 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
2152 {
2153 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
2154
2155 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
2156 if( ret == 0 )
Hanno Becker9ed1ba52021-06-24 11:03:13 +01002157 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Hanno Becker68636192019-02-05 14:36:34 +00002158 }
2159 }
2160#endif /* MBEDTLS_ECP_C */
2161
2162 if( mbedtls_ssl_check_cert_usage( chain,
2163 ciphersuite_info,
2164 ! ssl->conf->endpoint,
2165 &ssl->session_negotiate->verify_result ) != 0 )
2166 {
2167 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
2168 if( ret == 0 )
Hanno Becker9ed1ba52021-06-24 11:03:13 +01002169 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Hanno Becker68636192019-02-05 14:36:34 +00002170 }
2171
2172 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
2173 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
2174 * with details encoded in the verification flags. All other kinds
2175 * of error codes, including those from the user provided f_vrfy
2176 * functions, are treated as fatal and lead to a failure of
2177 * ssl_parse_certificate even if verification was optional. */
2178 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
2179 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
Hanno Becker9ed1ba52021-06-24 11:03:13 +01002180 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
Hanno Becker68636192019-02-05 14:36:34 +00002181 {
2182 ret = 0;
2183 }
2184
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00002185 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
Hanno Becker68636192019-02-05 14:36:34 +00002186 {
2187 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
2188 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
2189 }
2190
2191 if( ret != 0 )
2192 {
2193 uint8_t alert;
2194
2195 /* The certificate may have been rejected for several reasons.
2196 Pick one and send the corresponding alert. Which alert to send
2197 may be a subject of debate in some cases. */
2198 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
2199 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
2200 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
2201 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
2202 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
2203 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2204 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
2205 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2206 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
2207 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2208 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
2209 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2210 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
2211 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2212 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
2213 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
2214 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
2215 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
2216 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
2217 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
2218 else
2219 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
2220 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2221 alert );
2222 }
2223
2224#if defined(MBEDTLS_DEBUG_C)
2225 if( ssl->session_negotiate->verify_result != 0 )
2226 {
Paul Elliott3891caf2020-12-17 18:42:40 +00002227 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
Paul Elliott9f352112020-12-09 14:55:45 +00002228 (unsigned int) ssl->session_negotiate->verify_result ) );
Hanno Becker68636192019-02-05 14:36:34 +00002229 }
2230 else
2231 {
2232 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
2233 }
2234#endif /* MBEDTLS_DEBUG_C */
2235
2236 return( ret );
2237}
2238
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002239#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2240static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
2241 unsigned char *start, size_t len )
2242{
Janos Follath865b3eb2019-12-16 11:46:15 +00002243 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002244 /* Remember digest of the peer's end-CRT. */
2245 ssl->session_negotiate->peer_cert_digest =
2246 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
2247 if( ssl->session_negotiate->peer_cert_digest == NULL )
2248 {
2249 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
irwir40883e92019-09-21 17:55:33 +03002250 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002251 mbedtls_ssl_send_alert_message( ssl,
2252 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2253 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2254
2255 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2256 }
2257
2258 ret = mbedtls_md( mbedtls_md_info_from_type(
2259 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
2260 start, len,
2261 ssl->session_negotiate->peer_cert_digest );
2262
2263 ssl->session_negotiate->peer_cert_digest_type =
2264 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
2265 ssl->session_negotiate->peer_cert_digest_len =
2266 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
2267
2268 return( ret );
2269}
2270
2271static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
2272 unsigned char *start, size_t len )
2273{
2274 unsigned char *end = start + len;
Janos Follath865b3eb2019-12-16 11:46:15 +00002275 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002276
2277 /* Make a copy of the peer's raw public key. */
2278 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
2279 ret = mbedtls_pk_parse_subpubkey( &start, end,
2280 &ssl->handshake->peer_pubkey );
2281 if( ret != 0 )
2282 {
2283 /* We should have parsed the public key before. */
2284 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2285 }
2286
2287 return( 0 );
2288}
2289#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2290
Hanno Becker68636192019-02-05 14:36:34 +00002291int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
2292{
2293 int ret = 0;
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002294 int crt_expected;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002295#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2296 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
2297 ? ssl->handshake->sni_authmode
2298 : ssl->conf->authmode;
2299#else
Johan Pascal4f099262020-09-22 10:59:26 +02002300 const int authmode = ssl->conf->authmode;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002301#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002302 void *rs_ctx = NULL;
Hanno Becker3dad3112019-02-05 17:19:52 +00002303 mbedtls_x509_crt *chain = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002304
2305 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2306
Hanno Becker28f2fcd2019-02-07 10:11:07 +00002307 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
2308 if( crt_expected == SSL_CERTIFICATE_SKIP )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002309 {
2310 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Hanno Becker6bdfab22019-02-05 13:11:17 +00002311 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002312 }
2313
Gilles Peskineeccd8882020-03-10 12:19:08 +01002314#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002315 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02002316 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002317 {
Hanno Becker3dad3112019-02-05 17:19:52 +00002318 chain = ssl->handshake->ecrs_peer_cert;
2319 ssl->handshake->ecrs_peer_cert = NULL;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002320 goto crt_verify;
2321 }
2322#endif
2323
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02002324 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002325 {
2326 /* mbedtls_ssl_read_record may have sent an alert already. We
2327 let it decide whether to alert. */
2328 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Hanno Becker3dad3112019-02-05 17:19:52 +00002329 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002330 }
2331
Hanno Becker4a55f632019-02-05 12:49:06 +00002332#if defined(MBEDTLS_SSL_SRV_C)
2333 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
2334 {
2335 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Hanno Becker4a55f632019-02-05 12:49:06 +00002336
irwird3085ab2020-04-21 22:26:05 +03002337 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
Hanno Becker6bdfab22019-02-05 13:11:17 +00002338 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Hanno Becker4a55f632019-02-05 12:49:06 +00002339
Hanno Becker6bdfab22019-02-05 13:11:17 +00002340 goto exit;
Hanno Becker4a55f632019-02-05 12:49:06 +00002341 }
2342#endif /* MBEDTLS_SSL_SRV_C */
2343
Hanno Beckerc7bd7802019-02-05 15:37:23 +00002344 /* Clear existing peer CRT structure in case we tried to
2345 * reuse a session but it failed, and allocate a new one. */
Hanno Becker7a955a02019-02-05 13:08:01 +00002346 ssl_clear_peer_cert( ssl->session_negotiate );
Hanno Becker3dad3112019-02-05 17:19:52 +00002347
2348 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
2349 if( chain == NULL )
Hanno Beckerc7bd7802019-02-05 15:37:23 +00002350 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00002351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
Hanno Beckerc7bd7802019-02-05 15:37:23 +00002352 sizeof( mbedtls_x509_crt ) ) );
2353 mbedtls_ssl_send_alert_message( ssl,
2354 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2355 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Becker7a955a02019-02-05 13:08:01 +00002356
Hanno Becker3dad3112019-02-05 17:19:52 +00002357 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
2358 goto exit;
2359 }
2360 mbedtls_x509_crt_init( chain );
2361
2362 ret = ssl_parse_certificate_chain( ssl, chain );
Hanno Beckerc7bd7802019-02-05 15:37:23 +00002363 if( ret != 0 )
Hanno Becker3dad3112019-02-05 17:19:52 +00002364 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02002365
Gilles Peskineeccd8882020-03-10 12:19:08 +01002366#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002367 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02002368 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02002369
2370crt_verify:
2371 if( ssl->handshake->ecrs_enabled)
2372 rs_ctx = &ssl->handshake->ecrs_ctx;
2373#endif
2374
Hanno Becker68636192019-02-05 14:36:34 +00002375 ret = ssl_parse_certificate_verify( ssl, authmode,
Hanno Becker3dad3112019-02-05 17:19:52 +00002376 chain, rs_ctx );
Hanno Becker68636192019-02-05 14:36:34 +00002377 if( ret != 0 )
Hanno Becker3dad3112019-02-05 17:19:52 +00002378 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00002379
Hanno Becker6bbd94c2019-02-05 17:02:28 +00002380#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker6bbd94c2019-02-05 17:02:28 +00002381 {
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002382 unsigned char *crt_start, *pk_start;
2383 size_t crt_len, pk_len;
Hanno Becker3dad3112019-02-05 17:19:52 +00002384
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002385 /* We parse the CRT chain without copying, so
2386 * these pointers point into the input buffer,
2387 * and are hence still valid after freeing the
2388 * CRT chain. */
Hanno Becker6bbd94c2019-02-05 17:02:28 +00002389
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002390 crt_start = chain->raw.p;
2391 crt_len = chain->raw.len;
Hanno Becker6bbd94c2019-02-05 17:02:28 +00002392
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002393 pk_start = chain->pk_raw.p;
2394 pk_len = chain->pk_raw.len;
2395
2396 /* Free the CRT structures before computing
2397 * digest and copying the peer's public key. */
2398 mbedtls_x509_crt_free( chain );
2399 mbedtls_free( chain );
2400 chain = NULL;
2401
2402 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
Hanno Beckera2747532019-02-06 16:19:04 +00002403 if( ret != 0 )
Hanno Beckera2747532019-02-06 16:19:04 +00002404 goto exit;
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002405
2406 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
2407 if( ret != 0 )
2408 goto exit;
Hanno Beckera2747532019-02-06 16:19:04 +00002409 }
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002410#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2411 /* Pass ownership to session structure. */
Hanno Becker3dad3112019-02-05 17:19:52 +00002412 ssl->session_negotiate->peer_cert = chain;
2413 chain = NULL;
Hanno Becker6b8fbab2019-02-08 14:59:05 +00002414#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker3dad3112019-02-05 17:19:52 +00002415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002416 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002417
Hanno Becker6bdfab22019-02-05 13:11:17 +00002418exit:
2419
Hanno Becker3dad3112019-02-05 17:19:52 +00002420 if( ret == 0 )
2421 ssl->state++;
2422
Gilles Peskineeccd8882020-03-10 12:19:08 +01002423#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Hanno Becker3dad3112019-02-05 17:19:52 +00002424 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
2425 {
2426 ssl->handshake->ecrs_peer_cert = chain;
2427 chain = NULL;
2428 }
2429#endif
2430
2431 if( chain != NULL )
2432 {
2433 mbedtls_x509_crt_free( chain );
2434 mbedtls_free( chain );
2435 }
2436
Paul Bakker5121ce52009-01-03 21:22:43 +00002437 return( ret );
2438}
Gilles Peskineeccd8882020-03-10 12:19:08 +01002439#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002440
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002441void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
2442 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
Paul Bakker380da532012-04-18 16:10:25 +00002443{
Paul Bakkerfb08fd22013-08-27 15:06:26 +02002444 ((void) ciphersuite_info);
Paul Bakker769075d2012-11-24 11:26:46 +01002445
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002446#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002447 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002448 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
2449 else
2450#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002451#if defined(MBEDTLS_SHA256_C)
2452 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
Paul Bakker48916f92012-09-16 19:57:18 +00002453 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002454 else
2455#endif
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02002456 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002457 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002458 return;
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02002459 }
Paul Bakker380da532012-04-18 16:10:25 +00002460}
Paul Bakkerf7abd422013-04-16 13:15:56 +02002461
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002462void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002463{
Jerry Yuc3091b12021-12-23 14:57:39 +08002464 ((void) ssl);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002465#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002466#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek2ad22972019-01-30 03:32:12 -05002467 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002468 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2469#else
TRodziewicz26371e42021-06-08 16:45:41 +02002470 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002471#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002472#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002473#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002474#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek2ad22972019-01-30 03:32:12 -05002475 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
Andrzej Kurek972fba52019-01-30 03:29:12 -05002476 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002477#else
TRodziewicz26371e42021-06-08 16:45:41 +02002478 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002479#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002480#endif
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002481}
2482
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002483static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002484 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00002485{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002486#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002487#if defined(MBEDTLS_USE_PSA_CRYPTO)
2488 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2489#else
TRodziewicz26371e42021-06-08 16:45:41 +02002490 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002491#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002492#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002493#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002494#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05002495 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002496#else
TRodziewicz26371e42021-06-08 16:45:41 +02002497 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
Paul Bakker769075d2012-11-24 11:26:46 +01002498#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002499#endif
Paul Bakker380da532012-04-18 16:10:25 +00002500}
2501
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002502#if defined(MBEDTLS_SHA256_C)
2503static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002504 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00002505{
Andrzej Kurekeb342242019-01-29 09:14:33 -05002506#if defined(MBEDTLS_USE_PSA_CRYPTO)
2507 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2508#else
TRodziewicz26371e42021-06-08 16:45:41 +02002509 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002510#endif
Paul Bakker380da532012-04-18 16:10:25 +00002511}
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002512#endif
Paul Bakker380da532012-04-18 16:10:25 +00002513
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002514#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002515static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002516 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00002517{
Andrzej Kurekeb342242019-01-29 09:14:33 -05002518#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05002519 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002520#else
TRodziewicz26371e42021-06-08 16:45:41 +02002521 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002522#endif
Paul Bakker380da532012-04-18 16:10:25 +00002523}
Paul Bakker769075d2012-11-24 11:26:46 +01002524#endif
Jerry Yudb8c48a2022-01-27 14:54:54 +08002525#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002526#if defined(MBEDTLS_SHA256_C)
Paul Bakkerca4ab492012-04-18 14:23:57 +00002527static void ssl_calc_finished_tls_sha256(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002528 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker1ef83d62012-04-11 12:09:53 +00002529{
2530 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02002531 const char *sender;
Paul Bakker1ef83d62012-04-11 12:09:53 +00002532 unsigned char padbuf[32];
Andrzej Kurekeb342242019-01-29 09:14:33 -05002533#if defined(MBEDTLS_USE_PSA_CRYPTO)
2534 size_t hash_size;
Jaeden Amero34973232019-02-20 10:32:28 +00002535 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
Andrzej Kurekeb342242019-01-29 09:14:33 -05002536 psa_status_t status;
2537#else
2538 mbedtls_sha256_context sha256;
2539#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00002540
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002541 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00002542 if( !session )
2543 session = ssl->session;
2544
Andrzej Kurekeb342242019-01-29 09:14:33 -05002545 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
2546 ? "client finished"
2547 : "server finished";
2548
2549#if defined(MBEDTLS_USE_PSA_CRYPTO)
2550 sha256_psa = psa_hash_operation_init();
2551
2552 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
2553
2554 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
2555 if( status != PSA_SUCCESS )
2556 {
2557 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
2558 return;
2559 }
2560
2561 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
2562 if( status != PSA_SUCCESS )
2563 {
2564 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
2565 return;
2566 }
2567 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
2568#else
2569
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02002570 mbedtls_sha256_init( &sha256 );
2571
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02002572 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002573
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02002574 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002575
2576 /*
2577 * TLSv1.2:
2578 * hash = PRF( master, finished_label,
2579 * Hash( handshake ) )[0.11]
2580 */
2581
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002582#if !defined(MBEDTLS_SHA256_ALT)
2583 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02002584 sha256.state, sizeof( sha256.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02002585#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00002586
TRodziewicz26371e42021-06-08 16:45:41 +02002587 mbedtls_sha256_finish( &sha256, padbuf );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002588 mbedtls_sha256_free( &sha256 );
2589#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakker1ef83d62012-04-11 12:09:53 +00002590
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002591 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00002592 padbuf, 32, buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002594 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002595
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002596 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002598 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002599}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002600#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +00002601
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002602#if defined(MBEDTLS_SHA384_C)
Rodrigo Dias Corread596ca82020-11-25 00:42:28 -03002603
Paul Bakkerca4ab492012-04-18 14:23:57 +00002604static void ssl_calc_finished_tls_sha384(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002605 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002606{
2607 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02002608 const char *sender;
Rodrigo Dias Corread596ca82020-11-25 00:42:28 -03002609 unsigned char padbuf[48];
Andrzej Kurekeb342242019-01-29 09:14:33 -05002610#if defined(MBEDTLS_USE_PSA_CRYPTO)
2611 size_t hash_size;
Jaeden Amero34973232019-02-20 10:32:28 +00002612 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
Andrzej Kurekeb342242019-01-29 09:14:33 -05002613 psa_status_t status;
2614#else
2615 mbedtls_sha512_context sha512;
2616#endif
Paul Bakkerca4ab492012-04-18 14:23:57 +00002617
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002618 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00002619 if( !session )
2620 session = ssl->session;
2621
Andrzej Kurekeb342242019-01-29 09:14:33 -05002622 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
2623 ? "client finished"
2624 : "server finished";
2625
2626#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05002627 sha384_psa = psa_hash_operation_init();
Andrzej Kurekeb342242019-01-29 09:14:33 -05002628
2629 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
2630
Andrzej Kurek972fba52019-01-30 03:29:12 -05002631 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002632 if( status != PSA_SUCCESS )
2633 {
2634 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
2635 return;
2636 }
2637
Andrzej Kurek972fba52019-01-30 03:29:12 -05002638 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002639 if( status != PSA_SUCCESS )
2640 {
2641 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
2642 return;
2643 }
2644 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
2645#else
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02002646 mbedtls_sha512_init( &sha512 );
2647
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002648 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002649
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02002650 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002651
2652 /*
2653 * TLSv1.2:
2654 * hash = PRF( master, finished_label,
2655 * Hash( handshake ) )[0.11]
2656 */
2657
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002658#if !defined(MBEDTLS_SHA512_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02002659 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
2660 sha512.state, sizeof( sha512.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02002661#endif
TRodziewicz26371e42021-06-08 16:45:41 +02002662 mbedtls_sha512_finish( &sha512, padbuf );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002663
Andrzej Kurekeb342242019-01-29 09:14:33 -05002664 mbedtls_sha512_free( &sha512 );
2665#endif
Paul Bakkerca4ab492012-04-18 14:23:57 +00002666
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02002667 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00002668 padbuf, 48, buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002670 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002671
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002672 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002673
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002674 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002675}
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002676#endif /* MBEDTLS_SHA384_C */
Jerry Yudb8c48a2022-01-27 14:54:54 +08002677#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00002678void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00002679{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002680 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002681
2682 /*
2683 * Free our handshake params
2684 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02002685 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002686 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00002687 ssl->handshake = NULL;
2688
2689 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002690 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00002691 */
2692 if( ssl->transform )
2693 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002694 mbedtls_ssl_transform_free( ssl->transform );
2695 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00002696 }
2697 ssl->transform = ssl->transform_negotiate;
2698 ssl->transform_negotiate = NULL;
2699
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002700 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002701}
2702
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002703void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002704{
2705 int resume = ssl->handshake->resume;
2706
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002707 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002708
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002709#if defined(MBEDTLS_SSL_RENEGOTIATION)
2710 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002711 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002712 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002713 ssl->renego_records_seen = 0;
2714 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002715#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002716
2717 /*
2718 * Free the previous session and switch in the current one
2719 */
Paul Bakker0a597072012-09-25 21:55:46 +00002720 if( ssl->session )
2721 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002722#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01002723 /* RFC 7366 3.1: keep the EtM state */
2724 ssl->session_negotiate->encrypt_then_mac =
2725 ssl->session->encrypt_then_mac;
2726#endif
2727
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002728 mbedtls_ssl_session_free( ssl->session );
2729 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00002730 }
2731 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00002732 ssl->session_negotiate = NULL;
2733
Paul Bakker0a597072012-09-25 21:55:46 +00002734 /*
2735 * Add cache entry
2736 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002737 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002738 ssl->session->id_len != 0 &&
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02002739 resume == 0 )
2740 {
Hanno Beckerccdaf6e2021-04-15 09:26:17 +01002741 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
2742 ssl->session->id,
2743 ssl->session->id_len,
2744 ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002745 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02002746 }
Paul Bakker0a597072012-09-25 21:55:46 +00002747
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002748#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002749 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002750 ssl->handshake->flight != NULL )
2751 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002752 /* Cancel handshake timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00002753 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002754
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002755 /* Keep last flight around in case we need to resend it:
2756 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002757 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002758 }
2759 else
2760#endif
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00002761 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02002762
Paul Bakker48916f92012-09-16 19:57:18 +00002763 ssl->state++;
2764
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002765 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002766}
2767
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002768int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00002769{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002770 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00002771
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002772 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002773
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00002774 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01002775
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002776 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
Paul Bakker1ef83d62012-04-11 12:09:53 +00002777
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01002778 /*
2779 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
2780 * may define some other value. Currently (early 2016), no defined
2781 * ciphersuite does this (and this is unlikely to change as activity has
2782 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
2783 */
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002784 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00002785
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002786#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00002787 ssl->verify_data_len = hash_len;
2788 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002789#endif
Paul Bakker48916f92012-09-16 19:57:18 +00002790
Paul Bakker5121ce52009-01-03 21:22:43 +00002791 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002792 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2793 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00002794
2795 /*
2796 * In case of session resuming, invert the client and server
2797 * ChangeCipherSpec messages order.
2798 */
Paul Bakker0a597072012-09-25 21:55:46 +00002799 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002800 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002801#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002802 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002803 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01002804#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002805#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002806 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002807 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01002808#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002809 }
2810 else
2811 ssl->state++;
2812
Paul Bakker48916f92012-09-16 19:57:18 +00002813 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02002814 * Switch to our negotiated transform and session parameters for outbound
2815 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00002816 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002817 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01002818
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002819#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002820 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002821 {
2822 unsigned char i;
2823
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002824 /* Remember current epoch settings for resending */
2825 ssl->handshake->alt_transform_out = ssl->transform_out;
Jerry Yud9a94fe2021-09-28 18:58:59 +08002826 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
Jerry Yud96a5c22021-09-29 17:46:51 +08002827 sizeof( ssl->handshake->alt_out_ctr ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002828
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002829 /* Set sequence_number to zero */
Jerry Yufd320e92021-10-08 21:52:41 +08002830 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
Jerry Yud9a94fe2021-09-28 18:58:59 +08002831
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002832
2833 /* Increment epoch */
2834 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01002835 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002836 break;
2837
2838 /* The loop goes to its end iff the counter is wrapping */
2839 if( i == 0 )
2840 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002841 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
2842 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02002843 }
2844 }
2845 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002846#endif /* MBEDTLS_SSL_PROTO_DTLS */
Jerry Yufd320e92021-10-08 21:52:41 +08002847 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002848
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002849 ssl->transform_out = ssl->transform_negotiate;
2850 ssl->session_out = ssl->session_negotiate;
2851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002852#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002853 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002854 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002855#endif
2856
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002857 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002858 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002859 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002860 return( ret );
2861 }
2862
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002863#if defined(MBEDTLS_SSL_PROTO_DTLS)
2864 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2865 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2866 {
2867 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
2868 return( ret );
2869 }
2870#endif
2871
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002872 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002873
2874 return( 0 );
2875}
2876
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00002877#define SSL_MAX_HASH_LEN 12
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00002878
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002879int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002880{
Janos Follath865b3eb2019-12-16 11:46:15 +00002881 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea4174312021-12-13 14:38:40 +01002882 unsigned int hash_len = 12;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00002883 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00002884
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002885 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002886
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002887 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002888
Hanno Becker327c93b2018-08-15 13:56:18 +01002889 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002890 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002891 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Gilles Peskinef0fd4c32021-12-13 12:36:15 +01002892 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00002893 }
2894
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002895 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002896 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002897 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002898 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2899 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Gilles Peskinef0fd4c32021-12-13 12:36:15 +01002900 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
2901 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00002902 }
2903
Hanno Beckera0ca87e2021-06-24 10:27:37 +01002904 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
2905 {
2906 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2907 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Gilles Peskinef0fd4c32021-12-13 12:36:15 +01002908 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
2909 goto exit;
Hanno Beckera0ca87e2021-06-24 10:27:37 +01002910 }
2911
2912 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00002913 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002914 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002915 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2916 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Gilles Peskinef0fd4c32021-12-13 12:36:15 +01002917 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
2918 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00002919 }
2920
Gabor Mezei90437e32021-10-20 11:59:27 +02002921 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
Manuel Pégourié-Gonnard4abc3272014-09-10 12:02:46 +00002922 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002923 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002924 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002925 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Dave Rodgman43fcb8d2021-06-28 21:49:15 +01002926 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
Gilles Peskinef0fd4c32021-12-13 12:36:15 +01002927 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2928 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00002929 }
2930
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002931#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00002932 ssl->verify_data_len = hash_len;
2933 memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002934#endif
Paul Bakker48916f92012-09-16 19:57:18 +00002935
Paul Bakker0a597072012-09-25 21:55:46 +00002936 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002937 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002938#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002939 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002940 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01002941#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002942#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002943 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002944 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01002945#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002946 }
2947 else
2948 ssl->state++;
2949
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002950#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002951 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002952 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002953#endif
2954
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002955 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002956
Gilles Peskinef0fd4c32021-12-13 12:36:15 +01002957exit:
2958 mbedtls_platform_zeroize( buf, hash_len );
2959 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002960}
2961
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002962static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002963{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002964 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002965
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002966#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002967#if defined(MBEDTLS_USE_PSA_CRYPTO)
2968 handshake->fin_sha256_psa = psa_hash_operation_init();
2969 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2970#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002971 mbedtls_sha256_init( &handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +02002972 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002973#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002974#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02002975#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05002976#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05002977 handshake->fin_sha384_psa = psa_hash_operation_init();
2978 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -05002979#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002980 mbedtls_sha512_init( &handshake->fin_sha512 );
TRodziewicz26371e42021-06-08 16:45:41 +02002981 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002982#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05002983#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002984
2985 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +01002986
2987#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01002988 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01002989 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
2990#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002991
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002992#if defined(MBEDTLS_DHM_C)
2993 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002994#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002995#if defined(MBEDTLS_ECDH_C)
2996 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02002997#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002998#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02002999 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02003000#if defined(MBEDTLS_SSL_CLI_C)
3001 handshake->ecjpake_cache = NULL;
3002 handshake->ecjpake_cache_len = 0;
3003#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003004#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02003005
Gilles Peskineeccd8882020-03-10 12:19:08 +01003006#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02003007 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02003008#endif
3009
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02003010#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3011 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
3012#endif
Hanno Becker75173122019-02-06 16:18:31 +00003013
3014#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3015 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3016 mbedtls_pk_init( &handshake->peer_pubkey );
3017#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003018}
3019
Hanno Beckera18d1322018-01-03 14:27:32 +00003020void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003021{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003022 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +02003023
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +01003024#if defined(MBEDTLS_USE_PSA_CRYPTO)
3025 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
3026 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01003027#else
3028 mbedtls_cipher_init( &transform->cipher_ctx_enc );
3029 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +01003030#endif
3031
Hanno Beckerfd86ca82020-11-30 08:54:23 +00003032#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003033 mbedtls_md_init( &transform->md_ctx_enc );
3034 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +00003035#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003036}
3037
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003038void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003039{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003040 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003041}
3042
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003043static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003044{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003045 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00003046 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003047 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003048 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003049 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003050 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02003051 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003052
3053 /*
3054 * Either the pointers are now NULL or cleared properly and can be freed.
3055 * Now allocate missing structures.
3056 */
3057 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003058 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003059 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003060 }
Paul Bakker48916f92012-09-16 19:57:18 +00003061
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003062 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003063 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003064 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003065 }
Paul Bakker48916f92012-09-16 19:57:18 +00003066
Paul Bakker82788fb2014-10-20 13:59:19 +02003067 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003068 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003069 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02003070 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003071#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3072 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -04003073
Andrzej Kurek4a063792020-10-21 15:08:44 +02003074 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
3075 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003076#endif
Paul Bakker48916f92012-09-16 19:57:18 +00003077
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003078 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00003079 if( ssl->handshake == NULL ||
3080 ssl->transform_negotiate == NULL ||
3081 ssl->session_negotiate == NULL )
3082 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02003083 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003084
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003085 mbedtls_free( ssl->handshake );
3086 mbedtls_free( ssl->transform_negotiate );
3087 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003088
3089 ssl->handshake = NULL;
3090 ssl->transform_negotiate = NULL;
3091 ssl->session_negotiate = NULL;
3092
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003093 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00003094 }
3095
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003096 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003097 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Beckera18d1322018-01-03 14:27:32 +00003098 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02003099 ssl_handshake_params_init( ssl->handshake );
3100
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003101#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02003102 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3103 {
3104 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003105
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02003106 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3107 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
3108 else
3109 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003110
Hanno Becker0f57a652020-02-05 10:37:26 +00003111 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02003112 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003113#endif
3114
Brett Warrene0edc842021-08-17 09:53:13 +01003115/*
3116 * curve_list is translated to IANA TLS group identifiers here because
3117 * mbedtls_ssl_conf_curves returns void and so can't return
3118 * any error codes.
3119 */
3120#if defined(MBEDTLS_ECP_C)
3121#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3122 /* Heap allocate and translate curve_list from internal to IANA group ids */
3123 if ( ssl->conf->curve_list != NULL )
3124 {
3125 size_t length;
3126 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
3127
3128 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
3129 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
3130
3131 /* Leave room for zero termination */
3132 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
3133 if ( group_list == NULL )
3134 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3135
3136 for( size_t i = 0; i < length; i++ )
3137 {
3138 const mbedtls_ecp_curve_info *info =
3139 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
3140 if ( info == NULL )
3141 {
3142 mbedtls_free( group_list );
3143 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3144 }
3145 group_list[i] = info->tls_id;
3146 }
3147
3148 group_list[length] = 0;
3149
3150 ssl->handshake->group_list = group_list;
3151 ssl->handshake->group_list_heap_allocated = 1;
3152 }
3153 else
3154 {
3155 ssl->handshake->group_list = ssl->conf->group_list;
3156 ssl->handshake->group_list_heap_allocated = 0;
3157 }
3158#endif /* MBEDTLS_DEPRECATED_REMOVED */
3159#endif /* MBEDTLS_ECP_C */
3160
Jerry Yuf017ee42022-01-12 15:49:48 +08003161#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3162#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +08003163#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +08003164 /* Heap allocate and translate sig_hashes from internal hash identifiers to
3165 signature algorithms IANA identifiers. */
3166 if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) &&
Jerry Yuf017ee42022-01-12 15:49:48 +08003167 ssl->conf->sig_hashes != NULL )
3168 {
3169 const int *md;
3170 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +08003171 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +08003172 uint16_t *p;
3173
Jerry Yub476a442022-01-21 18:14:45 +08003174#if defined(static_assert)
3175 static_assert( MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
3176 <= ( SIZE_MAX - ( 2 * sizeof(uint16_t) ) ),
3177 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big" );
Jerry Yua68dca22022-01-20 16:28:27 +08003178#endif
3179
Jerry Yuf017ee42022-01-12 15:49:48 +08003180 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
3181 {
3182 if( mbedtls_ssl_hash_from_md_alg( *md ) == MBEDTLS_SSL_HASH_NONE )
3183 continue;
Jerry Yub476a442022-01-21 18:14:45 +08003184#if defined(MBEDTLS_ECDSA_C)
3185 sig_algs_len += sizeof( uint16_t );
3186#endif
Jerry Yua68dca22022-01-20 16:28:27 +08003187
Jerry Yub476a442022-01-21 18:14:45 +08003188#if defined(MBEDTLS_RSA_C)
3189 sig_algs_len += sizeof( uint16_t );
3190#endif
3191 if( sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN )
3192 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Jerry Yuf017ee42022-01-12 15:49:48 +08003193 }
3194
Jerry Yub476a442022-01-21 18:14:45 +08003195 if( sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN )
Jerry Yuf017ee42022-01-12 15:49:48 +08003196 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3197
Jerry Yub476a442022-01-21 18:14:45 +08003198 ssl->handshake->sig_algs = mbedtls_calloc( 1, sig_algs_len +
3199 sizeof( uint16_t ));
Jerry Yuf017ee42022-01-12 15:49:48 +08003200 if( ssl->handshake->sig_algs == NULL )
3201 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3202
3203 p = (uint16_t *)ssl->handshake->sig_algs;
3204 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
3205 {
3206 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *md );
3207 if( hash == MBEDTLS_SSL_HASH_NONE )
3208 continue;
Jerry Yu6106fdc2022-01-12 16:36:14 +08003209#if defined(MBEDTLS_ECDSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +08003210 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA);
3211 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08003212#endif
3213#if defined(MBEDTLS_RSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +08003214 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA);
3215 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08003216#endif
Jerry Yuf017ee42022-01-12 15:49:48 +08003217 }
3218 *p = MBEDTLS_TLS1_3_SIG_NONE;
3219 ssl->handshake->sig_algs_heap_allocated = 1;
3220 }
3221 else
Jerry Yua69269a2022-01-17 21:06:01 +08003222#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +08003223 {
3224 ssl->handshake->sig_algs = ssl->conf->sig_algs;
3225 ssl->handshake->sig_algs_heap_allocated = 0;
3226 }
3227#endif /* MBEDTLS_DEPRECATED_REMOVED */
3228#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +00003229 return( 0 );
3230}
3231
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02003232#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02003233/* Dummy cookie callbacks for defaults */
3234static int ssl_cookie_write_dummy( void *ctx,
3235 unsigned char **p, unsigned char *end,
3236 const unsigned char *cli_id, size_t cli_id_len )
3237{
3238 ((void) ctx);
3239 ((void) p);
3240 ((void) end);
3241 ((void) cli_id);
3242 ((void) cli_id_len);
3243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003244 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02003245}
3246
3247static int ssl_cookie_check_dummy( void *ctx,
3248 const unsigned char *cookie, size_t cookie_len,
3249 const unsigned char *cli_id, size_t cli_id_len )
3250{
3251 ((void) ctx);
3252 ((void) cookie);
3253 ((void) cookie_len);
3254 ((void) cli_id);
3255 ((void) cli_id_len);
3256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003257 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02003258}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02003259#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02003260
Paul Bakker5121ce52009-01-03 21:22:43 +00003261/*
3262 * Initialize an SSL context
3263 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02003264void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
3265{
3266 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
3267}
3268
Jerry Yu60835a82021-08-04 10:13:52 +08003269static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
3270{
Ronald Cron6f135e12021-12-08 16:57:54 +01003271#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu60835a82021-08-04 10:13:52 +08003272 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
3273 {
3274 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3275 {
3276 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported" ) );
3277 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3278 }
3279 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
3280 return( 0 );
3281 }
3282#endif
3283
3284#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3285 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
3286 {
3287 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
3288 return( 0 );
3289 }
3290#endif
3291
Ronald Cron6f135e12021-12-08 16:57:54 +01003292#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu60835a82021-08-04 10:13:52 +08003293 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( ssl->conf ) )
3294 {
3295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Hybrid TLS 1.2 + TLS 1.3 configurations are not yet supported" ) );
3296 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3297 }
3298#endif
3299
3300 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
3301 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3302}
3303
3304static int ssl_conf_check(const mbedtls_ssl_context *ssl)
3305{
3306 int ret;
3307 ret = ssl_conf_version_check( ssl );
3308 if( ret != 0 )
3309 return( ret );
3310
3311 /* Space for further checks */
3312
3313 return( 0 );
3314}
3315
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02003316/*
3317 * Setup an SSL context
3318 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01003319
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02003320int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02003321 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00003322{
Janos Follath865b3eb2019-12-16 11:46:15 +00003323 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +00003324 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3325 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00003326
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02003327 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00003328
Jerry Yu60835a82021-08-04 10:13:52 +08003329 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
3330 return( ret );
3331
Paul Bakker62f2dee2012-09-28 07:31:51 +00003332 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003333 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00003334 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02003335
3336 /* Set to NULL in case of an error condition */
3337 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02003338
Darryl Greenb33cc762019-11-28 14:29:44 +00003339#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3340 ssl->in_buf_len = in_buf_len;
3341#endif
3342 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10003343 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003344 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00003345 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02003346 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02003347 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10003348 }
3349
Darryl Greenb33cc762019-11-28 14:29:44 +00003350#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3351 ssl->out_buf_len = out_buf_len;
3352#endif
3353 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10003354 if( ssl->out_buf == NULL )
3355 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00003356 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02003357 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02003358 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00003359 }
3360
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00003361 mbedtls_ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02003362
Johan Pascalb62bb512015-12-03 21:56:45 +01003363#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +02003364 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
Johan Pascalb62bb512015-12-03 21:56:45 +01003365#endif
3366
Paul Bakker48916f92012-09-16 19:57:18 +00003367 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02003368 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00003369
3370 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02003371
3372error:
3373 mbedtls_free( ssl->in_buf );
3374 mbedtls_free( ssl->out_buf );
3375
3376 ssl->conf = NULL;
3377
Darryl Greenb33cc762019-11-28 14:29:44 +00003378#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3379 ssl->in_buf_len = 0;
3380 ssl->out_buf_len = 0;
3381#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02003382 ssl->in_buf = NULL;
3383 ssl->out_buf = NULL;
3384
3385 ssl->in_hdr = NULL;
3386 ssl->in_ctr = NULL;
3387 ssl->in_len = NULL;
3388 ssl->in_iv = NULL;
3389 ssl->in_msg = NULL;
3390
3391 ssl->out_hdr = NULL;
3392 ssl->out_ctr = NULL;
3393 ssl->out_len = NULL;
3394 ssl->out_iv = NULL;
3395 ssl->out_msg = NULL;
3396
k-stachowiak9f7798e2018-07-31 16:52:32 +02003397 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003398}
3399
3400/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00003401 * Reset an initialized and used SSL context for re-use while retaining
3402 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003403 *
3404 * If partial is non-zero, keep data in the input buffer and client ID.
3405 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00003406 */
XiaokangQian78b1fa72022-01-19 06:56:30 +00003407void mbedtls_ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
3408 int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00003409{
Darryl Greenb33cc762019-11-28 14:29:44 +00003410#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3411 size_t in_buf_len = ssl->in_buf_len;
3412 size_t out_buf_len = ssl->out_buf_len;
3413#else
3414 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3415 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3416#endif
Paul Bakker48916f92012-09-16 19:57:18 +00003417
Hanno Beckerb0302c42021-08-03 09:39:42 +01003418#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
3419 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01003420#endif
3421
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003422 /* Cancel any possibly running timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00003423 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003424
Hanno Beckerb0302c42021-08-03 09:39:42 +01003425 mbedtls_ssl_reset_in_out_pointers( ssl );
3426
3427 /* Reset incoming message parsing */
3428 ssl->in_offt = NULL;
3429 ssl->nb_zero = 0;
3430 ssl->in_msgtype = 0;
3431 ssl->in_msglen = 0;
3432 ssl->in_hslen = 0;
3433 ssl->keep_current_message = 0;
3434 ssl->transform_in = NULL;
3435
3436#if defined(MBEDTLS_SSL_PROTO_DTLS)
3437 ssl->next_record_offset = 0;
3438 ssl->in_epoch = 0;
3439#endif
3440
3441 /* Keep current datagram if partial == 1 */
3442 if( partial == 0 )
3443 {
3444 ssl->in_left = 0;
3445 memset( ssl->in_buf, 0, in_buf_len );
3446 }
3447
3448 /* Reset outgoing message writing */
3449 ssl->out_msgtype = 0;
3450 ssl->out_msglen = 0;
3451 ssl->out_left = 0;
3452 memset( ssl->out_buf, 0, out_buf_len );
3453 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
3454 ssl->transform_out = NULL;
3455
3456#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3457 mbedtls_ssl_dtls_replay_reset( ssl );
3458#endif
3459
XiaokangQian2b01dc32022-01-21 02:53:13 +00003460#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerb0302c42021-08-03 09:39:42 +01003461 if( ssl->transform )
3462 {
3463 mbedtls_ssl_transform_free( ssl->transform );
3464 mbedtls_free( ssl->transform );
3465 ssl->transform = NULL;
3466 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00003467#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3468
XiaokangQian2b01dc32022-01-21 02:53:13 +00003469#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3470 mbedtls_ssl_transform_free( ssl->transform_application );
3471 mbedtls_free( ssl->transform_application );
3472 ssl->transform_application = NULL;
3473
3474 if( ssl->handshake != NULL )
3475 {
3476 mbedtls_ssl_transform_free( ssl->handshake->transform_earlydata );
3477 mbedtls_free( ssl->handshake->transform_earlydata );
3478 ssl->handshake->transform_earlydata = NULL;
3479
3480 mbedtls_ssl_transform_free( ssl->handshake->transform_handshake );
3481 mbedtls_free( ssl->handshake->transform_handshake );
3482 ssl->handshake->transform_handshake = NULL;
3483 }
3484
XiaokangQian2b01dc32022-01-21 02:53:13 +00003485#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01003486}
3487
3488int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
3489{
3490 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3491
3492 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3493
XiaokangQian78b1fa72022-01-19 06:56:30 +00003494 mbedtls_ssl_session_reset_msg_layer( ssl, partial );
Hanno Beckerb0302c42021-08-03 09:39:42 +01003495
3496 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003497#if defined(MBEDTLS_SSL_RENEGOTIATION)
3498 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003499 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00003500
3501 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003502 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
3503 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003504#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003505 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00003506
Hanno Beckerb0302c42021-08-03 09:39:42 +01003507 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01003508 ssl->session_out = NULL;
Paul Bakkerc0463502013-02-14 11:19:38 +01003509 if( ssl->session )
3510 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003511 mbedtls_ssl_session_free( ssl->session );
3512 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01003513 ssl->session = NULL;
3514 }
3515
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003516#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02003517 ssl->alpn_chosen = NULL;
3518#endif
3519
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02003520#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01003521#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003522 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01003523#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003524 {
3525 mbedtls_free( ssl->cli_id );
3526 ssl->cli_id = NULL;
3527 ssl->cli_id_len = 0;
3528 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02003529#endif
3530
Paul Bakker48916f92012-09-16 19:57:18 +00003531 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3532 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003533
3534 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00003535}
3536
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02003537/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003538 * Reset an initialized and used SSL context for re-use while retaining
3539 * all application-set variables, function pointers and data.
3540 */
3541int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
3542{
Hanno Becker43aefe22020-02-05 10:44:56 +00003543 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003544}
3545
3546/*
Paul Bakker5121ce52009-01-03 21:22:43 +00003547 * SSL set accessors
3548 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003549void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00003550{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003551 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00003552}
3553
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02003554void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01003555{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003556 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01003557}
3558
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003559#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003560void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003561{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003562 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003563}
3564#endif
3565
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003566void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02003567{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003568 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02003569}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02003570
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003571#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01003572
Hanno Becker1841b0a2018-08-24 11:13:57 +01003573void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
3574 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01003575{
3576 ssl->disable_datagram_packing = !allow_packing;
3577}
3578
3579void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
3580 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02003581{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003582 conf->hs_timeout_min = min;
3583 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02003584}
3585#endif
3586
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003587void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00003588{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003589 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00003590}
3591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003592#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003593void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02003594 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00003595 void *p_vrfy )
3596{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003597 conf->f_vrfy = f_vrfy;
3598 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00003599}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003600#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00003601
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003602void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00003603 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00003604 void *p_rng )
3605{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003606 conf->f_rng = f_rng;
3607 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00003608}
3609
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003610void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02003611 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00003612 void *p_dbg )
3613{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003614 conf->f_dbg = f_dbg;
3615 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00003616}
3617
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003618void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02003619 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00003620 mbedtls_ssl_send_t *f_send,
3621 mbedtls_ssl_recv_t *f_recv,
3622 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02003623{
3624 ssl->p_bio = p_bio;
3625 ssl->f_send = f_send;
3626 ssl->f_recv = f_recv;
3627 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01003628}
3629
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02003630#if defined(MBEDTLS_SSL_PROTO_DTLS)
3631void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
3632{
3633 ssl->mtu = mtu;
3634}
3635#endif
3636
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003637void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01003638{
3639 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02003640}
3641
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02003642void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
3643 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00003644 mbedtls_ssl_set_timer_t *f_set_timer,
3645 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02003646{
3647 ssl->p_timer = p_timer;
3648 ssl->f_set_timer = f_set_timer;
3649 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003650
3651 /* Make sure we start with no timer running */
Hanno Becker0f57a652020-02-05 10:37:26 +00003652 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02003653}
3654
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003655#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003656void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Hanno Beckera637ff62021-04-15 08:42:48 +01003657 void *p_cache,
3658 mbedtls_ssl_cache_get_t *f_get_cache,
3659 mbedtls_ssl_cache_set_t *f_set_cache )
Paul Bakker5121ce52009-01-03 21:22:43 +00003660{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01003661 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003662 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003663 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00003664}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003665#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00003666
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003667#if defined(MBEDTLS_SSL_CLI_C)
3668int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00003669{
Janos Follath865b3eb2019-12-16 11:46:15 +00003670 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003671
3672 if( ssl == NULL ||
3673 session == NULL ||
3674 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003675 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003676 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003677 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003678 }
3679
Hanno Beckere810bbc2021-05-14 16:01:05 +01003680 if( ssl->handshake->resume == 1 )
3681 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3682
Hanno Becker52055ae2019-02-06 14:30:46 +00003683 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
3684 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003685 return( ret );
3686
Paul Bakker0a597072012-09-25 21:55:46 +00003687 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02003688
3689 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003690}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003691#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00003692
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01003693void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
3694 const int *ciphersuites )
3695{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01003696 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00003697}
3698
Ronald Cron6f135e12021-12-08 16:57:54 +01003699#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yucadebe52021-08-24 10:36:45 +08003700void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
Hanno Becker71f1ed62021-07-24 06:01:47 +01003701 const int kex_modes )
3702{
Xiaofei Bai746f9482021-11-12 08:53:56 +00003703 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01003704}
Ronald Cron6f135e12021-12-08 16:57:54 +01003705#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01003706
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003707#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02003708void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01003709 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02003710{
3711 conf->cert_profile = profile;
3712}
3713
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003714/* Append a new keycert entry to a (possibly empty) list */
3715static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
3716 mbedtls_x509_crt *cert,
3717 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003718{
niisato8ee24222018-06-25 19:05:48 +09003719 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003720
niisato8ee24222018-06-25 19:05:48 +09003721 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
3722 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003723 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003724
niisato8ee24222018-06-25 19:05:48 +09003725 new_cert->cert = cert;
3726 new_cert->key = key;
3727 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003728
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003729 /* Update head is the list was null, else add to the end */
3730 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01003731 {
niisato8ee24222018-06-25 19:05:48 +09003732 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01003733 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003734 else
3735 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003736 mbedtls_ssl_key_cert *cur = *head;
3737 while( cur->next != NULL )
3738 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09003739 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003740 }
3741
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003742 return( 0 );
3743}
3744
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003745int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02003746 mbedtls_x509_crt *own_cert,
3747 mbedtls_pk_context *pk_key )
3748{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02003749 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02003750}
3751
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02003752void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01003753 mbedtls_x509_crt *ca_chain,
3754 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003755{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01003756 conf->ca_chain = ca_chain;
3757 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00003758
3759#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
3760 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
3761 * cannot be used together. */
3762 conf->f_ca_cb = NULL;
3763 conf->p_ca_cb = NULL;
3764#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00003765}
Hanno Becker5adaad92019-03-27 16:54:37 +00003766
3767#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
3768void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00003769 mbedtls_x509_crt_ca_cb_t f_ca_cb,
Hanno Becker5adaad92019-03-27 16:54:37 +00003770 void *p_ca_cb )
3771{
3772 conf->f_ca_cb = f_ca_cb;
3773 conf->p_ca_cb = p_ca_cb;
3774
3775 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
3776 * cannot be used together. */
3777 conf->ca_chain = NULL;
3778 conf->ca_crl = NULL;
3779}
3780#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003781#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00003782
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02003783#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3784int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
3785 mbedtls_x509_crt *own_cert,
3786 mbedtls_pk_context *pk_key )
3787{
3788 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
3789 own_cert, pk_key ) );
3790}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02003791
3792void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
3793 mbedtls_x509_crt *ca_chain,
3794 mbedtls_x509_crl *ca_crl )
3795{
3796 ssl->handshake->sni_ca_chain = ca_chain;
3797 ssl->handshake->sni_ca_crl = ca_crl;
3798}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02003799
3800void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
3801 int authmode )
3802{
3803 ssl->handshake->sni_authmode = authmode;
3804}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02003805#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
3806
Hanno Becker8927c832019-04-03 12:52:50 +01003807#if defined(MBEDTLS_X509_CRT_PARSE_C)
3808void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
3809 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
3810 void *p_vrfy )
3811{
3812 ssl->f_vrfy = f_vrfy;
3813 ssl->p_vrfy = p_vrfy;
3814}
3815#endif
3816
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003817#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02003818/*
3819 * Set EC J-PAKE password for current handshake
3820 */
3821int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
3822 const unsigned char *pw,
3823 size_t pw_len )
3824{
3825 mbedtls_ecjpake_role role;
3826
Janos Follath8eb64132016-06-03 15:40:57 +01003827 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02003828 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3829
3830 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
3831 role = MBEDTLS_ECJPAKE_SERVER;
3832 else
3833 role = MBEDTLS_ECJPAKE_CLIENT;
3834
3835 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
3836 role,
3837 MBEDTLS_MD_SHA256,
3838 MBEDTLS_ECP_DP_SECP256R1,
3839 pw, pw_len ) );
3840}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003841#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02003842
Gilles Peskineeccd8882020-03-10 12:19:08 +01003843#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003844
Hanno Becker2ed3dce2021-04-19 21:59:14 +01003845static int ssl_conf_psk_is_configured( mbedtls_ssl_config const *conf )
3846{
3847#if defined(MBEDTLS_USE_PSA_CRYPTO)
3848 if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
3849 return( 1 );
3850#endif /* MBEDTLS_USE_PSA_CRYPTO */
3851
3852 if( conf->psk != NULL )
3853 return( 1 );
3854
3855 return( 0 );
3856}
3857
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003858static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
3859{
3860 /* Remove reference to existing PSK, if any. */
3861#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02003862 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003863 {
3864 /* The maintenance of the PSK key slot is the
3865 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02003866 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003867 }
Hanno Beckera63ac3f2018-11-05 12:47:16 +00003868 /* This and the following branch should never
3869 * be taken simultaenously as we maintain the
3870 * invariant that raw and opaque PSKs are never
3871 * configured simultaneously. As a safeguard,
3872 * though, `else` is omitted here. */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003873#endif /* MBEDTLS_USE_PSA_CRYPTO */
3874 if( conf->psk != NULL )
3875 {
3876 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
3877
3878 mbedtls_free( conf->psk );
3879 conf->psk = NULL;
3880 conf->psk_len = 0;
3881 }
3882
3883 /* Remove reference to PSK identity, if any. */
3884 if( conf->psk_identity != NULL )
3885 {
3886 mbedtls_free( conf->psk_identity );
3887 conf->psk_identity = NULL;
3888 conf->psk_identity_len = 0;
3889 }
3890}
3891
Hanno Becker7390c712018-11-15 13:33:04 +00003892/* This function assumes that PSK identity in the SSL config is unset.
3893 * It checks that the provided identity is well-formed and attempts
3894 * to make a copy of it in the SSL config.
3895 * On failure, the PSK identity in the config remains unset. */
3896static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
3897 unsigned char const *psk_identity,
3898 size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003899{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003900 /* Identity len will be encoded on two bytes */
Hanno Becker7390c712018-11-15 13:33:04 +00003901 if( psk_identity == NULL ||
3902 ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10003903 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003904 {
3905 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3906 }
3907
Hanno Becker7390c712018-11-15 13:33:04 +00003908 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
3909 if( conf->psk_identity == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003910 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker6db455e2013-09-18 17:29:31 +02003911
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01003912 conf->psk_identity_len = psk_identity_len;
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01003913 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker5ad403f2013-09-18 21:21:30 +02003914
3915 return( 0 );
Paul Bakker6db455e2013-09-18 17:29:31 +02003916}
3917
Hanno Becker7390c712018-11-15 13:33:04 +00003918int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
3919 const unsigned char *psk, size_t psk_len,
3920 const unsigned char *psk_identity, size_t psk_identity_len )
3921{
Janos Follath865b3eb2019-12-16 11:46:15 +00003922 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01003923
3924 /* We currently only support one PSK, raw or opaque. */
3925 if( ssl_conf_psk_is_configured( conf ) )
3926 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Becker7390c712018-11-15 13:33:04 +00003927
3928 /* Check and set raw PSK */
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01003929 if( psk == NULL )
Hanno Becker7390c712018-11-15 13:33:04 +00003930 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01003931 if( psk_len == 0 )
3932 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3933 if( psk_len > MBEDTLS_PSK_MAX_LEN )
3934 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3935
Hanno Becker7390c712018-11-15 13:33:04 +00003936 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
3937 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3938 conf->psk_len = psk_len;
3939 memcpy( conf->psk, psk, conf->psk_len );
3940
3941 /* Check and set PSK Identity */
3942 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
3943 if( ret != 0 )
3944 ssl_conf_remove_psk( conf );
3945
3946 return( ret );
3947}
3948
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003949static void ssl_remove_psk( mbedtls_ssl_context *ssl )
3950{
3951#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02003952 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003953 {
Ronald Croncf56a0a2020-08-04 09:51:30 +02003954 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003955 }
3956 else
3957#endif /* MBEDTLS_USE_PSA_CRYPTO */
3958 if( ssl->handshake->psk != NULL )
3959 {
3960 mbedtls_platform_zeroize( ssl->handshake->psk,
3961 ssl->handshake->psk_len );
3962 mbedtls_free( ssl->handshake->psk );
3963 ssl->handshake->psk_len = 0;
3964 }
3965}
3966
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003967int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
3968 const unsigned char *psk, size_t psk_len )
3969{
3970 if( psk == NULL || ssl->handshake == NULL )
3971 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3972
3973 if( psk_len > MBEDTLS_PSK_MAX_LEN )
3974 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3975
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003976 ssl_remove_psk( ssl );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003977
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003978 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003979 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003980
3981 ssl->handshake->psk_len = psk_len;
3982 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
3983
3984 return( 0 );
3985}
3986
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003987#if defined(MBEDTLS_USE_PSA_CRYPTO)
3988int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
Andrzej Kurek03e01462022-01-03 12:53:24 +01003989 mbedtls_svc_key_id_t psk,
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003990 const unsigned char *psk_identity,
3991 size_t psk_identity_len )
3992{
Janos Follath865b3eb2019-12-16 11:46:15 +00003993 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01003994
3995 /* We currently only support one PSK, raw or opaque. */
3996 if( ssl_conf_psk_is_configured( conf ) )
3997 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01003998
Hanno Becker7390c712018-11-15 13:33:04 +00003999 /* Check and set opaque PSK */
Ronald Croncf56a0a2020-08-04 09:51:30 +02004000 if( mbedtls_svc_key_id_is_null( psk ) )
Hanno Becker7390c712018-11-15 13:33:04 +00004001 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ronald Croncf56a0a2020-08-04 09:51:30 +02004002 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00004003
4004 /* Check and set PSK Identity */
4005 ret = ssl_conf_set_psk_identity( conf, psk_identity,
4006 psk_identity_len );
4007 if( ret != 0 )
4008 ssl_conf_remove_psk( conf );
4009
4010 return( ret );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01004011}
4012
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01004013int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
4014 mbedtls_svc_key_id_t psk )
4015{
4016 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
4017 ( ssl->handshake == NULL ) )
4018 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4019
4020 ssl_remove_psk( ssl );
4021 ssl->handshake->psk_opaque = psk;
4022 return( 0 );
4023}
4024#endif /* MBEDTLS_USE_PSA_CRYPTO */
4025
4026void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
4027 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
4028 size_t),
4029 void *p_psk )
4030{
4031 conf->f_psk = f_psk;
4032 conf->p_psk = p_psk;
4033}
4034#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
4035
4036#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01004037psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01004038 size_t taglen,
4039 psa_algorithm_t *alg,
4040 psa_key_type_t *key_type,
4041 size_t *key_size )
4042{
4043 switch ( mbedtls_cipher_type )
4044 {
4045 case MBEDTLS_CIPHER_AES_128_CBC:
4046 *alg = PSA_ALG_CBC_NO_PADDING;
4047 *key_type = PSA_KEY_TYPE_AES;
4048 *key_size = 128;
4049 break;
4050 case MBEDTLS_CIPHER_AES_128_CCM:
4051 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4052 *key_type = PSA_KEY_TYPE_AES;
4053 *key_size = 128;
4054 break;
4055 case MBEDTLS_CIPHER_AES_128_GCM:
4056 *alg = PSA_ALG_GCM;
4057 *key_type = PSA_KEY_TYPE_AES;
4058 *key_size = 128;
4059 break;
4060 case MBEDTLS_CIPHER_AES_192_CCM:
4061 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4062 *key_type = PSA_KEY_TYPE_AES;
4063 *key_size = 192;
4064 break;
4065 case MBEDTLS_CIPHER_AES_192_GCM:
4066 *alg = PSA_ALG_GCM;
4067 *key_type = PSA_KEY_TYPE_AES;
4068 *key_size = 192;
4069 break;
4070 case MBEDTLS_CIPHER_AES_256_CBC:
4071 *alg = PSA_ALG_CBC_NO_PADDING;
4072 *key_type = PSA_KEY_TYPE_AES;
4073 *key_size = 256;
4074 break;
4075 case MBEDTLS_CIPHER_AES_256_CCM:
4076 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4077 *key_type = PSA_KEY_TYPE_AES;
4078 *key_size = 256;
4079 break;
4080 case MBEDTLS_CIPHER_AES_256_GCM:
4081 *alg = PSA_ALG_GCM;
4082 *key_type = PSA_KEY_TYPE_AES;
4083 *key_size = 256;
4084 break;
4085 case MBEDTLS_CIPHER_ARIA_128_CBC:
4086 *alg = PSA_ALG_CBC_NO_PADDING;
4087 *key_type = PSA_KEY_TYPE_ARIA;
4088 *key_size = 128;
4089 break;
4090 case MBEDTLS_CIPHER_ARIA_128_CCM:
4091 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4092 *key_type = PSA_KEY_TYPE_ARIA;
4093 *key_size = 128;
4094 break;
4095 case MBEDTLS_CIPHER_ARIA_128_GCM:
4096 *alg = PSA_ALG_GCM;
4097 *key_type = PSA_KEY_TYPE_ARIA;
4098 *key_size = 128;
4099 break;
4100 case MBEDTLS_CIPHER_ARIA_192_CCM:
4101 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4102 *key_type = PSA_KEY_TYPE_ARIA;
4103 *key_size = 192;
4104 break;
4105 case MBEDTLS_CIPHER_ARIA_192_GCM:
4106 *alg = PSA_ALG_GCM;
4107 *key_type = PSA_KEY_TYPE_ARIA;
4108 *key_size = 192;
4109 break;
4110 case MBEDTLS_CIPHER_ARIA_256_CBC:
4111 *alg = PSA_ALG_CBC_NO_PADDING;
4112 *key_type = PSA_KEY_TYPE_ARIA;
4113 *key_size = 256;
4114 break;
4115 case MBEDTLS_CIPHER_ARIA_256_CCM:
4116 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4117 *key_type = PSA_KEY_TYPE_ARIA;
4118 *key_size = 256;
4119 break;
4120 case MBEDTLS_CIPHER_ARIA_256_GCM:
4121 *alg = PSA_ALG_GCM;
4122 *key_type = PSA_KEY_TYPE_ARIA;
4123 *key_size = 256;
4124 break;
4125 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
4126 *alg = PSA_ALG_CBC_NO_PADDING;
4127 *key_type = PSA_KEY_TYPE_CAMELLIA;
4128 *key_size = 128;
4129 break;
4130 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
4131 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4132 *key_type = PSA_KEY_TYPE_CAMELLIA;
4133 *key_size = 128;
4134 break;
4135 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
4136 *alg = PSA_ALG_GCM;
4137 *key_type = PSA_KEY_TYPE_CAMELLIA;
4138 *key_size = 128;
4139 break;
4140 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
4141 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4142 *key_type = PSA_KEY_TYPE_CAMELLIA;
4143 *key_size = 192;
4144 break;
4145 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
4146 *alg = PSA_ALG_GCM;
4147 *key_type = PSA_KEY_TYPE_CAMELLIA;
4148 *key_size = 192;
4149 break;
4150 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
4151 *alg = PSA_ALG_CBC_NO_PADDING;
4152 *key_type = PSA_KEY_TYPE_CAMELLIA;
4153 *key_size = 256;
4154 break;
4155 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
4156 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
4157 *key_type = PSA_KEY_TYPE_CAMELLIA;
4158 *key_size = 256;
4159 break;
4160 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
4161 *alg = PSA_ALG_GCM;
4162 *key_type = PSA_KEY_TYPE_CAMELLIA;
4163 *key_size = 256;
4164 break;
4165 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
4166 *alg = PSA_ALG_CHACHA20_POLY1305;
4167 *key_type = PSA_KEY_TYPE_CHACHA20;
4168 *key_size = 256;
4169 break;
4170 case MBEDTLS_CIPHER_NULL:
4171 *alg = MBEDTLS_SSL_NULL_CIPHER;
4172 *key_type = 0;
4173 *key_size = 0;
4174 break;
4175 default:
4176 return PSA_ERROR_NOT_SUPPORTED;
4177 }
4178
4179 return PSA_SUCCESS;
4180}
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01004181#endif /* MBEDTLS_USE_PSA_CRYPTO */
4182
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02004183#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckera90658f2017-10-04 15:29:08 +01004184int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
4185 const unsigned char *dhm_P, size_t P_len,
4186 const unsigned char *dhm_G, size_t G_len )
4187{
Janos Follath865b3eb2019-12-16 11:46:15 +00004188 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01004189
Glenn Strausscee11292021-12-20 01:43:17 -05004190 mbedtls_mpi_free( &conf->dhm_P );
4191 mbedtls_mpi_free( &conf->dhm_G );
4192
Hanno Beckera90658f2017-10-04 15:29:08 +01004193 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
4194 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
4195 {
4196 mbedtls_mpi_free( &conf->dhm_P );
4197 mbedtls_mpi_free( &conf->dhm_G );
4198 return( ret );
4199 }
4200
4201 return( 0 );
4202}
Paul Bakker5121ce52009-01-03 21:22:43 +00004203
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004204int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00004205{
Janos Follath865b3eb2019-12-16 11:46:15 +00004206 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00004207
Glenn Strausscee11292021-12-20 01:43:17 -05004208 mbedtls_mpi_free( &conf->dhm_P );
4209 mbedtls_mpi_free( &conf->dhm_G );
4210
Gilles Peskinee5702482021-06-11 21:59:08 +02004211 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
4212 &conf->dhm_P ) ) != 0 ||
4213 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
4214 &conf->dhm_G ) ) != 0 )
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01004215 {
4216 mbedtls_mpi_free( &conf->dhm_P );
4217 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00004218 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01004219 }
Paul Bakker1b57b062011-01-06 15:48:19 +00004220
4221 return( 0 );
4222}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02004223#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00004224
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02004225#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
4226/*
4227 * Set the minimum length for Diffie-Hellman parameters
4228 */
4229void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
4230 unsigned int bitlen )
4231{
4232 conf->dhm_min_bitlen = bitlen;
4233}
4234#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
4235
Gilles Peskineeccd8882020-03-10 12:19:08 +01004236#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08004237#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02004238/*
4239 * Set allowed/preferred hashes for handshake signatures
4240 */
4241void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
4242 const int *hashes )
4243{
4244 conf->sig_hashes = hashes;
4245}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08004246#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01004247
Jerry Yuf017ee42022-01-12 15:49:48 +08004248/* Configure allowed signature algorithms for handshake */
Hanno Becker1cd6e002021-08-10 13:27:10 +01004249void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
4250 const uint16_t* sig_algs )
4251{
Jerry Yuf017ee42022-01-12 15:49:48 +08004252#if !defined(MBEDTLS_DEPRECATED_REMOVED)
4253 conf->sig_hashes = NULL;
4254#endif /* !MBEDTLS_DEPRECATED_REMOVED */
4255 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01004256}
Gilles Peskineeccd8882020-03-10 12:19:08 +01004257#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02004258
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02004259#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01004260#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01004261/*
4262 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01004263 *
4264 * mbedtls_ssl_setup() takes the provided list
4265 * and translates it to a list of IANA TLS group identifiers,
4266 * stored in ssl->handshake->group_list.
4267 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01004268 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004269void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004270 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01004271{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004272 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01004273 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01004274}
Brett Warrene0edc842021-08-17 09:53:13 +01004275#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01004276#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01004277
Brett Warrene0edc842021-08-17 09:53:13 +01004278/*
4279 * Set the allowed groups
4280 */
4281void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
4282 const uint16_t *group_list )
4283{
4284#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4285 conf->curve_list = NULL;
4286#endif
4287 conf->group_list = group_list;
4288}
4289
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01004290#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004291int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00004292{
Hanno Becker947194e2017-04-07 13:25:49 +01004293 /* Initialize to suppress unnecessary compiler warning */
4294 size_t hostname_len = 0;
4295
4296 /* Check if new hostname is valid before
4297 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01004298 if( hostname != NULL )
4299 {
4300 hostname_len = strlen( hostname );
4301
4302 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
4303 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4304 }
4305
4306 /* Now it's clear that we will overwrite the old hostname,
4307 * so we can free it safely */
4308
4309 if( ssl->hostname != NULL )
4310 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004311 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01004312 mbedtls_free( ssl->hostname );
4313 }
4314
4315 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01004316
Paul Bakker5121ce52009-01-03 21:22:43 +00004317 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01004318 {
4319 ssl->hostname = NULL;
4320 }
4321 else
4322 {
4323 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01004324 if( ssl->hostname == NULL )
4325 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02004326
Hanno Becker947194e2017-04-07 13:25:49 +01004327 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02004328
Hanno Becker947194e2017-04-07 13:25:49 +01004329 ssl->hostname[hostname_len] = '\0';
4330 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004331
4332 return( 0 );
4333}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01004334#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00004335
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01004336#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004337void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004338 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00004339 const unsigned char *, size_t),
4340 void *p_sni )
4341{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004342 conf->f_sni = f_sni;
4343 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00004344}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004345#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00004346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004347#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004348int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004349{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02004350 size_t cur_len, tot_len;
4351 const char **p;
4352
4353 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08004354 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
4355 * MUST NOT be truncated."
4356 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02004357 */
4358 tot_len = 0;
4359 for( p = protos; *p != NULL; p++ )
4360 {
4361 cur_len = strlen( *p );
4362 tot_len += cur_len;
4363
Ronald Cron8216dd32020-04-23 16:41:44 +02004364 if( ( cur_len == 0 ) ||
4365 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
4366 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004367 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02004368 }
4369
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004370 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02004371
4372 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004373}
4374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004375const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004376{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02004377 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004378}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004379#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02004380
Johan Pascalb62bb512015-12-03 21:56:45 +01004381#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldoref72faf2018-07-12 11:54:20 +03004382void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
4383 int support_mki_value )
Ron Eldor591f1622018-01-22 12:30:04 +02004384{
4385 conf->dtls_srtp_mki_support = support_mki_value;
4386}
4387
Ron Eldoref72faf2018-07-12 11:54:20 +03004388int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
4389 unsigned char *mki_value,
Johan Pascalf6417ec2020-09-22 15:15:19 +02004390 uint16_t mki_len )
Ron Eldor591f1622018-01-22 12:30:04 +02004391{
Johan Pascal5ef72d22020-10-28 17:05:47 +01004392 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
Ron Eldora9788042018-12-05 11:04:31 +02004393 {
Johan Pascald576fdb2020-09-22 10:39:53 +02004394 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ron Eldora9788042018-12-05 11:04:31 +02004395 }
Ron Eldor591f1622018-01-22 12:30:04 +02004396
4397 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
Ron Eldora9788042018-12-05 11:04:31 +02004398 {
Johan Pascald576fdb2020-09-22 10:39:53 +02004399 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ron Eldora9788042018-12-05 11:04:31 +02004400 }
Ron Eldor591f1622018-01-22 12:30:04 +02004401
4402 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
4403 ssl->dtls_srtp_info.mki_len = mki_len;
Ron Eldora9788042018-12-05 11:04:31 +02004404 return( 0 );
Ron Eldor591f1622018-01-22 12:30:04 +02004405}
4406
Ron Eldoref72faf2018-07-12 11:54:20 +03004407int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
Johan Pascal253d0262020-09-22 13:04:45 +02004408 const mbedtls_ssl_srtp_profile *profiles )
Johan Pascalb62bb512015-12-03 21:56:45 +01004409{
Johan Pascal253d0262020-09-22 13:04:45 +02004410 const mbedtls_ssl_srtp_profile *p;
4411 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01004412
Johan Pascal253d0262020-09-22 13:04:45 +02004413 /* check the profiles list: all entry must be valid,
4414 * its size cannot be more than the total number of supported profiles, currently 4 */
Johan Pascald387aa02020-09-23 18:47:56 +02004415 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
4416 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
4417 p++ )
Johan Pascald576fdb2020-09-22 10:39:53 +02004418 {
Johan Pascal5ef72d22020-10-28 17:05:47 +01004419 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
Johan Pascald576fdb2020-09-22 10:39:53 +02004420 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02004421 list_size++;
4422 }
4423 else
4424 {
4425 /* unsupported value, stop parsing and set the size to an error value */
4426 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01004427 }
4428 }
4429
Johan Pascal5ef72d22020-10-28 17:05:47 +01004430 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
Johan Pascald387aa02020-09-23 18:47:56 +02004431 {
Johan Pascal253d0262020-09-22 13:04:45 +02004432 conf->dtls_srtp_profile_list = NULL;
4433 conf->dtls_srtp_profile_list_len = 0;
4434 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4435 }
4436
Johan Pascal9bc97ca2020-09-21 23:44:45 +02004437 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02004438 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01004439
4440 return( 0 );
4441}
4442
Johan Pascal5ef72d22020-10-28 17:05:47 +01004443void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
4444 mbedtls_dtls_srtp_info *dtls_srtp_info )
Johan Pascalb62bb512015-12-03 21:56:45 +01004445{
Johan Pascal2258a4f2020-10-28 13:53:09 +01004446 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
4447 /* do not copy the mki value if there is no chosen profile */
Johan Pascal5ef72d22020-10-28 17:05:47 +01004448 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01004449 {
Johan Pascal2258a4f2020-10-28 13:53:09 +01004450 dtls_srtp_info->mki_len = 0;
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01004451 }
Johan Pascal2258a4f2020-10-28 13:53:09 +01004452 else
4453 {
4454 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Johan Pascal5ef72d22020-10-28 17:05:47 +01004455 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
4456 ssl->dtls_srtp_info.mki_len );
Johan Pascal2258a4f2020-10-28 13:53:09 +01004457 }
Johan Pascalb62bb512015-12-03 21:56:45 +01004458}
Johan Pascalb62bb512015-12-03 21:56:45 +01004459#endif /* MBEDTLS_SSL_DTLS_SRTP */
4460
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02004461void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00004462{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004463 conf->max_major_ver = major;
4464 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00004465}
4466
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02004467void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00004468{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004469 conf->min_major_ver = major;
4470 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00004471}
4472
Janos Follath088ce432017-04-10 12:42:31 +01004473#if defined(MBEDTLS_SSL_SRV_C)
4474void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
4475 char cert_req_ca_list )
4476{
4477 conf->cert_req_ca_list = cert_req_ca_list;
4478}
4479#endif
4480
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004481#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004482void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01004483{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004484 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01004485}
4486#endif
4487
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004488#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004489void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02004490{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004491 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02004492}
4493#endif
4494
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004495#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004496int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004497{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004498 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10004499 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004500 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004501 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004502 }
4503
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01004504 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004505
4506 return( 0 );
4507}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004508#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02004509
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004510void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00004511{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004512 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00004513}
4514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004515#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004516void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01004517{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004518 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01004519}
4520
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004521void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02004522{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004523 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02004524}
4525
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02004526void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01004527 const unsigned char period[8] )
4528{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02004529 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01004530}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004531#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00004532
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004533#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004534#if defined(MBEDTLS_SSL_CLI_C)
4535void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02004536{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01004537 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02004538}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004539#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02004540
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004541#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02004542void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
4543 mbedtls_ssl_ticket_write_t *f_ticket_write,
4544 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
4545 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02004546{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02004547 conf->f_ticket_write = f_ticket_write;
4548 conf->f_ticket_parse = f_ticket_parse;
4549 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02004550}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004551#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004552#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02004553
Hanno Becker7e6c1782021-06-08 09:24:55 +01004554void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
4555 mbedtls_ssl_export_keys_t *f_export_keys,
4556 void *p_export_keys )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01004557{
Hanno Becker7e6c1782021-06-08 09:24:55 +01004558 ssl->f_export_keys = f_export_keys;
4559 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03004560}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01004561
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004562#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01004563void mbedtls_ssl_conf_async_private_cb(
4564 mbedtls_ssl_config *conf,
4565 mbedtls_ssl_async_sign_t *f_async_sign,
4566 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
4567 mbedtls_ssl_async_resume_t *f_async_resume,
4568 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004569 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01004570{
4571 conf->f_async_sign_start = f_async_sign;
4572 conf->f_async_decrypt_start = f_async_decrypt;
4573 conf->f_async_resume = f_async_resume;
4574 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004575 conf->p_async_config_data = async_config_data;
4576}
4577
Gilles Peskine8f97af72018-04-26 11:46:10 +02004578void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
4579{
4580 return( conf->p_async_config_data );
4581}
4582
Gilles Peskine1febfef2018-04-30 11:54:39 +02004583void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004584{
4585 if( ssl->handshake == NULL )
4586 return( NULL );
4587 else
4588 return( ssl->handshake->user_async_ctx );
4589}
4590
Gilles Peskine1febfef2018-04-30 11:54:39 +02004591void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004592 void *ctx )
4593{
4594 if( ssl->handshake != NULL )
4595 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01004596}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004597#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01004598
Paul Bakker5121ce52009-01-03 21:22:43 +00004599/*
4600 * SSL get accessors
4601 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02004602uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004603{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00004604 if( ssl->session != NULL )
4605 return( ssl->session->verify_result );
4606
4607 if( ssl->session_negotiate != NULL )
4608 return( ssl->session_negotiate->verify_result );
4609
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02004610 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00004611}
4612
Glenn Strauss8f526902022-01-13 00:04:49 -05004613int mbedtls_ssl_get_ciphersuite_id_from_ssl( const mbedtls_ssl_context *ssl )
4614{
4615 if( ssl == NULL || ssl->session == NULL )
4616 return( 0 );
4617
4618 return( ssl->session->ciphersuite );
4619}
4620
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004621const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00004622{
Paul Bakker926c8e42013-03-06 10:23:34 +01004623 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02004624 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01004625
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004626 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00004627}
4628
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004629const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00004630{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004631#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004632 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01004633 {
4634 switch( ssl->minor_ver )
4635 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004636 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01004637 return( "DTLSv1.2" );
4638
4639 default:
4640 return( "unknown (DTLS)" );
4641 }
4642 }
4643#endif
4644
Paul Bakker43ca69c2011-01-15 17:35:19 +00004645 switch( ssl->minor_ver )
4646 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004647 case MBEDTLS_SSL_MINOR_VERSION_3:
Paul Bakker1ef83d62012-04-11 12:09:53 +00004648 return( "TLSv1.2" );
4649
Paul Bakker43ca69c2011-01-15 17:35:19 +00004650 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01004651 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00004652 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00004653}
4654
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004655#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04004656size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
4657{
David Horstmann95d516f2021-05-04 18:36:56 +01004658 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04004659 size_t read_mfl;
4660
4661 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
4662 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
4663 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
4664 {
4665 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
4666 }
4667
4668 /* Check if a smaller max length was negotiated */
4669 if( ssl->session_out != NULL )
4670 {
4671 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
4672 if( read_mfl < max_len )
4673 {
4674 max_len = read_mfl;
4675 }
4676 }
4677
4678 // During a handshake, use the value being negotiated
4679 if( ssl->session_negotiate != NULL )
4680 {
4681 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
4682 if( read_mfl < max_len )
4683 {
4684 max_len = read_mfl;
4685 }
4686 }
4687
4688 return( max_len );
4689}
4690
4691size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004692{
4693 size_t max_len;
4694
4695 /*
4696 * Assume mfl_code is correct since it was checked when set
4697 */
Angus Grattond8213d02016-05-25 20:56:48 +10004698 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004699
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02004700 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004701 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10004702 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004703 {
Angus Grattond8213d02016-05-25 20:56:48 +10004704 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004705 }
4706
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02004707 /* During a handshake, use the value being negotiated */
4708 if( ssl->session_negotiate != NULL &&
4709 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
4710 {
4711 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
4712 }
4713
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004714 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02004715}
4716#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4717
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02004718#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00004719size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02004720{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04004721 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
4722 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
4723 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
4724 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
4725 return ( 0 );
4726
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02004727 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
4728 return( ssl->mtu );
4729
4730 if( ssl->mtu == 0 )
4731 return( ssl->handshake->mtu );
4732
4733 return( ssl->mtu < ssl->handshake->mtu ?
4734 ssl->mtu : ssl->handshake->mtu );
4735}
4736#endif /* MBEDTLS_SSL_PROTO_DTLS */
4737
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004738int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
4739{
4740 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
4741
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02004742#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
4743 !defined(MBEDTLS_SSL_PROTO_DTLS)
4744 (void) ssl;
4745#endif
4746
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004747#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04004748 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004749
4750 if( max_len > mfl )
4751 max_len = mfl;
4752#endif
4753
4754#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00004755 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004756 {
Hanno Becker89490712020-02-05 10:50:12 +00004757 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004758 const int ret = mbedtls_ssl_get_record_expansion( ssl );
4759 const size_t overhead = (size_t) ret;
4760
4761 if( ret < 0 )
4762 return( ret );
4763
4764 if( mtu <= overhead )
4765 {
4766 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
4767 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4768 }
4769
4770 if( max_len > mtu - overhead )
4771 max_len = mtu - overhead;
4772 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02004773#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004774
Hanno Becker0defedb2018-08-10 12:35:02 +01004775#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
4776 !defined(MBEDTLS_SSL_PROTO_DTLS)
4777 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02004778#endif
4779
4780 return( (int) max_len );
4781}
4782
Hanno Becker2d8e99b2021-04-21 06:19:50 +01004783int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
4784{
4785 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
4786
4787#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4788 (void) ssl;
4789#endif
4790
4791#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4792 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
4793
4794 if( max_len > mfl )
4795 max_len = mfl;
4796#endif
4797
4798 return( (int) max_len );
4799}
4800
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004801#if defined(MBEDTLS_X509_CRT_PARSE_C)
4802const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00004803{
4804 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02004805 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00004806
Hanno Beckere6824572019-02-07 13:18:46 +00004807#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +02004808 return( ssl->session->peer_cert );
Hanno Beckere6824572019-02-07 13:18:46 +00004809#else
4810 return( NULL );
4811#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00004812}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004813#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00004814
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004815#if defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerf852b1c2019-02-05 11:42:30 +00004816int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
4817 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004818{
Hanno Beckere810bbc2021-05-14 16:01:05 +01004819 int ret;
4820
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004821 if( ssl == NULL ||
4822 dst == NULL ||
4823 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004824 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004825 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004826 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004827 }
4828
Hanno Beckere810bbc2021-05-14 16:01:05 +01004829 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
4830 * idempotent: Each session can only be exported once.
4831 *
4832 * (This is in preparation for TLS 1.3 support where we will
4833 * need the ability to export multiple sessions (aka tickets),
4834 * which will be achieved by calling mbedtls_ssl_get_session()
4835 * multiple times until it fails.)
4836 *
4837 * Check whether we have already exported the current session,
4838 * and fail if so.
4839 */
4840 if( ssl->session->exported == 1 )
4841 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4842
4843 ret = mbedtls_ssl_session_copy( dst, ssl->session );
4844 if( ret != 0 )
4845 return( ret );
4846
4847 /* Remember that we've exported the session. */
4848 ssl->session->exported = 1;
4849 return( 0 );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004850}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004851#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02004852
Paul Bakker5121ce52009-01-03 21:22:43 +00004853/*
Hanno Beckera835da52019-05-16 12:39:07 +01004854 * Define ticket header determining Mbed TLS version
4855 * and structure of the ticket.
4856 */
4857
Hanno Becker94ef3b32019-05-16 12:50:45 +01004858/*
Hanno Becker50b59662019-05-28 14:30:45 +01004859 * Define bitflag determining compile-time settings influencing
4860 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01004861 */
4862
Hanno Becker50b59662019-05-28 14:30:45 +01004863#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01004864#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01004865#else
Hanno Becker3e088662019-05-29 11:10:18 +01004866#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004867#endif /* MBEDTLS_HAVE_TIME */
4868
4869#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01004870#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004871#else
Hanno Becker3e088662019-05-29 11:10:18 +01004872#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004873#endif /* MBEDTLS_X509_CRT_PARSE_C */
4874
4875#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01004876#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004877#else
Hanno Becker3e088662019-05-29 11:10:18 +01004878#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004879#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
4880
4881#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01004882#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004883#else
Hanno Becker3e088662019-05-29 11:10:18 +01004884#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004885#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4886
Hanno Becker94ef3b32019-05-16 12:50:45 +01004887#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01004888#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004889#else
Hanno Becker3e088662019-05-29 11:10:18 +01004890#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004891#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
4892
Hanno Becker94ef3b32019-05-16 12:50:45 +01004893#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4894#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
4895#else
4896#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
4897#endif /* MBEDTLS_SSL_SESSION_TICKETS */
4898
Hanno Becker3e088662019-05-29 11:10:18 +01004899#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
4900#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
4901#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
4902#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01004903#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
4904#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01004905
Hanno Becker50b59662019-05-28 14:30:45 +01004906#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Becker3e088662019-05-29 11:10:18 +01004907 ( (uint16_t) ( \
4908 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
4909 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
4910 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
4911 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
Hanno Becker3e088662019-05-29 11:10:18 +01004912 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Beckerbe34e8e2019-06-04 09:43:16 +01004913 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
Hanno Becker94ef3b32019-05-16 12:50:45 +01004914
Hanno Beckerf8787072019-05-16 12:41:07 +01004915static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01004916 MBEDTLS_VERSION_MAJOR,
4917 MBEDTLS_VERSION_MINOR,
4918 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01004919 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
4920 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
Hanno Beckerf8787072019-05-16 12:41:07 +01004921};
Hanno Beckera835da52019-05-16 12:39:07 +01004922
4923/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004924 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004925 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004926 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004927 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01004928 *
Hanno Beckerdce50972021-08-01 05:39:23 +01004929 * opaque mbedtls_version[3]; // library version: major, minor, patch
4930 * opaque session_format[2]; // library-version specific 16-bit field
4931 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004932 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01004933 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004934 * Note: When updating the format, remember to keep
4935 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004936 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004937 * // In this version, `session_format` determines
4938 * // the setting of those compile-time
4939 * // configuration options which influence
4940 * // the structure of mbedtls_ssl_session.
4941 *
Hanno Beckerfa0d61e2021-08-02 08:56:14 +01004942 * uint8_t minor_ver; // Protocol-version. Possible values:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004943 * // - TLS 1.2 (MBEDTLS_SSL_MINOR_VERSION_3)
4944 *
4945 * select (serialized_session.minor_ver) {
4946 *
4947 * case MBEDTLS_SSL_MINOR_VERSION_3: // TLS 1.2
4948 * serialized_session_tls12 data;
4949 *
4950 * };
4951 *
4952 * } serialized_session;
4953 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004954 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004955
4956#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4957/* Serialization of TLS 1.2 sessions:
4958 *
4959 * struct {
4960 * uint64 start_time;
4961 * uint8 ciphersuite[2]; // defined by the standard
4962 * uint8 compression; // 0 or 1
4963 * uint8 session_id_len; // at most 32
4964 * opaque session_id[32];
4965 * opaque master[48]; // fixed length in the standard
4966 * uint32 verify_result;
4967 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
4968 * opaque ticket<0..2^24-1>; // length 0 means no ticket
4969 * uint32 ticket_lifetime;
4970 * uint8 mfl_code; // up to 255 according to standard
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004971 * uint8 encrypt_then_mac; // 0 or 1
4972 * } serialized_session_tls12;
4973 *
4974 */
4975static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
4976 unsigned char *buf,
4977 size_t buf_len )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004978{
4979 unsigned char *p = buf;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004980 size_t used = 0;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004981
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004982#if defined(MBEDTLS_HAVE_TIME)
4983 uint64_t start;
4984#endif
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004985#if defined(MBEDTLS_X509_CRT_PARSE_C)
4986#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4987 size_t cert_len;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004988#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4989#endif /* MBEDTLS_X509_CRT_PARSE_C */
4990
Hanno Beckera835da52019-05-16 12:39:07 +01004991 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004992 * Time
4993 */
4994#if defined(MBEDTLS_HAVE_TIME)
4995 used += 8;
4996
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02004997 if( used <= buf_len )
4998 {
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02004999 start = (uint64_t) session->start;
5000
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005001 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
5002 p += 8;
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005003 }
5004#endif /* MBEDTLS_HAVE_TIME */
5005
5006 /*
5007 * Basic mandatory fields
5008 */
5009 used += 2 /* ciphersuite */
5010 + 1 /* compression */
5011 + 1 /* id_len */
5012 + sizeof( session->id )
5013 + sizeof( session->master )
5014 + 4; /* verify_result */
5015
5016 if( used <= buf_len )
5017 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005018 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
5019 p += 2;
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005020
Joe Subbiani2194dc42021-07-14 12:31:31 +01005021 *p++ = MBEDTLS_BYTE_0( session->compression );
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005022
Joe Subbiani2194dc42021-07-14 12:31:31 +01005023 *p++ = MBEDTLS_BYTE_0( session->id_len );
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005024 memcpy( p, session->id, 32 );
5025 p += 32;
5026
5027 memcpy( p, session->master, 48 );
5028 p += 48;
5029
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005030 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
5031 p += 4;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005032 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005033
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005034 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005035 * Peer's end-entity certificate
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005036 */
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005037#if defined(MBEDTLS_X509_CRT_PARSE_C)
5038#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5039 if( session->peer_cert == NULL )
5040 cert_len = 0;
5041 else
5042 cert_len = session->peer_cert->raw.len;
5043
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005044 used += 3 + cert_len;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005045
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005046 if( used <= buf_len )
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005047 {
Joe Subbiani2194dc42021-07-14 12:31:31 +01005048 *p++ = MBEDTLS_BYTE_2( cert_len );
5049 *p++ = MBEDTLS_BYTE_1( cert_len );
5050 *p++ = MBEDTLS_BYTE_0( cert_len );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005051
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005052 if( session->peer_cert != NULL )
5053 {
5054 memcpy( p, session->peer_cert->raw.p, cert_len );
5055 p += cert_len;
5056 }
5057 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005058#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005059 if( session->peer_cert_digest != NULL )
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005060 {
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005061 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
5062 if( used <= buf_len )
5063 {
5064 *p++ = (unsigned char) session->peer_cert_digest_type;
5065 *p++ = (unsigned char) session->peer_cert_digest_len;
5066 memcpy( p, session->peer_cert_digest,
5067 session->peer_cert_digest_len );
5068 p += session->peer_cert_digest_len;
5069 }
5070 }
5071 else
5072 {
5073 used += 2;
5074 if( used <= buf_len )
5075 {
5076 *p++ = (unsigned char) MBEDTLS_MD_NONE;
5077 *p++ = 0;
5078 }
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005079 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005080#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5081#endif /* MBEDTLS_X509_CRT_PARSE_C */
5082
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005083 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005084 * Session ticket if any, plus associated data
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005085 */
5086#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005087 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005088
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005089 if( used <= buf_len )
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005090 {
Joe Subbiani2194dc42021-07-14 12:31:31 +01005091 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
5092 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
5093 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005094
5095 if( session->ticket != NULL )
5096 {
5097 memcpy( p, session->ticket, session->ticket_len );
5098 p += session->ticket_len;
5099 }
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005100
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005101 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
5102 p += 4;
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005103 }
5104#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5105
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005106 /*
5107 * Misc extension-related info
5108 */
5109#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5110 used += 1;
5111
5112 if( used <= buf_len )
5113 *p++ = session->mfl_code;
5114#endif
5115
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005116#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5117 used += 1;
5118
5119 if( used <= buf_len )
Joe Subbiani2194dc42021-07-14 12:31:31 +01005120 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005121#endif
5122
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01005123 return( used );
5124}
5125#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005126
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01005127static int ssl_session_save( const mbedtls_ssl_session *session,
5128 unsigned char omit_header,
5129 unsigned char *buf,
5130 size_t buf_len,
5131 size_t *olen )
5132{
5133 unsigned char *p = buf;
5134 size_t used = 0;
5135
5136 if( !omit_header )
5137 {
5138 /*
5139 * Add Mbed TLS version identifier
5140 */
5141
5142 used += sizeof( ssl_serialized_session_header );
5143
5144 if( used <= buf_len )
5145 {
5146 memcpy( p, ssl_serialized_session_header,
5147 sizeof( ssl_serialized_session_header ) );
5148 p += sizeof( ssl_serialized_session_header );
5149 }
5150 }
5151
5152 /*
5153 * TLS version identifier
5154 */
5155 used += 1;
5156 if( used <= buf_len )
5157 {
5158 *p++ = session->minor_ver;
5159 }
5160
5161 /* Forward to version-specific serialization routine. */
5162 switch( session->minor_ver )
5163 {
5164#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5165 case MBEDTLS_SSL_MINOR_VERSION_3:
5166 {
5167 size_t remaining_len = used <= buf_len ? buf_len - used : 0;
5168 used += ssl_session_save_tls12( session, p, remaining_len );
5169 break;
5170 }
5171#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5172
5173 default:
5174 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
5175 }
5176
5177 *olen = used;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02005178 if( used > buf_len )
5179 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005180
5181 return( 0 );
5182}
5183
5184/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005185 * Public wrapper for ssl_session_save()
5186 */
5187int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
5188 unsigned char *buf,
5189 size_t buf_len,
5190 size_t *olen )
5191{
5192 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
5193}
Jerry Yuc3091b12021-12-23 14:57:39 +08005194#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005195/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02005196 * Deserialize session, see mbedtls_ssl_session_save() for format.
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02005197 *
5198 * This internal version is wrapped by a public function that cleans up in
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005199 * case of error, and has an extra option omit_header.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005200 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01005201static int ssl_session_load_tls12( mbedtls_ssl_session *session,
5202 const unsigned char *buf,
5203 size_t len )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005204{
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005205#if defined(MBEDTLS_HAVE_TIME)
5206 uint64_t start;
5207#endif
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005208#if defined(MBEDTLS_X509_CRT_PARSE_C)
5209#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5210 size_t cert_len;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005211#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5212#endif /* MBEDTLS_X509_CRT_PARSE_C */
5213
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01005214 const unsigned char *p = buf;
5215 const unsigned char * const end = buf + len;
Hanno Beckera835da52019-05-16 12:39:07 +01005216
5217 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005218 * Time
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005219 */
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005220#if defined(MBEDTLS_HAVE_TIME)
5221 if( 8 > (size_t)( end - p ) )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005222 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5223
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005224 start = ( (uint64_t) p[0] << 56 ) |
5225 ( (uint64_t) p[1] << 48 ) |
5226 ( (uint64_t) p[2] << 40 ) |
5227 ( (uint64_t) p[3] << 32 ) |
5228 ( (uint64_t) p[4] << 24 ) |
5229 ( (uint64_t) p[5] << 16 ) |
5230 ( (uint64_t) p[6] << 8 ) |
5231 ( (uint64_t) p[7] );
5232 p += 8;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005233
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005234 session->start = (time_t) start;
5235#endif /* MBEDTLS_HAVE_TIME */
5236
5237 /*
5238 * Basic mandatory fields
5239 */
5240 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
5241 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5242
5243 session->ciphersuite = ( p[0] << 8 ) | p[1];
5244 p += 2;
5245
5246 session->compression = *p++;
5247
5248 session->id_len = *p++;
5249 memcpy( session->id, p, 32 );
5250 p += 32;
5251
5252 memcpy( session->master, p, 48 );
5253 p += 48;
5254
5255 session->verify_result = ( (uint32_t) p[0] << 24 ) |
5256 ( (uint32_t) p[1] << 16 ) |
5257 ( (uint32_t) p[2] << 8 ) |
5258 ( (uint32_t) p[3] );
5259 p += 4;
5260
5261 /* Immediately clear invalid pointer values that have been read, in case
5262 * we exit early before we replaced them with valid ones. */
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005263#if defined(MBEDTLS_X509_CRT_PARSE_C)
5264#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5265 session->peer_cert = NULL;
5266#else
5267 session->peer_cert_digest = NULL;
5268#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5269#endif /* MBEDTLS_X509_CRT_PARSE_C */
5270#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5271 session->ticket = NULL;
5272#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5273
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005274 /*
5275 * Peer certificate
5276 */
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005277#if defined(MBEDTLS_X509_CRT_PARSE_C)
5278#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5279 /* Deserialize CRT from the end of the ticket. */
5280 if( 3 > (size_t)( end - p ) )
5281 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5282
5283 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5284 p += 3;
5285
5286 if( cert_len != 0 )
5287 {
Janos Follath865b3eb2019-12-16 11:46:15 +00005288 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005289
5290 if( cert_len > (size_t)( end - p ) )
5291 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5292
5293 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
5294
5295 if( session->peer_cert == NULL )
5296 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5297
5298 mbedtls_x509_crt_init( session->peer_cert );
5299
5300 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
5301 p, cert_len ) ) != 0 )
5302 {
5303 mbedtls_x509_crt_free( session->peer_cert );
5304 mbedtls_free( session->peer_cert );
5305 session->peer_cert = NULL;
5306 return( ret );
5307 }
5308
5309 p += cert_len;
5310 }
5311#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5312 /* Deserialize CRT digest from the end of the ticket. */
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005313 if( 2 > (size_t)( end - p ) )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005314 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5315
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005316 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
5317 session->peer_cert_digest_len = (size_t) *p++;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005318
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005319 if( session->peer_cert_digest_len != 0 )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005320 {
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005321 const mbedtls_md_info_t *md_info =
5322 mbedtls_md_info_from_type( session->peer_cert_digest_type );
5323 if( md_info == NULL )
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005324 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005325 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
5326 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005327
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005328 if( session->peer_cert_digest_len > (size_t)( end - p ) )
5329 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5330
5331 session->peer_cert_digest =
5332 mbedtls_calloc( 1, session->peer_cert_digest_len );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005333 if( session->peer_cert_digest == NULL )
5334 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5335
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005336 memcpy( session->peer_cert_digest, p,
5337 session->peer_cert_digest_len );
5338 p += session->peer_cert_digest_len;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005339 }
5340#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5341#endif /* MBEDTLS_X509_CRT_PARSE_C */
5342
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005343 /*
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005344 * Session ticket and associated data
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005345 */
5346#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5347 if( 3 > (size_t)( end - p ) )
5348 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5349
5350 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5351 p += 3;
5352
5353 if( session->ticket_len != 0 )
5354 {
5355 if( session->ticket_len > (size_t)( end - p ) )
5356 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5357
5358 session->ticket = mbedtls_calloc( 1, session->ticket_len );
5359 if( session->ticket == NULL )
5360 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5361
5362 memcpy( session->ticket, p, session->ticket_len );
5363 p += session->ticket_len;
5364 }
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005365
5366 if( 4 > (size_t)( end - p ) )
5367 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5368
5369 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
5370 ( (uint32_t) p[1] << 16 ) |
5371 ( (uint32_t) p[2] << 8 ) |
5372 ( (uint32_t) p[3] );
5373 p += 4;
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005374#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5375
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005376 /*
5377 * Misc extension-related info
5378 */
5379#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5380 if( 1 > (size_t)( end - p ) )
5381 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5382
5383 session->mfl_code = *p++;
5384#endif
5385
Manuel Pégourié-Gonnardf743c032019-05-24 12:06:29 +02005386#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5387 if( 1 > (size_t)( end - p ) )
5388 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5389
5390 session->encrypt_then_mac = *p++;
5391#endif
5392
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02005393 /* Done, should have consumed entire buffer */
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005394 if( p != end )
5395 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5396
5397 return( 0 );
5398}
Jerry Yuc5aef882021-12-23 20:15:02 +08005399#endif /*MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01005400static int ssl_session_load( mbedtls_ssl_session *session,
5401 unsigned char omit_header,
5402 const unsigned char *buf,
5403 size_t len )
5404{
5405 const unsigned char *p = buf;
5406 const unsigned char * const end = buf + len;
5407
5408 if( !omit_header )
5409 {
5410 /*
5411 * Check Mbed TLS version identifier
5412 */
5413
5414 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
5415 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5416
5417 if( memcmp( p, ssl_serialized_session_header,
5418 sizeof( ssl_serialized_session_header ) ) != 0 )
5419 {
5420 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
5421 }
5422 p += sizeof( ssl_serialized_session_header );
5423 }
5424
5425 /*
5426 * TLS version identifier
5427 */
5428 if( 1 > (size_t)( end - p ) )
5429 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5430 session->minor_ver = *p++;
5431
5432 /* Dispatch according to TLS version. */
5433 switch( session->minor_ver )
5434 {
5435#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5436 case MBEDTLS_SSL_MINOR_VERSION_3: /* TLS 1.2 */
5437 {
5438 size_t remaining_len = ( end - p );
5439 return( ssl_session_load_tls12( session, p, remaining_len ) );
5440 }
5441#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5442
5443 default:
5444 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5445 }
5446}
5447
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02005448/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02005449 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02005450 */
5451int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
5452 const unsigned char *buf,
5453 size_t len )
5454{
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005455 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02005456
5457 if( ret != 0 )
5458 mbedtls_ssl_session_free( session );
5459
5460 return( ret );
5461}
5462
5463/*
Paul Bakker1961b702013-01-25 14:49:24 +01005464 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00005465 */
Hanno Becker41934dd2021-08-07 19:13:43 +01005466static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
5467{
5468 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5469
5470 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
5471 return( ret );
5472
5473#if defined(MBEDTLS_SSL_PROTO_DTLS)
5474 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5475 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
5476 {
5477 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
5478 return( ret );
5479 }
5480#endif /* MBEDTLS_SSL_PROTO_DTLS */
5481
5482 return( ret );
5483}
5484
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005485int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005486{
Hanno Becker41934dd2021-08-07 19:13:43 +01005487 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00005488
Hanno Becker41934dd2021-08-07 19:13:43 +01005489 if( ssl == NULL ||
5490 ssl->conf == NULL ||
5491 ssl->handshake == NULL ||
5492 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
5493 {
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005494 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker41934dd2021-08-07 19:13:43 +01005495 }
5496
5497 ret = ssl_prepare_handshake_step( ssl );
5498 if( ret != 0 )
5499 return( ret );
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005500
Jerry Yue7047812021-09-13 19:26:39 +08005501 ret = mbedtls_ssl_handle_pending_alert( ssl );
5502 if( ret != 0 )
5503 goto cleanup;
5504
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005505#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005506 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Jerry Yub9930e72021-08-06 17:11:51 +08005507 {
Ronald Cron6f135e12021-12-08 16:57:54 +01005508#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yub9930e72021-08-06 17:11:51 +08005509 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yuf4436812021-08-26 22:59:56 +08005510 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
Ronald Cron6f135e12021-12-08 16:57:54 +01005511#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08005512
5513#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5514 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
5515 ret = mbedtls_ssl_handshake_client_step( ssl );
5516#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5517 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005518#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005519#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005520 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Jerry Yub9930e72021-08-06 17:11:51 +08005521 {
Ronald Cron6f135e12021-12-08 16:57:54 +01005522#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yub9930e72021-08-06 17:11:51 +08005523 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yu27561932021-08-27 17:07:38 +08005524 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
Ronald Cron6f135e12021-12-08 16:57:54 +01005525#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08005526
5527#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5528 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
5529 ret = mbedtls_ssl_handshake_server_step( ssl );
5530#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5531 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005532#endif
5533
Jerry Yue7047812021-09-13 19:26:39 +08005534 if( ret != 0 )
5535 {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08005536 /* handshake_step return error. And it is same
5537 * with alert_reason.
5538 */
Jerry Yu3bf1f972021-09-22 21:37:18 +08005539 if( ssl->send_alert )
Jerry Yue7047812021-09-13 19:26:39 +08005540 {
Jerry Yu3bf1f972021-09-22 21:37:18 +08005541 ret = mbedtls_ssl_handle_pending_alert( ssl );
Jerry Yue7047812021-09-13 19:26:39 +08005542 goto cleanup;
5543 }
5544 }
5545
5546cleanup:
Paul Bakker1961b702013-01-25 14:49:24 +01005547 return( ret );
5548}
5549
5550/*
5551 * Perform the SSL handshake
5552 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005553int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01005554{
5555 int ret = 0;
5556
Hanno Beckera817ea42020-10-20 15:20:23 +01005557 /* Sanity checks */
5558
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005559 if( ssl == NULL || ssl->conf == NULL )
5560 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5561
Hanno Beckera817ea42020-10-20 15:20:23 +01005562#if defined(MBEDTLS_SSL_PROTO_DTLS)
5563 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5564 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
5565 {
5566 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
5567 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
5568 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5569 }
5570#endif /* MBEDTLS_SSL_PROTO_DTLS */
5571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005572 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01005573
Hanno Beckera817ea42020-10-20 15:20:23 +01005574 /* Main handshake loop */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005575 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +01005576 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005577 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01005578
5579 if( ret != 0 )
5580 break;
5581 }
5582
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005583 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005584
5585 return( ret );
5586}
5587
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005588#if defined(MBEDTLS_SSL_RENEGOTIATION)
5589#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00005590/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005591 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00005592 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005593static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005594{
Janos Follath865b3eb2019-12-16 11:46:15 +00005595 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005596
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005597 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005598
5599 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005600 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5601 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005602
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005603 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005604 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005605 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005606 return( ret );
5607 }
5608
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005609 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005610
5611 return( 0 );
5612}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005613#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005614
5615/*
5616 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005617 * - any side: calling mbedtls_ssl_renegotiate(),
5618 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
5619 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02005620 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005621 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005622 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005623 */
Hanno Becker40cdaa12020-02-05 10:48:27 +00005624int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00005625{
Janos Follath865b3eb2019-12-16 11:46:15 +00005626 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00005627
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005628 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005629
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005630 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
5631 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00005632
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02005633 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
5634 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005635#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005636 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005637 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02005638 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005639 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005640 ssl->handshake->out_msg_seq = 1;
5641 else
5642 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02005643 }
5644#endif
5645
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005646 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
5647 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00005648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005649 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00005650 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005651 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00005652 return( ret );
5653 }
5654
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005655 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005656
5657 return( 0 );
5658}
5659
5660/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005661 * Renegotiate current connection on client,
5662 * or request renegotiation on server
5663 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005664int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005665{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005666 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005667
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005668 if( ssl == NULL || ssl->conf == NULL )
5669 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005671#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005672 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005673 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005674 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005675 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5676 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005677
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005678 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02005679
5680 /* Did we already try/start sending HelloRequest? */
5681 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005682 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02005683
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005684 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005685 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005686#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005687
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005688#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005689 /*
5690 * On client, either start the renegotiation process or,
5691 * if already in progress, continue the handshake
5692 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005693 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005694 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005695 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5696 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005697
Hanno Becker40cdaa12020-02-05 10:48:27 +00005698 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005699 {
Hanno Becker40cdaa12020-02-05 10:48:27 +00005700 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005701 return( ret );
5702 }
5703 }
5704 else
5705 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005706 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005707 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005708 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005709 return( ret );
5710 }
5711 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005712#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01005713
Paul Bakker37ce0ff2013-10-31 14:32:04 +01005714 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005715}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005716#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01005717
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005718#if defined(MBEDTLS_X509_CRT_PARSE_C)
5719static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005720{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005721 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005722
5723 while( cur != NULL )
5724 {
5725 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005726 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005727 cur = next;
5728 }
5729}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005730#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005731
Gilles Peskine9b562d52018-04-25 20:32:43 +02005732void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00005733{
Gilles Peskine9b562d52018-04-25 20:32:43 +02005734 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
5735
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005736 if( handshake == NULL )
5737 return;
5738
Brett Warrene0edc842021-08-17 09:53:13 +01005739#if defined(MBEDTLS_ECP_C)
5740#if !defined(MBEDTLS_DEPRECATED_REMOVED)
5741 if ( ssl->handshake->group_list_heap_allocated )
5742 mbedtls_free( (void*) handshake->group_list );
5743 handshake->group_list = NULL;
5744#endif /* MBEDTLS_DEPRECATED_REMOVED */
5745#endif /* MBEDTLS_ECP_C */
5746
Jerry Yuf017ee42022-01-12 15:49:48 +08005747#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
5748#if !defined(MBEDTLS_DEPRECATED_REMOVED)
5749 if ( ssl->handshake->sig_algs_heap_allocated )
5750 mbedtls_free( (void*) handshake->sig_algs );
5751 handshake->sig_algs = NULL;
5752#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00005753#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
5754 if( ssl->handshake->certificate_request_context )
5755 {
5756 mbedtls_free( (void*) handshake->certificate_request_context );
5757 }
5758#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuf017ee42022-01-12 15:49:48 +08005759#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
5760
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02005761#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
5762 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
5763 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02005764 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02005765 handshake->async_in_progress = 0;
5766 }
5767#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
5768
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02005769#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05005770#if defined(MBEDTLS_USE_PSA_CRYPTO)
5771 psa_hash_abort( &handshake->fin_sha256_psa );
5772#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02005773 mbedtls_sha256_free( &handshake->fin_sha256 );
5774#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05005775#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02005776#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05005777#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05005778 psa_hash_abort( &handshake->fin_sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05005779#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02005780 mbedtls_sha512_free( &handshake->fin_sha512 );
5781#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05005782#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02005783
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005784#if defined(MBEDTLS_DHM_C)
5785 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00005786#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005787#if defined(MBEDTLS_ECDH_C)
5788 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02005789#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02005790#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02005791 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02005792#if defined(MBEDTLS_SSL_CLI_C)
5793 mbedtls_free( handshake->ecjpake_cache );
5794 handshake->ecjpake_cache = NULL;
5795 handshake->ecjpake_cache_len = 0;
5796#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02005797#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02005798
Janos Follath4ae5c292016-02-10 11:27:43 +00005799#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
5800 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02005801 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005802 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02005803#endif
5804
Gilles Peskineeccd8882020-03-10 12:19:08 +01005805#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01005806 if( handshake->psk != NULL )
5807 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05005808 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01005809 mbedtls_free( handshake->psk );
5810 }
5811#endif
5812
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005813#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
5814 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02005815 /*
5816 * Free only the linked list wrapper, not the keys themselves
5817 * since the belong to the SNI callback
5818 */
5819 if( handshake->sni_key_cert != NULL )
5820 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005821 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02005822
5823 while( cur != NULL )
5824 {
5825 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005826 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02005827 cur = next;
5828 }
5829 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005830#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02005831
Gilles Peskineeccd8882020-03-10 12:19:08 +01005832#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02005833 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Becker3dad3112019-02-05 17:19:52 +00005834 if( handshake->ecrs_peer_cert != NULL )
5835 {
5836 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
5837 mbedtls_free( handshake->ecrs_peer_cert );
5838 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02005839#endif
5840
Hanno Becker75173122019-02-06 16:18:31 +00005841#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
5842 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5843 mbedtls_pk_free( &handshake->peer_pubkey );
5844#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5845
XiaokangQian34909742022-01-27 02:25:04 +00005846#if defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005847 mbedtls_free( handshake->verify_cookie );
XiaokangQian8499b6c2022-01-27 09:00:11 +00005848#endif /* MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 */
5849
5850#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker533ab5f2020-02-05 10:49:13 +00005851 mbedtls_ssl_flight_free( handshake->flight );
5852 mbedtls_ssl_buffering_free( ssl );
XiaokangQian8499b6c2022-01-27 09:00:11 +00005853#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02005854
Hanno Becker4a63ed42019-01-08 11:39:35 +00005855#if defined(MBEDTLS_ECDH_C) && \
5856 defined(MBEDTLS_USE_PSA_CRYPTO)
5857 psa_destroy_key( handshake->ecdh_psa_privkey );
5858#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
5859
Ronald Cron6f135e12021-12-08 16:57:54 +01005860#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yua1a568c2021-11-09 10:17:21 +08005861 mbedtls_ssl_transform_free( handshake->transform_handshake );
5862 mbedtls_ssl_transform_free( handshake->transform_earlydata );
Jerry Yuba9c7272021-10-30 11:54:10 +08005863 mbedtls_free( handshake->transform_earlydata );
5864 mbedtls_free( handshake->transform_handshake );
Ronald Cron6f135e12021-12-08 16:57:54 +01005865#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08005866
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05005867
5868#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
5869 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
5870 * processes datagrams and the fact that a datagram is allowed to have
5871 * several records in it, it is possible that the I/O buffers are not
5872 * empty at this stage */
Andrzej Kurek4a063792020-10-21 15:08:44 +02005873 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
5874 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05005875#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01005876
Jerry Yuba9c7272021-10-30 11:54:10 +08005877 /* mbedtls_platform_zeroize MUST be last one in this function */
5878 mbedtls_platform_zeroize( handshake,
5879 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005880}
5881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005882void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00005883{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005884 if( session == NULL )
5885 return;
5886
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005887#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker1294a0b2019-02-05 12:38:15 +00005888 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +02005889#endif
Paul Bakker0a597072012-09-25 21:55:46 +00005890
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02005891#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005892 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02005893#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02005894
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05005895 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00005896}
5897
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02005898#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005899
5900#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5901#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
5902#else
5903#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
5904#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5905
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005906#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005907
5908#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5909#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
5910#else
5911#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
5912#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5913
5914#if defined(MBEDTLS_SSL_ALPN)
5915#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
5916#else
5917#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
5918#endif /* MBEDTLS_SSL_ALPN */
5919
5920#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
5921#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
5922#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
5923#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
5924
5925#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
5926 ( (uint32_t) ( \
5927 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
5928 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
5929 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
5930 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
5931 0u ) )
5932
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005933static unsigned char ssl_serialized_context_header[] = {
5934 MBEDTLS_VERSION_MAJOR,
5935 MBEDTLS_VERSION_MINOR,
5936 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01005937 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5938 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5939 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5940 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5941 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005942};
5943
Paul Bakker5121ce52009-01-03 21:22:43 +00005944/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005945 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02005946 *
5947 * The format of the serialized data is:
5948 * (in the presentation language of TLS, RFC 8446 section 3)
5949 *
5950 * // header
5951 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005952 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02005953 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005954 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005955 * Note: When updating the format, remember to keep these
5956 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02005957 *
5958 * // session sub-structure
5959 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
5960 * // transform sub-structure
5961 * uint8 random[64]; // ServerHello.random+ClientHello.random
5962 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
5963 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
5964 * // fields from ssl_context
5965 * uint32 badmac_seen; // DTLS: number of records with failing MAC
5966 * uint64 in_window_top; // DTLS: last validated record seq_num
5967 * uint64 in_window; // DTLS: bitmask for replay protection
5968 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
5969 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
5970 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
5971 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
5972 *
5973 * Note that many fields of the ssl_context or sub-structures are not
5974 * serialized, as they fall in one of the following categories:
5975 *
5976 * 1. forced value (eg in_left must be 0)
5977 * 2. pointer to dynamically-allocated memory (eg session, transform)
5978 * 3. value can be re-derived from other data (eg session keys from MS)
5979 * 4. value was temporary (eg content of input buffer)
5980 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005981 */
5982int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
5983 unsigned char *buf,
5984 size_t buf_len,
5985 size_t *olen )
5986{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005987 unsigned char *p = buf;
5988 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005989 size_t session_len;
5990 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005991
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02005992 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005993 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
5994 * this function's documentation.
5995 *
5996 * These are due to assumptions/limitations in the implementation. Some of
5997 * them are likely to stay (no handshake in progress) some might go away
5998 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02005999 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006000 /* The initial handshake must be over */
6001 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006002 {
6003 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02006004 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006005 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006006 if( ssl->handshake != NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006007 {
6008 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006009 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006010 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006011 /* Double-check that sub-structures are indeed ready */
6012 if( ssl->transform == NULL || ssl->session == NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006013 {
6014 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006015 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006016 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006017 /* There must be no pending incoming or outgoing data */
6018 if( mbedtls_ssl_check_pending( ssl ) != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006019 {
6020 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006021 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006022 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006023 if( ssl->out_left != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006024 {
6025 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006026 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006027 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006028 /* Protocol must be DLTS, not TLS */
6029 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006030 {
6031 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006032 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006033 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006034 /* Version must be 1.2 */
6035 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006036 {
6037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006038 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006039 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006040 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006041 {
6042 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006043 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006044 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006045 /* We must be using an AEAD ciphersuite */
6046 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006047 {
6048 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006049 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006050 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006051 /* Renegotiation must not be enabled */
6052#if defined(MBEDTLS_SSL_RENEGOTIATION)
6053 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006054 {
6055 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006056 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03006057 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02006058#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02006059
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02006060 /*
6061 * Version and format identifier
6062 */
6063 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02006064
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02006065 if( used <= buf_len )
6066 {
6067 memcpy( p, ssl_serialized_context_header,
6068 sizeof( ssl_serialized_context_header ) );
6069 p += sizeof( ssl_serialized_context_header );
6070 }
6071
6072 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006073 * Session (length + data)
6074 */
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02006075 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006076 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
6077 return( ret );
6078
6079 used += 4 + session_len;
6080 if( used <= buf_len )
6081 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01006082 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
6083 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006084
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02006085 ret = ssl_session_save( ssl->session, 1,
6086 p, session_len, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006087 if( ret != 0 )
6088 return( ret );
6089
6090 p += session_len;
6091 }
6092
6093 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006094 * Transform
6095 */
6096 used += sizeof( ssl->transform->randbytes );
6097 if( used <= buf_len )
6098 {
6099 memcpy( p, ssl->transform->randbytes,
6100 sizeof( ssl->transform->randbytes ) );
6101 p += sizeof( ssl->transform->randbytes );
6102 }
6103
6104#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6105 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
6106 if( used <= buf_len )
6107 {
6108 *p++ = ssl->transform->in_cid_len;
6109 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
6110 p += ssl->transform->in_cid_len;
6111
6112 *p++ = ssl->transform->out_cid_len;
6113 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
6114 p += ssl->transform->out_cid_len;
6115 }
6116#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6117
6118 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006119 * Saved fields from top-level ssl_context structure
6120 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006121 used += 4;
6122 if( used <= buf_len )
6123 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01006124 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
6125 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006126 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006127
6128#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6129 used += 16;
6130 if( used <= buf_len )
6131 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01006132 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
6133 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006134
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01006135 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
6136 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006137 }
6138#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6139
6140#if defined(MBEDTLS_SSL_PROTO_DTLS)
6141 used += 1;
6142 if( used <= buf_len )
6143 {
6144 *p++ = ssl->disable_datagram_packing;
6145 }
6146#endif /* MBEDTLS_SSL_PROTO_DTLS */
6147
Jerry Yuae0b2e22021-10-08 15:21:19 +08006148 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006149 if( used <= buf_len )
6150 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08006151 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
6152 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006153 }
6154
6155#if defined(MBEDTLS_SSL_PROTO_DTLS)
6156 used += 2;
6157 if( used <= buf_len )
6158 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01006159 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
6160 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006161 }
6162#endif /* MBEDTLS_SSL_PROTO_DTLS */
6163
6164#if defined(MBEDTLS_SSL_ALPN)
6165 {
6166 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnardf041f4e2019-07-24 00:58:27 +02006167 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006168 : 0;
6169
6170 used += 1 + alpn_len;
6171 if( used <= buf_len )
6172 {
6173 *p++ = alpn_len;
6174
6175 if( ssl->alpn_chosen != NULL )
6176 {
6177 memcpy( p, ssl->alpn_chosen, alpn_len );
6178 p += alpn_len;
6179 }
6180 }
6181 }
6182#endif /* MBEDTLS_SSL_ALPN */
6183
6184 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02006185 * Done
6186 */
6187 *olen = used;
6188
6189 if( used > buf_len )
6190 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02006191
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006192 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
6193
Hanno Becker43aefe22020-02-05 10:44:56 +00006194 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02006195}
6196
6197/*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006198 * Helper to get TLS 1.2 PRF from ciphersuite
6199 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
6200 */
6201typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
6202 const char *label,
6203 const unsigned char *random, size_t rlen,
6204 unsigned char *dstbuf, size_t dlen );
6205static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
6206{
Jerry Yuc3091b12021-12-23 14:57:39 +08006207#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02006208#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006209 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
6210 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
6211
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02006212 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
6213 return( tls_prf_sha384 );
Jarno Lamsab7b486c2019-08-21 15:30:44 +03006214#else
6215 (void) ciphersuite_id;
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02006216#endif
6217 return( tls_prf_sha256 );
Jerry Yuc3091b12021-12-23 14:57:39 +08006218#else
Jerry Yuc5aef882021-12-23 20:15:02 +08006219 (void) ciphersuite_id;
6220 return( NULL );
6221#endif
Jerry Yuc3091b12021-12-23 14:57:39 +08006222
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006223}
6224
6225/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02006226 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006227 *
6228 * This internal version is wrapped by a public function that cleans up in
6229 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02006230 */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006231static int ssl_context_load( mbedtls_ssl_context *ssl,
6232 const unsigned char *buf,
6233 size_t len )
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02006234{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02006235 const unsigned char *p = buf;
6236 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006237 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00006238 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02006239
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02006240 /*
6241 * The context should have been freshly setup or reset.
6242 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02006243 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02006244 * renegotiating, or if the user mistakenly loaded a session first.)
6245 */
6246 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
6247 ssl->session != NULL )
6248 {
6249 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6250 }
6251
6252 /*
6253 * We can't check that the config matches the initial one, but we can at
6254 * least check it matches the requirements for serializing.
6255 */
6256 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
6257 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
6258 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 ||
6259 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ||
6260 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 ||
6261#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02006262 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02006263#endif
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02006264 0 )
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02006265 {
6266 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6267 }
6268
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006269 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
6270
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02006271 /*
6272 * Check version identifier
6273 */
6274 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
6275 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6276
6277 if( memcmp( p, ssl_serialized_context_header,
6278 sizeof( ssl_serialized_context_header ) ) != 0 )
6279 {
6280 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
6281 }
6282 p += sizeof( ssl_serialized_context_header );
6283
6284 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006285 * Session
6286 */
6287 if( (size_t)( end - p ) < 4 )
6288 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6289
6290 session_len = ( (size_t) p[0] << 24 ) |
6291 ( (size_t) p[1] << 16 ) |
6292 ( (size_t) p[2] << 8 ) |
6293 ( (size_t) p[3] );
6294 p += 4;
6295
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006296 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00006297 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006298 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006299 ssl->session_in = ssl->session;
6300 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006301 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006302
6303 if( (size_t)( end - p ) < session_len )
6304 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6305
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02006306 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006307 if( ret != 0 )
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02006308 {
6309 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006310 return( ret );
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02006311 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006312
6313 p += session_len;
6314
6315 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006316 * Transform
6317 */
6318
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006319 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00006320 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006321 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006322 ssl->transform_in = ssl->transform;
6323 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02006324 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006325
6326 /* Read random bytes and populate structure */
6327 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
6328 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6329
Hanno Beckerbd257552021-03-22 06:59:27 +00006330 ret = ssl_tls12_populate_transform( ssl->transform,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006331 ssl->session->ciphersuite,
6332 ssl->session->master,
Hanno Beckerbd257552021-03-22 06:59:27 +00006333#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
6334 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006335 ssl->session->encrypt_then_mac,
Hanno Beckerbd257552021-03-22 06:59:27 +00006336#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
6337 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006338 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
6339 p, /* currently pointing to randbytes */
6340 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
6341 ssl->conf->endpoint,
6342 ssl );
6343 if( ret != 0 )
6344 return( ret );
6345
6346 p += sizeof( ssl->transform->randbytes );
6347
6348#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6349 /* Read connection IDs and store them */
6350 if( (size_t)( end - p ) < 1 )
6351 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6352
6353 ssl->transform->in_cid_len = *p++;
6354
Manuel Pégourié-Gonnard5ea13b82019-07-23 15:02:54 +02006355 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02006356 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6357
6358 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
6359 p += ssl->transform->in_cid_len;
6360
6361 ssl->transform->out_cid_len = *p++;
6362
6363 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
6364 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6365
6366 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
6367 p += ssl->transform->out_cid_len;
6368#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6369
6370 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006371 * Saved fields from top-level ssl_context structure
6372 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006373 if( (size_t)( end - p ) < 4 )
6374 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6375
6376 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
6377 ( (uint32_t) p[1] << 16 ) |
6378 ( (uint32_t) p[2] << 8 ) |
6379 ( (uint32_t) p[3] );
6380 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006381
6382#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6383 if( (size_t)( end - p ) < 16 )
6384 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6385
6386 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
6387 ( (uint64_t) p[1] << 48 ) |
6388 ( (uint64_t) p[2] << 40 ) |
6389 ( (uint64_t) p[3] << 32 ) |
6390 ( (uint64_t) p[4] << 24 ) |
6391 ( (uint64_t) p[5] << 16 ) |
6392 ( (uint64_t) p[6] << 8 ) |
6393 ( (uint64_t) p[7] );
6394 p += 8;
6395
6396 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
6397 ( (uint64_t) p[1] << 48 ) |
6398 ( (uint64_t) p[2] << 40 ) |
6399 ( (uint64_t) p[3] << 32 ) |
6400 ( (uint64_t) p[4] << 24 ) |
6401 ( (uint64_t) p[5] << 16 ) |
6402 ( (uint64_t) p[6] << 8 ) |
6403 ( (uint64_t) p[7] );
6404 p += 8;
6405#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6406
6407#if defined(MBEDTLS_SSL_PROTO_DTLS)
6408 if( (size_t)( end - p ) < 1 )
6409 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6410
6411 ssl->disable_datagram_packing = *p++;
6412#endif /* MBEDTLS_SSL_PROTO_DTLS */
6413
Jerry Yud9a94fe2021-09-28 18:58:59 +08006414 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006415 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yud9a94fe2021-09-28 18:58:59 +08006416 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
6417 p += sizeof( ssl->cur_out_ctr );
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02006418
6419#if defined(MBEDTLS_SSL_PROTO_DTLS)
6420 if( (size_t)( end - p ) < 2 )
6421 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6422
6423 ssl->mtu = ( p[0] << 8 ) | p[1];
6424 p += 2;
6425#endif /* MBEDTLS_SSL_PROTO_DTLS */
6426
6427#if defined(MBEDTLS_SSL_ALPN)
6428 {
6429 uint8_t alpn_len;
6430 const char **cur;
6431
6432 if( (size_t)( end - p ) < 1 )
6433 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6434
6435 alpn_len = *p++;
6436
6437 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
6438 {
6439 /* alpn_chosen should point to an item in the configured list */
6440 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
6441 {
6442 if( strlen( *cur ) == alpn_len &&
6443 memcmp( p, cur, alpn_len ) == 0 )
6444 {
6445 ssl->alpn_chosen = *cur;
6446 break;
6447 }
6448 }
6449 }
6450
6451 /* can only happen on conf mismatch */
6452 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
6453 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6454
6455 p += alpn_len;
6456 }
6457#endif /* MBEDTLS_SSL_ALPN */
6458
6459 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02006460 * Forced fields from top-level ssl_context structure
6461 *
6462 * Most of them already set to the correct value by mbedtls_ssl_init() and
6463 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
6464 */
6465 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
6466
6467 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6468 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6469
Hanno Becker361b10d2019-08-30 10:42:49 +01006470 /* Adjust pointers for header fields of outgoing records to
6471 * the given transform, accounting for explicit IV and CID. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00006472 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
Hanno Becker361b10d2019-08-30 10:42:49 +01006473
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02006474#if defined(MBEDTLS_SSL_PROTO_DTLS)
6475 ssl->in_epoch = 1;
6476#endif
6477
6478 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
6479 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00006480 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
6481 * inappropriately. */
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02006482 if( ssl->handshake != NULL )
6483 {
6484 mbedtls_ssl_handshake_free( ssl );
6485 mbedtls_free( ssl->handshake );
6486 ssl->handshake = NULL;
6487 }
6488
6489 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02006490 * Done - should have consumed entire buffer
6491 */
6492 if( p != end )
6493 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02006494
6495 return( 0 );
6496}
6497
6498/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02006499 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006500 */
6501int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
6502 const unsigned char *buf,
6503 size_t len )
6504{
6505 int ret = ssl_context_load( context, buf, len );
6506
6507 if( ret != 0 )
6508 mbedtls_ssl_free( context );
6509
6510 return( ret );
6511}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02006512#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02006513
6514/*
Paul Bakker5121ce52009-01-03 21:22:43 +00006515 * Free an SSL context
6516 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006517void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006518{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006519 if( ssl == NULL )
6520 return;
6521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006522 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006523
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01006524 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006525 {
sander-visserb8aa2072020-05-06 22:05:13 +02006526#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6527 size_t out_buf_len = ssl->out_buf_len;
6528#else
6529 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
6530#endif
6531
Darryl Greenb33cc762019-11-28 14:29:44 +00006532 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006533 mbedtls_free( ssl->out_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05006534 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00006535 }
6536
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01006537 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006538 {
sander-visserb8aa2072020-05-06 22:05:13 +02006539#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6540 size_t in_buf_len = ssl->in_buf_len;
6541#else
6542 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6543#endif
6544
Darryl Greenb33cc762019-11-28 14:29:44 +00006545 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006546 mbedtls_free( ssl->in_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05006547 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00006548 }
6549
Paul Bakker48916f92012-09-16 19:57:18 +00006550 if( ssl->transform )
6551 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006552 mbedtls_ssl_transform_free( ssl->transform );
6553 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00006554 }
6555
6556 if( ssl->handshake )
6557 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02006558 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006559 mbedtls_ssl_transform_free( ssl->transform_negotiate );
6560 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00006561
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006562 mbedtls_free( ssl->handshake );
6563 mbedtls_free( ssl->transform_negotiate );
6564 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00006565 }
6566
Ronald Cron6f135e12021-12-08 16:57:54 +01006567#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker3aa186f2021-08-10 09:24:19 +01006568 mbedtls_ssl_transform_free( ssl->transform_application );
6569 mbedtls_free( ssl->transform_application );
Ronald Cron6f135e12021-12-08 16:57:54 +01006570#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01006571
Paul Bakkerc0463502013-02-14 11:19:38 +01006572 if( ssl->session )
6573 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006574 mbedtls_ssl_session_free( ssl->session );
6575 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01006576 }
6577
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02006578#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02006579 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006580 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006581 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006582 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00006583 }
Paul Bakker0be444a2013-08-27 21:55:01 +02006584#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006585
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02006586#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006587 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02006588#endif
6589
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006590 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00006591
Paul Bakker86f04f42013-02-14 11:20:09 +01006592 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006593 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006594}
6595
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006596/*
6597 * Initialze mbedtls_ssl_config
6598 */
6599void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
6600{
6601 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
6602}
6603
Gilles Peskineeccd8882020-03-10 12:19:08 +01006604#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08006605#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskineae270bf2021-06-02 00:05:29 +02006606/* The selection should be the same as mbedtls_x509_crt_profile_default in
Gilles Peskinea28f0f52021-06-02 15:29:38 +02006607 * x509_crt.c. Here, the order matters. Currently we favor stronger hashes,
6608 * for no fundamental reason.
Gilles Peskineae270bf2021-06-02 00:05:29 +02006609 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
6610 * about this list. */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006611static int ssl_preset_default_hashes[] = {
6612#if defined(MBEDTLS_SHA512_C)
6613 MBEDTLS_MD_SHA512,
Mateusz Starzyk3352a532021-04-06 14:28:22 +02006614#endif
6615#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006616 MBEDTLS_MD_SHA384,
6617#endif
6618#if defined(MBEDTLS_SHA256_C)
6619 MBEDTLS_MD_SHA256,
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02006620#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006621 MBEDTLS_MD_NONE
6622};
Jerry Yuf017ee42022-01-12 15:49:48 +08006623#endif /* !MBEDTLS_DEPRECATED_REMOVED */
6624#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006625
Gilles Peskineae270bf2021-06-02 00:05:29 +02006626/* The selection should be the same as mbedtls_x509_crt_profile_default in
6627 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02006628 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02006629 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02006630 * about this list.
6631 */
Brett Warrene0edc842021-08-17 09:53:13 +01006632static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02006633#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006634 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02006635#endif
6636#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006637 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02006638#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02006639#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006640 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006641#endif
6642#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006643 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006644#endif
6645#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006646 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006647#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02006648#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006649 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02006650#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02006651#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006652 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006653#endif
6654#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006655 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02006656#endif
Brett Warrene0edc842021-08-17 09:53:13 +01006657 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02006658};
Gilles Peskineae270bf2021-06-02 00:05:29 +02006659
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006660static int ssl_preset_suiteb_ciphersuites[] = {
6661 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
6662 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
6663 0
6664};
6665
Gilles Peskineeccd8882020-03-10 12:19:08 +01006666#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08006667#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006668static int ssl_preset_suiteb_hashes[] = {
Jerry Yuf017ee42022-01-12 15:49:48 +08006669#if defined(MBEDTLS_SHA256_C)
6670 MBEDTLS_MD_SHA256,
6671#endif
Jerry Yu713013f2022-01-17 18:16:35 +08006672#if defined(MBEDTLS_SHA384_C)
6673 MBEDTLS_MD_SHA384,
6674#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006675 MBEDTLS_MD_NONE
6676};
Jerry Yuf017ee42022-01-12 15:49:48 +08006677#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006678
Jerry Yu909df7b2022-01-22 11:56:27 +08006679/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08006680 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08006681 * rules SHOULD be upheld.
6682 * - No duplicate entries.
6683 * - But if there is a good reason, do not change the order of the algorithms.
6684 * - ssl_tls12_present* is for TLS 1.2 use only.
6685 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08006686 */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006687static uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08006688
Jerry Yued5e9f42022-01-26 11:21:34 +08006689#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
6690 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6691 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
6692#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
6693 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08006694
Jerry Yu909df7b2022-01-22 11:56:27 +08006695#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
6696 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6697 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
6698#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
6699 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
6700
Jerry Yued5e9f42022-01-26 11:21:34 +08006701#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA512_C) && \
6702 defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
6703 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
6704#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
6705 MBEDTLS_ECP_DP_SECP521R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08006706
Jerry Yu909df7b2022-01-22 11:56:27 +08006707#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
6708 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
6709#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
6710
Jerry Yu53037892022-01-25 11:02:06 +08006711#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
6712 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
6713#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
6714
Jerry Yu909df7b2022-01-22 11:56:27 +08006715 MBEDTLS_TLS1_3_SIG_NONE
6716};
6717
6718/* NOTICE: see above */
6719#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6720static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08006721#if defined(MBEDTLS_SHA512_C)
6722 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA512 )
6723#endif
Jerry Yu11f0a9c2022-01-12 18:43:08 +08006724#if defined(MBEDTLS_SHA384_C)
6725 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
6726#endif
6727#if defined(MBEDTLS_SHA256_C)
6728 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
6729#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08006730 MBEDTLS_TLS1_3_SIG_NONE
6731};
6732#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6733/* NOTICE: see above */
6734static uint16_t ssl_preset_suiteb_sig_algs[] = {
6735
Jerry Yu909df7b2022-01-22 11:56:27 +08006736#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
6737 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6738 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
6739#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
6740 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
6741
Jerry Yu53037892022-01-25 11:02:06 +08006742#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
6743 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6744 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
6745#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
6746 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08006747
6748#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
6749 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
6750#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
Jerry Yu1a8b4812022-01-20 17:56:50 +08006751
Jerry Yu53037892022-01-25 11:02:06 +08006752#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
6753 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
6754#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
6755
Jerry Yu713013f2022-01-17 18:16:35 +08006756 MBEDTLS_TLS1_3_SIG_NONE
6757};
Jerry Yu6106fdc2022-01-12 16:36:14 +08006758
Jerry Yu909df7b2022-01-22 11:56:27 +08006759/* NOTICE: see above */
6760#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6761static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08006762#if defined(MBEDTLS_SHA256_C)
6763 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
6764#endif
Jerry Yu18c833e2022-01-25 10:55:47 +08006765#if defined(MBEDTLS_SHA384_C)
6766 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
6767#endif
Xiaofei Bai95395012021-11-25 08:51:30 +00006768 MBEDTLS_TLS1_3_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01006769};
Jerry Yu909df7b2022-01-22 11:56:27 +08006770#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6771
Jerry Yu1a8b4812022-01-20 17:56:50 +08006772#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006773
Brett Warrene0edc842021-08-17 09:53:13 +01006774static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01006775#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006776 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01006777#endif
6778#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01006779 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01006780#endif
Brett Warrene0edc842021-08-17 09:53:13 +01006781 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006782};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006783
Jerry Yu1a8b4812022-01-20 17:56:50 +08006784#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08006785/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08006786 * to make sure there are no duplicated signature algorithm entries. */
Jerry Yuf377d642022-01-25 10:43:59 +08006787static int ssl_check_no_sig_alg_duplication( uint16_t * sig_algs )
Jerry Yu1a8b4812022-01-20 17:56:50 +08006788{
6789 size_t i, j;
6790 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08006791
Jerry Yuf377d642022-01-25 10:43:59 +08006792 for( i = 0; sig_algs[i] != MBEDTLS_TLS1_3_SIG_NONE; i++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08006793 {
Jerry Yuf377d642022-01-25 10:43:59 +08006794 for( j = 0; j < i; j++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08006795 {
Jerry Yuf377d642022-01-25 10:43:59 +08006796 if( sig_algs[i] != sig_algs[j] )
6797 continue;
6798 mbedtls_printf( " entry(%04x,%" MBEDTLS_PRINTF_SIZET
6799 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
6800 sig_algs[i], j, i );
6801 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08006802 }
6803 }
6804 return( ret );
6805}
6806
6807#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6808
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006809/*
Tillmann Karras588ad502015-09-25 04:27:22 +02006810 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006811 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02006812int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006813 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006814{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02006815#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00006816 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02006817#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006818
Jerry Yu1a8b4812022-01-20 17:56:50 +08006819#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf377d642022-01-25 10:43:59 +08006820 if( ssl_check_no_sig_alg_duplication( ssl_preset_suiteb_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08006821 {
6822 mbedtls_printf( "ssl_preset_suiteb_sig_algs has duplicated entries\n" );
6823 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
6824 }
6825
Jerry Yuf377d642022-01-25 10:43:59 +08006826 if( ssl_check_no_sig_alg_duplication( ssl_preset_default_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08006827 {
6828 mbedtls_printf( "ssl_preset_default_sig_algs has duplicated entries\n" );
6829 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
6830 }
Jerry Yu909df7b2022-01-22 11:56:27 +08006831
6832#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yuf377d642022-01-25 10:43:59 +08006833 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_suiteb_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08006834 {
Jerry Yu909df7b2022-01-22 11:56:27 +08006835 mbedtls_printf( "ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08006836 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
6837 }
6838
Jerry Yuf377d642022-01-25 10:43:59 +08006839 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_default_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08006840 {
Jerry Yu909df7b2022-01-22 11:56:27 +08006841 mbedtls_printf( "ssl_tls12_preset_default_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08006842 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
6843 }
6844#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yu1a8b4812022-01-20 17:56:50 +08006845#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6846
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02006847 /* Use the functions here so that they are covered in tests,
6848 * but otherwise access member directly for efficiency */
6849 mbedtls_ssl_conf_endpoint( conf, endpoint );
6850 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006851
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006852 /*
6853 * Things that are common to all presets
6854 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02006855#if defined(MBEDTLS_SSL_CLI_C)
6856 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
6857 {
6858 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
6859#if defined(MBEDTLS_SSL_SESSION_TICKETS)
6860 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
6861#endif
6862 }
6863#endif
6864
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006865#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6866 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
6867#endif
6868
6869#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6870 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
6871#endif
6872
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02006873#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006874 conf->f_cookie_write = ssl_cookie_write_dummy;
6875 conf->f_cookie_check = ssl_cookie_check_dummy;
6876#endif
6877
6878#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6879 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
6880#endif
6881
Janos Follath088ce432017-04-10 12:42:31 +01006882#if defined(MBEDTLS_SSL_SRV_C)
6883 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02006884 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01006885#endif
6886
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006887#if defined(MBEDTLS_SSL_PROTO_DTLS)
6888 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
6889 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
6890#endif
6891
6892#if defined(MBEDTLS_SSL_RENEGOTIATION)
6893 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00006894 memset( conf->renego_period, 0x00, 2 );
6895 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006896#endif
6897
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006898#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckere2defad2021-07-24 05:59:17 +01006899 if( endpoint == MBEDTLS_SSL_IS_SERVER )
6900 {
6901 const unsigned char dhm_p[] =
6902 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
6903 const unsigned char dhm_g[] =
6904 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01006905
Hanno Beckere2defad2021-07-24 05:59:17 +01006906 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
6907 dhm_p, sizeof( dhm_p ),
6908 dhm_g, sizeof( dhm_g ) ) ) != 0 )
6909 {
6910 return( ret );
6911 }
6912 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02006913#endif
6914
Ronald Cron6f135e12021-12-08 16:57:54 +01006915#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker71f1ed62021-07-24 06:01:47 +01006916 /*
6917 * Allow all TLS 1.3 key exchange modes by default.
6918 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00006919 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01006920#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01006921
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006922 /*
6923 * Preset-specific defaults
6924 */
6925 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006926 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006927 /*
6928 * NSA Suite B
6929 */
6930 case MBEDTLS_SSL_PRESET_SUITEB:
6931 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6932 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
6933 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Jerry Yu7d239632022-01-27 14:16:44 +08006934#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
6935 /* Hybrid TLS 1.2/1.3 is not supported yet */
6936 conf->max_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6937#else
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006938 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
Jerry Yu7d239632022-01-27 14:16:44 +08006939#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_TLS1_3 */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006940
Hanno Beckerd60b6c62021-04-29 12:04:11 +01006941 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006942
6943#if defined(MBEDTLS_X509_CRT_PARSE_C)
6944 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006945#endif
6946
Gilles Peskineeccd8882020-03-10 12:19:08 +01006947#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08006948#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006949 conf->sig_hashes = ssl_preset_suiteb_hashes;
Jerry Yuf017ee42022-01-12 15:49:48 +08006950#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yu909df7b2022-01-22 11:56:27 +08006951#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6952 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
6953 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
6954 else
6955#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6956 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006957#endif
6958
Brett Warrene0edc842021-08-17 09:53:13 +01006959#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
6960 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006961#endif
Brett Warrene0edc842021-08-17 09:53:13 +01006962 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02006963 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006964
6965 /*
6966 * Default
6967 */
6968 default:
Ron Eldor5e9f14d2017-05-28 10:46:38 +03006969 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
6970 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
6971 MBEDTLS_SSL_MIN_MAJOR_VERSION :
6972 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
6973 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
6974 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
6975 MBEDTLS_SSL_MIN_MINOR_VERSION :
6976 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006977 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Jerry Yu7d239632022-01-27 14:16:44 +08006978#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
6979 /* Hybrid TLS 1.2/1.3 is not supported yet */
6980 conf->max_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6981#else
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006982 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
Jerry Yu7d239632022-01-27 14:16:44 +08006983#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_TLS1_3 */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006984
6985#if defined(MBEDTLS_SSL_PROTO_DTLS)
6986 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
TRodziewiczef73f012021-05-13 14:53:36 +02006987 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006988#endif
Hanno Beckerd60b6c62021-04-29 12:04:11 +01006989 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006990
6991#if defined(MBEDTLS_X509_CRT_PARSE_C)
6992 conf->cert_profile = &mbedtls_x509_crt_profile_default;
6993#endif
6994
Gilles Peskineeccd8882020-03-10 12:19:08 +01006995#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08006996#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01006997 conf->sig_hashes = ssl_preset_default_hashes;
Jerry Yuf017ee42022-01-12 15:49:48 +08006998#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yu909df7b2022-01-22 11:56:27 +08006999#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
7000 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
7001 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
7002 else
7003#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7004 conf->sig_algs = ssl_preset_default_sig_algs;
Hanno Beckerdeb68ce2021-08-10 16:04:05 +01007005#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007006
Brett Warrene0edc842021-08-17 09:53:13 +01007007#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
7008 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007009#endif
Brett Warrene0edc842021-08-17 09:53:13 +01007010 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02007011
7012#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
7013 conf->dhm_min_bitlen = 1024;
7014#endif
7015 }
7016
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007017 return( 0 );
7018}
7019
7020/*
7021 * Free mbedtls_ssl_config
7022 */
7023void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
7024{
7025#if defined(MBEDTLS_DHM_C)
7026 mbedtls_mpi_free( &conf->dhm_P );
7027 mbedtls_mpi_free( &conf->dhm_G );
7028#endif
7029
Gilles Peskineeccd8882020-03-10 12:19:08 +01007030#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007031 if( conf->psk != NULL )
7032 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05007033 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007034 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00007035 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007036 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09007037 }
7038
7039 if( conf->psk_identity != NULL )
7040 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05007041 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09007042 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00007043 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007044 conf->psk_identity_len = 0;
7045 }
7046#endif
7047
7048#if defined(MBEDTLS_X509_CRT_PARSE_C)
7049 ssl_key_cert_free( conf->key_cert );
7050#endif
7051
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05007052 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02007053}
7054
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02007055#if defined(MBEDTLS_PK_C) && \
7056 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007057/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007058 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007059 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007060unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007061{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007062#if defined(MBEDTLS_RSA_C)
7063 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
7064 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007065#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007066#if defined(MBEDTLS_ECDSA_C)
7067 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
7068 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007069#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007070 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02007071}
7072
Hanno Becker7e5437a2017-04-28 17:15:26 +01007073unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
7074{
7075 switch( type ) {
7076 case MBEDTLS_PK_RSA:
7077 return( MBEDTLS_SSL_SIG_RSA );
7078 case MBEDTLS_PK_ECDSA:
7079 case MBEDTLS_PK_ECKEY:
7080 return( MBEDTLS_SSL_SIG_ECDSA );
7081 default:
7082 return( MBEDTLS_SSL_SIG_ANON );
7083 }
7084}
7085
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007086mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007087{
7088 switch( sig )
7089 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007090#if defined(MBEDTLS_RSA_C)
7091 case MBEDTLS_SSL_SIG_RSA:
7092 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007093#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007094#if defined(MBEDTLS_ECDSA_C)
7095 case MBEDTLS_SSL_SIG_ECDSA:
7096 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007097#endif
7098 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007099 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007100 }
7101}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02007102#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007103
Hanno Becker7e5437a2017-04-28 17:15:26 +01007104#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01007105 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01007106
7107/* Find an entry in a signature-hash set matching a given hash algorithm. */
7108mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
7109 mbedtls_pk_type_t sig_alg )
7110{
7111 switch( sig_alg )
7112 {
7113 case MBEDTLS_PK_RSA:
7114 return( set->rsa );
7115 case MBEDTLS_PK_ECDSA:
7116 return( set->ecdsa );
7117 default:
7118 return( MBEDTLS_MD_NONE );
7119 }
7120}
7121
7122/* Add a signature-hash-pair to a signature-hash set */
7123void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
7124 mbedtls_pk_type_t sig_alg,
7125 mbedtls_md_type_t md_alg )
7126{
7127 switch( sig_alg )
7128 {
7129 case MBEDTLS_PK_RSA:
7130 if( set->rsa == MBEDTLS_MD_NONE )
7131 set->rsa = md_alg;
7132 break;
7133
7134 case MBEDTLS_PK_ECDSA:
7135 if( set->ecdsa == MBEDTLS_MD_NONE )
7136 set->ecdsa = md_alg;
7137 break;
7138
7139 default:
7140 break;
7141 }
7142}
7143
7144/* Allow exactly one hash algorithm for each signature. */
7145void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
7146 mbedtls_md_type_t md_alg )
7147{
7148 set->rsa = md_alg;
7149 set->ecdsa = md_alg;
7150}
7151
7152#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
Gilles Peskineeccd8882020-03-10 12:19:08 +01007153 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Hanno Becker7e5437a2017-04-28 17:15:26 +01007154
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02007155/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02007156 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02007157 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007158mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007159{
7160 switch( hash )
7161 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007162#if defined(MBEDTLS_MD5_C)
7163 case MBEDTLS_SSL_HASH_MD5:
7164 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007165#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007166#if defined(MBEDTLS_SHA1_C)
7167 case MBEDTLS_SSL_HASH_SHA1:
7168 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007169#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02007170#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007171 case MBEDTLS_SSL_HASH_SHA224:
7172 return( MBEDTLS_MD_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02007173#endif
7174#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007175 case MBEDTLS_SSL_HASH_SHA256:
7176 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007177#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02007178#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007179 case MBEDTLS_SSL_HASH_SHA384:
7180 return( MBEDTLS_MD_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02007181#endif
7182#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007183 case MBEDTLS_SSL_HASH_SHA512:
7184 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007185#endif
7186 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007187 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02007188 }
7189}
7190
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02007191/*
7192 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
7193 */
7194unsigned char mbedtls_ssl_hash_from_md_alg( int md )
7195{
7196 switch( md )
7197 {
7198#if defined(MBEDTLS_MD5_C)
7199 case MBEDTLS_MD_MD5:
7200 return( MBEDTLS_SSL_HASH_MD5 );
7201#endif
7202#if defined(MBEDTLS_SHA1_C)
7203 case MBEDTLS_MD_SHA1:
7204 return( MBEDTLS_SSL_HASH_SHA1 );
7205#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02007206#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02007207 case MBEDTLS_MD_SHA224:
7208 return( MBEDTLS_SSL_HASH_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02007209#endif
7210#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02007211 case MBEDTLS_MD_SHA256:
7212 return( MBEDTLS_SSL_HASH_SHA256 );
7213#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02007214#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02007215 case MBEDTLS_MD_SHA384:
7216 return( MBEDTLS_SSL_HASH_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02007217#endif
7218#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02007219 case MBEDTLS_MD_SHA512:
7220 return( MBEDTLS_SSL_HASH_SHA512 );
7221#endif
7222 default:
7223 return( MBEDTLS_SSL_HASH_NONE );
7224 }
7225}
7226
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01007227/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02007228 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02007229 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01007230 */
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01007231int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01007232{
Brett Warrene0edc842021-08-17 09:53:13 +01007233 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01007234
Brett Warrene0edc842021-08-17 09:53:13 +01007235 if( group_list == NULL )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02007236 return( -1 );
7237
Brett Warrene0edc842021-08-17 09:53:13 +01007238 for( ; *group_list != 0; group_list++ )
7239 {
7240 if( *group_list == tls_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02007241 return( 0 );
Brett Warrene0edc842021-08-17 09:53:13 +01007242 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01007243
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02007244 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01007245}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01007246
7247#if defined(MBEDTLS_ECP_C)
7248/*
7249 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
7250 */
7251int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
7252{
Manuel Pégourié-Gonnard422370d2022-02-07 11:55:21 +01007253 uint16_t tls_id = mbedtls_ecp_curve_info_from_grp_id( grp_id )->tls_id;
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01007254 return mbedtls_ssl_check_curve_tls_id( ssl, tls_id );
7255}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02007256#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007257
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007258#if defined(MBEDTLS_X509_CRT_PARSE_C)
7259int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
7260 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01007261 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02007262 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007263{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01007264 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007265 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02007266 const char *ext_oid;
7267 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02007268
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007269 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007270 {
7271 /* Server part of the key exchange */
7272 switch( ciphersuite->key_exchange )
7273 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007274 case MBEDTLS_KEY_EXCHANGE_RSA:
7275 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01007276 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007277 break;
7278
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007279 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
7280 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
7281 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
7282 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007283 break;
7284
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007285 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
7286 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01007287 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007288 break;
7289
7290 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007291 case MBEDTLS_KEY_EXCHANGE_NONE:
7292 case MBEDTLS_KEY_EXCHANGE_PSK:
7293 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
7294 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02007295 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007296 usage = 0;
7297 }
7298 }
7299 else
7300 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007301 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
7302 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007303 }
7304
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007305 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01007306 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01007307 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01007308 ret = -1;
7309 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007311 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02007312 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007313 ext_oid = MBEDTLS_OID_SERVER_AUTH;
7314 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02007315 }
7316 else
7317 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007318 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
7319 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02007320 }
7321
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007322 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01007323 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01007324 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01007325 ret = -1;
7326 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02007327
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01007328 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02007329}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007330#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02007331
Simon Butcher99000142016-10-13 17:21:01 +01007332int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
7333{
7334#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
7335 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Hanno Becker541af852021-05-14 16:49:01 +01007336 return( -1 );
Simon Butcher99000142016-10-13 17:21:01 +01007337
7338 switch( md )
7339 {
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02007340#if defined(MBEDTLS_SHA384_C)
Simon Butcher99000142016-10-13 17:21:01 +01007341 case MBEDTLS_SSL_HASH_SHA384:
7342 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
7343 break;
7344#endif
7345#if defined(MBEDTLS_SHA256_C)
7346 case MBEDTLS_SSL_HASH_SHA256:
7347 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
7348 break;
7349#endif
7350 default:
Hanno Becker541af852021-05-14 16:49:01 +01007351 return( -1 );
Simon Butcher99000142016-10-13 17:21:01 +01007352 }
7353
7354 return 0;
7355#else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
7356 (void) ssl;
7357 (void) md;
7358
Hanno Becker541af852021-05-14 16:49:01 +01007359 return( -1 );
Simon Butcher99000142016-10-13 17:21:01 +01007360#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7361}
7362
TRodziewicz0f82ec62021-05-12 17:49:18 +02007363#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007364
7365#if defined(MBEDTLS_USE_PSA_CRYPTO)
7366int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7367 unsigned char *hash, size_t *hashlen,
7368 unsigned char *data, size_t data_len,
7369 mbedtls_md_type_t md_alg )
7370{
Andrzej Kurek814feff2019-01-14 04:35:19 -05007371 psa_status_t status;
Jaeden Amero34973232019-02-20 10:32:28 +00007372 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007373 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
7374
Hanno Becker4c8c7aa2019-04-10 09:25:41 +01007375 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
Andrzej Kurek814feff2019-01-14 04:35:19 -05007376
7377 if( ( status = psa_hash_setup( &hash_operation,
7378 hash_alg ) ) != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007379 {
Andrzej Kurek814feff2019-01-14 04:35:19 -05007380 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007381 goto exit;
7382 }
7383
Andrzej Kurek814feff2019-01-14 04:35:19 -05007384 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
7385 64 ) ) != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007386 {
Andrzej Kurek814feff2019-01-14 04:35:19 -05007387 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007388 goto exit;
7389 }
7390
Andrzej Kurek814feff2019-01-14 04:35:19 -05007391 if( ( status = psa_hash_update( &hash_operation,
7392 data, data_len ) ) != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007393 {
Andrzej Kurek814feff2019-01-14 04:35:19 -05007394 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007395 goto exit;
7396 }
7397
Ronald Cron69a63422021-10-18 09:47:58 +02007398 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
Andrzej Kurek814feff2019-01-14 04:35:19 -05007399 hashlen ) ) != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007400 {
Andrzej Kurek814feff2019-01-14 04:35:19 -05007401 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007402 goto exit;
7403 }
7404
7405exit:
Andrzej Kurek814feff2019-01-14 04:35:19 -05007406 if( status != PSA_SUCCESS )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007407 {
7408 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7409 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andrzej Kurek814feff2019-01-14 04:35:19 -05007410 switch( status )
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007411 {
7412 case PSA_ERROR_NOT_SUPPORTED:
7413 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
Andrzej Kurek814feff2019-01-14 04:35:19 -05007414 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007415 case PSA_ERROR_BUFFER_TOO_SMALL:
7416 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7417 case PSA_ERROR_INSUFFICIENT_MEMORY:
7418 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7419 default:
TRodziewiczb579ccd2021-04-13 14:28:28 +02007420 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007421 }
7422 }
7423 return( 0 );
7424}
7425
7426#else
7427
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007428int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +02007429 unsigned char *hash, size_t *hashlen,
7430 unsigned char *data, size_t data_len,
7431 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007432{
7433 int ret = 0;
7434 mbedtls_md_context_t ctx;
7435 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +02007436 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007437
Hanno Becker4c8c7aa2019-04-10 09:25:41 +01007438 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
Andrzej Kurek814feff2019-01-14 04:35:19 -05007439
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007440 mbedtls_md_init( &ctx );
7441
7442 /*
7443 * digitally-signed struct {
7444 * opaque client_random[32];
7445 * opaque server_random[32];
7446 * ServerDHParams params;
7447 * };
7448 */
7449 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7450 {
7451 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7452 goto exit;
7453 }
7454 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7455 {
7456 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7457 goto exit;
7458 }
7459 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7460 {
7461 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7462 goto exit;
7463 }
7464 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7465 {
7466 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7467 goto exit;
7468 }
Gilles Peskineca1d7422018-04-24 11:53:22 +02007469 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007470 {
7471 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7472 goto exit;
7473 }
7474
7475exit:
7476 mbedtls_md_free( &ctx );
7477
7478 if( ret != 0 )
7479 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7480 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7481
7482 return( ret );
7483}
Andrzej Kurekd6db9be2019-01-10 05:27:10 -05007484#endif /* MBEDTLS_USE_PSA_CRYPTO */
7485
TRodziewicz0f82ec62021-05-12 17:49:18 +02007486#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01007487
Jerry Yu148165c2021-09-24 23:20:59 +08007488#if defined(MBEDTLS_USE_PSA_CRYPTO)
7489int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
7490 const mbedtls_md_type_t md,
7491 unsigned char *dst,
7492 size_t dst_len,
7493 size_t *olen )
7494{
Ronald Cronf6893e12022-01-07 22:09:01 +01007495 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
7496 psa_hash_operation_t *hash_operation_to_clone;
7497 psa_hash_operation_t hash_operation = psa_hash_operation_init();
7498
Jerry Yu148165c2021-09-24 23:20:59 +08007499 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01007500
7501 switch( md )
7502 {
7503#if defined(MBEDTLS_SHA384_C)
7504 case MBEDTLS_MD_SHA384:
7505 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
7506 break;
7507#endif
7508
7509#if defined(MBEDTLS_SHA256_C)
7510 case MBEDTLS_MD_SHA256:
7511 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
7512 break;
7513#endif
7514
7515 default:
7516 goto exit;
7517 }
7518
7519 status = psa_hash_clone( hash_operation_to_clone, &hash_operation );
7520 if( status != PSA_SUCCESS )
7521 goto exit;
7522
7523 status = psa_hash_finish( &hash_operation, dst, dst_len, olen );
7524 if( status != PSA_SUCCESS )
7525 goto exit;
7526
7527exit:
Ronald Cronb788c042022-02-15 09:14:15 +01007528 return( psa_ssl_status_to_mbedtls( status ) );
Jerry Yu148165c2021-09-24 23:20:59 +08007529}
7530#else /* MBEDTLS_USE_PSA_CRYPTO */
7531
Jerry Yu24c0ec32021-09-09 14:21:07 +08007532#if defined(MBEDTLS_SHA384_C)
Jerry Yu000f9762021-09-14 11:12:51 +08007533static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
7534 unsigned char *dst,
7535 size_t dst_len,
7536 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08007537{
Jerry Yu24c0ec32021-09-09 14:21:07 +08007538 int ret;
7539 mbedtls_sha512_context sha512;
7540
7541 if( dst_len < 48 )
7542 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7543
7544 mbedtls_sha512_init( &sha512 );
7545 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
7546
7547 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
7548 {
7549 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
7550 goto exit;
7551 }
7552
7553 *olen = 48;
7554
7555exit:
7556
7557 mbedtls_sha512_free( &sha512 );
7558 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08007559}
7560#endif /* MBEDTLS_SHA384_C */
7561
7562#if defined(MBEDTLS_SHA256_C)
Jerry Yu000f9762021-09-14 11:12:51 +08007563static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
7564 unsigned char *dst,
7565 size_t dst_len,
7566 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08007567{
Jerry Yu24c0ec32021-09-09 14:21:07 +08007568 int ret;
7569 mbedtls_sha256_context sha256;
7570
7571 if( dst_len < 32 )
7572 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7573
7574 mbedtls_sha256_init( &sha256 );
7575 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Jerry Yuc5aef882021-12-23 20:15:02 +08007576
Jerry Yu24c0ec32021-09-09 14:21:07 +08007577 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
7578 {
7579 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
7580 goto exit;
7581 }
7582
7583 *olen = 32;
7584
7585exit:
7586
7587 mbedtls_sha256_free( &sha256 );
7588 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08007589}
7590#endif /* MBEDTLS_SHA256_C */
7591
Jerry Yu000f9762021-09-14 11:12:51 +08007592int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
7593 const mbedtls_md_type_t md,
7594 unsigned char *dst,
7595 size_t dst_len,
7596 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08007597{
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007598 switch( md )
7599 {
7600
Jerry Yu24c0ec32021-09-09 14:21:07 +08007601#if defined(MBEDTLS_SHA384_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007602 case MBEDTLS_MD_SHA384:
Jerry Yuc5aef882021-12-23 20:15:02 +08007603 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08007604#endif /* MBEDTLS_SHA384_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007605
Jerry Yu24c0ec32021-09-09 14:21:07 +08007606#if defined(MBEDTLS_SHA256_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007607 case MBEDTLS_MD_SHA256:
Jerry Yuc5aef882021-12-23 20:15:02 +08007608 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08007609#endif /* MBEDTLS_SHA256_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08007610
7611 default:
7612 break;
7613 }
Jerry Yuc5aef882021-12-23 20:15:02 +08007614 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu24c0ec32021-09-09 14:21:07 +08007615}
XiaokangQian647719a2021-12-07 09:16:29 +00007616
Jerry Yu148165c2021-09-24 23:20:59 +08007617#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08007618
Jerry Yu1ea9d102021-12-21 13:41:49 +08007619#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) || \
7620 defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
7621 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Jerry Yuba073422021-12-20 22:22:15 +08007622/*
Jerry Yub925f212022-01-12 11:17:02 +08007623 * Function for writing a supported groups (TLS 1.3) or supported elliptic
7624 * curves (TLS 1.2) extension.
Jerry Yuba073422021-12-20 22:22:15 +08007625 *
Jerry Yub925f212022-01-12 11:17:02 +08007626 * The "extension_data" field of a supported groups extension contains a
7627 * "NamedGroupList" value (TLS 1.3 RFC8446):
Jerry Yuba073422021-12-20 22:22:15 +08007628 * enum {
7629 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
7630 * x25519(0x001D), x448(0x001E),
7631 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
7632 * ffdhe6144(0x0103), ffdhe8192(0x0104),
7633 * ffdhe_private_use(0x01FC..0x01FF),
7634 * ecdhe_private_use(0xFE00..0xFEFF),
7635 * (0xFFFF)
7636 * } NamedGroup;
7637 * struct {
7638 * NamedGroup named_group_list<2..2^16-1>;
7639 * } NamedGroupList;
Jerry Yub925f212022-01-12 11:17:02 +08007640 *
7641 * The "extension_data" field of a supported elliptic curves extension contains
7642 * a "NamedCurveList" value (TLS 1.2 RFC 8422):
Jerry Yu63282b42022-01-11 15:43:53 +08007643 * enum {
7644 * deprecated(1..22),
7645 * secp256r1 (23), secp384r1 (24), secp521r1 (25),
7646 * x25519(29), x448(30),
7647 * reserved (0xFE00..0xFEFF),
7648 * deprecated(0xFF01..0xFF02),
7649 * (0xFFFF)
7650 * } NamedCurve;
7651 * struct {
7652 * NamedCurve named_curve_list<2..2^16-1>
7653 * } NamedCurveList;
7654 *
Jerry Yub925f212022-01-12 11:17:02 +08007655 * The TLS 1.3 supported groups extension was defined to be a compatible
7656 * generalization of the TLS 1.2 supported elliptic curves extension. They both
7657 * share the same extension identifier.
Jerry Yu63282b42022-01-11 15:43:53 +08007658 *
Jerry Yub925f212022-01-12 11:17:02 +08007659 * DHE groups are not supported yet.
Jerry Yuba073422021-12-20 22:22:15 +08007660 */
Jerry Yuba073422021-12-20 22:22:15 +08007661int mbedtls_ssl_write_supported_groups_ext( mbedtls_ssl_context *ssl,
7662 unsigned char *buf,
Jerry Yu17532612021-12-20 22:32:09 +08007663 const unsigned char *end,
Jerry Yuba073422021-12-20 22:22:15 +08007664 size_t *out_len )
7665{
7666 unsigned char *p = buf ;
7667 unsigned char *named_group_list; /* Start of named_group_list */
7668 size_t named_group_list_len; /* Length of named_group_list */
7669 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
7670
7671 *out_len = 0;
Jerry Yuf46b0162022-01-11 16:28:00 +08007672
Jerry Yuba073422021-12-20 22:22:15 +08007673 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_groups extension" ) );
7674
7675 /* Check if we have space for header and length fields:
7676 * - extension_type (2 bytes)
7677 * - extension_data_length (2 bytes)
7678 * - named_group_list_length (2 bytes)
7679 */
7680 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
7681 p += 6;
7682
7683 named_group_list = p;
7684
7685 if( group_list == NULL )
7686 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
7687
Jerry Yu1510cea2022-01-12 10:56:49 +08007688 for( ; *group_list != 0; group_list++ )
Jerry Yuba073422021-12-20 22:22:15 +08007689 {
Jerry Yu1510cea2022-01-12 10:56:49 +08007690 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got supported group(%04x)", *group_list ) );
Jerry Yu63282b42022-01-11 15:43:53 +08007691
Jerry Yu1ea9d102021-12-21 13:41:49 +08007692#if defined(MBEDTLS_ECP_C)
Jerry Yu1510cea2022-01-12 10:56:49 +08007693 if( ( mbedtls_ssl_conf_is_tls13_enabled( ssl->conf ) &&
Jerry Yu3ad14ac2022-01-11 17:13:16 +08007694 mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) ) ||
Jerry Yu1510cea2022-01-12 10:56:49 +08007695 ( mbedtls_ssl_conf_is_tls12_enabled( ssl->conf ) &&
Jerry Yu3ad14ac2022-01-11 17:13:16 +08007696 mbedtls_ssl_tls12_named_group_is_ecdhe( *group_list ) ) )
Jerry Yuba073422021-12-20 22:22:15 +08007697 {
Jerry Yu3ad14ac2022-01-11 17:13:16 +08007698 const mbedtls_ecp_curve_info *curve_info;
7699 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
Jerry Yub925f212022-01-12 11:17:02 +08007700 if( curve_info == NULL )
Jerry Yu3ad14ac2022-01-11 17:13:16 +08007701 continue;
Jerry Yub925f212022-01-12 11:17:02 +08007702 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
7703 MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
7704 p += 2;
7705 MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
7706 curve_info->name, *group_list ) );
Jerry Yuba073422021-12-20 22:22:15 +08007707 }
Jerry Yu63282b42022-01-11 15:43:53 +08007708#endif /* MBEDTLS_ECP_C */
7709 /* Add DHE groups here */
Jerry Yuba073422021-12-20 22:22:15 +08007710
7711 }
7712
Jerry Yu1510cea2022-01-12 10:56:49 +08007713 /* Length of named_group_list */
Jerry Yuba073422021-12-20 22:22:15 +08007714 named_group_list_len = p - named_group_list;
7715 if( named_group_list_len == 0 )
7716 {
7717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No group available." ) );
7718 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7719 }
7720
7721 /* Write extension_type */
7722 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0 );
7723 /* Write extension_data_length */
7724 MBEDTLS_PUT_UINT16_BE( named_group_list_len + 2, buf, 2 );
7725 /* Write length of named_group_list */
7726 MBEDTLS_PUT_UINT16_BE( named_group_list_len, buf, 4 );
7727
Jerry Yu7f029d82022-01-11 11:08:53 +08007728 MBEDTLS_SSL_DEBUG_BUF( 3, "Supported groups extension",
7729 buf + 4, named_group_list_len + 2 );
Jerry Yuba073422021-12-20 22:22:15 +08007730
7731 *out_len = p - buf;
7732
7733#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
7734 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS;
7735#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
7736
7737 return( 0 );
7738}
7739
Jerry Yu1ea9d102021-12-21 13:41:49 +08007740#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED ||
7741 MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
7742 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Jerry Yuba073422021-12-20 22:22:15 +08007743
Jerry Yuf017ee42022-01-12 15:49:48 +08007744#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7745/*
Jerry Yu7ddc38c2022-01-19 11:08:05 +08007746 * Function for writing a signature algorithm extension.
Jerry Yuf017ee42022-01-12 15:49:48 +08007747 *
Jerry Yu8afd6e42022-01-20 15:54:26 +08007748 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
Jerry Yu7ddc38c2022-01-19 11:08:05 +08007749 * value (TLS 1.3 RFC8446):
7750 * enum {
7751 * ....
7752 * ecdsa_secp256r1_sha256( 0x0403 ),
7753 * ecdsa_secp384r1_sha384( 0x0503 ),
7754 * ecdsa_secp521r1_sha512( 0x0603 ),
7755 * ....
7756 * } SignatureScheme;
Jerry Yuf017ee42022-01-12 15:49:48 +08007757 *
Jerry Yu7ddc38c2022-01-19 11:08:05 +08007758 * struct {
7759 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
7760 * } SignatureSchemeList;
Jerry Yuf017ee42022-01-12 15:49:48 +08007761 *
Jerry Yu8afd6e42022-01-20 15:54:26 +08007762 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
7763 * value (TLS 1.2 RFC5246):
Jerry Yu7ddc38c2022-01-19 11:08:05 +08007764 * enum {
7765 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
7766 * sha512(6), (255)
7767 * } HashAlgorithm;
7768 *
7769 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
7770 * SignatureAlgorithm;
7771 *
7772 * struct {
7773 * HashAlgorithm hash;
7774 * SignatureAlgorithm signature;
7775 * } SignatureAndHashAlgorithm;
7776 *
7777 * SignatureAndHashAlgorithm
7778 * supported_signature_algorithms<2..2^16-2>;
7779 *
7780 * The TLS 1.3 signature algorithm extension was defined to be a compatible
7781 * generalization of the TLS 1.2 signature algorithm extension.
7782 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
7783 * `SignatureScheme` field of TLS 1.3
7784 *
Jerry Yuf017ee42022-01-12 15:49:48 +08007785 */
7786int mbedtls_ssl_write_sig_alg_ext( mbedtls_ssl_context *ssl, unsigned char *buf,
7787 const unsigned char *end, size_t *out_len )
7788{
7789 unsigned char *p = buf;
7790 unsigned char *supported_sig_alg; /* Start of supported_signature_algorithms */
7791 size_t supported_sig_alg_len = 0; /* Length of supported_signature_algorithms */
7792
7793 *out_len = 0;
7794
7795 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding signature_algorithms extension" ) );
7796
7797 /* Check if we have space for header and length field:
7798 * - extension_type (2 bytes)
7799 * - extension_data_length (2 bytes)
7800 * - supported_signature_algorithms_length (2 bytes)
7801 */
7802 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
7803 p += 6;
7804
7805 /*
7806 * Write supported_signature_algorithms
7807 */
7808 supported_sig_alg = p;
Jerry Yu6106fdc2022-01-12 16:36:14 +08007809 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs( ssl );
7810 if( sig_alg == NULL )
7811 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
7812
7813 for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ )
Jerry Yuf017ee42022-01-12 15:49:48 +08007814 {
Jerry Yu1bab3012022-01-19 17:43:22 +08007815 if( ! mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg ) )
7816 continue;
Jerry Yuf017ee42022-01-12 15:49:48 +08007817 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
7818 MBEDTLS_PUT_UINT16_BE( *sig_alg, p, 0 );
7819 p += 2;
7820 MBEDTLS_SSL_DEBUG_MSG( 3, ( "signature scheme [%x]", *sig_alg ) );
7821 }
7822
7823 /* Length of supported_signature_algorithms */
7824 supported_sig_alg_len = p - supported_sig_alg;
7825 if( supported_sig_alg_len == 0 )
7826 {
7827 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No signature algorithms defined." ) );
7828 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7829 }
7830
7831 /* Write extension_type */
7832 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SIG_ALG, buf, 0 );
7833 /* Write extension_data_length */
7834 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len + 2, buf, 2 );
7835 /* Write length of supported_signature_algorithms */
7836 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len, buf, 4 );
7837
7838 /* Output the total length of signature algorithms extension. */
7839 *out_len = p - buf;
7840
7841#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
7842 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SIG_ALG;
7843#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
7844 return( 0 );
7845}
7846#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Jerry Yuc5aef882021-12-23 20:15:02 +08007847#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7848int mbedtls_ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
7849 unsigned char *buf,
7850 const unsigned char *end,
7851 size_t *olen )
7852{
7853 unsigned char *p = buf;
7854 size_t hostname_len;
7855
7856 *olen = 0;
7857
7858 if( ssl->hostname == NULL )
7859 return( 0 );
7860
7861 MBEDTLS_SSL_DEBUG_MSG( 3,
7862 ( "client hello, adding server name extension: %s",
7863 ssl->hostname ) );
7864
7865 hostname_len = strlen( ssl->hostname );
7866
7867 MBEDTLS_SSL_CHK_BUF_PTR( p, end, hostname_len + 9 );
7868
7869 /*
7870 * Sect. 3, RFC 6066 (TLS Extensions Definitions)
7871 *
7872 * In order to provide any of the server names, clients MAY include an
7873 * extension of type "server_name" in the (extended) client hello. The
7874 * "extension_data" field of this extension SHALL contain
7875 * "ServerNameList" where:
7876 *
7877 * struct {
7878 * NameType name_type;
7879 * select (name_type) {
7880 * case host_name: HostName;
7881 * } name;
7882 * } ServerName;
7883 *
7884 * enum {
7885 * host_name(0), (255)
7886 * } NameType;
7887 *
7888 * opaque HostName<1..2^16-1>;
7889 *
7890 * struct {
7891 * ServerName server_name_list<1..2^16-1>
7892 * } ServerNameList;
7893 *
7894 */
7895 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SERVERNAME, p, 0 );
7896 p += 2;
7897
7898 MBEDTLS_PUT_UINT16_BE( hostname_len + 5, p, 0 );
7899 p += 2;
7900
7901 MBEDTLS_PUT_UINT16_BE( hostname_len + 3, p, 0 );
7902 p += 2;
7903
7904 *p++ = MBEDTLS_BYTE_0( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME );
7905
7906 MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 );
7907 p += 2;
7908
7909 memcpy( p, ssl->hostname, hostname_len );
7910
7911 *olen = hostname_len + 9;
7912
7913 return( 0 );
7914}
7915#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Jerry Yuf017ee42022-01-12 15:49:48 +08007916
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007917#endif /* MBEDTLS_SSL_TLS_C */