blob: 9be79cfacb8b3d002eed5590fa9f4cc035805c79 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 shared functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21/*
22 * The SSL 3.0 specification was drafted by Netscape in 1996,
23 * and became an IETF standard in 1999.
24 *
25 * http://wp.netscape.com/eng/ssl3/
26 * http://www.ietf.org/rfc/rfc2246.txt
27 * http://www.ietf.org/rfc/rfc4346.txt
28 */
29
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020030#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000031#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020032#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020034#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000037
SimonBd5800b72016-04-26 07:43:27 +010038#if defined(MBEDTLS_PLATFORM_C)
39#include "mbedtls/platform.h"
40#else
41#include <stdlib.h>
42#define mbedtls_calloc calloc
43#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010044#endif
45
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/debug.h"
47#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020048#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050049#include "mbedtls/platform_util.h"
Hanno Beckerb5352f02019-05-16 12:39:07 +010050#include "mbedtls/version.h"
Jarno Lamsaaf60cd72019-12-19 16:45:23 +020051#include "mbedtls/platform.h"
52
Rich Evans00ab4702015-02-06 13:43:58 +000053#include <string.h>
54
Janos Follath23bdca02016-10-07 14:47:14 +010055#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000056#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020057#endif
58
Andrzej Kurekf7df0d32020-09-19 12:00:57 +020059#define PROPER_HS_FRAGMENT 0x75
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -040060
Andrzej Kureka7932372020-09-19 07:56:06 +020061#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
62static int mbedtls_ssl_switch_key( mbedtls_ssl_transform *transform,
63 const mbedtls_operation_t operation )
64{
65 unsigned char * key;
Andrzej Kurek69bafce2020-09-19 12:45:20 +020066 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
67 int flow_ctrl = 0;
Andrzej Kureka7932372020-09-19 07:56:06 +020068#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
69 uint32_t hash;
70#endif
71 if( operation == MBEDTLS_ENCRYPT )
72 {
Andrzej Kurek69bafce2020-09-19 12:45:20 +020073 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +020074 key = transform->key_enc;
75#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
76 hash = transform->key_enc_hash;
77#endif
78 }
79 else if ( operation == MBEDTLS_DECRYPT )
80 {
Andrzej Kurek69bafce2020-09-19 12:45:20 +020081 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +020082 key = transform->key_dec;
83#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
84 hash = transform->key_dec_hash;
85#endif
86 }
87 else
88 {
89 return ( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
90 }
91#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
92 /* Check hash */
93 if( hash != mbedtls_hash( key, transform->key_bitlen >> 3 ) )
94 {
95 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
96 }
Andrzej Kurek69bafce2020-09-19 12:45:20 +020097 else
98 {
99 flow_ctrl++;
100 }
101#else
102 flow_ctrl++;
Andrzej Kureka7932372020-09-19 07:56:06 +0200103#endif
104 if( operation != transform->cipher_ctx.operation )
105 {
106 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx,
107 key,
108 transform->key_bitlen,
109 operation ) ) != 0 )
110 {
111 return( ret );
112 }
113 }
Andrzej Kurek69bafce2020-09-19 12:45:20 +0200114 if( flow_ctrl == 2 )
115 {
116 return( 0 );
117 }
118 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Andrzej Kureka7932372020-09-19 07:56:06 +0200119}
120#endif
121
Hanno Beckeref982d52019-07-23 15:56:18 +0100122#if defined(MBEDTLS_USE_TINYCRYPT)
123static int uecc_rng_wrapper( uint8_t *dest, unsigned int size )
124{
Hanno Beckerd089fad2019-07-24 09:05:05 +0100125 int ret;
126 ret = mbedtls_ssl_conf_rng_func( NULL, dest, size );
127 if( ret == 0 )
128 return( (int) size );
129
130 return( 0 );
Hanno Beckeref982d52019-07-23 15:56:18 +0100131}
Hanno Becker75f12d12019-07-23 16:16:15 +0100132
133int mbedtls_ssl_ecdh_read_peerkey( mbedtls_ssl_context *ssl,
134 unsigned char **p, unsigned char *end )
135{
136 size_t const secp256r1_uncompressed_point_length =
137 1 /* length */ + 1 /* length */ + 2 * NUM_ECC_BYTES /* data */;
138
139 if( (size_t)( end - *p ) < secp256r1_uncompressed_point_length )
140 {
141 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Bad ECDH peer pubkey (too short)" ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +0100142 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +0100143 }
144
145 if( (*p)[0] != 2 * NUM_ECC_BYTES + 1 ||
146 (*p)[1] != 0x04 )
147 {
148 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Unexpected ECDH peer pubkey header - expected { %#02x, %#02x }, got { %#02x, %#02x }",
149 2 * NUM_ECC_BYTES + 1,
150 0x04,
151 (unsigned) (*p)[0],
152 (unsigned) (*p)[1] ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +0100153 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +0100154 }
155
Piotr Nowicki305a5ec2020-08-10 17:42:18 +0200156 if( mbedtls_platform_memcpy( ssl->handshake->ecdh_peerkey, *p + 2, 2 * NUM_ECC_BYTES ) !=
157 ssl->handshake->ecdh_peerkey )
158 {
159 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
160 }
Hanno Becker75f12d12019-07-23 16:16:15 +0100161
162 *p += secp256r1_uncompressed_point_length;
163 return( 0 );
164}
Hanno Beckeref982d52019-07-23 15:56:18 +0100165#endif /* MBEDTLS_USE_TINYCRYPT */
166
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100167static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl );
Hanno Beckercd9dcda2018-08-28 17:18:56 +0100168static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100169
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100170/* Length of the "epoch" field in the record header */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200171static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100172{
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200173#if !defined(MBEDTLS_SSL_TRANSPORT__BOTH)
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +0100174 ((void) ssl);
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100175#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200176
177#if defined(MBEDTLS_SSL_PROTO_DTLS)
178 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
179 return( 2 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200180 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200181#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200182#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100183 return( 0 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200184#endif
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100185}
186
Hanno Beckerb82350b2019-07-26 07:24:05 +0100187static void ssl_send_pending_fatal_alert( mbedtls_ssl_context *ssl )
188{
189 if( ssl->pending_fatal_alert_msg == MBEDTLS_SSL_ALERT_MSG_NONE )
190 return;
191
192 mbedtls_ssl_send_alert_message( ssl,
193 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
194 ssl->pending_fatal_alert_msg );
195 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
196}
197
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200198/*
199 * Start a timer.
200 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200201 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200203{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100204 if( mbedtls_ssl_get_set_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200205 return;
206
207 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
Hanno Becker0ae6b242019-06-13 16:45:36 +0100208 mbedtls_ssl_get_set_timer( ssl )( ssl->p_timer,
209 millisecs / 4,
210 millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200211}
212
213/*
214 * Return -1 is timer is expired, 0 if it isn't.
215 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200216static int ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200217{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100218 if( mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +0200219 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200220
Hanno Becker0ae6b242019-06-13 16:45:36 +0100221 if( mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200222 {
223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200224 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200225 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200226
227 return( 0 );
228}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200229
Hanno Becker5aa4e2c2018-08-06 09:26:08 +0100230static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
231 mbedtls_ssl_transform *transform );
Hanno Beckerf5970a02019-05-08 09:38:41 +0100232static void ssl_update_in_pointers( mbedtls_ssl_context *ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100233
Hanno Becker02f26092019-07-03 16:13:00 +0100234#if defined(MBEDTLS_SSL_RECORD_CHECKING)
Hanno Becker03e2db62019-07-12 14:40:00 +0100235static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
236 unsigned char *buf,
237 size_t len,
238 mbedtls_record *rec );
239
Hanno Becker02f26092019-07-03 16:13:00 +0100240int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl,
241 unsigned char *buf,
242 size_t buflen )
243{
Andrzej Kurekfd56f402020-05-25 11:52:05 -0400244 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker03e2db62019-07-12 14:40:00 +0100245 mbedtls_record rec;
246 MBEDTLS_SSL_DEBUG_MSG( 1, ( "=> mbedtls_ssl_check_record" ) );
247 MBEDTLS_SSL_DEBUG_BUF( 3, "record buffer", buf, buflen );
248
249 /* We don't support record checking in TLS because
250 * (a) there doesn't seem to be a usecase for it, and
251 * (b) In SSLv3 and TLS 1.0, CBC record decryption has state
252 * and we'd need to backup the transform here.
253 */
254#if defined(MBEDTLS_SSL_PROTO_TLS)
255 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
256 {
257 ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
258 goto exit;
259 }
260 MBEDTLS_SSL_TRANSPORT_ELSE
261#endif /* MBEDTLS_SSL_PROTO_TLS */
262#if defined(MBEDTLS_SSL_PROTO_DTLS)
263 {
264 ret = ssl_parse_record_header( ssl, buf, buflen, &rec );
265 if( ret != 0 )
266 {
267 MBEDTLS_SSL_DEBUG_RET( 3, "ssl_parse_record_header", ret );
268 goto exit;
269 }
270
271 if( ssl->transform_in != NULL )
272 {
273 ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in, &rec );
274 if( ret != 0 )
275 {
276 MBEDTLS_SSL_DEBUG_RET( 3, "mbedtls_ssl_decrypt_buf", ret );
277 goto exit;
278 }
279 }
280 }
281#endif /* MBEDTLS_SSL_PROTO_DTLS */
282
283exit:
284 /* On success, we have decrypted the buffer in-place, so make
285 * sure we don't leak any plaintext data. */
286 mbedtls_platform_zeroize( buf, buflen );
287
288 /* For the purpose of this API, treat messages with unexpected CID
289 * as well as such from future epochs as unexpected. */
290 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID ||
291 ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
292 {
293 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
294 }
295
296 MBEDTLS_SSL_DEBUG_MSG( 1, ( "<= mbedtls_ssl_check_record" ) );
297 return( ret );
Hanno Becker02f26092019-07-03 16:13:00 +0100298}
299#endif /* MBEDTLS_SSL_RECORD_CHECKING */
300
Hanno Becker67bc7c32018-08-06 11:33:50 +0100301#define SSL_DONT_FORCE_FLUSH 0
302#define SSL_FORCE_FLUSH 1
303
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200304#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +0100305
Hanno Beckera5a2b082019-05-15 14:03:01 +0100306#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100307/* Top-level Connection ID API */
308
Hanno Beckere0200da2019-06-13 09:23:43 +0100309#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
310 !defined(MBEDTLS_SSL_CONF_CID_LEN) && \
311 !defined(MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +0100312int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
313 size_t len,
314 int ignore_other_cid )
Hanno Beckereec2be92019-05-03 13:06:44 +0100315{
316 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
317 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
318
Hanno Becker791ec6b2019-05-14 11:45:26 +0100319 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
320 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
321 {
322 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
323 }
324
325 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckereec2be92019-05-03 13:06:44 +0100326 conf->cid_len = len;
327 return( 0 );
328}
Hanno Beckere0200da2019-06-13 09:23:43 +0100329#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
330 !MBEDTLS_SSL_CONF_CID_LEN &&
331 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
332
333#if MBEDTLS_SSL_CONF_CID_LEN > MBEDTLS_SSL_CID_IN_LEN_MAX
334#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_CID_LEN"
335#endif
336#if MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE && \
337 MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_FAIL
338#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID"
339#endif
340
341#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
342 !MBEDTLS_SSL_CONF_CID_LEN &&
343 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
Hanno Beckereec2be92019-05-03 13:06:44 +0100344
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100345int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
346 int enable,
347 unsigned char const *own_cid,
348 size_t own_cid_len )
349{
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200350 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker78c43022019-05-03 14:38:32 +0100351 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
352
Hanno Becker07489862019-04-25 16:01:49 +0100353 ssl->negotiate_cid = enable;
354 if( enable == MBEDTLS_SSL_CID_DISABLED )
355 {
356 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
357 return( 0 );
358 }
359 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckereec2be92019-05-03 13:06:44 +0100360 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Becker07489862019-04-25 16:01:49 +0100361
Hanno Beckere0200da2019-06-13 09:23:43 +0100362 if( own_cid_len != mbedtls_ssl_conf_get_cid_len( ssl->conf ) )
Hanno Becker07489862019-04-25 16:01:49 +0100363 {
Hanno Beckereec2be92019-05-03 13:06:44 +0100364 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
365 (unsigned) own_cid_len,
Hanno Beckere0200da2019-06-13 09:23:43 +0100366 (unsigned) mbedtls_ssl_conf_get_cid_len( ssl->conf ) ) );
Hanno Becker07489862019-04-25 16:01:49 +0100367 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
368 }
369
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300370 /* Not using more secure mbedtls_platform_memcpy as cid is public */
371 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb4a56062019-04-30 14:07:31 +0100372 /* Truncation is not an issue here because
373 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
374 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Becker07489862019-04-25 16:01:49 +0100375
Andrzej Kurekafec8852020-07-15 16:31:27 -0400376 return( 0 );
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100377}
378
379int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
380 int *enabled,
381 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
382 size_t *peer_cid_len )
383{
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100384 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Becker2de89fa2019-04-26 17:08:02 +0100385
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200386 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker78c43022019-05-03 14:38:32 +0100387 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
388 {
Hanno Becker2de89fa2019-04-26 17:08:02 +0100389 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker78c43022019-05-03 14:38:32 +0100390 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100391
Hanno Beckercb063f52019-05-03 12:54:52 +0100392 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
393 * were used, but client and server requested the empty CID.
394 * This is indistinguishable from not using the CID extension
395 * in the first place. */
Hanno Becker2de89fa2019-04-26 17:08:02 +0100396 if( ssl->transform_in->in_cid_len == 0 &&
397 ssl->transform_in->out_cid_len == 0 )
398 {
399 return( 0 );
400 }
401
Hanno Becker633d6042019-05-22 16:50:35 +0100402 if( peer_cid_len != NULL )
403 {
404 *peer_cid_len = ssl->transform_in->out_cid_len;
405 if( peer_cid != NULL )
406 {
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300407 /* Not using more secure mbedtls_platform_memcpy as cid is public */
408 memcpy( peer_cid, ssl->transform_in->out_cid,
Hanno Becker633d6042019-05-22 16:50:35 +0100409 ssl->transform_in->out_cid_len );
410 }
411 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100412
413 *enabled = MBEDTLS_SSL_CID_ENABLED;
414
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100415 return( 0 );
416}
Hanno Beckera5a2b082019-05-15 14:03:01 +0100417#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100418
Hanno Beckerd5847772018-08-28 10:09:23 +0100419/* Forward declarations for functions related to message buffering. */
420static void ssl_buffering_free( mbedtls_ssl_context *ssl );
421static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
422 uint8_t slot );
423static void ssl_free_buffered_record( mbedtls_ssl_context *ssl );
424static int ssl_load_buffered_message( mbedtls_ssl_context *ssl );
425static int ssl_load_buffered_record( mbedtls_ssl_context *ssl );
426static int ssl_buffer_message( mbedtls_ssl_context *ssl );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +0100427static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
428 mbedtls_record const *rec );
Hanno Beckeref7afdf2018-08-28 17:16:31 +0100429static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl );
Hanno Beckerd5847772018-08-28 10:09:23 +0100430
Hanno Beckera67dee22018-08-22 10:05:20 +0100431static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl );
Hanno Becker11682cc2018-08-22 14:41:02 +0100432static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context const *ssl )
Hanno Becker2b1e3542018-08-06 11:19:13 +0100433{
Hanno Becker11682cc2018-08-22 14:41:02 +0100434 size_t mtu = ssl_get_current_mtu( ssl );
Andrzej Kurekf3844952020-10-16 23:03:01 +0200435#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
436 size_t out_buf_len = ssl->out_buf_len;
437#else
438 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
439#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +0100440
Andrzej Kurekf3844952020-10-16 23:03:01 +0200441 if( mtu != 0 && mtu < out_buf_len )
Hanno Becker11682cc2018-08-22 14:41:02 +0100442 return( mtu );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100443
Andrzej Kurekf3844952020-10-16 23:03:01 +0200444 return( out_buf_len );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100445}
446
Hanno Becker67bc7c32018-08-06 11:33:50 +0100447static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
448{
Hanno Becker11682cc2018-08-22 14:41:02 +0100449 size_t const bytes_written = ssl->out_left;
450 size_t const mtu = ssl_get_maximum_datagram_size( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100451
452 /* Double-check that the write-index hasn't gone
453 * past what we can transmit in a single datagram. */
Hanno Becker11682cc2018-08-22 14:41:02 +0100454 if( bytes_written > mtu )
Hanno Becker67bc7c32018-08-06 11:33:50 +0100455 {
456 /* Should never happen... */
457 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
458 }
459
460 return( (int) ( mtu - bytes_written ) );
461}
462
463static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl )
464{
465 int ret;
466 size_t remaining, expansion;
Andrzej Kurek748face2018-10-11 07:20:19 -0400467 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100468
469#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +0200470 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100471
472 if( max_len > mfl )
473 max_len = mfl;
Hanno Beckerf4b010e2018-08-24 10:47:29 +0100474
475 /* By the standard (RFC 6066 Sect. 4), the MFL extension
476 * only limits the maximum record payload size, so in theory
477 * we would be allowed to pack multiple records of payload size
478 * MFL into a single datagram. However, this would mean that there's
479 * no way to explicitly communicate MTU restrictions to the peer.
480 *
481 * The following reduction of max_len makes sure that we never
482 * write datagrams larger than MFL + Record Expansion Overhead.
483 */
484 if( max_len <= ssl->out_left )
485 return( 0 );
486
487 max_len -= ssl->out_left;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100488#endif
489
490 ret = ssl_get_remaining_space_in_datagram( ssl );
491 if( ret < 0 )
492 return( ret );
493 remaining = (size_t) ret;
494
495 ret = mbedtls_ssl_get_record_expansion( ssl );
496 if( ret < 0 )
497 return( ret );
498 expansion = (size_t) ret;
499
500 if( remaining <= expansion )
501 return( 0 );
502
503 remaining -= expansion;
504 if( remaining >= max_len )
505 remaining = max_len;
506
507 return( (int) remaining );
508}
509
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200510/*
511 * Double the retransmit timeout value, within the allowed range,
512 * returning -1 if the maximum value has already been reached.
513 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200514static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200515{
516 uint32_t new_timeout;
517
Hanno Becker1f835fa2019-06-13 10:14:59 +0100518 if( ssl->handshake->retransmit_timeout >=
519 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
520 {
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200521 return( -1 );
Hanno Becker1f835fa2019-06-13 10:14:59 +0100522 }
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200523
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200524 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
525 * in the following way: after the initial transmission and a first
526 * retransmission, back off to a temporary estimated MTU of 508 bytes.
527 * This value is guaranteed to be deliverable (if not guaranteed to be
528 * delivered) of any compliant IPv4 (and IPv6) network, and should work
529 * on most non-IP stacks too. */
Hanno Becker1f835fa2019-06-13 10:14:59 +0100530 if( ssl->handshake->retransmit_timeout !=
531 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) )
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400532 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200533 ssl->handshake->mtu = 508;
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400534 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl->handshake->mtu ) );
535 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200536
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200537 new_timeout = 2 * ssl->handshake->retransmit_timeout;
538
539 /* Avoid arithmetic overflow and range overflow */
540 if( new_timeout < ssl->handshake->retransmit_timeout ||
Hanno Becker1f835fa2019-06-13 10:14:59 +0100541 new_timeout > mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200542 {
Hanno Becker1f835fa2019-06-13 10:14:59 +0100543 new_timeout = mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200544 }
545
546 ssl->handshake->retransmit_timeout = new_timeout;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200547 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200548 ssl->handshake->retransmit_timeout ) );
549
550 return( 0 );
551}
552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200553static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200554{
Hanno Becker1f835fa2019-06-13 10:14:59 +0100555 ssl->handshake->retransmit_timeout = mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200556 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200557 ssl->handshake->retransmit_timeout ) );
558}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200559#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200560
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200561#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200562/*
563 * Convert max_fragment_length codes to length.
564 * RFC 6066 says:
565 * enum{
566 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
567 * } MaxFragmentLength;
568 * and we add 0 -> extension unused
569 */
Angus Grattond8213d02016-05-25 20:56:48 +1000570static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200571{
Angus Grattond8213d02016-05-25 20:56:48 +1000572 switch( mfl )
573 {
574 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300575 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000576 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
577 return 512;
578 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
579 return 1024;
580 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
581 return 2048;
582 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
583 return 4096;
584 default:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300585 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000586 }
587}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200588#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200589
Hanno Becker58fccf22019-02-06 14:30:46 +0000590int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
591 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200592{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200593 mbedtls_ssl_session_free( dst );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300594 mbedtls_platform_memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200595
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerd5258fa2019-02-07 12:27:42 +0000597
598#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200599 if( src->peer_cert != NULL )
600 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200601 int ret;
602
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200603 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200604 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200605 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200607 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200608
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200609 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200610 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200611 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200612 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200613 dst->peer_cert = NULL;
614 return( ret );
615 }
616 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100617#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000618 if( src->peer_cert_digest != NULL )
619 {
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000620 dst->peer_cert_digest =
Hanno Becker9d64b782019-02-25 10:06:59 +0000621 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000622 if( dst->peer_cert_digest == NULL )
623 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
624
Teppo Järvelin91d79382019-10-02 09:09:31 +0300625 mbedtls_platform_memcpy( dst->peer_cert_digest, src->peer_cert_digest,
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000626 src->peer_cert_digest_len );
627 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Becker9d64b782019-02-25 10:06:59 +0000628 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000629 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100630#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200632#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200633
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200634#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200635 if( src->ticket != NULL )
636 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200637 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200638 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200639 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200640
Teppo Järvelin91d79382019-10-02 09:09:31 +0300641 mbedtls_platform_memcpy( dst->ticket, src->ticket, src->ticket_len );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200642 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200643#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200644
645 return( 0 );
646}
647
Andrzej Kurekf3844952020-10-16 23:03:01 +0200648#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
649static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
650{
651 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
652 if( resized_buffer == NULL )
653 return -1;
654
655 /* We want to copy len_new bytes when downsizing the buffer, and
656 * len_old bytes when upsizing, so we choose the smaller of two sizes,
657 * to fit one buffer into another. Size checks, ensuring that no data is
658 * lost, are done outside of this function. */
659 memcpy( resized_buffer, *buffer,
660 ( len_new < *len_old ) ? len_new : *len_old );
661 mbedtls_platform_zeroize( *buffer, *len_old );
662 mbedtls_free( *buffer );
663
664 *buffer = resized_buffer;
665 *len_old = len_new;
666
667 return 0;
668}
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200669
Andrzej Kurekcd9a6ff2020-10-22 11:12:07 +0200670#define BUFFER_UPSIZING 0
671#define BUFFER_DOWNSIZING 1
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200672static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
673 uint32_t in_buf_new_len,
674 uint32_t out_buf_new_len )
675{
676 int modified = 0;
677 size_t written_in = 0, len_offset_in = 0;
678 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
679 if( ssl->in_buf != NULL )
680 {
681 written_in = ssl->in_msg - ssl->in_buf;
682 len_offset_in = ssl->in_len - ssl->in_buf;
683 if( ( downsizing && ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len ) ||
684 ( !downsizing && ssl->in_buf_len < in_buf_new_len ) )
685 {
686 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
687 {
Andrzej Kurek2e49d072020-10-22 11:16:25 +0200688 /* No need to return an error here; The buffer will remain as
689 * is with no negative impact on the flow. */
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200690 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
691 }
692 else
693 {
694 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %d", in_buf_new_len ) );
695 modified = 1;
696 }
697 }
698 }
699
700 if( ssl->out_buf != NULL )
701 {
702 written_out = ssl->out_msg - ssl->out_buf;
703 iv_offset_out = ssl->out_iv - ssl->out_buf;
704 len_offset_out = ssl->out_len - ssl->out_buf;
705 if( ( downsizing && ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len ) ||
706 ( !downsizing && ssl->out_buf_len < out_buf_new_len ) )
707 {
708 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
709 {
Andrzej Kurek2e49d072020-10-22 11:16:25 +0200710 /* No need to return an error here; The buffer will remain as
711 * is with no negative impact on the flow. */
Andrzej Kurek79db2f12020-10-20 17:10:38 +0200712 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
713 }
714 else
715 {
716 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %d", out_buf_new_len ) );
717 modified = 1;
718 }
719 }
720 }
721 if( modified )
722 {
723 /* Update pointers here to avoid doing it twice. */
724 ssl_reset_in_out_pointers( ssl );
725 /* Fields below might not be properly updated with record
726 * splitting or with CID, so they are manually updated here. */
727 ssl->out_msg = ssl->out_buf + written_out;
728 ssl->out_len = ssl->out_buf + len_offset_out;
729 ssl->out_iv = ssl->out_buf + iv_offset_out;
730
731 ssl->in_msg = ssl->in_buf + written_in;
732 ssl->in_len = ssl->in_buf + len_offset_in;
733 }
734}
Andrzej Kurekf3844952020-10-16 23:03:01 +0200735#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
736
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
738int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
Paul Bakker9af723c2014-05-01 13:03:14 +0200739 const unsigned char *key_enc, const unsigned char *key_dec,
740 size_t keylen,
741 const unsigned char *iv_enc, const unsigned char *iv_dec,
742 size_t ivlen,
743 const unsigned char *mac_enc, const unsigned char *mac_dec,
Paul Bakker66d5d072014-06-17 16:39:18 +0200744 size_t maclen ) = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200745int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
746int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
747int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
748int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
749int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
750#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000751
Paul Bakker5121ce52009-01-03 21:22:43 +0000752/*
753 * Key material generation
754 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200755#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +0100756MBEDTLS_NO_INLINE static int ssl3_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200757 const char *label,
758 const unsigned char *random, size_t rlen,
Paul Bakker5f70b252012-09-13 14:23:06 +0000759 unsigned char *dstbuf, size_t dlen )
760{
Andres Amaya Garcia33952502017-07-20 16:29:16 +0100761 int ret = 0;
Paul Bakker5f70b252012-09-13 14:23:06 +0000762 size_t i;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200763 mbedtls_md5_context md5;
764 mbedtls_sha1_context sha1;
Paul Bakker5f70b252012-09-13 14:23:06 +0000765 unsigned char padding[16];
766 unsigned char sha1sum[20];
Andrzej Kurekafec8852020-07-15 16:31:27 -0400767 ((void)label);
Paul Bakker5f70b252012-09-13 14:23:06 +0000768
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200769 mbedtls_md5_init( &md5 );
770 mbedtls_sha1_init( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +0200771
Paul Bakker5f70b252012-09-13 14:23:06 +0000772 /*
773 * SSLv3:
774 * block =
775 * MD5( secret + SHA1( 'A' + secret + random ) ) +
776 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
777 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
778 * ...
779 */
780 for( i = 0; i < dlen / 16; i++ )
781 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200782 mbedtls_platform_memset( padding, (unsigned char) ('A' + i), 1 + i );
Paul Bakker5f70b252012-09-13 14:23:06 +0000783
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100784 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100785 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100786 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100787 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100788 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100789 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100790 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100791 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100792 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100793 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000794
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100795 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100796 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100797 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100798 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100799 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100800 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100801 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100802 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000803 }
804
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100805exit:
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200806 mbedtls_md5_free( &md5 );
807 mbedtls_sha1_free( &sha1 );
Paul Bakker5f70b252012-09-13 14:23:06 +0000808
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500809 mbedtls_platform_zeroize( padding, sizeof( padding ) );
810 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5f70b252012-09-13 14:23:06 +0000811
Andrzej Kurekafec8852020-07-15 16:31:27 -0400812 return( ret );
Paul Bakker5f70b252012-09-13 14:23:06 +0000813}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200814#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +0000815
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200816#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +0100817MBEDTLS_NO_INLINE static int tls1_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200818 const char *label,
819 const unsigned char *random, size_t rlen,
Paul Bakker23986e52011-04-24 08:57:21 +0000820 unsigned char *dstbuf, size_t dlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000821{
Paul Bakker23986e52011-04-24 08:57:21 +0000822 size_t nb, hs;
823 size_t i, j, k;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200824 const unsigned char *S1, *S2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000825 unsigned char tmp[128];
826 unsigned char h_i[20];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100827 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200828 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100829 int ret;
830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200831 mbedtls_md_init( &md_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +0000832
833 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200834 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000835
836 hs = ( slen + 1 ) / 2;
837 S1 = secret;
838 S2 = secret + slen - hs;
839
840 nb = strlen( label );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300841 mbedtls_platform_memcpy( tmp + 20, label, nb );
842 mbedtls_platform_memcpy( tmp + 20 + nb, random, rlen );
Paul Bakker5121ce52009-01-03 21:22:43 +0000843 nb += rlen;
844
845 /*
846 * First compute P_md5(secret,label+random)[0..dlen]
847 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100848 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) ==
849 MBEDTLS_MD_INVALID_HANDLE )
850 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200851 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100852 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100853
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200854 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100855 return( ret );
856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200857 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
858 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
859 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000860
861 for( i = 0; i < dlen; i += 16 )
862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200863 mbedtls_md_hmac_reset ( &md_ctx );
864 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
865 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200867 mbedtls_md_hmac_reset ( &md_ctx );
868 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
869 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000870
871 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
872
873 for( j = 0; j < k; j++ )
874 dstbuf[i + j] = h_i[j];
875 }
876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200877 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100878
Paul Bakker5121ce52009-01-03 21:22:43 +0000879 /*
880 * XOR out with P_sha1(secret,label+random)[0..dlen]
881 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100882 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) ==
883 MBEDTLS_MD_INVALID_HANDLE )
884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200885 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100886 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100887
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200888 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100889 return( ret );
890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200891 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
892 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
893 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000894
895 for( i = 0; i < dlen; i += 20 )
896 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200897 mbedtls_md_hmac_reset ( &md_ctx );
898 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
899 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100900
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200901 mbedtls_md_hmac_reset ( &md_ctx );
902 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
903 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000904
905 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
906
907 for( j = 0; j < k; j++ )
908 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
909 }
910
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200911 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100912
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500913 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
914 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000915
Andrzej Kurekafec8852020-07-15 16:31:27 -0400916 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000917}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200918#endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000919
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200920#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerf6cc7422019-08-16 14:34:52 +0100921#if !( defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_SHA512_C) )
922MBEDTLS_ALWAYS_INLINE static inline
923#else
924static
925#endif
926int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100927 const unsigned char *secret, size_t slen,
928 const char *label,
929 const unsigned char *random, size_t rlen,
930 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000931{
932 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100933 size_t i, j, k, md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000934 unsigned char tmp[128];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200935 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100936 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200937 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100938 int ret;
939
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200940 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000941
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100942 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) ==
943 MBEDTLS_MD_INVALID_HANDLE )
944 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100946 }
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100947
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200948 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100949
950 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200951 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000952
953 nb = strlen( label );
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200954 (void)mbedtls_platform_memcpy( tmp + md_len, label, nb );
955 (void)mbedtls_platform_memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000956 nb += rlen;
957
958 /*
959 * Compute P_<hash>(secret, label + random)[0..dlen]
960 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200961 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100962 return( ret );
963
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200964 if ( ( ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen ) ) != 0 )
965 return( ret );
966 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb ) ) != 0 )
967 return( ret );
968 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
969 return( ret );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100970
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100971 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000972 {
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200973 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
974 return( ret );
975 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb ) ) != 0 )
976 return( ret );
977 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, h_i ) ) != 0 )
978 return( ret );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100979
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200980 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
981 return( ret );
982 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len ) ) != 0 )
983 return( ret );
984 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
985 return( ret );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000986
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100987 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000988
989 for( j = 0; j < k; j++ )
990 dstbuf[i + j] = h_i[j];
991 }
992
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200993 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100994
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200995 (void)mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
996 (void)mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000997
Andrzej Kurekafec8852020-07-15 16:31:27 -0400998 return( 0 );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000999}
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001000
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001001#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001002MBEDTLS_NO_INLINE static int tls_prf_sha256(
1003 const unsigned char *secret, size_t slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001004 const char *label,
1005 const unsigned char *random, size_t rlen,
1006 unsigned char *dstbuf, size_t dlen )
1007{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001008 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001009 label, random, rlen, dstbuf, dlen ) );
1010}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001011#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +00001012
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001013#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001014MBEDTLS_NO_INLINE static int tls_prf_sha384(
1015 const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02001016 const char *label,
1017 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001018 unsigned char *dstbuf, size_t dlen )
1019{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001020 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +01001021 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001022}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001023#endif /* MBEDTLS_SHA512_C */
1024#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +00001025
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001026/*
1027 * Call the appropriate PRF function
1028 */
Hanno Becker2793f742019-08-16 14:28:43 +01001029MBEDTLS_ALWAYS_INLINE static inline int ssl_prf( int minor_ver,
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001030 mbedtls_md_type_t hash,
1031 const unsigned char *secret, size_t slen,
1032 const char *label,
1033 const unsigned char *random, size_t rlen,
1034 unsigned char *dstbuf, size_t dlen )
1035{
1036#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1037 (void) hash;
1038#endif
1039
1040#if defined(MBEDTLS_SSL_PROTO_SSL3)
1041 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1042 return( ssl3_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
1043 else
1044#endif
1045#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001046 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001047 return( tls1_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
1048 else
1049#endif
1050#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1051#if defined(MBEDTLS_SHA512_C)
1052 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1053 hash == MBEDTLS_MD_SHA384 )
1054 {
1055 return( tls_prf_sha384( secret, slen, label, random, rlen,
1056 dstbuf, dlen ) );
1057 }
1058 else
1059#endif
1060#if defined(MBEDTLS_SHA256_C)
1061 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1062 {
1063 return( tls_prf_sha256( secret, slen, label, random, rlen,
1064 dstbuf, dlen ) );
1065 }
1066#endif
1067#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1068
1069 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1070}
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001071
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001072#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +01001073MBEDTLS_NO_INLINE static void ssl_calc_finished_ssl(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001074 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1075{
1076 const char *sender;
1077 mbedtls_md5_context md5;
1078 mbedtls_sha1_context sha1;
1079
1080 unsigned char padbuf[48];
1081 unsigned char md5sum[16];
1082 unsigned char sha1sum[20];
1083
1084 mbedtls_ssl_session *session = ssl->session_negotiate;
1085 if( !session )
1086 session = ssl->session;
1087
1088 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
1089
1090 mbedtls_md5_init( &md5 );
1091 mbedtls_sha1_init( &sha1 );
1092
1093 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1094 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1095
1096 /*
1097 * SSLv3:
1098 * hash =
1099 * MD5( master + pad2 +
1100 * MD5( handshake + sender + master + pad1 ) )
1101 * + SHA1( master + pad2 +
1102 * SHA1( handshake + sender + master + pad1 ) )
1103 */
1104
1105#if !defined(MBEDTLS_MD5_ALT)
1106 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1107 md5.state, sizeof( md5.state ) );
1108#endif
1109
1110#if !defined(MBEDTLS_SHA1_ALT)
1111 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1112 sha1.state, sizeof( sha1.state ) );
1113#endif
1114
1115 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
1116 : "SRVR";
1117
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001118 mbedtls_platform_memset( padbuf, 0x36, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001119
1120 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
1121 mbedtls_md5_update_ret( &md5, session->master, 48 );
1122 mbedtls_md5_update_ret( &md5, padbuf, 48 );
1123 mbedtls_md5_finish_ret( &md5, md5sum );
1124
1125 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
1126 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
1127 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
1128 mbedtls_sha1_finish_ret( &sha1, sha1sum );
1129
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001130 mbedtls_platform_memset( padbuf, 0x5C, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001131
1132 mbedtls_md5_starts_ret( &md5 );
1133 mbedtls_md5_update_ret( &md5, session->master, 48 );
1134 mbedtls_md5_update_ret( &md5, padbuf, 48 );
1135 mbedtls_md5_update_ret( &md5, md5sum, 16 );
1136 mbedtls_md5_finish_ret( &md5, buf );
1137
1138 mbedtls_sha1_starts_ret( &sha1 );
1139 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
1140 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
1141 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
1142 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
1143
1144 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
1145
1146 mbedtls_md5_free( &md5 );
1147 mbedtls_sha1_free( &sha1 );
1148
1149 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1150 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
1151 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
1152
1153 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1154}
1155#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1156
1157#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +01001158MBEDTLS_NO_INLINE static void ssl_calc_finished_tls(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001159 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1160{
1161 int len = 12;
1162 const char *sender;
1163 mbedtls_md5_context md5;
1164 mbedtls_sha1_context sha1;
1165 unsigned char padbuf[36];
1166
1167 mbedtls_ssl_session *session = ssl->session_negotiate;
1168 if( !session )
1169 session = ssl->session;
1170
1171 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
1172
1173 mbedtls_md5_init( &md5 );
1174 mbedtls_sha1_init( &sha1 );
1175
1176 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1177 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1178
1179 /*
1180 * TLSv1:
1181 * hash = PRF( master, finished_label,
1182 * MD5( handshake ) + SHA1( handshake ) )[0..11]
1183 */
1184
1185#if !defined(MBEDTLS_MD5_ALT)
1186 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1187 md5.state, sizeof( md5.state ) );
1188#endif
1189
1190#if !defined(MBEDTLS_SHA1_ALT)
1191 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1192 sha1.state, sizeof( sha1.state ) );
1193#endif
1194
1195 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1196 ? "client finished"
1197 : "server finished";
1198
1199 mbedtls_md5_finish_ret( &md5, padbuf );
1200 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
1201
1202 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1203 mbedtls_ssl_suite_get_mac(
1204 mbedtls_ssl_ciphersuite_from_id(
1205 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1206 session->master, 48, sender,
1207 padbuf, 36, buf, len );
1208
1209 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1210
1211 mbedtls_md5_free( &md5 );
1212 mbedtls_sha1_free( &sha1 );
1213
1214 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1215
1216 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1217}
1218#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1219
1220#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1221#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001222MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha256(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001223 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1224{
1225 int len = 12;
1226 const char *sender;
1227 mbedtls_sha256_context sha256;
1228 unsigned char padbuf[32];
1229
1230 mbedtls_ssl_session *session = ssl->session_negotiate;
1231 if( !session )
1232 session = ssl->session;
1233
1234 mbedtls_sha256_init( &sha256 );
1235
1236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
1237
1238 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1239
1240 /*
1241 * TLSv1.2:
1242 * hash = PRF( master, finished_label,
1243 * Hash( handshake ) )[0.11]
1244 */
1245
1246#if !defined(MBEDTLS_SHA256_ALT)
1247 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
1248 sha256.state, sizeof( sha256.state ) );
1249#endif
1250
1251 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1252 ? "client finished"
1253 : "server finished";
1254
1255 mbedtls_sha256_finish_ret( &sha256, padbuf );
1256
1257 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1258 mbedtls_ssl_suite_get_mac(
1259 mbedtls_ssl_ciphersuite_from_id(
1260 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1261 session->master, 48, sender,
1262 padbuf, 32, buf, len );
1263
1264 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1265
1266 mbedtls_sha256_free( &sha256 );
1267
1268 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1269
1270 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1271}
1272#endif /* MBEDTLS_SHA256_C */
1273
1274#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001275MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha384(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001276 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1277{
1278 int len = 12;
1279 const char *sender;
1280 mbedtls_sha512_context sha512;
1281 unsigned char padbuf[48];
1282
1283 mbedtls_ssl_session *session = ssl->session_negotiate;
1284 if( !session )
1285 session = ssl->session;
1286
1287 mbedtls_sha512_init( &sha512 );
1288
1289 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
1290
1291 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1292
1293 /*
1294 * TLSv1.2:
1295 * hash = PRF( master, finished_label,
1296 * Hash( handshake ) )[0.11]
1297 */
1298
1299#if !defined(MBEDTLS_SHA512_ALT)
1300 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
1301 sha512.state, sizeof( sha512.state ) );
1302#endif
1303
1304 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1305 ? "client finished"
1306 : "server finished";
1307
1308 mbedtls_sha512_finish_ret( &sha512, padbuf );
1309
1310 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1311 mbedtls_ssl_suite_get_mac(
1312 mbedtls_ssl_ciphersuite_from_id(
1313 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1314 session->master, 48, sender,
1315 padbuf, 48, buf, len );
1316
1317 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1318
1319 mbedtls_sha512_free( &sha512 );
1320
1321 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1322
1323 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1324}
1325#endif /* MBEDTLS_SHA512_C */
1326#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1327
Hanno Becker2793f742019-08-16 14:28:43 +01001328MBEDTLS_ALWAYS_INLINE static inline int ssl_calc_finished(
1329 int minor_ver,
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001330 mbedtls_md_type_t hash,
1331 mbedtls_ssl_context *ssl,
1332 unsigned char *buf,
1333 int from )
1334{
1335#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1336 (void) hash;
1337#endif
1338
1339#if defined(MBEDTLS_SSL_PROTO_SSL3)
1340 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1341 ssl_calc_finished_ssl( ssl, buf, from );
1342 else
1343#endif
1344#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001345 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001346 ssl_calc_finished_tls( ssl, buf, from );
1347 else
1348#endif
1349#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1350#if defined(MBEDTLS_SHA512_C)
1351 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1352 hash == MBEDTLS_MD_SHA384 )
1353 {
1354 ssl_calc_finished_tls_sha384( ssl, buf, from );
1355 }
1356 else
1357#endif
1358#if defined(MBEDTLS_SHA256_C)
1359 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1360 ssl_calc_finished_tls_sha256( ssl, buf, from );
1361 else
1362#endif
1363#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1364 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1365
1366 return( 0 );
1367}
1368
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001369/*
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001370 * Populate a transform structure with session keys and all the other
1371 * necessary information.
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001372 *
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001373 * Parameters:
1374 * - [in/out]: transform: structure to populate
1375 * [in] must be just initialised with mbedtls_ssl_transform_init()
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001376 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001377 * - [in] ciphersuite
1378 * - [in] master
1379 * - [in] encrypt_then_mac
1380 * - [in] trunc_hmac
1381 * - [in] compression
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001382 * - [in] tls_prf: pointer to PRF to use for key derivation
1383 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001384 * - [in] minor_ver: SSL/TLS minor version
1385 * - [in] endpoint: client or server
1386 * - [in] ssl: optionally used for:
1387 * - MBEDTLS_SSL_HW_RECORD_ACCEL: whole context
1388 * - MBEDTLS_SSL_EXPORT_KEYS: ssl->conf->{f,p}_export_keys
1389 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001390 */
Hanno Becker298a4702019-08-16 10:21:32 +01001391/* Force compilers to inline this function if it's used only
1392 * from one place, because at least ARMC5 doesn't do that
1393 * automatically. */
1394#if !defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
1395MBEDTLS_ALWAYS_INLINE static inline
1396#else
1397static
1398#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
1399int ssl_populate_transform( mbedtls_ssl_transform *transform,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001400 int ciphersuite,
1401 const unsigned char master[48],
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001402#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001403#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1404 int encrypt_then_mac,
1405#endif
1406#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1407 int trunc_hmac,
1408#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001409#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001410#if defined(MBEDTLS_ZLIB_SUPPORT)
1411 int compression,
1412#endif
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001413 const unsigned char randbytes[64],
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001414 int minor_ver,
1415 unsigned endpoint,
Manuel Pégourié-Gonnard13bebd02020-03-13 11:28:19 +01001416#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1417 const
1418#endif
1419 mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001420{
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001421 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001422 unsigned char keyblk[256];
1423 unsigned char *key1;
1424 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +01001425 unsigned char *mac_enc;
1426 unsigned char *mac_dec;
Hanno Becker81c7b182017-11-09 18:39:33 +00001427 size_t mac_key_len;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001428 size_t iv_copy_len;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001429 unsigned keylen;
Hanno Becker473f98f2019-06-26 10:27:32 +01001430 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001431 const mbedtls_cipher_info_t *cipher_info;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001432 mbedtls_md_handle_t md_info;
Paul Bakker68884e32013-01-07 18:20:04 +01001433
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001434#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \
1435 !defined(MBEDTLS_SSL_EXPORT_KEYS) && \
1436 !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02001437 ssl = NULL; /* make sure we don't use it except for those cases */
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001438 (void) ssl;
Hanno Becker3307b532017-12-27 21:37:21 +00001439#endif
Hanno Becker3307b532017-12-27 21:37:21 +00001440
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001441 /*
1442 * Some data just needs copying into the structure
1443 */
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001444#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
1445 defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001446 transform->encrypt_then_mac = encrypt_then_mac;
Paul Bakker5121ce52009-01-03 21:22:43 +00001447#endif
Hanno Becker0a92b812019-06-24 15:46:40 +01001448
1449#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001450 transform->minor_ver = minor_ver;
Hanno Becker0a92b812019-06-24 15:46:40 +01001451#else
1452 ((void) minor_ver);
1453#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Paul Bakker5121ce52009-01-03 21:22:43 +00001454
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001455#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Teppo Järvelin91d79382019-10-02 09:09:31 +03001456 mbedtls_platform_memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001457#endif
1458
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001459 /*
1460 * Get various info structures
1461 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001462 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
Hanno Becker473f98f2019-06-26 10:27:32 +01001463 if( ciphersuite_info == MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE )
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001464 {
1465 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001466 ciphersuite ) );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001467 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1468 }
1469
Hanno Becker473f98f2019-06-26 10:27:32 +01001470 cipher_info = mbedtls_cipher_info_from_type(
1471 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) );
Paul Bakker68884e32013-01-07 18:20:04 +01001472 if( cipher_info == NULL )
1473 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001474 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001475 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001476 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001477 }
1478
Hanno Becker473f98f2019-06-26 10:27:32 +01001479 md_info = mbedtls_md_info_from_type(
1480 mbedtls_ssl_suite_get_mac( ciphersuite_info ) );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001481 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Paul Bakker68884e32013-01-07 18:20:04 +01001482 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001484 mbedtls_ssl_suite_get_mac( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001485 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001486 }
1487
Hanno Beckera5a2b082019-05-15 14:03:01 +01001488#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001489 /* Copy own and peer's CID if the use of the CID
1490 * extension has been negotiated. */
1491 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
1492 {
1493 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
Hanno Beckerd91dc372019-04-30 13:52:29 +01001494
Hanno Becker4932f9f2019-05-03 15:23:51 +01001495 transform->in_cid_len = ssl->own_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001496 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1497 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
Hanno Becker8013b272019-05-03 12:55:51 +01001498 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001499 transform->in_cid_len );
Hanno Beckere582d122019-05-15 10:21:55 +01001500
1501 transform->out_cid_len = ssl->handshake->peer_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001502 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1503 memcpy( transform->out_cid, ssl->handshake->peer_cid,
Hanno Beckere582d122019-05-15 10:21:55 +01001504 ssl->handshake->peer_cid_len );
1505 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
1506 transform->out_cid_len );
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001507 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01001508#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001509
Paul Bakker5121ce52009-01-03 21:22:43 +00001510 /*
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001511 * Compute key block using the PRF
Paul Bakker1ef83d62012-04-11 12:09:53 +00001512 */
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001513 ret = ssl_prf( minor_ver,
1514 mbedtls_ssl_suite_get_mac( ciphersuite_info ),
1515 master, 48, "key expansion", randbytes, 64,
1516 keyblk, 256 );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001517 if( ret != 0 )
1518 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001519 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001520 return( ret );
1521 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001523 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02001524 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001525 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001526 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001527 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001528
Paul Bakker5121ce52009-01-03 21:22:43 +00001529 /*
1530 * Determine the appropriate key, IV and MAC length.
1531 */
Paul Bakker68884e32013-01-07 18:20:04 +01001532
Hanno Beckere7f2df02017-12-27 08:17:40 +00001533 keylen = cipher_info->key_bitlen / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001534
Hanno Beckerf1229442018-01-03 15:32:31 +00001535#if defined(MBEDTLS_GCM_C) || \
1536 defined(MBEDTLS_CCM_C) || \
1537 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001538 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001539 cipher_info->mode == MBEDTLS_MODE_CCM ||
1540 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +00001541 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001542 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +00001543 mac_key_len = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01001544 transform->taglen = mbedtls_ssl_suite_get_flags( ciphersuite_info ) &
1545 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001546
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001547 /* All modes haves 96-bit IVs;
1548 * GCM and CCM has 4 implicit and 8 explicit bytes
1549 * ChachaPoly has all 12 bytes implicit
1550 */
Paul Bakker68884e32013-01-07 18:20:04 +01001551 transform->ivlen = 12;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001552 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
1553 transform->fixed_ivlen = 12;
1554 else
1555 transform->fixed_ivlen = 4;
Paul Bakker68884e32013-01-07 18:20:04 +01001556 }
1557 else
Hanno Beckerf1229442018-01-03 15:32:31 +00001558#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
1559#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1560 if( cipher_info->mode == MBEDTLS_MODE_STREAM ||
1561 cipher_info->mode == MBEDTLS_MODE_CBC )
Paul Bakker68884e32013-01-07 18:20:04 +01001562 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001563 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001564 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
1565 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001566 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001567 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001568 return( ret );
Paul Bakker68884e32013-01-07 18:20:04 +01001569 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001570
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001571 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +00001572 mac_key_len = mbedtls_md_get_size( md_info );
1573 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001575#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001576 /*
1577 * If HMAC is to be truncated, we shall keep the leftmost bytes,
1578 * (rfc 6066 page 13 or rfc 2104 section 4),
1579 * so we only need to adjust the length here.
1580 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001581 if( trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Hanno Beckere89353a2017-11-20 16:36:41 +00001582 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001583 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
Hanno Beckere89353a2017-11-20 16:36:41 +00001584
1585#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
1586 /* Fall back to old, non-compliant version of the truncated
Hanno Becker563423f2017-11-21 17:20:17 +00001587 * HMAC implementation which also truncates the key
1588 * (Mbed TLS versions from 1.3 to 2.6.0) */
Hanno Beckere89353a2017-11-20 16:36:41 +00001589 mac_key_len = transform->maclen;
1590#endif
1591 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001592#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001593
1594 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +01001595 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001596 }
Hanno Beckerf1229442018-01-03 15:32:31 +00001597 else
1598#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1599 {
1600 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1601 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1602 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001603
Hanno Beckera9d5c452019-07-25 16:47:12 +01001604 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, ivlen: %u, maclen: %u",
Hanno Beckere7f2df02017-12-27 08:17:40 +00001605 (unsigned) keylen,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001606 (unsigned) transform->ivlen,
1607 (unsigned) transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001608
1609 /*
1610 * Finally setup the cipher contexts, IVs and MAC secrets.
1611 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001612#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001613 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00001614 {
Hanno Becker81c7b182017-11-09 18:39:33 +00001615 key1 = keyblk + mac_key_len * 2;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001616 key2 = keyblk + mac_key_len * 2 + keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +00001617
Paul Bakker68884e32013-01-07 18:20:04 +01001618 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +00001619 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001620
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001621 /*
1622 * This is not used in TLS v1.1.
1623 */
Paul Bakker48916f92012-09-16 19:57:18 +00001624 iv_copy_len = ( transform->fixed_ivlen ) ?
1625 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001626 mbedtls_platform_memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
1627 mbedtls_platform_memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001628 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001629 }
1630 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001631#endif /* MBEDTLS_SSL_CLI_C */
1632#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001633 if( endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00001634 {
Hanno Beckere7f2df02017-12-27 08:17:40 +00001635 key1 = keyblk + mac_key_len * 2 + keylen;
Hanno Becker81c7b182017-11-09 18:39:33 +00001636 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00001637
Hanno Becker81c7b182017-11-09 18:39:33 +00001638 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +01001639 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +00001640
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001641 /*
1642 * This is not used in TLS v1.1.
1643 */
Paul Bakker48916f92012-09-16 19:57:18 +00001644 iv_copy_len = ( transform->fixed_ivlen ) ?
1645 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001646 mbedtls_platform_memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
1647 mbedtls_platform_memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001648 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001649 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001650 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001651#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001652 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001653 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1654 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001655 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001656
Hanno Becker92231322018-01-03 15:32:51 +00001657#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001658#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001659 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001660 {
Hanno Becker92231322018-01-03 15:32:51 +00001661 if( mac_key_len > sizeof( transform->mac_enc ) )
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001662 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001663 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1664 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001665 }
1666
Teppo Järvelin91d79382019-10-02 09:09:31 +03001667 mbedtls_platform_memcpy( transform->mac_enc, mac_enc, mac_key_len );
1668 mbedtls_platform_memcpy( transform->mac_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +01001669 }
1670 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001671#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1672#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1673 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001674 if( mbedtls_ssl_ver_geq( minor_ver, MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakker68884e32013-01-07 18:20:04 +01001675 {
Gilles Peskine039fd122018-03-19 19:06:08 +01001676 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1677 For AEAD-based ciphersuites, there is nothing to do here. */
1678 if( mac_key_len != 0 )
1679 {
1680 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
1681 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
1682 }
Paul Bakker68884e32013-01-07 18:20:04 +01001683 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001684 else
1685#endif
Paul Bakker577e0062013-08-28 11:57:20 +02001686 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001687 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1688 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02001689 }
Hanno Becker92231322018-01-03 15:32:51 +00001690#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker68884e32013-01-07 18:20:04 +01001691
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001692#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1693 if( mbedtls_ssl_hw_record_init != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00001694 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00001696
Hanno Beckere7f2df02017-12-27 08:17:40 +00001697 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen,
Paul Bakker07eb38b2012-12-19 14:42:06 +01001698 transform->iv_enc, transform->iv_dec,
1699 iv_copy_len,
Paul Bakker68884e32013-01-07 18:20:04 +01001700 mac_enc, mac_dec,
Hanno Becker81c7b182017-11-09 18:39:33 +00001701 mac_key_len ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00001702 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001703 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1704 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00001705 }
1706 }
Hanno Becker92231322018-01-03 15:32:51 +00001707#else
1708 ((void) mac_dec);
1709 ((void) mac_enc);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001710#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00001711
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001712#if defined(MBEDTLS_SSL_EXPORT_KEYS)
1713 if( ssl->conf->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001714 {
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001715 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001716 master, keyblk,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001717 mac_key_len, keylen,
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001718 iv_copy_len );
1719 }
1720#endif
Andrzej Kurek11750442020-09-17 07:12:06 -04001721#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
1722 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx,
1723 cipher_info ) ) != 0 )
1724 {
1725 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1726 return( ret );
1727 }
1728 transform->key_enc = mbedtls_calloc( 1, cipher_info->key_bitlen >> 3 );
1729 transform->key_dec = mbedtls_calloc( 1, cipher_info->key_bitlen >> 3 );
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001730
Andrzej Kurek28b3b292020-10-22 11:40:41 +02001731 if( transform->key_enc == NULL || transform->key_dec == NULL )
1732 {
1733 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to allocate cipher keys" ) );
1734 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1735 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001736 memcpy( transform->key_enc, key1, cipher_info->key_bitlen >> 3 );
1737 memcpy( transform->key_dec, key2, cipher_info->key_bitlen >> 3 );
1738
1739 transform->key_bitlen = cipher_info->key_bitlen;
Andrzej Kureka7932372020-09-19 07:56:06 +02001740#if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
1741 transform->key_enc_hash = mbedtls_hash( transform->key_enc, transform->key_bitlen >> 3 );
1742 transform->key_dec_hash = mbedtls_hash( transform->key_dec, transform->key_bitlen >> 3 );
1743#endif
1744
Andrzej Kurek11750442020-09-17 07:12:06 -04001745#else
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001746 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001747 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001748 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001749 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001750 return( ret );
1751 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001752
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001753 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001754 cipher_info ) ) != 0 )
1755 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001756 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001757 return( ret );
1758 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001759
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001760 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001761 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001762 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001763 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001764 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001765 return( ret );
1766 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001767
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001768 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001769 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001770 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001771 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001772 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001773 return( ret );
1774 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001775#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001776#if defined(MBEDTLS_CIPHER_MODE_CBC)
1777 if( cipher_info->mode == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001778 {
Andrzej Kurek11750442020-09-17 07:12:06 -04001779#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
1780 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx,
1781 MBEDTLS_PADDING_NONE ) ) != 0 )
1782 {
1783 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1784 return( ret );
1785 }
1786#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001787 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1788 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001789 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001790 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001791 return( ret );
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001792 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001793
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001794 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1795 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001796 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001797 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001798 return( ret );
1799 }
Andrzej Kurek11750442020-09-17 07:12:06 -04001800#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001801 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001802#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001803
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001804 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001805
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02001806 /* Initialize Zlib contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001807#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001808 if( compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001809 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001810 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001811
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001812 mbedtls_platform_memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1813 mbedtls_platform_memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001814
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001815 if( deflateInit( &transform->ctx_deflate,
1816 Z_DEFAULT_COMPRESSION ) != Z_OK ||
Paul Bakker48916f92012-09-16 19:57:18 +00001817 inflateInit( &transform->ctx_inflate ) != Z_OK )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001818 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001819 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1820 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001821 }
1822 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001823#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00001824
Paul Bakker5121ce52009-01-03 21:22:43 +00001825 return( 0 );
1826}
1827
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001828#if defined(MBEDTLS_SSL_PROTO_SSL3)
1829static inline void ssl_calc_verify_ssl( const mbedtls_ssl_context *ssl,
1830 unsigned char hash[36],
1831 size_t *hlen )
1832{
1833 mbedtls_md5_context md5;
1834 mbedtls_sha1_context sha1;
1835 unsigned char pad_1[48];
1836 unsigned char pad_2[48];
1837
1838 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
1839
1840 mbedtls_md5_init( &md5 );
1841 mbedtls_sha1_init( &sha1 );
1842
1843 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1844 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1845
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001846 mbedtls_platform_memset( pad_1, 0x36, 48 );
1847 mbedtls_platform_memset( pad_2, 0x5C, 48 );
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001848
1849 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1850 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1851 mbedtls_md5_finish_ret( &md5, hash );
1852
1853 mbedtls_md5_starts_ret( &md5 );
1854 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1855 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1856 mbedtls_md5_update_ret( &md5, hash, 16 );
1857 mbedtls_md5_finish_ret( &md5, hash );
1858
1859 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1860 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1861 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1862
1863 mbedtls_sha1_starts_ret( &sha1 );
1864 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1865 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1866 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1867 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1868
1869 *hlen = 36;
1870
1871 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1872 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1873
1874 mbedtls_md5_free( &md5 );
1875 mbedtls_sha1_free( &sha1 );
1876
1877 return;
1878}
1879#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1880
1881#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1882static inline void ssl_calc_verify_tls( const mbedtls_ssl_context *ssl,
1883 unsigned char hash[36],
1884 size_t *hlen )
1885{
1886 mbedtls_md5_context md5;
1887 mbedtls_sha1_context sha1;
1888
1889 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
1890
1891 mbedtls_md5_init( &md5 );
1892 mbedtls_sha1_init( &sha1 );
1893
1894 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1895 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1896
1897 mbedtls_md5_finish_ret( &md5, hash );
1898 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1899
1900 *hlen = 36;
1901
1902 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1903 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1904
1905 mbedtls_md5_free( &md5 );
1906 mbedtls_sha1_free( &sha1 );
1907
1908 return;
1909}
1910#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1911
1912#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1913#if defined(MBEDTLS_SHA256_C)
1914static inline void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1915 unsigned char hash[32],
1916 size_t *hlen )
1917{
1918 mbedtls_sha256_context sha256;
1919
1920 mbedtls_sha256_init( &sha256 );
1921
1922 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1923
1924 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1925 mbedtls_sha256_finish_ret( &sha256, hash );
1926
1927 *hlen = 32;
1928
1929 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1930 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1931
1932 mbedtls_sha256_free( &sha256 );
1933
1934 return;
1935}
1936#endif /* MBEDTLS_SHA256_C */
1937
1938#if defined(MBEDTLS_SHA512_C)
1939static inline void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1940 unsigned char hash[48],
1941 size_t *hlen )
1942{
1943 mbedtls_sha512_context sha512;
1944
1945 mbedtls_sha512_init( &sha512 );
1946
1947 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1948
1949 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1950 mbedtls_sha512_finish_ret( &sha512, hash );
1951
1952 *hlen = 48;
1953
1954 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1955 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1956
1957 mbedtls_sha512_free( &sha512 );
1958
1959 return;
1960}
1961#endif /* MBEDTLS_SHA512_C */
1962#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1963
Hanno Becker2f41b242019-08-15 17:29:43 +01001964int mbedtls_ssl_calc_verify( int minor_ver,
1965 mbedtls_md_type_t hash,
1966 mbedtls_ssl_context const *ssl,
1967 unsigned char *dst,
1968 size_t *hlen )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001969{
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001970#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1971 (void) hash;
1972#endif
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001973
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001974#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001975 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker2f41b242019-08-15 17:29:43 +01001976 ssl_calc_verify_ssl( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001977 else
1978#endif
1979#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001980 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker2f41b242019-08-15 17:29:43 +01001981 ssl_calc_verify_tls( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001982 else
1983#endif
1984#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1985#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001986 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1987 hash == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001988 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001989 ssl_calc_verify_tls_sha384( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001990 }
1991 else
1992#endif
1993#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001994 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001995 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001996 ssl_calc_verify_tls_sha256( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001997 }
1998 else
1999#endif
2000#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2001 {
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002002 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2003 }
2004
2005 return( 0 );
2006}
2007
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002008/*
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002009 * Compute master secret if needed
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002010 *
2011 * Parameters:
2012 * [in/out] handshake
2013 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
2014 * [out] premaster (cleared)
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002015 * [out] master
2016 * [in] ssl: optionally used for debugging and calc_verify
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002017 */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002018static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002019 unsigned char *master,
Manuel Pégourié-Gonnarded3b7a92019-05-03 09:58:33 +02002020 const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002021{
2022 int ret;
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002023
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002024/* #if !defined(MBEDTLS_DEBUG_C) && !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) */
2025/* ssl = NULL; /\* make sure we don't use it except for debug and EMS *\/ */
2026/* (void) ssl; */
2027/* #endif */
2028
2029 mbedtls_ssl_ciphersuite_handle_t const ciphersuite =
2030 mbedtls_ssl_handshake_get_ciphersuite( handshake );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002031
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002032#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02002033 if( handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002034 {
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002035 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
2036 return( 0 );
2037 }
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002038#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002039
2040 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
2041 handshake->pmslen );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002042
2043#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckera49ec562019-06-11 14:47:55 +01002044 if( mbedtls_ssl_hs_get_extended_ms( handshake )
2045 == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002046 {
2047 unsigned char session_hash[48];
2048 size_t hash_len;
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002049
Hanno Becker2f41b242019-08-15 17:29:43 +01002050 mbedtls_ssl_calc_verify(
2051 mbedtls_ssl_get_minor_ver( ssl ),
2052 mbedtls_ssl_suite_get_mac( ciphersuite ),
2053 ssl, session_hash, &hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002054
Manuel Pégourié-Gonnard9c5bcc92019-05-20 12:09:50 +02002055 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
2056 session_hash, hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002057
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002058 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
2059 mbedtls_ssl_suite_get_mac( ciphersuite ),
2060 handshake->premaster, handshake->pmslen,
2061 "extended master secret",
2062 session_hash, hash_len,
2063 master, 48 );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002064 }
2065 else
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002066#endif
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02002067 {
Hanno Becker39c7f7e2019-08-15 16:17:34 +01002068 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
2069 mbedtls_ssl_suite_get_mac( ciphersuite ),
2070 handshake->premaster, handshake->pmslen,
2071 "master secret",
2072 handshake->randbytes, 64,
2073 master, 48 );
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02002074 }
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02002075 if( ret != 0 )
2076 {
2077 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
2078 return( ret );
2079 }
2080
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02002081 if( handshake->premaster == mbedtls_platform_zeroize(
Piotr Nowickia6348ed2020-06-29 15:03:56 +02002082 handshake->premaster, sizeof(handshake->premaster) ) )
2083 {
2084 return( 0 );
2085 }
2086
2087 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002088}
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002089
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02002090int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
2091{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04002092 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02002093
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002094 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
Jarno Lamsa4031a452019-12-19 08:11:12 +02002095 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_UNSET;
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002096 /* Compute master secret if needed */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002097 ret = ssl_compute_master( ssl->handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02002098 ssl->session_negotiate->master,
2099 ssl );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02002100 if( ret != 0 )
2101 {
2102 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
2103 return( ret );
2104 }
2105
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002106 /* Swap the client and server random values:
2107 * - MS derivation wanted client+server (RFC 5246 8.1)
2108 * - key derivation wants server+client (RFC 5246 6.3) */
2109 {
2110 unsigned char tmp[64];
Teppo Järvelin91d79382019-10-02 09:09:31 +03002111 mbedtls_platform_memcpy( tmp, ssl->handshake->randbytes, 64 );
2112 mbedtls_platform_memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
2113 mbedtls_platform_memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002114 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
2115 }
2116
2117 /* Populate transform structure */
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02002118 ret = ssl_populate_transform( ssl->transform_negotiate,
Hanno Beckere02758c2019-06-26 15:31:31 +01002119 mbedtls_ssl_session_get_ciphersuite( ssl->session_negotiate ),
2120 ssl->session_negotiate->master,
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01002121#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002122#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01002123 ssl->session_negotiate->encrypt_then_mac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002124#endif
2125#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01002126 ssl->session_negotiate->trunc_hmac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002127#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01002128#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002129#if defined(MBEDTLS_ZLIB_SUPPORT)
Hanno Beckere02758c2019-06-26 15:31:31 +01002130 ssl->session_negotiate->compression,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02002131#endif
Hanno Beckere02758c2019-06-26 15:31:31 +01002132 ssl->handshake->randbytes,
Hanno Becker2881d802019-05-22 14:44:53 +01002133 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Beckere02758c2019-06-26 15:31:31 +01002134 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
2135 ssl );
Jarno Lamsa4031a452019-12-19 08:11:12 +02002136 if( ret == 0 )
2137 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002138 mbedtls_platform_random_delay();
Jarno Lamsa4031a452019-12-19 08:11:12 +02002139 if( ret == 0 )
2140 {
2141 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_SET;
2142 }
2143 else
2144 {
2145 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2146 }
2147 }
2148 else
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02002149 {
2150 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
2151 return( ret );
2152 }
2153
2154 /* We no longer need Server/ClientHello.random values */
2155 mbedtls_platform_zeroize( ssl->handshake->randbytes,
2156 sizeof( ssl->handshake->randbytes ) );
2157
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002158 /* Allocate compression buffer */
2159#if defined(MBEDTLS_ZLIB_SUPPORT)
jiblime92af9a92019-12-18 21:40:01 -08002160 if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002161 ssl->compress_buf == NULL )
2162 {
2163 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
2164 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
2165 if( ssl->compress_buf == NULL )
2166 {
2167 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02002168 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02002169 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2170 }
2171 }
2172#endif
2173
Paul Bakker5121ce52009-01-03 21:22:43 +00002174 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
2175
2176 return( 0 );
2177}
2178
Hanno Becker09d23642019-07-22 17:18:18 +01002179int mbedtls_ssl_build_pms( mbedtls_ssl_context *ssl )
2180{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04002181 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker09d23642019-07-22 17:18:18 +01002182
2183 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
2184 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Beckera3c2c172019-07-23 16:51:57 +01002185#if defined(MBEDTLS_USE_TINYCRYPT)
2186 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01002187 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
Hanno Beckera3c2c172019-07-23 16:51:57 +01002188 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01002189 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2190 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2191 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2192 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2193 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002194 {
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002195 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2196 ssl->handshake->ecdh_privkey,
2197 ssl->handshake->premaster );
2198 if( ret == UECC_FAULT_DETECTED )
2199 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2200 if( ret != UECC_SUCCESS )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002201 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002202 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Hanno Beckera3c2c172019-07-23 16:51:57 +01002203
2204 ssl->handshake->pmslen = NUM_ECC_BYTES;
2205 }
2206 else
2207#endif
Hanno Becker09d23642019-07-22 17:18:18 +01002208#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
2209 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2210 == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
2211 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002212 ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002213 ssl->handshake->premaster,
2214 MBEDTLS_PREMASTER_SIZE,
2215 &ssl->handshake->pmslen,
2216 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002217 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2218 if( ret == 0 )
2219 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002220 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002221 if( ret == 0 )
2222 {
2223 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2224 }
2225 else
2226 {
Piotr Nowickie048b912020-06-05 17:59:28 +02002227 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret",
2228 MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2229 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002230 }
2231 }
2232 else
Hanno Becker09d23642019-07-22 17:18:18 +01002233 {
2234 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
2235 return( ret );
2236 }
2237
2238 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
2239 }
2240 else
2241#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
Hanno Becker29d16552019-07-24 11:11:45 +01002242#if defined(MBEDTLS_ECDH_C) && \
2243 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2244 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2245 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2246 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) )
Hanno Becker09d23642019-07-22 17:18:18 +01002247 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2248 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2249 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2250 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2251 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2252 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2253 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2254 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2255 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002256 ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002257 &ssl->handshake->pmslen,
2258 ssl->handshake->premaster,
2259 MBEDTLS_MPI_MAX_SIZE,
2260 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002261 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2262 if( ret == 0 )
2263 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002264 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002265 if( ret == 0 )
2266 {
2267 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2268 }
2269 else
2270 {
2271 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002272 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002273 }
2274 }
2275 else
Hanno Becker09d23642019-07-22 17:18:18 +01002276 {
2277 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
2278 return( ret );
2279 }
2280
2281 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
2282 }
2283 else
2284#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2285 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2286 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2287 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2288#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2289 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
2290 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002291 ret = mbedtls_ssl_psk_derive_premaster( ssl,
2292 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) );
2293 if( ret == 0 )
2294 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002295 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002296 if( ret == 0 )
2297 {
2298 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2299 }
2300 else
2301 {
2302 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002303 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002304 }
2305 }
2306 else
Hanno Becker09d23642019-07-22 17:18:18 +01002307 {
2308 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
2309 return( ret );
2310 }
2311 }
2312 else
2313#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2314#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2315 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
2316 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2317 {
2318 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
2319 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
2320 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002321 mbedtls_ssl_conf_get_prng( ssl->conf ) );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002322 if( ret == 0 )
2323 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002324 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002325 if( ret == 0 )
2326 {
2327 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2328 }
2329 else
2330 {
2331 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002332 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002333 }
2334 }
2335 else
Hanno Becker09d23642019-07-22 17:18:18 +01002336 {
2337 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
2338 return( ret );
2339 }
2340 }
2341 else
2342#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2343#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
2344 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2345 == MBEDTLS_KEY_EXCHANGE_RSA )
2346 {
2347 ((void) ret);
Manuel Pégourié-Gonnard8793fab2019-08-01 10:44:07 +02002348 /* The premaster secret has already been set by
Hanno Becker09d23642019-07-22 17:18:18 +01002349 * ssl_rsa_generate_partial_pms(). Only the
2350 * PMS length needs to be set. */
2351 ssl->handshake->pmslen = 48;
2352 }
2353 else
2354#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2355 {
2356 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2357 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2358 }
2359
2360 return( 0 );
2361}
2362
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002363#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2364int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002365{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002366 unsigned char *p = ssl->handshake->premaster;
2367 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002368 const unsigned char *psk = ssl->conf->psk;
2369 size_t psk_len = ssl->conf->psk_len;
2370
2371 /* If the psk callback was called, use its result */
2372 if( ssl->handshake->psk != NULL )
2373 {
2374 psk = ssl->handshake->psk;
2375 psk_len = ssl->handshake->psk_len;
2376 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002377
2378 /*
2379 * PMS = struct {
2380 * opaque other_secret<0..2^16-1>;
2381 * opaque psk<0..2^16-1>;
2382 * };
2383 * with "other_secret" depending on the particular key exchange
2384 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002385#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
2386 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002387 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002388 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002389 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002390
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002391 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002392
2393 if( end < p || (size_t)( end - p ) < psk_len )
2394 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2395
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002396 mbedtls_platform_memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002397 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002398 }
2399 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002400#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
2401#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2402 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002403 {
2404 /*
2405 * other_secret already set by the ClientKeyExchange message,
2406 * and is 48 bytes long
2407 */
Philippe Antoine747fd532018-05-30 09:13:21 +02002408 if( end - p < 2 )
2409 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2410
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002411 *p++ = 0;
2412 *p++ = 48;
2413 p += 48;
2414 }
2415 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002416#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2417#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2418 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002419 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002420 int ret;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002421 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002422
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02002423 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002424 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002425 p + 2, end - ( p + 2 ), &len,
Hanno Beckerece325c2019-06-13 15:39:27 +01002426 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002427 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002428 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002429 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002430 return( ret );
2431 }
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002432 p = mbedtls_platform_put_uint16_be( p, len );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002433 p += len;
2434
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002435 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002436 }
2437 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002438#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2439#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2440 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002441 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002442 int ret;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002443 size_t zlen;
2444
Hanno Becker982da7e2019-09-02 09:47:39 +01002445#if defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002446 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2447 ssl->handshake->ecdh_privkey,
2448 p + 2 );
2449 if( ret == UECC_FAULT_DETECTED )
2450 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2451 if( ret != UECC_SUCCESS )
Hanno Becker982da7e2019-09-02 09:47:39 +01002452 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Hanno Becker982da7e2019-09-02 09:47:39 +01002453
2454 zlen = NUM_ECC_BYTES;
2455#else /* MBEDTLS_USE_TINYCRYPT */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002456 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02002457 p + 2, end - ( p + 2 ),
Hanno Beckerece325c2019-06-13 15:39:27 +01002458 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002459 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002460 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002461 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002462 return( ret );
2463 }
2464
Hanno Becker982da7e2019-09-02 09:47:39 +01002465 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2466 MBEDTLS_DEBUG_ECDH_Z );
2467#endif /* MBEDTLS_USE_TINYCRYPT */
2468
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002469 p = mbedtls_platform_put_uint16_be( p, zlen );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002470 p += zlen;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002471 }
2472 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002473#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002474 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002475 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2476 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002477 }
2478
2479 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002480 if( end - p < 2 )
2481 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01002482
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002483 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002484
2485 if( end < p || (size_t)( end - p ) < psk_len )
2486 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2487
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02002488 if( mbedtls_platform_memcpy( p, psk, psk_len ) != p )
2489 {
2490 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2491 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002492 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002493
2494 ssl->handshake->pmslen = p - ssl->handshake->premaster;
2495
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002496 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2497
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002498 return( 0 );
2499}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002500#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002501
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002502#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00002503/*
2504 * SSLv3.0 MAC functions
2505 */
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002506#define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002507static void ssl_mac( mbedtls_md_context_t *md_ctx,
2508 const unsigned char *secret,
2509 const unsigned char *buf, size_t len,
2510 const unsigned char *ctr, int type,
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002511 unsigned char out[SSL_MAC_MAX_BYTES] )
Paul Bakker5121ce52009-01-03 21:22:43 +00002512{
2513 unsigned char header[11];
2514 unsigned char padding[48];
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002515 int padlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002516 int md_size = mbedtls_md_get_size( md_ctx->md_info );
2517 int md_type = mbedtls_md_get_type( md_ctx->md_info );
Paul Bakker68884e32013-01-07 18:20:04 +01002518
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002519 /* Only MD5 and SHA-1 supported */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002520 if( md_type == MBEDTLS_MD_MD5 )
Paul Bakker68884e32013-01-07 18:20:04 +01002521 padlen = 48;
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002522 else
Paul Bakker68884e32013-01-07 18:20:04 +01002523 padlen = 40;
Paul Bakker5121ce52009-01-03 21:22:43 +00002524
Teppo Järvelin91d79382019-10-02 09:09:31 +03002525 mbedtls_platform_memcpy( header, ctr, 8 );
Arto Kinnunen6e3f09b2019-09-06 17:37:01 +03002526 header[8] = (unsigned char) type;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002527 (void)mbedtls_platform_put_uint16_be( &header[9], len );
Paul Bakker5121ce52009-01-03 21:22:43 +00002528
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002529 mbedtls_platform_memset( padding, 0x36, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002530 mbedtls_md_starts( md_ctx );
2531 mbedtls_md_update( md_ctx, secret, md_size );
2532 mbedtls_md_update( md_ctx, padding, padlen );
2533 mbedtls_md_update( md_ctx, header, 11 );
2534 mbedtls_md_update( md_ctx, buf, len );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002535 mbedtls_md_finish( md_ctx, out );
Paul Bakker5121ce52009-01-03 21:22:43 +00002536
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002537 mbedtls_platform_memset( padding, 0x5C, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002538 mbedtls_md_starts( md_ctx );
2539 mbedtls_md_update( md_ctx, secret, md_size );
2540 mbedtls_md_update( md_ctx, padding, padlen );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002541 mbedtls_md_update( md_ctx, out, md_size );
2542 mbedtls_md_finish( md_ctx, out );
Paul Bakker5f70b252012-09-13 14:23:06 +00002543}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002544#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +00002545
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002546/* The function below is only used in the Lucky 13 counter-measure in
Hanno Becker30d02cd2018-10-18 15:43:13 +01002547 * mbedtls_ssl_decrypt_buf(). These are the defines that guard the call site. */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002548#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) && \
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002549 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
2550 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2551 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
2552/* This function makes sure every byte in the memory region is accessed
2553 * (in ascending addresses order) */
2554static void ssl_read_memory( unsigned char *p, size_t len )
2555{
2556 unsigned char acc = 0;
2557 volatile unsigned char force;
2558
2559 for( ; len != 0; p++, len-- )
2560 acc ^= *p;
2561
2562 force = acc;
2563 (void) force;
2564}
2565#endif /* SSL_SOME_MODES_USE_MAC && ( TLS1 || TLS1_1 || TLS1_2 ) */
2566
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002567/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002568 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +02002569 */
Hanno Becker3307b532017-12-27 21:37:21 +00002570
Hanno Beckera5a2b082019-05-15 14:03:01 +01002571#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker89693692019-05-20 15:06:12 +01002572/* This functions transforms a DTLS plaintext fragment and a record content
2573 * type into an instance of the DTLSInnerPlaintext structure:
Hanno Becker92c930f2019-04-29 17:31:37 +01002574 *
2575 * struct {
2576 * opaque content[DTLSPlaintext.length];
2577 * ContentType real_type;
2578 * uint8 zeros[length_of_padding];
2579 * } DTLSInnerPlaintext;
2580 *
2581 * Input:
2582 * - `content`: The beginning of the buffer holding the
2583 * plaintext to be wrapped.
2584 * - `*content_size`: The length of the plaintext in Bytes.
2585 * - `max_len`: The number of Bytes available starting from
2586 * `content`. This must be `>= *content_size`.
2587 * - `rec_type`: The desired record content type.
2588 *
2589 * Output:
2590 * - `content`: The beginning of the resulting DTLSInnerPlaintext structure.
2591 * - `*content_size`: The length of the resulting DTLSInnerPlaintext structure.
2592 *
2593 * Returns:
2594 * - `0` on success.
2595 * - A negative error code if `max_len` didn't offer enough space
2596 * for the expansion.
2597 */
2598static int ssl_cid_build_inner_plaintext( unsigned char *content,
2599 size_t *content_size,
2600 size_t remaining,
2601 uint8_t rec_type )
2602{
2603 size_t len = *content_size;
Hanno Becker78426092019-05-13 15:31:17 +01002604 size_t pad = ( MBEDTLS_SSL_CID_PADDING_GRANULARITY -
2605 ( len + 1 ) % MBEDTLS_SSL_CID_PADDING_GRANULARITY ) %
2606 MBEDTLS_SSL_CID_PADDING_GRANULARITY;
Hanno Becker92c930f2019-04-29 17:31:37 +01002607
2608 /* Write real content type */
2609 if( remaining == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002610 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Hanno Becker92c930f2019-04-29 17:31:37 +01002611 content[ len ] = rec_type;
2612 len++;
2613 remaining--;
2614
2615 if( remaining < pad )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002616 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002617 mbedtls_platform_memset( content + len, 0, pad );
Hanno Becker92c930f2019-04-29 17:31:37 +01002618 len += pad;
2619 remaining -= pad;
2620
2621 *content_size = len;
Andrzej Kurekafec8852020-07-15 16:31:27 -04002622 return( 0 );
Hanno Becker92c930f2019-04-29 17:31:37 +01002623}
2624
Hanno Becker7dc25772019-05-20 15:08:01 +01002625/* This function parses a DTLSInnerPlaintext structure.
2626 * See ssl_cid_build_inner_plaintext() for details. */
Hanno Becker92c930f2019-04-29 17:31:37 +01002627static int ssl_cid_parse_inner_plaintext( unsigned char const *content,
2628 size_t *content_size,
2629 uint8_t *rec_type )
2630{
2631 size_t remaining = *content_size;
2632
2633 /* Determine length of padding by skipping zeroes from the back. */
2634 do
2635 {
2636 if( remaining == 0 )
2637 return( -1 );
2638 remaining--;
2639 } while( content[ remaining ] == 0 );
2640
2641 *content_size = remaining;
2642 *rec_type = content[ remaining ];
2643
2644 return( 0 );
2645}
Hanno Beckera5a2b082019-05-15 14:03:01 +01002646#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01002647
Hanno Becker99abf512019-05-20 14:50:53 +01002648/* `add_data` must have size 13 Bytes if the CID extension is disabled,
Hanno Beckeracadb0a2019-05-08 18:15:21 +01002649 * and 13 + 1 + CID-length Bytes if the CID extension is enabled. */
Hanno Becker3307b532017-12-27 21:37:21 +00002650static void ssl_extract_add_data_from_record( unsigned char* add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002651 size_t *add_data_len,
Hanno Becker3307b532017-12-27 21:37:21 +00002652 mbedtls_record *rec )
2653{
Hanno Becker99abf512019-05-20 14:50:53 +01002654 /* Quoting RFC 5246 (TLS 1.2):
Hanno Beckere83efe62019-04-29 13:52:53 +01002655 *
2656 * additional_data = seq_num + TLSCompressed.type +
2657 * TLSCompressed.version + TLSCompressed.length;
2658 *
Hanno Becker99abf512019-05-20 14:50:53 +01002659 * For the CID extension, this is extended as follows
2660 * (quoting draft-ietf-tls-dtls-connection-id-05,
2661 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05):
Hanno Beckere83efe62019-04-29 13:52:53 +01002662 *
2663 * additional_data = seq_num + DTLSPlaintext.type +
2664 * DTLSPlaintext.version +
Hanno Becker99abf512019-05-20 14:50:53 +01002665 * cid +
2666 * cid_length +
Hanno Beckere83efe62019-04-29 13:52:53 +01002667 * length_of_DTLSInnerPlaintext;
2668 */
2669
Teppo Järvelin91d79382019-10-02 09:09:31 +03002670 mbedtls_platform_memcpy( add_data, rec->ctr, sizeof( rec->ctr ) );
Hanno Becker3307b532017-12-27 21:37:21 +00002671 add_data[8] = rec->type;
Teppo Järvelin91d79382019-10-02 09:09:31 +03002672 mbedtls_platform_memcpy( add_data + 9, rec->ver, sizeof( rec->ver ) );
Hanno Beckere83efe62019-04-29 13:52:53 +01002673
Hanno Beckera5a2b082019-05-15 14:03:01 +01002674#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker1f02f052019-05-09 11:38:24 +01002675 if( rec->cid_len != 0 )
2676 {
Teppo Järvelin91d79382019-10-02 09:09:31 +03002677 mbedtls_platform_memcpy( add_data + 11, rec->cid, rec->cid_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002678 add_data[11 + rec->cid_len + 0] = rec->cid_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002679 (void)mbedtls_platform_put_uint16_be( &add_data[11 + rec->cid_len + 1],
2680 rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002681 *add_data_len = 13 + 1 + rec->cid_len;
2682 }
2683 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01002684#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker1f02f052019-05-09 11:38:24 +01002685 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002686 (void)mbedtls_platform_put_uint16_be( &add_data[11], rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002687 *add_data_len = 13;
2688 }
Hanno Becker3307b532017-12-27 21:37:21 +00002689}
2690
Hanno Becker611a83b2018-01-03 14:27:32 +00002691int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl,
2692 mbedtls_ssl_transform *transform,
2693 mbedtls_record *rec,
2694 int (*f_rng)(void *, unsigned char *, size_t),
2695 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +00002696{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002697 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002698 int auth_done = 0;
Hanno Becker3307b532017-12-27 21:37:21 +00002699 unsigned char * data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01002700 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_OUT_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01002701 size_t add_data_len;
Hanno Becker3307b532017-12-27 21:37:21 +00002702 size_t post_avail;
Andrzej Kurekff517212020-08-10 07:10:35 -04002703 int encryption_status = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker3307b532017-12-27 21:37:21 +00002704
2705 /* The SSL context is only used for debugging purposes! */
Hanno Becker611a83b2018-01-03 14:27:32 +00002706#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02002707 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker3307b532017-12-27 21:37:21 +00002708 ((void) ssl);
2709#endif
2710
2711 /* The PRNG is used for dynamic IV generation that's used
2712 * for CBC transformations in TLS 1.1 and TLS 1.2. */
2713#if !( defined(MBEDTLS_CIPHER_MODE_CBC) && \
2714 ( defined(MBEDTLS_AES_C) || \
2715 defined(MBEDTLS_ARIA_C) || \
2716 defined(MBEDTLS_CAMELLIA_C) ) && \
2717 ( defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) ) )
2718 ((void) f_rng);
2719 ((void) p_rng);
2720#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002721
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002722 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002723
Hanno Becker3307b532017-12-27 21:37:21 +00002724 if( transform == NULL )
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002725 {
Hanno Becker3307b532017-12-27 21:37:21 +00002726 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to encrypt_buf" ) );
2727 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2728 }
Hanno Becker505089d2019-05-01 09:45:57 +01002729 if( rec == NULL
2730 || rec->buf == NULL
2731 || rec->buf_len < rec->data_offset
2732 || rec->buf_len - rec->data_offset < rec->data_len
Hanno Beckera5a2b082019-05-15 14:03:01 +01002733#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01002734 || rec->cid_len != 0
2735#endif
2736 )
Hanno Becker3307b532017-12-27 21:37:21 +00002737 {
2738 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to encrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002739 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002740 }
2741
Hanno Becker3307b532017-12-27 21:37:21 +00002742 data = rec->buf + rec->data_offset;
Hanno Becker92c930f2019-04-29 17:31:37 +01002743 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002744 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Hanno Becker3307b532017-12-27 21:37:21 +00002745 data, rec->data_len );
Andrzej Kurek11750442020-09-17 07:12:06 -04002746#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
2747 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx );
2748#else
Hanno Becker3307b532017-12-27 21:37:21 +00002749 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc );
Andrzej Kurek11750442020-09-17 07:12:06 -04002750#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002751 if( rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
2752 {
2753 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record content %u too large, maximum %d",
2754 (unsigned) rec->data_len,
2755 MBEDTLS_SSL_OUT_CONTENT_LEN ) );
2756 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2757 }
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +01002758
Hanno Beckera5a2b082019-05-15 14:03:01 +01002759#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01002760 /*
2761 * Add CID information
2762 */
2763 rec->cid_len = transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03002764 /* Not using more secure mbedtls_platform_memcpy as cid is public */
2765 memcpy( rec->cid, transform->out_cid, transform->out_cid_len );
Hanno Beckere83efe62019-04-29 13:52:53 +01002766 MBEDTLS_SSL_DEBUG_BUF( 3, "CID", rec->cid, rec->cid_len );
Hanno Becker92c930f2019-04-29 17:31:37 +01002767 if( rec->cid_len != 0 )
2768 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002769 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker92c930f2019-04-29 17:31:37 +01002770 /*
Hanno Becker7dc25772019-05-20 15:08:01 +01002771 * Wrap plaintext into DTLSInnerPlaintext structure.
2772 * See ssl_cid_build_inner_plaintext() for more information.
Hanno Becker92c930f2019-04-29 17:31:37 +01002773 *
Hanno Becker7dc25772019-05-20 15:08:01 +01002774 * Note that this changes `rec->data_len`, and hence
2775 * `post_avail` needs to be recalculated afterwards.
Hanno Becker92c930f2019-04-29 17:31:37 +01002776 */
Andrzej Kurek84bde412020-07-06 15:27:34 -04002777 if( ( ret = ssl_cid_build_inner_plaintext( data,
2778 &rec->data_len,
2779 post_avail,
2780 rec->type ) ) != 0 )
Hanno Becker92c930f2019-04-29 17:31:37 +01002781 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002782 return( ret );
Hanno Becker92c930f2019-04-29 17:31:37 +01002783 }
2784
2785 rec->type = MBEDTLS_SSL_MSG_CID;
2786 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01002787#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01002788
Hanno Becker92c930f2019-04-29 17:31:37 +01002789 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
2790
Paul Bakker5121ce52009-01-03 21:22:43 +00002791 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002792 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +00002793 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002794#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002795 if( mode == MBEDTLS_MODE_STREAM ||
2796 ( mode == MBEDTLS_MODE_CBC
2797#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3307b532017-12-27 21:37:21 +00002798 && transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002799#endif
2800 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00002801 {
Hanno Becker3307b532017-12-27 21:37:21 +00002802 if( post_avail < transform->maclen )
2803 {
2804 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2805 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2806 }
2807
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002808#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01002809 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
2810 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002811 {
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002812 unsigned char mac[SSL_MAC_MAX_BYTES];
Hanno Becker3307b532017-12-27 21:37:21 +00002813 ssl_mac( &transform->md_ctx_enc, transform->mac_enc,
2814 data, rec->data_len, rec->ctr, rec->type, mac );
Teppo Järvelin91d79382019-10-02 09:09:31 +03002815 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002816 }
2817 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002818#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002819#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2820 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01002821 if( mbedtls_ssl_ver_geq(
2822 mbedtls_ssl_transform_get_minor_ver( transform ),
2823 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002824 {
Hanno Becker992b6872017-11-09 18:57:39 +00002825 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
2826
Hanno Beckere83efe62019-04-29 13:52:53 +01002827 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker992b6872017-11-09 18:57:39 +00002828
Hanno Becker3307b532017-12-27 21:37:21 +00002829 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002830 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00002831 mbedtls_md_hmac_update( &transform->md_ctx_enc,
2832 data, rec->data_len );
2833 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
2834 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
2835
Teppo Järvelin91d79382019-10-02 09:09:31 +03002836 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002837 }
2838 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002839#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002840 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002841 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2842 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002843 }
2844
Hanno Becker3307b532017-12-27 21:37:21 +00002845 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", data + rec->data_len,
2846 transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002847
Hanno Becker3307b532017-12-27 21:37:21 +00002848 rec->data_len += transform->maclen;
2849 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002850 auth_done++;
Paul Bakker577e0062013-08-28 11:57:20 +02002851 }
Hanno Becker5cc04d52018-01-03 15:24:20 +00002852#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00002853
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002854 /*
2855 * Encrypt
2856 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002857#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
2858 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00002859 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002860 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00002861 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002862 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Hanno Becker3307b532017-12-27 21:37:21 +00002863 "including %d bytes of padding",
2864 rec->data_len, 0 ) );
Andrzej Kurek11750442020-09-17 07:12:06 -04002865#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02002866 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
2867 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04002868 {
Andrzej Kureka7932372020-09-19 07:56:06 +02002869 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04002870 return( ret );
2871 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002872
Andrzej Kurekff517212020-08-10 07:10:35 -04002873 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04002874 transform->iv_enc, transform->ivlen,
2875 data, rec->data_len,
2876 data, &olen ) ) != 0 )
2877 {
2878 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
2879 return( ret );
2880 }
2881#else
Andrzej Kurekff517212020-08-10 07:10:35 -04002882 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002883 transform->iv_enc, transform->ivlen,
2884 data, rec->data_len,
2885 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002886 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002887 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002888 return( ret );
2889 }
Andrzej Kurek11750442020-09-17 07:12:06 -04002890#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002891 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002892 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002893 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2894 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002895 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002896 }
Paul Bakker68884e32013-01-07 18:20:04 +01002897 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002898#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002899
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002900#if defined(MBEDTLS_GCM_C) || \
2901 defined(MBEDTLS_CCM_C) || \
2902 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002903 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002904 mode == MBEDTLS_MODE_CCM ||
2905 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002906 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02002907 int ret;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002908 unsigned char iv[12];
Hanno Becker3307b532017-12-27 21:37:21 +00002909 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002910
Hanno Becker3307b532017-12-27 21:37:21 +00002911 /* Check that there's space for both the authentication tag
2912 * and the explicit IV before and after the record content. */
2913 if( post_avail < transform->taglen ||
2914 rec->data_offset < explicit_iv_len )
2915 {
2916 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2917 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2918 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00002919
Paul Bakker68884e32013-01-07 18:20:04 +01002920 /*
2921 * Generate IV
2922 */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002923 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
2924 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002925 /* GCM and CCM: fixed || explicit (=seqnum) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002926 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
2927 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, rec->ctr,
Hanno Becker3307b532017-12-27 21:37:21 +00002928 explicit_iv_len );
2929 /* Prefix record content with explicit IV. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002930 mbedtls_platform_memcpy( data - explicit_iv_len, rec->ctr, explicit_iv_len );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002931 }
2932 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
2933 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002934 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002935 unsigned char i;
2936
Teppo Järvelin91d79382019-10-02 09:09:31 +03002937 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002938
2939 for( i = 0; i < 8; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00002940 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002941 }
2942 else
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002943 {
2944 /* Reminder if we ever add an AEAD mode with a different size */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002945 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2946 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002947 }
2948
Hanno Beckere83efe62019-04-29 13:52:53 +01002949 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker08885812019-04-26 13:34:37 +01002950
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002951 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
2952 iv, transform->ivlen );
2953 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
Hanno Becker3307b532017-12-27 21:37:21 +00002954 data - explicit_iv_len, explicit_iv_len );
2955 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01002956 add_data, add_data_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002957 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002958 "including 0 bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00002959 rec->data_len ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002960
Paul Bakker68884e32013-01-07 18:20:04 +01002961 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02002962 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002963 */
Andrzej Kurek11750442020-09-17 07:12:06 -04002964#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02002965 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
2966 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04002967 {
Andrzej Kureka7932372020-09-19 07:56:06 +02002968 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04002969 return( ret );
2970 }
Hanno Becker3307b532017-12-27 21:37:21 +00002971
Andrzej Kurekff517212020-08-10 07:10:35 -04002972 if( ( ret = encryption_status = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04002973 iv, transform->ivlen,
2974 add_data, add_data_len, /* add data */
2975 data, rec->data_len, /* source */
2976 data, &rec->data_len, /* destination */
2977 data + rec->data_len, transform->taglen ) ) != 0 )
2978 {
2979 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
2980 return( ret );
2981 }
2982#else
Andrzej Kurekff517212020-08-10 07:10:35 -04002983 if( ( ret = encryption_status = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002984 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01002985 add_data, add_data_len, /* add data */
Hanno Becker3307b532017-12-27 21:37:21 +00002986 data, rec->data_len, /* source */
2987 data, &rec->data_len, /* destination */
2988 data + rec->data_len, transform->taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002989 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002990 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002991 return( ret );
2992 }
Andrzej Kurek11750442020-09-17 07:12:06 -04002993#endif
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04002994
Hanno Becker3307b532017-12-27 21:37:21 +00002995 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag",
2996 data + rec->data_len, transform->taglen );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002997
Hanno Becker3307b532017-12-27 21:37:21 +00002998 rec->data_len += transform->taglen + explicit_iv_len;
2999 rec->data_offset -= explicit_iv_len;
3000 post_avail -= transform->taglen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003001 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003002 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003003 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003004#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3005#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003006 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003007 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00003008 {
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003009 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00003010 size_t padlen, i;
3011 size_t olen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003012
Hanno Becker3307b532017-12-27 21:37:21 +00003013 /* Currently we're always using minimal padding
3014 * (up to 255 bytes would be allowed). */
3015 padlen = transform->ivlen - ( rec->data_len + 1 ) % transform->ivlen;
3016 if( padlen == transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003017 padlen = 0;
3018
Hanno Becker3307b532017-12-27 21:37:21 +00003019 /* Check there's enough space in the buffer for the padding. */
3020 if( post_avail < padlen + 1 )
3021 {
3022 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3023 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3024 }
3025
Paul Bakker5121ce52009-01-03 21:22:43 +00003026 for( i = 0; i <= padlen; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00003027 data[rec->data_len + i] = (unsigned char) padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00003028
Hanno Becker3307b532017-12-27 21:37:21 +00003029 rec->data_len += padlen + 1;
3030 post_avail -= padlen + 1;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003032#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003033 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00003034 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
3035 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003036 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003037 if( mbedtls_ssl_ver_geq(
3038 mbedtls_ssl_transform_get_minor_ver( transform ),
3039 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003040 {
Hanno Becker3307b532017-12-27 21:37:21 +00003041 if( f_rng == NULL )
3042 {
3043 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No PRNG provided to encrypt_record routine" ) );
3044 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3045 }
3046
3047 if( rec->data_offset < transform->ivlen )
3048 {
3049 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3050 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3051 }
3052
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003053 /*
3054 * Generate IV
3055 */
Hanno Becker3307b532017-12-27 21:37:21 +00003056 ret = f_rng( p_rng, transform->iv_enc, transform->ivlen );
Paul Bakkera3d195c2011-11-27 21:07:34 +00003057 if( ret != 0 )
3058 return( ret );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003059
Teppo Järvelin91d79382019-10-02 09:09:31 +03003060 mbedtls_platform_memcpy( data - transform->ivlen, transform->iv_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00003061 transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003062
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003063 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003064#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003065
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003066 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003067 "including %d bytes of IV and %d bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00003068 rec->data_len, transform->ivlen,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02003069 padlen + 1 ) );
Andrzej Kurek11750442020-09-17 07:12:06 -04003070#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003071 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_ENCRYPT ) )
3072 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003073 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003074 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003075 return( ret );
3076 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003077
Andrzej Kurekff517212020-08-10 07:10:35 -04003078 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx,
Andrzej Kurek11750442020-09-17 07:12:06 -04003079 transform->iv_enc,
3080 transform->ivlen,
3081 data, rec->data_len,
3082 data, &olen ) ) != 0 )
3083 {
3084 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3085 return( ret );
3086 }
3087#else
Andrzej Kurekff517212020-08-10 07:10:35 -04003088 if( ( ret = encryption_status = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00003089 transform->iv_enc,
3090 transform->ivlen,
3091 data, rec->data_len,
3092 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003093 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003094 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003095 return( ret );
3096 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003097#endif
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04003098
Hanno Becker3307b532017-12-27 21:37:21 +00003099 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003100 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003101 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3102 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003103 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003104
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003105#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003106 if( mbedtls_ssl_ver_lt(
3107 mbedtls_ssl_transform_get_minor_ver( transform ),
3108 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003109 {
3110 /*
3111 * Save IV in SSL3 and TLS1
3112 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003113#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3114 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx.iv,
3115 transform->ivlen );
3116#else
Teppo Järvelin91d79382019-10-02 09:09:31 +03003117 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx_enc.iv,
Hanno Becker3307b532017-12-27 21:37:21 +00003118 transform->ivlen );
Andrzej Kurek11750442020-09-17 07:12:06 -04003119#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003120 }
Hanno Becker3307b532017-12-27 21:37:21 +00003121 else
Paul Bakkercca5b812013-08-31 17:40:26 +02003122#endif
Hanno Becker3307b532017-12-27 21:37:21 +00003123 {
3124 data -= transform->ivlen;
3125 rec->data_offset -= transform->ivlen;
3126 rec->data_len += transform->ivlen;
3127 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003129#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003130 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003131 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00003132 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
3133
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003134 /*
3135 * MAC(MAC_write_key, seq_num +
3136 * TLSCipherText.type +
3137 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003138 * length_of( (IV +) ENC(...) ) +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003139 * IV + // except for TLS 1.0
3140 * ENC(content + padding + padding_length));
3141 */
Hanno Becker3307b532017-12-27 21:37:21 +00003142
3143 if( post_avail < transform->maclen)
3144 {
3145 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
3146 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3147 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003148
Hanno Beckere83efe62019-04-29 13:52:53 +01003149 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003151 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Hanno Becker3307b532017-12-27 21:37:21 +00003152 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01003153 add_data_len );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003154
Hanno Becker3307b532017-12-27 21:37:21 +00003155 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01003156 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00003157 mbedtls_md_hmac_update( &transform->md_ctx_enc,
3158 data, rec->data_len );
3159 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
3160 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003161
Teppo Järvelin91d79382019-10-02 09:09:31 +03003162 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003163
Hanno Becker3307b532017-12-27 21:37:21 +00003164 rec->data_len += transform->maclen;
3165 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003166 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003167 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003168#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00003169 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003170 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003171#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003172 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003173 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003174 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3175 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003176 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003177
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003178 /* Make extra sure authentication was performed, exactly once */
3179 if( auth_done != 1 )
3180 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003181 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3182 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003183 }
3184
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003185 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003186
Andrzej Kurekff517212020-08-10 07:10:35 -04003187 if( encryption_status == 0 )
Andrzej Kurek8ec9e132020-08-10 00:26:40 -04003188 {
3189 return( 0 );
3190 }
3191 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +00003192}
3193
Hanno Becker40478be2019-07-12 08:23:59 +01003194int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
Hanno Becker611a83b2018-01-03 14:27:32 +00003195 mbedtls_ssl_transform *transform,
3196 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00003197{
Hanno Becker4c6876b2017-12-27 21:28:58 +00003198 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003199 mbedtls_cipher_mode_t mode;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003200 int ret, auth_done = 0;
Hanno Becker5cc04d52018-01-03 15:24:20 +00003201#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01003202 size_t padlen = 0, correct = 1;
3203#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003204 unsigned char* data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01003205 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_IN_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01003206 size_t add_data_len;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003207
Hanno Becker611a83b2018-01-03 14:27:32 +00003208#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02003209 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003210 ((void) ssl);
3211#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003212
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003213 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003214 if( rec == NULL ||
3215 rec->buf == NULL ||
3216 rec->buf_len < rec->data_offset ||
3217 rec->buf_len - rec->data_offset < rec->data_len )
3218 {
3219 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to decrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003220 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003221 }
3222
Hanno Becker4c6876b2017-12-27 21:28:58 +00003223 data = rec->buf + rec->data_offset;
Andrzej Kurek11750442020-09-17 07:12:06 -04003224#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3225 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx );
3226#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003227 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -04003228#endif
Hanno Beckera5a2b082019-05-15 14:03:01 +01003229#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01003230 /*
3231 * Match record's CID with incoming CID.
3232 */
Hanno Beckerabd7c892019-05-08 13:02:22 +01003233 if( rec->cid_len != transform->in_cid_len ||
Teppo Järvelin0efac532019-10-04 13:21:08 +03003234 memcmp( rec->cid, transform->in_cid, rec->cid_len ) != 0 ) // use regular memcmp as CID is public
Hanno Beckerabd7c892019-05-08 13:02:22 +01003235 {
Hanno Beckere8eff9a2019-05-14 11:30:10 +01003236 return( MBEDTLS_ERR_SSL_UNEXPECTED_CID );
Hanno Beckerabd7c892019-05-08 13:02:22 +01003237 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003238#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01003239
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003240#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
3241 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker68884e32013-01-07 18:20:04 +01003242 {
3243 padlen = 0;
Andrzej Kurek11750442020-09-17 07:12:06 -04003244#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003245 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3246 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003247 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003248 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003249 return( ret );
3250 }
3251 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx,
3252 transform->iv_dec,
3253 transform->ivlen,
3254 data, rec->data_len,
3255 data, &olen ) ) != 0 )
3256 {
3257 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3258 return( ret );
3259 }
3260#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003261 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3262 transform->iv_dec,
3263 transform->ivlen,
3264 data, rec->data_len,
3265 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003266 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003267 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003268 return( ret );
3269 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003270#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003271 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003272 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003273 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3274 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02003275 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003276 }
Paul Bakker68884e32013-01-07 18:20:04 +01003277 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003278#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003279#if defined(MBEDTLS_GCM_C) || \
3280 defined(MBEDTLS_CCM_C) || \
3281 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003282 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003283 mode == MBEDTLS_MODE_CCM ||
3284 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003285 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003286 unsigned char iv[12];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003287 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003288
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003289 /*
3290 * Prepare IV from explicit and implicit data.
3291 */
3292
3293 /* Check that there's enough space for the explicit IV
3294 * (at the beginning of the record) and the MAC (at the
3295 * end of the record). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003296 if( rec->data_len < explicit_iv_len + transform->taglen )
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003297 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003299 "+ taglen (%d)", rec->data_len,
3300 explicit_iv_len, transform->taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003301 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003302 }
Paul Bakker68884e32013-01-07 18:20:04 +01003303
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003304#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003305 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
3306 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003307 /* GCM and CCM: fixed || explicit */
Paul Bakker68884e32013-01-07 18:20:04 +01003308
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003309 /* Fixed */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003310 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003311 /* Explicit */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003312 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, data, 8 );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003313 }
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003314 else
3315#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3316#if defined(MBEDTLS_CHACHAPOLY_C)
3317 if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003318 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02003319 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003320 unsigned char i;
3321
Teppo Järvelin91d79382019-10-02 09:09:31 +03003322 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003323
3324 for( i = 0; i < 8; i++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003325 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003326 }
3327 else
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003328#endif /* MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003329 {
3330 /* Reminder if we ever add an AEAD mode with a different size */
3331 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3332 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3333 }
3334
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003335 /* Group changes to data, data_len, and add_data, because
3336 * add_data depends on data_len. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003337 data += explicit_iv_len;
3338 rec->data_offset += explicit_iv_len;
3339 rec->data_len -= explicit_iv_len + transform->taglen;
3340
Hanno Beckere83efe62019-04-29 13:52:53 +01003341 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003342 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01003343 add_data, add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003344
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003345 /* Because of the check above, we know that there are
3346 * explicit_iv_len Bytes preceeding data, and taglen
3347 * bytes following data + data_len. This justifies
Hanno Becker07d420d2019-07-10 11:44:13 +01003348 * the debug message and the invocation of
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003349 * mbedtls_cipher_auth_decrypt() below. */
3350
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003351 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv, transform->ivlen );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003352 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", data + rec->data_len,
Hanno Becker8759e162017-12-27 21:34:08 +00003353 transform->taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01003354
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003355 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003356 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003357 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003358#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003359 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3360 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003361 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003362 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003363 return( ret );
3364 }
3365 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx,
3366 iv, transform->ivlen,
3367 add_data, add_data_len,
3368 data, rec->data_len,
3369 data, &olen,
3370 data + rec->data_len,
3371 transform->taglen ) ) != 0 )
3372 {
3373 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
3374
3375 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3376 return( MBEDTLS_ERR_SSL_INVALID_MAC );
3377
3378 return( ret );
3379 }
3380#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003381 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx_dec,
3382 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01003383 add_data, add_data_len,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003384 data, rec->data_len,
3385 data, &olen,
3386 data + rec->data_len,
3387 transform->taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003388 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003389 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003390
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003391 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3392 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003393
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003394 return( ret );
3395 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003396#endif
3397
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003398 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003399
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003400 /* Double-check that AEAD decryption doesn't change content length. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003401 if( olen != rec->data_len )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003402 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003403 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3404 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003405 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00003406 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003407 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003408#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3409#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003410 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003411 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00003412 {
Paul Bakkere47b34b2013-02-27 14:48:00 +01003413 size_t minlen = 0;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003414
Paul Bakker5121ce52009-01-03 21:22:43 +00003415 /*
Paul Bakker45829992013-01-03 14:52:21 +01003416 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00003417 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003418#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003419 if( mbedtls_ssl_ver_geq(
3420 mbedtls_ssl_transform_get_minor_ver( transform ),
3421 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003422 {
3423 /* The ciphertext is prefixed with the CBC IV. */
3424 minlen += transform->ivlen;
3425 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003426#endif
Paul Bakker45829992013-01-03 14:52:21 +01003427
Hanno Becker4c6876b2017-12-27 21:28:58 +00003428 /* Size considerations:
3429 *
3430 * - The CBC cipher text must not be empty and hence
3431 * at least of size transform->ivlen.
3432 *
3433 * Together with the potential IV-prefix, this explains
3434 * the first of the two checks below.
3435 *
3436 * - The record must contain a MAC, either in plain or
3437 * encrypted, depending on whether Encrypt-then-MAC
3438 * is used or not.
3439 * - If it is, the message contains the IV-prefix,
3440 * the CBC ciphertext, and the MAC.
3441 * - If it is not, the padded plaintext, and hence
3442 * the CBC ciphertext, has at least length maclen + 1
3443 * because there is at least the padding length byte.
3444 *
3445 * As the CBC ciphertext is not empty, both cases give the
3446 * lower bound minlen + maclen + 1 on the record size, which
3447 * we test for in the second check below.
3448 */
3449 if( rec->data_len < minlen + transform->ivlen ||
3450 rec->data_len < minlen + transform->maclen + 1 )
Paul Bakker45829992013-01-03 14:52:21 +01003451 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003452 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003453 "+ 1 ) ( + expl IV )", rec->data_len,
3454 transform->ivlen,
3455 transform->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003456 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01003457 }
3458
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003459 /*
3460 * Authenticate before decrypt if enabled
3461 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003462#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003463 if( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003464 {
Hanno Becker992b6872017-11-09 18:57:39 +00003465 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003466
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003467 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003468
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003469 /* Update data_len in tandem with add_data.
3470 *
3471 * The subtraction is safe because of the previous check
3472 * data_len >= minlen + maclen + 1.
3473 *
3474 * Afterwards, we know that data + data_len is followed by at
3475 * least maclen Bytes, which justifies the call to
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003476 * mbedtls_platform_memequal() below.
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003477 *
3478 * Further, we still know that data_len > minlen */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003479 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003480 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003481
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003482 /* Calculate expected MAC. */
Hanno Beckere83efe62019-04-29 13:52:53 +01003483 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
3484 add_data_len );
3485 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3486 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003487 mbedtls_md_hmac_update( &transform->md_ctx_dec,
3488 data, rec->data_len );
3489 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
3490 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003491
Hanno Becker4c6876b2017-12-27 21:28:58 +00003492 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len,
3493 transform->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00003494 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003495 transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003496
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003497 /* Compare expected MAC with MAC at the end of the record. */
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003498 if( mbedtls_platform_memequal( data + rec->data_len, mac_expect,
3499 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003500 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003501 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003502 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003503 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003504 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003505 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003506#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003507
3508 /*
3509 * Check length sanity
3510 */
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003511
3512 /* We know from above that data_len > minlen >= 0,
3513 * so the following check in particular implies that
3514 * data_len >= minlen + ivlen ( = minlen or 2 * minlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003515 if( rec->data_len % transform->ivlen != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003516 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003517 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003518 rec->data_len, transform->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003519 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003520 }
3521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003522#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003523 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00003524 * Initialize for prepended IV for block cipher in TLS v1.1 and up
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003525 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003526 if( mbedtls_ssl_ver_geq(
3527 mbedtls_ssl_transform_get_minor_ver( transform ),
3528 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003529 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003530 /* Safe because data_len >= minlen + ivlen = 2 * ivlen. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003531 mbedtls_platform_memcpy( transform->iv_dec, data, transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003532
Hanno Becker4c6876b2017-12-27 21:28:58 +00003533 data += transform->ivlen;
3534 rec->data_offset += transform->ivlen;
3535 rec->data_len -= transform->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003536 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003537#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003538
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003539 /* We still have data_len % ivlen == 0 and data_len >= ivlen here. */
Andrzej Kurek11750442020-09-17 07:12:06 -04003540#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
Andrzej Kureka7932372020-09-19 07:56:06 +02003541 if( ( ret = mbedtls_ssl_switch_key( transform, MBEDTLS_DECRYPT ) )
3542 != 0 )
Andrzej Kurek11750442020-09-17 07:12:06 -04003543 {
Andrzej Kureka7932372020-09-19 07:56:06 +02003544 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_switch_key", ret );
Andrzej Kurek11750442020-09-17 07:12:06 -04003545 return( ret );
3546 }
Andrzej Kureka7932372020-09-19 07:56:06 +02003547
Andrzej Kurek11750442020-09-17 07:12:06 -04003548 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx,
3549 transform->iv_dec, transform->ivlen,
3550 data, rec->data_len, data, &olen ) ) != 0 )
3551 {
3552 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
3553 return( ret );
3554 }
3555#else
Hanno Becker4c6876b2017-12-27 21:28:58 +00003556 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3557 transform->iv_dec, transform->ivlen,
3558 data, rec->data_len, data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003559 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003560 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003561 return( ret );
3562 }
Andrzej Kurek11750442020-09-17 07:12:06 -04003563#endif
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003564 /* Double-check that length hasn't changed during decryption. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003565 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003566 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003567 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3568 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003569 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003570
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003571#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003572 if( mbedtls_ssl_ver_lt(
3573 mbedtls_ssl_transform_get_minor_ver( transform ),
3574 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003575 {
3576 /*
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003577 * Save IV in SSL3 and TLS1, where CBC decryption of consecutive
3578 * records is equivalent to CBC decryption of the concatenation
3579 * of the records; in other words, IVs are maintained across
3580 * record decryptions.
Paul Bakkercca5b812013-08-31 17:40:26 +02003581 */
Andrzej Kurek11750442020-09-17 07:12:06 -04003582#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
3583 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx.iv,
3584 transform->ivlen );
3585#else
Teppo Järvelin91d79382019-10-02 09:09:31 +03003586 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx_dec.iv,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003587 transform->ivlen );
Andrzej Kurek11750442020-09-17 07:12:06 -04003588#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003589 }
Paul Bakkercca5b812013-08-31 17:40:26 +02003590#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003591
Hanno Becker4c6876b2017-12-27 21:28:58 +00003592 /* Safe since data_len >= minlen + maclen + 1, so after having
3593 * subtracted at most minlen and maclen up to this point,
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003594 * data_len > 0 (because of data_len % ivlen == 0, it's actually
3595 * >= ivlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003596 padlen = data[rec->data_len - 1];
Paul Bakker45829992013-01-03 14:52:21 +01003597
Hanno Becker4c6876b2017-12-27 21:28:58 +00003598 if( auth_done == 1 )
3599 {
3600 correct *= ( rec->data_len >= padlen + 1 );
3601 padlen *= ( rec->data_len >= padlen + 1 );
3602 }
3603 else
Paul Bakker45829992013-01-03 14:52:21 +01003604 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003605#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003606 if( rec->data_len < transform->maclen + padlen + 1 )
3607 {
3608 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
3609 rec->data_len,
3610 transform->maclen,
3611 padlen + 1 ) );
3612 }
Paul Bakkerd66f0702013-01-31 16:57:45 +01003613#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003614
3615 correct *= ( rec->data_len >= transform->maclen + padlen + 1 );
3616 padlen *= ( rec->data_len >= transform->maclen + padlen + 1 );
Paul Bakker45829992013-01-03 14:52:21 +01003617 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003618
Hanno Becker4c6876b2017-12-27 21:28:58 +00003619 padlen++;
3620
3621 /* Regardless of the validity of the padding,
3622 * we have data_len >= padlen here. */
3623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003624#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003625 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3626 MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003627 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003628 if( padlen > transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003629 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003630#if defined(MBEDTLS_SSL_DEBUG_ALL)
3631 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003632 "should be no more than %d",
3633 padlen, transform->ivlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003634#endif
Paul Bakker45829992013-01-03 14:52:21 +01003635 correct = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00003636 }
3637 }
3638 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003639#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3640#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3641 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003642 if( mbedtls_ssl_ver_gt(
3643 mbedtls_ssl_transform_get_minor_ver( transform ),
3644 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003645 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003646 /* The padding check involves a series of up to 256
3647 * consecutive memory reads at the end of the record
3648 * plaintext buffer. In order to hide the length and
3649 * validity of the padding, always perform exactly
3650 * `min(256,plaintext_len)` reads (but take into account
3651 * only the last `padlen` bytes for the padding check). */
3652 size_t pad_count = 0;
3653 size_t real_count = 0;
3654 volatile unsigned char* const check = data;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003655
Hanno Becker4c6876b2017-12-27 21:28:58 +00003656 /* Index of first padding byte; it has been ensured above
3657 * that the subtraction is safe. */
3658 size_t const padding_idx = rec->data_len - padlen;
3659 size_t const num_checks = rec->data_len <= 256 ? rec->data_len : 256;
3660 size_t const start_idx = rec->data_len - num_checks;
3661 size_t idx;
Paul Bakker956c9e02013-12-19 14:42:28 +01003662
Hanno Becker4c6876b2017-12-27 21:28:58 +00003663 for( idx = start_idx; idx < rec->data_len; idx++ )
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003664 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003665 real_count |= ( idx >= padding_idx );
3666 pad_count += real_count * ( check[idx] == padlen - 1 );
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003667 }
Hanno Becker4c6876b2017-12-27 21:28:58 +00003668 correct &= ( pad_count == padlen );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003670#if defined(MBEDTLS_SSL_DEBUG_ALL)
Paul Bakker66d5d072014-06-17 16:39:18 +02003671 if( padlen > 0 && correct == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003672 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003673#endif
Paul Bakkere47b34b2013-02-27 14:48:00 +01003674 padlen &= correct * 0x1FF;
Paul Bakker5121ce52009-01-03 21:22:43 +00003675 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003676 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003677#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3678 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003679 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003680 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3681 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003682 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003683
Hanno Becker4c6876b2017-12-27 21:28:58 +00003684 /* If the padding was found to be invalid, padlen == 0
3685 * and the subtraction is safe. If the padding was found valid,
3686 * padlen hasn't been changed and the previous assertion
3687 * data_len >= padlen still holds. */
3688 rec->data_len -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00003689 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003690 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003691#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003692 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003693 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003694 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3695 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003696 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003697
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003698#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003699 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003700 data, rec->data_len );
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003701#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003702
3703 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003704 * Authenticate if not done yet.
3705 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00003706 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00003707#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003708 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003709 {
Hanno Becker992b6872017-11-09 18:57:39 +00003710 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01003711
Hanno Becker4c6876b2017-12-27 21:28:58 +00003712 /* If the initial value of padlen was such that
3713 * data_len < maclen + padlen + 1, then padlen
3714 * got reset to 1, and the initial check
3715 * data_len >= minlen + maclen + 1
3716 * guarantees that at this point we still
3717 * have at least data_len >= maclen.
3718 *
3719 * If the initial value of padlen was such that
3720 * data_len >= maclen + padlen + 1, then we have
3721 * subtracted either padlen + 1 (if the padding was correct)
3722 * or 0 (if the padding was incorrect) since then,
3723 * hence data_len >= maclen in any case.
3724 */
3725 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003726 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Paul Bakker5121ce52009-01-03 21:22:43 +00003727
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003728#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003729 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3730 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003731 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003732 ssl_mac( &transform->md_ctx_dec,
3733 transform->mac_dec,
3734 data, rec->data_len,
3735 rec->ctr, rec->type,
3736 mac_expect );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003737 }
3738 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003739#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3740#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3741 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003742 if( mbedtls_ssl_ver_gt(
3743 mbedtls_ssl_transform_get_minor_ver( transform ),
3744 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003745 {
3746 /*
3747 * Process MAC and always update for padlen afterwards to make
Gilles Peskine20b44082018-05-29 14:06:49 +02003748 * total time independent of padlen.
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003749 *
3750 * Known timing attacks:
3751 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
3752 *
Gilles Peskine20b44082018-05-29 14:06:49 +02003753 * To compensate for different timings for the MAC calculation
3754 * depending on how much padding was removed (which is determined
3755 * by padlen), process extra_run more blocks through the hash
3756 * function.
3757 *
3758 * The formula in the paper is
3759 * extra_run = ceil( (L1-55) / 64 ) - ceil( (L2-55) / 64 )
3760 * where L1 is the size of the header plus the decrypted message
3761 * plus CBC padding and L2 is the size of the header plus the
3762 * decrypted message. This is for an underlying hash function
3763 * with 64-byte blocks.
3764 * We use ( (Lx+8) / 64 ) to handle 'negative Lx' values
3765 * correctly. We round down instead of up, so -56 is the correct
3766 * value for our calculations instead of -55.
3767 *
Gilles Peskine1bd9d582018-06-04 11:58:44 +02003768 * Repeat the formula rather than defining a block_size variable.
3769 * This avoids requiring division by a variable at runtime
3770 * (which would be marginally less efficient and would require
3771 * linking an extra division function in some builds).
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003772 */
3773 size_t j, extra_run = 0;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003774 unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003775
3776 /*
3777 * The next two sizes are the minimum and maximum values of
3778 * in_msglen over all padlen values.
3779 *
3780 * They're independent of padlen, since we previously did
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003781 * data_len -= padlen.
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003782 *
3783 * Note that max_len + maclen is never more than the buffer
3784 * length, as we previously did in_msglen -= maclen too.
3785 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003786 const size_t max_len = rec->data_len + padlen;
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003787 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
3788
Hanno Becker4c6876b2017-12-27 21:28:58 +00003789 memset( tmp, 0, sizeof( tmp ) );
3790
Hanno Beckera5cedbc2019-07-17 11:21:02 +01003791 switch( mbedtls_md_get_type(
3792 mbedtls_md_get_handle( &transform->md_ctx_dec ) ) )
Gilles Peskine20b44082018-05-29 14:06:49 +02003793 {
Gilles Peskined0e55a42018-06-04 12:03:30 +02003794#if defined(MBEDTLS_MD5_C) || defined(MBEDTLS_SHA1_C) || \
3795 defined(MBEDTLS_SHA256_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003796 case MBEDTLS_MD_MD5:
3797 case MBEDTLS_MD_SHA1:
Gilles Peskine20b44082018-05-29 14:06:49 +02003798 case MBEDTLS_MD_SHA256:
Gilles Peskine20b44082018-05-29 14:06:49 +02003799 /* 8 bytes of message size, 64-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003800 extra_run =
3801 ( add_data_len + rec->data_len + padlen + 8 ) / 64 -
3802 ( add_data_len + rec->data_len + 8 ) / 64;
Gilles Peskine20b44082018-05-29 14:06:49 +02003803 break;
3804#endif
Gilles Peskinea7fe25d2018-06-04 12:01:18 +02003805#if defined(MBEDTLS_SHA512_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003806 case MBEDTLS_MD_SHA384:
Gilles Peskine20b44082018-05-29 14:06:49 +02003807 /* 16 bytes of message size, 128-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003808 extra_run =
3809 ( add_data_len + rec->data_len + padlen + 16 ) / 128 -
3810 ( add_data_len + rec->data_len + 16 ) / 128;
Gilles Peskine20b44082018-05-29 14:06:49 +02003811 break;
3812#endif
3813 default:
Gilles Peskine5c389842018-06-04 12:02:43 +02003814 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Gilles Peskine20b44082018-05-29 14:06:49 +02003815 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3816 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01003817
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003818 extra_run &= correct * 0xFF;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003819
Hanno Beckere83efe62019-04-29 13:52:53 +01003820 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3821 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003822 mbedtls_md_hmac_update( &transform->md_ctx_dec, data,
3823 rec->data_len );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003824 /* Make sure we access everything even when padlen > 0. This
3825 * makes the synchronisation requirements for just-in-time
3826 * Prime+Probe attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003827 ssl_read_memory( data + rec->data_len, padlen );
3828 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003829
3830 /* Call mbedtls_md_process at least once due to cache attacks
3831 * that observe whether md_process() was called of not */
Manuel Pégourié-Gonnard47fede02015-04-29 01:35:48 +02003832 for( j = 0; j < extra_run + 1; j++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003833 mbedtls_md_process( &transform->md_ctx_dec, tmp );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003834
Hanno Becker4c6876b2017-12-27 21:28:58 +00003835 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003836
3837 /* Make sure we access all the memory that could contain the MAC,
3838 * before we check it in the next code block. This makes the
3839 * synchronisation requirements for just-in-time Prime+Probe
3840 * attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003841 ssl_read_memory( data + min_len,
3842 max_len - min_len + transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003843 }
3844 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003845#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3846 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003847 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003848 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3849 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003850 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003851
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003852#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003853 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, transform->maclen );
3854 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len, transform->maclen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003855#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003856
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02003857 if( mbedtls_platform_memequal( data + rec->data_len, mac_expect,
3858 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003859 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003860#if defined(MBEDTLS_SSL_DEBUG_ALL)
3861 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003862#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003863 correct = 0;
3864 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003865 auth_done++;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003866 }
Hanno Beckerdd3ab132018-10-17 14:43:14 +01003867
3868 /*
3869 * Finally check the correct flag
3870 */
3871 if( correct == 0 )
3872 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Hanno Becker5cc04d52018-01-03 15:24:20 +00003873#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003874
3875 /* Make extra sure authentication was performed, exactly once */
3876 if( auth_done != 1 )
3877 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003878 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3879 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003880 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003881
Hanno Beckera5a2b082019-05-15 14:03:01 +01003882#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker92c930f2019-04-29 17:31:37 +01003883 if( rec->cid_len != 0 )
3884 {
3885 ret = ssl_cid_parse_inner_plaintext( data, &rec->data_len,
3886 &rec->type );
3887 if( ret != 0 )
3888 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3889 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003890#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01003891
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003892 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003893
3894 return( 0 );
3895}
3896
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01003897#undef MAC_NONE
3898#undef MAC_PLAINTEXT
3899#undef MAC_CIPHERTEXT
3900
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003901#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00003902/*
3903 * Compression/decompression functions
3904 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003905static int ssl_compress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003906{
3907 int ret;
3908 unsigned char *msg_post = ssl->out_msg;
Andrzej Kurek5462e022018-04-20 07:58:53 -04003909 ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003910 size_t len_pre = ssl->out_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003911 unsigned char *msg_pre = ssl->compress_buf;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003912#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3913 size_t out_buf_len = ssl->out_buf_len;
3914#else
3915 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3916#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00003917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003918 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003919
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003920 if( len_pre == 0 )
3921 return( 0 );
3922
Teppo Järvelin91d79382019-10-02 09:09:31 +03003923 mbedtls_platform_memcpy( msg_pre, ssl->out_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003924
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003925 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003926 ssl->out_msglen ) );
3927
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003928 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003929 ssl->out_msg, ssl->out_msglen );
3930
Paul Bakker48916f92012-09-16 19:57:18 +00003931 ssl->transform_out->ctx_deflate.next_in = msg_pre;
3932 ssl->transform_out->ctx_deflate.avail_in = len_pre;
3933 ssl->transform_out->ctx_deflate.next_out = msg_post;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003934 ssl->transform_out->ctx_deflate.avail_out = out_buf_len - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003935
Paul Bakker48916f92012-09-16 19:57:18 +00003936 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003937 if( ret != Z_OK )
3938 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003939 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
3940 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003941 }
3942
Andrzej Kurekf3844952020-10-16 23:03:01 +02003943 ssl->out_msglen = out_buf_len -
Andrzej Kurek5462e022018-04-20 07:58:53 -04003944 ssl->transform_out->ctx_deflate.avail_out - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003945
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003946 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003947 ssl->out_msglen ) );
3948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003949 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003950 ssl->out_msg, ssl->out_msglen );
3951
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003952 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003953
3954 return( 0 );
3955}
3956
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003957static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003958{
3959 int ret;
3960 unsigned char *msg_post = ssl->in_msg;
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003961 ptrdiff_t header_bytes = ssl->in_msg - ssl->in_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003962 size_t len_pre = ssl->in_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003963 unsigned char *msg_pre = ssl->compress_buf;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003964#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3965 size_t in_buf_len = ssl->in_buf_len;
3966#else
3967 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3968#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00003969
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003970 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003971
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003972 if( len_pre == 0 )
3973 return( 0 );
3974
Teppo Järvelin91d79382019-10-02 09:09:31 +03003975 mbedtls_platform_memcpy( msg_pre, ssl->in_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003976
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003977 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003978 ssl->in_msglen ) );
3979
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003980 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003981 ssl->in_msg, ssl->in_msglen );
3982
Paul Bakker48916f92012-09-16 19:57:18 +00003983 ssl->transform_in->ctx_inflate.next_in = msg_pre;
3984 ssl->transform_in->ctx_inflate.avail_in = len_pre;
3985 ssl->transform_in->ctx_inflate.next_out = msg_post;
Andrzej Kurekf3844952020-10-16 23:03:01 +02003986 ssl->transform_in->ctx_inflate.avail_out = in_buf_len -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003987 header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003988
Paul Bakker48916f92012-09-16 19:57:18 +00003989 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003990 if( ret != Z_OK )
3991 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003992 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
3993 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003994 }
3995
Andrzej Kurekf3844952020-10-16 23:03:01 +02003996 ssl->in_msglen = in_buf_len -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003997 ssl->transform_in->ctx_inflate.avail_out - header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003998
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003999 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00004000 ssl->in_msglen ) );
4001
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004002 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00004003 ssl->in_msg, ssl->in_msglen );
4004
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004005 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004006
4007 return( 0 );
4008}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004009#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004010
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004011#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
4012static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004014#if defined(MBEDTLS_SSL_PROTO_DTLS)
4015static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004016{
4017 /* If renegotiation is not enforced, retransmit until we would reach max
4018 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004019 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004020 {
Hanno Becker1f835fa2019-06-13 10:14:59 +01004021 uint32_t ratio =
4022 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) /
4023 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004024 unsigned char doublings = 1;
4025
4026 while( ratio != 0 )
4027 {
4028 ++doublings;
4029 ratio >>= 1;
4030 }
4031
4032 if( ++ssl->renego_records_seen > doublings )
4033 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02004034 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004035 return( 0 );
4036 }
4037 }
4038
4039 return( ssl_write_hello_request( ssl ) );
4040}
4041#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004042#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004043
Paul Bakker5121ce52009-01-03 21:22:43 +00004044/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004045 * Fill the input message buffer by appending data to it.
4046 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004047 *
4048 * If we return 0, is it guaranteed that (at least) nb_want bytes are
4049 * available (from this read and/or a previous one). Otherwise, an error code
4050 * is returned (possibly EOF or WANT_READ).
4051 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004052 * With stream transport (TLS) on success ssl->in_left == nb_want, but
4053 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
4054 * since we always read a whole datagram at once.
4055 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02004056 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004057 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00004058 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004059int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00004060{
Paul Bakker23986e52011-04-24 08:57:21 +00004061 int ret;
4062 size_t len;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004063#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4064 size_t in_buf_len = ssl->in_buf_len;
4065#else
4066 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4067#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004068
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004069 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004070
Hanno Beckera58a8962019-06-13 16:11:15 +01004071 if( mbedtls_ssl_get_recv( ssl ) == NULL &&
4072 mbedtls_ssl_get_recv_timeout( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004073 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004074 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01004075 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004076 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004077 }
4078
Andrzej Kurekf3844952020-10-16 23:03:01 +02004079 if( nb_want > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004080 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004081 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
4082 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004083 }
4084
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004085#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004086 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004087 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004088 uint32_t timeout;
4089
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02004090 /* Just to be sure */
Hanno Becker0ae6b242019-06-13 16:45:36 +01004091 if( mbedtls_ssl_get_set_timer( ssl ) == NULL ||
4092 mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02004093 {
4094 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
4095 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
4096 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4097 }
4098
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004099 /*
4100 * The point is, we need to always read a full datagram at once, so we
4101 * sometimes read more then requested, and handle the additional data.
4102 * It could be the rest of the current record (while fetching the
4103 * header) and/or some other records in the same datagram.
4104 */
4105
4106 /*
4107 * Move to the next record in the already read datagram if applicable
4108 */
4109 if( ssl->next_record_offset != 0 )
4110 {
4111 if( ssl->in_left < ssl->next_record_offset )
4112 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004113 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4114 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004115 }
4116
4117 ssl->in_left -= ssl->next_record_offset;
4118
4119 if( ssl->in_left != 0 )
4120 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004121 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004122 ssl->next_record_offset ) );
4123 memmove( ssl->in_hdr,
4124 ssl->in_hdr + ssl->next_record_offset,
4125 ssl->in_left );
4126 }
4127
4128 ssl->next_record_offset = 0;
4129 }
4130
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004131 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Paul Bakker5121ce52009-01-03 21:22:43 +00004132 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004133
4134 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004135 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004136 */
4137 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004138 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004139 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004140 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004141 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004142
4143 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01004144 * A record can't be split across datagrams. If we need to read but
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004145 * are not at the beginning of a new record, the caller did something
4146 * wrong.
4147 */
4148 if( ssl->in_left != 0 )
4149 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004150 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4151 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004152 }
4153
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004154 /*
4155 * Don't even try to read if time's out already.
4156 * This avoids by-passing the timer when repeatedly receiving messages
4157 * that will end up being dropped.
4158 */
4159 if( ssl_check_timer( ssl ) != 0 )
Hanno Beckere65ce782017-05-22 14:47:48 +01004160 {
4161 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004162 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Hanno Beckere65ce782017-05-22 14:47:48 +01004163 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004164 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004165 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02004166 len = in_buf_len - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004167
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004168 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004169 timeout = ssl->handshake->retransmit_timeout;
4170 else
Hanno Becker1f835fa2019-06-13 10:14:59 +01004171 timeout = mbedtls_ssl_conf_get_read_timeout( ssl->conf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004172
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004173 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004174
Hanno Beckera58a8962019-06-13 16:11:15 +01004175 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
4176 {
4177 ret = mbedtls_ssl_get_recv_timeout( ssl )
4178 ( ssl->p_bio, ssl->in_hdr, len, timeout );
4179 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004180 else
Hanno Beckera58a8962019-06-13 16:11:15 +01004181 {
4182 ret = mbedtls_ssl_get_recv( ssl )
4183 ( ssl->p_bio, ssl->in_hdr, len );
4184 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004186 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004187
4188 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004189 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004190 }
4191
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004192 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004193 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004194 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004195 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004196
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004197 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004198 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004199 if( ssl_double_retransmit_timeout( ssl ) != 0 )
4200 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004201 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004202 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004203 }
4204
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004205 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004206 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004207 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02004208 return( ret );
4209 }
4210
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004211 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004212 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004213#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +01004214 else if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4215 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004216 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004217 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02004218 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004219 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004220 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004221 return( ret );
4222 }
4223
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01004224 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02004225 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004226#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004227 }
4228
Paul Bakker5121ce52009-01-03 21:22:43 +00004229 if( ret < 0 )
4230 return( ret );
4231
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004232 ssl->in_left = ret;
4233 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004234 MBEDTLS_SSL_TRANSPORT_ELSE
4235#endif /* MBEDTLS_SSL_PROTO_DTLS */
4236#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004237 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004238 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004239 ssl->in_left, nb_want ) );
4240
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004241 while( ssl->in_left < nb_want )
4242 {
4243 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02004244
4245 if( ssl_check_timer( ssl ) != 0 )
4246 ret = MBEDTLS_ERR_SSL_TIMEOUT;
4247 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004248 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004249 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004250 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004251 ret = mbedtls_ssl_get_recv_timeout( ssl )( ssl->p_bio,
4252 ssl->in_hdr + ssl->in_left, len,
4253 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004254 }
4255 else
4256 {
Hanno Beckera58a8962019-06-13 16:11:15 +01004257 ret = mbedtls_ssl_get_recv( ssl )( ssl->p_bio,
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004258 ssl->in_hdr + ssl->in_left, len );
4259 }
4260 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004261
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004262 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02004263 ssl->in_left, nb_want ) );
4264 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004265
4266 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004267 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004268
4269 if( ret < 0 )
4270 return( ret );
4271
mohammad160352aecb92018-03-28 23:41:40 -07004272 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16035bd15cb2018-02-28 04:30:59 -08004273 {
Darryl Green11999bb2018-03-13 15:22:58 +00004274 MBEDTLS_SSL_DEBUG_MSG( 1,
4275 ( "f_recv returned %d bytes but only %lu were requested",
mohammad160319d392b2018-04-02 07:25:26 -07004276 ret, (unsigned long)len ) );
mohammad16035bd15cb2018-02-28 04:30:59 -08004277 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4278 }
4279
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01004280 ssl->in_left += ret;
4281 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004282 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01004283#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00004284
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004285 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004286
4287 return( 0 );
4288}
4289
4290/*
4291 * Flush any data not yet written
4292 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004293int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004294{
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01004295 int ret;
Hanno Becker04484622018-08-06 09:49:38 +01004296 unsigned char *buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00004297
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004298 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004299
Hanno Beckera58a8962019-06-13 16:11:15 +01004300 if( mbedtls_ssl_get_send( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004301 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004302 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01004303 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004304 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02004305 }
4306
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004307 /* Avoid incrementing counter if data is flushed */
4308 if( ssl->out_left == 0 )
4309 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004310 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004311 return( 0 );
4312 }
4313
Paul Bakker5121ce52009-01-03 21:22:43 +00004314 while( ssl->out_left > 0 )
4315 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004316 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
Hanno Becker43395762019-05-03 14:46:38 +01004317 mbedtls_ssl_out_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004318
Hanno Becker2b1e3542018-08-06 11:19:13 +01004319 buf = ssl->out_hdr - ssl->out_left;
Hanno Beckera58a8962019-06-13 16:11:15 +01004320 ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00004321
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004322 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004323
4324 if( ret <= 0 )
4325 return( ret );
4326
mohammad160352aecb92018-03-28 23:41:40 -07004327 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16034bbaeb42018-02-22 04:29:04 -08004328 {
Darryl Green11999bb2018-03-13 15:22:58 +00004329 MBEDTLS_SSL_DEBUG_MSG( 1,
4330 ( "f_send returned %d bytes but only %lu bytes were sent",
mohammad160319d392b2018-04-02 07:25:26 -07004331 ret, (unsigned long)ssl->out_left ) );
mohammad16034bbaeb42018-02-22 04:29:04 -08004332 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4333 }
4334
Paul Bakker5121ce52009-01-03 21:22:43 +00004335 ssl->out_left -= ret;
4336 }
4337
Hanno Becker2b1e3542018-08-06 11:19:13 +01004338#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004339 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004340 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004341 ssl->out_hdr = ssl->out_buf;
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004342 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004343 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2b1e3542018-08-06 11:19:13 +01004344#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004345#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +01004346 {
4347 ssl->out_hdr = ssl->out_buf + 8;
4348 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004349#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004350 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004351
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004352 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004353
4354 return( 0 );
4355}
4356
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004357/*
4358 * Functions to handle the DTLS retransmission state machine
4359 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004360#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004361/*
4362 * Append current handshake message to current outgoing flight
4363 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004364static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004365{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004366 mbedtls_ssl_flight_item *msg;
Hanno Becker3b235902018-08-06 09:54:53 +01004367 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
4368 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
4369 ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004370
4371 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004372 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004373 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004374 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004375 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004376 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004377 }
4378
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004379 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004380 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004381 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004382 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004383 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004384 }
4385
4386 /* Copy current handshake message with headers */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004387 mbedtls_platform_memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004388 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004389 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004390 msg->next = NULL;
4391
4392 /* Append to the current flight */
4393 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004394 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004395 else
4396 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004397 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004398 while( cur->next != NULL )
4399 cur = cur->next;
4400 cur->next = msg;
4401 }
4402
Hanno Becker3b235902018-08-06 09:54:53 +01004403 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004404 return( 0 );
4405}
4406
4407/*
4408 * Free the current flight of handshake messages
4409 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004410static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004411{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004412 mbedtls_ssl_flight_item *cur = flight;
4413 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004414
4415 while( cur != NULL )
4416 {
4417 next = cur->next;
4418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004419 mbedtls_free( cur->p );
4420 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004421
4422 cur = next;
4423 }
4424}
4425
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004426#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4427static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004428#endif
4429
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004430/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004431 * Swap transform_out and out_ctr with the alternative ones
4432 */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004433static int ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004434{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004435 mbedtls_ssl_transform *tmp_transform;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004436 unsigned char tmp_out_ctr[8];
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004437#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4438 int ret;
4439#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004440
4441 if( ssl->transform_out == ssl->handshake->alt_transform_out )
4442 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004443 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004444 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004445 }
4446
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004447 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004448
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004449 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004450 tmp_transform = ssl->transform_out;
4451 ssl->transform_out = ssl->handshake->alt_transform_out;
4452 ssl->handshake->alt_transform_out = tmp_transform;
4453
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004454 /* Swap epoch + sequence_number */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004455 mbedtls_platform_memcpy( tmp_out_ctr, ssl->cur_out_ctr, 8 );
4456 mbedtls_platform_memcpy( ssl->cur_out_ctr, ssl->handshake->alt_out_ctr, 8 );
4457 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004458
4459 /* Adjust to the newly activated transform */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004460 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004461
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004462#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4463 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004464 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004465 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004466 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004467 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
4468 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004469 }
4470 }
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004471#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
4472
4473 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004474}
4475
4476/*
4477 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004478 */
4479int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
4480{
4481 int ret = 0;
4482
4483 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
4484
4485 ret = mbedtls_ssl_flight_transmit( ssl );
4486
4487 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
4488
4489 return( ret );
4490}
4491
4492/*
4493 * Transmit or retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004494 *
4495 * Need to remember the current message in case flush_output returns
4496 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004497 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004498 */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004499int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004500{
Hanno Becker67bc7c32018-08-06 11:33:50 +01004501 int ret;
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004502 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004503
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004504 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004505 {
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004506 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004507
4508 ssl->handshake->cur_msg = ssl->handshake->flight;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004509 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004510 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4511 return( ret );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004512
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004513 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004514 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004515
4516 while( ssl->handshake->cur_msg != NULL )
4517 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004518 size_t max_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004519 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004520
Hanno Beckere1dcb032018-08-17 16:47:58 +01004521 int const is_finished =
4522 ( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
4523 cur->p[0] == MBEDTLS_SSL_HS_FINISHED );
4524
Hanno Becker04da1892018-08-14 13:22:10 +01004525 uint8_t const force_flush = ssl->disable_datagram_packing == 1 ?
4526 SSL_FORCE_FLUSH : SSL_DONT_FORCE_FLUSH;
4527
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004528 /* Swap epochs before sending Finished: we can't do it after
4529 * sending ChangeCipherSpec, in case write returns WANT_READ.
4530 * Must be done before copying, may change out_msg pointer */
Hanno Beckere1dcb032018-08-17 16:47:58 +01004531 if( is_finished && ssl->handshake->cur_msg_p == ( cur->p + 12 ) )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004532 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004533 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004534 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4535 return( ret );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004536 }
4537
Hanno Becker67bc7c32018-08-06 11:33:50 +01004538 ret = ssl_get_remaining_payload_in_datagram( ssl );
4539 if( ret < 0 )
4540 return( ret );
4541 max_frag_len = (size_t) ret;
4542
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004543 /* CCS is copied as is, while HS messages may need fragmentation */
4544 if( cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4545 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004546 if( max_frag_len == 0 )
4547 {
4548 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4549 return( ret );
4550
4551 continue;
4552 }
4553
Teppo Järvelin91d79382019-10-02 09:09:31 +03004554 mbedtls_platform_memcpy( ssl->out_msg, cur->p, cur->len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004555 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004556 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004557
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004558 /* Update position inside current message */
4559 ssl->handshake->cur_msg_p += cur->len;
4560 }
4561 else
4562 {
4563 const unsigned char * const p = ssl->handshake->cur_msg_p;
4564 const size_t hs_len = cur->len - 12;
4565 const size_t frag_off = p - ( cur->p + 12 );
4566 const size_t rem_len = hs_len - frag_off;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004567 size_t cur_hs_frag_len, max_hs_frag_len;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004568
Hanno Beckere1dcb032018-08-17 16:47:58 +01004569 if( ( max_frag_len < 12 ) || ( max_frag_len == 12 && hs_len != 0 ) )
Manuel Pégourié-Gonnarda1071a52018-08-20 11:56:14 +02004570 {
Hanno Beckere1dcb032018-08-17 16:47:58 +01004571 if( is_finished )
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004572 {
4573 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4574 return( ret );
4575 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004576
Hanno Becker67bc7c32018-08-06 11:33:50 +01004577 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4578 return( ret );
4579
4580 continue;
4581 }
4582 max_hs_frag_len = max_frag_len - 12;
4583
4584 cur_hs_frag_len = rem_len > max_hs_frag_len ?
4585 max_hs_frag_len : rem_len;
4586
4587 if( frag_off == 0 && cur_hs_frag_len != hs_len )
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004588 {
4589 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
Hanno Becker67bc7c32018-08-06 11:33:50 +01004590 (unsigned) cur_hs_frag_len,
4591 (unsigned) max_hs_frag_len ) );
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004592 }
Manuel Pégourié-Gonnardb747c6c2018-08-12 13:28:53 +02004593
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004594 /* Messages are stored with handshake headers as if not fragmented,
4595 * copy beginning of headers then fill fragmentation fields.
4596 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004597 mbedtls_platform_memcpy( ssl->out_msg, cur->p, 6 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004598
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004599 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[6], frag_off );
4600 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[9],
4601 cur_hs_frag_len );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004602
4603 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl->out_msg, 12 );
4604
Hanno Becker3f7b9732018-08-28 09:53:25 +01004605 /* Copy the handshake message content and set records fields */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004606 mbedtls_platform_memcpy( ssl->out_msg + 12, p, cur_hs_frag_len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004607 ssl->out_msglen = cur_hs_frag_len + 12;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004608 ssl->out_msgtype = cur->type;
4609
4610 /* Update position inside current message */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004611 ssl->handshake->cur_msg_p += cur_hs_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004612 }
4613
4614 /* If done with the current message move to the next one if any */
4615 if( ssl->handshake->cur_msg_p >= cur->p + cur->len )
4616 {
4617 if( cur->next != NULL )
4618 {
4619 ssl->handshake->cur_msg = cur->next;
4620 ssl->handshake->cur_msg_p = cur->next->p + 12;
4621 }
4622 else
4623 {
4624 ssl->handshake->cur_msg = NULL;
4625 ssl->handshake->cur_msg_p = NULL;
4626 }
4627 }
4628
4629 /* Actually send the message out */
Hanno Becker04da1892018-08-14 13:22:10 +01004630 if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004631 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004632 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004633 return( ret );
4634 }
4635 }
4636
Hanno Becker67bc7c32018-08-06 11:33:50 +01004637 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4638 return( ret );
4639
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004640 /* Update state and set timer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004641 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
4642 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02004643 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004644 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004645 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004646 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
4647 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004648
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004649 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004650
4651 return( 0 );
4652}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004653
4654/*
4655 * To be called when the last message of an incoming flight is received.
4656 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004657void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004658{
4659 /* We won't need to resend that one any more */
4660 ssl_flight_free( ssl->handshake->flight );
4661 ssl->handshake->flight = NULL;
4662 ssl->handshake->cur_msg = NULL;
4663
4664 /* The next incoming flight will start with this msg_seq */
4665 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
4666
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004667 /* We don't want to remember CCS's across flight boundaries. */
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004668 ssl->handshake->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004669
Hanno Becker0271f962018-08-16 13:23:47 +01004670 /* Clear future message buffering structure. */
4671 ssl_buffering_free( ssl );
4672
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004673 /* Cancel timer */
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004674 ssl_set_timer( ssl, 0 );
4675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004676 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4677 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004678 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004679 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004680 }
4681 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004682 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004683}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004684
4685/*
4686 * To be called when the last message of an outgoing flight is send.
4687 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004688void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004689{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004690 ssl_reset_retransmit_timeout( ssl );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004691 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004692
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004693 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4694 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004695 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004696 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004697 }
4698 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004699 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004700}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004701#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004702
Paul Bakker5121ce52009-01-03 21:22:43 +00004703/*
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004704 * Handshake layer functions
Paul Bakker5121ce52009-01-03 21:22:43 +00004705 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004706
4707/*
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004708 * Write (DTLS: or queue) current handshake (including CCS) message.
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004709 *
4710 * - fill in handshake headers
4711 * - update handshake checksum
4712 * - DTLS: save message for resending
4713 * - then pass to the record layer
4714 *
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004715 * DTLS: except for HelloRequest, messages are only queued, and will only be
4716 * actually sent when calling flight_transmit() or resend().
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004717 *
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004718 * Inputs:
4719 * - ssl->out_msglen: 4 + actual handshake message len
4720 * (4 is the size of handshake headers for TLS)
4721 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
4722 * - ssl->out_msg + 4: the handshake message body
4723 *
Manuel Pégourié-Gonnard065a2a32018-08-20 11:09:26 +02004724 * Outputs, ie state before passing to flight_append() or write_record():
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004725 * - ssl->out_msglen: the length of the record contents
4726 * (including handshake headers but excluding record headers)
4727 * - ssl->out_msg: the record contents (handshake headers + content)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004728 */
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004729int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004730{
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004731 int ret;
4732 const size_t hs_len = ssl->out_msglen - 4;
4733 const unsigned char hs_type = ssl->out_msg[0];
Paul Bakker5121ce52009-01-03 21:22:43 +00004734
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004735 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
4736
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004737 /*
4738 * Sanity checks
4739 */
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004740 if( ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004741 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4742 {
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004743 /* In SSLv3, the client might send a NoCertificate alert. */
4744#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2881d802019-05-22 14:44:53 +01004745 if( ! ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004746 ssl->out_msgtype == MBEDTLS_SSL_MSG_ALERT &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01004747 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4748 MBEDTLS_SSL_IS_CLIENT ) )
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004749#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
4750 {
4751 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4752 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4753 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004754 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004755
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004756 /* Whenever we send anything different from a
4757 * HelloRequest we should be in a handshake - double check. */
4758 if( ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4759 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) &&
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004760 ssl->handshake == NULL )
4761 {
4762 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4763 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4764 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004765
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004766#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004767 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004768 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004769 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004770 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004771 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4772 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004773 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004774#endif
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004775
Hanno Beckerb50a2532018-08-06 11:52:54 +01004776 /* Double-check that we did not exceed the bounds
4777 * of the outgoing record buffer.
4778 * This should never fail as the various message
4779 * writing functions must obey the bounds of the
4780 * outgoing record buffer, but better be safe.
4781 *
4782 * Note: We deliberately do not check for the MTU or MFL here.
4783 */
4784 if( ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN )
4785 {
4786 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
4787 "size %u, maximum %u",
4788 (unsigned) ssl->out_msglen,
4789 (unsigned) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
4790 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4791 }
4792
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004793 /*
4794 * Fill handshake headers
4795 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004796 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004797 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004798 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[1], hs_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00004799
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004800 /*
4801 * DTLS has additional fields in the Handshake layer,
4802 * between the length field and the actual payload:
4803 * uint16 message_seq;
4804 * uint24 fragment_offset;
4805 * uint24 fragment_length;
4806 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004807#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004808 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004809 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004810 /* Make room for the additional DTLS fields */
Angus Grattond8213d02016-05-25 20:56:48 +10004811 if( MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8 )
Hanno Becker9648f8b2017-09-18 10:55:54 +01004812 {
4813 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
4814 "size %u, maximum %u",
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004815 (unsigned) ( hs_len ),
Angus Grattond8213d02016-05-25 20:56:48 +10004816 (unsigned) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
Hanno Becker9648f8b2017-09-18 10:55:54 +01004817 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4818 }
4819
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004820 memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004821 ssl->out_msglen += 8;
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004822
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004823 /* Write message_seq and update it, except for HelloRequest */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004824 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004825 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004826 (void)mbedtls_platform_put_uint16_be( &ssl->out_msg[4],
4827 ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02004828 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004829 }
4830 else
4831 {
4832 ssl->out_msg[4] = 0;
4833 ssl->out_msg[5] = 0;
4834 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004835
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004836 /* Handshake hashes are computed without fragmentation,
4837 * so set frag_offset = 0 and frag_len = hs_len for now */
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02004838 if( mbedtls_platform_memset( ssl->out_msg + 6, 0x00, 3 ) !=
4839 ssl->out_msg + 6 )
4840 {
4841 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
4842 }
4843 if( mbedtls_platform_memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 ) !=
4844 ssl->out_msg + 9 )
4845 {
4846 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
4847 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004848 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004849#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004850
Hanno Becker0207e532018-08-28 10:28:28 +01004851 /* Update running hashes of handshake messages seen */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004852 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Hanno Becker8a4b5902019-08-15 17:04:57 +01004853 mbedtls_ssl_update_checksum( ssl, ssl->out_msg, ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00004854 }
4855
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004856 /* Either send now, or just save to be sent (and resent) later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004857#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004858 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004859 ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4860 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004861 {
4862 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
4863 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004864 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004865 return( ret );
4866 }
4867 }
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004868 else
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004869#endif
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004870 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004871 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004872 {
4873 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
4874 return( ret );
4875 }
4876 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004877
4878 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
4879
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004880 return( 0 );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004881}
4882
4883/*
4884 * Record layer functions
4885 */
4886
4887/*
4888 * Write current record.
4889 *
4890 * Uses:
4891 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
4892 * - ssl->out_msglen: length of the record content (excl headers)
4893 * - ssl->out_msg: record content
4894 */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004895int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush )
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004896{
4897 int ret, done = 0;
4898 size_t len = ssl->out_msglen;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004899 uint8_t flush = force_flush;
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004900
4901 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004902
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004903#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00004904 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004905 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00004906 {
4907 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
4908 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004909 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004910 return( ret );
4911 }
4912
4913 len = ssl->out_msglen;
4914 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004915#endif /*MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004916
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004917#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4918 if( mbedtls_ssl_hw_record_write != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004919 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004920 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004921
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004922 ret = mbedtls_ssl_hw_record_write( ssl );
4923 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00004924 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004925 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
4926 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004927 }
Paul Bakkerc7878112012-12-19 14:41:14 +01004928
4929 if( ret == 0 )
4930 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00004931 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004932#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00004933 if( !done )
4934 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004935 unsigned i;
4936 size_t protected_record_size;
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004937 volatile int encrypted_fi = 0;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004938#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4939 size_t out_buf_len = ssl->out_buf_len;
4940#else
4941 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4942#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004943
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004944 /* Skip writing the record content type to after the encryption,
4945 * as it may change when using the CID extension. */
4946
Hanno Becker2881d802019-05-22 14:44:53 +01004947 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4948 mbedtls_ssl_get_minor_ver( ssl ),
4949 ssl->conf->transport, ssl->out_hdr + 1 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01004950
Teppo Järvelin91d79382019-10-02 09:09:31 +03004951 mbedtls_platform_memcpy( ssl->out_ctr, ssl->cur_out_ctr, 8 );
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004952 (void)mbedtls_platform_put_uint16_be( ssl->out_len, len );
Paul Bakker05ef8352012-05-08 09:17:57 +00004953
Paul Bakker48916f92012-09-16 19:57:18 +00004954 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00004955 {
Hanno Becker3307b532017-12-27 21:37:21 +00004956 mbedtls_record rec;
4957
4958 rec.buf = ssl->out_iv;
Andrzej Kurekf3844952020-10-16 23:03:01 +02004959 rec.buf_len = out_buf_len - ( ssl->out_iv - ssl->out_buf );
Hanno Becker3307b532017-12-27 21:37:21 +00004960 rec.data_len = ssl->out_msglen;
4961 rec.data_offset = ssl->out_msg - rec.buf;
4962
Teppo Järvelin91d79382019-10-02 09:09:31 +03004963 mbedtls_platform_memcpy( &rec.ctr[0], ssl->out_ctr, 8 );
Hanno Becker2881d802019-05-22 14:44:53 +01004964 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4965 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Becker3307b532017-12-27 21:37:21 +00004966 ssl->conf->transport, rec.ver );
4967 rec.type = ssl->out_msgtype;
4968
Hanno Beckera5a2b082019-05-15 14:03:01 +01004969#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01004970 /* The CID is set by mbedtls_ssl_encrypt_buf(). */
Hanno Beckere83efe62019-04-29 13:52:53 +01004971 rec.cid_len = 0;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004972#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01004973
Hanno Becker611a83b2018-01-03 14:27:32 +00004974 if( ( ret = mbedtls_ssl_encrypt_buf( ssl, ssl->transform_out, &rec,
Hanno Beckerece325c2019-06-13 15:39:27 +01004975 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01004976 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00004977 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004978 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00004979 return( ret );
4980 }
4981
Hanno Becker3307b532017-12-27 21:37:21 +00004982 if( rec.data_offset != 0 )
4983 {
4984 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4985 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4986 }
4987
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004988 /* Update the record content type and CID. */
4989 ssl->out_msgtype = rec.type;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004990#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID )
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03004991 /* Not using more secure mbedtls_platform_memcpy as cid is public */
4992 memcpy( ssl->out_cid, rec.cid, rec.cid_len );
Hanno Beckera5a2b082019-05-15 14:03:01 +01004993#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc5aee962019-03-14 12:56:23 +00004994 ssl->out_msglen = len = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004995 (void)mbedtls_platform_put_uint16_be( ssl->out_len, rec.data_len );
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004996 encrypted_fi = 1;
4997 }
4998
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004999 /* Double check to ensure the encryption has been done */
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02005000 if( ssl->transform_out != NULL && encrypted_fi == 0 )
5001 {
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02005002 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker05ef8352012-05-08 09:17:57 +00005003 }
5004
Hanno Becker43395762019-05-03 14:46:38 +01005005 protected_record_size = len + mbedtls_ssl_out_hdr_len( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01005006
5007#if defined(MBEDTLS_SSL_PROTO_DTLS)
5008 /* In case of DTLS, double-check that we don't exceed
5009 * the remaining space in the datagram. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005010 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2b1e3542018-08-06 11:19:13 +01005011 {
Hanno Becker554b0af2018-08-22 20:33:41 +01005012 ret = ssl_get_remaining_space_in_datagram( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01005013 if( ret < 0 )
5014 return( ret );
5015
5016 if( protected_record_size > (size_t) ret )
5017 {
5018 /* Should never happen */
5019 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5020 }
5021 }
5022#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker05ef8352012-05-08 09:17:57 +00005023
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005024 /* Now write the potentially updated record content type. */
5025 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
5026
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005027 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01005028 "version = [%d:%d], msglen = %d",
5029 ssl->out_hdr[0], ssl->out_hdr[1],
5030 ssl->out_hdr[2], len ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00005031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005032 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01005033 ssl->out_hdr, protected_record_size );
Hanno Becker2b1e3542018-08-06 11:19:13 +01005034
5035 ssl->out_left += protected_record_size;
5036 ssl->out_hdr += protected_record_size;
5037 ssl_update_out_pointers( ssl, ssl->transform_out );
5038
Hanno Becker04484622018-08-06 09:49:38 +01005039 for( i = 8; i > ssl_ep_len( ssl ); i-- )
5040 if( ++ssl->cur_out_ctr[i - 1] != 0 )
5041 break;
5042
5043 /* The loop goes to its end iff the counter is wrapping */
5044 if( i == ssl_ep_len( ssl ) )
5045 {
5046 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
5047 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
5048 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005049 }
5050
Hanno Becker67bc7c32018-08-06 11:33:50 +01005051#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005052 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker47db8772018-08-21 13:32:13 +01005053 flush == SSL_DONT_FORCE_FLUSH )
Hanno Becker67bc7c32018-08-06 11:33:50 +01005054 {
Hanno Becker1f5a15d2018-08-21 13:31:31 +01005055 size_t remaining;
5056 ret = ssl_get_remaining_payload_in_datagram( ssl );
5057 if( ret < 0 )
5058 {
5059 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
5060 ret );
5061 return( ret );
5062 }
5063
5064 remaining = (size_t) ret;
Hanno Becker67bc7c32018-08-06 11:33:50 +01005065 if( remaining == 0 )
Hanno Beckerf0da6672018-08-28 09:55:10 +01005066 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01005067 flush = SSL_FORCE_FLUSH;
Hanno Beckerf0da6672018-08-28 09:55:10 +01005068 }
Hanno Becker67bc7c32018-08-06 11:33:50 +01005069 else
5070 {
Hanno Becker513815a2018-08-20 11:56:09 +01005071 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining ) );
Hanno Becker67bc7c32018-08-06 11:33:50 +01005072 }
5073 }
5074#endif /* MBEDTLS_SSL_PROTO_DTLS */
5075
5076 if( ( flush == SSL_FORCE_FLUSH ) &&
5077 ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005078 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005079 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005080 return( ret );
5081 }
5082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005083 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005084
5085 return( 0 );
5086}
5087
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005088#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckere25e3b72018-08-16 09:30:53 +01005089
5090static int ssl_hs_is_proper_fragment( mbedtls_ssl_context *ssl )
5091{
5092 if( ssl->in_msglen < ssl->in_hslen ||
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02005093 mbedtls_platform_memequal( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
5094 mbedtls_platform_memequal( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
Hanno Beckere25e3b72018-08-16 09:30:53 +01005095 {
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04005096 return( PROPER_HS_FRAGMENT );
Hanno Beckere25e3b72018-08-16 09:30:53 +01005097 }
5098 return( 0 );
5099}
Hanno Becker44650b72018-08-16 12:51:11 +01005100
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005101static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005102{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005103 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[9] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01005104}
5105
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005106static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005107{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005108 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[6] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01005109}
5110
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005111static int ssl_check_hs_header( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01005112{
5113 uint32_t msg_len, frag_off, frag_len;
5114
5115 msg_len = ssl_get_hs_total_len( ssl );
5116 frag_off = ssl_get_hs_frag_off( ssl );
5117 frag_len = ssl_get_hs_frag_len( ssl );
5118
5119 if( frag_off > msg_len )
5120 return( -1 );
5121
5122 if( frag_len > msg_len - frag_off )
5123 return( -1 );
5124
5125 if( frag_len + 12 > ssl->in_msglen )
5126 return( -1 );
5127
5128 return( 0 );
5129}
5130
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005131/*
5132 * Mark bits in bitmask (used for DTLS HS reassembly)
5133 */
5134static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
5135{
5136 unsigned int start_bits, end_bits;
5137
5138 start_bits = 8 - ( offset % 8 );
5139 if( start_bits != 8 )
5140 {
5141 size_t first_byte_idx = offset / 8;
5142
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02005143 /* Special case */
5144 if( len <= start_bits )
5145 {
5146 for( ; len != 0; len-- )
5147 mask[first_byte_idx] |= 1 << ( start_bits - len );
5148
5149 /* Avoid potential issues with offset or len becoming invalid */
5150 return;
5151 }
5152
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005153 offset += start_bits; /* Now offset % 8 == 0 */
5154 len -= start_bits;
5155
5156 for( ; start_bits != 0; start_bits-- )
5157 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
5158 }
5159
5160 end_bits = len % 8;
5161 if( end_bits != 0 )
5162 {
5163 size_t last_byte_idx = ( offset + len ) / 8;
5164
5165 len -= end_bits; /* Now len % 8 == 0 */
5166
5167 for( ; end_bits != 0; end_bits-- )
5168 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
5169 }
5170
5171 memset( mask + offset / 8, 0xFF, len / 8 );
5172}
5173
Andrzej Kurek0919b142020-07-06 15:28:59 -04005174#define BITMASK_CHECK_FAILED 0x75555555
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005175/*
5176 * Check that bitmask is full
5177 */
5178static int ssl_bitmask_check( unsigned char *mask, size_t len )
5179{
5180 size_t i;
5181
5182 for( i = 0; i < len / 8; i++ )
5183 if( mask[i] != 0xFF )
Andrzej Kurek0919b142020-07-06 15:28:59 -04005184 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005185
5186 for( i = 0; i < len % 8; i++ )
5187 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04005188 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005189
5190 return( 0 );
5191}
5192
Hanno Becker56e205e2018-08-16 09:06:12 +01005193/* msg_len does not include the handshake header */
Hanno Becker65dc8852018-08-23 09:40:49 +01005194static size_t ssl_get_reassembly_buffer_size( size_t msg_len,
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005195 unsigned add_bitmap )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005196{
Hanno Becker56e205e2018-08-16 09:06:12 +01005197 size_t alloc_len;
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005198
Hanno Becker56e205e2018-08-16 09:06:12 +01005199 alloc_len = 12; /* Handshake header */
5200 alloc_len += msg_len; /* Content buffer */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005201
Hanno Beckerd07df862018-08-16 09:14:58 +01005202 if( add_bitmap )
5203 alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap */
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02005204
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005205 return( alloc_len );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005206}
Hanno Becker56e205e2018-08-16 09:06:12 +01005207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005208#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005209
Hanno Beckercd9dcda2018-08-28 17:18:56 +01005210static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl )
Hanno Becker12555c62018-08-16 12:47:53 +01005211{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005212 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[1] ) );
Hanno Becker12555c62018-08-16 12:47:53 +01005213}
Hanno Beckere25e3b72018-08-16 09:30:53 +01005214
Simon Butcher99000142016-10-13 17:21:01 +01005215int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005216{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005217 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005218 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005219 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005220 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005221 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02005222 }
5223
Hanno Becker12555c62018-08-16 12:47:53 +01005224 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005225
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005226 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005227 " %d, type = %d, hslen = %d",
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01005228 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005230#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005231 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005232 {
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005233 int ret;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005234 unsigned int recv_msg_seq = (unsigned int)
5235 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005236
Hanno Becker44650b72018-08-16 12:51:11 +01005237 if( ssl_check_hs_header( ssl ) != 0 )
5238 {
5239 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
5240 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5241 }
5242
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005243 if( ssl->handshake != NULL &&
Hanno Beckerc76c6192017-06-06 10:03:17 +01005244 ( ( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
5245 recv_msg_seq != ssl->handshake->in_msg_seq ) ||
5246 ( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5247 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) ) )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005248 {
Hanno Becker9e1ec222018-08-15 15:54:43 +01005249 if( recv_msg_seq > ssl->handshake->in_msg_seq )
5250 {
5251 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
5252 recv_msg_seq,
5253 ssl->handshake->in_msg_seq ) );
5254 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5255 }
5256
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02005257 /* Retransmit only on last message from previous flight, to avoid
5258 * too many retransmissions.
5259 * Besides, No sane server ever retransmits HelloVerifyRequest */
5260 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005261 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005262 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005263 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005264 "message_seq = %d, start_of_flight = %d",
5265 recv_msg_seq,
5266 ssl->handshake->in_flight_start_seq ) );
5267
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005268 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005269 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005270 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005271 return( ret );
5272 }
5273 }
5274 else
5275 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005276 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02005277 "message_seq = %d, expected = %d",
5278 recv_msg_seq,
5279 ssl->handshake->in_msg_seq ) );
5280 }
5281
Hanno Becker90333da2017-10-10 11:27:13 +01005282 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005283 }
5284 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005285
Hanno Becker6d97ef52018-08-16 13:09:04 +01005286 /* Message reassembly is handled alongside buffering of future
5287 * messages; the commonality is that both handshake fragments and
Hanno Becker83ab41c2018-08-28 17:19:38 +01005288 * future messages cannot be forwarded immediately to the
Hanno Becker6d97ef52018-08-16 13:09:04 +01005289 * handshake logic layer. */
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04005290 if( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005291 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005292 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Hanno Becker6d97ef52018-08-16 13:09:04 +01005293 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005294 }
5295 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005296 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005297#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005298#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02005299 {
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005300 /* With TLS we don't handle fragmentation (for now) */
5301 if( ssl->in_msglen < ssl->in_hslen )
5302 {
5303 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
5304 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
5305 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005306 }
Manuel Pégourié-Gonnardec1c2222019-06-12 10:18:26 +02005307#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005308
Simon Butcher99000142016-10-13 17:21:01 +01005309 return( 0 );
5310}
5311
5312void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
5313{
Hanno Becker0271f962018-08-16 13:23:47 +01005314 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Simon Butcher99000142016-10-13 17:21:01 +01005315
Hanno Becker0271f962018-08-16 13:23:47 +01005316 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && hs != NULL )
Hanno Becker8a4b5902019-08-15 17:04:57 +01005317 mbedtls_ssl_update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005318
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005319 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005320#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005321 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005322 ssl->handshake != NULL )
5323 {
Hanno Becker0271f962018-08-16 13:23:47 +01005324 unsigned offset;
5325 mbedtls_ssl_hs_buffer *hs_buf;
Hanno Beckere25e3b72018-08-16 09:30:53 +01005326
Hanno Becker0271f962018-08-16 13:23:47 +01005327 /* Increment handshake sequence number */
5328 hs->in_msg_seq++;
5329
5330 /*
5331 * Clear up handshake buffering and reassembly structure.
5332 */
5333
5334 /* Free first entry */
Hanno Beckere605b192018-08-21 15:59:07 +01005335 ssl_buffering_free_slot( ssl, 0 );
Hanno Becker0271f962018-08-16 13:23:47 +01005336
5337 /* Shift all other entries */
Hanno Beckere605b192018-08-21 15:59:07 +01005338 for( offset = 0, hs_buf = &hs->buffering.hs[0];
5339 offset + 1 < MBEDTLS_SSL_MAX_BUFFERED_HS;
Hanno Becker0271f962018-08-16 13:23:47 +01005340 offset++, hs_buf++ )
5341 {
5342 *hs_buf = *(hs_buf + 1);
5343 }
5344
5345 /* Create a fresh last entry */
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02005346 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02005347 }
5348#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005349}
5350
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005351/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005352 * DTLS anti-replay: RFC 6347 4.1.2.6
5353 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005354 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
5355 * Bit n is set iff record number in_window_top - n has been seen.
5356 *
5357 * Usually, in_window_top is the last record number seen and the lsb of
5358 * in_window is set. The only exception is the initial state (record number 0
5359 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005360 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005361#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5362static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005363{
5364 ssl->in_window_top = 0;
5365 ssl->in_window = 0;
5366}
5367
5368static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
5369{
5370 return( ( (uint64_t) buf[0] << 40 ) |
5371 ( (uint64_t) buf[1] << 32 ) |
5372 ( (uint64_t) buf[2] << 24 ) |
5373 ( (uint64_t) buf[3] << 16 ) |
5374 ( (uint64_t) buf[4] << 8 ) |
5375 ( (uint64_t) buf[5] ) );
5376}
5377
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005378static int mbedtls_ssl_dtls_record_replay_check( mbedtls_ssl_context *ssl, uint8_t *record_in_ctr )
5379{
5380 int ret;
5381 unsigned char *original_in_ctr;
5382
5383 // save original in_ctr
5384 original_in_ctr = ssl->in_ctr;
5385
5386 // use counter from record
5387 ssl->in_ctr = record_in_ctr;
5388
5389 ret = mbedtls_ssl_dtls_replay_check( (mbedtls_ssl_context const *) ssl );
5390
5391 // restore the counter
5392 ssl->in_ctr = original_in_ctr;
5393
5394 return ret;
5395}
5396
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005397/*
5398 * Return 0 if sequence number is acceptable, -1 otherwise
5399 */
Hanno Beckerfc551722019-07-12 08:50:37 +01005400int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context const *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005401{
5402 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5403 uint64_t bit;
5404
Hanno Becker7f376f42019-06-12 16:20:48 +01005405 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5406 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5407 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005408 return( 0 );
Hanno Becker7f376f42019-06-12 16:20:48 +01005409 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005410
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005411 if( rec_seqnum > ssl->in_window_top )
5412 return( 0 );
5413
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005414 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005415
5416 if( bit >= 64 )
5417 return( -1 );
5418
5419 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
5420 return( -1 );
5421
5422 return( 0 );
5423}
5424
5425/*
5426 * Update replay window on new validated record
5427 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005428void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005429{
5430 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5431
Hanno Becker7f376f42019-06-12 16:20:48 +01005432 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5433 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5434 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005435 return;
Hanno Becker7f376f42019-06-12 16:20:48 +01005436 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005437
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005438 if( rec_seqnum > ssl->in_window_top )
5439 {
5440 /* Update window_top and the contents of the window */
5441 uint64_t shift = rec_seqnum - ssl->in_window_top;
5442
5443 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005444 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005445 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005446 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005447 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005448 ssl->in_window |= 1;
5449 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005450
5451 ssl->in_window_top = rec_seqnum;
5452 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005453 else
5454 {
5455 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005456 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005457
5458 if( bit < 64 ) /* Always true, but be extra sure */
5459 ssl->in_window |= (uint64_t) 1 << bit;
5460 }
5461}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005462#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005463
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005464#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005465/* Forward declaration */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005466static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
5467
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005468/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005469 * Without any SSL context, check if a datagram looks like a ClientHello with
5470 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01005471 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005472 *
5473 * - if cookie is valid, return 0
5474 * - if ClientHello looks superficially valid but cookie is not,
5475 * fill obuf and set olen, then
5476 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
5477 * - otherwise return a specific error code
5478 */
5479static int ssl_check_dtls_clihlo_cookie(
5480 mbedtls_ssl_cookie_write_t *f_cookie_write,
5481 mbedtls_ssl_cookie_check_t *f_cookie_check,
5482 void *p_cookie,
5483 const unsigned char *cli_id, size_t cli_id_len,
5484 const unsigned char *in, size_t in_len,
5485 unsigned char *obuf, size_t buf_len, size_t *olen )
5486{
5487 size_t sid_len, cookie_len;
5488 unsigned char *p;
5489
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005490 /*
5491 * Structure of ClientHello with record and handshake headers,
5492 * and expected values. We don't need to check a lot, more checks will be
5493 * done when actually parsing the ClientHello - skipping those checks
5494 * avoids code duplication and does not make cookie forging any easier.
5495 *
5496 * 0-0 ContentType type; copied, must be handshake
5497 * 1-2 ProtocolVersion version; copied
5498 * 3-4 uint16 epoch; copied, must be 0
5499 * 5-10 uint48 sequence_number; copied
5500 * 11-12 uint16 length; (ignored)
5501 *
5502 * 13-13 HandshakeType msg_type; (ignored)
5503 * 14-16 uint24 length; (ignored)
5504 * 17-18 uint16 message_seq; copied
5505 * 19-21 uint24 fragment_offset; copied, must be 0
5506 * 22-24 uint24 fragment_length; (ignored)
5507 *
5508 * 25-26 ProtocolVersion client_version; (ignored)
5509 * 27-58 Random random; (ignored)
5510 * 59-xx SessionID session_id; 1 byte len + sid_len content
5511 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
5512 * ...
5513 *
5514 * Minimum length is 61 bytes.
5515 */
5516 if( in_len < 61 ||
5517 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
5518 in[3] != 0 || in[4] != 0 ||
5519 in[19] != 0 || in[20] != 0 || in[21] != 0 )
5520 {
5521 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5522 }
5523
5524 sid_len = in[59];
5525 if( sid_len > in_len - 61 )
5526 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5527
5528 cookie_len = in[60 + sid_len];
5529 if( cookie_len > in_len - 60 )
5530 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5531
5532 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
5533 cli_id, cli_id_len ) == 0 )
5534 {
5535 /* Valid cookie */
5536 return( 0 );
5537 }
5538
5539 /*
5540 * If we get here, we've got an invalid cookie, let's prepare HVR.
5541 *
5542 * 0-0 ContentType type; copied
5543 * 1-2 ProtocolVersion version; copied
5544 * 3-4 uint16 epoch; copied
5545 * 5-10 uint48 sequence_number; copied
5546 * 11-12 uint16 length; olen - 13
5547 *
5548 * 13-13 HandshakeType msg_type; hello_verify_request
5549 * 14-16 uint24 length; olen - 25
5550 * 17-18 uint16 message_seq; copied
5551 * 19-21 uint24 fragment_offset; copied
5552 * 22-24 uint24 fragment_length; olen - 25
5553 *
5554 * 25-26 ProtocolVersion server_version; 0xfe 0xff
5555 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
5556 *
5557 * Minimum length is 28.
5558 */
5559 if( buf_len < 28 )
5560 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5561
5562 /* Copy most fields and adapt others */
Teppo Järvelin91d79382019-10-02 09:09:31 +03005563 mbedtls_platform_memcpy( obuf, in, 25 );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005564 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
5565 obuf[25] = 0xfe;
5566 obuf[26] = 0xff;
5567
5568 /* Generate and write actual cookie */
5569 p = obuf + 28;
5570 if( f_cookie_write( p_cookie,
5571 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
5572 {
5573 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5574 }
5575
5576 *olen = p - obuf;
5577
5578 /* Go back and fill length fields */
5579 obuf[27] = (unsigned char)( *olen - 28 );
5580
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005581 (void)mbedtls_platform_put_uint24_be( &obuf[14], ( *olen - 25 ) );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005582 obuf[22] = obuf[14];
5583 obuf[23] = obuf[15];
5584 obuf[24] = obuf[16];
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005585
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005586 (void)mbedtls_platform_put_uint16_be( &obuf[11], ( *olen - 13 ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005587
5588 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
5589}
5590
5591/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005592 * Handle possible client reconnect with the same UDP quadruplet
5593 * (RFC 6347 Section 4.2.8).
5594 *
5595 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
5596 * that looks like a ClientHello.
5597 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005598 * - if the input looks like a ClientHello without cookies,
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005599 * send back HelloVerifyRequest, then return 0
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005600 * - if the input looks like a ClientHello with a valid cookie,
5601 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02005602 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005603 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005604 *
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005605 * This function is called (through ssl_check_client_reconnect()) when an
5606 * unexpected record is found in ssl_get_next_record(), which will discard the
5607 * record if we return 0, and bubble up the return value otherwise (this
5608 * includes the case of MBEDTLS_ERR_SSL_CLIENT_RECONNECT and of unexpected
5609 * errors, and is the right thing to do in both cases).
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005610 */
5611static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
5612{
5613 int ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005614 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005615
Hanno Becker87b56262019-07-10 14:37:41 +01005616 if( ssl->conf->f_cookie_write == NULL ||
5617 ssl->conf->f_cookie_check == NULL )
5618 {
5619 /* If we can't use cookies to verify reachability of the peer,
5620 * drop the record. */
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005621 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no cookie callbacks, "
5622 "can't check reconnect validity" ) );
Hanno Becker87b56262019-07-10 14:37:41 +01005623 return( 0 );
5624 }
5625
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005626 ret = ssl_check_dtls_clihlo_cookie(
5627 ssl->conf->f_cookie_write,
5628 ssl->conf->f_cookie_check,
5629 ssl->conf->p_cookie,
5630 ssl->cli_id, ssl->cli_id_len,
5631 ssl->in_buf, ssl->in_left,
Angus Grattond8213d02016-05-25 20:56:48 +10005632 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005633
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005634 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
5635
5636 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005637 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005638 int send_ret;
5639 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
5640 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
5641 ssl->out_buf, len );
Brian J Murray1903fb32016-11-06 04:45:15 -08005642 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005643 * If the error is permanent we'll catch it later,
5644 * if it's not, then hopefully it'll work next time. */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005645 send_ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, ssl->out_buf, len );
5646 MBEDTLS_SSL_DEBUG_RET( 2, "mbedtls_ssl_get_send", send_ret );
5647 (void) send_ret;
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005648 return( 0 );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005649 }
5650
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005651 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005652 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005653 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005654 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
5655 {
5656 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
5657 return( ret );
5658 }
5659
5660 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005661 }
5662
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005663 return( ret );
5664}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005665#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005666
Hanno Becker46483f12019-05-03 13:25:54 +01005667static int ssl_check_record_type( uint8_t record_type )
5668{
5669 if( record_type != MBEDTLS_SSL_MSG_HANDSHAKE &&
5670 record_type != MBEDTLS_SSL_MSG_ALERT &&
5671 record_type != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
5672 record_type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
5673 {
5674 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5675 }
5676
5677 return( 0 );
5678}
5679
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005680/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005681 * ContentType type;
5682 * ProtocolVersion version;
5683 * uint16 epoch; // DTLS only
5684 * uint48 sequence_number; // DTLS only
5685 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005686 *
5687 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00005688 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005689 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
5690 *
5691 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00005692 * 1. proceed with the record if this function returns 0
5693 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
5694 * 3. return CLIENT_RECONNECT if this function return that value
5695 * 4. drop the whole datagram if this function returns anything else.
5696 * Point 2 is needed when the peer is resending, and we have already received
5697 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005698 */
Hanno Becker21fc61c2019-07-12 11:10:16 +01005699static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005700 unsigned char *buf,
5701 size_t len,
5702 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00005703{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005704 int major_ver, minor_ver;
Paul Bakker5121ce52009-01-03 21:22:43 +00005705
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005706 size_t const rec_hdr_type_offset = 0;
5707 size_t const rec_hdr_type_len = 1;
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02005708
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005709 size_t const rec_hdr_version_offset = rec_hdr_type_offset +
5710 rec_hdr_type_len;
5711 size_t const rec_hdr_version_len = 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00005712
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005713 size_t const rec_hdr_ctr_len = 8;
5714#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker61817612019-07-25 10:13:02 +01005715 uint32_t rec_epoch;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005716 size_t const rec_hdr_ctr_offset = rec_hdr_version_offset +
5717 rec_hdr_version_len;
5718
Hanno Beckera5a2b082019-05-15 14:03:01 +01005719#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005720 size_t const rec_hdr_cid_offset = rec_hdr_ctr_offset +
5721 rec_hdr_ctr_len;
Hanno Becker61817612019-07-25 10:13:02 +01005722 size_t rec_hdr_cid_len = 0;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005723#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5724#endif /* MBEDTLS_SSL_PROTO_DTLS */
5725
5726 size_t rec_hdr_len_offset; /* To be determined */
5727 size_t const rec_hdr_len_len = 2;
5728
5729 /*
5730 * Check minimum lengths for record header.
5731 */
5732
5733#if defined(MBEDTLS_SSL_PROTO_DTLS)
5734 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5735 {
5736 rec_hdr_len_offset = rec_hdr_ctr_offset + rec_hdr_ctr_len;
5737 }
5738 MBEDTLS_SSL_TRANSPORT_ELSE
5739#endif /* MBEDTLS_SSL_PROTO_DTLS */
5740#if defined(MBEDTLS_SSL_PROTO_TLS)
5741 {
5742 rec_hdr_len_offset = rec_hdr_version_offset + rec_hdr_version_len;
5743 }
5744#endif /* MBEDTLS_SSL_PROTO_DTLS */
5745
5746 if( len < rec_hdr_len_offset + rec_hdr_len_len )
5747 {
5748 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header of length %u",
5749 (unsigned) len,
5750 (unsigned)( rec_hdr_len_len + rec_hdr_len_len ) ) );
5751 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5752 }
5753
5754 /*
5755 * Parse and validate record content type
5756 */
5757
5758 rec->type = buf[ rec_hdr_type_offset ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005759
5760 /* Check record content type */
5761#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5762 rec->cid_len = 0;
5763
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005764 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005765 mbedtls_ssl_conf_get_cid_len( ssl->conf ) != 0 &&
5766 rec->type == MBEDTLS_SSL_MSG_CID )
Hanno Becker8b09b732019-05-08 12:03:28 +01005767 {
5768 /* Shift pointers to account for record header including CID
5769 * struct {
5770 * ContentType special_type = tls12_cid;
5771 * ProtocolVersion version;
5772 * uint16 epoch;
5773 * uint48 sequence_number;
Hanno Becker3b2bf5b2019-05-23 17:03:19 +01005774 * opaque cid[cid_length]; // Additional field compared to
5775 * // default DTLS record format
Hanno Becker8b09b732019-05-08 12:03:28 +01005776 * uint16 length;
5777 * opaque enc_content[DTLSCiphertext.length];
5778 * } DTLSCiphertext;
5779 */
5780
5781 /* So far, we only support static CID lengths
5782 * fixed in the configuration. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005783 rec_hdr_cid_len = mbedtls_ssl_conf_get_cid_len( ssl->conf );
5784 rec_hdr_len_offset += rec_hdr_cid_len;
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005785
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005786 if( len < rec_hdr_len_offset + rec_hdr_len_len )
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005787 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005788 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header including CID, length %u",
5789 (unsigned) len,
5790 (unsigned)( rec_hdr_len_offset + rec_hdr_len_len ) ) );
Hanno Becker29823462019-07-10 14:53:43 +01005791 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005792 }
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005793
Manuel Pégourié-Gonnardf3a15b32019-08-02 10:17:15 +02005794 /* configured CID len is guaranteed at most 255, see
5795 * MBEDTLS_SSL_CID_OUT_LEN_MAX in check_config.h */
5796 rec->cid_len = (uint8_t) rec_hdr_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005797 /* Not using more secure mbedtls_platform_memcpy as cid is public */
5798 memcpy( rec->cid, buf + rec_hdr_cid_offset, rec_hdr_cid_len );
Hanno Becker8b09b732019-05-08 12:03:28 +01005799 }
5800 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01005801#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005802 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005803 if( ssl_check_record_type( rec->type ) )
5804 {
Hanno Becker03e2db62019-07-12 14:40:00 +01005805 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type %u",
5806 (unsigned) rec->type ) );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005807 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5808 }
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005809 }
5810
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005811 /*
5812 * Parse and validate record version
5813 */
5814
Hanno Becker8061c6e2019-07-26 08:07:03 +01005815 rec->ver[0] = buf[ rec_hdr_version_offset + 0 ];
5816 rec->ver[1] = buf[ rec_hdr_version_offset + 1 ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005817 mbedtls_ssl_read_version( &major_ver, &minor_ver,
5818 ssl->conf->transport,
Hanno Becker8061c6e2019-07-26 08:07:03 +01005819 &rec->ver[0] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005820
Hanno Becker2881d802019-05-22 14:44:53 +01005821 if( major_ver != mbedtls_ssl_get_major_ver( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005822 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005823 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
5824 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005825 }
5826
Hanno Becker7bcf2b52019-07-26 09:02:40 +01005827 if( mbedtls_ssl_ver_gt( minor_ver,
5828 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ) ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005829 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005830 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
5831 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005832 }
5833
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005834 /*
5835 * Parse/Copy record sequence number.
5836 */
Hanno Becker8b09b732019-05-08 12:03:28 +01005837
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005838#if defined(MBEDTLS_SSL_PROTO_DTLS)
5839 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5840 {
5841 /* Copy explicit record sequence number from input buffer. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005842 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5843 memcpy( &rec->ctr[0], buf + rec_hdr_ctr_offset,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005844 rec_hdr_ctr_len );
5845 }
5846 MBEDTLS_SSL_TRANSPORT_ELSE
5847#endif /* MBEDTLS_SSL_PROTO_DTLS */
5848#if defined(MBEDTLS_SSL_PROTO_TLS)
5849 {
5850 /* Copy implicit record sequence number from SSL context structure. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005851 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5852 memcpy( &rec->ctr[0], ssl->in_ctr, rec_hdr_ctr_len );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005853 }
5854#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker8b09b732019-05-08 12:03:28 +01005855
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005856 /*
5857 * Parse record length.
5858 */
5859
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005860 rec->data_offset = rec_hdr_len_offset + rec_hdr_len_len;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005861 rec->data_len = mbedtls_platform_get_uint16_be( &buf[rec_hdr_len_offset] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005862 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", buf, rec->data_offset );
5863
Hanno Becker8b09b732019-05-08 12:03:28 +01005864 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
Hanno Beckerd8f7c4a2019-05-23 17:03:44 +01005865 "version = [%d:%d], msglen = %d",
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005866 rec->type,
5867 major_ver, minor_ver, rec->data_len ) );
5868
5869 rec->buf = buf;
5870 rec->buf_len = rec->data_offset + rec->data_len;
Hanno Becker8b09b732019-05-08 12:03:28 +01005871
Hanno Beckerec014082019-07-26 08:20:27 +01005872 if( rec->data_len == 0 )
5873 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5874
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005875 /*
Hanno Becker52c6dc62017-05-26 16:07:36 +01005876 * DTLS-related tests.
5877 * Check epoch before checking length constraint because
5878 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
5879 * message gets duplicated before the corresponding Finished message,
5880 * the second ChangeCipherSpec should be discarded because it belongs
5881 * to an old epoch, but not because its length is shorter than
5882 * the minimum record length for packets using the new record transform.
5883 * Note that these two kinds of failures are handled differently,
5884 * as an unexpected record is silently skipped but an invalid
5885 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005886 */
5887#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005888 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005889 {
Arto Kinnunena3fa06e2019-09-09 12:22:51 +03005890 rec_epoch = (uint32_t)mbedtls_platform_get_uint16_be( rec->ctr );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005891
Hanno Beckere0452772019-07-10 17:12:07 +01005892 /* Check that the datagram is large enough to contain a record
5893 * of the advertised length. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005894 if( len < rec->data_offset + rec->data_len )
Hanno Beckere0452772019-07-10 17:12:07 +01005895 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005896 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Datagram of length %u too small to contain record of advertised length %u.",
5897 (unsigned) len,
5898 (unsigned)( rec->data_offset + rec->data_len ) ) );
Hanno Beckere0452772019-07-10 17:12:07 +01005899 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5900 }
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005901
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005902 /* Records from other, non-matching epochs are silently discarded.
5903 * (The case of same-port Client reconnects must be considered in
5904 * the caller). */
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005905 if( rec_epoch != ssl->in_epoch )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005906 {
5907 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
5908 "expected %d, received %d",
5909 ssl->in_epoch, rec_epoch ) );
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005910
5911 /* Records from the next epoch are considered for buffering
5912 * (concretely: early Finished messages). */
5913 if( rec_epoch == (unsigned) ssl->in_epoch + 1 )
5914 {
5915 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
5916 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5917 }
5918
Hanno Becker87b56262019-07-10 14:37:41 +01005919 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005920 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005921#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005922 /* For records from the correct epoch, check whether their
5923 * sequence number has been seen before. */
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005924 else if( mbedtls_ssl_dtls_record_replay_check( (mbedtls_ssl_context *) ssl,
5925 &rec->ctr[0] ) != 0 )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005926 {
5927 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
5928 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
5929 }
5930#endif
5931 }
5932#endif /* MBEDTLS_SSL_PROTO_DTLS */
5933
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005934 return( 0 );
5935}
Paul Bakker5121ce52009-01-03 21:22:43 +00005936
Hanno Becker87b56262019-07-10 14:37:41 +01005937
5938#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
5939static int ssl_check_client_reconnect( mbedtls_ssl_context *ssl )
5940{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005941 unsigned int rec_epoch = (unsigned int)
5942 mbedtls_platform_get_uint16_be( &ssl->in_ctr[0] );
Hanno Becker87b56262019-07-10 14:37:41 +01005943
5944 /*
5945 * Check for an epoch 0 ClientHello. We can't use in_msg here to
5946 * access the first byte of record content (handshake type), as we
5947 * have an active transform (possibly iv_len != 0), so use the
5948 * fact that the record header len is 13 instead.
5949 */
5950 if( rec_epoch == 0 &&
5951 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
5952 MBEDTLS_SSL_IS_SERVER &&
5953 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5954 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
5955 ssl->in_left > 13 &&
5956 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
5957 {
5958 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
5959 "from the same port" ) );
5960 return( ssl_handle_possible_reconnect( ssl ) );
5961 }
5962
5963 return( 0 );
5964}
5965#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
5966
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005967/*
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01005968 * If applicable, decrypt record content
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005969 */
Hanno Beckera89610a2019-07-11 13:07:45 +01005970static int ssl_prepare_record_content( mbedtls_ssl_context *ssl,
5971 mbedtls_record *rec )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005972{
5973 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02005974
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005975 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
Hanno Beckera89610a2019-07-11 13:07:45 +01005976 rec->buf, rec->buf_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00005977
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005978#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
5979 if( mbedtls_ssl_hw_record_read != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00005980 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005981 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00005982
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005983 ret = mbedtls_ssl_hw_record_read( ssl );
5984 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00005985 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005986 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
5987 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00005988 }
Paul Bakkerc7878112012-12-19 14:41:14 +01005989
5990 if( ret == 0 )
5991 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00005992 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005993#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker48916f92012-09-16 19:57:18 +00005994 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005995 {
Hanno Becker106f3da2019-07-12 09:35:58 +01005996 unsigned char const old_msg_type = rec->type;
5997
Hanno Becker611a83b2018-01-03 14:27:32 +00005998 if( ( ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in,
Hanno Beckera89610a2019-07-11 13:07:45 +01005999 rec ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006000 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006001 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Hanno Beckere8eff9a2019-05-14 11:30:10 +01006002
Hanno Beckera5a2b082019-05-15 14:03:01 +01006003#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +01006004 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID &&
Hanno Beckere0200da2019-06-13 09:23:43 +01006005 mbedtls_ssl_conf_get_ignore_unexpected_cid( ssl->conf )
6006 == MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
Hanno Beckere8eff9a2019-05-14 11:30:10 +01006007 {
Hanno Becker675c4d62019-05-24 10:11:06 +01006008 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ignoring unexpected CID" ) );
Hanno Becker687e0fb2019-05-08 13:02:55 +01006009 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
Hanno Beckere8eff9a2019-05-14 11:30:10 +01006010 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01006011#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker687e0fb2019-05-08 13:02:55 +01006012
Paul Bakker5121ce52009-01-03 21:22:43 +00006013 return( ret );
6014 }
6015
Hanno Becker106f3da2019-07-12 09:35:58 +01006016 if( old_msg_type != rec->type )
Hanno Becker93012fe2018-08-07 14:30:18 +01006017 {
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006018 MBEDTLS_SSL_DEBUG_MSG( 4, ( "record type after decrypt (before %d): %d",
Hanno Becker106f3da2019-07-12 09:35:58 +01006019 old_msg_type, rec->type ) );
Hanno Becker93012fe2018-08-07 14:30:18 +01006020 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006021
Paul Bakker5121ce52009-01-03 21:22:43 +00006022 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Hanno Becker106f3da2019-07-12 09:35:58 +01006023 rec->buf + rec->data_offset, rec->data_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00006024
Hanno Beckera5a2b082019-05-15 14:03:01 +01006025#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006026 /* We have already checked the record content type
6027 * in ssl_parse_record_header(), failing or silently
6028 * dropping the record in the case of an unknown type.
6029 *
6030 * Since with the use of CIDs, the record content type
6031 * might change during decryption, re-check the record
6032 * content type, but treat a failure as fatal this time. */
Hanno Becker106f3da2019-07-12 09:35:58 +01006033 if( ssl_check_record_type( rec->type ) )
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006034 {
6035 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
6036 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6037 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01006038#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerff3e9c22019-05-08 11:57:13 +01006039
Hanno Becker106f3da2019-07-12 09:35:58 +01006040 if( rec->data_len == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006041 {
6042#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker2881d802019-05-22 14:44:53 +01006043 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_3
Hanno Becker106f3da2019-07-12 09:35:58 +01006044 && rec->type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006045 {
6046 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
6047 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
6048 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6049 }
6050#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6051
6052 ssl->nb_zero++;
6053
6054 /*
6055 * Three or more empty messages may be a DoS attack
6056 * (excessive CPU consumption).
6057 */
6058 if( ssl->nb_zero > 3 )
6059 {
6060 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Hanno Becker70463db2019-05-08 10:38:32 +01006061 "messages, possible DoS attack" ) );
6062 /* Treat the records as if they were not properly authenticated,
6063 * thereby failing the connection if we see more than allowed
6064 * by the configured bad MAC threshold. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00006065 return( MBEDTLS_ERR_SSL_INVALID_MAC );
6066 }
6067 }
6068 else
6069 ssl->nb_zero = 0;
6070
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006071 /* Only needed for TLS, as with DTLS in_ctr is read from the header */
6072#if defined(MBEDTLS_SSL_PROTO_TLS)
6073 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006074 {
6075 unsigned i;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006076 for( i = 8; i > 0; i-- )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006077 if( ++ssl->in_ctr[i - 1] != 0 )
6078 break;
6079
Manuel Pégourié-Gonnard8794a422019-06-11 10:04:57 +02006080 /* The loop goes to its end only if the counter is wrapping around */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006081 if( i == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00006082 {
6083 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
6084 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
6085 }
6086 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006087#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker4c6876b2017-12-27 21:28:58 +00006088
Paul Bakker5121ce52009-01-03 21:22:43 +00006089 }
6090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006091#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006092 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02006093 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006094 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02006095 }
6096#endif
6097
Hanno Beckerf0242852019-07-09 17:30:02 +01006098 /* Check actual (decrypted) record content length against
6099 * configured maximum. */
6100 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
6101 {
6102 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
6103 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6104 }
6105
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006106 return( 0 );
6107}
6108
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006109static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006110
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006111/*
6112 * Read a record.
6113 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02006114 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
6115 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
6116 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006117 */
Hanno Becker1097b342018-08-15 14:09:41 +01006118
6119/* Helper functions for mbedtls_ssl_read_record(). */
6120static int ssl_consume_current_message( mbedtls_ssl_context *ssl );
Hanno Beckere74d5562018-08-15 14:26:08 +01006121static int ssl_get_next_record( mbedtls_ssl_context *ssl );
6122static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl );
Hanno Becker4162b112018-08-15 14:05:04 +01006123
Hanno Becker327c93b2018-08-15 13:56:18 +01006124int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
Hanno Becker3a0aad12018-08-20 09:44:02 +01006125 unsigned update_hs_digest )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006126{
6127 int ret;
6128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006129 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006130
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006131 if( ssl->keep_current_message == 0 )
6132 {
6133 do {
Simon Butcher99000142016-10-13 17:21:01 +01006134
Hanno Becker26994592018-08-15 14:14:59 +01006135 ret = ssl_consume_current_message( ssl );
Hanno Becker90333da2017-10-10 11:27:13 +01006136 if( ret != 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006137 return( ret );
Hanno Becker26994592018-08-15 14:14:59 +01006138
Hanno Beckere74d5562018-08-15 14:26:08 +01006139 if( ssl_record_is_in_progress( ssl ) == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006140 {
Hanno Becker40f50842018-08-15 14:48:01 +01006141#if defined(MBEDTLS_SSL_PROTO_DTLS)
6142 int have_buffered = 0;
Hanno Beckere74d5562018-08-15 14:26:08 +01006143
Hanno Becker40f50842018-08-15 14:48:01 +01006144 /* We only check for buffered messages if the
6145 * current datagram is fully consumed. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006146 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006147 ssl_next_record_is_in_datagram( ssl ) == 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006148 {
Hanno Becker40f50842018-08-15 14:48:01 +01006149 if( ssl_load_buffered_message( ssl ) == 0 )
6150 have_buffered = 1;
6151 }
6152
6153 if( have_buffered == 0 )
6154#endif /* MBEDTLS_SSL_PROTO_DTLS */
6155 {
6156 ret = ssl_get_next_record( ssl );
6157 if( ret == MBEDTLS_ERR_SSL_CONTINUE_PROCESSING )
6158 continue;
6159
6160 if( ret != 0 )
6161 {
Hanno Beckerc573ac32018-08-28 17:15:25 +01006162 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
Hanno Becker42a6b042019-07-26 07:25:20 +01006163 ssl_send_pending_fatal_alert( ssl );
Hanno Becker40f50842018-08-15 14:48:01 +01006164 return( ret );
6165 }
Hanno Beckere74d5562018-08-15 14:26:08 +01006166 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006167 }
6168
6169 ret = mbedtls_ssl_handle_message_type( ssl );
6170
Hanno Becker40f50842018-08-15 14:48:01 +01006171#if defined(MBEDTLS_SSL_PROTO_DTLS)
6172 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6173 {
6174 /* Buffer future message */
6175 ret = ssl_buffer_message( ssl );
6176 if( ret != 0 )
6177 return( ret );
6178
6179 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
6180 }
6181#endif /* MBEDTLS_SSL_PROTO_DTLS */
6182
Hanno Becker90333da2017-10-10 11:27:13 +01006183 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret ||
6184 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING == ret );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006185
6186 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01006187 {
Hanno Becker05c4fc82017-11-09 14:34:06 +00006188 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
Simon Butcher99000142016-10-13 17:21:01 +01006189 return( ret );
6190 }
6191
Hanno Becker327c93b2018-08-15 13:56:18 +01006192 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
Hanno Becker3a0aad12018-08-20 09:44:02 +01006193 update_hs_digest == 1 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006194 {
6195 mbedtls_ssl_update_handshake_status( ssl );
6196 }
Simon Butcher99000142016-10-13 17:21:01 +01006197 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006198 else
Simon Butcher99000142016-10-13 17:21:01 +01006199 {
Hanno Becker02f59072018-08-15 14:00:24 +01006200 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01006201 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01006202 }
6203
6204 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
6205
6206 return( 0 );
6207}
6208
Hanno Becker40f50842018-08-15 14:48:01 +01006209#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006210static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
Simon Butcher99000142016-10-13 17:21:01 +01006211{
Hanno Becker40f50842018-08-15 14:48:01 +01006212 if( ssl->in_left > ssl->next_record_offset )
6213 return( 1 );
Simon Butcher99000142016-10-13 17:21:01 +01006214
Hanno Becker40f50842018-08-15 14:48:01 +01006215 return( 0 );
6216}
6217
6218static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
6219{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006220 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker37f95322018-08-16 13:55:32 +01006221 mbedtls_ssl_hs_buffer * hs_buf;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006222 int ret = 0;
6223
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006224 if( hs == NULL )
6225 return( -1 );
6226
Hanno Beckere00ae372018-08-20 09:39:42 +01006227 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
6228
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006229 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC ||
6230 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
6231 {
6232 /* Check if we have seen a ChangeCipherSpec before.
6233 * If yes, synthesize a CCS record. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006234 if( !hs->buffering.seen_ccs )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006235 {
6236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
6237 ret = -1;
Hanno Becker0d4b3762018-08-20 09:36:59 +01006238 goto exit;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006239 }
6240
Hanno Becker39b8bc92018-08-28 17:17:13 +01006241 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006242 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
6243 ssl->in_msglen = 1;
6244 ssl->in_msg[0] = 1;
6245
6246 /* As long as they are equal, the exact value doesn't matter. */
6247 ssl->in_left = 0;
6248 ssl->next_record_offset = 0;
6249
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006250 hs->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006251 goto exit;
6252 }
Hanno Becker37f95322018-08-16 13:55:32 +01006253
Hanno Beckerb8f50142018-08-28 10:01:34 +01006254#if defined(MBEDTLS_DEBUG_C)
Hanno Becker37f95322018-08-16 13:55:32 +01006255 /* Debug only */
6256 {
6257 unsigned offset;
6258 for( offset = 1; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
6259 {
6260 hs_buf = &hs->buffering.hs[offset];
6261 if( hs_buf->is_valid == 1 )
6262 {
6263 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
6264 hs->in_msg_seq + offset,
Hanno Beckera591c482018-08-28 17:20:00 +01006265 hs_buf->is_complete ? "fully" : "partially" ) );
Hanno Becker37f95322018-08-16 13:55:32 +01006266 }
6267 }
6268 }
Hanno Beckerb8f50142018-08-28 10:01:34 +01006269#endif /* MBEDTLS_DEBUG_C */
Hanno Becker37f95322018-08-16 13:55:32 +01006270
6271 /* Check if we have buffered and/or fully reassembled the
6272 * next handshake message. */
6273 hs_buf = &hs->buffering.hs[0];
6274 if( ( hs_buf->is_valid == 1 ) && ( hs_buf->is_complete == 1 ) )
6275 {
6276 /* Synthesize a record containing the buffered HS message. */
Arto Kinnunen84eeb4f2019-09-10 10:32:30 +03006277 size_t msg_len = mbedtls_platform_get_uint24_be( &hs_buf->data[1] );
Hanno Becker37f95322018-08-16 13:55:32 +01006278
6279 /* Double-check that we haven't accidentally buffered
6280 * a message that doesn't fit into the input buffer. */
6281 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
6282 {
6283 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6284 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6285 }
6286
6287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
6288 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
6289 hs_buf->data, msg_len + 12 );
6290
6291 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6292 ssl->in_hslen = msg_len + 12;
6293 ssl->in_msglen = msg_len + 12;
Teppo Järvelin91d79382019-10-02 09:09:31 +03006294 mbedtls_platform_memcpy( ssl->in_msg, hs_buf->data, ssl->in_hslen );
Hanno Becker37f95322018-08-16 13:55:32 +01006295
6296 ret = 0;
6297 goto exit;
6298 }
6299 else
6300 {
6301 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
6302 hs->in_msg_seq ) );
6303 }
6304
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006305 ret = -1;
6306
6307exit:
6308
6309 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
6310 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006311}
6312
Hanno Beckera02b0b42018-08-21 17:20:27 +01006313static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
6314 size_t desired )
6315{
6316 int offset;
6317 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006318 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
6319 (unsigned) desired ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006320
Hanno Becker01315ea2018-08-21 17:22:17 +01006321 /* Get rid of future records epoch first, if such exist. */
6322 ssl_free_buffered_record( ssl );
6323
6324 /* Check if we have enough space available now. */
6325 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6326 hs->buffering.total_bytes_buffered ) )
6327 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006328 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
Hanno Becker01315ea2018-08-21 17:22:17 +01006329 return( 0 );
6330 }
Hanno Beckera02b0b42018-08-21 17:20:27 +01006331
Hanno Becker4f432ad2018-08-28 10:02:32 +01006332 /* We don't have enough space to buffer the next expected handshake
6333 * message. Remove buffers used for future messages to gain space,
6334 * starting with the most distant one. */
Hanno Beckera02b0b42018-08-21 17:20:27 +01006335 for( offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1;
6336 offset >= 0; offset-- )
6337 {
6338 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
6339 offset ) );
6340
Hanno Beckerb309b922018-08-23 13:18:05 +01006341 ssl_buffering_free_slot( ssl, (uint8_t) offset );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006342
6343 /* Check if we have enough space available now. */
6344 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6345 hs->buffering.total_bytes_buffered ) )
6346 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006347 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01006348 return( 0 );
6349 }
6350 }
6351
6352 return( -1 );
6353}
6354
Hanno Becker40f50842018-08-15 14:48:01 +01006355static int ssl_buffer_message( mbedtls_ssl_context *ssl )
6356{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006357 int ret = 0;
6358 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6359
6360 if( hs == NULL )
6361 return( 0 );
6362
6363 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
6364
6365 switch( ssl->in_msgtype )
6366 {
6367 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC:
6368 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
Hanno Beckere678eaa2018-08-21 14:57:46 +01006369
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006370 hs->buffering.seen_ccs = 1;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006371 break;
6372
6373 case MBEDTLS_SSL_MSG_HANDSHAKE:
Hanno Becker37f95322018-08-16 13:55:32 +01006374 {
6375 unsigned recv_msg_seq_offset;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03006376 unsigned recv_msg_seq = (unsigned)
6377 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03006378
Hanno Becker37f95322018-08-16 13:55:32 +01006379 mbedtls_ssl_hs_buffer *hs_buf;
6380 size_t msg_len = ssl->in_hslen - 12;
6381
6382 /* We should never receive an old handshake
6383 * message - double-check nonetheless. */
6384 if( recv_msg_seq < ssl->handshake->in_msg_seq )
6385 {
6386 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6387 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6388 }
6389
6390 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
6391 if( recv_msg_seq_offset >= MBEDTLS_SSL_MAX_BUFFERED_HS )
6392 {
6393 /* Silently ignore -- message too far in the future */
6394 MBEDTLS_SSL_DEBUG_MSG( 2,
6395 ( "Ignore future HS message with sequence number %u, "
6396 "buffering window %u - %u",
6397 recv_msg_seq, ssl->handshake->in_msg_seq,
6398 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - 1 ) );
6399
6400 goto exit;
6401 }
6402
6403 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
6404 recv_msg_seq, recv_msg_seq_offset ) );
6405
6406 hs_buf = &hs->buffering.hs[ recv_msg_seq_offset ];
6407
6408 /* Check if the buffering for this seq nr has already commenced. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006409 if( !hs_buf->is_valid )
Hanno Becker37f95322018-08-16 13:55:32 +01006410 {
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006411 size_t reassembly_buf_sz;
6412
Hanno Becker37f95322018-08-16 13:55:32 +01006413 hs_buf->is_fragmented =
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04006414 ( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT );
Hanno Becker37f95322018-08-16 13:55:32 +01006415
6416 /* We copy the message back into the input buffer
6417 * after reassembly, so check that it's not too large.
6418 * This is an implementation-specific limitation
6419 * and not one from the standard, hence it is not
6420 * checked in ssl_check_hs_header(). */
Hanno Becker96a6c692018-08-21 15:56:03 +01006421 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker37f95322018-08-16 13:55:32 +01006422 {
6423 /* Ignore message */
6424 goto exit;
6425 }
6426
Hanno Beckere0b150f2018-08-21 15:51:03 +01006427 /* Check if we have enough space to buffer the message. */
6428 if( hs->buffering.total_bytes_buffered >
6429 MBEDTLS_SSL_DTLS_MAX_BUFFERING )
6430 {
6431 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6432 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6433 }
6434
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006435 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
6436 hs_buf->is_fragmented );
Hanno Beckere0b150f2018-08-21 15:51:03 +01006437
6438 if( reassembly_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6439 hs->buffering.total_bytes_buffered ) )
6440 {
6441 if( recv_msg_seq_offset > 0 )
6442 {
6443 /* If we can't buffer a future message because
6444 * of space limitations -- ignore. */
6445 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
6446 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6447 (unsigned) hs->buffering.total_bytes_buffered ) );
6448 goto exit;
6449 }
Hanno Beckere1801392018-08-21 16:51:05 +01006450 else
6451 {
6452 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- attempt to make space by freeing buffered future messages\n",
6453 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6454 (unsigned) hs->buffering.total_bytes_buffered ) );
6455 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006456
Hanno Beckera02b0b42018-08-21 17:20:27 +01006457 if( ssl_buffer_make_space( ssl, reassembly_buf_sz ) != 0 )
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006458 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006459 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %u (%u with bitmap) would exceed the compile-time limit %u (already %u bytes buffered) -- fail\n",
6460 (unsigned) msg_len,
6461 (unsigned) reassembly_buf_sz,
6462 MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Beckere0b150f2018-08-21 15:51:03 +01006463 (unsigned) hs->buffering.total_bytes_buffered ) );
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006464 ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
6465 goto exit;
6466 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006467 }
6468
6469 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
6470 msg_len ) );
6471
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006472 hs_buf->data = mbedtls_calloc( 1, reassembly_buf_sz );
6473 if( hs_buf->data == NULL )
Hanno Becker37f95322018-08-16 13:55:32 +01006474 {
Hanno Beckere0b150f2018-08-21 15:51:03 +01006475 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
Hanno Becker37f95322018-08-16 13:55:32 +01006476 goto exit;
6477 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006478 hs_buf->data_len = reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006479
6480 /* Prepare final header: copy msg_type, length and message_seq,
6481 * then add standardised fragment_offset and fragment_length */
Piotr Nowicki305a5ec2020-08-10 17:42:18 +02006482 if( mbedtls_platform_memcpy( hs_buf->data, ssl->in_msg, 6 ) !=
6483 hs_buf->data )
6484 {
6485 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6486 goto exit;
6487 }
6488 if( mbedtls_platform_memset( hs_buf->data + 6, 0, 3 ) !=
6489 hs_buf->data + 6 )
6490 {
6491 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6492 goto exit;
6493 }
6494 if( mbedtls_platform_memcpy( hs_buf->data + 9, hs_buf->data + 1, 3 ) !=
6495 hs_buf->data + 9 )
6496 {
6497 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
6498 goto exit;
6499 }
Hanno Becker37f95322018-08-16 13:55:32 +01006500
6501 hs_buf->is_valid = 1;
Hanno Beckere0b150f2018-08-21 15:51:03 +01006502
6503 hs->buffering.total_bytes_buffered += reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006504 }
6505 else
6506 {
6507 /* Make sure msg_type and length are consistent */
Teppo Järvelin0efac532019-10-04 13:21:08 +03006508 if( memcmp( hs_buf->data, ssl->in_msg, 4 ) != 0 ) // use regular memcmp as msg type is public
Hanno Becker37f95322018-08-16 13:55:32 +01006509 {
6510 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
6511 /* Ignore */
6512 goto exit;
6513 }
6514 }
6515
Hanno Becker4422bbb2018-08-20 09:40:19 +01006516 if( !hs_buf->is_complete )
Hanno Becker37f95322018-08-16 13:55:32 +01006517 {
6518 size_t frag_len, frag_off;
6519 unsigned char * const msg = hs_buf->data + 12;
6520
6521 /*
6522 * Check and copy current fragment
6523 */
6524
6525 /* Validation of header fields already done in
6526 * mbedtls_ssl_prepare_handshake_record(). */
6527 frag_off = ssl_get_hs_frag_off( ssl );
6528 frag_len = ssl_get_hs_frag_len( ssl );
6529
6530 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
6531 frag_off, frag_len ) );
Teppo Järvelin91d79382019-10-02 09:09:31 +03006532 mbedtls_platform_memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
Hanno Becker37f95322018-08-16 13:55:32 +01006533
6534 if( hs_buf->is_fragmented )
6535 {
6536 unsigned char * const bitmask = msg + msg_len;
6537 ssl_bitmask_set( bitmask, frag_off, frag_len );
6538 hs_buf->is_complete = ( ssl_bitmask_check( bitmask,
6539 msg_len ) == 0 );
6540 }
6541 else
6542 {
6543 hs_buf->is_complete = 1;
6544 }
6545
6546 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
6547 hs_buf->is_complete ? "" : "not yet " ) );
6548 }
6549
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006550 break;
Hanno Becker37f95322018-08-16 13:55:32 +01006551 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006552
6553 default:
Hanno Becker360bef32018-08-28 10:04:33 +01006554 /* We don't buffer other types of messages. */
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006555 break;
6556 }
6557
6558exit:
6559
6560 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
6561 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006562}
6563#endif /* MBEDTLS_SSL_PROTO_DTLS */
6564
Hanno Becker1097b342018-08-15 14:09:41 +01006565static int ssl_consume_current_message( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006566{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006567 /*
Hanno Becker4a810fb2017-05-24 16:27:30 +01006568 * Consume last content-layer message and potentially
6569 * update in_msglen which keeps track of the contents'
6570 * consumption state.
6571 *
6572 * (1) Handshake messages:
6573 * Remove last handshake message, move content
6574 * and adapt in_msglen.
6575 *
6576 * (2) Alert messages:
6577 * Consume whole record content, in_msglen = 0.
6578 *
Hanno Becker4a810fb2017-05-24 16:27:30 +01006579 * (3) Change cipher spec:
6580 * Consume whole record content, in_msglen = 0.
6581 *
6582 * (4) Application data:
6583 * Don't do anything - the record layer provides
6584 * the application data as a stream transport
6585 * and consumes through mbedtls_ssl_read only.
6586 *
6587 */
6588
6589 /* Case (1): Handshake messages */
6590 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006591 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006592 /* Hard assertion to be sure that no application data
6593 * is in flight, as corrupting ssl->in_msglen during
6594 * ssl->in_offt != NULL is fatal. */
6595 if( ssl->in_offt != NULL )
6596 {
6597 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6598 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6599 }
6600
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006601 /*
6602 * Get next Handshake message in the current record
6603 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006604
Hanno Becker4a810fb2017-05-24 16:27:30 +01006605 /* Notes:
Hanno Beckere72489d2017-10-23 13:23:50 +01006606 * (1) in_hslen is not necessarily the size of the
Hanno Becker4a810fb2017-05-24 16:27:30 +01006607 * current handshake content: If DTLS handshake
6608 * fragmentation is used, that's the fragment
6609 * size instead. Using the total handshake message
Hanno Beckere72489d2017-10-23 13:23:50 +01006610 * size here is faulty and should be changed at
6611 * some point.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006612 * (2) While it doesn't seem to cause problems, one
6613 * has to be very careful not to assume that in_hslen
6614 * is always <= in_msglen in a sensible communication.
6615 * Again, it's wrong for DTLS handshake fragmentation.
6616 * The following check is therefore mandatory, and
6617 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006618 * Additionally, ssl->in_hslen might be arbitrarily out of
6619 * bounds after handling a DTLS message with an unexpected
6620 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006621 */
6622 if( ssl->in_hslen < ssl->in_msglen )
6623 {
6624 ssl->in_msglen -= ssl->in_hslen;
6625 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
6626 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006627
Hanno Becker4a810fb2017-05-24 16:27:30 +01006628 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
6629 ssl->in_msg, ssl->in_msglen );
6630 }
6631 else
6632 {
6633 ssl->in_msglen = 0;
6634 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02006635
Hanno Becker4a810fb2017-05-24 16:27:30 +01006636 ssl->in_hslen = 0;
6637 }
6638 /* Case (4): Application data */
6639 else if( ssl->in_offt != NULL )
6640 {
6641 return( 0 );
6642 }
6643 /* Everything else (CCS & Alerts) */
6644 else
6645 {
6646 ssl->in_msglen = 0;
6647 }
6648
Hanno Becker1097b342018-08-15 14:09:41 +01006649 return( 0 );
6650}
Hanno Becker4a810fb2017-05-24 16:27:30 +01006651
Hanno Beckere74d5562018-08-15 14:26:08 +01006652static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
6653{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006654 if( ssl->in_msglen > 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006655 return( 1 );
6656
6657 return( 0 );
6658}
6659
Hanno Becker5f066e72018-08-16 14:56:31 +01006660#if defined(MBEDTLS_SSL_PROTO_DTLS)
6661
6662static void ssl_free_buffered_record( mbedtls_ssl_context *ssl )
6663{
6664 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6665 if( hs == NULL )
6666 return;
6667
Hanno Becker01315ea2018-08-21 17:22:17 +01006668 if( hs->buffering.future_record.data != NULL )
Hanno Becker4a810fb2017-05-24 16:27:30 +01006669 {
Hanno Becker01315ea2018-08-21 17:22:17 +01006670 hs->buffering.total_bytes_buffered -=
6671 hs->buffering.future_record.len;
6672
6673 mbedtls_free( hs->buffering.future_record.data );
6674 hs->buffering.future_record.data = NULL;
6675 }
Hanno Becker5f066e72018-08-16 14:56:31 +01006676}
6677
6678static int ssl_load_buffered_record( mbedtls_ssl_context *ssl )
6679{
6680 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6681 unsigned char * rec;
6682 size_t rec_len;
6683 unsigned rec_epoch;
Andrzej Kurekf3844952020-10-16 23:03:01 +02006684#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6685 size_t in_buf_len = ssl->in_buf_len;
6686#else
6687 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6688#endif
Hanno Becker5f066e72018-08-16 14:56:31 +01006689
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006690 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006691 return( 0 );
6692
6693 if( hs == NULL )
6694 return( 0 );
6695
Hanno Becker5f066e72018-08-16 14:56:31 +01006696 rec = hs->buffering.future_record.data;
6697 rec_len = hs->buffering.future_record.len;
6698 rec_epoch = hs->buffering.future_record.epoch;
6699
6700 if( rec == NULL )
6701 return( 0 );
6702
Hanno Becker4cb782d2018-08-20 11:19:05 +01006703 /* Only consider loading future records if the
6704 * input buffer is empty. */
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006705 if( ssl_next_record_is_in_datagram( ssl ) == 1 )
Hanno Becker4cb782d2018-08-20 11:19:05 +01006706 return( 0 );
6707
Hanno Becker5f066e72018-08-16 14:56:31 +01006708 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
6709
6710 if( rec_epoch != ssl->in_epoch )
6711 {
6712 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
6713 goto exit;
6714 }
6715
6716 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
6717
6718 /* Double-check that the record is not too large */
Andrzej Kurekf3844952020-10-16 23:03:01 +02006719 if( rec_len > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006720 {
6721 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6722 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6723 }
6724
Teppo Järvelin91d79382019-10-02 09:09:31 +03006725 mbedtls_platform_memcpy( ssl->in_hdr, rec, rec_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006726 ssl->in_left = rec_len;
6727 ssl->next_record_offset = 0;
6728
6729 ssl_free_buffered_record( ssl );
6730
6731exit:
6732 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
6733 return( 0 );
6734}
6735
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006736static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
6737 mbedtls_record const *rec )
Hanno Becker5f066e72018-08-16 14:56:31 +01006738{
6739 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker5f066e72018-08-16 14:56:31 +01006740
6741 /* Don't buffer future records outside handshakes. */
6742 if( hs == NULL )
6743 return( 0 );
6744
6745 /* Only buffer handshake records (we are only interested
6746 * in Finished messages). */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006747 if( rec->type != MBEDTLS_SSL_MSG_HANDSHAKE )
Hanno Becker5f066e72018-08-16 14:56:31 +01006748 return( 0 );
6749
6750 /* Don't buffer more than one future epoch record. */
6751 if( hs->buffering.future_record.data != NULL )
6752 return( 0 );
6753
Hanno Becker01315ea2018-08-21 17:22:17 +01006754 /* Don't buffer record if there's not enough buffering space remaining. */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006755 if( rec->buf_len > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
Hanno Becker01315ea2018-08-21 17:22:17 +01006756 hs->buffering.total_bytes_buffered ) )
6757 {
6758 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006759 (unsigned) rec->buf_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Becker01315ea2018-08-21 17:22:17 +01006760 (unsigned) hs->buffering.total_bytes_buffered ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006761 return( 0 );
6762 }
6763
Hanno Becker5f066e72018-08-16 14:56:31 +01006764 /* Buffer record */
6765 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
6766 ssl->in_epoch + 1 ) );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006767 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006768
6769 /* ssl_parse_record_header() only considers records
6770 * of the next epoch as candidates for buffering. */
6771 hs->buffering.future_record.epoch = ssl->in_epoch + 1;
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006772 hs->buffering.future_record.len = rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006773
6774 hs->buffering.future_record.data =
6775 mbedtls_calloc( 1, hs->buffering.future_record.len );
6776 if( hs->buffering.future_record.data == NULL )
6777 {
6778 /* If we run out of RAM trying to buffer a
6779 * record from the next epoch, just ignore. */
6780 return( 0 );
6781 }
6782
Teppo Järvelin91d79382019-10-02 09:09:31 +03006783 mbedtls_platform_memcpy( hs->buffering.future_record.data, rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006784
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006785 hs->buffering.total_bytes_buffered += rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006786 return( 0 );
6787}
6788
6789#endif /* MBEDTLS_SSL_PROTO_DTLS */
6790
Hanno Beckere74d5562018-08-15 14:26:08 +01006791static int ssl_get_next_record( mbedtls_ssl_context *ssl )
Hanno Becker1097b342018-08-15 14:09:41 +01006792{
6793 int ret;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006794 mbedtls_record rec;
Hanno Becker1097b342018-08-15 14:09:41 +01006795
Hanno Becker5f066e72018-08-16 14:56:31 +01006796#if defined(MBEDTLS_SSL_PROTO_DTLS)
6797 /* We might have buffered a future record; if so,
6798 * and if the epoch matches now, load it.
6799 * On success, this call will set ssl->in_left to
6800 * the length of the buffered record, so that
6801 * the calls to ssl_fetch_input() below will
6802 * essentially be no-ops. */
6803 ret = ssl_load_buffered_record( ssl );
6804 if( ret != 0 )
6805 return( ret );
6806#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker4a810fb2017-05-24 16:27:30 +01006807
Hanno Becker8b09b732019-05-08 12:03:28 +01006808 /* Ensure that we have enough space available for the default form
6809 * of TLS / DTLS record headers (5 Bytes for TLS, 13 Bytes for DTLS,
6810 * with no space for CIDs counted in). */
6811 ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_in_hdr_len( ssl ) );
6812 if( ret != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006813 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006814 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006815 return( ret );
6816 }
6817
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006818 ret = ssl_parse_record_header( ssl, ssl->in_hdr, ssl->in_left, &rec );
6819 if( ret != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006820 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006821#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker87b56262019-07-10 14:37:41 +01006822 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006823 {
Hanno Becker5f066e72018-08-16 14:56:31 +01006824 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6825 {
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006826 ret = ssl_buffer_future_record( ssl, &rec );
Hanno Becker5f066e72018-08-16 14:56:31 +01006827 if( ret != 0 )
6828 return( ret );
6829
6830 /* Fall through to handling of unexpected records */
6831 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
6832 }
6833
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006834 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
6835 {
Hanno Becker87b56262019-07-10 14:37:41 +01006836#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker68379722019-07-12 09:23:47 +01006837 /* Reset in pointers to default state for TLS/DTLS records,
6838 * assuming no CID and no offset between record content and
6839 * record plaintext. */
6840 ssl_update_in_pointers( ssl );
6841
Hanno Becker69412452019-07-12 08:33:49 +01006842 /* Setup internal message pointers from record structure. */
6843 ssl->in_msgtype = rec.type;
6844#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6845 ssl->in_len = ssl->in_cid + rec.cid_len;
6846#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006847 ssl->in_msg = ssl->in_len + 2;
Hanno Becker69412452019-07-12 08:33:49 +01006848 ssl->in_msglen = rec.data_len;
6849
Hanno Becker87b56262019-07-10 14:37:41 +01006850 ret = ssl_check_client_reconnect( ssl );
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02006851 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_client_reconnect", ret );
Hanno Becker87b56262019-07-10 14:37:41 +01006852 if( ret != 0 )
6853 return( ret );
6854#endif
6855
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006856 /* Skip unexpected record (but not whole datagram) */
Hanno Becker2528ee02019-07-11 12:48:53 +01006857 ssl->next_record_offset = rec.buf_len;
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006858
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006859 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
6860 "(header)" ) );
6861 }
6862 else
6863 {
6864 /* Skip invalid record and the rest of the datagram */
6865 ssl->next_record_offset = 0;
6866 ssl->in_left = 0;
6867
6868 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
6869 "(header)" ) );
6870 }
6871
6872 /* Get next record */
Hanno Becker90333da2017-10-10 11:27:13 +01006873 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006874 }
Hanno Becker87b56262019-07-10 14:37:41 +01006875 else
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006876#endif
Hanno Becker87b56262019-07-10 14:37:41 +01006877 {
6878 return( ret );
6879 }
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006880 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006882#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006883 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckere65ce782017-05-22 14:47:48 +01006884 {
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006885 /* Remember offset of next record within datagram. */
Hanno Becker2720f4c2019-07-11 12:50:10 +01006886 ssl->next_record_offset = rec.buf_len;
Hanno Beckere65ce782017-05-22 14:47:48 +01006887 if( ssl->next_record_offset < ssl->in_left )
6888 {
6889 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
6890 }
6891 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006892 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006893#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006894#if defined(MBEDTLS_SSL_PROTO_TLS)
6895 {
Hanno Beckere0452772019-07-10 17:12:07 +01006896 /*
6897 * Fetch record contents from underlying transport.
6898 */
Hanno Becker9babbf72019-07-11 12:50:29 +01006899 ret = mbedtls_ssl_fetch_input( ssl, rec.buf_len );
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006900 if( ret != 0 )
6901 {
6902 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
6903 return( ret );
6904 }
6905
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006906 ssl->in_left = 0;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006907 }
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006908#endif /* MBEDTLS_SSL_PROTO_TLS */
6909
6910 /*
6911 * Decrypt record contents.
6912 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006913
Hanno Beckera89610a2019-07-11 13:07:45 +01006914 if( ( ret = ssl_prepare_record_content( ssl, &rec ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006915 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006916#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006917 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006918 {
6919 /* Silently discard invalid records */
Hanno Becker16e9ae22019-05-03 16:36:59 +01006920 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006921 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006922 /* Except when waiting for Finished as a bad mac here
6923 * probably means something went wrong in the handshake
6924 * (eg wrong psk used, mitm downgrade attempt, etc.) */
6925 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
6926 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
6927 {
6928#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6929 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
6930 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006931 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006932 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
6933 }
6934#endif
6935 return( ret );
6936 }
6937
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006938#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Hanno Beckerde671542019-06-12 16:30:46 +01006939 if( mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) != 0 &&
6940 ++ssl->badmac_seen >= mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006941 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006942 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
6943 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006944 }
6945#endif
6946
Hanno Becker4a810fb2017-05-24 16:27:30 +01006947 /* As above, invalid records cause
6948 * dismissal of the whole datagram. */
6949
6950 ssl->next_record_offset = 0;
6951 ssl->in_left = 0;
6952
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006953 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Hanno Becker90333da2017-10-10 11:27:13 +01006954 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006955 }
6956
6957 return( ret );
6958 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006959 MBEDTLS_SSL_TRANSPORT_ELSE
6960#endif /* MBEDTLS_SSL_PROTO_DTLS */
6961#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006962 {
6963 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006964#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6965 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006966 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006967 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006968 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006969 }
6970#endif
6971 return( ret );
6972 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006973#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006974 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006975
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006976
6977 /* Reset in pointers to default state for TLS/DTLS records,
6978 * assuming no CID and no offset between record content and
6979 * record plaintext. */
6980 ssl_update_in_pointers( ssl );
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006981#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6982 ssl->in_len = ssl->in_cid + rec.cid_len;
6983#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006984 ssl->in_msg = ssl->in_len + 2;
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006985
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006986 /* The record content type may change during decryption,
6987 * so re-read it. */
6988 ssl->in_msgtype = rec.type;
6989 /* Also update the input buffer, because unfortunately
6990 * the server-side ssl_parse_client_hello() reparses the
6991 * record header when receiving a ClientHello initiating
6992 * a renegotiation. */
6993 ssl->in_hdr[0] = rec.type;
6994 ssl->in_msg = rec.buf + rec.data_offset;
6995 ssl->in_msglen = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03006996 (void)mbedtls_platform_put_uint16_be( ssl->in_len, rec.data_len );
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006997
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01006998#if defined(MBEDTLS_ZLIB_SUPPORT)
6999 if( ssl->transform_in != NULL &&
7000 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
7001 {
7002 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
7003 {
7004 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
7005 return( ret );
7006 }
7007
7008 /* Check actual (decompress) record content length against
7009 * configured maximum. */
7010 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
7011 {
7012 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
7013 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7014 }
7015 }
7016#endif /* MBEDTLS_ZLIB_SUPPORT */
7017
Simon Butcher99000142016-10-13 17:21:01 +01007018 return( 0 );
7019}
7020
7021int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
7022{
7023 int ret;
7024
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007025 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02007026 * Handle particular types of records
7027 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007028 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007029 {
Simon Butcher99000142016-10-13 17:21:01 +01007030 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
7031 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01007032 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01007033 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007034 }
7035
Hanno Beckere678eaa2018-08-21 14:57:46 +01007036 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007037 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01007038 if( ssl->in_msglen != 1 )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007039 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01007040 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %d",
7041 ssl->in_msglen ) );
7042 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007043 }
7044
Hanno Beckere678eaa2018-08-21 14:57:46 +01007045 if( ssl->in_msg[0] != 1 )
7046 {
7047 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
7048 ssl->in_msg[0] ) );
7049 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7050 }
7051
7052#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02007053 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckere678eaa2018-08-21 14:57:46 +01007054 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
7055 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
7056 {
7057 if( ssl->handshake == NULL )
7058 {
7059 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
7060 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
7061 }
7062
7063 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
7064 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
7065 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007066#endif
Hanno Beckere678eaa2018-08-21 14:57:46 +01007067 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01007068
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007069 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00007070 {
Angus Gratton1a7a17e2018-06-20 15:43:50 +10007071 if( ssl->in_msglen != 2 )
7072 {
7073 /* Note: Standard allows for more than one 2 byte alert
7074 to be packed in a single message, but Mbed TLS doesn't
7075 currently support this. */
7076 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
7077 ssl->in_msglen ) );
7078 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
7079 }
7080
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007081 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00007082 ssl->in_msg[0], ssl->in_msg[1] ) );
7083
7084 /*
Simon Butcher459a9502015-10-27 16:09:03 +00007085 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00007086 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007087 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007088 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007089 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00007090 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007091 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007092 }
7093
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007094 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7095 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00007096 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007097 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
7098 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00007099 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007100
7101#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
7102 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7103 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
7104 {
Hanno Becker90333da2017-10-10 11:27:13 +01007105 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no renegotiation alert" ) );
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007106 /* Will be handled when trying to parse ServerHello */
7107 return( 0 );
7108 }
7109#endif
7110
7111#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2881d802019-05-22 14:44:53 +01007112 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007113 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7114 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02007115 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7116 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7117 {
7118 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
7119 /* Will be handled in mbedtls_ssl_parse_certificate() */
7120 return( 0 );
7121 }
7122#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
7123
7124 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01007125 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00007126 }
7127
Hanno Beckerc76c6192017-06-06 10:03:17 +01007128#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02007129 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckerc76c6192017-06-06 10:03:17 +01007130 {
Hanno Becker74dd3a72019-05-03 16:54:26 +01007131 /* Drop unexpected ApplicationData records,
7132 * except at the beginning of renegotiations */
7133 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
7134 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
7135#if defined(MBEDTLS_SSL_RENEGOTIATION)
7136 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
7137 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
Hanno Beckerc76c6192017-06-06 10:03:17 +01007138#endif
Hanno Becker74dd3a72019-05-03 16:54:26 +01007139 )
7140 {
7141 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
7142 return( MBEDTLS_ERR_SSL_NON_FATAL );
7143 }
7144
7145 if( ssl->handshake != NULL &&
7146 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
7147 {
7148 ssl_handshake_wrapup_free_hs_transform( ssl );
7149 }
7150 }
Hanno Beckerf65ad822019-05-08 16:26:21 +01007151#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Beckerc76c6192017-06-06 10:03:17 +01007152
Paul Bakker5121ce52009-01-03 21:22:43 +00007153 return( 0 );
7154}
7155
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007156int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007157{
7158 int ret;
7159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007160 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
7161 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7162 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00007163 {
7164 return( ret );
7165 }
7166
7167 return( 0 );
7168}
7169
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007170int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Hanno Becker1facd552019-07-03 13:57:23 +01007171 unsigned char level,
7172 unsigned char message )
Paul Bakker0a925182012-04-16 06:46:41 +00007173{
7174 int ret;
7175
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02007176 if( ssl == NULL || ssl->conf == NULL )
7177 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7178
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007179 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007180 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00007181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007182 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00007183 ssl->out_msglen = 2;
7184 ssl->out_msg[0] = level;
7185 ssl->out_msg[1] = message;
7186
Hanno Becker67bc7c32018-08-06 11:33:50 +01007187 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00007188 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007189 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00007190 return( ret );
7191 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007192 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00007193
7194 return( 0 );
7195}
7196
Hanno Becker17572472019-02-08 07:19:04 +00007197#if defined(MBEDTLS_X509_CRT_PARSE_C)
7198static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
7199{
7200#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7201 if( session->peer_cert != NULL )
7202 {
7203 mbedtls_x509_crt_free( session->peer_cert );
7204 mbedtls_free( session->peer_cert );
7205 session->peer_cert = NULL;
7206 }
Hanno Becker5882dd02019-06-06 16:25:57 +01007207#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker17572472019-02-08 07:19:04 +00007208 if( session->peer_cert_digest != NULL )
7209 {
7210 /* Zeroization is not necessary. */
7211 mbedtls_free( session->peer_cert_digest );
7212 session->peer_cert_digest = NULL;
7213 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
7214 session->peer_cert_digest_len = 0;
7215 }
Hanno Becker5882dd02019-06-06 16:25:57 +01007216#else
7217 ((void) session);
7218#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker17572472019-02-08 07:19:04 +00007219}
7220#endif /* MBEDTLS_X509_CRT_PARSE_C */
7221
Paul Bakker5121ce52009-01-03 21:22:43 +00007222/*
7223 * Handshake functions
7224 */
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007225#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02007226/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007227int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007228{
Hanno Beckerdf645962019-06-26 13:02:22 +01007229 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7230 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker5121ce52009-01-03 21:22:43 +00007231
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007232 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007233
Hanno Becker5097cba2019-02-05 13:36:46 +00007234 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007235 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007237 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7238 {
7239 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7240 }
7241 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7242 {
7243 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7244 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007245 else
7246 {
7247 ssl->state = MBEDTLS_SSL_INVALID;
7248 }
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007249 return( 0 );
7250 }
7251
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007252 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7253 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007254}
7255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007256int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007257{
Hanno Beckerdf645962019-06-26 13:02:22 +01007258 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7259 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007260
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007261 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007262
Hanno Becker5097cba2019-02-05 13:36:46 +00007263 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007265 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007266 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7267 {
7268 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7269 }
7270 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7271 {
7272 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7273 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007274 else
7275 {
7276 ssl->state = MBEDTLS_SSL_INVALID;
7277 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007278 return( 0 );
7279 }
7280
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007281 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7282 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007283}
Gilles Peskinef9828522017-05-03 12:28:43 +02007284
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007285#else /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Gilles Peskinef9828522017-05-03 12:28:43 +02007286/* Some certificate support -> implement write and parse */
7287
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007288int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007289{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007290 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007291 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007292 const mbedtls_x509_crt *crt;
Hanno Beckerdf645962019-06-26 13:02:22 +01007293 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
7294 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007295
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007296 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007297
Hanno Becker5097cba2019-02-05 13:36:46 +00007298 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007299 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007300 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007301 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7302 {
7303 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7304 }
7305 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7306 {
7307 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7308 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007309 else
7310 {
7311 ssl->state = MBEDTLS_SSL_INVALID;
7312 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02007313 return( 0 );
7314 }
7315
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007316#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007317 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7318 MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00007319 {
7320 if( ssl->client_auth == 0 )
7321 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007322 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02007323 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7324 {
7325 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7326 }
7327 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7328 {
7329 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7330 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007331 else
7332 {
7333 ssl->state = MBEDTLS_SSL_INVALID;
7334 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007335 return( 0 );
7336 }
7337
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007338#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00007339 /*
7340 * If using SSLv3 and got no cert, send an Alert message
7341 * (otherwise an empty Certificate message will be sent).
7342 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007343 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
Hanno Becker2881d802019-05-22 14:44:53 +01007344 mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007345 {
7346 ssl->out_msglen = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007347 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
7348 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
7349 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
Paul Bakker5121ce52009-01-03 21:22:43 +00007350
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007351 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007352 goto write_msg;
7353 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007354#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00007355 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007356#endif /* MBEDTLS_SSL_CLI_C */
7357#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007358 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00007359 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007360 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007361 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007362 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
7363 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00007364 }
7365 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01007366#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007367
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007368 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007369
7370 /*
7371 * 0 . 0 handshake type
7372 * 1 . 3 handshake length
7373 * 4 . 6 length of all certs
7374 * 7 . 9 length of cert. 1
7375 * 10 . n-1 peer certificate
7376 * n . n+2 length of cert. 2
7377 * n+3 . ... upper level cert, etc.
7378 */
7379 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007380 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00007381
Paul Bakker29087132010-03-21 21:03:34 +00007382 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007383 {
7384 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10007385 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00007386 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007387 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
Angus Grattond8213d02016-05-25 20:56:48 +10007388 i + 3 + n, MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007389 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007390 }
7391
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007392 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[i], n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007393
Teppo Järvelin91d79382019-10-02 09:09:31 +03007394 i += 3; mbedtls_platform_memcpy( ssl->out_msg + i, crt->raw.p, n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007395 i += n; crt = crt->next;
7396 }
7397
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007398 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[4], ( i - 7 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007399
7400 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007401 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7402 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00007403
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02007404#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00007405write_msg:
Paul Bakkerd2f068e2013-08-27 21:19:20 +02007406#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007407
Jarno Lamsa2b205162019-11-12 15:36:21 +02007408 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7409 {
7410 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7411 }
7412 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7413 {
7414 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7415 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007416 else
7417 {
7418 ssl->state = MBEDTLS_SSL_INVALID;
7419 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007420
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007421 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007422 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007423 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007424 return( ret );
7425 }
7426
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007427 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007428
Paul Bakkered27a042013-04-18 22:46:23 +02007429 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007430}
7431
Hanno Becker285ff0c2019-01-31 07:44:03 +00007432#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerdf759382019-02-05 17:02:46 +00007433
7434#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007435#define PEER_CRT_CHANGED 0x75555555
Hanno Becker33c3dc82019-01-30 14:46:46 +00007436static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7437 unsigned char *crt_buf,
7438 size_t crt_buf_len )
7439{
7440 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
7441
7442 if( peer_crt == NULL )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007443 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007444
7445 if( peer_crt->raw.len != crt_buf_len )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007446 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007447
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02007448 return( mbedtls_platform_memequal( peer_crt->raw.p, crt_buf, crt_buf_len ) );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007449}
Hanno Becker5882dd02019-06-06 16:25:57 +01007450#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007451#define PEER_CRT_CHANGED 0x75555555
Hanno Beckerdf759382019-02-05 17:02:46 +00007452static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7453 unsigned char *crt_buf,
7454 size_t crt_buf_len )
7455{
7456 int ret;
7457 unsigned char const * const peer_cert_digest =
7458 ssl->session->peer_cert_digest;
7459 mbedtls_md_type_t const peer_cert_digest_type =
7460 ssl->session->peer_cert_digest_type;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007461 mbedtls_md_handle_t digest_info =
Hanno Beckerdf759382019-02-05 17:02:46 +00007462 mbedtls_md_info_from_type( peer_cert_digest_type );
7463 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
7464 size_t digest_len;
7465
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007466 if( peer_cert_digest == NULL ||
7467 digest_info == MBEDTLS_MD_INVALID_HANDLE )
7468 {
Andrzej Kurek0919b142020-07-06 15:28:59 -04007469 return( PEER_CRT_CHANGED );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007470 }
Hanno Beckerdf759382019-02-05 17:02:46 +00007471
7472 digest_len = mbedtls_md_get_size( digest_info );
7473 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
Andrzej Kurek45e71992020-07-08 10:09:44 -04007474 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007475
7476 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
7477 if( ret != 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007478 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007479
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02007480 return( mbedtls_platform_memequal( tmp_digest, peer_cert_digest, digest_len ) );
Hanno Beckerdf759382019-02-05 17:02:46 +00007481}
Hanno Becker5882dd02019-06-06 16:25:57 +01007482#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker285ff0c2019-01-31 07:44:03 +00007483#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Hanno Becker33c3dc82019-01-30 14:46:46 +00007484
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007485/*
7486 * Once the certificate message is read, parse it into a cert chain and
7487 * perform basic checks, but leave actual verification to the caller
7488 */
Hanno Becker35e41772019-02-05 15:37:23 +00007489static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
7490 mbedtls_x509_crt *chain )
Paul Bakker5121ce52009-01-03 21:22:43 +00007491{
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007492 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker35e41772019-02-05 15:37:23 +00007493#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7494 int crt_cnt=0;
7495#endif
Paul Bakker23986e52011-04-24 08:57:21 +00007496 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02007497 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00007498
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007499 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007500 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007501 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007502 mbedtls_ssl_pend_fatal_alert( ssl,
7503 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007504 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007505 }
7506
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007507 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
7508 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007509 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007510 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007511 mbedtls_ssl_pend_fatal_alert( ssl,
7512 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007513 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007514 }
7515
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007516 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007517
Paul Bakker5121ce52009-01-03 21:22:43 +00007518 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007519 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00007520 */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007521 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007522
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007523 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007524 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00007525 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007526 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007527 mbedtls_ssl_pend_fatal_alert( ssl,
7528 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007529 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007530 }
7531
Hanno Becker33c3dc82019-01-30 14:46:46 +00007532 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
7533 i += 3;
7534
Hanno Becker33c3dc82019-01-30 14:46:46 +00007535 /* Iterate through and parse the CRTs in the provided chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007536 while( i < ssl->in_hslen )
7537 {
Hanno Becker33c3dc82019-01-30 14:46:46 +00007538 /* Check that there's room for the next CRT's length fields. */
Philippe Antoine747fd532018-05-30 09:13:21 +02007539 if ( i + 3 > ssl->in_hslen ) {
7540 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007541 mbedtls_ssl_pend_fatal_alert( ssl,
7542 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +02007543 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
7544 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007545 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
7546 * anything beyond 2**16 ~ 64K. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007547 if( ssl->in_msg[i] != 0 )
7548 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007549 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007550 mbedtls_ssl_pend_fatal_alert( ssl,
7551 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007552 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007553 }
7554
Hanno Becker33c3dc82019-01-30 14:46:46 +00007555 /* Read length of the next CRT in the chain. */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007556 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007557 i += 3;
7558
7559 if( n < 128 || i + n > ssl->in_hslen )
7560 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007561 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007562 mbedtls_ssl_pend_fatal_alert( ssl,
7563 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007564 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007565 }
7566
Hanno Becker33c3dc82019-01-30 14:46:46 +00007567 /* Check if we're handling the first CRT in the chain. */
Hanno Becker35e41772019-02-05 15:37:23 +00007568#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7569 if( crt_cnt++ == 0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007570 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7571 MBEDTLS_SSL_IS_CLIENT &&
Hanno Becker35e41772019-02-05 15:37:23 +00007572 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007573 {
Hanno Becker68b856d2019-02-08 14:00:04 +00007574 /* During client-side renegotiation, check that the server's
7575 * end-CRTs hasn't changed compared to the initial handshake,
7576 * mitigating the triple handshake attack. On success, reuse
7577 * the original end-CRT instead of parsing it again. */
Hanno Becker35e41772019-02-05 15:37:23 +00007578 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
7579 if( ssl_check_peer_crt_unchanged( ssl,
7580 &ssl->in_msg[i],
7581 n ) != 0 )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007582 {
Hanno Becker35e41772019-02-05 15:37:23 +00007583 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007584 mbedtls_ssl_pend_fatal_alert( ssl,
7585 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Hanno Becker35e41772019-02-05 15:37:23 +00007586 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007587 }
Hanno Becker35e41772019-02-05 15:37:23 +00007588
7589 /* Now we can safely free the original chain. */
7590 ssl_clear_peer_cert( ssl->session );
7591 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007592#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7593
Hanno Becker33c3dc82019-01-30 14:46:46 +00007594 /* Parse the next certificate in the chain. */
Hanno Becker0cc7af52019-02-08 14:39:16 +00007595#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker35e41772019-02-05 15:37:23 +00007596 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
Hanno Becker0cc7af52019-02-08 14:39:16 +00007597#else
Hanno Becker42de8f82019-02-26 11:51:34 +00007598 /* If we don't need to store the CRT chain permanently, parse
Hanno Becker0cc7af52019-02-08 14:39:16 +00007599 * it in-place from the input buffer instead of making a copy. */
7600 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
7601#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007602 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00007603 {
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007604 case 0: /* ok */
7605 mbedtls_platform_random_delay();
7606 if( ret != 0 )
7607 {
7608 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7609 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7610 goto crt_parse_der_failed;
7611 }
7612 break;
Hanno Becker33c3dc82019-01-30 14:46:46 +00007613 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7614 /* Ignore certificate with an unknown algorithm: maybe a
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007615 * prior certificate was already trusted. */
7616 mbedtls_platform_random_delay();
7617 if( ret != MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND )
7618 {
7619 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7620 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7621 goto crt_parse_der_failed;
7622 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007623 break;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007624
Hanno Becker33c3dc82019-01-30 14:46:46 +00007625 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7626 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7627 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007628
Hanno Becker33c3dc82019-01-30 14:46:46 +00007629 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7630 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7631 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007632
Hanno Becker33c3dc82019-01-30 14:46:46 +00007633 default:
7634 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7635 crt_parse_der_failed:
Hanno Beckerde62da92019-07-24 13:23:50 +01007636 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007637 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
7638 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007639 }
7640
7641 i += n;
7642 }
7643
Hanno Becker35e41772019-02-05 15:37:23 +00007644 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007645 return( 0 );
7646}
7647
Hanno Beckerb8a08572019-02-05 12:49:06 +00007648#if defined(MBEDTLS_SSL_SRV_C)
7649static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
7650{
Hanno Becker2d9623f2019-06-13 12:07:05 +01007651 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007652 return( -1 );
7653
7654#if defined(MBEDTLS_SSL_PROTO_SSL3)
7655 /*
7656 * Check if the client sent an empty certificate
7657 */
Hanno Becker2881d802019-05-22 14:44:53 +01007658 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007659 {
7660 if( ssl->in_msglen == 2 &&
7661 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
7662 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7663 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7664 {
7665 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
7666 return( 0 );
7667 }
7668
7669 return( -1 );
7670 }
7671#endif /* MBEDTLS_SSL_PROTO_SSL3 */
7672
7673#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
7674 defined(MBEDTLS_SSL_PROTO_TLS1_2)
7675 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
7676 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7677 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
Teppo Järvelin0efac532019-10-04 13:21:08 +03007678 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 ) // use regular memcmp as comparing public data
Hanno Beckerb8a08572019-02-05 12:49:06 +00007679 {
7680 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
7681 return( 0 );
7682 }
7683
Hanno Beckerb8a08572019-02-05 12:49:06 +00007684#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
7685 MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker17daaa52019-06-18 12:31:45 +01007686
7687 return( -1 );
Hanno Beckerb8a08572019-02-05 12:49:06 +00007688}
7689#endif /* MBEDTLS_SSL_SRV_C */
7690
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007691/* Check if a certificate message is expected.
7692 * Return either
7693 * - SSL_CERTIFICATE_EXPECTED, or
7694 * - SSL_CERTIFICATE_SKIP
7695 * indicating whether a Certificate message is expected or not.
7696 */
7697#define SSL_CERTIFICATE_EXPECTED 0
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02007698#define SSL_CERTIFICATE_SKIP 0xff
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007699static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
7700 int authmode )
7701{
Hanno Becker473f98f2019-06-26 10:27:32 +01007702 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007703 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007704
7705 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
7706 return( SSL_CERTIFICATE_SKIP );
7707
7708#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007709 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007710 {
Hanno Becker473f98f2019-06-26 10:27:32 +01007711 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
7712 MBEDTLS_KEY_EXCHANGE_RSA_PSK )
7713 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007714 return( SSL_CERTIFICATE_SKIP );
Hanno Becker473f98f2019-06-26 10:27:32 +01007715 }
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007716
7717 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
7718 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007719 ssl->session_negotiate->verify_result =
7720 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
7721 return( SSL_CERTIFICATE_SKIP );
7722 }
7723 }
Hanno Beckerfd5dc8a2019-03-01 08:10:46 +00007724#else
7725 ((void) authmode);
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007726#endif /* MBEDTLS_SSL_SRV_C */
7727
7728 return( SSL_CERTIFICATE_EXPECTED );
7729}
7730
Hanno Becker3cf50612019-02-05 14:36:34 +00007731static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007732 volatile int authmode,
Hanno Becker3cf50612019-02-05 14:36:34 +00007733 mbedtls_x509_crt *chain,
7734 void *rs_ctx )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007735{
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007736 volatile int verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Andrzej Kurekfd56f402020-05-25 11:52:05 -04007737 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007738 volatile int flow_counter = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01007739 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007740 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker3cf50612019-02-05 14:36:34 +00007741 mbedtls_x509_crt *ca_chain;
7742 mbedtls_x509_crl *ca_crl;
7743
7744 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
Jarno Lamsae1621d42019-12-19 08:58:56 +02007745 {
Hanno Becker3cf50612019-02-05 14:36:34 +00007746 return( 0 );
Jarno Lamsae1621d42019-12-19 08:58:56 +02007747 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007748
Jarno Lamsae1621d42019-12-19 08:58:56 +02007749 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Hanno Becker3cf50612019-02-05 14:36:34 +00007750#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7751 if( ssl->handshake->sni_ca_chain != NULL )
7752 {
7753 ca_chain = ssl->handshake->sni_ca_chain;
7754 ca_crl = ssl->handshake->sni_ca_crl;
7755 }
7756 else
7757#endif
7758 {
7759 ca_chain = ssl->conf->ca_chain;
7760 ca_crl = ssl->conf->ca_crl;
7761 }
7762
7763 /*
7764 * Main check: verify certificate
7765 */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007766 verify_ret = mbedtls_x509_crt_verify_restartable(
Hanno Becker3cf50612019-02-05 14:36:34 +00007767 chain,
7768 ca_chain, ca_crl,
7769 ssl->conf->cert_profile,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007770#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Hanno Becker3cf50612019-02-05 14:36:34 +00007771 ssl->hostname,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007772#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Hanno Becker3cf50612019-02-05 14:36:34 +00007773 &ssl->session_negotiate->verify_result,
Hanno Becker9ec3fe02019-07-01 17:36:12 +01007774#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
7775 ssl->conf->f_vrfy, ssl->conf->p_vrfy,
7776#endif /* MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
7777 rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00007778
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007779 if( verify_ret == 0 )
7780 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007781 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007782 if( verify_ret == 0 )
7783 {
7784 flow_counter++;
7785 }
7786 else
7787 {
7788 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7789 }
7790 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007791 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007792 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007793 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", verify_ret );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007794 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007795 }
7796
7797#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Hanno Becker8c13ee62019-02-26 16:48:17 +00007798 if( verify_ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Hanno Becker3cf50612019-02-05 14:36:34 +00007799 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
7800#endif
7801
7802 /*
7803 * Secondary checks: always done, but change 'ret' only if it was 0
7804 */
7805
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007806#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
Hanno Becker3cf50612019-02-05 14:36:34 +00007807 {
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007808#if defined(MBEDTLS_USE_TINYCRYPT)
Hanno Beckeree902df2019-08-23 13:47:47 +01007809 ret = mbedtls_ssl_check_curve_uecc( ssl, MBEDTLS_UECC_DP_SECP256R1 );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007810#else /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007811 mbedtls_pk_context *pk;
7812 ret = mbedtls_x509_crt_pk_acquire( chain, &pk );
7813 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +01007814 {
7815 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007816 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +01007817 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007818
7819 /* If certificate uses an EC key, make sure the curve is OK */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007820 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) )
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007821 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007822 ret = mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007823 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007824
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00007825 mbedtls_x509_crt_pk_release( chain );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007826#endif /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007827
7828 if( ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007829 {
7830 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
7831
7832 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007833 if( verify_ret == 0 )
7834 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007835 flow_counter++;
7836 }
7837 if( ret == 0 )
7838 {
7839 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007840 }
7841 }
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007842#endif /* MBEDTLS_ECP_C || MEDTLS_USE_TINYCRYPT */
Hanno Becker3cf50612019-02-05 14:36:34 +00007843
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007844 ret = mbedtls_ssl_check_cert_usage( chain,
Hanno Becker3cf50612019-02-05 14:36:34 +00007845 ciphersuite_info,
Hanno Becker2d9623f2019-06-13 12:07:05 +01007846 ( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7847 MBEDTLS_SSL_IS_CLIENT ),
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007848 &ssl->session_negotiate->verify_result );
7849 if( ret == 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007850 {
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007851 flow_counter++;
7852 }
7853 else
7854 {
7855 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007856 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007857 if( verify_ret == 0 )
7858 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Hanno Becker3cf50612019-02-05 14:36:34 +00007859 }
7860
7861 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
7862 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
7863 * with details encoded in the verification flags. All other kinds
7864 * of error codes, including those from the user provided f_vrfy
7865 * functions, are treated as fatal and lead to a failure of
7866 * ssl_parse_certificate even if verification was optional. */
7867 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
Hanno Becker8c13ee62019-02-26 16:48:17 +00007868 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7869 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
Hanno Becker3cf50612019-02-05 14:36:34 +00007870 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007871 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007872 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
7873 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7874 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
7875 {
7876 verify_ret = 0;
7877 flow_counter++;
7878 }
7879 else
7880 {
7881 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7882 }
7883 } else {
7884 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007885 }
7886
7887 if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
7888 {
7889 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007890 verify_ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007891 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007892 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007893 else
7894 {
7895 flow_counter++;
7896 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007897
Hanno Becker8c13ee62019-02-26 16:48:17 +00007898 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007899 {
7900 uint8_t alert;
7901
7902 /* The certificate may have been rejected for several reasons.
7903 Pick one and send the corresponding alert. Which alert to send
7904 may be a subject of debate in some cases. */
7905 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
7906 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
7907 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
7908 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7909 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
7910 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7911 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
7912 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7913 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
7914 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7915 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
7916 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7917 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
7918 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7919 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
7920 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
7921 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
7922 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
7923 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
7924 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
7925 else
7926 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Hanno Beckerde62da92019-07-24 13:23:50 +01007927 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker3cf50612019-02-05 14:36:34 +00007928 }
7929
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007930 if( verify_ret == 0 &&
7931#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7932 flow_counter == 5 )
7933#else
7934 flow_counter == 4 )
7935#endif
7936 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007937 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007938 if( verify_ret == 0 &&
7939#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7940 flow_counter == 5 )
7941#else
7942 flow_counter == 4 )
7943#endif
7944 {
Jarno Lamsae1621d42019-12-19 08:58:56 +02007945 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER AUTHENTICATED" ) );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007946 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
7947 }
7948 else
7949 {
7950 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7951 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007952 } else {
7953 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER NOT AUTHENTICATED, %d", flow_counter));
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007954 }
7955
Hanno Becker3cf50612019-02-05 14:36:34 +00007956#if defined(MBEDTLS_DEBUG_C)
7957 if( ssl->session_negotiate->verify_result != 0 )
7958 {
7959 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
7960 ssl->session_negotiate->verify_result ) );
7961 }
7962 else
7963 {
7964 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
7965 }
7966#endif /* MBEDTLS_DEBUG_C */
7967
Hanno Becker8c13ee62019-02-26 16:48:17 +00007968 return( verify_ret );
Hanno Becker3cf50612019-02-05 14:36:34 +00007969}
7970
Hanno Becker34106f62019-02-08 14:59:05 +00007971#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker5882dd02019-06-06 16:25:57 +01007972
7973#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00007974static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
7975 unsigned char *start, size_t len )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007976{
7977 int ret;
Hanno Becker34106f62019-02-08 14:59:05 +00007978 /* Remember digest of the peer's end-CRT. */
7979 ssl->session_negotiate->peer_cert_digest =
7980 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
7981 if( ssl->session_negotiate->peer_cert_digest == NULL )
7982 {
7983 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
7984 sizeof( MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007985 mbedtls_ssl_pend_fatal_alert( ssl,
7986 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Becker34106f62019-02-08 14:59:05 +00007987
7988 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7989 }
7990
7991 ret = mbedtls_md( mbedtls_md_info_from_type(
7992 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
7993 start, len,
7994 ssl->session_negotiate->peer_cert_digest );
7995
7996 ssl->session_negotiate->peer_cert_digest_type =
7997 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
7998 ssl->session_negotiate->peer_cert_digest_len =
7999 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
8000
8001 return( ret );
8002}
Hanno Becker5882dd02019-06-06 16:25:57 +01008003#endif /* MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker34106f62019-02-08 14:59:05 +00008004
8005static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
8006 unsigned char *start, size_t len )
8007{
8008 unsigned char *end = start + len;
8009 int ret;
8010
8011 /* Make a copy of the peer's raw public key. */
8012 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
8013 ret = mbedtls_pk_parse_subpubkey( &start, end,
8014 &ssl->handshake->peer_pubkey );
8015 if( ret != 0 )
8016 {
8017 /* We should have parsed the public key before. */
8018 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
8019 }
8020
Manuel Pégourié-Gonnard2829bbf2019-09-19 10:45:14 +02008021 ssl->handshake->got_peer_pubkey = 1;
Hanno Becker34106f62019-02-08 14:59:05 +00008022 return( 0 );
8023}
8024#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8025
Hanno Becker3cf50612019-02-05 14:36:34 +00008026int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
8027{
8028 int ret = 0;
Hanno Becker6b9a6f32019-02-07 10:11:07 +00008029 int crt_expected;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008030#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8031 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
8032 ? ssl->handshake->sni_authmode
Hanno Beckeracd4fc02019-06-12 16:40:50 +01008033 : mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008034#else
Hanno Beckeracd4fc02019-06-12 16:40:50 +01008035 const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008036#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008037 void *rs_ctx = NULL;
Hanno Beckere4aeb762019-02-05 17:19:52 +00008038 mbedtls_x509_crt *chain = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008039
8040 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
8041
Hanno Becker6b9a6f32019-02-07 10:11:07 +00008042 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
8043 if( crt_expected == SSL_CERTIFICATE_SKIP )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008044 {
8045 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Hanno Becker613d4902019-02-05 13:11:17 +00008046 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008047 }
8048
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008049#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8050 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02008051 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008052 {
Hanno Beckere4aeb762019-02-05 17:19:52 +00008053 chain = ssl->handshake->ecrs_peer_cert;
8054 ssl->handshake->ecrs_peer_cert = NULL;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008055 goto crt_verify;
8056 }
8057#endif
8058
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02008059 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008060 {
8061 /* mbedtls_ssl_read_record may have sent an alert already. We
8062 let it decide whether to alert. */
8063 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Hanno Beckere4aeb762019-02-05 17:19:52 +00008064 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008065 }
8066
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008067#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerb8a08572019-02-05 12:49:06 +00008068 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
8069 {
8070 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008071
Hanno Beckerb8a08572019-02-05 12:49:06 +00008072 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
Hanno Becker613d4902019-02-05 13:11:17 +00008073 ret = 0;
8074 else
8075 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Hanno Beckerb8a08572019-02-05 12:49:06 +00008076
Hanno Becker613d4902019-02-05 13:11:17 +00008077 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008078 }
Hanno Beckerb8a08572019-02-05 12:49:06 +00008079#endif /* MBEDTLS_SSL_SRV_C */
8080
Hanno Becker35e41772019-02-05 15:37:23 +00008081 /* Clear existing peer CRT structure in case we tried to
8082 * reuse a session but it failed, and allocate a new one. */
Hanno Beckera46c2872019-02-05 13:08:01 +00008083 ssl_clear_peer_cert( ssl->session_negotiate );
Hanno Beckere4aeb762019-02-05 17:19:52 +00008084
8085 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
8086 if( chain == NULL )
Hanno Becker35e41772019-02-05 15:37:23 +00008087 {
8088 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
8089 sizeof( mbedtls_x509_crt ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008090 mbedtls_ssl_pend_fatal_alert( ssl,
8091 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Beckera46c2872019-02-05 13:08:01 +00008092
Hanno Beckere4aeb762019-02-05 17:19:52 +00008093 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
8094 goto exit;
8095 }
8096 mbedtls_x509_crt_init( chain );
8097
8098 ret = ssl_parse_certificate_chain( ssl, chain );
Hanno Becker35e41772019-02-05 15:37:23 +00008099 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00008100 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008101
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008102#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8103 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02008104 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02008105
8106crt_verify:
8107 if( ssl->handshake->ecrs_enabled)
8108 rs_ctx = &ssl->handshake->ecrs_ctx;
8109#endif
8110
Hanno Becker3cf50612019-02-05 14:36:34 +00008111 ret = ssl_parse_certificate_verify( ssl, authmode,
Hanno Beckere4aeb762019-02-05 17:19:52 +00008112 chain, rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00008113 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00008114 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00008115
Hanno Becker3008d282019-02-05 17:02:28 +00008116#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakker5121ce52009-01-03 21:22:43 +00008117 {
Hanno Becker5882dd02019-06-06 16:25:57 +01008118 size_t pk_len;
8119 unsigned char *pk_start;
Paul Bakker5121ce52009-01-03 21:22:43 +00008120
Hanno Becker34106f62019-02-08 14:59:05 +00008121 /* We parse the CRT chain without copying, so
8122 * these pointers point into the input buffer,
8123 * and are hence still valid after freeing the
8124 * CRT chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00008125
Hanno Becker5882dd02019-06-06 16:25:57 +01008126#if defined(MBEDTLS_SSL_RENEGOTIATION)
8127 unsigned char *crt_start;
8128 size_t crt_len;
8129
Hanno Becker34106f62019-02-08 14:59:05 +00008130 crt_start = chain->raw.p;
8131 crt_len = chain->raw.len;
Hanno Becker5882dd02019-06-06 16:25:57 +01008132#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008133
Hanno Becker8c13ee62019-02-26 16:48:17 +00008134 pk_start = chain->cache->pk_raw.p;
8135 pk_len = chain->cache->pk_raw.len;
Hanno Becker34106f62019-02-08 14:59:05 +00008136
8137 /* Free the CRT structures before computing
8138 * digest and copying the peer's public key. */
8139 mbedtls_x509_crt_free( chain );
8140 mbedtls_free( chain );
8141 chain = NULL;
8142
Hanno Becker5882dd02019-06-06 16:25:57 +01008143#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00008144 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008145 if( ret != 0 )
Hanno Beckercf291d62019-02-06 16:19:04 +00008146 goto exit;
Hanno Becker5882dd02019-06-06 16:25:57 +01008147#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008148
Hanno Becker34106f62019-02-08 14:59:05 +00008149 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008150 if( ret != 0 )
Hanno Becker34106f62019-02-08 14:59:05 +00008151 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00008152 }
Hanno Becker34106f62019-02-08 14:59:05 +00008153#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8154 /* Pass ownership to session structure. */
Hanno Beckere4aeb762019-02-05 17:19:52 +00008155 ssl->session_negotiate->peer_cert = chain;
8156 chain = NULL;
Hanno Becker34106f62019-02-08 14:59:05 +00008157#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02008158
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008159 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008160
Hanno Becker613d4902019-02-05 13:11:17 +00008161exit:
8162
Hanno Beckere4aeb762019-02-05 17:19:52 +00008163 if( ret == 0 )
Jarno Lamsa2b205162019-11-12 15:36:21 +02008164 {
8165 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
8166 {
8167 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
8168 }
8169 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
8170 {
8171 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
8172 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008173 else
8174 {
8175 ssl->state = MBEDTLS_SSL_INVALID;
8176 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008177 }
Hanno Beckere4aeb762019-02-05 17:19:52 +00008178
8179#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
8180 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
8181 {
8182 ssl->handshake->ecrs_peer_cert = chain;
8183 chain = NULL;
8184 }
8185#endif
8186
8187 if( chain != NULL )
8188 {
8189 mbedtls_x509_crt_free( chain );
8190 mbedtls_free( chain );
8191 }
8192
Paul Bakker5121ce52009-01-03 21:22:43 +00008193 return( ret );
8194}
Hanno Beckerb71e90a2019-02-05 13:20:55 +00008195#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00008196
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008197int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008198{
8199 int ret;
8200
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008201 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008202
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008203 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00008204 ssl->out_msglen = 1;
8205 ssl->out_msg[0] = 1;
8206
Jarno Lamsa2b205162019-11-12 15:36:21 +02008207 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
8208 {
8209 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
8210 }
8211 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
8212 {
8213 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
8214 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008215 else
8216 {
8217 ssl->state = MBEDTLS_SSL_INVALID;
8218 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008219
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008220 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008221 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008222 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008223 return( ret );
8224 }
8225
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008226 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008227
8228 return( 0 );
8229}
8230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008231int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008232{
8233 int ret;
8234
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008235 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008236
Hanno Becker327c93b2018-08-15 13:56:18 +01008237 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008238 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008239 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008240 return( ret );
8241 }
8242
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008243 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00008244 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008245 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008246 mbedtls_ssl_pend_fatal_alert( ssl,
8247 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008248 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008249 }
8250
Hanno Beckere678eaa2018-08-21 14:57:46 +01008251 /* CCS records are only accepted if they have length 1 and content '1',
8252 * so we don't need to check this here. */
Paul Bakker5121ce52009-01-03 21:22:43 +00008253
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008254 /*
8255 * Switch to our negotiated transform and session parameters for inbound
8256 * data.
8257 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008258 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008259 ssl->transform_in = ssl->transform_negotiate;
8260 ssl->session_in = ssl->session_negotiate;
8261
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008262#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008263 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008265#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008266 ssl_dtls_replay_reset( ssl );
8267#endif
8268
8269 /* Increment epoch */
8270 if( ++ssl->in_epoch == 0 )
8271 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008272 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02008273 /* This is highly unlikely to happen for legitimate reasons, so
8274 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008275 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008276 }
8277 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008278 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008279#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008280#if defined(MBEDTLS_SSL_PROTO_TLS)
8281 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008282 mbedtls_platform_memset( ssl->in_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008283 }
8284#endif
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008285
Hanno Beckerf5970a02019-05-08 09:38:41 +01008286 ssl_update_in_pointers( ssl );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008287
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008288#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8289 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008290 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008291 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008292 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008293 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
Hanno Beckerde62da92019-07-24 13:23:50 +01008294 mbedtls_ssl_pend_fatal_alert( ssl,
8295 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008296 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008297 }
8298 }
8299#endif
8300
Jarno Lamsa2b205162019-11-12 15:36:21 +02008301 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
8302 {
8303 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
8304 }
8305 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
8306 {
8307 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
8308 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008309 else
8310 {
8311 ssl->state = MBEDTLS_SSL_INVALID;
8312 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008313
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008314 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008315
8316 return( 0 );
8317}
8318
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008319void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008320{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008321#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8322 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker533f5b12019-08-15 16:56:35 +01008323 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008324 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008325#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008326#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8327#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008328 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008329#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008330#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008331 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008332#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008333#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02008334}
8335
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008336static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008337{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008338 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008339
8340 /*
8341 * Free our handshake params
8342 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02008343 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008344 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00008345 ssl->handshake = NULL;
8346
8347 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008348 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00008349 */
8350 if( ssl->transform )
8351 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008352 mbedtls_ssl_transform_free( ssl->transform );
8353 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00008354 }
8355 ssl->transform = ssl->transform_negotiate;
8356 ssl->transform_negotiate = NULL;
8357
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008358 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008359}
8360
Jarno Lamsae1621d42019-12-19 08:58:56 +02008361int mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008362{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04008363 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008364
8365#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Jarno Lamsa015aa442019-12-20 12:09:37 +02008366 volatile const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008367 ? ssl->handshake->sni_authmode
8368 : mbedtls_ssl_conf_get_authmode( ssl->conf );
8369#else
Jarno Lamsa015aa442019-12-20 12:09:37 +02008370 volatile const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008371#endif
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008372#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8373 volatile int crt_expected = SSL_CERTIFICATE_EXPECTED;
8374 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
8375#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008376 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008377
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008378#if defined(MBEDTLS_SSL_RENEGOTIATION)
8379 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008380 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008381 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008382 ssl->renego_records_seen = 0;
8383 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008384#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008385
8386 /*
8387 * Free the previous session and switch in the current one
8388 */
Paul Bakker0a597072012-09-25 21:55:46 +00008389 if( ssl->session )
8390 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008391#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01008392 /* RFC 7366 3.1: keep the EtM state */
8393 ssl->session_negotiate->encrypt_then_mac =
8394 ssl->session->encrypt_then_mac;
8395#endif
8396
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008397 mbedtls_ssl_session_free( ssl->session );
8398 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00008399 }
8400 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00008401 ssl->session_negotiate = NULL;
8402
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008403#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Paul Bakker0a597072012-09-25 21:55:46 +00008404 /*
8405 * Add cache entry
8406 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008407 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02008408 ssl->session->id_len != 0 &&
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008409 ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_UNSET )
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008410 {
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01008411 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008412 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008413 }
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008414#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker0a597072012-09-25 21:55:46 +00008415
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008416 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8417 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8418#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8419 crt_expected == SSL_CERTIFICATE_SKIP )
8420#else
8421 1 )
8422#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008423 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008424 mbedtls_platform_random_delay();
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008425 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8426 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8427#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8428 crt_expected == SSL_CERTIFICATE_SKIP )
8429#else
8430 1 )
8431#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008432 {
8433 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
8434 }
8435 else
8436 {
8437 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8438 goto cleanup;
8439 }
8440 }
8441
Jarno Lamsae1621d42019-12-19 08:58:56 +02008442#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008443 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008444 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008445 mbedtls_platform_random_delay();
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008446 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008447 {
Jarno Lamsa06164052019-12-19 14:40:36 +02008448 /* When doing session resume, no premaster or peer authentication */
Jarno Lamsae1621d42019-12-19 08:58:56 +02008449 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsa06164052019-12-19 14:40:36 +02008450 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008451 }
8452 else
8453 {
8454 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008455 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008456 }
8457 }
8458#endif
8459
8460 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8461 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008462 mbedtls_platform_random_delay();
Jarno Lamsae1621d42019-12-19 08:58:56 +02008463 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8464 {
8465 ret = 0;
8466 }
8467 else
8468 {
8469 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008470 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008471 }
8472 }
8473 else
8474 {
8475 ret = MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008476 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008477 }
8478
Jarno Lamsa06164052019-12-19 14:40:36 +02008479 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8480 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8481 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8482 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008483 mbedtls_platform_random_delay();
Jarno Lamsa06164052019-12-19 14:40:36 +02008484 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8485 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8486 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8487 {
8488 ret = 0;
8489 }
8490 else
8491 {
8492 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8493 goto cleanup;
8494 }
8495 }
8496 else
8497 {
8498 MBEDTLS_SSL_DEBUG_MSG( 3, ( "hello random %d", ssl->handshake->hello_random_set ) );
8499 MBEDTLS_SSL_DEBUG_MSG( 3, ( "key_derivation_done %d", ssl->handshake->key_derivation_done ) );
8500 MBEDTLS_SSL_DEBUG_MSG( 3, ( "premaster_generated %d", ssl->handshake->premaster_generated ) );
8501 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8502 }
8503
8504cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008505#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008506 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008507 ssl->handshake->flight != NULL )
8508 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008509 /* Cancel handshake timer */
8510 ssl_set_timer( ssl, 0 );
8511
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008512 /* Keep last flight around in case we need to resend it:
8513 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008514 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008515 }
8516 else
8517#endif
8518 ssl_handshake_wrapup_free_hs_transform( ssl );
8519
Jarno Lamsa2b205162019-11-12 15:36:21 +02008520 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Paul Bakker48916f92012-09-16 19:57:18 +00008521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008522 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Jarno Lamsae1621d42019-12-19 08:58:56 +02008523 return ret;
Paul Bakker48916f92012-09-16 19:57:18 +00008524}
8525
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008526int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00008527{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008528 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00008529
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008530 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008531
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008532 ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01008533
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008534 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8535 mbedtls_ssl_suite_get_mac(
8536 mbedtls_ssl_ciphersuite_from_id(
8537 mbedtls_ssl_session_get_ciphersuite(
8538 ssl->session_negotiate ) ) ),
8539 ssl, ssl->out_msg + 4,
8540 mbedtls_ssl_conf_get_endpoint( ssl->conf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008541
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01008542 /*
8543 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
8544 * may define some other value. Currently (early 2016), no defined
8545 * ciphersuite does this (and this is unlikely to change as activity has
8546 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
8547 */
Hanno Becker2881d802019-05-22 14:44:53 +01008548 hash_len = ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008549
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008550#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008551 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008552 mbedtls_platform_memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008553#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008554
Paul Bakker5121ce52009-01-03 21:22:43 +00008555 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008556 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8557 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00008558
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008559#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Paul Bakker5121ce52009-01-03 21:22:43 +00008560 /*
8561 * In case of session resuming, invert the client and server
8562 * ChangeCipherSpec messages order.
8563 */
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008564 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008565 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008566#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008567 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8568 MBEDTLS_SSL_IS_CLIENT )
8569 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008570 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008571 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008572#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008573#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008574 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8575 MBEDTLS_SSL_IS_SERVER )
8576 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008577 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008578 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008579#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008580 }
8581 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008582#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008583 {
8584 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8585 {
8586 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8587 }
8588 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8589 {
8590 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8591 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008592 else
8593 {
8594 ssl->state = MBEDTLS_SSL_INVALID;
8595 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008596 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008597
Paul Bakker48916f92012-09-16 19:57:18 +00008598 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02008599 * Switch to our negotiated transform and session parameters for outbound
8600 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00008601 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008602 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01008603
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008604#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008605 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008606 {
8607 unsigned char i;
8608
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008609 /* Remember current epoch settings for resending */
8610 ssl->handshake->alt_transform_out = ssl->transform_out;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008611 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008612
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008613 /* Set sequence_number to zero */
Hanno Becker19859472018-08-06 09:40:20 +01008614 memset( ssl->cur_out_ctr + 2, 0, 6 );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008615
8616 /* Increment epoch */
8617 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01008618 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008619 break;
8620
8621 /* The loop goes to its end iff the counter is wrapping */
8622 if( i == 0 )
8623 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008624 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
8625 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008626 }
8627 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008628 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008629#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008630#if defined(MBEDTLS_SSL_PROTO_TLS)
8631 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008632 mbedtls_platform_memset( ssl->cur_out_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008633 }
8634#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008635
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008636 ssl->transform_out = ssl->transform_negotiate;
8637 ssl->session_out = ssl->session_negotiate;
8638
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008639#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8640 if( mbedtls_ssl_hw_record_activate != NULL )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008641 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008642 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008643 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008644 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
8645 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker07eb38b2012-12-19 14:42:06 +01008646 }
8647 }
8648#endif
8649
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008650#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008651 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008652 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02008653#endif
8654
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008655 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008656 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008657 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008658 return( ret );
8659 }
8660
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008661#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008662 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008663 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
8664 {
8665 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
8666 return( ret );
8667 }
8668#endif
8669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008670 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008671
8672 return( 0 );
8673}
8674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008675#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008676#define SSL_MAX_HASH_LEN 36
8677#else
8678#define SSL_MAX_HASH_LEN 12
8679#endif
8680
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008681int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008682{
Paul Bakker23986e52011-04-24 08:57:21 +00008683 int ret;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008684 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008685 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00008686
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008687 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008688
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008689 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8690 mbedtls_ssl_suite_get_mac(
8691 mbedtls_ssl_ciphersuite_from_id(
8692 mbedtls_ssl_session_get_ciphersuite(
8693 ssl->session_negotiate ) ) ),
8694 ssl, buf,
8695 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00008696
Hanno Becker327c93b2018-08-15 13:56:18 +01008697 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008698 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008699 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008700 return( ret );
8701 }
8702
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008703 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00008704 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008706 mbedtls_ssl_pend_fatal_alert( ssl,
8707 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008708 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008709 }
8710
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008711 /* There is currently no ciphersuite using another length with TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008712#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +01008713 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008714 hash_len = 36;
8715 else
8716#endif
8717 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008718
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008719 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
8720 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00008721 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008722 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008723 mbedtls_ssl_pend_fatal_alert( ssl,
8724 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008725 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008726 }
8727
Piotr Nowickie3c4ee52020-06-23 12:59:56 +02008728 if( mbedtls_platform_memequal( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
8729 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008730 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008731 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008732 mbedtls_ssl_pend_fatal_alert( ssl,
8733 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008734 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008735 }
8736
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008737#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008738 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008739 mbedtls_platform_memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008740#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008741
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008742#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008743 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008744 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008745#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008746 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008747 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008748#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008749#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008750 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008751 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008752#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008753 }
8754 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008755#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008756 {
8757 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8758 {
8759 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8760 }
8761 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8762 {
8763 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8764 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008765 else
8766 {
8767 ssl->state = MBEDTLS_SSL_INVALID;
8768 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008769 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008770
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008771#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008772 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008773 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008774#endif
8775
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008776 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008777
8778 return( 0 );
8779}
8780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008781static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008782{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008783 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008784
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008785#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8786 defined(MBEDTLS_SSL_PROTO_TLS1_1)
8787 mbedtls_md5_init( &handshake->fin_md5 );
8788 mbedtls_sha1_init( &handshake->fin_sha1 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008789 mbedtls_md5_starts_ret( &handshake->fin_md5 );
8790 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008791#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008792#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8793#if defined(MBEDTLS_SHA256_C)
8794 mbedtls_sha256_init( &handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008795 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008796#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008797#if defined(MBEDTLS_SHA512_C)
8798 mbedtls_sha512_init( &handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008799 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008800#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008801#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008802
Hanno Becker7e5437a2017-04-28 17:15:26 +01008803#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
8804 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8805 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
8806#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008807
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008808#if defined(MBEDTLS_DHM_C)
8809 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008810#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008811#if defined(MBEDTLS_ECDH_C)
8812 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008813#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02008814#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008815 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02008816#if defined(MBEDTLS_SSL_CLI_C)
8817 handshake->ecjpake_cache = NULL;
8818 handshake->ecjpake_cache_len = 0;
8819#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008820#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008821
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008822#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02008823 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008824#endif
8825
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008826#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8827 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
8828#endif
Hanno Becker3bf8cdf2019-02-06 16:18:31 +00008829
8830#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
8831 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8832 mbedtls_pk_init( &handshake->peer_pubkey );
8833#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008834}
8835
Hanno Becker611a83b2018-01-03 14:27:32 +00008836void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008837{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008838 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Andrzej Kurek11750442020-09-17 07:12:06 -04008839#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
8840 mbedtls_cipher_init( &transform->cipher_ctx );
8841#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008842 mbedtls_cipher_init( &transform->cipher_ctx_enc );
8843 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -04008844#endif
Paul Bakker84bbeb52014-07-01 14:53:22 +02008845
Hanno Becker92231322018-01-03 15:32:51 +00008846#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008847 mbedtls_md_init( &transform->md_ctx_enc );
8848 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +00008849#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008850}
8851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008852void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008853{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008854 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008855}
8856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008857static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008858{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008859 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00008860 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008861 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008862 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008863 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008864 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02008865 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008866
8867 /*
8868 * Either the pointers are now NULL or cleared properly and can be freed.
8869 * Now allocate missing structures.
8870 */
8871 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008872 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008873 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008874 }
Paul Bakker48916f92012-09-16 19:57:18 +00008875
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008876 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008877 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008878 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008879 }
Paul Bakker48916f92012-09-16 19:57:18 +00008880
Paul Bakker82788fb2014-10-20 13:59:19 +02008881 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008882 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008883 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008884 }
Paul Bakker48916f92012-09-16 19:57:18 +00008885
Andrzej Kurekf3844952020-10-16 23:03:01 +02008886#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
8887 /* If the buffers are too small - reallocate */
Andrzej Kurekcd9a6ff2020-10-22 11:12:07 +02008888 handle_buffer_resizing( ssl, BUFFER_UPSIZING, MBEDTLS_SSL_IN_BUFFER_LEN,
8889 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurekf3844952020-10-16 23:03:01 +02008890#endif
8891
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008892 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00008893 if( ssl->handshake == NULL ||
8894 ssl->transform_negotiate == NULL ||
8895 ssl->session_negotiate == NULL )
8896 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02008897 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008898
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008899 mbedtls_free( ssl->handshake );
8900 mbedtls_free( ssl->transform_negotiate );
8901 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008902
8903 ssl->handshake = NULL;
8904 ssl->transform_negotiate = NULL;
8905 ssl->session_negotiate = NULL;
8906
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02008907 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00008908 }
8909
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008910 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008911 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Becker611a83b2018-01-03 14:27:32 +00008912 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02008913 ssl_handshake_params_init( ssl->handshake );
8914
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008915#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008916 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008917 {
8918 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008919
Hanno Becker2d9623f2019-06-13 12:07:05 +01008920 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008921 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
8922 else
8923 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
8924 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008925#endif
8926
Paul Bakker48916f92012-09-16 19:57:18 +00008927 return( 0 );
8928}
8929
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008930#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008931/* Dummy cookie callbacks for defaults */
8932static int ssl_cookie_write_dummy( void *ctx,
8933 unsigned char **p, unsigned char *end,
8934 const unsigned char *cli_id, size_t cli_id_len )
8935{
8936 ((void) ctx);
8937 ((void) p);
8938 ((void) end);
8939 ((void) cli_id);
8940 ((void) cli_id_len);
8941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008942 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008943}
8944
8945static int ssl_cookie_check_dummy( void *ctx,
8946 const unsigned char *cookie, size_t cookie_len,
8947 const unsigned char *cli_id, size_t cli_id_len )
8948{
8949 ((void) ctx);
8950 ((void) cookie);
8951 ((void) cookie_len);
8952 ((void) cli_id);
8953 ((void) cli_id_len);
8954
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008955 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008956}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008957#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008958
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008959/* Once ssl->out_hdr as the address of the beginning of the
8960 * next outgoing record is set, deduce the other pointers.
8961 *
8962 * Note: For TLS, we save the implicit record sequence number
8963 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
8964 * and the caller has to make sure there's space for this.
8965 */
8966
8967static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
8968 mbedtls_ssl_transform *transform )
8969{
8970#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008971 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008972 {
8973 ssl->out_ctr = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008974#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01008975 ssl->out_cid = ssl->out_ctr + 8;
8976 ssl->out_len = ssl->out_cid;
8977 if( transform != NULL )
8978 ssl->out_len += transform->out_cid_len;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008979#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008980 ssl->out_len = ssl->out_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008981#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008982 ssl->out_iv = ssl->out_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008983 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008984 MBEDTLS_SSL_TRANSPORT_ELSE
8985#endif /* MBEDTLS_SSL_PROTO_DTLS */
8986#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008987 {
8988 ssl->out_ctr = ssl->out_hdr - 8;
8989 ssl->out_len = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008990#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01008991 ssl->out_cid = ssl->out_len;
8992#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008993 ssl->out_iv = ssl->out_hdr + 5;
8994 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008995#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008996
8997 /* Adjust out_msg to make space for explicit IV, if used. */
8998 if( transform != NULL &&
Hanno Becker7bcf2b52019-07-26 09:02:40 +01008999 mbedtls_ssl_ver_geq(
9000 mbedtls_ssl_get_minor_ver( ssl ),
9001 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009002 {
9003 ssl->out_msg = ssl->out_iv + transform->ivlen - transform->fixed_ivlen;
9004 }
9005 else
9006 ssl->out_msg = ssl->out_iv;
9007}
9008
9009/* Once ssl->in_hdr as the address of the beginning of the
9010 * next incoming record is set, deduce the other pointers.
9011 *
9012 * Note: For TLS, we save the implicit record sequence number
9013 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
9014 * and the caller has to make sure there's space for this.
9015 */
9016
Hanno Beckerf5970a02019-05-08 09:38:41 +01009017static void ssl_update_in_pointers( mbedtls_ssl_context *ssl )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009018{
Hanno Beckerf5970a02019-05-08 09:38:41 +01009019 /* This function sets the pointers to match the case
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009020 * of unprotected TLS/DTLS records, with ssl->in_msg
9021 * pointing to the beginning of the record content.
Hanno Beckerf5970a02019-05-08 09:38:41 +01009022 *
9023 * When decrypting a protected record, ssl->in_msg
9024 * will be shifted to point to the beginning of the
9025 * record plaintext.
9026 */
9027
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009028#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009029 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009030 {
Hanno Becker70e79282019-05-03 14:34:53 +01009031 /* This sets the header pointers to match records
9032 * without CID. When we receive a record containing
9033 * a CID, the fields are shifted accordingly in
9034 * ssl_parse_record_header(). */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009035 ssl->in_ctr = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009036#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01009037 ssl->in_cid = ssl->in_ctr + 8;
9038 ssl->in_len = ssl->in_cid; /* Default: no CID */
Hanno Beckera5a2b082019-05-15 14:03:01 +01009039#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01009040 ssl->in_len = ssl->in_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009041#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009042 ssl->in_msg = ssl->in_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009043 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009044 MBEDTLS_SSL_TRANSPORT_ELSE
9045#endif /* MBEDTLS_SSL_PROTO_DTLS */
9046#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009047 {
9048 ssl->in_ctr = ssl->in_hdr - 8;
9049 ssl->in_len = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009050#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01009051 ssl->in_cid = ssl->in_len;
9052#endif
Hanno Beckerc360dcc2019-07-12 10:00:45 +01009053 ssl->in_msg = ssl->in_hdr + 5;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009054 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009055#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01009056}
9057
Paul Bakker5121ce52009-01-03 21:22:43 +00009058/*
9059 * Initialize an SSL context
9060 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02009061void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
9062{
9063 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
9064}
9065
9066/*
9067 * Setup an SSL context
9068 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009069
9070static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl )
9071{
9072 /* Set the incoming and outgoing record pointers. */
9073#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009074 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009075 {
9076 ssl->out_hdr = ssl->out_buf;
9077 ssl->in_hdr = ssl->in_buf;
9078 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009079 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009080#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009081#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009082 {
9083 ssl->out_hdr = ssl->out_buf + 8;
9084 ssl->in_hdr = ssl->in_buf + 8;
9085 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02009086#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009087
9088 /* Derive other internal pointers. */
9089 ssl_update_out_pointers( ssl, NULL /* no transform enabled */ );
Hanno Beckerf5970a02019-05-08 09:38:41 +01009090 ssl_update_in_pointers ( ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009091}
9092
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02009093int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02009094 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00009095{
Paul Bakker48916f92012-09-16 19:57:18 +00009096 int ret;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009097 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
9098 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00009099
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02009100 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00009101
Hanno Beckeref982d52019-07-23 15:56:18 +01009102#if defined(MBEDTLS_USE_TINYCRYPT)
9103 uECC_set_rng( &uecc_rng_wrapper );
9104#endif
9105
Paul Bakker62f2dee2012-09-28 07:31:51 +00009106 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01009107 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00009108 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02009109
9110 /* Set to NULL in case of an error condition */
9111 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02009112
Andrzej Kurekf3844952020-10-16 23:03:01 +02009113#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9114 ssl->in_buf_len = in_buf_len;
9115#endif
9116 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10009117 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009118 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02009119 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", in_buf_len) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02009120 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02009121 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10009122 }
9123
Andrzej Kurekf3844952020-10-16 23:03:01 +02009124#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9125 ssl->out_buf_len = out_buf_len;
9126#endif
9127
9128 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10009129 if( ssl->out_buf == NULL )
9130 {
Andrzej Kurekf3844952020-10-16 23:03:01 +02009131 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", out_buf_len) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02009132 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02009133 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00009134 }
9135
Hanno Becker2a43f6f2018-08-10 11:12:52 +01009136 ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02009137
Paul Bakker48916f92012-09-16 19:57:18 +00009138 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02009139 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00009140
Hanno Beckerc8f52992019-07-25 11:15:08 +01009141 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
Hanno Beckerf46e1ce2019-07-03 13:56:59 +01009142
Paul Bakker5121ce52009-01-03 21:22:43 +00009143 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02009144
9145error:
9146 mbedtls_free( ssl->in_buf );
9147 mbedtls_free( ssl->out_buf );
9148
9149 ssl->conf = NULL;
9150
Andrzej Kurekf3844952020-10-16 23:03:01 +02009151#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9152 ssl->in_buf_len = 0;
9153 ssl->out_buf_len = 0;
9154#endif
9155
k-stachowiaka47911c2018-07-04 17:41:58 +02009156 ssl->in_buf = NULL;
9157 ssl->out_buf = NULL;
9158
9159 ssl->in_hdr = NULL;
9160 ssl->in_ctr = NULL;
9161 ssl->in_len = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02009162 ssl->in_msg = NULL;
9163
9164 ssl->out_hdr = NULL;
9165 ssl->out_ctr = NULL;
9166 ssl->out_len = NULL;
9167 ssl->out_iv = NULL;
9168 ssl->out_msg = NULL;
9169
k-stachowiak9f7798e2018-07-31 16:52:32 +02009170 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00009171}
9172
9173/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00009174 * Reset an initialized and used SSL context for re-use while retaining
9175 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009176 *
9177 * If partial is non-zero, keep data in the input buffer and client ID.
9178 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00009179 */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009180static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00009181{
Paul Bakker48916f92012-09-16 19:57:18 +00009182 int ret;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009183#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
9184 size_t in_buf_len = ssl->in_buf_len;
9185 size_t out_buf_len = ssl->out_buf_len;
9186#else
9187 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
9188 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
9189#endif
Paul Bakker48916f92012-09-16 19:57:18 +00009190
Hanno Becker7e772132018-08-10 12:38:21 +01009191#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
9192 !defined(MBEDTLS_SSL_SRV_C)
9193 ((void) partial);
9194#endif
9195
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009196 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009197
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009198 /* Cancel any possibly running timer */
9199 ssl_set_timer( ssl, 0 );
9200
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009201#if defined(MBEDTLS_SSL_RENEGOTIATION)
9202 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009203 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00009204
9205 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02009206 mbedtls_platform_memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
9207 mbedtls_platform_memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009208#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009209 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00009210
Paul Bakker7eb013f2011-10-06 12:37:39 +00009211 ssl->in_offt = NULL;
Hanno Beckerf29d4702018-08-10 11:31:15 +01009212 ssl_reset_in_out_pointers( ssl );
Paul Bakker7eb013f2011-10-06 12:37:39 +00009213
9214 ssl->in_msgtype = 0;
9215 ssl->in_msglen = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009216#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02009217 ssl->next_record_offset = 0;
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02009218 ssl->in_epoch = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02009219#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009220#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02009221 ssl_dtls_replay_reset( ssl );
9222#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00009223
9224 ssl->in_hslen = 0;
9225 ssl->nb_zero = 0;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01009226
9227 ssl->keep_current_message = 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00009228
9229 ssl->out_msgtype = 0;
9230 ssl->out_msglen = 0;
9231 ssl->out_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009232#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
9233 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009234 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009235#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00009236
Hanno Becker19859472018-08-06 09:40:20 +01009237 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
9238
Paul Bakker48916f92012-09-16 19:57:18 +00009239 ssl->transform_in = NULL;
9240 ssl->transform_out = NULL;
Paul Bakker7eb013f2011-10-06 12:37:39 +00009241
Hanno Becker78640902018-08-13 16:35:15 +01009242 ssl->session_in = NULL;
9243 ssl->session_out = NULL;
9244
Andrzej Kurekf3844952020-10-16 23:03:01 +02009245 mbedtls_platform_memset( ssl->out_buf, 0, out_buf_len );
Hanno Becker4ccbf062018-08-10 11:20:38 +01009246
9247#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009248 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01009249#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
9250 {
9251 ssl->in_left = 0;
Andrzej Kurekf3844952020-10-16 23:03:01 +02009252 mbedtls_platform_memset( ssl->in_buf, 0, in_buf_len );
Hanno Becker4ccbf062018-08-10 11:20:38 +01009253 }
Paul Bakker05ef8352012-05-08 09:17:57 +00009254
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009255#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
9256 if( mbedtls_ssl_hw_record_reset != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00009257 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009258 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
9259 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
Paul Bakker2770fbd2012-07-03 13:30:23 +00009260 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009261 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
9262 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00009263 }
Paul Bakker05ef8352012-05-08 09:17:57 +00009264 }
9265#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00009266
Paul Bakker48916f92012-09-16 19:57:18 +00009267 if( ssl->transform )
Paul Bakker2770fbd2012-07-03 13:30:23 +00009268 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009269 mbedtls_ssl_transform_free( ssl->transform );
9270 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00009271 ssl->transform = NULL;
Paul Bakker2770fbd2012-07-03 13:30:23 +00009272 }
Paul Bakker48916f92012-09-16 19:57:18 +00009273
Paul Bakkerc0463502013-02-14 11:19:38 +01009274 if( ssl->session )
9275 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009276 mbedtls_ssl_session_free( ssl->session );
9277 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01009278 ssl->session = NULL;
9279 }
9280
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009281#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009282 ssl->alpn_chosen = NULL;
9283#endif
9284
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02009285#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01009286#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009287 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01009288#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009289 {
9290 mbedtls_free( ssl->cli_id );
9291 ssl->cli_id = NULL;
9292 ssl->cli_id_len = 0;
9293 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02009294#endif
9295
Paul Bakker48916f92012-09-16 19:57:18 +00009296 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
9297 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00009298
9299 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00009300}
9301
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02009302/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02009303 * Reset an initialized and used SSL context for re-use while retaining
9304 * all application-set variables, function pointers and data.
9305 */
9306int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
9307{
9308 return( ssl_session_reset_int( ssl, 0 ) );
9309}
9310
9311/*
Paul Bakker5121ce52009-01-03 21:22:43 +00009312 * SSL set accessors
9313 */
Hanno Becker2d9623f2019-06-13 12:07:05 +01009314#if !defined(MBEDTLS_SSL_CONF_ENDPOINT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009315void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00009316{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009317 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00009318}
Hanno Becker2d9623f2019-06-13 12:07:05 +01009319#endif /* MBEDTLS_SSL_CONF_ENDPOINT */
Paul Bakker5121ce52009-01-03 21:22:43 +00009320
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009321void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01009322{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009323 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01009324}
9325
Hanno Becker7f376f42019-06-12 16:20:48 +01009326#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
9327 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009328void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009329{
Hanno Becker7f376f42019-06-12 16:20:48 +01009330 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009331}
Hanno Becker7f376f42019-06-12 16:20:48 +01009332#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY && !MBEDTLS_SSL_CONF_ANTI_REPLAY */
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02009333
Hanno Beckerde671542019-06-12 16:30:46 +01009334#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
9335 !defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
9336void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf,
9337 unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009338{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009339 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009340}
Hanno Beckerde671542019-06-12 16:30:46 +01009341#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT && !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02009342
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009343#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01009344
Hanno Becker1841b0a2018-08-24 11:13:57 +01009345void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
9346 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01009347{
9348 ssl->disable_datagram_packing = !allow_packing;
9349}
9350
Hanno Becker1f835fa2019-06-13 10:14:59 +01009351#if !( defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX) && \
9352 defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN) )
Hanno Becker04da1892018-08-14 13:22:10 +01009353void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
9354 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009355{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009356 conf->hs_timeout_min = min;
9357 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009358}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009359#else /* !( MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
9360 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX ) */
9361void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
9362 uint32_t min, uint32_t max )
9363{
9364 ((void) conf);
9365 ((void) min);
9366 ((void) max);
9367}
9368#endif /* MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
9369 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
9370
9371#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02009372
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009373void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00009374{
Hanno Beckeracd4fc02019-06-12 16:40:50 +01009375#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
9376 conf->authmode = authmode;
9377#else
9378 ((void) conf);
9379 ((void) authmode);
9380#endif /* MBEDTLS_SSL_CONF_AUTHMODE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009381}
9382
Hanno Becker9ec3fe02019-07-01 17:36:12 +01009383#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
9384 !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009385void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02009386 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009387 void *p_vrfy )
9388{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009389 conf->f_vrfy = f_vrfy;
9390 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009391}
Hanno Becker9ec3fe02019-07-01 17:36:12 +01009392#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00009393
Hanno Beckerece325c2019-06-13 15:39:27 +01009394#if !defined(MBEDTLS_SSL_CONF_RNG)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009395void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00009396 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00009397 void *p_rng )
9398{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01009399 conf->f_rng = f_rng;
9400 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00009401}
Hanno Beckerece325c2019-06-13 15:39:27 +01009402#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00009403
Hanno Becker14a4a442019-07-02 17:00:34 +01009404#if defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009405void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02009406 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00009407 void *p_dbg )
9408{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009409 conf->f_dbg = f_dbg;
9410 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00009411}
Hanno Becker14a4a442019-07-02 17:00:34 +01009412#endif /* MBEDTLS_DEBUG_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00009413
Hanno Beckera58a8962019-06-13 16:11:15 +01009414#if !defined(MBEDTLS_SSL_CONF_RECV) && \
9415 !defined(MBEDTLS_SSL_CONF_SEND) && \
9416 !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009417void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009418 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00009419 mbedtls_ssl_send_t *f_send,
9420 mbedtls_ssl_recv_t *f_recv,
9421 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009422{
Hanno Beckera58a8962019-06-13 16:11:15 +01009423 ssl->p_bio = p_bio;
9424 ssl->f_send = f_send;
9425 ssl->f_recv = f_recv;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009426 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009427}
Hanno Beckera58a8962019-06-13 16:11:15 +01009428#else
9429void mbedtls_ssl_set_bio_ctx( mbedtls_ssl_context *ssl,
9430 void *p_bio )
9431{
9432 ssl->p_bio = p_bio;
9433}
9434#endif
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009435
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02009436#if defined(MBEDTLS_SSL_PROTO_DTLS)
9437void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
9438{
9439 ssl->mtu = mtu;
9440}
9441#endif
9442
Hanno Becker1f835fa2019-06-13 10:14:59 +01009443#if !defined(MBEDTLS_SSL_CONF_READ_TIMEOUT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009444void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009445{
9446 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009447}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009448#endif /* MBEDTLS_SSL_CONF_READ_TIMEOUT */
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009449
Hanno Becker0ae6b242019-06-13 16:45:36 +01009450#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && \
9451 !defined(MBEDTLS_SSL_CONF_GET_TIMER)
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009452void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
9453 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00009454 mbedtls_ssl_set_timer_t *f_set_timer,
9455 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009456{
9457 ssl->p_timer = p_timer;
9458 ssl->f_set_timer = f_set_timer;
9459 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009460 /* Make sure we start with no timer running */
9461 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009462}
Hanno Becker0ae6b242019-06-13 16:45:36 +01009463#else
9464void mbedtls_ssl_set_timer_cb_ctx( mbedtls_ssl_context *ssl,
9465 void *p_timer )
9466{
9467 ssl->p_timer = p_timer;
9468 /* Make sure we start with no timer running */
9469 ssl_set_timer( ssl, 0 );
9470}
9471#endif
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009472
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009473#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009474void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009475 void *p_cache,
9476 int (*f_get_cache)(void *, mbedtls_ssl_session *),
9477 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
Paul Bakker5121ce52009-01-03 21:22:43 +00009478{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009479 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009480 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009481 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00009482}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009483#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009484
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009485#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009486int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00009487{
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009488 int ret;
9489
9490 if( ssl == NULL ||
9491 session == NULL ||
9492 ssl->session_negotiate == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +01009493 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009494 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009495 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009496 }
9497
Hanno Becker58fccf22019-02-06 14:30:46 +00009498 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
9499 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009500 return( ret );
9501
Jarno Lamsa8d09e572019-12-19 15:20:19 +02009502 ssl->handshake->resume = MBEDTLS_SSL_FI_FLAG_SET;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009503
9504 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00009505}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009506#endif /* MBEDTLS_SSL_CLI_C && !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009507
Hanno Becker73f4cb12019-06-27 13:51:07 +01009508#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009509void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009510 const int *ciphersuites )
Paul Bakker5121ce52009-01-03 21:22:43 +00009511{
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009512 conf->ciphersuite_list[0] = ciphersuites;
9513 conf->ciphersuite_list[1] = ciphersuites;
9514 conf->ciphersuite_list[2] = ciphersuites;
9515 conf->ciphersuite_list[3] = ciphersuites;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009516}
9517
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009518void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02009519 const int *ciphersuites,
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009520 int major, int minor )
9521{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009522 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009523 return;
9524
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009525 if( mbedtls_ssl_ver_lt( minor, MBEDTLS_SSL_MINOR_VERSION_0 ) ||
9526 mbedtls_ssl_ver_gt( minor, MBEDTLS_SSL_MINOR_VERSION_3 ) )
9527 {
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009528 return;
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009529 }
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009530
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009531 conf->ciphersuite_list[mbedtls_ssl_minor_ver_index( minor )] =
9532 ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00009533}
Hanno Becker73f4cb12019-06-27 13:51:07 +01009534#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009535
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009536#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009537void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01009538 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009539{
9540 conf->cert_profile = profile;
9541}
9542
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009543/* Append a new keycert entry to a (possibly empty) list */
9544static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
9545 mbedtls_x509_crt *cert,
9546 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009547{
niisato8ee24222018-06-25 19:05:48 +09009548 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009549
niisato8ee24222018-06-25 19:05:48 +09009550 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
9551 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009552 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009553
niisato8ee24222018-06-25 19:05:48 +09009554 new_cert->cert = cert;
9555 new_cert->key = key;
9556 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009557
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009558 /* Update head is the list was null, else add to the end */
9559 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01009560 {
niisato8ee24222018-06-25 19:05:48 +09009561 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01009562 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009563 else
9564 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009565 mbedtls_ssl_key_cert *cur = *head;
9566 while( cur->next != NULL )
9567 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09009568 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009569 }
9570
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009571 return( 0 );
9572}
9573
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009574int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009575 mbedtls_x509_crt *own_cert,
9576 mbedtls_pk_context *pk_key )
9577{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02009578 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009579}
9580
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009581void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009582 mbedtls_x509_crt *ca_chain,
9583 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009584{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009585 conf->ca_chain = ca_chain;
9586 conf->ca_crl = ca_crl;
Paul Bakker5121ce52009-01-03 21:22:43 +00009587}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009588#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00009589
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009590#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
9591int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
9592 mbedtls_x509_crt *own_cert,
9593 mbedtls_pk_context *pk_key )
9594{
9595 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
9596 own_cert, pk_key ) );
9597}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02009598
9599void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
9600 mbedtls_x509_crt *ca_chain,
9601 mbedtls_x509_crl *ca_crl )
9602{
9603 ssl->handshake->sni_ca_chain = ca_chain;
9604 ssl->handshake->sni_ca_crl = ca_crl;
9605}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02009606
9607void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
9608 int authmode )
9609{
9610 ssl->handshake->sni_authmode = authmode;
9611}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009612#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9613
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009614#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009615/*
9616 * Set EC J-PAKE password for current handshake
9617 */
9618int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
9619 const unsigned char *pw,
9620 size_t pw_len )
9621{
9622 mbedtls_ecjpake_role role;
9623
Janos Follath8eb64132016-06-03 15:40:57 +01009624 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009625 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9626
Hanno Becker2d9623f2019-06-13 12:07:05 +01009627 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009628 role = MBEDTLS_ECJPAKE_SERVER;
9629 else
9630 role = MBEDTLS_ECJPAKE_CLIENT;
9631
9632 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
9633 role,
9634 MBEDTLS_MD_SHA256,
9635 MBEDTLS_ECP_DP_SECP256R1,
9636 pw, pw_len ) );
9637}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009638#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009639
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009640#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009641int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009642 const unsigned char *psk, size_t psk_len,
9643 const unsigned char *psk_identity, size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009644{
Paul Bakker6db455e2013-09-18 17:29:31 +02009645 if( psk == NULL || psk_identity == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009646 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker6db455e2013-09-18 17:29:31 +02009647
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009648 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9649 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01009650
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009651 /* Identity len will be encoded on two bytes */
9652 if( ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10009653 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009654 {
9655 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9656 }
9657
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009658 if( conf->psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02009659 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009660 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009661
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009662 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009663 conf->psk = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009664 conf->psk_len = 0;
9665 }
9666 if( conf->psk_identity != NULL )
9667 {
9668 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009669 conf->psk_identity = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009670 conf->psk_identity_len = 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02009671 }
9672
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009673 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
9674 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
Mansour Moufidf81088b2015-02-17 13:10:21 -05009675 {
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009676 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009677 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009678 conf->psk = NULL;
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009679 conf->psk_identity = NULL;
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009680 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Mansour Moufidf81088b2015-02-17 13:10:21 -05009681 }
Paul Bakker6db455e2013-09-18 17:29:31 +02009682
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009683 conf->psk_len = psk_len;
9684 conf->psk_identity_len = psk_identity_len;
Paul Bakker6db455e2013-09-18 17:29:31 +02009685
Teppo Järvelin91d79382019-10-02 09:09:31 +03009686 mbedtls_platform_memcpy( conf->psk, psk, conf->psk_len );
9687 mbedtls_platform_memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker6db455e2013-09-18 17:29:31 +02009688
9689 return( 0 );
9690}
9691
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009692int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
9693 const unsigned char *psk, size_t psk_len )
9694{
9695 if( psk == NULL || ssl->handshake == NULL )
9696 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9697
9698 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9699 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9700
9701 if( ssl->handshake->psk != NULL )
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009702 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009703 mbedtls_platform_zeroize( ssl->handshake->psk,
9704 ssl->handshake->psk_len );
Simon Butcher5b8d1d62015-10-04 22:06:51 +01009705 mbedtls_free( ssl->handshake->psk );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009706 ssl->handshake->psk_len = 0;
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009707 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009708
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009709 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009710 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009711
9712 ssl->handshake->psk_len = psk_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03009713 mbedtls_platform_memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009714
9715 return( 0 );
9716}
9717
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009718void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009719 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02009720 size_t),
9721 void *p_psk )
9722{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009723 conf->f_psk = f_psk;
9724 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009725}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009726#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00009727
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009728#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker470a8c42017-10-04 15:28:46 +01009729
9730#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009731int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
Paul Bakker5121ce52009-01-03 21:22:43 +00009732{
9733 int ret;
9734
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009735 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
9736 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
9737 {
9738 mbedtls_mpi_free( &conf->dhm_P );
9739 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker5121ce52009-01-03 21:22:43 +00009740 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009741 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009742
9743 return( 0 );
9744}
Hanno Becker470a8c42017-10-04 15:28:46 +01009745#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker5121ce52009-01-03 21:22:43 +00009746
Hanno Beckera90658f2017-10-04 15:29:08 +01009747int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
9748 const unsigned char *dhm_P, size_t P_len,
9749 const unsigned char *dhm_G, size_t G_len )
9750{
9751 int ret;
9752
9753 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
9754 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
9755 {
9756 mbedtls_mpi_free( &conf->dhm_P );
9757 mbedtls_mpi_free( &conf->dhm_G );
9758 return( ret );
9759 }
9760
9761 return( 0 );
9762}
Paul Bakker5121ce52009-01-03 21:22:43 +00009763
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009764int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00009765{
9766 int ret;
9767
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009768 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
9769 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
9770 {
9771 mbedtls_mpi_free( &conf->dhm_P );
9772 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00009773 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009774 }
Paul Bakker1b57b062011-01-06 15:48:19 +00009775
9776 return( 0 );
9777}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009778#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00009779
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02009780#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
9781/*
9782 * Set the minimum length for Diffie-Hellman parameters
9783 */
9784void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
9785 unsigned int bitlen )
9786{
9787 conf->dhm_min_bitlen = bitlen;
9788}
9789#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
9790
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009791#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009792/*
9793 * Set allowed/preferred hashes for handshake signatures
9794 */
9795void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
9796 const int *hashes )
9797{
Hanno Becker56595f42019-06-19 16:31:38 +01009798#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009799 conf->sig_hashes = hashes;
Hanno Becker56595f42019-06-19 16:31:38 +01009800#else
9801 ((void) conf);
9802 ((void) hashes);
9803#endif /* MBEDTLS_SSL_CONF_SINGLE_SIG_HASH */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009804}
Hanno Becker947194e2017-04-07 13:25:49 +01009805#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009806
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02009807#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +01009808#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009809/*
9810 * Set the allowed elliptic curves
9811 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009812void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009813 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009814{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009815 conf->curve_list = curve_list;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009816}
Hanno Beckerc1096e72019-06-19 12:30:41 +01009817#endif /* MBEDTLS_SSL_CONF_SINGLE_EC */
Hanno Becker947194e2017-04-07 13:25:49 +01009818#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009819
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009820#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009821int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00009822{
Hanno Becker947194e2017-04-07 13:25:49 +01009823 /* Initialize to suppress unnecessary compiler warning */
9824 size_t hostname_len = 0;
9825
9826 /* Check if new hostname is valid before
9827 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01009828 if( hostname != NULL )
9829 {
9830 hostname_len = strlen( hostname );
9831
9832 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
9833 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9834 }
9835
9836 /* Now it's clear that we will overwrite the old hostname,
9837 * so we can free it safely */
9838
9839 if( ssl->hostname != NULL )
9840 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009841 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01009842 mbedtls_free( ssl->hostname );
9843 }
9844
9845 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01009846
Paul Bakker5121ce52009-01-03 21:22:43 +00009847 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01009848 {
9849 ssl->hostname = NULL;
9850 }
9851 else
9852 {
9853 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01009854 if( ssl->hostname == NULL )
9855 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009856
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03009857 /* Not using more secure mbedtls_platform_memcpy as hostname is public in initial handshake */
9858 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009859
Hanno Becker947194e2017-04-07 13:25:49 +01009860 ssl->hostname[hostname_len] = '\0';
9861 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009862
9863 return( 0 );
9864}
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009865#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009866
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009867#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009868void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009869 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00009870 const unsigned char *, size_t),
9871 void *p_sni )
9872{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009873 conf->f_sni = f_sni;
9874 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00009875}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009876#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00009877
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009878#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009879int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009880{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009881 size_t cur_len, tot_len;
9882 const char **p;
9883
9884 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08009885 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
9886 * MUST NOT be truncated."
9887 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009888 */
9889 tot_len = 0;
9890 for( p = protos; *p != NULL; p++ )
9891 {
9892 cur_len = strlen( *p );
9893 tot_len += cur_len;
9894
9895 if( cur_len == 0 || cur_len > 255 || tot_len > 65535 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009896 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009897 }
9898
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009899 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009900
9901 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009902}
9903
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009904const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009905{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02009906 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009907}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009908#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009909
Hanno Becker33b9b252019-07-05 11:23:25 +01009910#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || \
9911 !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
9912void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf,
9913 int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00009914{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009915 conf->max_major_ver = major;
9916 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00009917}
Hanno Becker33b9b252019-07-05 11:23:25 +01009918#endif /* MBEDTLS_SSL_CONF_MAX_MINOR_VER ||
9919 MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
Paul Bakker490ecc82011-10-06 13:04:09 +00009920
Hanno Becker33b9b252019-07-05 11:23:25 +01009921#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || \
9922 !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
9923void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf,
9924 int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00009925{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009926 conf->min_major_ver = major;
9927 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00009928}
Hanno Becker33b9b252019-07-05 11:23:25 +01009929#endif /* MBEDTLS_SSL_CONF_MIN_MINOR_VER ||
9930 MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
Paul Bakker1d29fb52012-09-28 13:28:45 +00009931
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009932#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009933void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009934{
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01009935 conf->fallback = fallback;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009936}
9937#endif
9938
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +01009939#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +01009940void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
9941 char cert_req_ca_list )
9942{
9943 conf->cert_req_ca_list = cert_req_ca_list;
9944}
9945#endif
9946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009947#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009948void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009949{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009950 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009951}
9952#endif
9953
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009954#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckerf765ce62019-06-21 13:17:14 +01009955#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009956void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009957{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009958 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009959}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009960#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
9961#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009962void mbedtls_ssl_conf_extended_master_secret_enforce( mbedtls_ssl_config *conf,
Jarno Lamsa842be162019-06-10 15:05:33 +03009963 char ems_enf )
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009964{
9965 conf->enforce_extended_master_secret = ems_enf;
9966}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009967#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Hanno Beckeraabbb582019-06-11 13:43:27 +01009968#endif /* !MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009969
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009970#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009971void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009972{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009973 conf->arc4_disabled = arc4;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009974}
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009975#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009976
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009977#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009978int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009979{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009980 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10009981 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009982 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009983 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009984 }
9985
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01009986 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009987
9988 return( 0 );
9989}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009990#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009991
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009992#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009993void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009994{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009995 conf->trunc_hmac = truncate;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009996}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009997#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009998
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009999#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010000void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010010001{
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010010002 conf->cbc_record_splitting = split;
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010010003}
10004#endif
10005
Hanno Beckerb0b2b672019-06-12 16:58:10 +010010006#if !defined(MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010007void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +000010008{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010009 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +000010010}
Hanno Beckerb0b2b672019-06-12 16:58:10 +010010011#endif /* !MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000010012
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010013#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010014void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +010010015{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010016 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +010010017}
10018
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010019void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020010020{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020010021 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020010022}
10023
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020010024void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +010010025 const unsigned char period[8] )
10026{
Teppo Järvelin91d79382019-10-02 09:09:31 +030010027 mbedtls_platform_memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +010010028}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010029#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000010030
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010031#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010032#if defined(MBEDTLS_SSL_CLI_C)
10033void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010034{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +010010035 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010036}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010037#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +020010038
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010039#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +020010040void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
10041 mbedtls_ssl_ticket_write_t *f_ticket_write,
10042 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
10043 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +020010044{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +020010045 conf->f_ticket_write = f_ticket_write;
10046 conf->f_ticket_parse = f_ticket_parse;
10047 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +020010048}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020010049#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010050#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +020010051
Robert Cragie4feb7ae2015-10-02 13:33:37 +010010052#if defined(MBEDTLS_SSL_EXPORT_KEYS)
10053void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
10054 mbedtls_ssl_export_keys_t *f_export_keys,
10055 void *p_export_keys )
10056{
10057 conf->f_export_keys = f_export_keys;
10058 conf->p_export_keys = p_export_keys;
10059}
10060#endif
10061
Gilles Peskineb74a1c72018-04-24 13:09:22 +020010062#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010063void mbedtls_ssl_conf_async_private_cb(
10064 mbedtls_ssl_config *conf,
10065 mbedtls_ssl_async_sign_t *f_async_sign,
10066 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
10067 mbedtls_ssl_async_resume_t *f_async_resume,
10068 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010069 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010070{
10071 conf->f_async_sign_start = f_async_sign;
10072 conf->f_async_decrypt_start = f_async_decrypt;
10073 conf->f_async_resume = f_async_resume;
10074 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010075 conf->p_async_config_data = async_config_data;
10076}
10077
Gilles Peskine8f97af72018-04-26 11:46:10 +020010078void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
10079{
10080 return( conf->p_async_config_data );
10081}
10082
Gilles Peskine1febfef2018-04-30 11:54:39 +020010083void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010084{
10085 if( ssl->handshake == NULL )
10086 return( NULL );
10087 else
10088 return( ssl->handshake->user_async_ctx );
10089}
10090
Gilles Peskine1febfef2018-04-30 11:54:39 +020010091void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020010092 void *ctx )
10093{
10094 if( ssl->handshake != NULL )
10095 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010096}
Gilles Peskineb74a1c72018-04-24 13:09:22 +020010097#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +010010098
Paul Bakker5121ce52009-01-03 21:22:43 +000010099/*
10100 * SSL get accessors
10101 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010102size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010103{
10104 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
10105}
10106
Hanno Becker8b170a02017-10-10 11:51:19 +010010107int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
10108{
10109 /*
10110 * Case A: We're currently holding back
10111 * a message for further processing.
10112 */
10113
10114 if( ssl->keep_current_message == 1 )
10115 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010116 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010117 return( 1 );
10118 }
10119
10120 /*
10121 * Case B: Further records are pending in the current datagram.
10122 */
10123
10124#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010125 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker8b170a02017-10-10 11:51:19 +010010126 ssl->in_left > ssl->next_record_offset )
10127 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010128 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010129 return( 1 );
10130 }
10131#endif /* MBEDTLS_SSL_PROTO_DTLS */
10132
10133 /*
10134 * Case C: A handshake message is being processed.
10135 */
10136
Hanno Becker8b170a02017-10-10 11:51:19 +010010137 if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
10138 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010139 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010140 return( 1 );
10141 }
10142
10143 /*
10144 * Case D: An application data message is being processed
10145 */
10146 if( ssl->in_offt != NULL )
10147 {
Hanno Beckera6fb0892017-10-23 13:17:48 +010010148 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +010010149 return( 1 );
10150 }
10151
10152 /*
10153 * In all other cases, the rest of the message can be dropped.
Hanno Beckerc573ac32018-08-28 17:15:25 +010010154 * As in ssl_get_next_record, this needs to be adapted if
Hanno Becker8b170a02017-10-10 11:51:19 +010010155 * we implement support for multiple alerts in single records.
10156 */
10157
10158 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
10159 return( 0 );
10160}
10161
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020010162uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010163{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +000010164 if( ssl->session != NULL )
10165 return( ssl->session->verify_result );
10166
10167 if( ssl->session_negotiate != NULL )
10168 return( ssl->session_negotiate->verify_result );
10169
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +020010170 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +000010171}
10172
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010173const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +000010174{
Hanno Beckere02758c2019-06-26 15:31:31 +010010175 int suite;
10176
Paul Bakker926c8e42013-03-06 10:23:34 +010010177 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010178 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +010010179
Hanno Beckere02758c2019-06-26 15:31:31 +010010180 suite = mbedtls_ssl_session_get_ciphersuite( ssl->session );
10181 return( mbedtls_ssl_get_ciphersuite_name( suite ) );
Paul Bakker72f62662011-01-16 21:27:44 +000010182}
10183
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010184const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +000010185{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010186#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010187 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010188 {
Hanno Becker2881d802019-05-22 14:44:53 +010010189 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010190 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010191 case MBEDTLS_SSL_MINOR_VERSION_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010192 return( "DTLSv1.0" );
10193
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010194 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +010010195 return( "DTLSv1.2" );
10196
10197 default:
10198 return( "unknown (DTLS)" );
10199 }
10200 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010201 MBEDTLS_SSL_TRANSPORT_ELSE
10202#endif /* MBEDTLS_SSL_PROTO_DTLS */
10203#if defined(MBEDTLS_SSL_PROTO_TLS)
Paul Bakker43ca69c2011-01-15 17:35:19 +000010204 {
Hanno Becker2881d802019-05-22 14:44:53 +010010205 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010206 {
10207 case MBEDTLS_SSL_MINOR_VERSION_0:
10208 return( "SSLv3.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010209
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010210 case MBEDTLS_SSL_MINOR_VERSION_1:
10211 return( "TLSv1.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010212
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010213 case MBEDTLS_SSL_MINOR_VERSION_2:
10214 return( "TLSv1.1" );
Paul Bakker43ca69c2011-01-15 17:35:19 +000010215
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010216 case MBEDTLS_SSL_MINOR_VERSION_3:
10217 return( "TLSv1.2" );
Paul Bakker1ef83d62012-04-11 12:09:53 +000010218
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010219 default:
10220 return( "unknown" );
10221 }
Paul Bakker43ca69c2011-01-15 17:35:19 +000010222 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010223#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker43ca69c2011-01-15 17:35:19 +000010224}
10225
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010226int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010227{
Hanno Becker3136ede2018-08-17 15:28:19 +010010228 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010229 const mbedtls_ssl_transform *transform = ssl->transform_out;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010230
Hanno Becker43395762019-05-03 14:46:38 +010010231 size_t out_hdr_len = mbedtls_ssl_out_hdr_len( ssl );
10232
Hanno Becker78640902018-08-13 16:35:15 +010010233 if( transform == NULL )
Hanno Becker43395762019-05-03 14:46:38 +010010234 return( (int) out_hdr_len );
Hanno Becker78640902018-08-13 16:35:15 +010010235
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010236#if defined(MBEDTLS_ZLIB_SUPPORT)
10237 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
10238 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010239#endif
Andrzej Kurek11750442020-09-17 07:12:06 -040010240#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
10241 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx ) )
10242#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010243 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Andrzej Kurek11750442020-09-17 07:12:06 -040010244#endif
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010245 {
Hanno Beckera9d5c452019-07-25 16:47:12 +010010246#if defined(MBEDTLS_GCM_C) || \
10247 defined(MBEDTLS_CCM_C) || \
10248 defined(MBEDTLS_CHACHAPOLY_C)
10249#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010250 case MBEDTLS_MODE_GCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010251#endif
10252#if defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010253 case MBEDTLS_MODE_CCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010254#endif
10255#if defined(MBEDTLS_CHACHAPOLY_C)
Hanno Becker5b559ac2018-08-03 09:40:07 +010010256 case MBEDTLS_MODE_CHACHAPOLY:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010257#endif
10258 transform_expansion =
10259 transform->ivlen - transform->fixed_ivlen + transform->taglen;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010260 break;
10261
Hanno Beckera9d5c452019-07-25 16:47:12 +010010262#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C ||
10263 MBEDTLS_CHACHAPOLY_C */
10264
10265#if defined(MBEDTLS_CIPHER_MODE_STREAM)
10266 case MBEDTLS_MODE_STREAM:
10267 transform_expansion = transform->maclen;
10268 break;
10269#endif /* MBEDTLS_CIPHER_MODE_STREAM */
10270
10271#if defined(MBEDTLS_CIPHER_MODE_CBC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010272 case MBEDTLS_MODE_CBC:
Hanno Beckera9d5c452019-07-25 16:47:12 +010010273 {
10274 size_t block_size;
Andrzej Kurek11750442020-09-17 07:12:06 -040010275#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
10276 block_size = mbedtls_cipher_get_block_size(
10277 &transform->cipher_ctx );
10278#else
Hanno Becker5b559ac2018-08-03 09:40:07 +010010279 block_size = mbedtls_cipher_get_block_size(
10280 &transform->cipher_ctx_enc );
Andrzej Kurek11750442020-09-17 07:12:06 -040010281#endif
Hanno Becker3136ede2018-08-17 15:28:19 +010010282 /* Expansion due to the addition of the MAC. */
10283 transform_expansion += transform->maclen;
10284
10285 /* Expansion due to the addition of CBC padding;
10286 * Theoretically up to 256 bytes, but we never use
10287 * more than the block size of the underlying cipher. */
10288 transform_expansion += block_size;
10289
10290 /* For TLS 1.1 or higher, an explicit IV is added
10291 * after the record header. */
Hanno Becker5b559ac2018-08-03 09:40:07 +010010292#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010010293 if( mbedtls_ssl_ver_geq(
10294 mbedtls_ssl_get_minor_ver( ssl ),
10295 MBEDTLS_SSL_MINOR_VERSION_2 ) )
10296 {
Hanno Becker3136ede2018-08-17 15:28:19 +010010297 transform_expansion += block_size;
Hanno Becker7bcf2b52019-07-26 09:02:40 +010010298 }
Hanno Becker5b559ac2018-08-03 09:40:07 +010010299#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker3136ede2018-08-17 15:28:19 +010010300
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010301 break;
Hanno Beckera9d5c452019-07-25 16:47:12 +010010302 }
10303#endif /* MBEDTLS_CIPHER_MODE_CBC */
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010304
10305 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020010306 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010307 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010308 }
10309
Hanno Beckera5a2b082019-05-15 14:03:01 +010010310#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckeradd01902019-05-08 15:40:11 +010010311 if( transform->out_cid_len != 0 )
10312 transform_expansion += MBEDTLS_SSL_MAX_CID_EXPANSION;
Hanno Beckera5a2b082019-05-15 14:03:01 +010010313#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckeradd01902019-05-08 15:40:11 +010010314
Hanno Becker43395762019-05-03 14:46:38 +010010315 return( (int)( out_hdr_len + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +020010316}
10317
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010318#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +020010319size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
10320{
10321 size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
10322 size_t read_mfl;
10323
10324 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
Kevin Braceyd859db82020-11-03 15:56:12 +020010325 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT &&
Andrzej Kurekf3844952020-10-16 23:03:01 +020010326 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
10327 {
10328 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
10329 }
10330
10331 /* Check if a smaller max length was negotiated */
10332 if( ssl->session_out != NULL )
10333 {
10334 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
10335 if( read_mfl < max_len )
10336 {
10337 max_len = read_mfl;
10338 }
10339 }
10340
10341 // During a handshake, use the value being negotiated
10342 if( ssl->session_negotiate != NULL )
10343 {
10344 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
10345 if( read_mfl < max_len )
10346 {
10347 max_len = read_mfl;
10348 }
10349 }
10350
10351 return( max_len );
10352}
10353
10354size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010355{
10356 size_t max_len;
10357
10358 /*
10359 * Assume mfl_code is correct since it was checked when set
10360 */
Angus Grattond8213d02016-05-25 20:56:48 +100010361 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010362
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +020010363 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010364 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +100010365 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010366 {
Angus Grattond8213d02016-05-25 20:56:48 +100010367 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010368 }
10369
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +020010370 /* During a handshake, use the value being negotiated */
10371 if( ssl->session_negotiate != NULL &&
10372 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
10373 {
10374 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
10375 }
10376
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010377 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010378}
Andrzej Kurekf3844952020-10-16 23:03:01 +020010379
10380#if !defined(MBEDTLS_DEPRECATED_REMOVED)
10381size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
10382{
10383 return mbedtls_ssl_get_output_max_frag_len( ssl );
10384}
10385#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +020010386#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10387
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010388#if defined(MBEDTLS_SSL_PROTO_DTLS)
10389static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
10390{
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010391 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
Hanno Becker2d9623f2019-06-13 12:07:05 +010010392 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT &&
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010393 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
10394 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010395 return( 0 );
Andrzej Kurekef43ce62018-10-09 08:24:12 -040010396
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010397 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
10398 return( ssl->mtu );
10399
10400 if( ssl->mtu == 0 )
10401 return( ssl->handshake->mtu );
10402
10403 return( ssl->mtu < ssl->handshake->mtu ?
10404 ssl->mtu : ssl->handshake->mtu );
10405}
10406#endif /* MBEDTLS_SSL_PROTO_DTLS */
10407
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010408int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
10409{
10410 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
10411
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +020010412#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
10413 !defined(MBEDTLS_SSL_PROTO_DTLS)
10414 (void) ssl;
10415#endif
10416
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010417#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurekf3844952020-10-16 23:03:01 +020010418 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010419
10420 if( max_len > mfl )
10421 max_len = mfl;
10422#endif
10423
10424#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010425 if( ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010426 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010427 const size_t mtu = ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010428 const int ret = mbedtls_ssl_get_record_expansion( ssl );
10429 const size_t overhead = (size_t) ret;
10430
10431 if( ret < 0 )
10432 return( ret );
10433
10434 if( mtu <= overhead )
10435 {
10436 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
10437 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
10438 }
10439
10440 if( max_len > mtu - overhead )
10441 max_len = mtu - overhead;
10442 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +020010443#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010444
Hanno Becker0defedb2018-08-10 12:35:02 +010010445#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
10446 !defined(MBEDTLS_SSL_PROTO_DTLS)
10447 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020010448#endif
10449
10450 return( (int) max_len );
10451}
10452
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010453#if defined(MBEDTLS_X509_CRT_PARSE_C)
10454const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +000010455{
10456 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010457 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +000010458
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010459#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010460 return( ssl->session->peer_cert );
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010461#else
10462 return( NULL );
10463#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010464}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010465#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010466
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010467#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker933b9fc2019-02-05 11:42:30 +000010468int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
10469 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010470{
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010471 if( ssl == NULL ||
10472 dst == NULL ||
10473 ssl->session == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +010010474 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010475 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010476 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010477 }
10478
Hanno Becker58fccf22019-02-06 14:30:46 +000010479 return( mbedtls_ssl_session_copy( dst, ssl->session ) );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010480}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010481#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010482
Manuel Pégourié-Gonnard37a53242019-05-20 11:12:28 +020010483const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl )
10484{
10485 if( ssl == NULL )
10486 return( NULL );
10487
10488 return( ssl->session );
10489}
10490
Paul Bakker5121ce52009-01-03 21:22:43 +000010491/*
Hanno Beckerb5352f02019-05-16 12:39:07 +010010492 * Define ticket header determining Mbed TLS version
10493 * and structure of the ticket.
10494 */
10495
Hanno Becker41527622019-05-16 12:50:45 +010010496/*
Hanno Becker26829e92019-05-28 14:30:45 +010010497 * Define bitflag determining compile-time settings influencing
10498 * structure of serialized SSL sessions.
Hanno Becker41527622019-05-16 12:50:45 +010010499 */
10500
Hanno Becker26829e92019-05-28 14:30:45 +010010501#if defined(MBEDTLS_HAVE_TIME)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010502#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker26829e92019-05-28 14:30:45 +010010503#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010504#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker41527622019-05-16 12:50:45 +010010505#endif /* MBEDTLS_HAVE_TIME */
10506
10507#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010508#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker41527622019-05-16 12:50:45 +010010509#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010510#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker41527622019-05-16 12:50:45 +010010511#endif /* MBEDTLS_X509_CRT_PARSE_C */
10512
10513#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010514#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker41527622019-05-16 12:50:45 +010010515#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010516#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker41527622019-05-16 12:50:45 +010010517#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
10518
10519#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010520#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker41527622019-05-16 12:50:45 +010010521#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010522#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker41527622019-05-16 12:50:45 +010010523#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10524
10525#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010526#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 1
Hanno Becker41527622019-05-16 12:50:45 +010010527#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010528#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 0
Hanno Becker41527622019-05-16 12:50:45 +010010529#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
10530
10531#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010532#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker41527622019-05-16 12:50:45 +010010533#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010534#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker41527622019-05-16 12:50:45 +010010535#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
10536
Hanno Becker41527622019-05-16 12:50:45 +010010537#if defined(MBEDTLS_SSL_SESSION_TICKETS)
10538#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
10539#else
10540#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
10541#endif /* MBEDTLS_SSL_SESSION_TICKETS */
10542
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010543#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
10544#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 1
10545#else
10546#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 0
10547#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10548
Hanno Becker88440552019-07-03 14:16:13 +010010549#if defined(MBEDTLS_ZLIB_SUPPORT)
10550#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 1
10551#else
10552#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 0
10553#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10554
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010555#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
10556#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
10557#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
10558#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
10559#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT 4
10560#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 5
10561#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 6
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010562#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT 7
Hanno Becker88440552019-07-03 14:16:13 +010010563#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT 8
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010564
Hanno Becker26829e92019-05-28 14:30:45 +010010565#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010566 ( (uint16_t) ( \
10567 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
10568 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
10569 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
10570 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
10571 ( SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC << SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT ) | \
10572 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010573 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) | \
Hanno Becker88440552019-07-03 14:16:13 +010010574 ( SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION << SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010575 ( SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT << SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT ) ) )
Hanno Becker41527622019-05-16 12:50:45 +010010576
Hanno Becker557fe9f2019-05-16 12:41:07 +010010577static unsigned char ssl_serialized_session_header[] = {
Hanno Becker41527622019-05-16 12:50:45 +010010578 MBEDTLS_VERSION_MAJOR,
10579 MBEDTLS_VERSION_MINOR,
10580 MBEDTLS_VERSION_PATCH,
Hanno Becker26829e92019-05-28 14:30:45 +010010581 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
10582 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Hanno Becker557fe9f2019-05-16 12:41:07 +010010583};
Hanno Beckerb5352f02019-05-16 12:39:07 +010010584
10585/*
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010586 * Serialize a session in the following format:
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010587 * (in the presentation language of TLS, RFC 8446 section 3)
10588 *
Hanno Becker26829e92019-05-28 14:30:45 +010010589 * opaque mbedtls_version[3]; // major, minor, patch
10590 * opaque session_format[2]; // version-specific 16-bit field determining
10591 * // the format of the remaining
10592 * // serialized data.
Hanno Beckerb36db4f2019-05-29 11:08:00 +010010593 *
10594 * Note: When updating the format, remember to keep
10595 * these version+format bytes.
10596 *
Hanno Becker7bf77102019-06-04 09:43:16 +010010597 * // In this version, `session_format` determines
10598 * // the setting of those compile-time
10599 * // configuration options which influence
Hanno Becker26829e92019-05-28 14:30:45 +010010600 * // the structure of mbedtls_ssl_session.
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010601 * uint64 start_time;
Hanno Becker26829e92019-05-28 14:30:45 +010010602 * uint8 ciphersuite[2]; // defined by the standard
10603 * uint8 compression; // 0 or 1
10604 * uint8 session_id_len; // at most 32
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010605 * opaque session_id[32];
Hanno Becker26829e92019-05-28 14:30:45 +010010606 * opaque master[48]; // fixed length in the standard
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010607 * uint32 verify_result;
Hanno Becker0528f822019-06-18 12:45:31 +010010608 * select (MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) {
10609 * case enabled: opaque peer_cert<0..2^24-1>; // length 0 means no cert
10610 * case disabled: uint8_t peer_cert_digest_type;
10611 * opaque peer_cert_digest<0..2^8-1>;
10612 * }
Hanno Becker26829e92019-05-28 14:30:45 +010010613 * opaque ticket<0..2^24-1>; // length 0 means no ticket
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010614 * uint32 ticket_lifetime;
Hanno Becker26829e92019-05-28 14:30:45 +010010615 * uint8 mfl_code; // up to 255 according to standard
10616 * uint8 trunc_hmac; // 0 or 1
10617 * uint8 encrypt_then_mac; // 0 or 1
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010618 *
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010619 * The order is the same as in the definition of the structure, except
10620 * verify_result is put before peer_cert so that all mandatory fields come
10621 * together in one block.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010622 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010623static int ssl_session_save( const mbedtls_ssl_session *session,
10624 unsigned char omit_header,
10625 unsigned char *buf,
10626 size_t buf_len,
10627 size_t *olen )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010628{
10629 unsigned char *p = buf;
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010630 size_t used = 0;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010631#if defined(MBEDTLS_HAVE_TIME)
10632 uint64_t start;
10633#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010634#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010635#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010636 size_t cert_len;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010637#endif
Hanno Becker2e6d3472019-02-06 15:40:27 +000010638#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010639
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010640 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010641 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010642 /*
10643 * Add version identifier
10644 */
10645
10646 used += sizeof( ssl_serialized_session_header );
10647
10648 if( used <= buf_len )
10649 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010650 mbedtls_platform_memcpy( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010651 sizeof( ssl_serialized_session_header ) );
10652 p += sizeof( ssl_serialized_session_header );
10653 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010654 }
10655
10656 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010657 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010658 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010659#if defined(MBEDTLS_HAVE_TIME)
10660 used += 8;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010661
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010662 if( used <= buf_len )
10663 {
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010664 start = (uint64_t) session->start;
10665
10666 *p++ = (unsigned char)( ( start >> 56 ) & 0xFF );
10667 *p++ = (unsigned char)( ( start >> 48 ) & 0xFF );
10668 *p++ = (unsigned char)( ( start >> 40 ) & 0xFF );
10669 *p++ = (unsigned char)( ( start >> 32 ) & 0xFF );
10670 *p++ = (unsigned char)( ( start >> 24 ) & 0xFF );
10671 *p++ = (unsigned char)( ( start >> 16 ) & 0xFF );
10672 *p++ = (unsigned char)( ( start >> 8 ) & 0xFF );
10673 *p++ = (unsigned char)( ( start ) & 0xFF );
10674 }
10675#endif /* MBEDTLS_HAVE_TIME */
10676
10677 /*
10678 * Basic mandatory fields
10679 */
Hanno Becker88440552019-07-03 14:16:13 +010010680 {
10681 size_t const ciphersuite_len = 2;
10682#if defined(MBEDTLS_ZLIB_SUPPORT)
10683 size_t const compression_len = 1;
10684#else
10685 size_t const compression_len = 0;
10686#endif
10687 size_t const id_len_len = 1;
10688 size_t const id_len = 32;
10689 size_t const master_len = 48;
10690 size_t const verif_result_len = 4;
10691
10692 size_t const basic_len =
10693 ciphersuite_len +
10694 compression_len +
10695 id_len_len +
10696 id_len +
10697 master_len +
10698 verif_result_len;
10699
10700 used += basic_len;
10701 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010702
10703 if( used <= buf_len )
10704 {
Hanno Beckere02758c2019-06-26 15:31:31 +010010705 const int ciphersuite =
10706 mbedtls_ssl_session_get_ciphersuite( session );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010707 p = mbedtls_platform_put_uint16_be( p, ciphersuite );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010708
Hanno Becker88440552019-07-03 14:16:13 +010010709#if defined(MBEDTLS_ZLIB_SUPPORT)
10710 *p++ = (unsigned char)(
10711 mbedtls_ssl_session_get_compression( session ) );
10712#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010713
10714 *p++ = (unsigned char)( session->id_len & 0xFF );
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010715 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10716 memcpy( p, session->id, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010717 p += 32;
10718
Teppo Järvelin91d79382019-10-02 09:09:31 +030010719 mbedtls_platform_memcpy( p, session->master, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010720 p += 48;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010721 p = mbedtls_platform_put_uint32_be( p, session->verify_result );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010722 }
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010723
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010724 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010725 * Peer's end-entity certificate
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010726 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010727#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010728#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010729 if( session->peer_cert == NULL )
10730 cert_len = 0;
10731 else
10732 cert_len = session->peer_cert->raw.len;
10733
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010734 used += 3 + cert_len;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010735
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010736 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010737 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010738 p = mbedtls_platform_put_uint24_be( p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010739
10740 if( session->peer_cert != NULL )
10741 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010742 mbedtls_platform_memcpy( p, session->peer_cert->raw.p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010743 p += cert_len;
10744 }
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010745 }
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010746
Hanno Becker5882dd02019-06-06 16:25:57 +010010747#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010748 /* Digest of peer certificate */
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010749 if( session->peer_cert_digest != NULL )
10750 {
10751 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
10752 if( used <= buf_len )
10753 {
10754 *p++ = (unsigned char) session->peer_cert_digest_type;
10755 *p++ = (unsigned char) session->peer_cert_digest_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +030010756 mbedtls_platform_memcpy( p, session->peer_cert_digest,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010757 session->peer_cert_digest_len );
10758 p += session->peer_cert_digest_len;
10759 }
10760 }
10761 else
10762 {
10763 used += 2;
10764 if( used <= buf_len )
10765 {
10766 *p++ = (unsigned char) MBEDTLS_MD_NONE;
10767 *p++ = 0;
10768 }
10769 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010770#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010771#endif /* MBEDTLS_X509_CRT_PARSE_C */
10772
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010773 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010774 * Session ticket if any, plus associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010775 */
10776#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010777 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010778
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010779 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010780 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010781 p = mbedtls_platform_put_uint24_be( p, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010782
10783 if( session->ticket != NULL )
10784 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010785 mbedtls_platform_memcpy( p, session->ticket, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010786 p += session->ticket_len;
10787 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010788
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010789 p = mbedtls_platform_put_uint32_be( p, session->ticket_lifetime );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010790 }
10791#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
10792
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010793 /*
10794 * Misc extension-related info
10795 */
10796#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
10797 used += 1;
10798
10799 if( used <= buf_len )
10800 *p++ = session->mfl_code;
10801#endif
10802
10803#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
10804 used += 1;
10805
10806 if( used <= buf_len )
10807 *p++ = (unsigned char)( ( session->trunc_hmac ) & 0xFF );
10808#endif
10809
10810#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
10811 used += 1;
10812
10813 if( used <= buf_len )
10814 *p++ = (unsigned char)( ( session->encrypt_then_mac ) & 0xFF );
10815#endif
10816
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010817 /* Done */
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010818 *olen = used;
10819
10820 if( used > buf_len )
10821 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010822
10823 return( 0 );
10824}
10825
10826/*
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010827 * Public wrapper for ssl_session_save()
10828 */
10829int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
10830 unsigned char *buf,
10831 size_t buf_len,
10832 size_t *olen )
10833{
10834 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
10835}
10836
10837/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020010838 * Deserialize session, see mbedtls_ssl_session_save() for format.
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010839 *
10840 * This internal version is wrapped by a public function that cleans up in
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010841 * case of error, and has an extra option omit_header.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010842 */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010843static int ssl_session_load( mbedtls_ssl_session *session,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010844 unsigned char omit_header,
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010845 const unsigned char *buf,
10846 size_t len )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010847{
10848 const unsigned char *p = buf;
10849 const unsigned char * const end = buf + len;
Hanno Beckere02758c2019-06-26 15:31:31 +010010850 int ciphersuite;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010851#if defined(MBEDTLS_HAVE_TIME)
10852 uint64_t start;
10853#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010854#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010855#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010856 size_t cert_len;
Hanno Becker2e6d3472019-02-06 15:40:27 +000010857#endif
10858#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010859
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010860 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010861 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010862 /*
10863 * Check version identifier
10864 */
10865
10866 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
10867 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10868
Teppo Järvelin0efac532019-10-04 13:21:08 +030010869 // use regular memcmp as session header is public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030010870 if( memcmp( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010871 sizeof( ssl_serialized_session_header ) ) != 0 )
10872 {
10873 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10874 }
10875 p += sizeof( ssl_serialized_session_header );
Hanno Beckerb5352f02019-05-16 12:39:07 +010010876 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010877
10878 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010879 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010880 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010881#if defined(MBEDTLS_HAVE_TIME)
10882 if( 8 > (size_t)( end - p ) )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010883 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10884
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010885 start = ( (uint64_t) p[0] << 56 ) |
10886 ( (uint64_t) p[1] << 48 ) |
10887 ( (uint64_t) p[2] << 40 ) |
10888 ( (uint64_t) p[3] << 32 ) |
10889 ( (uint64_t) p[4] << 24 ) |
10890 ( (uint64_t) p[5] << 16 ) |
10891 ( (uint64_t) p[6] << 8 ) |
10892 ( (uint64_t) p[7] );
10893 p += 8;
10894
10895 session->start = (time_t) start;
10896#endif /* MBEDTLS_HAVE_TIME */
10897
10898 /*
10899 * Basic mandatory fields
10900 */
Hanno Becker88440552019-07-03 14:16:13 +010010901 {
10902 size_t const ciphersuite_len = 2;
10903#if defined(MBEDTLS_ZLIB_SUPPORT)
10904 size_t const compression_len = 1;
10905#else
10906 size_t const compression_len = 0;
10907#endif
10908 size_t const id_len_len = 1;
10909 size_t const id_len = 32;
10910 size_t const master_len = 48;
10911 size_t const verif_result_len = 4;
Hanno Beckere02758c2019-06-26 15:31:31 +010010912
Hanno Becker88440552019-07-03 14:16:13 +010010913 size_t const basic_len =
10914 ciphersuite_len +
10915 compression_len +
10916 id_len_len +
10917 id_len +
10918 master_len +
10919 verif_result_len;
10920
10921 if( basic_len > (size_t)( end - p ) )
10922 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10923 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010924
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010925 ciphersuite = (int)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010926 p += 2;
10927
Hanno Becker73f4cb12019-06-27 13:51:07 +010010928#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Beckere02758c2019-06-26 15:31:31 +010010929 session->ciphersuite = ciphersuite;
10930#else
10931 if( ciphersuite !=
Hanno Becker73f4cb12019-06-27 13:51:07 +010010932 MBEDTLS_SSL_SUITE_ID( MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE ) )
Hanno Beckere02758c2019-06-26 15:31:31 +010010933 {
10934 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10935 }
10936#endif
10937
Hanno Becker88440552019-07-03 14:16:13 +010010938#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010939 session->compression = *p++;
Hanno Becker88440552019-07-03 14:16:13 +010010940#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010941
10942 session->id_len = *p++;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010943 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10944 memcpy( session->id, p, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010945 p += 32;
10946
Teppo Järvelin91d79382019-10-02 09:09:31 +030010947 mbedtls_platform_memcpy( session->master, p, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010948 p += 48;
10949
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010950 session->verify_result = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010951 p += 4;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010952
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010953 /* Immediately clear invalid pointer values that have been read, in case
10954 * we exit early before we replaced them with valid ones. */
10955#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010956#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010957 session->peer_cert = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010958#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010959 session->peer_cert_digest = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010960#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010961#endif
10962#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
10963 session->ticket = NULL;
10964#endif
10965
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010966 /*
10967 * Peer certificate
10968 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010969#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010970#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010971 if( 3 > (size_t)( end - p ) )
10972 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10973
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010974 cert_len = mbedtls_platform_get_uint24_be( &p[0] );
10975
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010976 p += 3;
10977
10978 if( cert_len == 0 )
10979 {
10980 session->peer_cert = NULL;
10981 }
10982 else
10983 {
10984 int ret;
10985
10986 if( cert_len > (size_t)( end - p ) )
10987 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10988
10989 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
10990
10991 if( session->peer_cert == NULL )
10992 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
10993
10994 mbedtls_x509_crt_init( session->peer_cert );
10995
10996 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
10997 p, cert_len ) ) != 0 )
10998 {
10999 mbedtls_x509_crt_free( session->peer_cert );
11000 mbedtls_free( session->peer_cert );
11001 session->peer_cert = NULL;
11002 return( ret );
11003 }
11004
11005 p += cert_len;
11006 }
Hanno Becker5882dd02019-06-06 16:25:57 +010011007#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011008 /* Deserialize CRT digest from the end of the ticket. */
11009 if( 2 > (size_t)( end - p ) )
11010 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11011
11012 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
11013 session->peer_cert_digest_len = (size_t) *p++;
11014
11015 if( session->peer_cert_digest_len != 0 )
11016 {
Hanno Beckera5cedbc2019-07-17 11:21:02 +010011017 mbedtls_md_handle_t md_info =
Hanno Becker2326d202019-06-06 14:54:55 +010011018 mbedtls_md_info_from_type( session->peer_cert_digest_type );
Hanno Beckera5cedbc2019-07-17 11:21:02 +010011019 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Hanno Becker2326d202019-06-06 14:54:55 +010011020 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11021 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
11022 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11023
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011024 if( session->peer_cert_digest_len > (size_t)( end - p ) )
11025 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11026
11027 session->peer_cert_digest =
11028 mbedtls_calloc( 1, session->peer_cert_digest_len );
11029 if( session->peer_cert_digest == NULL )
11030 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
11031
Teppo Järvelin91d79382019-10-02 09:09:31 +030011032 mbedtls_platform_memcpy( session->peer_cert_digest, p,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000011033 session->peer_cert_digest_len );
11034 p += session->peer_cert_digest_len;
11035 }
Hanno Becker5882dd02019-06-06 16:25:57 +010011036#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020011037#endif /* MBEDTLS_X509_CRT_PARSE_C */
11038
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011039 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011040 * Session ticket and associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011041 */
11042#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
11043 if( 3 > (size_t)( end - p ) )
11044 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11045
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030011046 session->ticket_len = mbedtls_platform_get_uint24_be( &p[0] );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011047 p += 3;
11048
11049 if( session->ticket_len != 0 )
11050 {
11051 if( session->ticket_len > (size_t)( end - p ) )
11052 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11053
11054 session->ticket = mbedtls_calloc( 1, session->ticket_len );
11055 if( session->ticket == NULL )
11056 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
11057
Teppo Järvelin91d79382019-10-02 09:09:31 +030011058 mbedtls_platform_memcpy( session->ticket, p, session->ticket_len );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011059 p += session->ticket_len;
11060 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011061
11062 if( 4 > (size_t)( end - p ) )
11063 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11064
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030011065 session->ticket_lifetime = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011066 p += 4;
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011067#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
11068
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020011069 /*
11070 * Misc extension-related info
11071 */
11072#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
11073 if( 1 > (size_t)( end - p ) )
11074 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11075
11076 session->mfl_code = *p++;
11077#endif
11078
11079#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
11080 if( 1 > (size_t)( end - p ) )
11081 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11082
11083 session->trunc_hmac = *p++;
11084#endif
11085
11086#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
11087 if( 1 > (size_t)( end - p ) )
11088 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11089
11090 session->encrypt_then_mac = *p++;
11091#endif
11092
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020011093 /* Done, should have consumed entire buffer */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020011094 if( p != end )
11095 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11096
11097 return( 0 );
11098}
11099
11100/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020011101 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020011102 */
11103int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
11104 const unsigned char *buf,
11105 size_t len )
11106{
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011107 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020011108
11109 if( ret != 0 )
11110 mbedtls_ssl_session_free( session );
11111
11112 return( ret );
11113}
11114
11115/*
Paul Bakker1961b702013-01-25 14:49:24 +010011116 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +000011117 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011118int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011119{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011120 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker5121ce52009-01-03 21:22:43 +000011121
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011122 if( ssl == NULL || ssl->conf == NULL )
11123 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11124
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011125#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011126 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011127 ret = mbedtls_ssl_handshake_client_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000011128#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011129#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011130 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011131 ret = mbedtls_ssl_handshake_server_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000011132#endif
11133
Hanno Beckerb82350b2019-07-26 07:24:05 +010011134 ssl_send_pending_fatal_alert( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010011135 return( ret );
11136}
11137
11138/*
11139 * Perform the SSL handshake
11140 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011141int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +010011142{
11143 int ret = 0;
11144
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011145 if( ssl == NULL || ssl->conf == NULL )
11146 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11147
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011148 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +010011149
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011150 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +010011151 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011152 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010011153
11154 if( ret != 0 )
11155 break;
11156 }
11157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011158 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011159
11160 return( ret );
11161}
11162
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011163#if defined(MBEDTLS_SSL_RENEGOTIATION)
11164#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000011165/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011166 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +000011167 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011168static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011169{
11170 int ret;
11171
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011172 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011173
11174 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011175 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
11176 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011177
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020011178 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011179 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020011180 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011181 return( ret );
11182 }
11183
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011184 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011185
11186 return( 0 );
11187}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011188#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011189
11190/*
11191 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011192 * - any side: calling mbedtls_ssl_renegotiate(),
11193 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
11194 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +020011195 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011196 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011197 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011198 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011199static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011200{
11201 int ret;
11202
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011203 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011204
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011205 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
11206 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011207
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011208 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
11209 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011210#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011211 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011212 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011213 {
Hanno Becker2d9623f2019-06-13 12:07:05 +010011214 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11215 MBEDTLS_SSL_IS_SERVER )
11216 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011217 ssl->handshake->out_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010011218 }
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011219 else
Hanno Becker2d9623f2019-06-13 12:07:05 +010011220 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020011221 ssl->handshake->in_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010011222 }
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020011223 }
11224#endif
11225
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011226 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
11227 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +000011228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011229 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011230 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011231 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011232 return( ret );
11233 }
11234
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011235 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011236
11237 return( 0 );
11238}
11239
11240/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011241 * Renegotiate current connection on client,
11242 * or request renegotiation on server
11243 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011244int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011245{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011246 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011247
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011248 if( ssl == NULL || ssl->conf == NULL )
11249 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011251#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011252 /* On server, just send the request */
Hanno Becker2d9623f2019-06-13 12:07:05 +010011253 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011254 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011255 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
11256 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011257
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011258 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020011259
11260 /* Did we already try/start sending HelloRequest? */
11261 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011262 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020011263
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011264 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011265 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011266#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011267
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011268#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011269 /*
11270 * On client, either start the renegotiation process or,
11271 * if already in progress, continue the handshake
11272 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011273 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011274 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011275 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
11276 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011277
11278 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
11279 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011280 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011281 return( ret );
11282 }
11283 }
11284 else
11285 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011286 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011287 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011288 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011289 return( ret );
11290 }
11291 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011292#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010011293
Paul Bakker37ce0ff2013-10-31 14:32:04 +010011294 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010011295}
11296
11297/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011298 * Check record counters and renegotiate if they're above the limit.
11299 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011300static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011301{
Andres AG2196c7f2016-12-15 17:01:16 +000011302 size_t ep_len = ssl_ep_len( ssl );
11303 int in_ctr_cmp;
11304 int out_ctr_cmp;
11305
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011306 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
11307 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020011308 ! mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011309 {
11310 return( 0 );
11311 }
11312
Teppo Järvelin0efac532019-10-04 13:21:08 +030011313 // use regular memcmp as counters are public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030011314 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000011315 ssl->conf->renego_period + ep_len, 8 - ep_len );
Teppo Järvelin650343c2019-10-03 15:36:59 +030011316 out_ctr_cmp = memcmp( ssl->cur_out_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000011317 ssl->conf->renego_period + ep_len, 8 - ep_len );
11318
11319 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011320 {
11321 return( 0 );
11322 }
11323
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020011324 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011325 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011326}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011327#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000011328
11329/*
11330 * Receive application data decrypted from the SSL layer
11331 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011332int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011333{
Hanno Becker4a810fb2017-05-24 16:27:30 +010011334 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +000011335 size_t n;
Andrzej Kurek84bde412020-07-06 15:27:34 -040011336 volatile unsigned char *buf_dup = buf;
11337 volatile size_t len_dup = len;
Paul Bakker5121ce52009-01-03 21:22:43 +000011338
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011339 if( ssl == NULL || ssl->conf == NULL )
11340 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11341
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011342 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011343
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011344#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011345 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011346 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011347 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011348 return( ret );
11349
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011350 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011351 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011352 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +020011353 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011354 return( ret );
11355 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020011356 }
11357#endif
11358
Hanno Becker4a810fb2017-05-24 16:27:30 +010011359 /*
11360 * Check if renegotiation is necessary and/or handshake is
11361 * in process. If yes, perform/continue, and fall through
11362 * if an unexpected packet is received while the client
11363 * is waiting for the ServerHello.
11364 *
11365 * (There is no equivalent to the last condition on
11366 * the server-side as it is not treated as within
11367 * a handshake while waiting for the ClientHello
11368 * after a renegotiation request.)
11369 */
11370
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011371#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011372 ret = ssl_check_ctr_renegotiate( ssl );
11373 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11374 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011375 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011376 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010011377 return( ret );
11378 }
11379#endif
11380
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011381 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011382 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011383 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +010011384 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11385 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011386 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011387 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011388 return( ret );
11389 }
11390 }
11391
Hanno Beckere41158b2017-10-23 13:30:32 +010011392 /* Loop as long as no application data record is available */
Hanno Becker90333da2017-10-10 11:27:13 +010011393 while( ssl->in_offt == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000011394 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011395 /* Start timer if not already running */
Hanno Becker0ae6b242019-06-13 16:45:36 +010011396 if( mbedtls_ssl_get_get_timer( ssl ) != NULL &&
11397 mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == -1 )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020011398 {
Hanno Becker1f835fa2019-06-13 10:14:59 +010011399 ssl_set_timer( ssl,
11400 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020011401 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011402
Hanno Becker327c93b2018-08-15 13:56:18 +010011403 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011404 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011405 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
11406 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +000011407
Hanno Becker4a810fb2017-05-24 16:27:30 +010011408 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
11409 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011410 }
11411
11412 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011413 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011414 {
11415 /*
11416 * OpenSSL sends empty messages to randomize the IV
11417 */
Hanno Becker327c93b2018-08-15 13:56:18 +010011418 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011419 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011420 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +000011421 return( 0 );
11422
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011423 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011424 return( ret );
11425 }
11426 }
11427
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011428 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +000011429 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011430 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011431
Hanno Becker4a810fb2017-05-24 16:27:30 +010011432 /*
11433 * - For client-side, expect SERVER_HELLO_REQUEST.
11434 * - For server-side, expect CLIENT_HELLO.
11435 * - Fail (TLS) or silently drop record (DTLS) in other cases.
11436 */
11437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011438#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011439 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11440 MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011441 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
Hanno Becker4a810fb2017-05-24 16:27:30 +010011442 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
Paul Bakker48916f92012-09-16 19:57:18 +000011443 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011444 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011445
11446 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011447#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011448 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011449 {
11450 continue;
11451 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011452 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011453#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011454#if defined(MBEDTLS_SSL_PROTO_TLS)
11455 {
11456 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11457 }
11458#endif
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011459 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011460#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011461
Hanno Becker4a810fb2017-05-24 16:27:30 +010011462#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011463 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11464 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011465 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011466 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011467 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011468
11469 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011470#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011471 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011472 {
11473 continue;
11474 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011475 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011476#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011477#if defined(MBEDTLS_SSL_PROTO_TLS)
11478 {
11479 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11480 }
11481#endif
Paul Bakker48916f92012-09-16 19:57:18 +000011482 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011483#endif /* MBEDTLS_SSL_SRV_C */
11484
Hanno Becker21df7f92017-10-17 11:03:26 +010011485#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011486 /* Determine whether renegotiation attempt should be accepted */
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011487 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
11488 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +010011489 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011490 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
11491 {
11492 /*
11493 * Accept renegotiation request
11494 */
Paul Bakker48916f92012-09-16 19:57:18 +000011495
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011496 /* DTLS clients need to know renego is server-initiated */
11497#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011498 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker2d9623f2019-06-13 12:07:05 +010011499 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11500 MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011501 {
11502 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
11503 }
11504#endif
11505 ret = ssl_start_renegotiation( ssl );
11506 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11507 ret != 0 )
11508 {
11509 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
11510 return( ret );
11511 }
11512 }
11513 else
Hanno Becker21df7f92017-10-17 11:03:26 +010011514#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000011515 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011516 /*
11517 * Refuse renegotiation
11518 */
11519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011520 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011522#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +010011523 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011524 {
Gilles Peskine92e44262017-05-10 17:27:49 +020011525 /* SSLv3 does not have a "no_renegotiation" warning, so
11526 we send a fatal alert and abort the connection. */
11527 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
11528 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
11529 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011530 }
11531 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011532#endif /* MBEDTLS_SSL_PROTO_SSL3 */
11533#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
11534 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011535 if( mbedtls_ssl_ver_geq(
11536 mbedtls_ssl_get_minor_ver( ssl ),
11537 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011538 {
Hanno Becker2e8d1332019-07-25 10:27:36 +010011539 ret = mbedtls_ssl_send_alert_message( ssl,
11540 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11541 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION );
11542 if( ret != 0 )
11543 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011544 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +020011545 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011546#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
11547 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +020011548 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011549 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
11550 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +020011551 }
Paul Bakker48916f92012-09-16 19:57:18 +000011552 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011553
Hanno Becker90333da2017-10-10 11:27:13 +010011554 /* At this point, we don't know whether the renegotiation has been
11555 * completed or not. The cases to consider are the following:
11556 * 1) The renegotiation is complete. In this case, no new record
11557 * has been read yet.
11558 * 2) The renegotiation is incomplete because the client received
11559 * an application data record while awaiting the ServerHello.
11560 * 3) The renegotiation is incomplete because the client received
11561 * a non-handshake, non-application data message while awaiting
11562 * the ServerHello.
11563 * In each of these case, looping will be the proper action:
11564 * - For 1), the next iteration will read a new record and check
11565 * if it's application data.
11566 * - For 2), the loop condition isn't satisfied as application data
11567 * is present, hence continue is the same as break
11568 * - For 3), the loop condition is satisfied and read_record
11569 * will re-deliver the message that was held back by the client
11570 * when expecting the ServerHello.
11571 */
11572 continue;
Paul Bakker48916f92012-09-16 19:57:18 +000011573 }
Hanno Becker21df7f92017-10-17 11:03:26 +010011574#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011575 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011576 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011577 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011578 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011579 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011580 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011581 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011582 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011583 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011584 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011585 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011586 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011587#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011588
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011589 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
11590 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011591 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011592 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +010011593 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011594 }
11595
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011596 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011597 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011598 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
11599 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +000011600 }
11601
11602 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011603
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011604 /* We're going to return something now, cancel timer,
11605 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011606 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011607 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011608
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020011609#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011610 /* If we requested renego but received AppData, resend HelloRequest.
11611 * Do it now, after setting in_offt, to avoid taking this branch
11612 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011613#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011614 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11615 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011616 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011617 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011618 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011619 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011620 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011621 return( ret );
11622 }
11623 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011624#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +010011625#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +000011626 }
11627
11628 n = ( len < ssl->in_msglen )
11629 ? len : ssl->in_msglen;
11630
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011631 if( mbedtls_platform_memcpy( buf, ssl->in_offt, n ) !=
11632 buf )
11633 {
11634 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11635 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011636 ssl->in_msglen -= n;
11637
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011638 // clear incoming data after it's copied to buffer
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011639 if( mbedtls_platform_memset( ssl->in_offt, 0, n ) !=
11640 ssl->in_offt )
11641 {
11642 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11643 }
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011644
Paul Bakker5121ce52009-01-03 21:22:43 +000011645 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +010011646 {
11647 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +000011648 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +010011649 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011650 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011651 else
Hanno Becker4a810fb2017-05-24 16:27:30 +010011652 {
Paul Bakker5121ce52009-01-03 21:22:43 +000011653 /* more data available */
11654 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011655 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011656
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011657 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011658
Andrzej Kurek84bde412020-07-06 15:27:34 -040011659 /* Secure against buffer substitution */
11660 if( buf_dup == buf && len_dup == len )
11661 {
11662 return( (int) n );
11663 }
11664 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +000011665}
11666
11667/*
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011668 * Send application data to be encrypted by the SSL layer, taking care of max
11669 * fragment length and buffer size.
11670 *
11671 * According to RFC 5246 Section 6.2.1:
11672 *
11673 * Zero-length fragments of Application data MAY be sent as they are
11674 * potentially useful as a traffic analysis countermeasure.
11675 *
11676 * Therefore, it is possible that the input message length is 0 and the
11677 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +000011678 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011679static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011680 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011681{
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020011682 int ret = mbedtls_ssl_get_max_out_record_payload( ssl );
11683 const size_t max_len = (size_t) ret;
11684
11685 if( ret < 0 )
11686 {
11687 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
11688 return( ret );
11689 }
11690
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011691 if( len > max_len )
11692 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011693#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011694 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011695 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011696 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011697 "maximum fragment length: %d > %d",
11698 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011699 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011700 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011701 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011702#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011703#if defined(MBEDTLS_SSL_PROTO_TLS)
11704 {
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011705 len = max_len;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011706 }
11707#endif
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011708 }
Paul Bakker887bd502011-06-08 13:10:54 +000011709
Paul Bakker5121ce52009-01-03 21:22:43 +000011710 if( ssl->out_left != 0 )
11711 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011712 /*
11713 * The user has previously tried to send the data and
11714 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
11715 * written. In this case, we expect the high-level write function
11716 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
11717 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011718 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011719 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011720 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011721 return( ret );
11722 }
11723 }
Paul Bakker887bd502011-06-08 13:10:54 +000011724 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +000011725 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011726 /*
11727 * The user is trying to send a message the first time, so we need to
11728 * copy the data into the internal buffers and setup the data structure
11729 * to keep track of partial writes
11730 */
shelib014062d6c2020-07-21 11:54:52 +030011731 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011732 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Piotr Nowicki305a5ec2020-08-10 17:42:18 +020011733 if( mbedtls_platform_memcpy( ssl->out_msg, buf, len ) != ssl->out_msg )
11734 {
11735 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
11736 }
Paul Bakker887bd502011-06-08 13:10:54 +000011737
shelib014062d6c2020-07-21 11:54:52 +030011738#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011739 /*
11740 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11741 * After splitting pointers and data size will not be the same as initaly provides by user.
11742 */
shelib014062d6c2020-07-21 11:54:52 +030011743 /* Secure against buffer substitution */
Shelly Liberman3799fc12020-08-05 15:52:58 +030011744 if( buf == ssl->out_msg_dup &&
shelib014062d6c2020-07-21 11:54:52 +030011745 ssl->out_msglen == ssl->out_msglen_dup &&
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011746 ssl->out_msg_dup[0] == ssl->out_msg[0] )
shelib014062d6c2020-07-21 11:54:52 +030011747 {/*write record only if data was copied from correct user pointer */
11748#endif
Shelly Liberman3799fc12020-08-05 15:52:58 +030011749 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
shelib014062d6c2020-07-21 11:54:52 +030011750 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011751 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
11752 return( ret );
shelib014062d6c2020-07-21 11:54:52 +030011753 }
11754
11755#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Paul Bakker887bd502011-06-08 13:10:54 +000011756 }
shelib014062d6c2020-07-21 11:54:52 +030011757 else
11758 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011759 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011760 }
11761#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000011762 }
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011763 if ( ret == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -040011764 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011765 return( (int) len );
Andrzej Kurek84bde412020-07-06 15:27:34 -040011766 }
shelib014062d6c2020-07-21 11:54:52 +030011767 else
11768 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011769 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011770 }
11771
Paul Bakker5121ce52009-01-03 21:22:43 +000011772}
11773
11774/*
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011775 * Write application data, doing 1/n-1 splitting if necessary.
11776 *
11777 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011778 * then the caller will call us again with the same arguments, so
Hanno Becker2b187c42017-09-18 14:58:11 +010011779 * remember whether we already did the split or not.
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011780 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011781#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011782static int ssl_write_split( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011783 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011784{
11785 int ret;
11786
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010011787 if( ssl->conf->cbc_record_splitting ==
11788 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011789 len <= 1 ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011790 mbedtls_ssl_ver_gt(
11791 mbedtls_ssl_get_minor_ver( ssl ),
11792 MBEDTLS_SSL_MINOR_VERSION_1 ) ||
Andrzej Kurek11750442020-09-17 07:12:06 -040011793#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
11794 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx )
11795 != MBEDTLS_MODE_CBC )
11796#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011797 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
11798 != MBEDTLS_MODE_CBC )
Andrzej Kurek11750442020-09-17 07:12:06 -040011799#endif
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011800 {
11801 return( ssl_write_real( ssl, buf, len ) );
11802 }
11803
11804 if( ssl->split_done == 0 )
11805 {
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011806 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011807 return( ret );
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011808 ssl->split_done = 1;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011809 }
11810
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011811 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
11812 return( ret );
11813 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011814
11815 return( ret + 1 );
11816}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011817#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011818
11819/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011820 * Write application data (public-facing wrapper)
11821 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011822int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011823{
shelib014062d6c2020-07-21 11:54:52 +030011824 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
11825#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011826 /*
11827 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11828 * After splitting pointers and data size will not be the same as initaly provides by user.
11829 */
Andrzej Kurek84bde412020-07-06 15:27:34 -040011830 volatile const unsigned char *buf_dup = buf;
11831 volatile size_t len_dup = len;
shelib014062d6c2020-07-21 11:54:52 +030011832#endif
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011833 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011834
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011835 if( ssl == NULL || ssl->conf == NULL )
11836 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11837
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011838#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011839 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
11840 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011841 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011842 return( ret );
11843 }
11844#endif
11845
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011846 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011847 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011848 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011849 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +020011850 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011851 return( ret );
11852 }
11853 }
11854
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011855#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011856 ret = ssl_write_split( ssl, buf, len );
11857#else
shelib014062d6c2020-07-21 11:54:52 +030011858#if defined(MBEDTLS_FI_COUNTERMEASURES)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011859 /* Add const user pointers to context. We will be able to check its validity before copy to context */
shelib014062d6c2020-07-21 11:54:52 +030011860 ssl->out_msg_dup = (unsigned char*)buf_dup;
11861 ssl->out_msglen_dup = len_dup;
11862#endif //MBEDTLS_FI_COUNTERMEASURES
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011863 ret = ssl_write_real( ssl, buf, len );
11864#endif
11865
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011866 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011867
shelib014062d6c2020-07-21 11:54:52 +030011868
11869 return( ret );
11870
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011871}
11872
11873/*
Paul Bakker5121ce52009-01-03 21:22:43 +000011874 * Notify the peer that the connection is being closed
11875 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011876int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011877{
11878 int ret;
11879
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011880 if( ssl == NULL || ssl->conf == NULL )
11881 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11882
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011883 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011884
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011885 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011886 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011887
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011888 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011889 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011890 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
11891 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11892 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011893 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011894 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011895 return( ret );
11896 }
11897 }
11898
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011899 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011900
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011901 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +000011902}
11903
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011904void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +000011905{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011906 if( transform == NULL )
11907 return;
11908
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011909#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +000011910 deflateEnd( &transform->ctx_deflate );
11911 inflateEnd( &transform->ctx_inflate );
11912#endif
Andrzej Kurek11750442020-09-17 07:12:06 -040011913#if defined(MBEDTLS_SSL_TRANSFORM_OPTIMIZE_CIPHERS)
11914 mbedtls_cipher_free( &transform->cipher_ctx );
11915 if( transform->key_dec != NULL )
11916 mbedtls_free( transform->key_dec );
11917 if( transform->key_enc != NULL )
11918 mbedtls_free( transform->key_enc );
11919#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011920 mbedtls_cipher_free( &transform->cipher_ctx_enc );
11921 mbedtls_cipher_free( &transform->cipher_ctx_dec );
Andrzej Kurek11750442020-09-17 07:12:06 -040011922#endif
Hanno Becker92231322018-01-03 15:32:51 +000011923#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011924 mbedtls_md_free( &transform->md_ctx_enc );
11925 mbedtls_md_free( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +000011926#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020011927
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050011928 mbedtls_platform_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011929}
11930
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011931#if defined(MBEDTLS_X509_CRT_PARSE_C)
11932static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011933{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011934 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011935
11936 while( cur != NULL )
11937 {
11938 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011939 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011940 cur = next;
11941 }
11942}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011943#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011944
Hanno Becker0271f962018-08-16 13:23:47 +010011945#if defined(MBEDTLS_SSL_PROTO_DTLS)
11946
11947static void ssl_buffering_free( mbedtls_ssl_context *ssl )
11948{
11949 unsigned offset;
11950 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11951
11952 if( hs == NULL )
11953 return;
11954
Hanno Becker283f5ef2018-08-24 09:34:47 +010011955 ssl_free_buffered_record( ssl );
11956
Hanno Becker0271f962018-08-16 13:23:47 +010011957 for( offset = 0; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
Hanno Beckere605b192018-08-21 15:59:07 +010011958 ssl_buffering_free_slot( ssl, offset );
11959}
11960
11961static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
11962 uint8_t slot )
11963{
11964 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11965 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot];
Hanno Beckerb309b922018-08-23 13:18:05 +010011966
11967 if( slot >= MBEDTLS_SSL_MAX_BUFFERED_HS )
11968 return;
11969
Hanno Beckere605b192018-08-21 15:59:07 +010011970 if( hs_buf->is_valid == 1 )
Hanno Becker0271f962018-08-16 13:23:47 +010011971 {
Hanno Beckere605b192018-08-21 15:59:07 +010011972 hs->buffering.total_bytes_buffered -= hs_buf->data_len;
Hanno Becker805f2e12018-10-12 16:31:41 +010011973 mbedtls_platform_zeroize( hs_buf->data, hs_buf->data_len );
Hanno Beckere605b192018-08-21 15:59:07 +010011974 mbedtls_free( hs_buf->data );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020011975 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Hanno Becker0271f962018-08-16 13:23:47 +010011976 }
11977}
11978
11979#endif /* MBEDTLS_SSL_PROTO_DTLS */
11980
Gilles Peskine9b562d52018-04-25 20:32:43 +020011981void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011982{
Gilles Peskine9b562d52018-04-25 20:32:43 +020011983 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
11984
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011985 if( handshake == NULL )
11986 return;
11987
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011988#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
11989 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
11990 {
Gilles Peskine8f97af72018-04-26 11:46:10 +020011991 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011992 handshake->async_in_progress = 0;
11993 }
11994#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
11995
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +020011996#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
11997 defined(MBEDTLS_SSL_PROTO_TLS1_1)
11998 mbedtls_md5_free( &handshake->fin_md5 );
11999 mbedtls_sha1_free( &handshake->fin_sha1 );
12000#endif
12001#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
12002#if defined(MBEDTLS_SHA256_C)
12003 mbedtls_sha256_free( &handshake->fin_sha256 );
12004#endif
12005#if defined(MBEDTLS_SHA512_C)
12006 mbedtls_sha512_free( &handshake->fin_sha512 );
12007#endif
12008#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
12009
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012010#if defined(MBEDTLS_DHM_C)
12011 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +000012012#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012013#if defined(MBEDTLS_ECDH_C)
12014 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +020012015#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +020012016#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020012017 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +020012018#if defined(MBEDTLS_SSL_CLI_C)
12019 mbedtls_free( handshake->ecjpake_cache );
12020 handshake->ecjpake_cache = NULL;
12021 handshake->ecjpake_cache_len = 0;
12022#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020012023#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020012024
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010012025#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
12026 if( handshake->psk != NULL )
12027 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012028 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010012029 mbedtls_free( handshake->psk );
12030 }
12031#endif
12032
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012033#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
12034 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012035 /*
12036 * Free only the linked list wrapper, not the keys themselves
12037 * since the belong to the SNI callback
12038 */
12039 if( handshake->sni_key_cert != NULL )
12040 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012041 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012042
12043 while( cur != NULL )
12044 {
12045 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012046 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020012047 cur = next;
12048 }
12049 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012050#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020012051
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020012052#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +020012053 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Beckere4aeb762019-02-05 17:19:52 +000012054 if( handshake->ecrs_peer_cert != NULL )
12055 {
12056 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
12057 mbedtls_free( handshake->ecrs_peer_cert );
12058 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020012059#endif
12060
Hanno Becker3bf8cdf2019-02-06 16:18:31 +000012061#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
12062 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
12063 mbedtls_pk_free( &handshake->peer_pubkey );
12064#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
12065
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012066#if defined(MBEDTLS_SSL_PROTO_DTLS)
12067 mbedtls_free( handshake->verify_cookie );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +020012068 ssl_flight_free( handshake->flight );
Hanno Becker0271f962018-08-16 13:23:47 +010012069 ssl_buffering_free( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +020012070#endif
12071
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012072 mbedtls_platform_zeroize( handshake,
12073 sizeof( mbedtls_ssl_handshake_params ) );
Andrzej Kurekf3844952020-10-16 23:03:01 +020012074
12075#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12076 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
12077 * processes datagrams and the fact that a datagram is allowed to have
12078 * several records in it, it is possible that the I/O buffers are not
12079 * empty at this stage */
Andrzej Kurekcd9a6ff2020-10-22 11:12:07 +020012080 handle_buffer_resizing( ssl, BUFFER_DOWNSIZING,
12081 mbedtls_ssl_get_input_buflen( ssl ),
12082 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurekf3844952020-10-16 23:03:01 +020012083#endif
Paul Bakker48916f92012-09-16 19:57:18 +000012084}
12085
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012086void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +000012087{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012088 if( session == NULL )
12089 return;
12090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012091#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker22141592019-02-05 12:38:15 +000012092 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +020012093#endif
Paul Bakker0a597072012-09-25 21:55:46 +000012094
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020012095#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012096 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +020012097#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +020012098
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012099 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +000012100}
12101
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012102#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012103
12104#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12105#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
12106#else
12107#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
12108#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12109
12110#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12111#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
12112#else
12113#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 0u
12114#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12115
12116#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12117#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
12118#else
12119#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
12120#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12121
12122#if defined(MBEDTLS_SSL_ALPN)
12123#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
12124#else
12125#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
12126#endif /* MBEDTLS_SSL_ALPN */
12127
12128#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
12129#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
12130#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
12131#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
12132
12133#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
12134 ( (uint32_t) ( \
12135 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
12136 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
12137 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
12138 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
12139 0u ) )
12140
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012141static unsigned char ssl_serialized_context_header[] = {
12142 MBEDTLS_VERSION_MAJOR,
12143 MBEDTLS_VERSION_MINOR,
12144 MBEDTLS_VERSION_PATCH,
12145 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
12146 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012147 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 16 ) & 0xFF,
12148 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 8 ) & 0xFF,
12149 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012150};
12151
Paul Bakker5121ce52009-01-03 21:22:43 +000012152/*
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012153 * Serialize a full SSL context
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012154 *
12155 * The format of the serialized data is:
12156 * (in the presentation language of TLS, RFC 8446 section 3)
12157 *
12158 * // header
12159 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012160 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012161 * // the format of the remaining
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012162 * // serialized data.
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020012163 * Note: When updating the format, remember to keep these
12164 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020012165 *
12166 * // session sub-structure
12167 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
12168 * // transform sub-structure
12169 * uint8 random[64]; // ServerHello.random+ClientHello.random
12170 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
12171 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
12172 * // fields from ssl_context
12173 * uint32 badmac_seen; // DTLS: number of records with failing MAC
12174 * uint64 in_window_top; // DTLS: last validated record seq_num
12175 * uint64 in_window; // DTLS: bitmask for replay protection
12176 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
12177 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
12178 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
12179 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
12180 *
12181 * Note that many fields of the ssl_context or sub-structures are not
12182 * serialized, as they fall in one of the following categories:
12183 *
12184 * 1. forced value (eg in_left must be 0)
12185 * 2. pointer to dynamically-allocated memory (eg session, transform)
12186 * 3. value can be re-derived from other data (eg session keys from MS)
12187 * 4. value was temporary (eg content of input buffer)
12188 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012189 */
12190int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
12191 unsigned char *buf,
12192 size_t buf_len,
12193 size_t *olen )
12194{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012195 unsigned char *p = buf;
12196 size_t used = 0;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012197 size_t session_len;
12198 int ret = 0;
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012199
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012200 /*
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012201 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
12202 * this function's documentation.
12203 *
12204 * These are due to assumptions/limitations in the implementation. Some of
12205 * them are likely to stay (no handshake in progress) some might go away
12206 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012207 */
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012208 /* The initial handshake must be over */
12209 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020012210 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020012211 if( ssl->handshake != NULL )
12212 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12213 /* Double-check that sub-structures are indeed ready */
12214 if( ssl->transform == NULL || ssl->session == NULL )
12215 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12216 /* There must be no pending incoming or outgoing data */
12217 if( mbedtls_ssl_check_pending( ssl ) != 0 )
12218 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12219 if( ssl->out_left != 0 )
12220 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12221 /* Protocol must be DLTS, not TLS */
12222 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
12223 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12224 /* Version must be 1.2 */
12225 if( mbedtls_ssl_get_major_ver( ssl ) != MBEDTLS_SSL_MAJOR_VERSION_3 )
12226 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12227 if( mbedtls_ssl_get_minor_ver( ssl ) != MBEDTLS_SSL_MINOR_VERSION_3 )
12228 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12229 /* We must be using an AEAD ciphersuite */
12230 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
12231 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12232 /* Renegotiation must not be enabled */
12233 if( mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
12234 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012235
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012236 /*
12237 * Version and format identifier
12238 */
12239 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012240
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012241 if( used <= buf_len )
12242 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012243 mbedtls_platform_memcpy( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012244 sizeof( ssl_serialized_context_header ) );
12245 p += sizeof( ssl_serialized_context_header );
12246 }
12247
12248 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012249 * Session (length + data)
12250 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012251 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012252 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
12253 return( ret );
12254
12255 used += 4 + session_len;
12256 if( used <= buf_len )
12257 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012258 p = mbedtls_platform_put_uint32_be( p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012259
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012260 ret = ssl_session_save( ssl->session, 1,
12261 p, session_len, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012262 if( ret != 0 )
12263 return( ret );
12264
12265 p += session_len;
12266 }
12267
12268 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012269 * Transform
12270 */
12271 used += sizeof( ssl->transform->randbytes );
12272 if( used <= buf_len )
12273 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012274 mbedtls_platform_memcpy( p, ssl->transform->randbytes,
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012275 sizeof( ssl->transform->randbytes ) );
12276 p += sizeof( ssl->transform->randbytes );
12277 }
12278
12279#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12280 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
12281 if( used <= buf_len )
12282 {
12283 *p++ = ssl->transform->in_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012284 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12285 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012286 p += ssl->transform->in_cid_len;
12287
12288 *p++ = ssl->transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012289 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12290 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012291 p += ssl->transform->out_cid_len;
12292 }
12293#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12294
12295 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012296 * Saved fields from top-level ssl_context structure
12297 */
12298#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12299 used += 4;
12300 if( used <= buf_len )
12301 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012302 p = mbedtls_platform_put_uint32_be( p, ssl->badmac_seen );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012303 }
12304#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12305
12306#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12307 used += 16;
12308 if( used <= buf_len )
12309 {
12310 *p++ = (unsigned char)( ( ssl->in_window_top >> 56 ) & 0xFF );
12311 *p++ = (unsigned char)( ( ssl->in_window_top >> 48 ) & 0xFF );
12312 *p++ = (unsigned char)( ( ssl->in_window_top >> 40 ) & 0xFF );
12313 *p++ = (unsigned char)( ( ssl->in_window_top >> 32 ) & 0xFF );
12314 *p++ = (unsigned char)( ( ssl->in_window_top >> 24 ) & 0xFF );
12315 *p++ = (unsigned char)( ( ssl->in_window_top >> 16 ) & 0xFF );
12316 *p++ = (unsigned char)( ( ssl->in_window_top >> 8 ) & 0xFF );
12317 *p++ = (unsigned char)( ( ssl->in_window_top ) & 0xFF );
12318
12319 *p++ = (unsigned char)( ( ssl->in_window >> 56 ) & 0xFF );
12320 *p++ = (unsigned char)( ( ssl->in_window >> 48 ) & 0xFF );
12321 *p++ = (unsigned char)( ( ssl->in_window >> 40 ) & 0xFF );
12322 *p++ = (unsigned char)( ( ssl->in_window >> 32 ) & 0xFF );
12323 *p++ = (unsigned char)( ( ssl->in_window >> 24 ) & 0xFF );
12324 *p++ = (unsigned char)( ( ssl->in_window >> 16 ) & 0xFF );
12325 *p++ = (unsigned char)( ( ssl->in_window >> 8 ) & 0xFF );
12326 *p++ = (unsigned char)( ( ssl->in_window ) & 0xFF );
12327 }
12328#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12329
12330#if defined(MBEDTLS_SSL_PROTO_DTLS)
12331 used += 1;
12332 if( used <= buf_len )
12333 {
12334 *p++ = ssl->disable_datagram_packing;
12335 }
12336#endif /* MBEDTLS_SSL_PROTO_DTLS */
12337
12338 used += 8;
12339 if( used <= buf_len )
12340 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012341 mbedtls_platform_memcpy( p, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012342 p += 8;
12343 }
12344
12345#if defined(MBEDTLS_SSL_PROTO_DTLS)
12346 used += 2;
12347 if( used <= buf_len )
12348 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012349 p = mbedtls_platform_put_uint16_be( p, ssl->mtu );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012350 }
12351#endif /* MBEDTLS_SSL_PROTO_DTLS */
12352
12353#if defined(MBEDTLS_SSL_ALPN)
12354 {
12355 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnard7af73752019-07-24 00:58:27 +020012356 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012357 : 0;
12358
12359 used += 1 + alpn_len;
12360 if( used <= buf_len )
12361 {
12362 *p++ = alpn_len;
12363
12364 if( ssl->alpn_chosen != NULL )
12365 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030012366 mbedtls_platform_memcpy( p, ssl->alpn_chosen, alpn_len );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012367 p += alpn_len;
12368 }
12369 }
12370 }
12371#endif /* MBEDTLS_SSL_ALPN */
12372
12373 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012374 * Done
12375 */
12376 *olen = used;
12377
12378 if( used > buf_len )
12379 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012380
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012381 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
12382
Manuel Pégourié-Gonnardbc847ca2019-07-23 14:51:09 +020012383 return( ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012384}
12385
12386/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012387 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012388 *
12389 * This internal version is wrapped by a public function that cleans up in
12390 * case of error.
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012391 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012392static int ssl_context_load( mbedtls_ssl_context *ssl,
12393 const unsigned char *buf,
12394 size_t len )
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012395{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012396 const unsigned char *p = buf;
12397 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012398 size_t session_len;
12399 int ret;
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012400
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012401 /*
12402 * The context should have been freshly setup or reset.
12403 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard14e2a8a2019-07-26 16:31:53 +020012404 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012405 * renegotiating, or if the user mistakenly loaded a session first.)
12406 */
12407 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
12408 ssl->session != NULL )
12409 {
12410 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12411 }
12412
12413 /*
12414 * We can't check that the config matches the initial one, but we can at
12415 * least check it matches the requirements for serializing.
12416 */
12417 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012418 mbedtls_ssl_ver_lt(
12419 mbedtls_ssl_conf_get_max_major_ver( ssl->conf ),
12420 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
12421 mbedtls_ssl_ver_gt(
12422 mbedtls_ssl_conf_get_min_major_ver( ssl->conf ),
12423 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
12424 mbedtls_ssl_ver_lt(
12425 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ),
12426 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
12427 mbedtls_ssl_ver_gt(
12428 mbedtls_ssl_conf_get_min_minor_ver( ssl->conf ),
12429 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020012430 mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020012431 {
12432 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12433 }
12434
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012435 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
12436
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012437 /*
12438 * Check version identifier
12439 */
12440 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
12441 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12442
Teppo Järvelin650343c2019-10-03 15:36:59 +030012443 // use regular memcmp as header is not that critical
12444 if( memcmp( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012445 sizeof( ssl_serialized_context_header ) ) != 0 )
12446 {
12447 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
12448 }
12449 p += sizeof( ssl_serialized_context_header );
12450
12451 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012452 * Session
12453 */
12454 if( (size_t)( end - p ) < 4 )
12455 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12456
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030012457 session_len = mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012458 p += 4;
12459
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012460 /* This has been allocated by ssl_handshake_init(), called by
12461 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12462 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012463 ssl->session_in = ssl->session;
12464 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012465 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012466
12467 if( (size_t)( end - p ) < session_len )
12468 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12469
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012470 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012471 if( ret != 0 )
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012472 {
12473 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012474 return( ret );
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020012475 }
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012476
12477 p += session_len;
12478
12479 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012480 * Transform
12481 */
12482
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012483 /* This has been allocated by ssl_handshake_init(), called by
12484 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12485 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012486 ssl->transform_in = ssl->transform;
12487 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012488 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012489
12490 /* Read random bytes and populate structure */
12491 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
12492 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12493
12494 ret = ssl_populate_transform( ssl->transform,
12495 mbedtls_ssl_session_get_ciphersuite( ssl->session ),
12496 ssl->session->master,
12497#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
12498#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12499 ssl->session->encrypt_then_mac,
12500#endif
12501#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
12502 ssl->session->trunc_hmac,
12503#endif
12504#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
12505#if defined(MBEDTLS_ZLIB_SUPPORT)
12506 ssl->session->compression,
12507#endif
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012508 p, /* currently pointing to randbytes */
12509 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
12510 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
12511 ssl );
12512 if( ret != 0 )
12513 return( ret );
12514
12515 p += sizeof( ssl->transform->randbytes );
12516
12517#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12518 /* Read connection IDs and store them */
12519 if( (size_t)( end - p ) < 1 )
12520 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12521
12522 ssl->transform->in_cid_len = *p++;
12523
Manuel Pégourié-Gonnard2f3fa622019-07-23 15:02:54 +020012524 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012525 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12526
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012527 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12528 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012529 p += ssl->transform->in_cid_len;
12530
12531 ssl->transform->out_cid_len = *p++;
12532
12533 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
12534 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12535
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012536 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12537 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012538 p += ssl->transform->out_cid_len;
12539#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12540
12541 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012542 * Saved fields from top-level ssl_context structure
12543 */
12544#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12545 if( (size_t)( end - p ) < 4 )
12546 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12547
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012548 ssl->badmac_seen = (unsigned)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012549 p += 4;
12550#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12551
12552#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12553 if( (size_t)( end - p ) < 16 )
12554 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12555
12556 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
12557 ( (uint64_t) p[1] << 48 ) |
12558 ( (uint64_t) p[2] << 40 ) |
12559 ( (uint64_t) p[3] << 32 ) |
12560 ( (uint64_t) p[4] << 24 ) |
12561 ( (uint64_t) p[5] << 16 ) |
12562 ( (uint64_t) p[6] << 8 ) |
12563 ( (uint64_t) p[7] );
12564 p += 8;
12565
12566 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
12567 ( (uint64_t) p[1] << 48 ) |
12568 ( (uint64_t) p[2] << 40 ) |
12569 ( (uint64_t) p[3] << 32 ) |
12570 ( (uint64_t) p[4] << 24 ) |
12571 ( (uint64_t) p[5] << 16 ) |
12572 ( (uint64_t) p[6] << 8 ) |
12573 ( (uint64_t) p[7] );
12574 p += 8;
12575#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12576
12577#if defined(MBEDTLS_SSL_PROTO_DTLS)
12578 if( (size_t)( end - p ) < 1 )
12579 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12580
12581 ssl->disable_datagram_packing = *p++;
12582#endif /* MBEDTLS_SSL_PROTO_DTLS */
12583
12584 if( (size_t)( end - p ) < 8 )
12585 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12586
Teppo Järvelin91d79382019-10-02 09:09:31 +030012587 mbedtls_platform_memcpy( ssl->cur_out_ctr, p, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012588 p += 8;
12589
12590#if defined(MBEDTLS_SSL_PROTO_DTLS)
12591 if( (size_t)( end - p ) < 2 )
12592 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012593 ssl->mtu = (uint16_t)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012594 p += 2;
12595#endif /* MBEDTLS_SSL_PROTO_DTLS */
12596
12597#if defined(MBEDTLS_SSL_ALPN)
12598 {
12599 uint8_t alpn_len;
12600 const char **cur;
12601
12602 if( (size_t)( end - p ) < 1 )
12603 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12604
12605 alpn_len = *p++;
12606
12607 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
12608 {
12609 /* alpn_chosen should point to an item in the configured list */
12610 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
12611 {
12612 if( strlen( *cur ) == alpn_len &&
Piotr Nowickie3c4ee52020-06-23 12:59:56 +020012613 mbedtls_platform_memequal( p, cur, alpn_len ) == 0 )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012614 {
12615 ssl->alpn_chosen = *cur;
12616 break;
12617 }
12618 }
12619 }
12620
12621 /* can only happen on conf mismatch */
12622 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
12623 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12624
12625 p += alpn_len;
12626 }
12627#endif /* MBEDTLS_SSL_ALPN */
12628
12629 /*
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012630 * Forced fields from top-level ssl_context structure
12631 *
12632 * Most of them already set to the correct value by mbedtls_ssl_init() and
12633 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
12634 */
12635 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
12636
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012637#if !defined(MBEDTLS_SSL_CONF_FIXED_MAJOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012638 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012639#endif /* !MBEDTLS_SSL_CONF_FIXED_MAJOR_VER */
12640#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012641 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012642#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012643
Hanno Becker83985822019-08-30 10:42:49 +010012644 /* Adjust pointers for header fields of outgoing records to
12645 * the given transform, accounting for explicit IV and CID. */
12646 ssl_update_out_pointers( ssl, ssl->transform );
12647
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012648#if defined(MBEDTLS_SSL_PROTO_DTLS)
12649 ssl->in_epoch = 1;
12650#endif
12651
12652 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
12653 * which we don't want - otherwise we'd end up freeing the wrong transform
12654 * by calling ssl_handshake_wrapup_free_hs_transform() inappropriately. */
12655 if( ssl->handshake != NULL )
12656 {
12657 mbedtls_ssl_handshake_free( ssl );
12658 mbedtls_free( ssl->handshake );
12659 ssl->handshake = NULL;
12660 }
12661
12662 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012663 * Done - should have consumed entire buffer
12664 */
12665 if( p != end )
12666 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012667
12668 return( 0 );
12669}
12670
12671/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012672 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012673 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012674int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012675 const unsigned char *buf,
12676 size_t len )
12677{
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012678 int ret = ssl_context_load( context, buf, len );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012679
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012680 if( ret != 0 )
12681 mbedtls_ssl_free( context );
12682
12683 return( ret );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012684}
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012685#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012686
12687/*
Paul Bakker5121ce52009-01-03 21:22:43 +000012688 * Free an SSL context
12689 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012690void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000012691{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012692 if( ssl == NULL )
12693 return;
12694
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012696
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012697 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012698 {
Andrzej Kurekf3844952020-10-16 23:03:01 +020012699#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12700 size_t out_buf_len = ssl->out_buf_len;
12701#else
12702 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
12703#endif
12704 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012705 mbedtls_free( ssl->out_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012706 }
12707
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012708 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012709 {
Andrzej Kurekf3844952020-10-16 23:03:01 +020012710#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
12711 size_t in_buf_len = ssl->in_buf_len;
12712#else
12713 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
12714#endif
12715 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012716 mbedtls_free( ssl->in_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012717 }
12718
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012719#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker16770332013-10-11 09:59:44 +020012720 if( ssl->compress_buf != NULL )
12721 {
Angus Grattond8213d02016-05-25 20:56:48 +100012722 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012723 mbedtls_free( ssl->compress_buf );
Paul Bakker16770332013-10-11 09:59:44 +020012724 }
12725#endif
12726
Paul Bakker48916f92012-09-16 19:57:18 +000012727 if( ssl->transform )
12728 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012729 mbedtls_ssl_transform_free( ssl->transform );
12730 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +000012731 }
12732
12733 if( ssl->handshake )
12734 {
Gilles Peskine9b562d52018-04-25 20:32:43 +020012735 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012736 mbedtls_ssl_transform_free( ssl->transform_negotiate );
12737 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012738
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012739 mbedtls_free( ssl->handshake );
12740 mbedtls_free( ssl->transform_negotiate );
12741 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012742 }
12743
Paul Bakkerc0463502013-02-14 11:19:38 +010012744 if( ssl->session )
12745 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012746 mbedtls_ssl_session_free( ssl->session );
12747 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +010012748 }
12749
Teppo Järvelin4009d8f2019-08-19 14:48:09 +030012750#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Paul Bakker66d5d072014-06-17 16:39:18 +020012751 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012752 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012753 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012754 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +000012755 }
Paul Bakker0be444a2013-08-27 21:55:01 +020012756#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000012757
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012758#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
12759 if( mbedtls_ssl_hw_record_finish != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +000012760 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012761 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
12762 mbedtls_ssl_hw_record_finish( ssl );
Paul Bakker05ef8352012-05-08 09:17:57 +000012763 }
12764#endif
12765
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012766#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012767 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020012768#endif
12769
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012770 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +000012771
Paul Bakker86f04f42013-02-14 11:20:09 +010012772 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012773 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012774}
12775
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012776/*
12777 * Initialze mbedtls_ssl_config
12778 */
12779void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
12780{
12781 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnarde744eab2019-03-18 10:51:18 +010012782
12783#if !defined(MBEDTLS_SSL_PROTO_TLS)
12784 conf->transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
12785#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012786}
12787
Simon Butcherc97b6972015-12-27 23:48:17 +000012788#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012789#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012790static int ssl_preset_default_hashes[] = {
12791#if defined(MBEDTLS_SHA512_C)
12792 MBEDTLS_MD_SHA512,
12793 MBEDTLS_MD_SHA384,
12794#endif
12795#if defined(MBEDTLS_SHA256_C)
12796 MBEDTLS_MD_SHA256,
12797 MBEDTLS_MD_SHA224,
12798#endif
Gilles Peskine5d2511c2017-05-12 13:16:40 +020012799#if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012800 MBEDTLS_MD_SHA1,
12801#endif
12802 MBEDTLS_MD_NONE
12803};
Simon Butcherc97b6972015-12-27 23:48:17 +000012804#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012805#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012806
Hanno Becker73f4cb12019-06-27 13:51:07 +010012807#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012808static int ssl_preset_suiteb_ciphersuites[] = {
12809 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
12810 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
12811 0
12812};
Hanno Becker73f4cb12019-06-27 13:51:07 +010012813#endif /* !MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012814
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012815#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012816#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012817static int ssl_preset_suiteb_hashes[] = {
12818 MBEDTLS_MD_SHA256,
12819 MBEDTLS_MD_SHA384,
12820 MBEDTLS_MD_NONE
12821};
12822#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012823#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012824
Hanno Beckerc1096e72019-06-19 12:30:41 +010012825#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012826static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
Jaeden Amero16529b22019-06-03 08:27:16 +010012827#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012828 MBEDTLS_ECP_DP_SECP256R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012829#endif
12830#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012831 MBEDTLS_ECP_DP_SECP384R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012832#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012833 MBEDTLS_ECP_DP_NONE
12834};
12835#endif
12836
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012837/*
Tillmann Karras588ad502015-09-25 04:27:22 +020012838 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012839 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012840int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012841 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012842{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012843#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012844 int ret;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012845#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012846
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +020012847 /* Use the functions here so that they are covered in tests,
12848 * but otherwise access member directly for efficiency */
Kevin Braceyd859db82020-11-03 15:56:12 +020012849#if !defined(MBEDTLS_SSL_CONF_ENDPOINT)
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +020012850 mbedtls_ssl_conf_endpoint( conf, endpoint );
Kevin Braceyd859db82020-11-03 15:56:12 +020012851#endif
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +020012852 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012853
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012854 /*
12855 * Things that are common to all presets
12856 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012857#if defined(MBEDTLS_SSL_CLI_C)
12858 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
12859 {
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012860#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012861 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012862#endif /* !MBEDTLS_SSL_CONF_AUTHMODE */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012863#if defined(MBEDTLS_SSL_SESSION_TICKETS)
12864 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
12865#endif
12866 }
12867#endif
12868
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012869#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012870 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012871#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012872
12873#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12874 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
12875#endif
12876
12877#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckeraabbb582019-06-11 13:43:27 +010012878#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012879 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012880#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
12881#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsad9382f82019-06-10 10:27:14 +030012882 conf->enforce_extended_master_secret =
Jarno Lamsa18b9a492019-06-10 15:23:29 +030012883 MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012884#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012885#endif
12886
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010012887#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
12888 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
12889#endif
12890
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012891#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012892 conf->f_cookie_write = ssl_cookie_write_dummy;
12893 conf->f_cookie_check = ssl_cookie_check_dummy;
12894#endif
12895
Hanno Becker7f376f42019-06-12 16:20:48 +010012896#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
12897 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012898 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
12899#endif
12900
Janos Follath088ce432017-04-10 12:42:31 +010012901#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012902#if !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +010012903 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012904#endif /* !MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST */
12905#endif /* MBEDTLS_SSL_SRV_C */
Janos Follath088ce432017-04-10 12:42:31 +010012906
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012907#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker1f835fa2019-06-13 10:14:59 +010012908#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012909 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012910#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN */
12911#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012912 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012913#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
12914#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012915
12916#if defined(MBEDTLS_SSL_RENEGOTIATION)
12917 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020012918 mbedtls_platform_memset( conf->renego_period, 0x00, 2 );
12919 mbedtls_platform_memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012920#endif
12921
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012922#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
12923 if( endpoint == MBEDTLS_SSL_IS_SERVER )
12924 {
Hanno Becker00d0a682017-10-04 13:14:29 +010012925 const unsigned char dhm_p[] =
12926 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
12927 const unsigned char dhm_g[] =
12928 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
12929
Hanno Beckera90658f2017-10-04 15:29:08 +010012930 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
12931 dhm_p, sizeof( dhm_p ),
12932 dhm_g, sizeof( dhm_g ) ) ) != 0 )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012933 {
12934 return( ret );
12935 }
12936 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +020012937#endif
12938
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012939 /*
12940 * Preset-specific defaults
12941 */
12942 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012943 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012944 /*
12945 * NSA Suite B
12946 */
12947 case MBEDTLS_SSL_PRESET_SUITEB:
Hanno Beckere965bd32019-06-12 14:04:34 +010012948#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012949 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Hanno Beckere965bd32019-06-12 14:04:34 +010012950#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12951#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012952 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
Hanno Beckere965bd32019-06-12 14:04:34 +010012953#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
12954#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012955 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012956#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
12957#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012958 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012959#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012960
Hanno Becker73f4cb12019-06-27 13:51:07 +010012961#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012962 conf->ciphersuite_list[0] =
12963 conf->ciphersuite_list[1] =
12964 conf->ciphersuite_list[2] =
12965 conf->ciphersuite_list[3] =
12966 ssl_preset_suiteb_ciphersuites;
Hanno Becker73f4cb12019-06-27 13:51:07 +010012967#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012968
12969#if defined(MBEDTLS_X509_CRT_PARSE_C)
12970 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012971#endif
12972
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012973#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012974#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012975 conf->sig_hashes = ssl_preset_suiteb_hashes;
12976#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012977#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012978
12979#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010012980#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012981 conf->curve_list = ssl_preset_suiteb_curves;
12982#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010012983#endif
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +020012984 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012985
12986 /*
12987 * Default
12988 */
12989 default:
Hanno Beckere965bd32019-06-12 14:04:34 +010012990#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030012991 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
12992 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
12993 MBEDTLS_SSL_MIN_MAJOR_VERSION :
12994 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012995#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12996#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030012997 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
12998 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
12999 MBEDTLS_SSL_MIN_MINOR_VERSION :
13000 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013001#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020013002 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( transport ) )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013003 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
13004#endif
Hanno Beckere965bd32019-06-12 14:04:34 +010013005#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
13006#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
13007 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
13008#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
13009#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
13010 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
13011#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013012
Hanno Becker73f4cb12019-06-27 13:51:07 +010013013#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010013014 conf->ciphersuite_list[0] =
13015 conf->ciphersuite_list[1] =
13016 conf->ciphersuite_list[2] =
13017 conf->ciphersuite_list[3] =
13018 mbedtls_ssl_list_ciphersuites();
Hanno Becker73f4cb12019-06-27 13:51:07 +010013019#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013020
13021#if defined(MBEDTLS_X509_CRT_PARSE_C)
13022 conf->cert_profile = &mbedtls_x509_crt_profile_default;
13023#endif
13024
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013025#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010013026#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010013027 conf->sig_hashes = ssl_preset_default_hashes;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013028#endif
Hanno Becker56595f42019-06-19 16:31:38 +010013029#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013030
13031#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010013032#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013033 conf->curve_list = mbedtls_ecp_grp_id_list();
13034#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010013035#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020013036
13037#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
13038 conf->dhm_min_bitlen = 1024;
13039#endif
13040 }
13041
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013042 return( 0 );
13043}
13044
13045/*
13046 * Free mbedtls_ssl_config
13047 */
13048void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
13049{
13050#if defined(MBEDTLS_DHM_C)
13051 mbedtls_mpi_free( &conf->dhm_P );
13052 mbedtls_mpi_free( &conf->dhm_G );
13053#endif
13054
13055#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
13056 if( conf->psk != NULL )
13057 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013058 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013059 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +000013060 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013061 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +090013062 }
13063
13064 if( conf->psk_identity != NULL )
13065 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013066 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +090013067 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +000013068 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013069 conf->psk_identity_len = 0;
13070 }
13071#endif
13072
13073#if defined(MBEDTLS_X509_CRT_PARSE_C)
13074 ssl_key_cert_free( conf->key_cert );
13075#endif
13076
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050013077 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020013078}
13079
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020013080#if defined(MBEDTLS_PK_C) && \
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013081 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) ) || \
13082 ( defined(MBEDTLS_USE_TINYCRYPT) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013083/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013084 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013085 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013086unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013087{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013088#if defined(MBEDTLS_RSA_C)
13089 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
13090 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013091#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013092#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013093 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
13094 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013095#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013096 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020013097}
13098
Hanno Becker7e5437a2017-04-28 17:15:26 +010013099unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
13100{
13101 switch( type ) {
13102 case MBEDTLS_PK_RSA:
13103 return( MBEDTLS_SSL_SIG_RSA );
13104 case MBEDTLS_PK_ECDSA:
13105 case MBEDTLS_PK_ECKEY:
13106 return( MBEDTLS_SSL_SIG_ECDSA );
13107 default:
13108 return( MBEDTLS_SSL_SIG_ANON );
13109 }
13110}
13111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013112mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013113{
13114 switch( sig )
13115 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013116#if defined(MBEDTLS_RSA_C)
13117 case MBEDTLS_SSL_SIG_RSA:
13118 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013119#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030013120#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013121 case MBEDTLS_SSL_SIG_ECDSA:
13122 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013123#endif
13124 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013125 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013126 }
13127}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020013128#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013129
Hanno Becker7e5437a2017-04-28 17:15:26 +010013130#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
13131 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
13132
13133/* Find an entry in a signature-hash set matching a given hash algorithm. */
13134mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
13135 mbedtls_pk_type_t sig_alg )
13136{
13137 switch( sig_alg )
13138 {
13139 case MBEDTLS_PK_RSA:
13140 return( set->rsa );
13141 case MBEDTLS_PK_ECDSA:
13142 return( set->ecdsa );
13143 default:
13144 return( MBEDTLS_MD_NONE );
13145 }
13146}
13147
13148/* Add a signature-hash-pair to a signature-hash set */
13149void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
13150 mbedtls_pk_type_t sig_alg,
13151 mbedtls_md_type_t md_alg )
13152{
13153 switch( sig_alg )
13154 {
13155 case MBEDTLS_PK_RSA:
13156 if( set->rsa == MBEDTLS_MD_NONE )
13157 set->rsa = md_alg;
13158 break;
13159
13160 case MBEDTLS_PK_ECDSA:
13161 if( set->ecdsa == MBEDTLS_MD_NONE )
13162 set->ecdsa = md_alg;
13163 break;
13164
13165 default:
13166 break;
13167 }
13168}
13169
13170/* Allow exactly one hash algorithm for each signature. */
13171void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
13172 mbedtls_md_type_t md_alg )
13173{
13174 set->rsa = md_alg;
13175 set->ecdsa = md_alg;
13176}
13177
13178#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
13179 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
13180
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020013181/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013182 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020013183 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013184mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013185{
13186 switch( hash )
13187 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013188#if defined(MBEDTLS_MD5_C)
13189 case MBEDTLS_SSL_HASH_MD5:
13190 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013191#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013192#if defined(MBEDTLS_SHA1_C)
13193 case MBEDTLS_SSL_HASH_SHA1:
13194 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013195#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013196#if defined(MBEDTLS_SHA256_C)
13197 case MBEDTLS_SSL_HASH_SHA224:
13198 return( MBEDTLS_MD_SHA224 );
13199 case MBEDTLS_SSL_HASH_SHA256:
13200 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013201#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013202#if defined(MBEDTLS_SHA512_C)
13203 case MBEDTLS_SSL_HASH_SHA384:
13204 return( MBEDTLS_MD_SHA384 );
13205 case MBEDTLS_SSL_HASH_SHA512:
13206 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013207#endif
13208 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013209 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020013210 }
13211}
13212
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013213/*
13214 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
13215 */
13216unsigned char mbedtls_ssl_hash_from_md_alg( int md )
13217{
13218 switch( md )
13219 {
13220#if defined(MBEDTLS_MD5_C)
13221 case MBEDTLS_MD_MD5:
13222 return( MBEDTLS_SSL_HASH_MD5 );
13223#endif
13224#if defined(MBEDTLS_SHA1_C)
13225 case MBEDTLS_MD_SHA1:
13226 return( MBEDTLS_SSL_HASH_SHA1 );
13227#endif
13228#if defined(MBEDTLS_SHA256_C)
13229 case MBEDTLS_MD_SHA224:
13230 return( MBEDTLS_SSL_HASH_SHA224 );
13231 case MBEDTLS_MD_SHA256:
13232 return( MBEDTLS_SSL_HASH_SHA256 );
13233#endif
13234#if defined(MBEDTLS_SHA512_C)
13235 case MBEDTLS_MD_SHA384:
13236 return( MBEDTLS_SSL_HASH_SHA384 );
13237 case MBEDTLS_MD_SHA512:
13238 return( MBEDTLS_SSL_HASH_SHA512 );
13239#endif
13240 default:
13241 return( MBEDTLS_SSL_HASH_NONE );
13242 }
13243}
13244
Hanno Beckeree902df2019-08-23 13:47:47 +010013245#if defined(MBEDTLS_USE_TINYCRYPT)
13246/*
13247 * Check if a curve proposed by the peer is in our list.
13248 * Return 0 if we're willing to use it, -1 otherwise.
13249 */
13250int mbedtls_ssl_check_curve_uecc( const mbedtls_ssl_context *ssl,
13251 mbedtls_uecc_group_id grp_id )
13252{
13253 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_UECC_GRP_ID( own_ec_id )
13254 if( own_ec_id == grp_id )
13255 return( 0 );
13256 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_UECC_GRP_ID
13257
13258 return( -1 );
13259}
13260#endif /* MBEDTLS_USE_TINYCRYPT */
13261
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020013262#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013263/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013264 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020013265 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013266 */
Hanno Beckeree902df2019-08-23 13:47:47 +010013267int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl,
13268 mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013269{
Hanno Beckera4a9c692019-06-18 16:55:47 +010013270 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_EC_GRP_ID( own_ec_id )
13271 if( own_ec_id == grp_id )
13272 return( 0 );
13273 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_EC_GRP_ID
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013274
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020013275 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010013276}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020013277#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013278
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013279#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013280/*
13281 * Check if a hash proposed by the peer is in our list.
13282 * Return 0 if we're willing to use it, -1 otherwise.
13283 */
13284int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
13285 mbedtls_md_type_t md )
13286{
Hanno Beckerf1bc9e12019-06-19 16:23:21 +010013287 MBEDTLS_SSL_BEGIN_FOR_EACH_SIG_HASH( md_alg )
13288 if( md_alg == md )
13289 return( 0 );
13290 MBEDTLS_SSL_END_FOR_EACH_SIG_HASH
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013291
13292 return( -1 );
13293}
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020013294#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020013295
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013296#if defined(MBEDTLS_X509_CRT_PARSE_C)
13297int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
Hanno Becker473f98f2019-06-26 10:27:32 +010013298 mbedtls_ssl_ciphersuite_handle_t ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013299 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020013300 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013301{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013302 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013303#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013304 int usage = 0;
13305#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013306#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013307 const char *ext_oid;
13308 size_t ext_len;
13309#endif
13310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013311#if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
13312 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013313 ((void) cert);
13314 ((void) cert_endpoint);
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013315 ((void) flags);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013316#endif
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013317
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013318#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
13319 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013320 {
13321 /* Server part of the key exchange */
Hanno Becker473f98f2019-06-26 10:27:32 +010013322 switch( mbedtls_ssl_suite_get_key_exchange( ciphersuite ) )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013323 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013324 case MBEDTLS_KEY_EXCHANGE_RSA:
13325 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013326 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013327 break;
13328
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013329 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
13330 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
13331 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
13332 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013333 break;
13334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013335 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
13336 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013337 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013338 break;
13339
13340 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013341 case MBEDTLS_KEY_EXCHANGE_NONE:
13342 case MBEDTLS_KEY_EXCHANGE_PSK:
13343 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
13344 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +020013345 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013346 usage = 0;
13347 }
13348 }
13349 else
13350 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013351 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
13352 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013353 }
13354
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013355 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013356 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013357 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013358 ret = -1;
13359 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013360#else
13361 ((void) ciphersuite);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013362#endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013363
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013364#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
13365 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013366 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013367 ext_oid = MBEDTLS_OID_SERVER_AUTH;
13368 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013369 }
13370 else
13371 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013372 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
13373 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013374 }
13375
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013376 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013377 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010013378 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013379 ret = -1;
13380 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013381#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020013382
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010013383 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020013384}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013385#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +020013386
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013387#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
13388 defined(MBEDTLS_SSL_PROTO_TLS1_1)
13389int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
13390 unsigned char *output,
13391 unsigned char *data, size_t data_len )
13392{
13393 int ret = 0;
13394 mbedtls_md5_context mbedtls_md5;
13395 mbedtls_sha1_context mbedtls_sha1;
13396
13397 mbedtls_md5_init( &mbedtls_md5 );
13398 mbedtls_sha1_init( &mbedtls_sha1 );
13399
13400 /*
13401 * digitally-signed struct {
13402 * opaque md5_hash[16];
13403 * opaque sha_hash[20];
13404 * };
13405 *
13406 * md5_hash
13407 * MD5(ClientHello.random + ServerHello.random
13408 * + ServerParams);
13409 * sha_hash
13410 * SHA(ClientHello.random + ServerHello.random
13411 * + ServerParams);
13412 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013413 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013414 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013415 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013416 goto exit;
13417 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013418 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013419 ssl->handshake->randbytes, 64 ) ) != 0 )
13420 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013421 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013422 goto exit;
13423 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013424 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013425 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013426 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013427 goto exit;
13428 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013429 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013430 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013431 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013432 goto exit;
13433 }
13434
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013435 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013436 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013437 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013438 goto exit;
13439 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013440 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013441 ssl->handshake->randbytes, 64 ) ) != 0 )
13442 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013443 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013444 goto exit;
13445 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013446 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013447 data_len ) ) != 0 )
13448 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013449 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013450 goto exit;
13451 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013452 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013453 output + 16 ) ) != 0 )
13454 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010013455 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013456 goto exit;
13457 }
13458
13459exit:
13460 mbedtls_md5_free( &mbedtls_md5 );
13461 mbedtls_sha1_free( &mbedtls_sha1 );
13462
13463 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013464 mbedtls_ssl_pend_fatal_alert( ssl,
13465 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013466
13467 return( ret );
13468
13469}
13470#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
13471 MBEDTLS_SSL_PROTO_TLS1_1 */
13472
13473#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
13474 defined(MBEDTLS_SSL_PROTO_TLS1_2)
13475int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +020013476 unsigned char *hash, size_t *hashlen,
13477 unsigned char *data, size_t data_len,
13478 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013479{
13480 int ret = 0;
13481 mbedtls_md_context_t ctx;
Andrzej Kurek84bde412020-07-06 15:27:34 -040013482
Hanno Beckera5cedbc2019-07-17 11:21:02 +010013483 mbedtls_md_handle_t md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +020013484 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013485
13486 mbedtls_md_init( &ctx );
13487
13488 /*
13489 * digitally-signed struct {
13490 * opaque client_random[32];
13491 * opaque server_random[32];
13492 * ServerDHParams params;
13493 * };
13494 */
13495 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
13496 {
13497 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
13498 goto exit;
13499 }
13500 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
13501 {
13502 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
13503 goto exit;
13504 }
13505 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
13506 {
13507 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13508 goto exit;
13509 }
13510 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
13511 {
13512 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13513 goto exit;
13514 }
Gilles Peskineca1d7422018-04-24 11:53:22 +020013515 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013516 {
13517 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
13518 goto exit;
13519 }
13520
13521exit:
13522 mbedtls_md_free( &ctx );
13523
13524 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013525 mbedtls_ssl_pend_fatal_alert( ssl,
13526 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013527
Andrzej Kurekafec8852020-07-15 16:31:27 -040013528 return( ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013529}
13530#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
13531 MBEDTLS_SSL_PROTO_TLS1_2 */
13532
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013533#endif /* MBEDTLS_SSL_TLS_C */