blob: 32b9799429a40ec20a3b8d2aed2260ceb84876d5 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Jerry Yub476a442022-01-21 18:14:45 +080028#include <assert.h>
29
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
Jerry Yu6ade7432022-01-25 10:39:33 +080034#include <stdio.h>
SimonBd5800b72016-04-26 07:43:27 +010035#define mbedtls_calloc calloc
36#define mbedtls_free free
Jerry Yu6ade7432022-01-25 10:39:33 +080037#define mbedtls_printf printf
38#endif /* !MBEDTLS_PLATFORM_C */
SimonBd5800b72016-04-26 07:43:27 +010039
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000040#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010041#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010042#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000043#include "ssl_misc.h"
Janos Follath73c616b2019-12-18 15:07:04 +000044#include "mbedtls/debug.h"
45#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050046#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010047#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020048#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020049
Rich Evans00ab4702015-02-06 13:43:58 +000050#include <string.h>
51
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050052#if defined(MBEDTLS_USE_PSA_CRYPTO)
53#include "mbedtls/psa_util.h"
54#include "psa/crypto.h"
55#endif
56
Janos Follath23bdca02016-10-07 14:47:14 +010057#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000058#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020059#endif
60
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020061#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010062
Hanno Beckera0e20d02019-05-15 14:03:01 +010063#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010064/* Top-level Connection ID API */
65
Hanno Becker8367ccc2019-05-14 11:30:10 +010066int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
67 size_t len,
68 int ignore_other_cid )
Hanno Beckerad4a1372019-05-03 13:06:44 +010069{
70 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
71 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
72
Hanno Becker611ac772019-05-14 11:45:26 +010073 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
74 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
75 {
76 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
77 }
78
79 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010080 conf->cid_len = len;
81 return( 0 );
82}
83
Hanno Beckerf8542cf2019-04-09 15:22:03 +010084int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
85 int enable,
86 unsigned char const *own_cid,
87 size_t own_cid_len )
88{
Hanno Becker76a79ab2019-05-03 14:38:32 +010089 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
90 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
91
Hanno Beckerca092242019-04-25 16:01:49 +010092 ssl->negotiate_cid = enable;
93 if( enable == MBEDTLS_SSL_CID_DISABLED )
94 {
95 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
96 return( 0 );
97 }
98 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckerad4a1372019-05-03 13:06:44 +010099 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Beckerca092242019-04-25 16:01:49 +0100100
Hanno Beckerad4a1372019-05-03 13:06:44 +0100101 if( own_cid_len != ssl->conf->cid_len )
Hanno Beckerca092242019-04-25 16:01:49 +0100102 {
Hanno Beckerad4a1372019-05-03 13:06:44 +0100103 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
104 (unsigned) own_cid_len,
105 (unsigned) ssl->conf->cid_len ) );
Hanno Beckerca092242019-04-25 16:01:49 +0100106 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
107 }
108
109 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100110 /* Truncation is not an issue here because
111 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
112 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100113
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100114 return( 0 );
115}
116
Paul Elliott0113cf12022-03-11 20:26:47 +0000117int mbedtls_ssl_get_own_cid( mbedtls_ssl_context *ssl,
118 int *enabled,
119 unsigned char own_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
120 size_t *own_cid_len )
121{
122 *enabled = MBEDTLS_SSL_CID_DISABLED;
123
124 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
125 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
126
127 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID length is
128 * zero as this is indistinguishable from not requesting to use
129 * the CID extension. */
130 if( ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
131 return( 0 );
132
133 if( own_cid_len != NULL )
134 {
135 *own_cid_len = ssl->own_cid_len;
136 if( own_cid != NULL )
137 memcpy( own_cid, ssl->own_cid, ssl->own_cid_len );
138 }
139
140 *enabled = MBEDTLS_SSL_CID_ENABLED;
141
142 return( 0 );
143}
144
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100145int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
146 int *enabled,
147 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
148 size_t *peer_cid_len )
149{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100150 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100151
Hanno Becker76a79ab2019-05-03 14:38:32 +0100152 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Paul Elliott27b0d942022-03-18 21:55:32 +0000153 mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Hanno Becker76a79ab2019-05-03 14:38:32 +0100154 {
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100155 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker76a79ab2019-05-03 14:38:32 +0100156 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100157
Hanno Beckerc5f24222019-05-03 12:54:52 +0100158 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
159 * were used, but client and server requested the empty CID.
160 * This is indistinguishable from not using the CID extension
161 * in the first place. */
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100162 if( ssl->transform_in->in_cid_len == 0 &&
163 ssl->transform_in->out_cid_len == 0 )
164 {
165 return( 0 );
166 }
167
Hanno Becker615ef172019-05-22 16:50:35 +0100168 if( peer_cid_len != NULL )
169 {
170 *peer_cid_len = ssl->transform_in->out_cid_len;
171 if( peer_cid != NULL )
172 {
173 memcpy( peer_cid, ssl->transform_in->out_cid,
174 ssl->transform_in->out_cid_len );
175 }
176 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100177
178 *enabled = MBEDTLS_SSL_CID_ENABLED;
179
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100180 return( 0 );
181}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100182#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100183
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200186#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200187/*
188 * Convert max_fragment_length codes to length.
189 * RFC 6066 says:
190 * enum{
191 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
192 * } MaxFragmentLength;
193 * and we add 0 -> extension unused
194 */
Angus Grattond8213d02016-05-25 20:56:48 +1000195static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200196{
Angus Grattond8213d02016-05-25 20:56:48 +1000197 switch( mfl )
198 {
199 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
200 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
201 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
202 return 512;
203 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
204 return 1024;
205 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
206 return 2048;
207 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
208 return 4096;
209 default:
210 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
211 }
212}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200213#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200214
Hanno Becker52055ae2019-02-06 14:30:46 +0000215int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
216 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200217{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200218 mbedtls_ssl_session_free( dst );
219 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200220
吴敬辉0b716112021-11-29 10:46:35 +0800221#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
222 dst->ticket = NULL;
223#endif
224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200225#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000226
227#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200228 if( src->peer_cert != NULL )
229 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000230 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200231
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200232 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200233 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200234 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200235
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200236 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200237
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200238 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200239 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200240 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200241 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200242 dst->peer_cert = NULL;
243 return( ret );
244 }
245 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000246#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker9198ad12019-02-05 17:00:50 +0000247 if( src->peer_cert_digest != NULL )
248 {
Hanno Becker9198ad12019-02-05 17:00:50 +0000249 dst->peer_cert_digest =
Hanno Beckeraccc5992019-02-25 10:06:59 +0000250 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9198ad12019-02-05 17:00:50 +0000251 if( dst->peer_cert_digest == NULL )
252 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
253
254 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
255 src->peer_cert_digest_len );
256 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000257 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000258 }
259#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
260
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200261#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200262
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200263#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200264 if( src->ticket != NULL )
265 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200266 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200267 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200268 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200269
270 memcpy( dst->ticket, src->ticket, src->ticket_len );
271 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200272#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200273
274 return( 0 );
275}
276
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500277#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
278static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
279{
280 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
281 if( resized_buffer == NULL )
282 return -1;
283
284 /* We want to copy len_new bytes when downsizing the buffer, and
285 * len_old bytes when upsizing, so we choose the smaller of two sizes,
286 * to fit one buffer into another. Size checks, ensuring that no data is
287 * lost, are done outside of this function. */
288 memcpy( resized_buffer, *buffer,
289 ( len_new < *len_old ) ? len_new : *len_old );
290 mbedtls_platform_zeroize( *buffer, *len_old );
291 mbedtls_free( *buffer );
292
293 *buffer = resized_buffer;
294 *len_old = len_new;
295
296 return 0;
297}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200298
299static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
Andrzej Kurek069fa962021-01-07 08:02:15 -0500300 size_t in_buf_new_len,
301 size_t out_buf_new_len )
Andrzej Kurek4a063792020-10-21 15:08:44 +0200302{
303 int modified = 0;
304 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
305 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
306 if( ssl->in_buf != NULL )
307 {
308 written_in = ssl->in_msg - ssl->in_buf;
309 iv_offset_in = ssl->in_iv - ssl->in_buf;
310 len_offset_in = ssl->in_len - ssl->in_buf;
311 if( downsizing ?
312 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
313 ssl->in_buf_len < in_buf_new_len )
314 {
315 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
316 {
317 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
318 }
319 else
320 {
Paul Elliottb7449902021-03-10 18:14:58 +0000321 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
322 in_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200323 modified = 1;
324 }
325 }
326 }
327
328 if( ssl->out_buf != NULL )
329 {
330 written_out = ssl->out_msg - ssl->out_buf;
331 iv_offset_out = ssl->out_iv - ssl->out_buf;
332 len_offset_out = ssl->out_len - ssl->out_buf;
333 if( downsizing ?
334 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
335 ssl->out_buf_len < out_buf_new_len )
336 {
337 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
338 {
339 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
340 }
341 else
342 {
Paul Elliottb7449902021-03-10 18:14:58 +0000343 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
344 out_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200345 modified = 1;
346 }
347 }
348 }
349 if( modified )
350 {
351 /* Update pointers here to avoid doing it twice. */
352 mbedtls_ssl_reset_in_out_pointers( ssl );
353 /* Fields below might not be properly updated with record
354 * splitting or with CID, so they are manually updated here. */
355 ssl->out_msg = ssl->out_buf + written_out;
356 ssl->out_len = ssl->out_buf + len_offset_out;
357 ssl->out_iv = ssl->out_buf + iv_offset_out;
358
359 ssl->in_msg = ssl->in_buf + written_in;
360 ssl->in_len = ssl->in_buf + len_offset_in;
361 ssl->in_iv = ssl->in_buf + iv_offset_in;
362 }
363}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500364#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
365
Jerry Yudb8c48a2022-01-27 14:54:54 +0800366#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800367
368#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
369typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
370 const char *label,
371 const unsigned char *random, size_t rlen,
372 unsigned char *dstbuf, size_t dlen );
373
374static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id );
375
376#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
377
378/* Type for the TLS PRF */
379typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
380 const unsigned char *, size_t,
381 unsigned char *, size_t);
382
383static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
384 int ciphersuite,
385 const unsigned char master[48],
386#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
387 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
388 int encrypt_then_mac,
389#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
390 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
391 ssl_tls_prf_t tls_prf,
392 const unsigned char randbytes[64],
393 int minor_ver,
394 unsigned endpoint,
395 const mbedtls_ssl_context *ssl );
396
397#if defined(MBEDTLS_SHA256_C)
398static int tls_prf_sha256( const unsigned char *secret, size_t slen,
399 const char *label,
400 const unsigned char *random, size_t rlen,
401 unsigned char *dstbuf, size_t dlen );
402static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
403static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
404
405#endif /* MBEDTLS_SHA256_C */
406
407#if defined(MBEDTLS_SHA384_C)
408static int tls_prf_sha384( const unsigned char *secret, size_t slen,
409 const char *label,
410 const unsigned char *random, size_t rlen,
411 unsigned char *dstbuf, size_t dlen );
412
413static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
414static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
415#endif /* MBEDTLS_SHA384_C */
416
417static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
418 unsigned char *buf,
419 size_t buf_len );
420static int ssl_session_load_tls12( mbedtls_ssl_session *session,
421 const unsigned char *buf,
422 size_t len );
423#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
424
Jerry Yu53d23e22022-02-09 16:25:09 +0800425static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
426
Jerry Yudb8c48a2022-01-27 14:54:54 +0800427#if defined(MBEDTLS_SHA256_C)
428static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
Jerry Yu53d23e22022-02-09 16:25:09 +0800429#endif /* MBEDTLS_SHA256_C */
Jerry Yudb8c48a2022-01-27 14:54:54 +0800430
431#if defined(MBEDTLS_SHA384_C)
432static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
Jerry Yu53d23e22022-02-09 16:25:09 +0800433#endif /* MBEDTLS_SHA384_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000434
Ron Eldor51d3ab52019-05-12 14:54:30 +0300435int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
436 const unsigned char *secret, size_t slen,
437 const char *label,
438 const unsigned char *random, size_t rlen,
439 unsigned char *dstbuf, size_t dlen )
440{
441 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
442
443 switch( prf )
444 {
Ron Eldord2f25f72019-05-15 14:54:22 +0300445#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200446#if defined(MBEDTLS_SHA384_C)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300447 case MBEDTLS_SSL_TLS_PRF_SHA384:
448 tls_prf = tls_prf_sha384;
449 break;
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200450#endif /* MBEDTLS_SHA384_C */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300451#if defined(MBEDTLS_SHA256_C)
452 case MBEDTLS_SSL_TLS_PRF_SHA256:
453 tls_prf = tls_prf_sha256;
454 break;
Ron Eldord2f25f72019-05-15 14:54:22 +0300455#endif /* MBEDTLS_SHA256_C */
456#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300457 default:
458 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
459 }
460
461 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
462}
463
Jerry Yuc73c6182022-02-08 20:29:25 +0800464#if defined(MBEDTLS_X509_CRT_PARSE_C)
465static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
466{
467#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
468 if( session->peer_cert != NULL )
469 {
470 mbedtls_x509_crt_free( session->peer_cert );
471 mbedtls_free( session->peer_cert );
472 session->peer_cert = NULL;
473 }
474#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
475 if( session->peer_cert_digest != NULL )
476 {
477 /* Zeroization is not necessary. */
478 mbedtls_free( session->peer_cert_digest );
479 session->peer_cert_digest = NULL;
480 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
481 session->peer_cert_digest_len = 0;
482 }
483#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
484}
485#endif /* MBEDTLS_X509_CRT_PARSE_C */
486
487void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
488 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
489{
490 ((void) ciphersuite_info);
491
492#if defined(MBEDTLS_SHA384_C)
493 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
494 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
495 else
496#endif
497#if defined(MBEDTLS_SHA256_C)
498 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
499 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
500 else
501#endif
502 {
503 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
504 return;
505 }
506}
507
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100508static void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
509 unsigned hs_type,
510 size_t total_hs_len )
511{
512 unsigned char hs_hdr[4];
513
514 /* Build HS header for checksum update. */
515 hs_hdr[0] = MBEDTLS_BYTE_0( hs_type );
516 hs_hdr[1] = MBEDTLS_BYTE_2( total_hs_len );
517 hs_hdr[2] = MBEDTLS_BYTE_1( total_hs_len );
518 hs_hdr[3] = MBEDTLS_BYTE_0( total_hs_len );
519
520 ssl->handshake->update_checksum( ssl, hs_hdr, sizeof( hs_hdr ) );
521}
522
523void mbedtls_ssl_add_hs_msg_to_checksum( mbedtls_ssl_context *ssl,
524 unsigned hs_type,
525 unsigned char const *msg,
526 size_t msg_len )
527{
528 mbedtls_ssl_add_hs_hdr_to_checksum( ssl, hs_type, msg_len );
529 ssl->handshake->update_checksum( ssl, msg, msg_len );
530}
531
Jerry Yuc73c6182022-02-08 20:29:25 +0800532void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
533{
534 ((void) ssl);
535#if defined(MBEDTLS_SHA256_C)
536#if defined(MBEDTLS_USE_PSA_CRYPTO)
537 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
538 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
539#else
540 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
541#endif
542#endif
543#if defined(MBEDTLS_SHA384_C)
544#if defined(MBEDTLS_USE_PSA_CRYPTO)
545 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
546 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
547#else
548 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
549#endif
550#endif
551}
552
553static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
554 const unsigned char *buf, size_t len )
555{
556#if defined(MBEDTLS_SHA256_C)
557#if defined(MBEDTLS_USE_PSA_CRYPTO)
558 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
559#else
560 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
561#endif
562#endif
563#if defined(MBEDTLS_SHA384_C)
564#if defined(MBEDTLS_USE_PSA_CRYPTO)
565 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
566#else
567 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
568#endif
569#endif
570}
571
572#if defined(MBEDTLS_SHA256_C)
573static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
574 const unsigned char *buf, size_t len )
575{
576#if defined(MBEDTLS_USE_PSA_CRYPTO)
577 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
578#else
579 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
580#endif
581}
582#endif
583
584#if defined(MBEDTLS_SHA384_C)
585static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
586 const unsigned char *buf, size_t len )
587{
588#if defined(MBEDTLS_USE_PSA_CRYPTO)
589 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
590#else
591 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
592#endif
593}
594#endif
595
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200597{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200598 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200599
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200600#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500601#if defined(MBEDTLS_USE_PSA_CRYPTO)
602 handshake->fin_sha256_psa = psa_hash_operation_init();
603 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
604#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200605 mbedtls_sha256_init( &handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +0200606 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200607#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500608#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200609#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500610#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500611 handshake->fin_sha384_psa = psa_hash_operation_init();
612 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -0500613#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200614 mbedtls_sha512_init( &handshake->fin_sha512 );
TRodziewicz26371e42021-06-08 16:45:41 +0200615 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200616#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500617#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200618
619 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100620
621#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +0100622 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100623 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
624#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200625
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200626#if defined(MBEDTLS_DHM_C)
627 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200628#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200629#if defined(MBEDTLS_ECDH_C)
630 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200631#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200632#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200633 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +0200634#if defined(MBEDTLS_SSL_CLI_C)
635 handshake->ecjpake_cache = NULL;
636 handshake->ecjpake_cache_len = 0;
637#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200638#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200639
Gilles Peskineeccd8882020-03-10 12:19:08 +0100640#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +0200641 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +0200642#endif
643
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200644#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
645 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
646#endif
Hanno Becker75173122019-02-06 16:18:31 +0000647
648#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
649 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
650 mbedtls_pk_init( &handshake->peer_pubkey );
651#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200652}
653
Hanno Beckera18d1322018-01-03 14:27:32 +0000654void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200655{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200656 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +0200657
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100658#if defined(MBEDTLS_USE_PSA_CRYPTO)
659 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
660 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100661#else
662 mbedtls_cipher_init( &transform->cipher_ctx_enc );
663 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100664#endif
665
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000666#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +0100667#if defined(MBEDTLS_USE_PSA_CRYPTO)
668 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
669 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100670#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200671 mbedtls_md_init( &transform->md_ctx_enc );
672 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +0000673#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100674#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200675}
676
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200677void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200678{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200679 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200680}
681
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200682static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +0000683{
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200684 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +0000685 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200686 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200687 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200688 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200689 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +0200690 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200691
692 /*
693 * Either the pointers are now NULL or cleared properly and can be freed.
694 * Now allocate missing structures.
695 */
696 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200697 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200698 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200699 }
Paul Bakker48916f92012-09-16 19:57:18 +0000700
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200701 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200702 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200703 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200704 }
Paul Bakker48916f92012-09-16 19:57:18 +0000705
Paul Bakker82788fb2014-10-20 13:59:19 +0200706 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200707 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200708 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200709 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500710#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
711 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -0400712
Andrzej Kurek4a063792020-10-21 15:08:44 +0200713 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
714 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500715#endif
Paul Bakker48916f92012-09-16 19:57:18 +0000716
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200717 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +0000718 if( ssl->handshake == NULL ||
719 ssl->transform_negotiate == NULL ||
720 ssl->session_negotiate == NULL )
721 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +0200722 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200723
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200724 mbedtls_free( ssl->handshake );
725 mbedtls_free( ssl->transform_negotiate );
726 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200727
728 ssl->handshake = NULL;
729 ssl->transform_negotiate = NULL;
730 ssl->session_negotiate = NULL;
731
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200732 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +0000733 }
734
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200735 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200736 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Beckera18d1322018-01-03 14:27:32 +0000737 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +0200738 ssl_handshake_params_init( ssl->handshake );
739
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200740#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200741 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
742 {
743 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200744
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200745 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
746 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
747 else
748 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200749
Hanno Becker0f57a652020-02-05 10:37:26 +0000750 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200751 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200752#endif
753
Brett Warrene0edc842021-08-17 09:53:13 +0100754/*
755 * curve_list is translated to IANA TLS group identifiers here because
756 * mbedtls_ssl_conf_curves returns void and so can't return
757 * any error codes.
758 */
759#if defined(MBEDTLS_ECP_C)
760#if !defined(MBEDTLS_DEPRECATED_REMOVED)
761 /* Heap allocate and translate curve_list from internal to IANA group ids */
762 if ( ssl->conf->curve_list != NULL )
763 {
764 size_t length;
765 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
766
767 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
768 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
769
770 /* Leave room for zero termination */
771 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
772 if ( group_list == NULL )
773 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
774
775 for( size_t i = 0; i < length; i++ )
776 {
777 const mbedtls_ecp_curve_info *info =
778 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
779 if ( info == NULL )
780 {
781 mbedtls_free( group_list );
782 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
783 }
784 group_list[i] = info->tls_id;
785 }
786
787 group_list[length] = 0;
788
789 ssl->handshake->group_list = group_list;
790 ssl->handshake->group_list_heap_allocated = 1;
791 }
792 else
793 {
794 ssl->handshake->group_list = ssl->conf->group_list;
795 ssl->handshake->group_list_heap_allocated = 0;
796 }
797#endif /* MBEDTLS_DEPRECATED_REMOVED */
798#endif /* MBEDTLS_ECP_C */
799
Jerry Yuf017ee42022-01-12 15:49:48 +0800800#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
801#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +0800802#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +0800803 /* Heap allocate and translate sig_hashes from internal hash identifiers to
804 signature algorithms IANA identifiers. */
805 if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) &&
Jerry Yuf017ee42022-01-12 15:49:48 +0800806 ssl->conf->sig_hashes != NULL )
807 {
808 const int *md;
809 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +0800810 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +0800811 uint16_t *p;
812
Jerry Yub476a442022-01-21 18:14:45 +0800813#if defined(static_assert)
814 static_assert( MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
815 <= ( SIZE_MAX - ( 2 * sizeof(uint16_t) ) ),
816 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big" );
Jerry Yua68dca22022-01-20 16:28:27 +0800817#endif
818
Jerry Yuf017ee42022-01-12 15:49:48 +0800819 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
820 {
821 if( mbedtls_ssl_hash_from_md_alg( *md ) == MBEDTLS_SSL_HASH_NONE )
822 continue;
Jerry Yub476a442022-01-21 18:14:45 +0800823#if defined(MBEDTLS_ECDSA_C)
824 sig_algs_len += sizeof( uint16_t );
825#endif
Jerry Yua68dca22022-01-20 16:28:27 +0800826
Jerry Yub476a442022-01-21 18:14:45 +0800827#if defined(MBEDTLS_RSA_C)
828 sig_algs_len += sizeof( uint16_t );
829#endif
830 if( sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN )
831 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Jerry Yuf017ee42022-01-12 15:49:48 +0800832 }
833
Jerry Yub476a442022-01-21 18:14:45 +0800834 if( sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN )
Jerry Yuf017ee42022-01-12 15:49:48 +0800835 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
836
Jerry Yub476a442022-01-21 18:14:45 +0800837 ssl->handshake->sig_algs = mbedtls_calloc( 1, sig_algs_len +
838 sizeof( uint16_t ));
Jerry Yuf017ee42022-01-12 15:49:48 +0800839 if( ssl->handshake->sig_algs == NULL )
840 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
841
842 p = (uint16_t *)ssl->handshake->sig_algs;
843 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
844 {
845 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *md );
846 if( hash == MBEDTLS_SSL_HASH_NONE )
847 continue;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800848#if defined(MBEDTLS_ECDSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800849 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA);
850 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800851#endif
852#if defined(MBEDTLS_RSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800853 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA);
854 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800855#endif
Jerry Yuf017ee42022-01-12 15:49:48 +0800856 }
857 *p = MBEDTLS_TLS1_3_SIG_NONE;
858 ssl->handshake->sig_algs_heap_allocated = 1;
859 }
860 else
Jerry Yua69269a2022-01-17 21:06:01 +0800861#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +0800862 {
863 ssl->handshake->sig_algs = ssl->conf->sig_algs;
864 ssl->handshake->sig_algs_heap_allocated = 0;
865 }
866#endif /* MBEDTLS_DEPRECATED_REMOVED */
867#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +0000868 return( 0 );
869}
870
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200871#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200872/* Dummy cookie callbacks for defaults */
873static int ssl_cookie_write_dummy( void *ctx,
874 unsigned char **p, unsigned char *end,
875 const unsigned char *cli_id, size_t cli_id_len )
876{
877 ((void) ctx);
878 ((void) p);
879 ((void) end);
880 ((void) cli_id);
881 ((void) cli_id_len);
882
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200883 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200884}
885
886static int ssl_cookie_check_dummy( void *ctx,
887 const unsigned char *cookie, size_t cookie_len,
888 const unsigned char *cli_id, size_t cli_id_len )
889{
890 ((void) ctx);
891 ((void) cookie);
892 ((void) cookie_len);
893 ((void) cli_id);
894 ((void) cli_id_len);
895
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200896 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200897}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200898#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200899
Paul Bakker5121ce52009-01-03 21:22:43 +0000900/*
901 * Initialize an SSL context
902 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200903void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
904{
905 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
906}
907
Jerry Yu60835a82021-08-04 10:13:52 +0800908static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
909{
Ronald Cron086ee0b2022-03-15 15:18:51 +0100910 const mbedtls_ssl_config *conf = ssl->conf;
911
Ronald Cron6f135e12021-12-08 16:57:54 +0100912#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100913 if( mbedtls_ssl_conf_is_tls13_only( conf ) )
914 {
915 if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jerry Yu60835a82021-08-04 10:13:52 +0800916 {
Ronald Cron086ee0b2022-03-15 15:18:51 +0100917 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported." ) );
Jerry Yu60835a82021-08-04 10:13:52 +0800918 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
919 }
Ronald Cron37bdaab2022-03-30 16:45:51 +0200920
921 if( conf->endpoint == MBEDTLS_SSL_IS_SERVER )
922 {
923 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 server is not supported yet." ) );
924 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
925 }
926
Jerry Yu60835a82021-08-04 10:13:52 +0800927 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
928 return( 0 );
929 }
930#endif
931
932#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100933 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800934 {
935 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
936 return( 0 );
937 }
938#endif
939
Ronald Cron6f135e12021-12-08 16:57:54 +0100940#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100941 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800942 {
Ronald Crone1d3f062022-02-10 14:50:54 +0100943 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
944 {
945 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2" ) );
946 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
947 }
Ronald Cron37bdaab2022-03-30 16:45:51 +0200948
949 if( conf->endpoint == MBEDTLS_SSL_IS_SERVER )
950 {
951 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 server is not supported yet." ) );
952 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
953 }
954
Ronald Crone1d3f062022-02-10 14:50:54 +0100955 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is TLS 1.3 or TLS 1.2." ) );
956 return( 0 );
Jerry Yu60835a82021-08-04 10:13:52 +0800957 }
958#endif
959
960 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
961 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
962}
963
964static int ssl_conf_check(const mbedtls_ssl_context *ssl)
965{
966 int ret;
967 ret = ssl_conf_version_check( ssl );
968 if( ret != 0 )
969 return( ret );
970
971 /* Space for further checks */
972
973 return( 0 );
974}
975
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200976/*
977 * Setup an SSL context
978 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100979
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +0200980int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +0200981 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +0000982{
Janos Follath865b3eb2019-12-16 11:46:15 +0000983 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +0000984 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
985 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +0000986
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +0200987 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +0000988
Jerry Yu60835a82021-08-04 10:13:52 +0800989 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
990 return( ret );
991
Paul Bakker62f2dee2012-09-28 07:31:51 +0000992 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +0100993 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +0000994 */
k-stachowiakc9a5f022018-07-24 13:53:31 +0200995
996 /* Set to NULL in case of an error condition */
997 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +0200998
Darryl Greenb33cc762019-11-28 14:29:44 +0000999#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1000 ssl->in_buf_len = in_buf_len;
1001#endif
1002 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001003 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001004 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001005 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001006 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001007 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10001008 }
1009
Darryl Greenb33cc762019-11-28 14:29:44 +00001010#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1011 ssl->out_buf_len = out_buf_len;
1012#endif
1013 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001014 if( ssl->out_buf == NULL )
1015 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001016 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001017 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001018 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001019 }
1020
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00001021 mbedtls_ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001022
Johan Pascalb62bb512015-12-03 21:56:45 +01001023#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +02001024 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
Johan Pascalb62bb512015-12-03 21:56:45 +01001025#endif
1026
Paul Bakker48916f92012-09-16 19:57:18 +00001027 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02001028 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001029
1030 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02001031
1032error:
1033 mbedtls_free( ssl->in_buf );
1034 mbedtls_free( ssl->out_buf );
1035
1036 ssl->conf = NULL;
1037
Darryl Greenb33cc762019-11-28 14:29:44 +00001038#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1039 ssl->in_buf_len = 0;
1040 ssl->out_buf_len = 0;
1041#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001042 ssl->in_buf = NULL;
1043 ssl->out_buf = NULL;
1044
1045 ssl->in_hdr = NULL;
1046 ssl->in_ctr = NULL;
1047 ssl->in_len = NULL;
1048 ssl->in_iv = NULL;
1049 ssl->in_msg = NULL;
1050
1051 ssl->out_hdr = NULL;
1052 ssl->out_ctr = NULL;
1053 ssl->out_len = NULL;
1054 ssl->out_iv = NULL;
1055 ssl->out_msg = NULL;
1056
k-stachowiak9f7798e2018-07-31 16:52:32 +02001057 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001058}
1059
1060/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001061 * Reset an initialized and used SSL context for re-use while retaining
1062 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001063 *
1064 * If partial is non-zero, keep data in the input buffer and client ID.
1065 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001066 */
XiaokangQian78b1fa72022-01-19 06:56:30 +00001067void mbedtls_ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
1068 int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00001069{
Darryl Greenb33cc762019-11-28 14:29:44 +00001070#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1071 size_t in_buf_len = ssl->in_buf_len;
1072 size_t out_buf_len = ssl->out_buf_len;
1073#else
1074 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1075 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1076#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001077
Hanno Beckerb0302c42021-08-03 09:39:42 +01001078#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1079 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001080#endif
1081
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001082 /* Cancel any possibly running timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00001083 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001084
Hanno Beckerb0302c42021-08-03 09:39:42 +01001085 mbedtls_ssl_reset_in_out_pointers( ssl );
1086
1087 /* Reset incoming message parsing */
1088 ssl->in_offt = NULL;
1089 ssl->nb_zero = 0;
1090 ssl->in_msgtype = 0;
1091 ssl->in_msglen = 0;
1092 ssl->in_hslen = 0;
1093 ssl->keep_current_message = 0;
1094 ssl->transform_in = NULL;
1095
1096#if defined(MBEDTLS_SSL_PROTO_DTLS)
1097 ssl->next_record_offset = 0;
1098 ssl->in_epoch = 0;
1099#endif
1100
1101 /* Keep current datagram if partial == 1 */
1102 if( partial == 0 )
1103 {
1104 ssl->in_left = 0;
1105 memset( ssl->in_buf, 0, in_buf_len );
1106 }
1107
1108 /* Reset outgoing message writing */
1109 ssl->out_msgtype = 0;
1110 ssl->out_msglen = 0;
1111 ssl->out_left = 0;
1112 memset( ssl->out_buf, 0, out_buf_len );
1113 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
1114 ssl->transform_out = NULL;
1115
1116#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1117 mbedtls_ssl_dtls_replay_reset( ssl );
1118#endif
1119
XiaokangQian2b01dc32022-01-21 02:53:13 +00001120#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001121 if( ssl->transform )
1122 {
1123 mbedtls_ssl_transform_free( ssl->transform );
1124 mbedtls_free( ssl->transform );
1125 ssl->transform = NULL;
1126 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001127#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1128
XiaokangQian2b01dc32022-01-21 02:53:13 +00001129#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1130 mbedtls_ssl_transform_free( ssl->transform_application );
1131 mbedtls_free( ssl->transform_application );
1132 ssl->transform_application = NULL;
1133
1134 if( ssl->handshake != NULL )
1135 {
1136 mbedtls_ssl_transform_free( ssl->handshake->transform_earlydata );
1137 mbedtls_free( ssl->handshake->transform_earlydata );
1138 ssl->handshake->transform_earlydata = NULL;
1139
1140 mbedtls_ssl_transform_free( ssl->handshake->transform_handshake );
1141 mbedtls_free( ssl->handshake->transform_handshake );
1142 ssl->handshake->transform_handshake = NULL;
1143 }
1144
XiaokangQian2b01dc32022-01-21 02:53:13 +00001145#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001146}
1147
1148int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
1149{
1150 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1151
1152 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
1153
XiaokangQian78b1fa72022-01-19 06:56:30 +00001154 mbedtls_ssl_session_reset_msg_layer( ssl, partial );
Hanno Beckerb0302c42021-08-03 09:39:42 +01001155
1156 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001157#if defined(MBEDTLS_SSL_RENEGOTIATION)
1158 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001159 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001160
1161 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001162 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
1163 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001164#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001165 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001166
Hanno Beckerb0302c42021-08-03 09:39:42 +01001167 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001168 ssl->session_out = NULL;
Paul Bakkerc0463502013-02-14 11:19:38 +01001169 if( ssl->session )
1170 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001171 mbedtls_ssl_session_free( ssl->session );
1172 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01001173 ssl->session = NULL;
1174 }
1175
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001176#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001177 ssl->alpn_chosen = NULL;
1178#endif
1179
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001180#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01001181#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001182 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01001183#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001184 {
1185 mbedtls_free( ssl->cli_id );
1186 ssl->cli_id = NULL;
1187 ssl->cli_id_len = 0;
1188 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001189#endif
1190
Paul Bakker48916f92012-09-16 19:57:18 +00001191 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
1192 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001193
1194 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00001195}
1196
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001197/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001198 * Reset an initialized and used SSL context for re-use while retaining
1199 * all application-set variables, function pointers and data.
1200 */
1201int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
1202{
Hanno Becker43aefe22020-02-05 10:44:56 +00001203 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001204}
1205
1206/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001207 * SSL set accessors
1208 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001209void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00001210{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001211 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001212}
1213
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02001214void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001215{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001216 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001217}
1218
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001219#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001220void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001221{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001222 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001223}
1224#endif
1225
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001226void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001227{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001228 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001229}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001231#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001232
Hanno Becker1841b0a2018-08-24 11:13:57 +01001233void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
1234 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01001235{
1236 ssl->disable_datagram_packing = !allow_packing;
1237}
1238
1239void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
1240 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001241{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001242 conf->hs_timeout_min = min;
1243 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001244}
1245#endif
1246
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001247void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00001248{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001249 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001250}
1251
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001252#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001253void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02001254 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001255 void *p_vrfy )
1256{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001257 conf->f_vrfy = f_vrfy;
1258 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001259}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001260#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001261
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001262void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001263 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00001264 void *p_rng )
1265{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001266 conf->f_rng = f_rng;
1267 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001268}
1269
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001270void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02001271 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00001272 void *p_dbg )
1273{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001274 conf->f_dbg = f_dbg;
1275 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001276}
1277
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001278void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001279 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00001280 mbedtls_ssl_send_t *f_send,
1281 mbedtls_ssl_recv_t *f_recv,
1282 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001283{
1284 ssl->p_bio = p_bio;
1285 ssl->f_send = f_send;
1286 ssl->f_recv = f_recv;
1287 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001288}
1289
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001290#if defined(MBEDTLS_SSL_PROTO_DTLS)
1291void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
1292{
1293 ssl->mtu = mtu;
1294}
1295#endif
1296
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001297void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001298{
1299 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001300}
1301
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001302void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
1303 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00001304 mbedtls_ssl_set_timer_t *f_set_timer,
1305 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001306{
1307 ssl->p_timer = p_timer;
1308 ssl->f_set_timer = f_set_timer;
1309 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001310
1311 /* Make sure we start with no timer running */
Hanno Becker0f57a652020-02-05 10:37:26 +00001312 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001313}
1314
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001315#if defined(MBEDTLS_SSL_SRV_C)
Glenn Strauss2ed95272022-01-21 18:02:17 -05001316void mbedtls_ssl_conf_cert_cb( mbedtls_ssl_config *conf,
1317 int (*f_cert_cb)(mbedtls_ssl_context *) )
1318{
1319 conf->f_cert_cb = f_cert_cb;
1320}
1321#endif /* MBEDTLS_SSL_SRV_C */
1322
1323#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001324void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Hanno Beckera637ff62021-04-15 08:42:48 +01001325 void *p_cache,
1326 mbedtls_ssl_cache_get_t *f_get_cache,
1327 mbedtls_ssl_cache_set_t *f_set_cache )
Paul Bakker5121ce52009-01-03 21:22:43 +00001328{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001329 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001330 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001331 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001332}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001333#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001335#if defined(MBEDTLS_SSL_CLI_C)
1336int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00001337{
Janos Follath865b3eb2019-12-16 11:46:15 +00001338 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001339
1340 if( ssl == NULL ||
1341 session == NULL ||
1342 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001343 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001344 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001345 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001346 }
1347
Hanno Beckere810bbc2021-05-14 16:01:05 +01001348 if( ssl->handshake->resume == 1 )
1349 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1350
Hanno Becker52055ae2019-02-06 14:30:46 +00001351 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
1352 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001353 return( ret );
1354
Paul Bakker0a597072012-09-25 21:55:46 +00001355 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001356
1357 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001358}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001359#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001360
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001361void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
1362 const int *ciphersuites )
1363{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001364 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001365}
1366
Ronald Cron6f135e12021-12-08 16:57:54 +01001367#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yucadebe52021-08-24 10:36:45 +08001368void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
Hanno Becker71f1ed62021-07-24 06:01:47 +01001369 const int kex_modes )
1370{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001371 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001372}
Ronald Cron6f135e12021-12-08 16:57:54 +01001373#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001375#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001376void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01001377 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001378{
1379 conf->cert_profile = profile;
1380}
1381
Glenn Strauss36872db2022-01-22 05:06:31 -05001382static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
1383{
1384 mbedtls_ssl_key_cert *cur = key_cert, *next;
1385
1386 while( cur != NULL )
1387 {
1388 next = cur->next;
1389 mbedtls_free( cur );
1390 cur = next;
1391 }
1392}
1393
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001394/* Append a new keycert entry to a (possibly empty) list */
1395static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
1396 mbedtls_x509_crt *cert,
1397 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001398{
niisato8ee24222018-06-25 19:05:48 +09001399 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001400
Glenn Strauss36872db2022-01-22 05:06:31 -05001401 if( cert == NULL )
1402 {
1403 /* Free list if cert is null */
1404 ssl_key_cert_free( *head );
1405 *head = NULL;
1406 return( 0 );
1407 }
1408
niisato8ee24222018-06-25 19:05:48 +09001409 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
1410 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001411 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001412
niisato8ee24222018-06-25 19:05:48 +09001413 new_cert->cert = cert;
1414 new_cert->key = key;
1415 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001416
Glenn Strauss36872db2022-01-22 05:06:31 -05001417 /* Update head if the list was null, else add to the end */
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001418 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01001419 {
niisato8ee24222018-06-25 19:05:48 +09001420 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01001421 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001422 else
1423 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001424 mbedtls_ssl_key_cert *cur = *head;
1425 while( cur->next != NULL )
1426 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09001427 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001428 }
1429
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001430 return( 0 );
1431}
1432
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001433int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001434 mbedtls_x509_crt *own_cert,
1435 mbedtls_pk_context *pk_key )
1436{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02001437 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001438}
1439
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001440void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001441 mbedtls_x509_crt *ca_chain,
1442 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001443{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001444 conf->ca_chain = ca_chain;
1445 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001446
1447#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1448 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1449 * cannot be used together. */
1450 conf->f_ca_cb = NULL;
1451 conf->p_ca_cb = NULL;
1452#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001453}
Hanno Becker5adaad92019-03-27 16:54:37 +00001454
1455#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1456void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00001457 mbedtls_x509_crt_ca_cb_t f_ca_cb,
Hanno Becker5adaad92019-03-27 16:54:37 +00001458 void *p_ca_cb )
1459{
1460 conf->f_ca_cb = f_ca_cb;
1461 conf->p_ca_cb = p_ca_cb;
1462
1463 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1464 * cannot be used together. */
1465 conf->ca_chain = NULL;
1466 conf->ca_crl = NULL;
1467}
1468#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001469#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001470
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001471#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Glenn Strauss69894072022-01-24 12:58:00 -05001472const unsigned char *mbedtls_ssl_get_hs_sni( mbedtls_ssl_context *ssl,
1473 size_t *name_len )
1474{
1475 *name_len = ssl->handshake->sni_name_len;
1476 return( ssl->handshake->sni_name );
1477}
1478
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001479int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
1480 mbedtls_x509_crt *own_cert,
1481 mbedtls_pk_context *pk_key )
1482{
1483 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
1484 own_cert, pk_key ) );
1485}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001486
1487void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
1488 mbedtls_x509_crt *ca_chain,
1489 mbedtls_x509_crl *ca_crl )
1490{
1491 ssl->handshake->sni_ca_chain = ca_chain;
1492 ssl->handshake->sni_ca_crl = ca_crl;
1493}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001494
1495void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
1496 int authmode )
1497{
1498 ssl->handshake->sni_authmode = authmode;
1499}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001500#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1501
Hanno Becker8927c832019-04-03 12:52:50 +01001502#if defined(MBEDTLS_X509_CRT_PARSE_C)
1503void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
1504 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1505 void *p_vrfy )
1506{
1507 ssl->f_vrfy = f_vrfy;
1508 ssl->p_vrfy = p_vrfy;
1509}
1510#endif
1511
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001512#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001513/*
1514 * Set EC J-PAKE password for current handshake
1515 */
1516int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
1517 const unsigned char *pw,
1518 size_t pw_len )
1519{
1520 mbedtls_ecjpake_role role;
1521
Janos Follath8eb64132016-06-03 15:40:57 +01001522 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001523 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1524
1525 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1526 role = MBEDTLS_ECJPAKE_SERVER;
1527 else
1528 role = MBEDTLS_ECJPAKE_CLIENT;
1529
1530 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
1531 role,
1532 MBEDTLS_MD_SHA256,
1533 MBEDTLS_ECP_DP_SECP256R1,
1534 pw, pw_len ) );
1535}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001536#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001537
Gilles Peskineeccd8882020-03-10 12:19:08 +01001538#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001539
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001540static int ssl_conf_psk_is_configured( mbedtls_ssl_config const *conf )
1541{
1542#if defined(MBEDTLS_USE_PSA_CRYPTO)
1543 if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
1544 return( 1 );
1545#endif /* MBEDTLS_USE_PSA_CRYPTO */
1546
1547 if( conf->psk != NULL )
1548 return( 1 );
1549
1550 return( 0 );
1551}
1552
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001553static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
1554{
1555 /* Remove reference to existing PSK, if any. */
1556#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001557 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001558 {
1559 /* The maintenance of the PSK key slot is the
1560 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001561 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001562 }
Hanno Beckera63ac3f2018-11-05 12:47:16 +00001563 /* This and the following branch should never
1564 * be taken simultaenously as we maintain the
1565 * invariant that raw and opaque PSKs are never
1566 * configured simultaneously. As a safeguard,
1567 * though, `else` is omitted here. */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001568#endif /* MBEDTLS_USE_PSA_CRYPTO */
1569 if( conf->psk != NULL )
1570 {
1571 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
1572
1573 mbedtls_free( conf->psk );
1574 conf->psk = NULL;
1575 conf->psk_len = 0;
1576 }
1577
1578 /* Remove reference to PSK identity, if any. */
1579 if( conf->psk_identity != NULL )
1580 {
1581 mbedtls_free( conf->psk_identity );
1582 conf->psk_identity = NULL;
1583 conf->psk_identity_len = 0;
1584 }
1585}
1586
Hanno Becker7390c712018-11-15 13:33:04 +00001587/* This function assumes that PSK identity in the SSL config is unset.
1588 * It checks that the provided identity is well-formed and attempts
1589 * to make a copy of it in the SSL config.
1590 * On failure, the PSK identity in the config remains unset. */
1591static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
1592 unsigned char const *psk_identity,
1593 size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001594{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001595 /* Identity len will be encoded on two bytes */
Hanno Becker7390c712018-11-15 13:33:04 +00001596 if( psk_identity == NULL ||
1597 ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10001598 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001599 {
1600 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1601 }
1602
Hanno Becker7390c712018-11-15 13:33:04 +00001603 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
1604 if( conf->psk_identity == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001605 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker6db455e2013-09-18 17:29:31 +02001606
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001607 conf->psk_identity_len = psk_identity_len;
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001608 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker5ad403f2013-09-18 21:21:30 +02001609
1610 return( 0 );
Paul Bakker6db455e2013-09-18 17:29:31 +02001611}
1612
Hanno Becker7390c712018-11-15 13:33:04 +00001613int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
1614 const unsigned char *psk, size_t psk_len,
1615 const unsigned char *psk_identity, size_t psk_identity_len )
1616{
Janos Follath865b3eb2019-12-16 11:46:15 +00001617 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001618
1619 /* We currently only support one PSK, raw or opaque. */
1620 if( ssl_conf_psk_is_configured( conf ) )
1621 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Becker7390c712018-11-15 13:33:04 +00001622
1623 /* Check and set raw PSK */
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001624 if( psk == NULL )
Hanno Becker7390c712018-11-15 13:33:04 +00001625 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001626 if( psk_len == 0 )
1627 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1628 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1629 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1630
Hanno Becker7390c712018-11-15 13:33:04 +00001631 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
1632 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1633 conf->psk_len = psk_len;
1634 memcpy( conf->psk, psk, conf->psk_len );
1635
1636 /* Check and set PSK Identity */
1637 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
1638 if( ret != 0 )
1639 ssl_conf_remove_psk( conf );
1640
1641 return( ret );
1642}
1643
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001644static void ssl_remove_psk( mbedtls_ssl_context *ssl )
1645{
1646#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001647 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001648 {
Ronald Croncf56a0a2020-08-04 09:51:30 +02001649 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001650 }
1651 else
1652#endif /* MBEDTLS_USE_PSA_CRYPTO */
1653 if( ssl->handshake->psk != NULL )
1654 {
1655 mbedtls_platform_zeroize( ssl->handshake->psk,
1656 ssl->handshake->psk_len );
1657 mbedtls_free( ssl->handshake->psk );
1658 ssl->handshake->psk_len = 0;
1659 }
1660}
1661
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001662int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
1663 const unsigned char *psk, size_t psk_len )
1664{
1665 if( psk == NULL || ssl->handshake == NULL )
1666 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1667
1668 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1669 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1670
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001671 ssl_remove_psk( ssl );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001672
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02001673 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001674 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001675
1676 ssl->handshake->psk_len = psk_len;
1677 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
1678
1679 return( 0 );
1680}
1681
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001682#if defined(MBEDTLS_USE_PSA_CRYPTO)
1683int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
Andrzej Kurek03e01462022-01-03 12:53:24 +01001684 mbedtls_svc_key_id_t psk,
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001685 const unsigned char *psk_identity,
1686 size_t psk_identity_len )
1687{
Janos Follath865b3eb2019-12-16 11:46:15 +00001688 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001689
1690 /* We currently only support one PSK, raw or opaque. */
1691 if( ssl_conf_psk_is_configured( conf ) )
1692 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001693
Hanno Becker7390c712018-11-15 13:33:04 +00001694 /* Check and set opaque PSK */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001695 if( mbedtls_svc_key_id_is_null( psk ) )
Hanno Becker7390c712018-11-15 13:33:04 +00001696 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ronald Croncf56a0a2020-08-04 09:51:30 +02001697 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00001698
1699 /* Check and set PSK Identity */
1700 ret = ssl_conf_set_psk_identity( conf, psk_identity,
1701 psk_identity_len );
1702 if( ret != 0 )
1703 ssl_conf_remove_psk( conf );
1704
1705 return( ret );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001706}
1707
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01001708int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
1709 mbedtls_svc_key_id_t psk )
1710{
1711 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
1712 ( ssl->handshake == NULL ) )
1713 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1714
1715 ssl_remove_psk( ssl );
1716 ssl->handshake->psk_opaque = psk;
1717 return( 0 );
1718}
1719#endif /* MBEDTLS_USE_PSA_CRYPTO */
1720
1721void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
1722 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
1723 size_t),
1724 void *p_psk )
1725{
1726 conf->f_psk = f_psk;
1727 conf->p_psk = p_psk;
1728}
1729#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1730
1731#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01001732psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01001733 size_t taglen,
1734 psa_algorithm_t *alg,
1735 psa_key_type_t *key_type,
1736 size_t *key_size )
1737{
1738 switch ( mbedtls_cipher_type )
1739 {
1740 case MBEDTLS_CIPHER_AES_128_CBC:
1741 *alg = PSA_ALG_CBC_NO_PADDING;
1742 *key_type = PSA_KEY_TYPE_AES;
1743 *key_size = 128;
1744 break;
1745 case MBEDTLS_CIPHER_AES_128_CCM:
1746 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1747 *key_type = PSA_KEY_TYPE_AES;
1748 *key_size = 128;
1749 break;
1750 case MBEDTLS_CIPHER_AES_128_GCM:
1751 *alg = PSA_ALG_GCM;
1752 *key_type = PSA_KEY_TYPE_AES;
1753 *key_size = 128;
1754 break;
1755 case MBEDTLS_CIPHER_AES_192_CCM:
1756 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1757 *key_type = PSA_KEY_TYPE_AES;
1758 *key_size = 192;
1759 break;
1760 case MBEDTLS_CIPHER_AES_192_GCM:
1761 *alg = PSA_ALG_GCM;
1762 *key_type = PSA_KEY_TYPE_AES;
1763 *key_size = 192;
1764 break;
1765 case MBEDTLS_CIPHER_AES_256_CBC:
1766 *alg = PSA_ALG_CBC_NO_PADDING;
1767 *key_type = PSA_KEY_TYPE_AES;
1768 *key_size = 256;
1769 break;
1770 case MBEDTLS_CIPHER_AES_256_CCM:
1771 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1772 *key_type = PSA_KEY_TYPE_AES;
1773 *key_size = 256;
1774 break;
1775 case MBEDTLS_CIPHER_AES_256_GCM:
1776 *alg = PSA_ALG_GCM;
1777 *key_type = PSA_KEY_TYPE_AES;
1778 *key_size = 256;
1779 break;
1780 case MBEDTLS_CIPHER_ARIA_128_CBC:
1781 *alg = PSA_ALG_CBC_NO_PADDING;
1782 *key_type = PSA_KEY_TYPE_ARIA;
1783 *key_size = 128;
1784 break;
1785 case MBEDTLS_CIPHER_ARIA_128_CCM:
1786 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1787 *key_type = PSA_KEY_TYPE_ARIA;
1788 *key_size = 128;
1789 break;
1790 case MBEDTLS_CIPHER_ARIA_128_GCM:
1791 *alg = PSA_ALG_GCM;
1792 *key_type = PSA_KEY_TYPE_ARIA;
1793 *key_size = 128;
1794 break;
1795 case MBEDTLS_CIPHER_ARIA_192_CCM:
1796 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1797 *key_type = PSA_KEY_TYPE_ARIA;
1798 *key_size = 192;
1799 break;
1800 case MBEDTLS_CIPHER_ARIA_192_GCM:
1801 *alg = PSA_ALG_GCM;
1802 *key_type = PSA_KEY_TYPE_ARIA;
1803 *key_size = 192;
1804 break;
1805 case MBEDTLS_CIPHER_ARIA_256_CBC:
1806 *alg = PSA_ALG_CBC_NO_PADDING;
1807 *key_type = PSA_KEY_TYPE_ARIA;
1808 *key_size = 256;
1809 break;
1810 case MBEDTLS_CIPHER_ARIA_256_CCM:
1811 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1812 *key_type = PSA_KEY_TYPE_ARIA;
1813 *key_size = 256;
1814 break;
1815 case MBEDTLS_CIPHER_ARIA_256_GCM:
1816 *alg = PSA_ALG_GCM;
1817 *key_type = PSA_KEY_TYPE_ARIA;
1818 *key_size = 256;
1819 break;
1820 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
1821 *alg = PSA_ALG_CBC_NO_PADDING;
1822 *key_type = PSA_KEY_TYPE_CAMELLIA;
1823 *key_size = 128;
1824 break;
1825 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
1826 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1827 *key_type = PSA_KEY_TYPE_CAMELLIA;
1828 *key_size = 128;
1829 break;
1830 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
1831 *alg = PSA_ALG_GCM;
1832 *key_type = PSA_KEY_TYPE_CAMELLIA;
1833 *key_size = 128;
1834 break;
1835 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
1836 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1837 *key_type = PSA_KEY_TYPE_CAMELLIA;
1838 *key_size = 192;
1839 break;
1840 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
1841 *alg = PSA_ALG_GCM;
1842 *key_type = PSA_KEY_TYPE_CAMELLIA;
1843 *key_size = 192;
1844 break;
1845 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
1846 *alg = PSA_ALG_CBC_NO_PADDING;
1847 *key_type = PSA_KEY_TYPE_CAMELLIA;
1848 *key_size = 256;
1849 break;
1850 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
1851 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1852 *key_type = PSA_KEY_TYPE_CAMELLIA;
1853 *key_size = 256;
1854 break;
1855 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
1856 *alg = PSA_ALG_GCM;
1857 *key_type = PSA_KEY_TYPE_CAMELLIA;
1858 *key_size = 256;
1859 break;
1860 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
1861 *alg = PSA_ALG_CHACHA20_POLY1305;
1862 *key_type = PSA_KEY_TYPE_CHACHA20;
1863 *key_size = 256;
1864 break;
1865 case MBEDTLS_CIPHER_NULL:
1866 *alg = MBEDTLS_SSL_NULL_CIPHER;
1867 *key_type = 0;
1868 *key_size = 0;
1869 break;
1870 default:
1871 return PSA_ERROR_NOT_SUPPORTED;
1872 }
1873
1874 return PSA_SUCCESS;
1875}
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001876#endif /* MBEDTLS_USE_PSA_CRYPTO */
1877
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02001878#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckera90658f2017-10-04 15:29:08 +01001879int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
1880 const unsigned char *dhm_P, size_t P_len,
1881 const unsigned char *dhm_G, size_t G_len )
1882{
Janos Follath865b3eb2019-12-16 11:46:15 +00001883 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01001884
Glenn Strausscee11292021-12-20 01:43:17 -05001885 mbedtls_mpi_free( &conf->dhm_P );
1886 mbedtls_mpi_free( &conf->dhm_G );
1887
Hanno Beckera90658f2017-10-04 15:29:08 +01001888 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
1889 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
1890 {
1891 mbedtls_mpi_free( &conf->dhm_P );
1892 mbedtls_mpi_free( &conf->dhm_G );
1893 return( ret );
1894 }
1895
1896 return( 0 );
1897}
Paul Bakker5121ce52009-01-03 21:22:43 +00001898
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001899int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00001900{
Janos Follath865b3eb2019-12-16 11:46:15 +00001901 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00001902
Glenn Strausscee11292021-12-20 01:43:17 -05001903 mbedtls_mpi_free( &conf->dhm_P );
1904 mbedtls_mpi_free( &conf->dhm_G );
1905
Gilles Peskinee5702482021-06-11 21:59:08 +02001906 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
1907 &conf->dhm_P ) ) != 0 ||
1908 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
1909 &conf->dhm_G ) ) != 0 )
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01001910 {
1911 mbedtls_mpi_free( &conf->dhm_P );
1912 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00001913 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01001914 }
Paul Bakker1b57b062011-01-06 15:48:19 +00001915
1916 return( 0 );
1917}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02001918#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00001919
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02001920#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
1921/*
1922 * Set the minimum length for Diffie-Hellman parameters
1923 */
1924void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
1925 unsigned int bitlen )
1926{
1927 conf->dhm_min_bitlen = bitlen;
1928}
1929#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
1930
Gilles Peskineeccd8882020-03-10 12:19:08 +01001931#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08001932#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02001933/*
1934 * Set allowed/preferred hashes for handshake signatures
1935 */
1936void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
1937 const int *hashes )
1938{
1939 conf->sig_hashes = hashes;
1940}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08001941#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01001942
Jerry Yuf017ee42022-01-12 15:49:48 +08001943/* Configure allowed signature algorithms for handshake */
Hanno Becker1cd6e002021-08-10 13:27:10 +01001944void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
1945 const uint16_t* sig_algs )
1946{
Jerry Yuf017ee42022-01-12 15:49:48 +08001947#if !defined(MBEDTLS_DEPRECATED_REMOVED)
1948 conf->sig_hashes = NULL;
1949#endif /* !MBEDTLS_DEPRECATED_REMOVED */
1950 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01001951}
Gilles Peskineeccd8882020-03-10 12:19:08 +01001952#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02001953
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02001954#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01001955#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001956/*
1957 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01001958 *
1959 * mbedtls_ssl_setup() takes the provided list
1960 * and translates it to a list of IANA TLS group identifiers,
1961 * stored in ssl->handshake->group_list.
1962 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001963 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001964void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001965 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001966{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001967 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01001968 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001969}
Brett Warrene0edc842021-08-17 09:53:13 +01001970#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01001971#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01001972
Brett Warrene0edc842021-08-17 09:53:13 +01001973/*
1974 * Set the allowed groups
1975 */
1976void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
1977 const uint16_t *group_list )
1978{
1979#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
1980 conf->curve_list = NULL;
1981#endif
1982 conf->group_list = group_list;
1983}
1984
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001985#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001986int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00001987{
Hanno Becker947194e2017-04-07 13:25:49 +01001988 /* Initialize to suppress unnecessary compiler warning */
1989 size_t hostname_len = 0;
1990
1991 /* Check if new hostname is valid before
1992 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01001993 if( hostname != NULL )
1994 {
1995 hostname_len = strlen( hostname );
1996
1997 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
1998 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1999 }
2000
2001 /* Now it's clear that we will overwrite the old hostname,
2002 * so we can free it safely */
2003
2004 if( ssl->hostname != NULL )
2005 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002006 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01002007 mbedtls_free( ssl->hostname );
2008 }
2009
2010 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01002011
Paul Bakker5121ce52009-01-03 21:22:43 +00002012 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01002013 {
2014 ssl->hostname = NULL;
2015 }
2016 else
2017 {
2018 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01002019 if( ssl->hostname == NULL )
2020 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002021
Hanno Becker947194e2017-04-07 13:25:49 +01002022 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002023
Hanno Becker947194e2017-04-07 13:25:49 +01002024 ssl->hostname[hostname_len] = '\0';
2025 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002026
2027 return( 0 );
2028}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01002029#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002030
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002031#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002032void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002033 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00002034 const unsigned char *, size_t),
2035 void *p_sni )
2036{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002037 conf->f_sni = f_sni;
2038 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00002039}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002040#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00002041
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002042#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002043int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002044{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002045 size_t cur_len, tot_len;
2046 const char **p;
2047
2048 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08002049 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
2050 * MUST NOT be truncated."
2051 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002052 */
2053 tot_len = 0;
2054 for( p = protos; *p != NULL; p++ )
2055 {
2056 cur_len = strlen( *p );
2057 tot_len += cur_len;
2058
Ronald Cron8216dd32020-04-23 16:41:44 +02002059 if( ( cur_len == 0 ) ||
2060 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
2061 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002062 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002063 }
2064
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002065 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002066
2067 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002068}
2069
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002070const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002071{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002072 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002073}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002074#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002075
Johan Pascalb62bb512015-12-03 21:56:45 +01002076#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldoref72faf2018-07-12 11:54:20 +03002077void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
2078 int support_mki_value )
Ron Eldor591f1622018-01-22 12:30:04 +02002079{
2080 conf->dtls_srtp_mki_support = support_mki_value;
2081}
2082
Ron Eldoref72faf2018-07-12 11:54:20 +03002083int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
2084 unsigned char *mki_value,
Johan Pascalf6417ec2020-09-22 15:15:19 +02002085 uint16_t mki_len )
Ron Eldor591f1622018-01-22 12:30:04 +02002086{
Johan Pascal5ef72d22020-10-28 17:05:47 +01002087 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
Ron Eldora9788042018-12-05 11:04:31 +02002088 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002089 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ron Eldora9788042018-12-05 11:04:31 +02002090 }
Ron Eldor591f1622018-01-22 12:30:04 +02002091
2092 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
Ron Eldora9788042018-12-05 11:04:31 +02002093 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002094 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ron Eldora9788042018-12-05 11:04:31 +02002095 }
Ron Eldor591f1622018-01-22 12:30:04 +02002096
2097 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
2098 ssl->dtls_srtp_info.mki_len = mki_len;
Ron Eldora9788042018-12-05 11:04:31 +02002099 return( 0 );
Ron Eldor591f1622018-01-22 12:30:04 +02002100}
2101
Ron Eldoref72faf2018-07-12 11:54:20 +03002102int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
Johan Pascal253d0262020-09-22 13:04:45 +02002103 const mbedtls_ssl_srtp_profile *profiles )
Johan Pascalb62bb512015-12-03 21:56:45 +01002104{
Johan Pascal253d0262020-09-22 13:04:45 +02002105 const mbedtls_ssl_srtp_profile *p;
2106 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002107
Johan Pascal253d0262020-09-22 13:04:45 +02002108 /* check the profiles list: all entry must be valid,
2109 * its size cannot be more than the total number of supported profiles, currently 4 */
Johan Pascald387aa02020-09-23 18:47:56 +02002110 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
2111 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
2112 p++ )
Johan Pascald576fdb2020-09-22 10:39:53 +02002113 {
Johan Pascal5ef72d22020-10-28 17:05:47 +01002114 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
Johan Pascald576fdb2020-09-22 10:39:53 +02002115 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002116 list_size++;
2117 }
2118 else
2119 {
2120 /* unsupported value, stop parsing and set the size to an error value */
2121 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01002122 }
2123 }
2124
Johan Pascal5ef72d22020-10-28 17:05:47 +01002125 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
Johan Pascald387aa02020-09-23 18:47:56 +02002126 {
Johan Pascal253d0262020-09-22 13:04:45 +02002127 conf->dtls_srtp_profile_list = NULL;
2128 conf->dtls_srtp_profile_list_len = 0;
2129 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2130 }
2131
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002132 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02002133 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01002134
2135 return( 0 );
2136}
2137
Johan Pascal5ef72d22020-10-28 17:05:47 +01002138void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
2139 mbedtls_dtls_srtp_info *dtls_srtp_info )
Johan Pascalb62bb512015-12-03 21:56:45 +01002140{
Johan Pascal2258a4f2020-10-28 13:53:09 +01002141 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
2142 /* do not copy the mki value if there is no chosen profile */
Johan Pascal5ef72d22020-10-28 17:05:47 +01002143 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002144 {
Johan Pascal2258a4f2020-10-28 13:53:09 +01002145 dtls_srtp_info->mki_len = 0;
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002146 }
Johan Pascal2258a4f2020-10-28 13:53:09 +01002147 else
2148 {
2149 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Johan Pascal5ef72d22020-10-28 17:05:47 +01002150 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
2151 ssl->dtls_srtp_info.mki_len );
Johan Pascal2258a4f2020-10-28 13:53:09 +01002152 }
Johan Pascalb62bb512015-12-03 21:56:45 +01002153}
Johan Pascalb62bb512015-12-03 21:56:45 +01002154#endif /* MBEDTLS_SSL_DTLS_SRTP */
2155
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002156void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00002157{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002158 conf->max_major_ver = major;
2159 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00002160}
2161
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002162void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00002163{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002164 conf->min_major_ver = major;
2165 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00002166}
2167
Janos Follath088ce432017-04-10 12:42:31 +01002168#if defined(MBEDTLS_SSL_SRV_C)
2169void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
2170 char cert_req_ca_list )
2171{
2172 conf->cert_req_ca_list = cert_req_ca_list;
2173}
2174#endif
2175
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002176#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002177void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002178{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002179 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002180}
2181#endif
2182
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002183#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002184void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002185{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002186 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002187}
2188#endif
2189
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002190#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002191int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002192{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002193 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10002194 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002195 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002196 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002197 }
2198
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01002199 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002200
2201 return( 0 );
2202}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002203#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002204
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002205void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00002206{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002207 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00002208}
2209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002210#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002211void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002212{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002213 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002214}
2215
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002216void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002217{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002218 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002219}
2220
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002221void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002222 const unsigned char period[8] )
2223{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002224 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002225}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002226#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002227
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002228#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002229#if defined(MBEDTLS_SSL_CLI_C)
2230void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002231{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01002232 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002233}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002234#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02002235
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002236#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002237void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
2238 mbedtls_ssl_ticket_write_t *f_ticket_write,
2239 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
2240 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02002241{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002242 conf->f_ticket_write = f_ticket_write;
2243 conf->f_ticket_parse = f_ticket_parse;
2244 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02002245}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002246#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002247#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002248
Hanno Becker7e6c1782021-06-08 09:24:55 +01002249void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
2250 mbedtls_ssl_export_keys_t *f_export_keys,
2251 void *p_export_keys )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002252{
Hanno Becker7e6c1782021-06-08 09:24:55 +01002253 ssl->f_export_keys = f_export_keys;
2254 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03002255}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002256
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002257#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002258void mbedtls_ssl_conf_async_private_cb(
2259 mbedtls_ssl_config *conf,
2260 mbedtls_ssl_async_sign_t *f_async_sign,
2261 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
2262 mbedtls_ssl_async_resume_t *f_async_resume,
2263 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002264 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002265{
2266 conf->f_async_sign_start = f_async_sign;
2267 conf->f_async_decrypt_start = f_async_decrypt;
2268 conf->f_async_resume = f_async_resume;
2269 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002270 conf->p_async_config_data = async_config_data;
2271}
2272
Gilles Peskine8f97af72018-04-26 11:46:10 +02002273void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
2274{
2275 return( conf->p_async_config_data );
2276}
2277
Gilles Peskine1febfef2018-04-30 11:54:39 +02002278void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002279{
2280 if( ssl->handshake == NULL )
2281 return( NULL );
2282 else
2283 return( ssl->handshake->user_async_ctx );
2284}
2285
Gilles Peskine1febfef2018-04-30 11:54:39 +02002286void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002287 void *ctx )
2288{
2289 if( ssl->handshake != NULL )
2290 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002291}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002292#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002293
Paul Bakker5121ce52009-01-03 21:22:43 +00002294/*
2295 * SSL get accessors
2296 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02002297uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002298{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00002299 if( ssl->session != NULL )
2300 return( ssl->session->verify_result );
2301
2302 if( ssl->session_negotiate != NULL )
2303 return( ssl->session_negotiate->verify_result );
2304
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02002305 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00002306}
2307
Glenn Strauss8f526902022-01-13 00:04:49 -05002308int mbedtls_ssl_get_ciphersuite_id_from_ssl( const mbedtls_ssl_context *ssl )
2309{
2310 if( ssl == NULL || ssl->session == NULL )
2311 return( 0 );
2312
2313 return( ssl->session->ciphersuite );
2314}
2315
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002316const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00002317{
Paul Bakker926c8e42013-03-06 10:23:34 +01002318 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002319 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01002320
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002321 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00002322}
2323
Gilles Peskinee1a0c252022-01-13 01:08:03 +01002324mbedtls_ssl_protocol_version mbedtls_ssl_get_version_number(
2325 const mbedtls_ssl_context *ssl )
2326{
2327 /* For major_ver, only 3 is supported, so skip checking it. */
2328 switch( ssl->minor_ver )
2329 {
2330 case MBEDTLS_SSL_MINOR_VERSION_3:
2331 return( MBEDTLS_SSL_VERSION_1_2 );
2332 case MBEDTLS_SSL_MINOR_VERSION_4:
2333 return( MBEDTLS_SSL_VERSION_1_3 );
2334 default:
2335 return( MBEDTLS_SSL_VERSION_UNKNOWN );
2336 }
2337}
2338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002339const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00002340{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002341#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002342 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002343 {
2344 switch( ssl->minor_ver )
2345 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002346 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002347 return( "DTLSv1.2" );
2348
2349 default:
2350 return( "unknown (DTLS)" );
2351 }
2352 }
2353#endif
2354
Paul Bakker43ca69c2011-01-15 17:35:19 +00002355 switch( ssl->minor_ver )
2356 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002357 case MBEDTLS_SSL_MINOR_VERSION_3:
Paul Bakker1ef83d62012-04-11 12:09:53 +00002358 return( "TLSv1.2" );
Gilles Peskinec63a1e02022-01-13 01:10:24 +01002359 case MBEDTLS_SSL_MINOR_VERSION_4:
2360 return( "TLSv1.3" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002361 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002362 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002363 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00002364}
2365
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002366#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002367size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
2368{
David Horstmann95d516f2021-05-04 18:36:56 +01002369 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002370 size_t read_mfl;
2371
2372 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
2373 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2374 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
2375 {
2376 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
2377 }
2378
2379 /* Check if a smaller max length was negotiated */
2380 if( ssl->session_out != NULL )
2381 {
2382 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
2383 if( read_mfl < max_len )
2384 {
2385 max_len = read_mfl;
2386 }
2387 }
2388
2389 // During a handshake, use the value being negotiated
2390 if( ssl->session_negotiate != NULL )
2391 {
2392 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2393 if( read_mfl < max_len )
2394 {
2395 max_len = read_mfl;
2396 }
2397 }
2398
2399 return( max_len );
2400}
2401
2402size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002403{
2404 size_t max_len;
2405
2406 /*
2407 * Assume mfl_code is correct since it was checked when set
2408 */
Angus Grattond8213d02016-05-25 20:56:48 +10002409 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002410
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002411 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002412 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10002413 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002414 {
Angus Grattond8213d02016-05-25 20:56:48 +10002415 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002416 }
2417
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002418 /* During a handshake, use the value being negotiated */
2419 if( ssl->session_negotiate != NULL &&
2420 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
2421 {
2422 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2423 }
2424
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002425 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002426}
2427#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2428
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002429#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002430size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002431{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04002432 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
2433 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2434 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
2435 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
2436 return ( 0 );
2437
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002438 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
2439 return( ssl->mtu );
2440
2441 if( ssl->mtu == 0 )
2442 return( ssl->handshake->mtu );
2443
2444 return( ssl->mtu < ssl->handshake->mtu ?
2445 ssl->mtu : ssl->handshake->mtu );
2446}
2447#endif /* MBEDTLS_SSL_PROTO_DTLS */
2448
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002449int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
2450{
2451 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
2452
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02002453#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2454 !defined(MBEDTLS_SSL_PROTO_DTLS)
2455 (void) ssl;
2456#endif
2457
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002458#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002459 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002460
2461 if( max_len > mfl )
2462 max_len = mfl;
2463#endif
2464
2465#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002466 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002467 {
Hanno Becker89490712020-02-05 10:50:12 +00002468 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002469 const int ret = mbedtls_ssl_get_record_expansion( ssl );
2470 const size_t overhead = (size_t) ret;
2471
2472 if( ret < 0 )
2473 return( ret );
2474
2475 if( mtu <= overhead )
2476 {
2477 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
2478 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2479 }
2480
2481 if( max_len > mtu - overhead )
2482 max_len = mtu - overhead;
2483 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002484#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002485
Hanno Becker0defedb2018-08-10 12:35:02 +01002486#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2487 !defined(MBEDTLS_SSL_PROTO_DTLS)
2488 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002489#endif
2490
2491 return( (int) max_len );
2492}
2493
Hanno Becker2d8e99b2021-04-21 06:19:50 +01002494int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
2495{
2496 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
2497
2498#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2499 (void) ssl;
2500#endif
2501
2502#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2503 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
2504
2505 if( max_len > mfl )
2506 max_len = mfl;
2507#endif
2508
2509 return( (int) max_len );
2510}
2511
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002512#if defined(MBEDTLS_X509_CRT_PARSE_C)
2513const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00002514{
2515 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002516 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00002517
Hanno Beckere6824572019-02-07 13:18:46 +00002518#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002519 return( ssl->session->peer_cert );
Hanno Beckere6824572019-02-07 13:18:46 +00002520#else
2521 return( NULL );
2522#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002523}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002524#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002525
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002526#if defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerf852b1c2019-02-05 11:42:30 +00002527int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
2528 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002529{
Hanno Beckere810bbc2021-05-14 16:01:05 +01002530 int ret;
2531
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002532 if( ssl == NULL ||
2533 dst == NULL ||
2534 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002535 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002536 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002537 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002538 }
2539
Hanno Beckere810bbc2021-05-14 16:01:05 +01002540 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
2541 * idempotent: Each session can only be exported once.
2542 *
2543 * (This is in preparation for TLS 1.3 support where we will
2544 * need the ability to export multiple sessions (aka tickets),
2545 * which will be achieved by calling mbedtls_ssl_get_session()
2546 * multiple times until it fails.)
2547 *
2548 * Check whether we have already exported the current session,
2549 * and fail if so.
2550 */
2551 if( ssl->session->exported == 1 )
2552 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2553
2554 ret = mbedtls_ssl_session_copy( dst, ssl->session );
2555 if( ret != 0 )
2556 return( ret );
2557
2558 /* Remember that we've exported the session. */
2559 ssl->session->exported = 1;
2560 return( 0 );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002561}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002562#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002563
Paul Bakker5121ce52009-01-03 21:22:43 +00002564/*
Hanno Beckera835da52019-05-16 12:39:07 +01002565 * Define ticket header determining Mbed TLS version
2566 * and structure of the ticket.
2567 */
2568
Hanno Becker94ef3b32019-05-16 12:50:45 +01002569/*
Hanno Becker50b59662019-05-28 14:30:45 +01002570 * Define bitflag determining compile-time settings influencing
2571 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01002572 */
2573
Hanno Becker50b59662019-05-28 14:30:45 +01002574#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01002575#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01002576#else
Hanno Becker3e088662019-05-29 11:10:18 +01002577#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002578#endif /* MBEDTLS_HAVE_TIME */
2579
2580#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01002581#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002582#else
Hanno Becker3e088662019-05-29 11:10:18 +01002583#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002584#endif /* MBEDTLS_X509_CRT_PARSE_C */
2585
2586#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01002587#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002588#else
Hanno Becker3e088662019-05-29 11:10:18 +01002589#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002590#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
2591
2592#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01002593#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002594#else
Hanno Becker3e088662019-05-29 11:10:18 +01002595#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002596#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2597
Hanno Becker94ef3b32019-05-16 12:50:45 +01002598#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01002599#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002600#else
Hanno Becker3e088662019-05-29 11:10:18 +01002601#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002602#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
2603
Hanno Becker94ef3b32019-05-16 12:50:45 +01002604#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2605#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
2606#else
2607#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
2608#endif /* MBEDTLS_SSL_SESSION_TICKETS */
2609
Hanno Becker3e088662019-05-29 11:10:18 +01002610#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
2611#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
2612#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
2613#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01002614#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
2615#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01002616
Hanno Becker50b59662019-05-28 14:30:45 +01002617#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Becker3e088662019-05-29 11:10:18 +01002618 ( (uint16_t) ( \
2619 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
2620 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
2621 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
2622 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
Hanno Becker3e088662019-05-29 11:10:18 +01002623 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Beckerbe34e8e2019-06-04 09:43:16 +01002624 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
Hanno Becker94ef3b32019-05-16 12:50:45 +01002625
Hanno Beckerf8787072019-05-16 12:41:07 +01002626static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01002627 MBEDTLS_VERSION_MAJOR,
2628 MBEDTLS_VERSION_MINOR,
2629 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01002630 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
2631 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
Hanno Beckerf8787072019-05-16 12:41:07 +01002632};
Hanno Beckera835da52019-05-16 12:39:07 +01002633
2634/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002635 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02002636 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002637 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002638 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01002639 *
Hanno Beckerdce50972021-08-01 05:39:23 +01002640 * opaque mbedtls_version[3]; // library version: major, minor, patch
2641 * opaque session_format[2]; // library-version specific 16-bit field
2642 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002643 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01002644 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002645 * Note: When updating the format, remember to keep
2646 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002647 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002648 * // In this version, `session_format` determines
2649 * // the setting of those compile-time
2650 * // configuration options which influence
2651 * // the structure of mbedtls_ssl_session.
2652 *
Hanno Beckerfa0d61e2021-08-02 08:56:14 +01002653 * uint8_t minor_ver; // Protocol-version. Possible values:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002654 * // - TLS 1.2 (MBEDTLS_SSL_MINOR_VERSION_3)
2655 *
2656 * select (serialized_session.minor_ver) {
2657 *
2658 * case MBEDTLS_SSL_MINOR_VERSION_3: // TLS 1.2
2659 * serialized_session_tls12 data;
2660 *
2661 * };
2662 *
2663 * } serialized_session;
2664 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002665 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002666
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002667static int ssl_session_save( const mbedtls_ssl_session *session,
2668 unsigned char omit_header,
2669 unsigned char *buf,
2670 size_t buf_len,
2671 size_t *olen )
2672{
2673 unsigned char *p = buf;
2674 size_t used = 0;
2675
2676 if( !omit_header )
2677 {
2678 /*
2679 * Add Mbed TLS version identifier
2680 */
2681
2682 used += sizeof( ssl_serialized_session_header );
2683
2684 if( used <= buf_len )
2685 {
2686 memcpy( p, ssl_serialized_session_header,
2687 sizeof( ssl_serialized_session_header ) );
2688 p += sizeof( ssl_serialized_session_header );
2689 }
2690 }
2691
2692 /*
2693 * TLS version identifier
2694 */
2695 used += 1;
2696 if( used <= buf_len )
2697 {
2698 *p++ = session->minor_ver;
2699 }
2700
2701 /* Forward to version-specific serialization routine. */
2702 switch( session->minor_ver )
2703 {
2704#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2705 case MBEDTLS_SSL_MINOR_VERSION_3:
2706 {
2707 size_t remaining_len = used <= buf_len ? buf_len - used : 0;
2708 used += ssl_session_save_tls12( session, p, remaining_len );
2709 break;
2710 }
2711#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2712
2713 default:
2714 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2715 }
2716
2717 *olen = used;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02002718 if( used > buf_len )
2719 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002720
2721 return( 0 );
2722}
2723
2724/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02002725 * Public wrapper for ssl_session_save()
2726 */
2727int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
2728 unsigned char *buf,
2729 size_t buf_len,
2730 size_t *olen )
2731{
2732 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
2733}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002734
Jerry Yuf1b23ca2022-02-18 11:48:47 +08002735/*
2736 * Deserialize session, see mbedtls_ssl_session_save() for format.
2737 *
2738 * This internal version is wrapped by a public function that cleans up in
2739 * case of error, and has an extra option omit_header.
2740 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002741static int ssl_session_load( mbedtls_ssl_session *session,
2742 unsigned char omit_header,
2743 const unsigned char *buf,
2744 size_t len )
2745{
2746 const unsigned char *p = buf;
2747 const unsigned char * const end = buf + len;
2748
2749 if( !omit_header )
2750 {
2751 /*
2752 * Check Mbed TLS version identifier
2753 */
2754
2755 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
2756 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2757
2758 if( memcmp( p, ssl_serialized_session_header,
2759 sizeof( ssl_serialized_session_header ) ) != 0 )
2760 {
2761 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
2762 }
2763 p += sizeof( ssl_serialized_session_header );
2764 }
2765
2766 /*
2767 * TLS version identifier
2768 */
2769 if( 1 > (size_t)( end - p ) )
2770 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2771 session->minor_ver = *p++;
2772
2773 /* Dispatch according to TLS version. */
2774 switch( session->minor_ver )
2775 {
2776#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2777 case MBEDTLS_SSL_MINOR_VERSION_3: /* TLS 1.2 */
2778 {
2779 size_t remaining_len = ( end - p );
2780 return( ssl_session_load_tls12( session, p, remaining_len ) );
2781 }
2782#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2783
2784 default:
2785 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2786 }
2787}
2788
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002789/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02002790 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02002791 */
2792int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
2793 const unsigned char *buf,
2794 size_t len )
2795{
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02002796 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02002797
2798 if( ret != 0 )
2799 mbedtls_ssl_session_free( session );
2800
2801 return( ret );
2802}
2803
2804/*
Paul Bakker1961b702013-01-25 14:49:24 +01002805 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00002806 */
Hanno Becker41934dd2021-08-07 19:13:43 +01002807static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
2808{
2809 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2810
Ronald Cron66dbf912022-02-02 15:33:46 +01002811 /*
2812 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01002813 * that were written into the output buffer by the previous handshake step,
2814 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01002815 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
2816 * We proceed to the next handshake step only when all data from the
2817 * previous one have been sent to the peer, thus we make sure that this is
2818 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
2819 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
2820 * we have to wait before to go ahead.
2821 * In the case of TLS 1.3, handshake step handlers do not send data to the
2822 * peer. Data are only sent here and through
2823 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
2824 * alert occured.
2825 */
Hanno Becker41934dd2021-08-07 19:13:43 +01002826 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
2827 return( ret );
2828
2829#if defined(MBEDTLS_SSL_PROTO_DTLS)
2830 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2831 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
2832 {
2833 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2834 return( ret );
2835 }
2836#endif /* MBEDTLS_SSL_PROTO_DTLS */
2837
2838 return( ret );
2839}
2840
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002841int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002842{
Hanno Becker41934dd2021-08-07 19:13:43 +01002843 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00002844
Hanno Becker41934dd2021-08-07 19:13:43 +01002845 if( ssl == NULL ||
2846 ssl->conf == NULL ||
2847 ssl->handshake == NULL ||
Paul Elliott27b0d942022-03-18 21:55:32 +00002848 mbedtls_ssl_is_handshake_over( ssl ) == 1 )
Hanno Becker41934dd2021-08-07 19:13:43 +01002849 {
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02002850 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker41934dd2021-08-07 19:13:43 +01002851 }
2852
2853 ret = ssl_prepare_handshake_step( ssl );
2854 if( ret != 0 )
2855 return( ret );
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02002856
Jerry Yue7047812021-09-13 19:26:39 +08002857 ret = mbedtls_ssl_handle_pending_alert( ssl );
2858 if( ret != 0 )
2859 goto cleanup;
2860
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002861#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002862 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Jerry Yub9930e72021-08-06 17:11:51 +08002863 {
Ronald Cron27c85e72022-03-08 11:37:55 +01002864 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %s",
2865 mbedtls_ssl_states_str( ssl->state ) ) );
Jerry Yub9930e72021-08-06 17:11:51 +08002866
Ronald Cron9f0fba32022-02-10 16:45:15 +01002867 switch( ssl->state )
2868 {
2869 case MBEDTLS_SSL_HELLO_REQUEST:
2870 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
2871 break;
Jerry Yub9930e72021-08-06 17:11:51 +08002872
Ronald Cron9f0fba32022-02-10 16:45:15 +01002873 case MBEDTLS_SSL_CLIENT_HELLO:
2874 ret = mbedtls_ssl_write_client_hello( ssl );
2875 break;
2876
2877 default:
2878#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
2879 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
2880 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
2881 else
2882 ret = mbedtls_ssl_handshake_client_step( ssl );
2883#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
2884 ret = mbedtls_ssl_handshake_client_step( ssl );
2885#else
2886 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
2887#endif
2888 }
Jerry Yub9930e72021-08-06 17:11:51 +08002889 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002890#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002891#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002892 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Jerry Yub9930e72021-08-06 17:11:51 +08002893 {
Ronald Cron6f135e12021-12-08 16:57:54 +01002894#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yub9930e72021-08-06 17:11:51 +08002895 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yu27561932021-08-27 17:07:38 +08002896 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
Ronald Cron6f135e12021-12-08 16:57:54 +01002897#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08002898
2899#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2900 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
2901 ret = mbedtls_ssl_handshake_server_step( ssl );
2902#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2903 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002904#endif
2905
Jerry Yue7047812021-09-13 19:26:39 +08002906 if( ret != 0 )
2907 {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08002908 /* handshake_step return error. And it is same
2909 * with alert_reason.
2910 */
Jerry Yu3bf1f972021-09-22 21:37:18 +08002911 if( ssl->send_alert )
Jerry Yue7047812021-09-13 19:26:39 +08002912 {
Jerry Yu3bf1f972021-09-22 21:37:18 +08002913 ret = mbedtls_ssl_handle_pending_alert( ssl );
Jerry Yue7047812021-09-13 19:26:39 +08002914 goto cleanup;
2915 }
2916 }
2917
2918cleanup:
Paul Bakker1961b702013-01-25 14:49:24 +01002919 return( ret );
2920}
2921
2922/*
2923 * Perform the SSL handshake
2924 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002925int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01002926{
2927 int ret = 0;
2928
Hanno Beckera817ea42020-10-20 15:20:23 +01002929 /* Sanity checks */
2930
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02002931 if( ssl == NULL || ssl->conf == NULL )
2932 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2933
Hanno Beckera817ea42020-10-20 15:20:23 +01002934#if defined(MBEDTLS_SSL_PROTO_DTLS)
2935 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2936 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
2937 {
2938 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
2939 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
2940 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2941 }
2942#endif /* MBEDTLS_SSL_PROTO_DTLS */
2943
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002944 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01002945
Hanno Beckera817ea42020-10-20 15:20:23 +01002946 /* Main handshake loop */
Paul Elliott27b0d942022-03-18 21:55:32 +00002947 while( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01002948 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002949 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01002950
2951 if( ret != 0 )
2952 break;
2953 }
2954
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002955 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002956
2957 return( ret );
2958}
2959
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002960#if defined(MBEDTLS_SSL_RENEGOTIATION)
2961#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00002962/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002963 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00002964 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002965static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002966{
Janos Follath865b3eb2019-12-16 11:46:15 +00002967 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002968
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002969 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002970
2971 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002972 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2973 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002974
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002975 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002976 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002977 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002978 return( ret );
2979 }
2980
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002981 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002982
2983 return( 0 );
2984}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002985#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002986
2987/*
2988 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002989 * - any side: calling mbedtls_ssl_renegotiate(),
2990 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
2991 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02002992 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01002993 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002994 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01002995 */
Hanno Becker40cdaa12020-02-05 10:48:27 +00002996int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00002997{
Janos Follath865b3eb2019-12-16 11:46:15 +00002998 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00002999
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003000 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003001
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003002 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3003 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003004
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003005 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
3006 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003007#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003008 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003009 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003010 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003011 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003012 ssl->handshake->out_msg_seq = 1;
3013 else
3014 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003015 }
3016#endif
3017
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003018 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3019 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00003020
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003021 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00003022 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003023 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003024 return( ret );
3025 }
3026
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003027 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003028
3029 return( 0 );
3030}
3031
3032/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003033 * Renegotiate current connection on client,
3034 * or request renegotiation on server
3035 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003036int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003037{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003038 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003039
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003040 if( ssl == NULL || ssl->conf == NULL )
3041 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3042
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003043#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003044 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003045 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003046 {
Paul Elliott27b0d942022-03-18 21:55:32 +00003047 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003048 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003049
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003050 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003051
3052 /* Did we already try/start sending HelloRequest? */
3053 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003054 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003055
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003056 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003057 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003058#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003059
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003060#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003061 /*
3062 * On client, either start the renegotiation process or,
3063 * if already in progress, continue the handshake
3064 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003065 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003066 {
Paul Elliott27b0d942022-03-18 21:55:32 +00003067 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003068 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003069
Hanno Becker40cdaa12020-02-05 10:48:27 +00003070 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003071 {
Hanno Becker40cdaa12020-02-05 10:48:27 +00003072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003073 return( ret );
3074 }
3075 }
3076 else
3077 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003078 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003079 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003080 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003081 return( ret );
3082 }
3083 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003084#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003085
Paul Bakker37ce0ff2013-10-31 14:32:04 +01003086 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003087}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003088#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003089
Gilles Peskine9b562d52018-04-25 20:32:43 +02003090void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003091{
Gilles Peskine9b562d52018-04-25 20:32:43 +02003092 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3093
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003094 if( handshake == NULL )
3095 return;
3096
Brett Warrene0edc842021-08-17 09:53:13 +01003097#if defined(MBEDTLS_ECP_C)
3098#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3099 if ( ssl->handshake->group_list_heap_allocated )
3100 mbedtls_free( (void*) handshake->group_list );
3101 handshake->group_list = NULL;
3102#endif /* MBEDTLS_DEPRECATED_REMOVED */
3103#endif /* MBEDTLS_ECP_C */
3104
Jerry Yuf017ee42022-01-12 15:49:48 +08003105#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3106#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3107 if ( ssl->handshake->sig_algs_heap_allocated )
3108 mbedtls_free( (void*) handshake->sig_algs );
3109 handshake->sig_algs = NULL;
3110#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00003111#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3112 if( ssl->handshake->certificate_request_context )
3113 {
3114 mbedtls_free( (void*) handshake->certificate_request_context );
3115 }
3116#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuf017ee42022-01-12 15:49:48 +08003117#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
3118
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003119#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3120 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
3121 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003122 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003123 handshake->async_in_progress = 0;
3124 }
3125#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3126
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003127#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003128#if defined(MBEDTLS_USE_PSA_CRYPTO)
3129 psa_hash_abort( &handshake->fin_sha256_psa );
3130#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003131 mbedtls_sha256_free( &handshake->fin_sha256 );
3132#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003133#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02003134#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003135#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05003136 psa_hash_abort( &handshake->fin_sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05003137#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003138 mbedtls_sha512_free( &handshake->fin_sha512 );
3139#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003140#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003141
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003142#if defined(MBEDTLS_DHM_C)
3143 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00003144#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003145#if defined(MBEDTLS_ECDH_C)
3146 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02003147#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003148#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003149 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02003150#if defined(MBEDTLS_SSL_CLI_C)
3151 mbedtls_free( handshake->ecjpake_cache );
3152 handshake->ecjpake_cache = NULL;
3153 handshake->ecjpake_cache_len = 0;
3154#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003155#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02003156
Janos Follath4ae5c292016-02-10 11:27:43 +00003157#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
3158 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02003159 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003160 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02003161#endif
3162
Gilles Peskineeccd8882020-03-10 12:19:08 +01003163#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003164 if( handshake->psk != NULL )
3165 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003166 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003167 mbedtls_free( handshake->psk );
3168 }
3169#endif
3170
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003171#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3172 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02003173 /*
3174 * Free only the linked list wrapper, not the keys themselves
3175 * since the belong to the SNI callback
3176 */
Glenn Strauss36872db2022-01-22 05:06:31 -05003177 ssl_key_cert_free( handshake->sni_key_cert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003178#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02003179
Gilles Peskineeccd8882020-03-10 12:19:08 +01003180#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02003181 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Becker3dad3112019-02-05 17:19:52 +00003182 if( handshake->ecrs_peer_cert != NULL )
3183 {
3184 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
3185 mbedtls_free( handshake->ecrs_peer_cert );
3186 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02003187#endif
3188
Hanno Becker75173122019-02-06 16:18:31 +00003189#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3190 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3191 mbedtls_pk_free( &handshake->peer_pubkey );
3192#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3193
XiaokangQian9b93c0d2022-02-09 06:02:25 +00003194#if defined(MBEDTLS_SSL_CLI_C) && \
3195 ( defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
3196 mbedtls_free( handshake->cookie );
3197#endif /* MBEDTLS_SSL_CLI_C &&
3198 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00003199
3200#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker533ab5f2020-02-05 10:49:13 +00003201 mbedtls_ssl_flight_free( handshake->flight );
3202 mbedtls_ssl_buffering_free( ssl );
XiaokangQian8499b6c2022-01-27 09:00:11 +00003203#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02003204
Ronald Cronf12b81d2022-03-15 10:42:41 +01003205#if defined(MBEDTLS_ECDH_C) && \
3206 ( defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
Neil Armstrongf716a702022-04-04 11:23:46 +02003207 if( handshake->ecdh_psa_privkey_is_external == 0 )
Neil Armstrong8113d252022-03-23 10:57:04 +01003208 psa_destroy_key( handshake->ecdh_psa_privkey );
Hanno Becker4a63ed42019-01-08 11:39:35 +00003209#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
3210
Ronald Cron6f135e12021-12-08 16:57:54 +01003211#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yua1a568c2021-11-09 10:17:21 +08003212 mbedtls_ssl_transform_free( handshake->transform_handshake );
3213 mbedtls_ssl_transform_free( handshake->transform_earlydata );
Jerry Yuba9c7272021-10-30 11:54:10 +08003214 mbedtls_free( handshake->transform_earlydata );
3215 mbedtls_free( handshake->transform_handshake );
Ronald Cron6f135e12021-12-08 16:57:54 +01003216#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08003217
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003218
3219#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3220 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
3221 * processes datagrams and the fact that a datagram is allowed to have
3222 * several records in it, it is possible that the I/O buffers are not
3223 * empty at this stage */
Andrzej Kurek4a063792020-10-21 15:08:44 +02003224 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
3225 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003226#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01003227
Jerry Yuba9c7272021-10-30 11:54:10 +08003228 /* mbedtls_platform_zeroize MUST be last one in this function */
3229 mbedtls_platform_zeroize( handshake,
3230 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003231}
3232
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003233void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00003234{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003235 if( session == NULL )
3236 return;
3237
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003238#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker1294a0b2019-02-05 12:38:15 +00003239 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +02003240#endif
Paul Bakker0a597072012-09-25 21:55:46 +00003241
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003242#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003243 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02003244#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02003245
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003246 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003247}
3248
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02003249#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003250
3251#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3252#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
3253#else
3254#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
3255#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3256
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003257#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003258
3259#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3260#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
3261#else
3262#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
3263#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3264
3265#if defined(MBEDTLS_SSL_ALPN)
3266#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
3267#else
3268#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
3269#endif /* MBEDTLS_SSL_ALPN */
3270
3271#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
3272#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
3273#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
3274#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
3275
3276#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
3277 ( (uint32_t) ( \
3278 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
3279 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
3280 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
3281 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
3282 0u ) )
3283
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003284static unsigned char ssl_serialized_context_header[] = {
3285 MBEDTLS_VERSION_MAJOR,
3286 MBEDTLS_VERSION_MINOR,
3287 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01003288 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3289 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3290 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3291 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3292 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003293};
3294
Paul Bakker5121ce52009-01-03 21:22:43 +00003295/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003296 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003297 *
3298 * The format of the serialized data is:
3299 * (in the presentation language of TLS, RFC 8446 section 3)
3300 *
3301 * // header
3302 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003303 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003304 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003305 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003306 * Note: When updating the format, remember to keep these
3307 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003308 *
3309 * // session sub-structure
3310 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
3311 * // transform sub-structure
3312 * uint8 random[64]; // ServerHello.random+ClientHello.random
3313 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
3314 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
3315 * // fields from ssl_context
3316 * uint32 badmac_seen; // DTLS: number of records with failing MAC
3317 * uint64 in_window_top; // DTLS: last validated record seq_num
3318 * uint64 in_window; // DTLS: bitmask for replay protection
3319 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
3320 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
3321 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
3322 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
3323 *
3324 * Note that many fields of the ssl_context or sub-structures are not
3325 * serialized, as they fall in one of the following categories:
3326 *
3327 * 1. forced value (eg in_left must be 0)
3328 * 2. pointer to dynamically-allocated memory (eg session, transform)
3329 * 3. value can be re-derived from other data (eg session keys from MS)
3330 * 4. value was temporary (eg content of input buffer)
3331 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003332 */
3333int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
3334 unsigned char *buf,
3335 size_t buf_len,
3336 size_t *olen )
3337{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003338 unsigned char *p = buf;
3339 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003340 size_t session_len;
3341 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003342
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003343 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003344 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
3345 * this function's documentation.
3346 *
3347 * These are due to assumptions/limitations in the implementation. Some of
3348 * them are likely to stay (no handshake in progress) some might go away
3349 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003350 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003351 /* The initial handshake must be over */
Paul Elliott27b0d942022-03-18 21:55:32 +00003352 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003353 {
3354 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003355 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003356 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003357 if( ssl->handshake != NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003358 {
3359 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003360 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003361 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003362 /* Double-check that sub-structures are indeed ready */
3363 if( ssl->transform == NULL || ssl->session == NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003364 {
3365 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003366 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003367 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003368 /* There must be no pending incoming or outgoing data */
3369 if( mbedtls_ssl_check_pending( ssl ) != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003370 {
3371 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003372 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003373 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003374 if( ssl->out_left != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003375 {
3376 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003377 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003378 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003379 /* Protocol must be DLTS, not TLS */
3380 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003381 {
3382 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003383 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003384 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003385 /* Version must be 1.2 */
3386 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003387 {
3388 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003389 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003390 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003391 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003392 {
3393 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003394 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003395 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003396 /* We must be using an AEAD ciphersuite */
3397 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003398 {
3399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003400 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003401 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003402 /* Renegotiation must not be enabled */
3403#if defined(MBEDTLS_SSL_RENEGOTIATION)
3404 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003405 {
3406 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003407 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003408 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003409#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003410
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003411 /*
3412 * Version and format identifier
3413 */
3414 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003415
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003416 if( used <= buf_len )
3417 {
3418 memcpy( p, ssl_serialized_context_header,
3419 sizeof( ssl_serialized_context_header ) );
3420 p += sizeof( ssl_serialized_context_header );
3421 }
3422
3423 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003424 * Session (length + data)
3425 */
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003426 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003427 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
3428 return( ret );
3429
3430 used += 4 + session_len;
3431 if( used <= buf_len )
3432 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003433 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
3434 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003435
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003436 ret = ssl_session_save( ssl->session, 1,
3437 p, session_len, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003438 if( ret != 0 )
3439 return( ret );
3440
3441 p += session_len;
3442 }
3443
3444 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003445 * Transform
3446 */
3447 used += sizeof( ssl->transform->randbytes );
3448 if( used <= buf_len )
3449 {
3450 memcpy( p, ssl->transform->randbytes,
3451 sizeof( ssl->transform->randbytes ) );
3452 p += sizeof( ssl->transform->randbytes );
3453 }
3454
3455#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3456 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
3457 if( used <= buf_len )
3458 {
3459 *p++ = ssl->transform->in_cid_len;
3460 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
3461 p += ssl->transform->in_cid_len;
3462
3463 *p++ = ssl->transform->out_cid_len;
3464 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
3465 p += ssl->transform->out_cid_len;
3466 }
3467#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3468
3469 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003470 * Saved fields from top-level ssl_context structure
3471 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003472 used += 4;
3473 if( used <= buf_len )
3474 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003475 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
3476 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003477 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003478
3479#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3480 used += 16;
3481 if( used <= buf_len )
3482 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003483 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
3484 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003485
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003486 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
3487 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003488 }
3489#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3490
3491#if defined(MBEDTLS_SSL_PROTO_DTLS)
3492 used += 1;
3493 if( used <= buf_len )
3494 {
3495 *p++ = ssl->disable_datagram_packing;
3496 }
3497#endif /* MBEDTLS_SSL_PROTO_DTLS */
3498
Jerry Yuae0b2e22021-10-08 15:21:19 +08003499 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003500 if( used <= buf_len )
3501 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08003502 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
3503 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003504 }
3505
3506#if defined(MBEDTLS_SSL_PROTO_DTLS)
3507 used += 2;
3508 if( used <= buf_len )
3509 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003510 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
3511 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003512 }
3513#endif /* MBEDTLS_SSL_PROTO_DTLS */
3514
3515#if defined(MBEDTLS_SSL_ALPN)
3516 {
3517 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnardf041f4e2019-07-24 00:58:27 +02003518 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003519 : 0;
3520
3521 used += 1 + alpn_len;
3522 if( used <= buf_len )
3523 {
3524 *p++ = alpn_len;
3525
3526 if( ssl->alpn_chosen != NULL )
3527 {
3528 memcpy( p, ssl->alpn_chosen, alpn_len );
3529 p += alpn_len;
3530 }
3531 }
3532 }
3533#endif /* MBEDTLS_SSL_ALPN */
3534
3535 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003536 * Done
3537 */
3538 *olen = used;
3539
3540 if( used > buf_len )
3541 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003542
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003543 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
3544
Hanno Becker43aefe22020-02-05 10:44:56 +00003545 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003546}
3547
3548/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003549 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003550 *
3551 * This internal version is wrapped by a public function that cleans up in
3552 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003553 */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003554static int ssl_context_load( mbedtls_ssl_context *ssl,
3555 const unsigned char *buf,
3556 size_t len )
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003557{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003558 const unsigned char *p = buf;
3559 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003560 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00003561 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003562
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003563 /*
3564 * The context should have been freshly setup or reset.
3565 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02003566 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003567 * renegotiating, or if the user mistakenly loaded a session first.)
3568 */
3569 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
3570 ssl->session != NULL )
3571 {
3572 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3573 }
3574
3575 /*
3576 * We can't check that the config matches the initial one, but we can at
3577 * least check it matches the requirements for serializing.
3578 */
3579 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
3580 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
3581 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 ||
3582 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ||
3583 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 ||
3584#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02003585 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003586#endif
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02003587 0 )
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003588 {
3589 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3590 }
3591
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003592 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
3593
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003594 /*
3595 * Check version identifier
3596 */
3597 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
3598 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3599
3600 if( memcmp( p, ssl_serialized_context_header,
3601 sizeof( ssl_serialized_context_header ) ) != 0 )
3602 {
3603 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
3604 }
3605 p += sizeof( ssl_serialized_context_header );
3606
3607 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003608 * Session
3609 */
3610 if( (size_t)( end - p ) < 4 )
3611 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3612
3613 session_len = ( (size_t) p[0] << 24 ) |
3614 ( (size_t) p[1] << 16 ) |
3615 ( (size_t) p[2] << 8 ) |
3616 ( (size_t) p[3] );
3617 p += 4;
3618
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003619 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00003620 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003621 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003622 ssl->session_in = ssl->session;
3623 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003624 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003625
3626 if( (size_t)( end - p ) < session_len )
3627 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3628
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003629 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003630 if( ret != 0 )
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003631 {
3632 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003633 return( ret );
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003634 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003635
3636 p += session_len;
3637
3638 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003639 * Transform
3640 */
3641
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003642 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00003643 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003644 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003645 ssl->transform_in = ssl->transform;
3646 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003647 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003648
3649 /* Read random bytes and populate structure */
3650 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
3651 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yu840fbb22022-02-17 14:59:29 +08003652#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerbd257552021-03-22 06:59:27 +00003653 ret = ssl_tls12_populate_transform( ssl->transform,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003654 ssl->session->ciphersuite,
3655 ssl->session->master,
Hanno Beckerbd257552021-03-22 06:59:27 +00003656#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
3657 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003658 ssl->session->encrypt_then_mac,
Hanno Beckerbd257552021-03-22 06:59:27 +00003659#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
3660 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003661 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
3662 p, /* currently pointing to randbytes */
3663 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
3664 ssl->conf->endpoint,
3665 ssl );
3666 if( ret != 0 )
3667 return( ret );
Jerry Yu840fbb22022-02-17 14:59:29 +08003668#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003669 p += sizeof( ssl->transform->randbytes );
3670
3671#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3672 /* Read connection IDs and store them */
3673 if( (size_t)( end - p ) < 1 )
3674 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3675
3676 ssl->transform->in_cid_len = *p++;
3677
Manuel Pégourié-Gonnard5ea13b82019-07-23 15:02:54 +02003678 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003679 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3680
3681 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
3682 p += ssl->transform->in_cid_len;
3683
3684 ssl->transform->out_cid_len = *p++;
3685
3686 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
3687 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3688
3689 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
3690 p += ssl->transform->out_cid_len;
3691#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3692
3693 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003694 * Saved fields from top-level ssl_context structure
3695 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003696 if( (size_t)( end - p ) < 4 )
3697 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3698
3699 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
3700 ( (uint32_t) p[1] << 16 ) |
3701 ( (uint32_t) p[2] << 8 ) |
3702 ( (uint32_t) p[3] );
3703 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003704
3705#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3706 if( (size_t)( end - p ) < 16 )
3707 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3708
3709 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
3710 ( (uint64_t) p[1] << 48 ) |
3711 ( (uint64_t) p[2] << 40 ) |
3712 ( (uint64_t) p[3] << 32 ) |
3713 ( (uint64_t) p[4] << 24 ) |
3714 ( (uint64_t) p[5] << 16 ) |
3715 ( (uint64_t) p[6] << 8 ) |
3716 ( (uint64_t) p[7] );
3717 p += 8;
3718
3719 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
3720 ( (uint64_t) p[1] << 48 ) |
3721 ( (uint64_t) p[2] << 40 ) |
3722 ( (uint64_t) p[3] << 32 ) |
3723 ( (uint64_t) p[4] << 24 ) |
3724 ( (uint64_t) p[5] << 16 ) |
3725 ( (uint64_t) p[6] << 8 ) |
3726 ( (uint64_t) p[7] );
3727 p += 8;
3728#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3729
3730#if defined(MBEDTLS_SSL_PROTO_DTLS)
3731 if( (size_t)( end - p ) < 1 )
3732 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3733
3734 ssl->disable_datagram_packing = *p++;
3735#endif /* MBEDTLS_SSL_PROTO_DTLS */
3736
Jerry Yud9a94fe2021-09-28 18:58:59 +08003737 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003738 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yud9a94fe2021-09-28 18:58:59 +08003739 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
3740 p += sizeof( ssl->cur_out_ctr );
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003741
3742#if defined(MBEDTLS_SSL_PROTO_DTLS)
3743 if( (size_t)( end - p ) < 2 )
3744 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3745
3746 ssl->mtu = ( p[0] << 8 ) | p[1];
3747 p += 2;
3748#endif /* MBEDTLS_SSL_PROTO_DTLS */
3749
3750#if defined(MBEDTLS_SSL_ALPN)
3751 {
3752 uint8_t alpn_len;
3753 const char **cur;
3754
3755 if( (size_t)( end - p ) < 1 )
3756 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3757
3758 alpn_len = *p++;
3759
3760 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
3761 {
3762 /* alpn_chosen should point to an item in the configured list */
3763 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
3764 {
3765 if( strlen( *cur ) == alpn_len &&
3766 memcmp( p, cur, alpn_len ) == 0 )
3767 {
3768 ssl->alpn_chosen = *cur;
3769 break;
3770 }
3771 }
3772 }
3773
3774 /* can only happen on conf mismatch */
3775 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
3776 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3777
3778 p += alpn_len;
3779 }
3780#endif /* MBEDTLS_SSL_ALPN */
3781
3782 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003783 * Forced fields from top-level ssl_context structure
3784 *
3785 * Most of them already set to the correct value by mbedtls_ssl_init() and
3786 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
3787 */
3788 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
3789
3790 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
3791 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
3792
Hanno Becker361b10d2019-08-30 10:42:49 +01003793 /* Adjust pointers for header fields of outgoing records to
3794 * the given transform, accounting for explicit IV and CID. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00003795 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
Hanno Becker361b10d2019-08-30 10:42:49 +01003796
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003797#if defined(MBEDTLS_SSL_PROTO_DTLS)
3798 ssl->in_epoch = 1;
3799#endif
3800
3801 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
3802 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00003803 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
3804 * inappropriately. */
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003805 if( ssl->handshake != NULL )
3806 {
3807 mbedtls_ssl_handshake_free( ssl );
3808 mbedtls_free( ssl->handshake );
3809 ssl->handshake = NULL;
3810 }
3811
3812 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003813 * Done - should have consumed entire buffer
3814 */
3815 if( p != end )
3816 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003817
3818 return( 0 );
3819}
3820
3821/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003822 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003823 */
3824int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
3825 const unsigned char *buf,
3826 size_t len )
3827{
3828 int ret = ssl_context_load( context, buf, len );
3829
3830 if( ret != 0 )
3831 mbedtls_ssl_free( context );
3832
3833 return( ret );
3834}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02003835#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003836
3837/*
Paul Bakker5121ce52009-01-03 21:22:43 +00003838 * Free an SSL context
3839 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003840void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003841{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003842 if( ssl == NULL )
3843 return;
3844
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003845 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003846
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01003847 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003848 {
sander-visserb8aa2072020-05-06 22:05:13 +02003849#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3850 size_t out_buf_len = ssl->out_buf_len;
3851#else
3852 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3853#endif
3854
Darryl Greenb33cc762019-11-28 14:29:44 +00003855 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003856 mbedtls_free( ssl->out_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003857 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00003858 }
3859
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01003860 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003861 {
sander-visserb8aa2072020-05-06 22:05:13 +02003862#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3863 size_t in_buf_len = ssl->in_buf_len;
3864#else
3865 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3866#endif
3867
Darryl Greenb33cc762019-11-28 14:29:44 +00003868 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003869 mbedtls_free( ssl->in_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003870 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00003871 }
3872
Paul Bakker48916f92012-09-16 19:57:18 +00003873 if( ssl->transform )
3874 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003875 mbedtls_ssl_transform_free( ssl->transform );
3876 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00003877 }
3878
3879 if( ssl->handshake )
3880 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02003881 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003882 mbedtls_ssl_transform_free( ssl->transform_negotiate );
3883 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00003884
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003885 mbedtls_free( ssl->handshake );
3886 mbedtls_free( ssl->transform_negotiate );
3887 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00003888 }
3889
Ronald Cron6f135e12021-12-08 16:57:54 +01003890#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker3aa186f2021-08-10 09:24:19 +01003891 mbedtls_ssl_transform_free( ssl->transform_application );
3892 mbedtls_free( ssl->transform_application );
Ronald Cron6f135e12021-12-08 16:57:54 +01003893#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01003894
Paul Bakkerc0463502013-02-14 11:19:38 +01003895 if( ssl->session )
3896 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003897 mbedtls_ssl_session_free( ssl->session );
3898 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01003899 }
3900
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02003901#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02003902 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003903 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003904 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003905 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00003906 }
Paul Bakker0be444a2013-08-27 21:55:01 +02003907#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003908
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02003909#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003910 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02003911#endif
3912
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003913 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00003914
Paul Bakker86f04f42013-02-14 11:20:09 +01003915 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003916 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003917}
3918
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02003919/*
3920 * Initialze mbedtls_ssl_config
3921 */
3922void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
3923{
3924 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
3925}
3926
Gilles Peskineeccd8882020-03-10 12:19:08 +01003927#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08003928#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskineae270bf2021-06-02 00:05:29 +02003929/* The selection should be the same as mbedtls_x509_crt_profile_default in
Gilles Peskinea28f0f52021-06-02 15:29:38 +02003930 * x509_crt.c. Here, the order matters. Currently we favor stronger hashes,
3931 * for no fundamental reason.
Gilles Peskineae270bf2021-06-02 00:05:29 +02003932 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
3933 * about this list. */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01003934static int ssl_preset_default_hashes[] = {
3935#if defined(MBEDTLS_SHA512_C)
3936 MBEDTLS_MD_SHA512,
Mateusz Starzyk3352a532021-04-06 14:28:22 +02003937#endif
3938#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01003939 MBEDTLS_MD_SHA384,
3940#endif
3941#if defined(MBEDTLS_SHA256_C)
3942 MBEDTLS_MD_SHA256,
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02003943#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01003944 MBEDTLS_MD_NONE
3945};
Jerry Yuf017ee42022-01-12 15:49:48 +08003946#endif /* !MBEDTLS_DEPRECATED_REMOVED */
3947#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01003948
Gilles Peskineae270bf2021-06-02 00:05:29 +02003949/* The selection should be the same as mbedtls_x509_crt_profile_default in
3950 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02003951 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02003952 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02003953 * about this list.
3954 */
Brett Warrene0edc842021-08-17 09:53:13 +01003955static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02003956#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003957 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02003958#endif
3959#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003960 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02003961#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02003962#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003963 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003964#endif
3965#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003966 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003967#endif
3968#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003969 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003970#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02003971#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003972 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02003973#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02003974#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003975 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003976#endif
3977#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01003978 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02003979#endif
Brett Warrene0edc842021-08-17 09:53:13 +01003980 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02003981};
Gilles Peskineae270bf2021-06-02 00:05:29 +02003982
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02003983static int ssl_preset_suiteb_ciphersuites[] = {
3984 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
3985 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
3986 0
3987};
3988
Gilles Peskineeccd8882020-03-10 12:19:08 +01003989#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08003990#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02003991static int ssl_preset_suiteb_hashes[] = {
Jerry Yuf017ee42022-01-12 15:49:48 +08003992#if defined(MBEDTLS_SHA256_C)
3993 MBEDTLS_MD_SHA256,
3994#endif
Jerry Yu713013f2022-01-17 18:16:35 +08003995#if defined(MBEDTLS_SHA384_C)
3996 MBEDTLS_MD_SHA384,
3997#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02003998 MBEDTLS_MD_NONE
3999};
Jerry Yuf017ee42022-01-12 15:49:48 +08004000#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004001
Jerry Yu909df7b2022-01-22 11:56:27 +08004002/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08004003 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08004004 * rules SHOULD be upheld.
4005 * - No duplicate entries.
4006 * - But if there is a good reason, do not change the order of the algorithms.
4007 * - ssl_tls12_present* is for TLS 1.2 use only.
4008 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08004009 */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004010static uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08004011
Jerry Yued5e9f42022-01-26 11:21:34 +08004012#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
4013 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4014 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
4015#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
4016 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004017
Jerry Yu909df7b2022-01-22 11:56:27 +08004018#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
4019 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4020 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
4021#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4022 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
4023
Jerry Yued5e9f42022-01-26 11:21:34 +08004024#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA512_C) && \
4025 defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
4026 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
4027#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4028 MBEDTLS_ECP_DP_SECP521R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004029
Jerry Yu909df7b2022-01-22 11:56:27 +08004030#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
4031 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4032#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
4033
Ronald Cron8540cf62022-03-16 08:01:09 +01004034#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA512_C)
4035 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
4036#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */
4037
4038#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA384_C)
4039 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
4040#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */
4041
Jerry Yu53037892022-01-25 11:02:06 +08004042#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
4043 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4044#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4045
Jerry Yu909df7b2022-01-22 11:56:27 +08004046 MBEDTLS_TLS1_3_SIG_NONE
4047};
4048
4049/* NOTICE: see above */
4050#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4051static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08004052#if defined(MBEDTLS_SHA512_C)
4053 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA512 )
4054#endif
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004055#if defined(MBEDTLS_SHA384_C)
4056 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
4057#endif
4058#if defined(MBEDTLS_SHA256_C)
4059 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
4060#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08004061 MBEDTLS_TLS1_3_SIG_NONE
4062};
4063#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4064/* NOTICE: see above */
4065static uint16_t ssl_preset_suiteb_sig_algs[] = {
4066
Jerry Yu909df7b2022-01-22 11:56:27 +08004067#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
4068 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4069 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
4070#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
4071 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
4072
Jerry Yu53037892022-01-25 11:02:06 +08004073#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
4074 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4075 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
4076#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4077 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004078
4079#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
4080 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4081#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004082
Jerry Yu53037892022-01-25 11:02:06 +08004083#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
4084 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4085#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4086
Jerry Yu713013f2022-01-17 18:16:35 +08004087 MBEDTLS_TLS1_3_SIG_NONE
4088};
Jerry Yu6106fdc2022-01-12 16:36:14 +08004089
Jerry Yu909df7b2022-01-22 11:56:27 +08004090/* NOTICE: see above */
4091#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4092static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08004093#if defined(MBEDTLS_SHA256_C)
4094 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
4095#endif
Jerry Yu18c833e2022-01-25 10:55:47 +08004096#if defined(MBEDTLS_SHA384_C)
4097 MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
4098#endif
Xiaofei Bai95395012021-11-25 08:51:30 +00004099 MBEDTLS_TLS1_3_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004100};
Jerry Yu909df7b2022-01-22 11:56:27 +08004101#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4102
Jerry Yu1a8b4812022-01-20 17:56:50 +08004103#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004104
Brett Warrene0edc842021-08-17 09:53:13 +01004105static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01004106#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004107 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004108#endif
4109#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004110 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004111#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004112 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004113};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004114
Jerry Yu1a8b4812022-01-20 17:56:50 +08004115#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004116/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08004117 * to make sure there are no duplicated signature algorithm entries. */
Jerry Yuf377d642022-01-25 10:43:59 +08004118static int ssl_check_no_sig_alg_duplication( uint16_t * sig_algs )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004119{
4120 size_t i, j;
4121 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08004122
Jerry Yuf377d642022-01-25 10:43:59 +08004123 for( i = 0; sig_algs[i] != MBEDTLS_TLS1_3_SIG_NONE; i++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004124 {
Jerry Yuf377d642022-01-25 10:43:59 +08004125 for( j = 0; j < i; j++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004126 {
Jerry Yuf377d642022-01-25 10:43:59 +08004127 if( sig_algs[i] != sig_algs[j] )
4128 continue;
4129 mbedtls_printf( " entry(%04x,%" MBEDTLS_PRINTF_SIZET
4130 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
4131 sig_algs[i], j, i );
4132 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08004133 }
4134 }
4135 return( ret );
4136}
4137
4138#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4139
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004140/*
Tillmann Karras588ad502015-09-25 04:27:22 +02004141 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004142 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004143int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004144 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004145{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004146#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00004147 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004148#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004149
Jerry Yu1a8b4812022-01-20 17:56:50 +08004150#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf377d642022-01-25 10:43:59 +08004151 if( ssl_check_no_sig_alg_duplication( ssl_preset_suiteb_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004152 {
4153 mbedtls_printf( "ssl_preset_suiteb_sig_algs has duplicated entries\n" );
4154 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4155 }
4156
Jerry Yuf377d642022-01-25 10:43:59 +08004157 if( ssl_check_no_sig_alg_duplication( ssl_preset_default_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004158 {
4159 mbedtls_printf( "ssl_preset_default_sig_algs has duplicated entries\n" );
4160 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4161 }
Jerry Yu909df7b2022-01-22 11:56:27 +08004162
4163#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yuf377d642022-01-25 10:43:59 +08004164 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_suiteb_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004165 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004166 mbedtls_printf( "ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004167 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4168 }
4169
Jerry Yuf377d642022-01-25 10:43:59 +08004170 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_default_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004171 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004172 mbedtls_printf( "ssl_tls12_preset_default_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004173 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4174 }
4175#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004176#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4177
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02004178 /* Use the functions here so that they are covered in tests,
4179 * but otherwise access member directly for efficiency */
4180 mbedtls_ssl_conf_endpoint( conf, endpoint );
4181 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004182
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004183 /*
4184 * Things that are common to all presets
4185 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004186#if defined(MBEDTLS_SSL_CLI_C)
4187 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
4188 {
4189 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
4190#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4191 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
4192#endif
4193 }
4194#endif
4195
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004196#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4197 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
4198#endif
4199
4200#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
4201 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
4202#endif
4203
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004204#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004205 conf->f_cookie_write = ssl_cookie_write_dummy;
4206 conf->f_cookie_check = ssl_cookie_check_dummy;
4207#endif
4208
4209#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4210 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
4211#endif
4212
Janos Follath088ce432017-04-10 12:42:31 +01004213#if defined(MBEDTLS_SSL_SRV_C)
4214 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02004215 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01004216#endif
4217
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004218#if defined(MBEDTLS_SSL_PROTO_DTLS)
4219 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
4220 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
4221#endif
4222
4223#if defined(MBEDTLS_SSL_RENEGOTIATION)
4224 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00004225 memset( conf->renego_period, 0x00, 2 );
4226 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004227#endif
4228
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004229#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckere2defad2021-07-24 05:59:17 +01004230 if( endpoint == MBEDTLS_SSL_IS_SERVER )
4231 {
4232 const unsigned char dhm_p[] =
4233 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
4234 const unsigned char dhm_g[] =
4235 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01004236
Hanno Beckere2defad2021-07-24 05:59:17 +01004237 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
4238 dhm_p, sizeof( dhm_p ),
4239 dhm_g, sizeof( dhm_g ) ) ) != 0 )
4240 {
4241 return( ret );
4242 }
4243 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02004244#endif
4245
Ronald Cron6f135e12021-12-08 16:57:54 +01004246#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker71f1ed62021-07-24 06:01:47 +01004247 /*
4248 * Allow all TLS 1.3 key exchange modes by default.
4249 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00004250 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01004251#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01004252
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004253 /*
4254 * Preset-specific defaults
4255 */
4256 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004257 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004258 /*
4259 * NSA Suite B
4260 */
4261 case MBEDTLS_SSL_PRESET_SUITEB:
Ronald Crone71639d2022-03-11 11:31:31 +01004262 conf->min_major_ver = MBEDTLS_SSL_MIN_MAJOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004263 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004264
Ronald Cronf6606552022-03-15 11:23:25 +01004265 if( ( endpoint == MBEDTLS_SSL_IS_SERVER ) ||
4266 ( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) )
4267#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4268 {
4269 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
4270 conf->max_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
4271 }
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004272#else
Ronald Cronf6606552022-03-15 11:23:25 +01004273 {
4274 conf->min_major_ver = 0;
4275 conf->max_major_ver = 0;
4276 conf->min_minor_ver = 0;
4277 conf->max_minor_ver = 0;
Ronald Cron1fa4f682022-03-30 17:35:18 +02004278 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ronald Cronf6606552022-03-15 11:23:25 +01004279 }
4280#endif
4281 else
4282 {
4283 conf->min_minor_ver = MBEDTLS_SSL_MIN_MINOR_VERSION;
4284 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
4285 }
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004286 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004287
4288#if defined(MBEDTLS_X509_CRT_PARSE_C)
4289 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004290#endif
4291
Gilles Peskineeccd8882020-03-10 12:19:08 +01004292#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004293#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004294 conf->sig_hashes = ssl_preset_suiteb_hashes;
Jerry Yuf017ee42022-01-12 15:49:48 +08004295#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004296#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4297 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4298 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
4299 else
4300#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4301 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004302#endif
4303
Brett Warrene0edc842021-08-17 09:53:13 +01004304#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4305 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004306#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004307 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02004308 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004309
4310 /*
4311 * Default
4312 */
4313 default:
Ronald Crone71639d2022-03-11 11:31:31 +01004314 conf->min_major_ver = MBEDTLS_SSL_MIN_MAJOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004315 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004316
Ronald Cronf6606552022-03-15 11:23:25 +01004317 if( ( endpoint == MBEDTLS_SSL_IS_SERVER ) ||
4318 ( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) )
4319#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4320 {
TRodziewiczef73f012021-05-13 14:53:36 +02004321 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Ronald Cronf6606552022-03-15 11:23:25 +01004322 conf->max_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
4323 }
4324#else
4325 {
4326 conf->min_major_ver = 0;
4327 conf->max_major_ver = 0;
4328 conf->min_minor_ver = 0;
4329 conf->max_minor_ver = 0;
Ronald Cron1fa4f682022-03-30 17:35:18 +02004330 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ronald Cronf6606552022-03-15 11:23:25 +01004331 }
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004332#endif
Ronald Cronf6606552022-03-15 11:23:25 +01004333 else
4334 {
4335 conf->min_minor_ver = MBEDTLS_SSL_MIN_MINOR_VERSION;
4336 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
4337 }
4338
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004339 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004340
4341#if defined(MBEDTLS_X509_CRT_PARSE_C)
4342 conf->cert_profile = &mbedtls_x509_crt_profile_default;
4343#endif
4344
Gilles Peskineeccd8882020-03-10 12:19:08 +01004345#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004346#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01004347 conf->sig_hashes = ssl_preset_default_hashes;
Jerry Yuf017ee42022-01-12 15:49:48 +08004348#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004349#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4350 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4351 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
4352 else
4353#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4354 conf->sig_algs = ssl_preset_default_sig_algs;
Hanno Beckerdeb68ce2021-08-10 16:04:05 +01004355#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004356
Brett Warrene0edc842021-08-17 09:53:13 +01004357#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4358 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004359#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004360 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004361
4362#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
4363 conf->dhm_min_bitlen = 1024;
4364#endif
4365 }
4366
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004367 return( 0 );
4368}
4369
4370/*
4371 * Free mbedtls_ssl_config
4372 */
4373void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
4374{
4375#if defined(MBEDTLS_DHM_C)
4376 mbedtls_mpi_free( &conf->dhm_P );
4377 mbedtls_mpi_free( &conf->dhm_G );
4378#endif
4379
Gilles Peskineeccd8882020-03-10 12:19:08 +01004380#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004381 if( conf->psk != NULL )
4382 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004383 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004384 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00004385 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004386 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09004387 }
4388
4389 if( conf->psk_identity != NULL )
4390 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004391 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09004392 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00004393 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004394 conf->psk_identity_len = 0;
4395 }
4396#endif
4397
4398#if defined(MBEDTLS_X509_CRT_PARSE_C)
4399 ssl_key_cert_free( conf->key_cert );
4400#endif
4401
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004402 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004403}
4404
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004405#if defined(MBEDTLS_PK_C) && \
4406 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004407/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004408 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004409 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004410unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004411{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004412#if defined(MBEDTLS_RSA_C)
4413 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
4414 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004415#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004416#if defined(MBEDTLS_ECDSA_C)
4417 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
4418 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004419#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004420 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004421}
4422
Hanno Becker7e5437a2017-04-28 17:15:26 +01004423unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
4424{
4425 switch( type ) {
4426 case MBEDTLS_PK_RSA:
4427 return( MBEDTLS_SSL_SIG_RSA );
4428 case MBEDTLS_PK_ECDSA:
4429 case MBEDTLS_PK_ECKEY:
4430 return( MBEDTLS_SSL_SIG_ECDSA );
4431 default:
4432 return( MBEDTLS_SSL_SIG_ANON );
4433 }
4434}
4435
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004436mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004437{
4438 switch( sig )
4439 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004440#if defined(MBEDTLS_RSA_C)
4441 case MBEDTLS_SSL_SIG_RSA:
4442 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004443#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004444#if defined(MBEDTLS_ECDSA_C)
4445 case MBEDTLS_SSL_SIG_ECDSA:
4446 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004447#endif
4448 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004449 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004450 }
4451}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004452#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004453
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004454/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004455 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004456 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004457mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004458{
4459 switch( hash )
4460 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004461#if defined(MBEDTLS_MD5_C)
4462 case MBEDTLS_SSL_HASH_MD5:
4463 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004464#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004465#if defined(MBEDTLS_SHA1_C)
4466 case MBEDTLS_SSL_HASH_SHA1:
4467 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004468#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004469#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004470 case MBEDTLS_SSL_HASH_SHA224:
4471 return( MBEDTLS_MD_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004472#endif
4473#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004474 case MBEDTLS_SSL_HASH_SHA256:
4475 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004476#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004477#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004478 case MBEDTLS_SSL_HASH_SHA384:
4479 return( MBEDTLS_MD_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004480#endif
4481#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004482 case MBEDTLS_SSL_HASH_SHA512:
4483 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004484#endif
4485 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004486 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004487 }
4488}
4489
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004490/*
4491 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
4492 */
4493unsigned char mbedtls_ssl_hash_from_md_alg( int md )
4494{
4495 switch( md )
4496 {
4497#if defined(MBEDTLS_MD5_C)
4498 case MBEDTLS_MD_MD5:
4499 return( MBEDTLS_SSL_HASH_MD5 );
4500#endif
4501#if defined(MBEDTLS_SHA1_C)
4502 case MBEDTLS_MD_SHA1:
4503 return( MBEDTLS_SSL_HASH_SHA1 );
4504#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004505#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004506 case MBEDTLS_MD_SHA224:
4507 return( MBEDTLS_SSL_HASH_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004508#endif
4509#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004510 case MBEDTLS_MD_SHA256:
4511 return( MBEDTLS_SSL_HASH_SHA256 );
4512#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004513#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004514 case MBEDTLS_MD_SHA384:
4515 return( MBEDTLS_SSL_HASH_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004516#endif
4517#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004518 case MBEDTLS_MD_SHA512:
4519 return( MBEDTLS_SSL_HASH_SHA512 );
4520#endif
4521 default:
4522 return( MBEDTLS_SSL_HASH_NONE );
4523 }
4524}
4525
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004526/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004527 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004528 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004529 */
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004530int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004531{
Brett Warrene0edc842021-08-17 09:53:13 +01004532 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004533
Brett Warrene0edc842021-08-17 09:53:13 +01004534 if( group_list == NULL )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004535 return( -1 );
4536
Brett Warrene0edc842021-08-17 09:53:13 +01004537 for( ; *group_list != 0; group_list++ )
4538 {
4539 if( *group_list == tls_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004540 return( 0 );
Brett Warrene0edc842021-08-17 09:53:13 +01004541 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004542
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004543 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004544}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004545
4546#if defined(MBEDTLS_ECP_C)
4547/*
4548 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
4549 */
4550int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
4551{
Manuel Pégourié-Gonnard422370d2022-02-07 11:55:21 +01004552 uint16_t tls_id = mbedtls_ecp_curve_info_from_grp_id( grp_id )->tls_id;
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004553 return mbedtls_ssl_check_curve_tls_id( ssl, tls_id );
4554}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02004555#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004556
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004557#if defined(MBEDTLS_X509_CRT_PARSE_C)
4558int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
4559 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004560 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02004561 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004562{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004563 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004564 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004565 const char *ext_oid;
4566 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004568 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004569 {
4570 /* Server part of the key exchange */
4571 switch( ciphersuite->key_exchange )
4572 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004573 case MBEDTLS_KEY_EXCHANGE_RSA:
4574 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004575 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004576 break;
4577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004578 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
4579 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
4580 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
4581 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004582 break;
4583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004584 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
4585 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004586 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004587 break;
4588
4589 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004590 case MBEDTLS_KEY_EXCHANGE_NONE:
4591 case MBEDTLS_KEY_EXCHANGE_PSK:
4592 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
4593 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02004594 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004595 usage = 0;
4596 }
4597 }
4598 else
4599 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004600 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
4601 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004602 }
4603
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004604 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004605 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004606 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004607 ret = -1;
4608 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004609
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004610 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004611 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004612 ext_oid = MBEDTLS_OID_SERVER_AUTH;
4613 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004614 }
4615 else
4616 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004617 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
4618 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004619 }
4620
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004621 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004622 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004623 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004624 ret = -1;
4625 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004626
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004627 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004628}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004629#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02004630
Jerry Yu148165c2021-09-24 23:20:59 +08004631#if defined(MBEDTLS_USE_PSA_CRYPTO)
4632int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
4633 const mbedtls_md_type_t md,
4634 unsigned char *dst,
4635 size_t dst_len,
4636 size_t *olen )
4637{
Ronald Cronf6893e12022-01-07 22:09:01 +01004638 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4639 psa_hash_operation_t *hash_operation_to_clone;
4640 psa_hash_operation_t hash_operation = psa_hash_operation_init();
4641
Jerry Yu148165c2021-09-24 23:20:59 +08004642 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01004643
4644 switch( md )
4645 {
4646#if defined(MBEDTLS_SHA384_C)
4647 case MBEDTLS_MD_SHA384:
4648 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
4649 break;
4650#endif
4651
4652#if defined(MBEDTLS_SHA256_C)
4653 case MBEDTLS_MD_SHA256:
4654 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
4655 break;
4656#endif
4657
4658 default:
4659 goto exit;
4660 }
4661
4662 status = psa_hash_clone( hash_operation_to_clone, &hash_operation );
4663 if( status != PSA_SUCCESS )
4664 goto exit;
4665
4666 status = psa_hash_finish( &hash_operation, dst, dst_len, olen );
4667 if( status != PSA_SUCCESS )
4668 goto exit;
4669
4670exit:
Ronald Cronb788c042022-02-15 09:14:15 +01004671 return( psa_ssl_status_to_mbedtls( status ) );
Jerry Yu148165c2021-09-24 23:20:59 +08004672}
4673#else /* MBEDTLS_USE_PSA_CRYPTO */
4674
Jerry Yu24c0ec32021-09-09 14:21:07 +08004675#if defined(MBEDTLS_SHA384_C)
Jerry Yu000f9762021-09-14 11:12:51 +08004676static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
4677 unsigned char *dst,
4678 size_t dst_len,
4679 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004680{
Jerry Yu24c0ec32021-09-09 14:21:07 +08004681 int ret;
4682 mbedtls_sha512_context sha512;
4683
4684 if( dst_len < 48 )
4685 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4686
4687 mbedtls_sha512_init( &sha512 );
4688 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
4689
4690 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
4691 {
4692 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
4693 goto exit;
4694 }
4695
4696 *olen = 48;
4697
4698exit:
4699
4700 mbedtls_sha512_free( &sha512 );
4701 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004702}
4703#endif /* MBEDTLS_SHA384_C */
4704
4705#if defined(MBEDTLS_SHA256_C)
Jerry Yu000f9762021-09-14 11:12:51 +08004706static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
4707 unsigned char *dst,
4708 size_t dst_len,
4709 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004710{
Jerry Yu24c0ec32021-09-09 14:21:07 +08004711 int ret;
4712 mbedtls_sha256_context sha256;
4713
4714 if( dst_len < 32 )
4715 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4716
4717 mbedtls_sha256_init( &sha256 );
4718 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Jerry Yuc5aef882021-12-23 20:15:02 +08004719
Jerry Yu24c0ec32021-09-09 14:21:07 +08004720 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
4721 {
4722 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
4723 goto exit;
4724 }
4725
4726 *olen = 32;
4727
4728exit:
4729
4730 mbedtls_sha256_free( &sha256 );
4731 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004732}
4733#endif /* MBEDTLS_SHA256_C */
4734
Jerry Yu000f9762021-09-14 11:12:51 +08004735int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
4736 const mbedtls_md_type_t md,
4737 unsigned char *dst,
4738 size_t dst_len,
4739 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004740{
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004741 switch( md )
4742 {
4743
Jerry Yu24c0ec32021-09-09 14:21:07 +08004744#if defined(MBEDTLS_SHA384_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004745 case MBEDTLS_MD_SHA384:
Jerry Yuc5aef882021-12-23 20:15:02 +08004746 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08004747#endif /* MBEDTLS_SHA384_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004748
Jerry Yu24c0ec32021-09-09 14:21:07 +08004749#if defined(MBEDTLS_SHA256_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004750 case MBEDTLS_MD_SHA256:
Jerry Yuc5aef882021-12-23 20:15:02 +08004751 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08004752#endif /* MBEDTLS_SHA256_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004753
4754 default:
4755 break;
4756 }
Jerry Yuc5aef882021-12-23 20:15:02 +08004757 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004758}
XiaokangQian647719a2021-12-07 09:16:29 +00004759
Jerry Yu148165c2021-09-24 23:20:59 +08004760#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08004761
Jerry Yudc7bd172022-02-17 13:44:15 +08004762#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4763
4764#if defined(MBEDTLS_USE_PSA_CRYPTO)
4765
4766static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
4767 mbedtls_svc_key_id_t key,
4768 psa_algorithm_t alg,
4769 const unsigned char* seed, size_t seed_length,
4770 const unsigned char* label, size_t label_length,
4771 size_t capacity )
4772{
4773 psa_status_t status;
4774
4775 status = psa_key_derivation_setup( derivation, alg );
4776 if( status != PSA_SUCCESS )
4777 return( status );
4778
4779 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
4780 {
4781 status = psa_key_derivation_input_bytes( derivation,
4782 PSA_KEY_DERIVATION_INPUT_SEED,
4783 seed, seed_length );
4784 if( status != PSA_SUCCESS )
4785 return( status );
4786
4787 if( mbedtls_svc_key_id_is_null( key ) )
4788 {
4789 status = psa_key_derivation_input_bytes(
4790 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
4791 NULL, 0 );
4792 }
4793 else
4794 {
4795 status = psa_key_derivation_input_key(
4796 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
4797 }
4798 if( status != PSA_SUCCESS )
4799 return( status );
4800
4801 status = psa_key_derivation_input_bytes( derivation,
4802 PSA_KEY_DERIVATION_INPUT_LABEL,
4803 label, label_length );
4804 if( status != PSA_SUCCESS )
4805 return( status );
4806 }
4807 else
4808 {
4809 return( PSA_ERROR_NOT_SUPPORTED );
4810 }
4811
4812 status = psa_key_derivation_set_capacity( derivation, capacity );
4813 if( status != PSA_SUCCESS )
4814 return( status );
4815
4816 return( PSA_SUCCESS );
4817}
4818
4819static int tls_prf_generic( mbedtls_md_type_t md_type,
4820 const unsigned char *secret, size_t slen,
4821 const char *label,
4822 const unsigned char *random, size_t rlen,
4823 unsigned char *dstbuf, size_t dlen )
4824{
4825 psa_status_t status;
4826 psa_algorithm_t alg;
4827 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
4828 psa_key_derivation_operation_t derivation =
4829 PSA_KEY_DERIVATION_OPERATION_INIT;
4830
4831 if( md_type == MBEDTLS_MD_SHA384 )
4832 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
4833 else
4834 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
4835
4836 /* Normally a "secret" should be long enough to be impossible to
4837 * find by brute force, and in particular should not be empty. But
4838 * this PRF is also used to derive an IV, in particular in EAP-TLS,
4839 * and for this use case it makes sense to have a 0-length "secret".
4840 * Since the key API doesn't allow importing a key of length 0,
4841 * keep master_key=0, which setup_psa_key_derivation() understands
4842 * to mean a 0-length "secret" input. */
4843 if( slen != 0 )
4844 {
4845 psa_key_attributes_t key_attributes = psa_key_attributes_init();
4846 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
4847 psa_set_key_algorithm( &key_attributes, alg );
4848 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
4849
4850 status = psa_import_key( &key_attributes, secret, slen, &master_key );
4851 if( status != PSA_SUCCESS )
4852 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4853 }
4854
4855 status = setup_psa_key_derivation( &derivation,
4856 master_key, alg,
4857 random, rlen,
4858 (unsigned char const *) label,
4859 (size_t) strlen( label ),
4860 dlen );
4861 if( status != PSA_SUCCESS )
4862 {
4863 psa_key_derivation_abort( &derivation );
4864 psa_destroy_key( master_key );
4865 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4866 }
4867
4868 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
4869 if( status != PSA_SUCCESS )
4870 {
4871 psa_key_derivation_abort( &derivation );
4872 psa_destroy_key( master_key );
4873 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4874 }
4875
4876 status = psa_key_derivation_abort( &derivation );
4877 if( status != PSA_SUCCESS )
4878 {
4879 psa_destroy_key( master_key );
4880 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4881 }
4882
4883 if( ! mbedtls_svc_key_id_is_null( master_key ) )
4884 status = psa_destroy_key( master_key );
4885 if( status != PSA_SUCCESS )
4886 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
4887
4888 return( 0 );
4889}
4890
4891#else /* MBEDTLS_USE_PSA_CRYPTO */
4892
4893static int tls_prf_generic( mbedtls_md_type_t md_type,
4894 const unsigned char *secret, size_t slen,
4895 const char *label,
4896 const unsigned char *random, size_t rlen,
4897 unsigned char *dstbuf, size_t dlen )
4898{
4899 size_t nb;
4900 size_t i, j, k, md_len;
4901 unsigned char *tmp;
4902 size_t tmp_len = 0;
4903 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
4904 const mbedtls_md_info_t *md_info;
4905 mbedtls_md_context_t md_ctx;
4906 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4907
4908 mbedtls_md_init( &md_ctx );
4909
4910 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
4911 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4912
4913 md_len = mbedtls_md_get_size( md_info );
4914
4915 tmp_len = md_len + strlen( label ) + rlen;
4916 tmp = mbedtls_calloc( 1, tmp_len );
4917 if( tmp == NULL )
4918 {
4919 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
4920 goto exit;
4921 }
4922
4923 nb = strlen( label );
4924 memcpy( tmp + md_len, label, nb );
4925 memcpy( tmp + md_len + nb, random, rlen );
4926 nb += rlen;
4927
4928 /*
4929 * Compute P_<hash>(secret, label + random)[0..dlen]
4930 */
4931 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
4932 goto exit;
4933
4934 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
4935 if( ret != 0 )
4936 goto exit;
4937 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
4938 if( ret != 0 )
4939 goto exit;
4940 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
4941 if( ret != 0 )
4942 goto exit;
4943
4944 for( i = 0; i < dlen; i += md_len )
4945 {
4946 ret = mbedtls_md_hmac_reset ( &md_ctx );
4947 if( ret != 0 )
4948 goto exit;
4949 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
4950 if( ret != 0 )
4951 goto exit;
4952 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
4953 if( ret != 0 )
4954 goto exit;
4955
4956 ret = mbedtls_md_hmac_reset ( &md_ctx );
4957 if( ret != 0 )
4958 goto exit;
4959 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
4960 if( ret != 0 )
4961 goto exit;
4962 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
4963 if( ret != 0 )
4964 goto exit;
4965
4966 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
4967
4968 for( j = 0; j < k; j++ )
4969 dstbuf[i + j] = h_i[j];
4970 }
4971
4972exit:
4973 mbedtls_md_free( &md_ctx );
4974
4975 mbedtls_platform_zeroize( tmp, tmp_len );
4976 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
4977
4978 mbedtls_free( tmp );
4979
4980 return( ret );
4981}
4982#endif /* MBEDTLS_USE_PSA_CRYPTO */
4983
4984#if defined(MBEDTLS_SHA256_C)
4985static int tls_prf_sha256( const unsigned char *secret, size_t slen,
4986 const char *label,
4987 const unsigned char *random, size_t rlen,
4988 unsigned char *dstbuf, size_t dlen )
4989{
4990 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
4991 label, random, rlen, dstbuf, dlen ) );
4992}
4993#endif /* MBEDTLS_SHA256_C */
4994
4995#if defined(MBEDTLS_SHA384_C)
4996static int tls_prf_sha384( const unsigned char *secret, size_t slen,
4997 const char *label,
4998 const unsigned char *random, size_t rlen,
4999 unsigned char *dstbuf, size_t dlen )
5000{
5001 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
5002 label, random, rlen, dstbuf, dlen ) );
5003}
5004#endif /* MBEDTLS_SHA384_C */
5005
Jerry Yuf009d862022-02-17 14:01:37 +08005006/*
5007 * Set appropriate PRF function and other SSL / TLS1.2 functions
5008 *
5009 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08005010 * - hash associated with the ciphersuite (only used by TLS 1.2)
5011 *
5012 * Outputs:
5013 * - the tls_prf, calc_verify and calc_finished members of handshake structure
5014 */
5015static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
Jerry Yuf009d862022-02-17 14:01:37 +08005016 mbedtls_md_type_t hash )
5017{
Jerry Yuf009d862022-02-17 14:01:37 +08005018#if defined(MBEDTLS_SHA384_C)
Ronald Cron81591aa2022-03-07 09:05:51 +01005019 if( hash == MBEDTLS_MD_SHA384 )
Jerry Yuf009d862022-02-17 14:01:37 +08005020 {
5021 handshake->tls_prf = tls_prf_sha384;
5022 handshake->calc_verify = ssl_calc_verify_tls_sha384;
5023 handshake->calc_finished = ssl_calc_finished_tls_sha384;
5024 }
5025 else
5026#endif
5027#if defined(MBEDTLS_SHA256_C)
Jerry Yuf009d862022-02-17 14:01:37 +08005028 {
Ronald Cron81591aa2022-03-07 09:05:51 +01005029 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005030 handshake->tls_prf = tls_prf_sha256;
5031 handshake->calc_verify = ssl_calc_verify_tls_sha256;
5032 handshake->calc_finished = ssl_calc_finished_tls_sha256;
5033 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005034#else
Jerry Yuf009d862022-02-17 14:01:37 +08005035 {
Jerry Yuf009d862022-02-17 14:01:37 +08005036 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01005037 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005038 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5039 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005040#endif
Jerry Yuf009d862022-02-17 14:01:37 +08005041
5042 return( 0 );
5043}
Jerry Yud6ab2352022-02-17 14:03:43 +08005044
5045#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \
5046 defined(MBEDTLS_USE_PSA_CRYPTO)
5047static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
5048{
5049 if( ssl->conf->f_psk != NULL )
5050 {
5051 /* If we've used a callback to select the PSK,
5052 * the static configuration is irrelevant. */
5053 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
5054 return( 1 );
5055
5056 return( 0 );
5057 }
5058
5059 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
5060 return( 1 );
5061
5062 return( 0 );
5063}
5064#endif /* MBEDTLS_USE_PSA_CRYPTO &&
5065 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
5066
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005067/*
5068 * Compute master secret if needed
5069 *
5070 * Parameters:
5071 * [in/out] handshake
5072 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
5073 * (PSA-PSK) ciphersuite_info, psk_opaque
5074 * [out] premaster (cleared)
5075 * [out] master
5076 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
5077 * debug: conf->f_dbg, conf->p_dbg
5078 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01005079 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005080 */
5081static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
5082 unsigned char *master,
5083 const mbedtls_ssl_context *ssl )
5084{
5085 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5086
5087 /* cf. RFC 5246, Section 8.1:
5088 * "The master secret is always exactly 48 bytes in length." */
5089 size_t const master_secret_len = 48;
5090
5091#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5092 unsigned char session_hash[48];
5093#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
5094
5095 /* The label for the KDF used for key expansion.
5096 * This is either "master secret" or "extended master secret"
5097 * depending on whether the Extended Master Secret extension
5098 * is used. */
5099 char const *lbl = "master secret";
5100
5101 /* The salt for the KDF used for key expansion.
5102 * - If the Extended Master Secret extension is not used,
5103 * this is ClientHello.Random + ServerHello.Random
5104 * (see Sect. 8.1 in RFC 5246).
5105 * - If the Extended Master Secret extension is used,
5106 * this is the transcript of the handshake so far.
5107 * (see Sect. 4 in RFC 7627). */
5108 unsigned char const *salt = handshake->randbytes;
5109 size_t salt_len = 64;
5110
5111#if !defined(MBEDTLS_DEBUG_C) && \
5112 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
5113 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
5114 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
5115 ssl = NULL; /* make sure we don't use it except for those cases */
5116 (void) ssl;
5117#endif
5118
5119 if( handshake->resume != 0 )
5120 {
5121 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
5122 return( 0 );
5123 }
5124
5125#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5126 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
5127 {
5128 lbl = "extended master secret";
5129 salt = session_hash;
5130 handshake->calc_verify( ssl, session_hash, &salt_len );
5131
5132 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
5133 session_hash, salt_len );
5134 }
5135#endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */
5136
5137#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
5138 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
5139 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005140 ssl_use_opaque_psk( ssl ) == 1 )
5141 {
5142 /* Perform PSK-to-MS expansion in a single step. */
5143 psa_status_t status;
5144 psa_algorithm_t alg;
5145 mbedtls_svc_key_id_t psk;
5146 psa_key_derivation_operation_t derivation =
5147 PSA_KEY_DERIVATION_OPERATION_INIT;
5148 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
5149
5150 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
5151
5152 psk = mbedtls_ssl_get_opaque_psk( ssl );
5153
5154 if( hash_alg == MBEDTLS_MD_SHA384 )
5155 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
5156 else
5157 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
5158
5159 status = setup_psa_key_derivation( &derivation, psk, alg,
5160 salt, salt_len,
5161 (unsigned char const *) lbl,
5162 (size_t) strlen( lbl ),
5163 master_secret_len );
5164 if( status != PSA_SUCCESS )
5165 {
5166 psa_key_derivation_abort( &derivation );
5167 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5168 }
5169
5170 status = psa_key_derivation_output_bytes( &derivation,
5171 master,
5172 master_secret_len );
5173 if( status != PSA_SUCCESS )
5174 {
5175 psa_key_derivation_abort( &derivation );
5176 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5177 }
5178
5179 status = psa_key_derivation_abort( &derivation );
5180 if( status != PSA_SUCCESS )
5181 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5182 }
5183 else
5184#endif
5185 {
5186 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
5187 lbl, salt, salt_len,
5188 master,
5189 master_secret_len );
5190 if( ret != 0 )
5191 {
5192 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
5193 return( ret );
5194 }
5195
5196 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
5197 handshake->premaster,
5198 handshake->pmslen );
5199
5200 mbedtls_platform_zeroize( handshake->premaster,
5201 sizeof(handshake->premaster) );
5202 }
5203
5204 return( 0 );
5205}
5206
Jerry Yud62f87e2022-02-17 14:09:02 +08005207int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
5208{
5209 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5210 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5211 ssl->handshake->ciphersuite_info;
5212
5213 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
5214
5215 /* Set PRF, calc_verify and calc_finished function pointers */
5216 ret = ssl_set_handshake_prfs( ssl->handshake,
Jerry Yud62f87e2022-02-17 14:09:02 +08005217 ciphersuite_info->mac );
5218 if( ret != 0 )
5219 {
5220 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
5221 return( ret );
5222 }
5223
5224 /* Compute master secret if needed */
5225 ret = ssl_compute_master( ssl->handshake,
5226 ssl->session_negotiate->master,
5227 ssl );
5228 if( ret != 0 )
5229 {
5230 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
5231 return( ret );
5232 }
5233
5234 /* Swap the client and server random values:
5235 * - MS derivation wanted client+server (RFC 5246 8.1)
5236 * - key derivation wants server+client (RFC 5246 6.3) */
5237 {
5238 unsigned char tmp[64];
5239 memcpy( tmp, ssl->handshake->randbytes, 64 );
5240 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
5241 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
5242 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
5243 }
5244
5245 /* Populate transform structure */
5246 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
5247 ssl->session_negotiate->ciphersuite,
5248 ssl->session_negotiate->master,
5249#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
5250 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5251 ssl->session_negotiate->encrypt_then_mac,
5252#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
5253 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
5254 ssl->handshake->tls_prf,
5255 ssl->handshake->randbytes,
5256 ssl->minor_ver,
5257 ssl->conf->endpoint,
5258 ssl );
5259 if( ret != 0 )
5260 {
5261 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
5262 return( ret );
5263 }
5264
5265 /* We no longer need Server/ClientHello.random values */
5266 mbedtls_platform_zeroize( ssl->handshake->randbytes,
5267 sizeof( ssl->handshake->randbytes ) );
5268
5269 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
5270
5271 return( 0 );
5272}
Jerry Yu8392e0d2022-02-17 14:10:24 +08005273
Ronald Cron4dcbca92022-03-07 10:21:40 +01005274int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
5275{
Ronald Cron4dcbca92022-03-07 10:21:40 +01005276 switch( md )
5277 {
5278#if defined(MBEDTLS_SHA384_C)
5279 case MBEDTLS_SSL_HASH_SHA384:
5280 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
5281 break;
5282#endif
5283#if defined(MBEDTLS_SHA256_C)
5284 case MBEDTLS_SSL_HASH_SHA256:
5285 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
5286 break;
5287#endif
5288 default:
5289 return( -1 );
5290 }
5291
Ronald Cronc2f13a02022-03-07 10:25:24 +01005292 return( 0 );
Ronald Cron4dcbca92022-03-07 10:21:40 +01005293}
5294
Jerry Yu8392e0d2022-02-17 14:10:24 +08005295#if defined(MBEDTLS_SHA256_C)
5296void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
5297 unsigned char *hash,
5298 size_t *hlen )
5299{
5300#if defined(MBEDTLS_USE_PSA_CRYPTO)
5301 size_t hash_size;
5302 psa_status_t status;
5303 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
5304
5305 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
5306 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
5307 if( status != PSA_SUCCESS )
5308 {
5309 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5310 return;
5311 }
5312
5313 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
5314 if( status != PSA_SUCCESS )
5315 {
5316 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5317 return;
5318 }
5319
5320 *hlen = 32;
5321 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5322 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5323#else
5324 mbedtls_sha256_context sha256;
5325
5326 mbedtls_sha256_init( &sha256 );
5327
5328 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
5329
5330 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
5331 mbedtls_sha256_finish( &sha256, hash );
5332
5333 *hlen = 32;
5334
5335 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
5336 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
5337
5338 mbedtls_sha256_free( &sha256 );
5339#endif /* MBEDTLS_USE_PSA_CRYPTO */
5340 return;
5341}
5342#endif /* MBEDTLS_SHA256_C */
5343
Jerry Yuc1cb3842022-02-17 14:13:48 +08005344#if defined(MBEDTLS_SHA384_C)
5345void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
5346 unsigned char *hash,
5347 size_t *hlen )
5348{
5349#if defined(MBEDTLS_USE_PSA_CRYPTO)
5350 size_t hash_size;
5351 psa_status_t status;
5352 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
5353
5354 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
5355 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
5356 if( status != PSA_SUCCESS )
5357 {
5358 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5359 return;
5360 }
5361
5362 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
5363 if( status != PSA_SUCCESS )
5364 {
5365 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5366 return;
5367 }
5368
5369 *hlen = 48;
5370 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5371 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5372#else
5373 mbedtls_sha512_context sha512;
5374
5375 mbedtls_sha512_init( &sha512 );
5376
5377 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
5378
5379 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
5380 mbedtls_sha512_finish( &sha512, hash );
5381
5382 *hlen = 48;
5383
5384 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
5385 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
5386
5387 mbedtls_sha512_free( &sha512 );
5388#endif /* MBEDTLS_USE_PSA_CRYPTO */
5389 return;
5390}
5391#endif /* MBEDTLS_SHA384_C */
5392
Jerry Yuce3dca42022-02-17 14:16:37 +08005393#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
5394int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
5395{
5396 unsigned char *p = ssl->handshake->premaster;
5397 unsigned char *end = p + sizeof( ssl->handshake->premaster );
5398 const unsigned char *psk = NULL;
5399 size_t psk_len = 0;
5400
5401 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
5402 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
5403 {
5404 /*
5405 * This should never happen because the existence of a PSK is always
5406 * checked before calling this function
5407 */
5408 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5409 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5410 }
5411
5412 /*
5413 * PMS = struct {
5414 * opaque other_secret<0..2^16-1>;
5415 * opaque psk<0..2^16-1>;
5416 * };
5417 * with "other_secret" depending on the particular key exchange
5418 */
5419#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
5420 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
5421 {
5422 if( end - p < 2 )
5423 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5424
5425 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
5426 p += 2;
5427
5428 if( end < p || (size_t)( end - p ) < psk_len )
5429 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5430
5431 memset( p, 0, psk_len );
5432 p += psk_len;
5433 }
5434 else
5435#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
5436#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
5437 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
5438 {
5439 /*
5440 * other_secret already set by the ClientKeyExchange message,
5441 * and is 48 bytes long
5442 */
5443 if( end - p < 2 )
5444 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5445
5446 *p++ = 0;
5447 *p++ = 48;
5448 p += 48;
5449 }
5450 else
5451#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
5452#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
5453 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
5454 {
5455 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5456 size_t len;
5457
5458 /* Write length only when we know the actual value */
5459 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
5460 p + 2, end - ( p + 2 ), &len,
5461 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
5462 {
5463 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
5464 return( ret );
5465 }
5466 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
5467 p += 2 + len;
5468
5469 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
5470 }
5471 else
5472#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
5473#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
5474 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
5475 {
5476 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5477 size_t zlen;
5478
5479 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
5480 p + 2, end - ( p + 2 ),
5481 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
5482 {
5483 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
5484 return( ret );
5485 }
5486
5487 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
5488 p += 2 + zlen;
5489
5490 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
5491 MBEDTLS_DEBUG_ECDH_Z );
5492 }
5493 else
5494#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
5495 {
5496 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5497 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5498 }
5499
5500 /* opaque psk<0..2^16-1>; */
5501 if( end - p < 2 )
5502 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5503
5504 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
5505 p += 2;
5506
5507 if( end < p || (size_t)( end - p ) < psk_len )
5508 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5509
5510 memcpy( p, psk, psk_len );
5511 p += psk_len;
5512
5513 ssl->handshake->pmslen = p - ssl->handshake->premaster;
5514
5515 return( 0 );
5516}
5517#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08005518
5519#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
5520static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
5521
5522#if defined(MBEDTLS_SSL_PROTO_DTLS)
5523int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
5524{
5525 /* If renegotiation is not enforced, retransmit until we would reach max
5526 * timeout if we were using the usual handshake doubling scheme */
5527 if( ssl->conf->renego_max_records < 0 )
5528 {
5529 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
5530 unsigned char doublings = 1;
5531
5532 while( ratio != 0 )
5533 {
5534 ++doublings;
5535 ratio >>= 1;
5536 }
5537
5538 if( ++ssl->renego_records_seen > doublings )
5539 {
5540 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
5541 return( 0 );
5542 }
5543 }
5544
5545 return( ssl_write_hello_request( ssl ) );
5546}
5547#endif
5548#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08005549
Jerry Yud9526692022-02-17 14:23:47 +08005550/*
5551 * Handshake functions
5552 */
5553#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
5554/* No certificate support -> dummy functions */
5555int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
5556{
5557 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5558 ssl->handshake->ciphersuite_info;
5559
5560 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
5561
5562 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5563 {
5564 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5565 ssl->state++;
5566 return( 0 );
5567 }
5568
5569 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5570 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5571}
5572
5573int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
5574{
5575 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5576 ssl->handshake->ciphersuite_info;
5577
5578 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
5579
5580 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5581 {
5582 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5583 ssl->state++;
5584 return( 0 );
5585 }
5586
5587 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5588 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5589}
5590
5591#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
5592/* Some certificate support -> implement write and parse */
5593
5594int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
5595{
5596 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5597 size_t i, n;
5598 const mbedtls_x509_crt *crt;
5599 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5600 ssl->handshake->ciphersuite_info;
5601
5602 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
5603
5604 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5605 {
5606 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5607 ssl->state++;
5608 return( 0 );
5609 }
5610
5611#if defined(MBEDTLS_SSL_CLI_C)
5612 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5613 {
5614 if( ssl->handshake->client_auth == 0 )
5615 {
5616 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5617 ssl->state++;
5618 return( 0 );
5619 }
5620 }
5621#endif /* MBEDTLS_SSL_CLI_C */
5622#if defined(MBEDTLS_SSL_SRV_C)
5623 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5624 {
5625 if( mbedtls_ssl_own_cert( ssl ) == NULL )
5626 {
5627 /* Should never happen because we shouldn't have picked the
5628 * ciphersuite if we don't have a certificate. */
5629 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5630 }
5631 }
5632#endif
5633
5634 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
5635
5636 /*
5637 * 0 . 0 handshake type
5638 * 1 . 3 handshake length
5639 * 4 . 6 length of all certs
5640 * 7 . 9 length of cert. 1
5641 * 10 . n-1 peer certificate
5642 * n . n+2 length of cert. 2
5643 * n+3 . ... upper level cert, etc.
5644 */
5645 i = 7;
5646 crt = mbedtls_ssl_own_cert( ssl );
5647
5648 while( crt != NULL )
5649 {
5650 n = crt->raw.len;
5651 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
5652 {
5653 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
5654 " > %" MBEDTLS_PRINTF_SIZET,
5655 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
5656 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5657 }
5658
5659 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
5660 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
5661 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
5662
5663 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
5664 i += n; crt = crt->next;
5665 }
5666
5667 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
5668 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
5669 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
5670
5671 ssl->out_msglen = i;
5672 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5673 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
5674
5675 ssl->state++;
5676
5677 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
5678 {
5679 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
5680 return( ret );
5681 }
5682
5683 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
5684
5685 return( ret );
5686}
5687
5688#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
5689
5690#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5691static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
5692 unsigned char *crt_buf,
5693 size_t crt_buf_len )
5694{
5695 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
5696
5697 if( peer_crt == NULL )
5698 return( -1 );
5699
5700 if( peer_crt->raw.len != crt_buf_len )
5701 return( -1 );
5702
5703 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
5704}
5705#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5706static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
5707 unsigned char *crt_buf,
5708 size_t crt_buf_len )
5709{
5710 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5711 unsigned char const * const peer_cert_digest =
5712 ssl->session->peer_cert_digest;
5713 mbedtls_md_type_t const peer_cert_digest_type =
5714 ssl->session->peer_cert_digest_type;
5715 mbedtls_md_info_t const * const digest_info =
5716 mbedtls_md_info_from_type( peer_cert_digest_type );
5717 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
5718 size_t digest_len;
5719
5720 if( peer_cert_digest == NULL || digest_info == NULL )
5721 return( -1 );
5722
5723 digest_len = mbedtls_md_get_size( digest_info );
5724 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
5725 return( -1 );
5726
5727 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
5728 if( ret != 0 )
5729 return( -1 );
5730
5731 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
5732}
5733#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5734#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
5735
5736/*
5737 * Once the certificate message is read, parse it into a cert chain and
5738 * perform basic checks, but leave actual verification to the caller
5739 */
5740static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
5741 mbedtls_x509_crt *chain )
5742{
5743 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5744#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
5745 int crt_cnt=0;
5746#endif
5747 size_t i, n;
5748 uint8_t alert;
5749
5750 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
5751 {
5752 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5753 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5754 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
5755 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
5756 }
5757
5758 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
5759 {
5760 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5761 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
5762 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
5763 }
5764
5765 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
5766 {
5767 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5768 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5769 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5770 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5771 }
5772
5773 i = mbedtls_ssl_hs_hdr_len( ssl );
5774
5775 /*
5776 * Same message structure as in mbedtls_ssl_write_certificate()
5777 */
5778 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
5779
5780 if( ssl->in_msg[i] != 0 ||
5781 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
5782 {
5783 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5784 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5785 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5786 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5787 }
5788
5789 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
5790 i += 3;
5791
5792 /* Iterate through and parse the CRTs in the provided chain. */
5793 while( i < ssl->in_hslen )
5794 {
5795 /* Check that there's room for the next CRT's length fields. */
5796 if ( i + 3 > ssl->in_hslen ) {
5797 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5798 mbedtls_ssl_send_alert_message( ssl,
5799 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5800 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5801 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5802 }
5803 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
5804 * anything beyond 2**16 ~ 64K. */
5805 if( ssl->in_msg[i] != 0 )
5806 {
5807 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5808 mbedtls_ssl_send_alert_message( ssl,
5809 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5810 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
5811 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
5812 }
5813
5814 /* Read length of the next CRT in the chain. */
5815 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
5816 | (unsigned int) ssl->in_msg[i + 2];
5817 i += 3;
5818
5819 if( n < 128 || i + n > ssl->in_hslen )
5820 {
5821 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5822 mbedtls_ssl_send_alert_message( ssl,
5823 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5824 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5825 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5826 }
5827
5828 /* Check if we're handling the first CRT in the chain. */
5829#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
5830 if( crt_cnt++ == 0 &&
5831 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
5832 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
5833 {
5834 /* During client-side renegotiation, check that the server's
5835 * end-CRTs hasn't changed compared to the initial handshake,
5836 * mitigating the triple handshake attack. On success, reuse
5837 * the original end-CRT instead of parsing it again. */
5838 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
5839 if( ssl_check_peer_crt_unchanged( ssl,
5840 &ssl->in_msg[i],
5841 n ) != 0 )
5842 {
5843 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
5844 mbedtls_ssl_send_alert_message( ssl,
5845 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5846 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
5847 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
5848 }
5849
5850 /* Now we can safely free the original chain. */
5851 ssl_clear_peer_cert( ssl->session );
5852 }
5853#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
5854
5855 /* Parse the next certificate in the chain. */
5856#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5857 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
5858#else
5859 /* If we don't need to store the CRT chain permanently, parse
5860 * it in-place from the input buffer instead of making a copy. */
5861 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
5862#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5863 switch( ret )
5864 {
5865 case 0: /*ok*/
5866 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
5867 /* Ignore certificate with an unknown algorithm: maybe a
5868 prior certificate was already trusted. */
5869 break;
5870
5871 case MBEDTLS_ERR_X509_ALLOC_FAILED:
5872 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
5873 goto crt_parse_der_failed;
5874
5875 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
5876 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
5877 goto crt_parse_der_failed;
5878
5879 default:
5880 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
5881 crt_parse_der_failed:
5882 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
5883 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
5884 return( ret );
5885 }
5886
5887 i += n;
5888 }
5889
5890 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
5891 return( 0 );
5892}
5893
5894#if defined(MBEDTLS_SSL_SRV_C)
5895static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
5896{
5897 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5898 return( -1 );
5899
5900 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
5901 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
5902 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
5903 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
5904 {
5905 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
5906 return( 0 );
5907 }
5908 return( -1 );
5909}
5910#endif /* MBEDTLS_SSL_SRV_C */
5911
5912/* Check if a certificate message is expected.
5913 * Return either
5914 * - SSL_CERTIFICATE_EXPECTED, or
5915 * - SSL_CERTIFICATE_SKIP
5916 * indicating whether a Certificate message is expected or not.
5917 */
5918#define SSL_CERTIFICATE_EXPECTED 0
5919#define SSL_CERTIFICATE_SKIP 1
5920static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
5921 int authmode )
5922{
5923 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5924 ssl->handshake->ciphersuite_info;
5925
5926 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5927 return( SSL_CERTIFICATE_SKIP );
5928
5929#if defined(MBEDTLS_SSL_SRV_C)
5930 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5931 {
5932 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
5933 return( SSL_CERTIFICATE_SKIP );
5934
5935 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
5936 {
5937 ssl->session_negotiate->verify_result =
5938 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
5939 return( SSL_CERTIFICATE_SKIP );
5940 }
5941 }
5942#else
5943 ((void) authmode);
5944#endif /* MBEDTLS_SSL_SRV_C */
5945
5946 return( SSL_CERTIFICATE_EXPECTED );
5947}
5948
5949static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
5950 int authmode,
5951 mbedtls_x509_crt *chain,
5952 void *rs_ctx )
5953{
5954 int ret = 0;
5955 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5956 ssl->handshake->ciphersuite_info;
5957 int have_ca_chain = 0;
5958
5959 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
5960 void *p_vrfy;
5961
5962 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
5963 return( 0 );
5964
5965 if( ssl->f_vrfy != NULL )
5966 {
5967 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
5968 f_vrfy = ssl->f_vrfy;
5969 p_vrfy = ssl->p_vrfy;
5970 }
5971 else
5972 {
5973 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
5974 f_vrfy = ssl->conf->f_vrfy;
5975 p_vrfy = ssl->conf->p_vrfy;
5976 }
5977
5978 /*
5979 * Main check: verify certificate
5980 */
5981#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
5982 if( ssl->conf->f_ca_cb != NULL )
5983 {
5984 ((void) rs_ctx);
5985 have_ca_chain = 1;
5986
5987 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
5988 ret = mbedtls_x509_crt_verify_with_ca_cb(
5989 chain,
5990 ssl->conf->f_ca_cb,
5991 ssl->conf->p_ca_cb,
5992 ssl->conf->cert_profile,
5993 ssl->hostname,
5994 &ssl->session_negotiate->verify_result,
5995 f_vrfy, p_vrfy );
5996 }
5997 else
5998#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
5999 {
6000 mbedtls_x509_crt *ca_chain;
6001 mbedtls_x509_crl *ca_crl;
6002
6003#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6004 if( ssl->handshake->sni_ca_chain != NULL )
6005 {
6006 ca_chain = ssl->handshake->sni_ca_chain;
6007 ca_crl = ssl->handshake->sni_ca_crl;
6008 }
6009 else
6010#endif
6011 {
6012 ca_chain = ssl->conf->ca_chain;
6013 ca_crl = ssl->conf->ca_crl;
6014 }
6015
6016 if( ca_chain != NULL )
6017 have_ca_chain = 1;
6018
6019 ret = mbedtls_x509_crt_verify_restartable(
6020 chain,
6021 ca_chain, ca_crl,
6022 ssl->conf->cert_profile,
6023 ssl->hostname,
6024 &ssl->session_negotiate->verify_result,
6025 f_vrfy, p_vrfy, rs_ctx );
6026 }
6027
6028 if( ret != 0 )
6029 {
6030 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
6031 }
6032
6033#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6034 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
6035 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
6036#endif
6037
6038 /*
6039 * Secondary checks: always done, but change 'ret' only if it was 0
6040 */
6041
6042#if defined(MBEDTLS_ECP_C)
6043 {
6044 const mbedtls_pk_context *pk = &chain->pk;
6045
6046 /* If certificate uses an EC key, make sure the curve is OK */
6047 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
6048 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
6049 {
6050 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
6051
6052 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
6053 if( ret == 0 )
6054 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6055 }
6056 }
6057#endif /* MBEDTLS_ECP_C */
6058
6059 if( mbedtls_ssl_check_cert_usage( chain,
6060 ciphersuite_info,
6061 ! ssl->conf->endpoint,
6062 &ssl->session_negotiate->verify_result ) != 0 )
6063 {
6064 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
6065 if( ret == 0 )
6066 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6067 }
6068
6069 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
6070 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
6071 * with details encoded in the verification flags. All other kinds
6072 * of error codes, including those from the user provided f_vrfy
6073 * functions, are treated as fatal and lead to a failure of
6074 * ssl_parse_certificate even if verification was optional. */
6075 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
6076 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
6077 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
6078 {
6079 ret = 0;
6080 }
6081
6082 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
6083 {
6084 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
6085 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
6086 }
6087
6088 if( ret != 0 )
6089 {
6090 uint8_t alert;
6091
6092 /* The certificate may have been rejected for several reasons.
6093 Pick one and send the corresponding alert. Which alert to send
6094 may be a subject of debate in some cases. */
6095 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
6096 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
6097 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
6098 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6099 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
6100 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6101 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
6102 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6103 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
6104 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6105 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
6106 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6107 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
6108 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6109 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
6110 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
6111 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
6112 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
6113 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
6114 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
6115 else
6116 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
6117 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6118 alert );
6119 }
6120
6121#if defined(MBEDTLS_DEBUG_C)
6122 if( ssl->session_negotiate->verify_result != 0 )
6123 {
6124 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
6125 (unsigned int) ssl->session_negotiate->verify_result ) );
6126 }
6127 else
6128 {
6129 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
6130 }
6131#endif /* MBEDTLS_DEBUG_C */
6132
6133 return( ret );
6134}
6135
6136#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6137static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
6138 unsigned char *start, size_t len )
6139{
6140 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6141 /* Remember digest of the peer's end-CRT. */
6142 ssl->session_negotiate->peer_cert_digest =
6143 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
6144 if( ssl->session_negotiate->peer_cert_digest == NULL )
6145 {
6146 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
6147 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
6148 mbedtls_ssl_send_alert_message( ssl,
6149 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6150 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6151
6152 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
6153 }
6154
6155 ret = mbedtls_md( mbedtls_md_info_from_type(
6156 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
6157 start, len,
6158 ssl->session_negotiate->peer_cert_digest );
6159
6160 ssl->session_negotiate->peer_cert_digest_type =
6161 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
6162 ssl->session_negotiate->peer_cert_digest_len =
6163 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
6164
6165 return( ret );
6166}
6167
6168static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
6169 unsigned char *start, size_t len )
6170{
6171 unsigned char *end = start + len;
6172 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6173
6174 /* Make a copy of the peer's raw public key. */
6175 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
6176 ret = mbedtls_pk_parse_subpubkey( &start, end,
6177 &ssl->handshake->peer_pubkey );
6178 if( ret != 0 )
6179 {
6180 /* We should have parsed the public key before. */
6181 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6182 }
6183
6184 return( 0 );
6185}
6186#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6187
6188int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6189{
6190 int ret = 0;
6191 int crt_expected;
6192#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6193 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
6194 ? ssl->handshake->sni_authmode
6195 : ssl->conf->authmode;
6196#else
6197 const int authmode = ssl->conf->authmode;
6198#endif
6199 void *rs_ctx = NULL;
6200 mbedtls_x509_crt *chain = NULL;
6201
6202 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6203
6204 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
6205 if( crt_expected == SSL_CERTIFICATE_SKIP )
6206 {
6207 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6208 goto exit;
6209 }
6210
6211#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6212 if( ssl->handshake->ecrs_enabled &&
6213 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
6214 {
6215 chain = ssl->handshake->ecrs_peer_cert;
6216 ssl->handshake->ecrs_peer_cert = NULL;
6217 goto crt_verify;
6218 }
6219#endif
6220
6221 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
6222 {
6223 /* mbedtls_ssl_read_record may have sent an alert already. We
6224 let it decide whether to alert. */
6225 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6226 goto exit;
6227 }
6228
6229#if defined(MBEDTLS_SSL_SRV_C)
6230 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
6231 {
6232 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
6233
6234 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
6235 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
6236
6237 goto exit;
6238 }
6239#endif /* MBEDTLS_SSL_SRV_C */
6240
6241 /* Clear existing peer CRT structure in case we tried to
6242 * reuse a session but it failed, and allocate a new one. */
6243 ssl_clear_peer_cert( ssl->session_negotiate );
6244
6245 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
6246 if( chain == NULL )
6247 {
6248 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
6249 sizeof( mbedtls_x509_crt ) ) );
6250 mbedtls_ssl_send_alert_message( ssl,
6251 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6252 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6253
6254 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
6255 goto exit;
6256 }
6257 mbedtls_x509_crt_init( chain );
6258
6259 ret = ssl_parse_certificate_chain( ssl, chain );
6260 if( ret != 0 )
6261 goto exit;
6262
6263#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6264 if( ssl->handshake->ecrs_enabled)
6265 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
6266
6267crt_verify:
6268 if( ssl->handshake->ecrs_enabled)
6269 rs_ctx = &ssl->handshake->ecrs_ctx;
6270#endif
6271
6272 ret = ssl_parse_certificate_verify( ssl, authmode,
6273 chain, rs_ctx );
6274 if( ret != 0 )
6275 goto exit;
6276
6277#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6278 {
6279 unsigned char *crt_start, *pk_start;
6280 size_t crt_len, pk_len;
6281
6282 /* We parse the CRT chain without copying, so
6283 * these pointers point into the input buffer,
6284 * and are hence still valid after freeing the
6285 * CRT chain. */
6286
6287 crt_start = chain->raw.p;
6288 crt_len = chain->raw.len;
6289
6290 pk_start = chain->pk_raw.p;
6291 pk_len = chain->pk_raw.len;
6292
6293 /* Free the CRT structures before computing
6294 * digest and copying the peer's public key. */
6295 mbedtls_x509_crt_free( chain );
6296 mbedtls_free( chain );
6297 chain = NULL;
6298
6299 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
6300 if( ret != 0 )
6301 goto exit;
6302
6303 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
6304 if( ret != 0 )
6305 goto exit;
6306 }
6307#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6308 /* Pass ownership to session structure. */
6309 ssl->session_negotiate->peer_cert = chain;
6310 chain = NULL;
6311#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6312
6313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
6314
6315exit:
6316
6317 if( ret == 0 )
6318 ssl->state++;
6319
6320#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6321 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
6322 {
6323 ssl->handshake->ecrs_peer_cert = chain;
6324 chain = NULL;
6325 }
6326#endif
6327
6328 if( chain != NULL )
6329 {
6330 mbedtls_x509_crt_free( chain );
6331 mbedtls_free( chain );
6332 }
6333
6334 return( ret );
6335}
6336#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6337
Jerry Yu615bd6f2022-02-17 14:25:15 +08006338#if defined(MBEDTLS_SHA256_C)
6339static void ssl_calc_finished_tls_sha256(
6340 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
6341{
6342 int len = 12;
6343 const char *sender;
6344 unsigned char padbuf[32];
6345#if defined(MBEDTLS_USE_PSA_CRYPTO)
6346 size_t hash_size;
6347 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
6348 psa_status_t status;
6349#else
6350 mbedtls_sha256_context sha256;
6351#endif
6352
6353 mbedtls_ssl_session *session = ssl->session_negotiate;
6354 if( !session )
6355 session = ssl->session;
6356
6357 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
6358 ? "client finished"
6359 : "server finished";
6360
6361#if defined(MBEDTLS_USE_PSA_CRYPTO)
6362 sha256_psa = psa_hash_operation_init();
6363
6364 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
6365
6366 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
6367 if( status != PSA_SUCCESS )
6368 {
6369 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6370 return;
6371 }
6372
6373 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
6374 if( status != PSA_SUCCESS )
6375 {
6376 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6377 return;
6378 }
6379 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
6380#else
6381
6382 mbedtls_sha256_init( &sha256 );
6383
6384 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
6385
6386 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
6387
6388 /*
6389 * TLSv1.2:
6390 * hash = PRF( master, finished_label,
6391 * Hash( handshake ) )[0.11]
6392 */
6393
6394#if !defined(MBEDTLS_SHA256_ALT)
6395 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
6396 sha256.state, sizeof( sha256.state ) );
6397#endif
6398
6399 mbedtls_sha256_finish( &sha256, padbuf );
6400 mbedtls_sha256_free( &sha256 );
6401#endif /* MBEDTLS_USE_PSA_CRYPTO */
6402
6403 ssl->handshake->tls_prf( session->master, 48, sender,
6404 padbuf, 32, buf, len );
6405
6406 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
6407
6408 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6409
6410 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6411}
6412#endif /* MBEDTLS_SHA256_C */
6413
Jerry Yub7ba49e2022-02-17 14:25:53 +08006414
6415#if defined(MBEDTLS_SHA384_C)
6416
6417static void ssl_calc_finished_tls_sha384(
6418 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
6419{
6420 int len = 12;
6421 const char *sender;
6422 unsigned char padbuf[48];
6423#if defined(MBEDTLS_USE_PSA_CRYPTO)
6424 size_t hash_size;
6425 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
6426 psa_status_t status;
6427#else
6428 mbedtls_sha512_context sha512;
6429#endif
6430
6431 mbedtls_ssl_session *session = ssl->session_negotiate;
6432 if( !session )
6433 session = ssl->session;
6434
6435 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
6436 ? "client finished"
6437 : "server finished";
6438
6439#if defined(MBEDTLS_USE_PSA_CRYPTO)
6440 sha384_psa = psa_hash_operation_init();
6441
6442 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
6443
6444 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
6445 if( status != PSA_SUCCESS )
6446 {
6447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6448 return;
6449 }
6450
6451 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
6452 if( status != PSA_SUCCESS )
6453 {
6454 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6455 return;
6456 }
6457 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
6458#else
6459 mbedtls_sha512_init( &sha512 );
6460
6461 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
6462
6463 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
6464
6465 /*
6466 * TLSv1.2:
6467 * hash = PRF( master, finished_label,
6468 * Hash( handshake ) )[0.11]
6469 */
6470
6471#if !defined(MBEDTLS_SHA512_ALT)
6472 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
6473 sha512.state, sizeof( sha512.state ) );
6474#endif
6475 mbedtls_sha512_finish( &sha512, padbuf );
6476
6477 mbedtls_sha512_free( &sha512 );
6478#endif
6479
6480 ssl->handshake->tls_prf( session->master, 48, sender,
6481 padbuf, 48, buf, len );
6482
6483 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
6484
6485 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6486
6487 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6488}
6489#endif /* MBEDTLS_SHA384_C */
6490
Jerry Yuaef00152022-02-17 14:27:31 +08006491void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
6492{
6493 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
6494
6495 /*
6496 * Free our handshake params
6497 */
6498 mbedtls_ssl_handshake_free( ssl );
6499 mbedtls_free( ssl->handshake );
6500 ssl->handshake = NULL;
6501
6502 /*
6503 * Free the previous transform and swith in the current one
6504 */
6505 if( ssl->transform )
6506 {
6507 mbedtls_ssl_transform_free( ssl->transform );
6508 mbedtls_free( ssl->transform );
6509 }
6510 ssl->transform = ssl->transform_negotiate;
6511 ssl->transform_negotiate = NULL;
6512
6513 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
6514}
6515
Jerry Yu2a9fff52022-02-17 14:28:51 +08006516void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
6517{
6518 int resume = ssl->handshake->resume;
6519
6520 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
6521
6522#if defined(MBEDTLS_SSL_RENEGOTIATION)
6523 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
6524 {
6525 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
6526 ssl->renego_records_seen = 0;
6527 }
6528#endif
6529
6530 /*
6531 * Free the previous session and switch in the current one
6532 */
6533 if( ssl->session )
6534 {
6535#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6536 /* RFC 7366 3.1: keep the EtM state */
6537 ssl->session_negotiate->encrypt_then_mac =
6538 ssl->session->encrypt_then_mac;
6539#endif
6540
6541 mbedtls_ssl_session_free( ssl->session );
6542 mbedtls_free( ssl->session );
6543 }
6544 ssl->session = ssl->session_negotiate;
6545 ssl->session_negotiate = NULL;
6546
6547 /*
6548 * Add cache entry
6549 */
6550 if( ssl->conf->f_set_cache != NULL &&
6551 ssl->session->id_len != 0 &&
6552 resume == 0 )
6553 {
6554 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
6555 ssl->session->id,
6556 ssl->session->id_len,
6557 ssl->session ) != 0 )
6558 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
6559 }
6560
6561#if defined(MBEDTLS_SSL_PROTO_DTLS)
6562 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
6563 ssl->handshake->flight != NULL )
6564 {
6565 /* Cancel handshake timer */
6566 mbedtls_ssl_set_timer( ssl, 0 );
6567
6568 /* Keep last flight around in case we need to resend it:
6569 * we need the handshake and transform structures for that */
6570 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
6571 }
6572 else
6573#endif
6574 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
6575
6576 ssl->state++;
6577
6578 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
6579}
6580
Jerry Yu3c8e47b2022-02-17 14:30:01 +08006581int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
6582{
6583 int ret, hash_len;
6584
6585 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
6586
6587 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
6588
6589 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
6590
6591 /*
6592 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
6593 * may define some other value. Currently (early 2016), no defined
6594 * ciphersuite does this (and this is unlikely to change as activity has
6595 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
6596 */
6597 hash_len = 12;
6598
6599#if defined(MBEDTLS_SSL_RENEGOTIATION)
6600 ssl->verify_data_len = hash_len;
6601 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
6602#endif
6603
6604 ssl->out_msglen = 4 + hash_len;
6605 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6606 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
6607
6608 /*
6609 * In case of session resuming, invert the client and server
6610 * ChangeCipherSpec messages order.
6611 */
6612 if( ssl->handshake->resume != 0 )
6613 {
6614#if defined(MBEDTLS_SSL_CLI_C)
6615 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6616 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
6617#endif
6618#if defined(MBEDTLS_SSL_SRV_C)
6619 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6620 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
6621#endif
6622 }
6623 else
6624 ssl->state++;
6625
6626 /*
6627 * Switch to our negotiated transform and session parameters for outbound
6628 * data.
6629 */
6630 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
6631
6632#if defined(MBEDTLS_SSL_PROTO_DTLS)
6633 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6634 {
6635 unsigned char i;
6636
6637 /* Remember current epoch settings for resending */
6638 ssl->handshake->alt_transform_out = ssl->transform_out;
6639 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
6640 sizeof( ssl->handshake->alt_out_ctr ) );
6641
6642 /* Set sequence_number to zero */
6643 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
6644
6645
6646 /* Increment epoch */
6647 for( i = 2; i > 0; i-- )
6648 if( ++ssl->cur_out_ctr[i - 1] != 0 )
6649 break;
6650
6651 /* The loop goes to its end iff the counter is wrapping */
6652 if( i == 0 )
6653 {
6654 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
6655 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
6656 }
6657 }
6658 else
6659#endif /* MBEDTLS_SSL_PROTO_DTLS */
6660 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
6661
6662 ssl->transform_out = ssl->transform_negotiate;
6663 ssl->session_out = ssl->session_negotiate;
6664
6665#if defined(MBEDTLS_SSL_PROTO_DTLS)
6666 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6667 mbedtls_ssl_send_flight_completed( ssl );
6668#endif
6669
6670 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
6671 {
6672 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
6673 return( ret );
6674 }
6675
6676#if defined(MBEDTLS_SSL_PROTO_DTLS)
6677 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
6678 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
6679 {
6680 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
6681 return( ret );
6682 }
6683#endif
6684
6685 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
6686
6687 return( 0 );
6688}
6689
Jerry Yu0b3d7c12022-02-17 14:30:51 +08006690#define SSL_MAX_HASH_LEN 12
6691
6692int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
6693{
6694 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6695 unsigned int hash_len = 12;
6696 unsigned char buf[SSL_MAX_HASH_LEN];
6697
6698 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
6699
6700 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
6701
6702 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
6703 {
6704 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6705 goto exit;
6706 }
6707
6708 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
6709 {
6710 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6711 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6712 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6713 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
6714 goto exit;
6715 }
6716
6717 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
6718 {
6719 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6720 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6721 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
6722 goto exit;
6723 }
6724
6725 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
6726 {
6727 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6728 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6729 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6730 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
6731 goto exit;
6732 }
6733
6734 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
6735 buf, hash_len ) != 0 )
6736 {
6737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6738 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6739 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
6740 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
6741 goto exit;
6742 }
6743
6744#if defined(MBEDTLS_SSL_RENEGOTIATION)
6745 ssl->verify_data_len = hash_len;
6746 memcpy( ssl->peer_verify_data, buf, hash_len );
6747#endif
6748
6749 if( ssl->handshake->resume != 0 )
6750 {
6751#if defined(MBEDTLS_SSL_CLI_C)
6752 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6753 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
6754#endif
6755#if defined(MBEDTLS_SSL_SRV_C)
6756 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6757 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
6758#endif
6759 }
6760 else
6761 ssl->state++;
6762
6763#if defined(MBEDTLS_SSL_PROTO_DTLS)
6764 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6765 mbedtls_ssl_recv_flight_completed( ssl );
6766#endif
6767
6768 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
6769
6770exit:
6771 mbedtls_platform_zeroize( buf, hash_len );
6772 return( ret );
6773}
6774
Jerry Yu392112c2022-02-17 14:34:10 +08006775#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
6776/*
6777 * Helper to get TLS 1.2 PRF from ciphersuite
6778 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
6779 */
6780static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
6781{
6782#if defined(MBEDTLS_SHA384_C)
6783 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
6784 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
6785
6786 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
6787 return( tls_prf_sha384 );
6788#else
6789 (void) ciphersuite_id;
6790#endif
6791 return( tls_prf_sha256 );
6792}
6793#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08006794
6795static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
6796{
6797 ((void) tls_prf);
6798#if defined(MBEDTLS_SHA384_C)
6799 if( tls_prf == tls_prf_sha384 )
6800 {
6801 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
6802 }
6803 else
6804#endif
6805#if defined(MBEDTLS_SHA256_C)
6806 if( tls_prf == tls_prf_sha256 )
6807 {
6808 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
6809 }
6810 else
6811#endif
6812 return( MBEDTLS_SSL_TLS_PRF_NONE );
6813}
6814
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006815/*
6816 * Populate a transform structure with session keys and all the other
6817 * necessary information.
6818 *
6819 * Parameters:
6820 * - [in/out]: transform: structure to populate
6821 * [in] must be just initialised with mbedtls_ssl_transform_init()
6822 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
6823 * - [in] ciphersuite
6824 * - [in] master
6825 * - [in] encrypt_then_mac
6826 * - [in] compression
6827 * - [in] tls_prf: pointer to PRF to use for key derivation
6828 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
6829 * - [in] minor_ver: SSL/TLS minor version
6830 * - [in] endpoint: client or server
6831 * - [in] ssl: used for:
6832 * - ssl->conf->{f,p}_export_keys
6833 * [in] optionally used for:
6834 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
6835 */
6836static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
6837 int ciphersuite,
6838 const unsigned char master[48],
6839#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
6840 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6841 int encrypt_then_mac,
6842#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
6843 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
6844 ssl_tls_prf_t tls_prf,
6845 const unsigned char randbytes[64],
6846 int minor_ver,
6847 unsigned endpoint,
6848 const mbedtls_ssl_context *ssl )
6849{
6850 int ret = 0;
6851 unsigned char keyblk[256];
6852 unsigned char *key1;
6853 unsigned char *key2;
6854 unsigned char *mac_enc;
6855 unsigned char *mac_dec;
6856 size_t mac_key_len = 0;
6857 size_t iv_copy_len;
6858 size_t keylen;
6859 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
6860 const mbedtls_cipher_info_t *cipher_info;
Neil Armstronge4512952022-03-08 09:08:22 +01006861#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006862 const mbedtls_md_info_t *md_info;
Neil Armstronge4512952022-03-08 09:08:22 +01006863#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006864
6865#if defined(MBEDTLS_USE_PSA_CRYPTO)
6866 psa_key_type_t key_type;
6867 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
6868 psa_algorithm_t alg;
Neil Armstronge4512952022-03-08 09:08:22 +01006869 psa_algorithm_t mac_alg = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006870 size_t key_bits;
6871 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
6872#endif
6873
6874#if !defined(MBEDTLS_DEBUG_C) && \
6875 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6876 if( ssl->f_export_keys == NULL )
6877 {
6878 ssl = NULL; /* make sure we don't use it except for these cases */
6879 (void) ssl;
6880 }
6881#endif
6882
6883 /*
6884 * Some data just needs copying into the structure
6885 */
6886#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
6887 defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
6888 transform->encrypt_then_mac = encrypt_then_mac;
6889#endif
6890 transform->minor_ver = minor_ver;
6891
6892#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
6893 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
6894#endif
6895
6896#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6897 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
6898 {
6899 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
6900 * generation separate. This should never happen. */
6901 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6902 }
6903#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6904
6905 /*
6906 * Get various info structures
6907 */
6908 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
6909 if( ciphersuite_info == NULL )
6910 {
6911 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
6912 ciphersuite ) );
6913 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6914 }
6915
6916 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
6917 if( cipher_info == NULL )
6918 {
6919 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
6920 ciphersuite_info->cipher ) );
6921 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6922 }
6923
Neil Armstronge4512952022-03-08 09:08:22 +01006924#if defined(MBEDTLS_USE_PSA_CRYPTO)
6925 mac_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
6926 if( mac_alg == 0 )
6927 {
6928 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_psa_translate_md for %u not found",
6929 (unsigned) ciphersuite_info->mac ) );
6930 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6931 }
6932#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006933 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
6934 if( md_info == NULL )
6935 {
6936 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
6937 (unsigned) ciphersuite_info->mac ) );
6938 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6939 }
Neil Armstronge4512952022-03-08 09:08:22 +01006940#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08006941
6942#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6943 /* Copy own and peer's CID if the use of the CID
6944 * extension has been negotiated. */
6945 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
6946 {
6947 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
6948
6949 transform->in_cid_len = ssl->own_cid_len;
6950 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
6951 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
6952 transform->in_cid_len );
6953
6954 transform->out_cid_len = ssl->handshake->peer_cid_len;
6955 memcpy( transform->out_cid, ssl->handshake->peer_cid,
6956 ssl->handshake->peer_cid_len );
6957 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
6958 transform->out_cid_len );
6959 }
6960#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6961
6962 /*
6963 * Compute key block using the PRF
6964 */
6965 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
6966 if( ret != 0 )
6967 {
6968 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
6969 return( ret );
6970 }
6971
6972 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
6973 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
6974 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
6975 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
6976 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
6977
6978 /*
6979 * Determine the appropriate key, IV and MAC length.
6980 */
6981
6982 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
6983
6984#if defined(MBEDTLS_GCM_C) || \
6985 defined(MBEDTLS_CCM_C) || \
6986 defined(MBEDTLS_CHACHAPOLY_C)
6987 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_GCM ||
6988 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CCM ||
6989 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
6990 {
6991 size_t explicit_ivlen;
6992
6993 transform->maclen = 0;
6994 mac_key_len = 0;
6995 transform->taglen =
6996 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
6997
6998 /* All modes haves 96-bit IVs, but the length of the static parts vary
6999 * with mode and version:
7000 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
7001 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
7002 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
7003 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
7004 * sequence number).
7005 */
7006 transform->ivlen = 12;
7007 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
7008 transform->fixed_ivlen = 12;
7009 else
7010 transform->fixed_ivlen = 4;
7011
7012 /* Minimum length of encrypted record */
7013 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
7014 transform->minlen = explicit_ivlen + transform->taglen;
7015 }
7016 else
7017#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
7018#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
7019 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM ||
7020 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
7021 {
Neil Armstronge4512952022-03-08 09:08:22 +01007022#if defined(MBEDTLS_USE_PSA_CRYPTO)
7023 /* Get MAC length */
7024 mac_key_len = PSA_HASH_LENGTH(mac_alg);
7025#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007026 /* Initialize HMAC contexts */
7027 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
7028 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
7029 {
7030 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7031 goto end;
7032 }
7033
7034 /* Get MAC length */
7035 mac_key_len = mbedtls_md_get_size( md_info );
Neil Armstronge4512952022-03-08 09:08:22 +01007036#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007037 transform->maclen = mac_key_len;
7038
7039 /* IV length */
7040 transform->ivlen = cipher_info->iv_size;
7041
7042 /* Minimum length */
7043 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM )
7044 transform->minlen = transform->maclen;
7045 else
7046 {
7047 /*
7048 * GenericBlockCipher:
7049 * 1. if EtM is in use: one block plus MAC
7050 * otherwise: * first multiple of blocklen greater than maclen
7051 * 2. IV
7052 */
7053#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7054 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
7055 {
7056 transform->minlen = transform->maclen
7057 + cipher_info->block_size;
7058 }
7059 else
7060#endif
7061 {
7062 transform->minlen = transform->maclen
7063 + cipher_info->block_size
7064 - transform->maclen % cipher_info->block_size;
7065 }
7066
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007067 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
7068 {
7069 transform->minlen += transform->ivlen;
7070 }
7071 else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007072 {
7073 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7074 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7075 goto end;
7076 }
7077 }
7078 }
7079 else
7080#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7081 {
7082 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7083 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7084 }
7085
7086 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
7087 (unsigned) keylen,
7088 (unsigned) transform->minlen,
7089 (unsigned) transform->ivlen,
7090 (unsigned) transform->maclen ) );
7091
7092 /*
7093 * Finally setup the cipher contexts, IVs and MAC secrets.
7094 */
7095#if defined(MBEDTLS_SSL_CLI_C)
7096 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
7097 {
7098 key1 = keyblk + mac_key_len * 2;
7099 key2 = keyblk + mac_key_len * 2 + keylen;
7100
7101 mac_enc = keyblk;
7102 mac_dec = keyblk + mac_key_len;
7103
7104 /*
7105 * This is not used in TLS v1.1.
7106 */
7107 iv_copy_len = ( transform->fixed_ivlen ) ?
7108 transform->fixed_ivlen : transform->ivlen;
7109 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
7110 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
7111 iv_copy_len );
7112 }
7113 else
7114#endif /* MBEDTLS_SSL_CLI_C */
7115#if defined(MBEDTLS_SSL_SRV_C)
7116 if( endpoint == MBEDTLS_SSL_IS_SERVER )
7117 {
7118 key1 = keyblk + mac_key_len * 2 + keylen;
7119 key2 = keyblk + mac_key_len * 2;
7120
7121 mac_enc = keyblk + mac_key_len;
7122 mac_dec = keyblk;
7123
7124 /*
7125 * This is not used in TLS v1.1.
7126 */
7127 iv_copy_len = ( transform->fixed_ivlen ) ?
7128 transform->fixed_ivlen : transform->ivlen;
7129 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
7130 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
7131 iv_copy_len );
7132 }
7133 else
7134#endif /* MBEDTLS_SSL_SRV_C */
7135 {
7136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7137 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7138 goto end;
7139 }
7140
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007141 if( ssl != NULL && ssl->f_export_keys != NULL )
7142 {
7143 ssl->f_export_keys( ssl->p_export_keys,
7144 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
7145 master, 48,
7146 randbytes + 32,
7147 randbytes,
7148 tls_prf_get_type( tls_prf ) );
7149 }
7150
7151#if defined(MBEDTLS_USE_PSA_CRYPTO)
7152 if( ( status = mbedtls_ssl_cipher_to_psa( cipher_info->type,
7153 transform->taglen,
7154 &alg,
7155 &key_type,
7156 &key_bits ) ) != PSA_SUCCESS )
7157 {
7158 ret = psa_ssl_status_to_mbedtls( status );
7159 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", ret );
7160 goto end;
7161 }
7162
7163 transform->psa_alg = alg;
7164
7165 if ( alg != MBEDTLS_SSL_NULL_CIPHER )
7166 {
7167 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
7168 psa_set_key_algorithm( &attributes, alg );
7169 psa_set_key_type( &attributes, key_type );
7170
7171 if( ( status = psa_import_key( &attributes,
7172 key1,
7173 PSA_BITS_TO_BYTES( key_bits ),
7174 &transform->psa_key_enc ) ) != PSA_SUCCESS )
7175 {
7176 MBEDTLS_SSL_DEBUG_RET( 3, "psa_import_key", (int)status );
7177 ret = psa_ssl_status_to_mbedtls( status );
7178 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7179 goto end;
7180 }
7181
7182 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
7183
7184 if( ( status = psa_import_key( &attributes,
7185 key2,
7186 PSA_BITS_TO_BYTES( key_bits ),
7187 &transform->psa_key_dec ) ) != PSA_SUCCESS )
7188 {
7189 ret = psa_ssl_status_to_mbedtls( status );
7190 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7191 goto end;
7192 }
7193 }
7194#else
7195 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
7196 cipher_info ) ) != 0 )
7197 {
7198 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7199 goto end;
7200 }
7201
7202 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
7203 cipher_info ) ) != 0 )
7204 {
7205 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7206 goto end;
7207 }
7208
7209 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
7210 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7211 MBEDTLS_ENCRYPT ) ) != 0 )
7212 {
7213 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7214 goto end;
7215 }
7216
7217 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
7218 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7219 MBEDTLS_DECRYPT ) ) != 0 )
7220 {
7221 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7222 goto end;
7223 }
7224
7225#if defined(MBEDTLS_CIPHER_MODE_CBC)
7226 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
7227 {
7228 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
7229 MBEDTLS_PADDING_NONE ) ) != 0 )
7230 {
7231 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7232 goto end;
7233 }
7234
7235 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
7236 MBEDTLS_PADDING_NONE ) ) != 0 )
7237 {
7238 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7239 goto end;
7240 }
7241 }
7242#endif /* MBEDTLS_CIPHER_MODE_CBC */
7243#endif /* MBEDTLS_USE_PSA_CRYPTO */
7244
Neil Armstrong29c0c042022-03-17 17:47:28 +01007245#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
7246 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
7247 For AEAD-based ciphersuites, there is nothing to do here. */
7248 if( mac_key_len != 0 )
7249 {
7250#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01007251 transform->psa_mac_alg = PSA_ALG_HMAC( mac_alg );
Neil Armstrong29c0c042022-03-17 17:47:28 +01007252
7253 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
Neil Armstronge4512952022-03-08 09:08:22 +01007254 psa_set_key_algorithm( &attributes, PSA_ALG_HMAC( mac_alg ) );
Neil Armstrong29c0c042022-03-17 17:47:28 +01007255 psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
7256
7257 if( ( status = psa_import_key( &attributes,
7258 mac_enc, mac_key_len,
7259 &transform->psa_mac_enc ) ) != PSA_SUCCESS )
7260 {
7261 ret = psa_ssl_status_to_mbedtls( status );
7262 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7263 goto end;
7264 }
7265
Ronald Cronfb39f152022-03-25 14:36:28 +01007266 if( ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ) ||
7267 ( ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING ) &&
7268 ( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ) ) )
Neil Armstrong29c0c042022-03-17 17:47:28 +01007269 /* mbedtls_ct_hmac() requires the key to be exportable */
7270 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT |
7271 PSA_KEY_USAGE_VERIFY_HASH );
7272 else
7273 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
7274
7275 if( ( status = psa_import_key( &attributes,
7276 mac_dec, mac_key_len,
7277 &transform->psa_mac_dec ) ) != PSA_SUCCESS )
7278 {
7279 ret = psa_ssl_status_to_mbedtls( status );
7280 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7281 goto end;
7282 }
7283#else
7284 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
7285 if( ret != 0 )
7286 goto end;
7287 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
7288 if( ret != 0 )
7289 goto end;
7290#endif /* MBEDTLS_USE_PSA_CRYPTO */
7291 }
7292#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7293
7294 ((void) mac_dec);
7295 ((void) mac_enc);
7296
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007297end:
7298 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
7299 return( ret );
7300}
7301
Jerry Yuee40f9d2022-02-17 14:55:16 +08007302#if defined(MBEDTLS_USE_PSA_CRYPTO)
7303int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7304 unsigned char *hash, size_t *hashlen,
7305 unsigned char *data, size_t data_len,
7306 mbedtls_md_type_t md_alg )
7307{
7308 psa_status_t status;
7309 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
7310 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
7311
7312 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
7313
7314 if( ( status = psa_hash_setup( &hash_operation,
7315 hash_alg ) ) != PSA_SUCCESS )
7316 {
7317 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
7318 goto exit;
7319 }
7320
7321 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
7322 64 ) ) != PSA_SUCCESS )
7323 {
7324 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7325 goto exit;
7326 }
7327
7328 if( ( status = psa_hash_update( &hash_operation,
7329 data, data_len ) ) != PSA_SUCCESS )
7330 {
7331 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7332 goto exit;
7333 }
7334
7335 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
7336 hashlen ) ) != PSA_SUCCESS )
7337 {
7338 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
7339 goto exit;
7340 }
7341
7342exit:
7343 if( status != PSA_SUCCESS )
7344 {
7345 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7346 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7347 switch( status )
7348 {
7349 case PSA_ERROR_NOT_SUPPORTED:
7350 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
7351 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
7352 case PSA_ERROR_BUFFER_TOO_SMALL:
7353 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7354 case PSA_ERROR_INSUFFICIENT_MEMORY:
7355 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7356 default:
7357 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
7358 }
7359 }
7360 return( 0 );
7361}
7362
7363#else
7364
7365int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7366 unsigned char *hash, size_t *hashlen,
7367 unsigned char *data, size_t data_len,
7368 mbedtls_md_type_t md_alg )
7369{
7370 int ret = 0;
7371 mbedtls_md_context_t ctx;
7372 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
7373 *hashlen = mbedtls_md_get_size( md_info );
7374
7375 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
7376
7377 mbedtls_md_init( &ctx );
7378
7379 /*
7380 * digitally-signed struct {
7381 * opaque client_random[32];
7382 * opaque server_random[32];
7383 * ServerDHParams params;
7384 * };
7385 */
7386 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7387 {
7388 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7389 goto exit;
7390 }
7391 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7392 {
7393 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7394 goto exit;
7395 }
7396 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7397 {
7398 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7399 goto exit;
7400 }
7401 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7402 {
7403 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7404 goto exit;
7405 }
7406 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
7407 {
7408 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7409 goto exit;
7410 }
7411
7412exit:
7413 mbedtls_md_free( &ctx );
7414
7415 if( ret != 0 )
7416 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7417 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7418
7419 return( ret );
7420}
7421#endif /* MBEDTLS_USE_PSA_CRYPTO */
7422
Jerry Yud9d91da2022-02-17 14:57:06 +08007423#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7424
7425/* Find an entry in a signature-hash set matching a given hash algorithm. */
7426mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
7427 mbedtls_pk_type_t sig_alg )
7428{
7429 switch( sig_alg )
7430 {
7431 case MBEDTLS_PK_RSA:
7432 return( set->rsa );
7433 case MBEDTLS_PK_ECDSA:
7434 return( set->ecdsa );
7435 default:
7436 return( MBEDTLS_MD_NONE );
7437 }
7438}
7439
7440/* Add a signature-hash-pair to a signature-hash set */
7441void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
7442 mbedtls_pk_type_t sig_alg,
7443 mbedtls_md_type_t md_alg )
7444{
7445 switch( sig_alg )
7446 {
7447 case MBEDTLS_PK_RSA:
7448 if( set->rsa == MBEDTLS_MD_NONE )
7449 set->rsa = md_alg;
7450 break;
7451
7452 case MBEDTLS_PK_ECDSA:
7453 if( set->ecdsa == MBEDTLS_MD_NONE )
7454 set->ecdsa = md_alg;
7455 break;
7456
7457 default:
7458 break;
7459 }
7460}
7461
7462/* Allow exactly one hash algorithm for each signature. */
7463void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
7464 mbedtls_md_type_t md_alg )
7465{
7466 set->rsa = md_alg;
7467 set->ecdsa = md_alg;
7468}
7469
7470#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7471
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08007472/* Serialization of TLS 1.2 sessions:
7473 *
7474 * struct {
7475 * uint64 start_time;
7476 * uint8 ciphersuite[2]; // defined by the standard
7477 * uint8 compression; // 0 or 1
7478 * uint8 session_id_len; // at most 32
7479 * opaque session_id[32];
7480 * opaque master[48]; // fixed length in the standard
7481 * uint32 verify_result;
7482 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
7483 * opaque ticket<0..2^24-1>; // length 0 means no ticket
7484 * uint32 ticket_lifetime;
7485 * uint8 mfl_code; // up to 255 according to standard
7486 * uint8 encrypt_then_mac; // 0 or 1
7487 * } serialized_session_tls12;
7488 *
7489 */
7490static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
7491 unsigned char *buf,
7492 size_t buf_len )
7493{
7494 unsigned char *p = buf;
7495 size_t used = 0;
7496
7497#if defined(MBEDTLS_HAVE_TIME)
7498 uint64_t start;
7499#endif
7500#if defined(MBEDTLS_X509_CRT_PARSE_C)
7501#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7502 size_t cert_len;
7503#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7504#endif /* MBEDTLS_X509_CRT_PARSE_C */
7505
7506 /*
7507 * Time
7508 */
7509#if defined(MBEDTLS_HAVE_TIME)
7510 used += 8;
7511
7512 if( used <= buf_len )
7513 {
7514 start = (uint64_t) session->start;
7515
7516 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
7517 p += 8;
7518 }
7519#endif /* MBEDTLS_HAVE_TIME */
7520
7521 /*
7522 * Basic mandatory fields
7523 */
7524 used += 2 /* ciphersuite */
7525 + 1 /* compression */
7526 + 1 /* id_len */
7527 + sizeof( session->id )
7528 + sizeof( session->master )
7529 + 4; /* verify_result */
7530
7531 if( used <= buf_len )
7532 {
7533 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
7534 p += 2;
7535
7536 *p++ = MBEDTLS_BYTE_0( session->compression );
7537
7538 *p++ = MBEDTLS_BYTE_0( session->id_len );
7539 memcpy( p, session->id, 32 );
7540 p += 32;
7541
7542 memcpy( p, session->master, 48 );
7543 p += 48;
7544
7545 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
7546 p += 4;
7547 }
7548
7549 /*
7550 * Peer's end-entity certificate
7551 */
7552#if defined(MBEDTLS_X509_CRT_PARSE_C)
7553#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7554 if( session->peer_cert == NULL )
7555 cert_len = 0;
7556 else
7557 cert_len = session->peer_cert->raw.len;
7558
7559 used += 3 + cert_len;
7560
7561 if( used <= buf_len )
7562 {
7563 *p++ = MBEDTLS_BYTE_2( cert_len );
7564 *p++ = MBEDTLS_BYTE_1( cert_len );
7565 *p++ = MBEDTLS_BYTE_0( cert_len );
7566
7567 if( session->peer_cert != NULL )
7568 {
7569 memcpy( p, session->peer_cert->raw.p, cert_len );
7570 p += cert_len;
7571 }
7572 }
7573#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7574 if( session->peer_cert_digest != NULL )
7575 {
7576 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
7577 if( used <= buf_len )
7578 {
7579 *p++ = (unsigned char) session->peer_cert_digest_type;
7580 *p++ = (unsigned char) session->peer_cert_digest_len;
7581 memcpy( p, session->peer_cert_digest,
7582 session->peer_cert_digest_len );
7583 p += session->peer_cert_digest_len;
7584 }
7585 }
7586 else
7587 {
7588 used += 2;
7589 if( used <= buf_len )
7590 {
7591 *p++ = (unsigned char) MBEDTLS_MD_NONE;
7592 *p++ = 0;
7593 }
7594 }
7595#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7596#endif /* MBEDTLS_X509_CRT_PARSE_C */
7597
7598 /*
7599 * Session ticket if any, plus associated data
7600 */
7601#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
7602 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
7603
7604 if( used <= buf_len )
7605 {
7606 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
7607 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
7608 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
7609
7610 if( session->ticket != NULL )
7611 {
7612 memcpy( p, session->ticket, session->ticket_len );
7613 p += session->ticket_len;
7614 }
7615
7616 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
7617 p += 4;
7618 }
7619#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
7620
7621 /*
7622 * Misc extension-related info
7623 */
7624#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
7625 used += 1;
7626
7627 if( used <= buf_len )
7628 *p++ = session->mfl_code;
7629#endif
7630
7631#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7632 used += 1;
7633
7634 if( used <= buf_len )
7635 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
7636#endif
7637
7638 return( used );
7639}
7640
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08007641static int ssl_session_load_tls12( mbedtls_ssl_session *session,
7642 const unsigned char *buf,
7643 size_t len )
7644{
7645#if defined(MBEDTLS_HAVE_TIME)
7646 uint64_t start;
7647#endif
7648#if defined(MBEDTLS_X509_CRT_PARSE_C)
7649#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7650 size_t cert_len;
7651#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7652#endif /* MBEDTLS_X509_CRT_PARSE_C */
7653
7654 const unsigned char *p = buf;
7655 const unsigned char * const end = buf + len;
7656
7657 /*
7658 * Time
7659 */
7660#if defined(MBEDTLS_HAVE_TIME)
7661 if( 8 > (size_t)( end - p ) )
7662 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7663
7664 start = ( (uint64_t) p[0] << 56 ) |
7665 ( (uint64_t) p[1] << 48 ) |
7666 ( (uint64_t) p[2] << 40 ) |
7667 ( (uint64_t) p[3] << 32 ) |
7668 ( (uint64_t) p[4] << 24 ) |
7669 ( (uint64_t) p[5] << 16 ) |
7670 ( (uint64_t) p[6] << 8 ) |
7671 ( (uint64_t) p[7] );
7672 p += 8;
7673
7674 session->start = (time_t) start;
7675#endif /* MBEDTLS_HAVE_TIME */
7676
7677 /*
7678 * Basic mandatory fields
7679 */
7680 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
7681 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7682
7683 session->ciphersuite = ( p[0] << 8 ) | p[1];
7684 p += 2;
7685
7686 session->compression = *p++;
7687
7688 session->id_len = *p++;
7689 memcpy( session->id, p, 32 );
7690 p += 32;
7691
7692 memcpy( session->master, p, 48 );
7693 p += 48;
7694
7695 session->verify_result = ( (uint32_t) p[0] << 24 ) |
7696 ( (uint32_t) p[1] << 16 ) |
7697 ( (uint32_t) p[2] << 8 ) |
7698 ( (uint32_t) p[3] );
7699 p += 4;
7700
7701 /* Immediately clear invalid pointer values that have been read, in case
7702 * we exit early before we replaced them with valid ones. */
7703#if defined(MBEDTLS_X509_CRT_PARSE_C)
7704#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7705 session->peer_cert = NULL;
7706#else
7707 session->peer_cert_digest = NULL;
7708#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7709#endif /* MBEDTLS_X509_CRT_PARSE_C */
7710#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
7711 session->ticket = NULL;
7712#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
7713
7714 /*
7715 * Peer certificate
7716 */
7717#if defined(MBEDTLS_X509_CRT_PARSE_C)
7718#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7719 /* Deserialize CRT from the end of the ticket. */
7720 if( 3 > (size_t)( end - p ) )
7721 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7722
7723 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
7724 p += 3;
7725
7726 if( cert_len != 0 )
7727 {
7728 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7729
7730 if( cert_len > (size_t)( end - p ) )
7731 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7732
7733 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
7734
7735 if( session->peer_cert == NULL )
7736 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7737
7738 mbedtls_x509_crt_init( session->peer_cert );
7739
7740 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
7741 p, cert_len ) ) != 0 )
7742 {
7743 mbedtls_x509_crt_free( session->peer_cert );
7744 mbedtls_free( session->peer_cert );
7745 session->peer_cert = NULL;
7746 return( ret );
7747 }
7748
7749 p += cert_len;
7750 }
7751#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7752 /* Deserialize CRT digest from the end of the ticket. */
7753 if( 2 > (size_t)( end - p ) )
7754 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7755
7756 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
7757 session->peer_cert_digest_len = (size_t) *p++;
7758
7759 if( session->peer_cert_digest_len != 0 )
7760 {
7761 const mbedtls_md_info_t *md_info =
7762 mbedtls_md_info_from_type( session->peer_cert_digest_type );
7763 if( md_info == NULL )
7764 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7765 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
7766 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7767
7768 if( session->peer_cert_digest_len > (size_t)( end - p ) )
7769 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7770
7771 session->peer_cert_digest =
7772 mbedtls_calloc( 1, session->peer_cert_digest_len );
7773 if( session->peer_cert_digest == NULL )
7774 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7775
7776 memcpy( session->peer_cert_digest, p,
7777 session->peer_cert_digest_len );
7778 p += session->peer_cert_digest_len;
7779 }
7780#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7781#endif /* MBEDTLS_X509_CRT_PARSE_C */
7782
7783 /*
7784 * Session ticket and associated data
7785 */
7786#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
7787 if( 3 > (size_t)( end - p ) )
7788 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7789
7790 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
7791 p += 3;
7792
7793 if( session->ticket_len != 0 )
7794 {
7795 if( session->ticket_len > (size_t)( end - p ) )
7796 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7797
7798 session->ticket = mbedtls_calloc( 1, session->ticket_len );
7799 if( session->ticket == NULL )
7800 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7801
7802 memcpy( session->ticket, p, session->ticket_len );
7803 p += session->ticket_len;
7804 }
7805
7806 if( 4 > (size_t)( end - p ) )
7807 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7808
7809 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
7810 ( (uint32_t) p[1] << 16 ) |
7811 ( (uint32_t) p[2] << 8 ) |
7812 ( (uint32_t) p[3] );
7813 p += 4;
7814#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
7815
7816 /*
7817 * Misc extension-related info
7818 */
7819#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
7820 if( 1 > (size_t)( end - p ) )
7821 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7822
7823 session->mfl_code = *p++;
7824#endif
7825
7826#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7827 if( 1 > (size_t)( end - p ) )
7828 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7829
7830 session->encrypt_then_mac = *p++;
7831#endif
7832
7833 /* Done, should have consumed entire buffer */
7834 if( p != end )
7835 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7836
7837 return( 0 );
7838}
Jerry Yudc7bd172022-02-17 13:44:15 +08007839#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7840
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007841#endif /* MBEDTLS_SSL_TLS_C */