blob: 668b5ecae3c2809c62ca43a2b0cbd731375236b7 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Jerry Yub476a442022-01-21 18:14:45 +080028#include <assert.h>
29
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
Jerry Yu6ade7432022-01-25 10:39:33 +080034#include <stdio.h>
SimonBd5800b72016-04-26 07:43:27 +010035#define mbedtls_calloc calloc
36#define mbedtls_free free
Jerry Yu6ade7432022-01-25 10:39:33 +080037#define mbedtls_printf printf
38#endif /* !MBEDTLS_PLATFORM_C */
SimonBd5800b72016-04-26 07:43:27 +010039
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000040#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010041#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010042#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000043#include "ssl_misc.h"
Janos Follath73c616b2019-12-18 15:07:04 +000044#include "mbedtls/debug.h"
45#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050046#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010047#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020048#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020049
Rich Evans00ab4702015-02-06 13:43:58 +000050#include <string.h>
51
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050052#if defined(MBEDTLS_USE_PSA_CRYPTO)
53#include "mbedtls/psa_util.h"
54#include "psa/crypto.h"
55#endif
56
Janos Follath23bdca02016-10-07 14:47:14 +010057#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000058#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020059#endif
60
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020061#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010062
Hanno Beckera0e20d02019-05-15 14:03:01 +010063#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010064/* Top-level Connection ID API */
65
Hanno Becker8367ccc2019-05-14 11:30:10 +010066int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
67 size_t len,
68 int ignore_other_cid )
Hanno Beckerad4a1372019-05-03 13:06:44 +010069{
70 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
71 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
72
Hanno Becker611ac772019-05-14 11:45:26 +010073 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
74 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
75 {
76 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
77 }
78
79 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010080 conf->cid_len = len;
81 return( 0 );
82}
83
Hanno Beckerf8542cf2019-04-09 15:22:03 +010084int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
85 int enable,
86 unsigned char const *own_cid,
87 size_t own_cid_len )
88{
Hanno Becker76a79ab2019-05-03 14:38:32 +010089 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
90 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
91
Hanno Beckerca092242019-04-25 16:01:49 +010092 ssl->negotiate_cid = enable;
93 if( enable == MBEDTLS_SSL_CID_DISABLED )
94 {
95 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
96 return( 0 );
97 }
98 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckerad4a1372019-05-03 13:06:44 +010099 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Beckerca092242019-04-25 16:01:49 +0100100
Hanno Beckerad4a1372019-05-03 13:06:44 +0100101 if( own_cid_len != ssl->conf->cid_len )
Hanno Beckerca092242019-04-25 16:01:49 +0100102 {
Hanno Beckerad4a1372019-05-03 13:06:44 +0100103 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
104 (unsigned) own_cid_len,
105 (unsigned) ssl->conf->cid_len ) );
Hanno Beckerca092242019-04-25 16:01:49 +0100106 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
107 }
108
109 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100110 /* Truncation is not an issue here because
111 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
112 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100113
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100114 return( 0 );
115}
116
Paul Elliott0113cf12022-03-11 20:26:47 +0000117int mbedtls_ssl_get_own_cid( mbedtls_ssl_context *ssl,
118 int *enabled,
119 unsigned char own_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
120 size_t *own_cid_len )
121{
122 *enabled = MBEDTLS_SSL_CID_DISABLED;
123
124 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
125 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
126
127 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID length is
128 * zero as this is indistinguishable from not requesting to use
129 * the CID extension. */
130 if( ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
131 return( 0 );
132
133 if( own_cid_len != NULL )
134 {
135 *own_cid_len = ssl->own_cid_len;
136 if( own_cid != NULL )
137 memcpy( own_cid, ssl->own_cid, ssl->own_cid_len );
138 }
139
140 *enabled = MBEDTLS_SSL_CID_ENABLED;
141
142 return( 0 );
143}
144
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100145int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
146 int *enabled,
147 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
148 size_t *peer_cid_len )
149{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100150 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100151
Hanno Becker76a79ab2019-05-03 14:38:32 +0100152 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Paul Elliott27b0d942022-03-18 21:55:32 +0000153 mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Hanno Becker76a79ab2019-05-03 14:38:32 +0100154 {
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100155 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker76a79ab2019-05-03 14:38:32 +0100156 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100157
Hanno Beckerc5f24222019-05-03 12:54:52 +0100158 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
159 * were used, but client and server requested the empty CID.
160 * This is indistinguishable from not using the CID extension
161 * in the first place. */
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100162 if( ssl->transform_in->in_cid_len == 0 &&
163 ssl->transform_in->out_cid_len == 0 )
164 {
165 return( 0 );
166 }
167
Hanno Becker615ef172019-05-22 16:50:35 +0100168 if( peer_cid_len != NULL )
169 {
170 *peer_cid_len = ssl->transform_in->out_cid_len;
171 if( peer_cid != NULL )
172 {
173 memcpy( peer_cid, ssl->transform_in->out_cid,
174 ssl->transform_in->out_cid_len );
175 }
176 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100177
178 *enabled = MBEDTLS_SSL_CID_ENABLED;
179
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100180 return( 0 );
181}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100182#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100183
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200186#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200187/*
188 * Convert max_fragment_length codes to length.
189 * RFC 6066 says:
190 * enum{
191 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
192 * } MaxFragmentLength;
193 * and we add 0 -> extension unused
194 */
Angus Grattond8213d02016-05-25 20:56:48 +1000195static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200196{
Angus Grattond8213d02016-05-25 20:56:48 +1000197 switch( mfl )
198 {
199 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
200 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
201 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
202 return 512;
203 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
204 return 1024;
205 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
206 return 2048;
207 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
208 return 4096;
209 default:
210 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
211 }
212}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200213#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200214
Hanno Becker52055ae2019-02-06 14:30:46 +0000215int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
216 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200217{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200218 mbedtls_ssl_session_free( dst );
219 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200220
吴敬辉0b716112021-11-29 10:46:35 +0800221#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
222 dst->ticket = NULL;
223#endif
224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200225#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000226
227#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200228 if( src->peer_cert != NULL )
229 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000230 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200231
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200232 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200233 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200234 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200235
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200236 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200237
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200238 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200239 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200240 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200241 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200242 dst->peer_cert = NULL;
243 return( ret );
244 }
245 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000246#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker9198ad12019-02-05 17:00:50 +0000247 if( src->peer_cert_digest != NULL )
248 {
Hanno Becker9198ad12019-02-05 17:00:50 +0000249 dst->peer_cert_digest =
Hanno Beckeraccc5992019-02-25 10:06:59 +0000250 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9198ad12019-02-05 17:00:50 +0000251 if( dst->peer_cert_digest == NULL )
252 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
253
254 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
255 src->peer_cert_digest_len );
256 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000257 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000258 }
259#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
260
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200261#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200262
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200263#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200264 if( src->ticket != NULL )
265 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200266 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200267 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200268 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200269
270 memcpy( dst->ticket, src->ticket, src->ticket_len );
271 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200272#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200273
274 return( 0 );
275}
276
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500277#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200278MBEDTLS_CHECK_RETURN_CRITICAL
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500279static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
280{
281 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
282 if( resized_buffer == NULL )
283 return -1;
284
285 /* We want to copy len_new bytes when downsizing the buffer, and
286 * len_old bytes when upsizing, so we choose the smaller of two sizes,
287 * to fit one buffer into another. Size checks, ensuring that no data is
288 * lost, are done outside of this function. */
289 memcpy( resized_buffer, *buffer,
290 ( len_new < *len_old ) ? len_new : *len_old );
291 mbedtls_platform_zeroize( *buffer, *len_old );
292 mbedtls_free( *buffer );
293
294 *buffer = resized_buffer;
295 *len_old = len_new;
296
297 return 0;
298}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200299
300static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
Andrzej Kurek069fa962021-01-07 08:02:15 -0500301 size_t in_buf_new_len,
302 size_t out_buf_new_len )
Andrzej Kurek4a063792020-10-21 15:08:44 +0200303{
304 int modified = 0;
305 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
306 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
307 if( ssl->in_buf != NULL )
308 {
309 written_in = ssl->in_msg - ssl->in_buf;
310 iv_offset_in = ssl->in_iv - ssl->in_buf;
311 len_offset_in = ssl->in_len - ssl->in_buf;
312 if( downsizing ?
313 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
314 ssl->in_buf_len < in_buf_new_len )
315 {
316 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
317 {
318 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
319 }
320 else
321 {
Paul Elliottb7449902021-03-10 18:14:58 +0000322 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
323 in_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200324 modified = 1;
325 }
326 }
327 }
328
329 if( ssl->out_buf != NULL )
330 {
331 written_out = ssl->out_msg - ssl->out_buf;
332 iv_offset_out = ssl->out_iv - ssl->out_buf;
333 len_offset_out = ssl->out_len - ssl->out_buf;
334 if( downsizing ?
335 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
336 ssl->out_buf_len < out_buf_new_len )
337 {
338 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
339 {
340 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
341 }
342 else
343 {
Paul Elliottb7449902021-03-10 18:14:58 +0000344 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
345 out_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200346 modified = 1;
347 }
348 }
349 }
350 if( modified )
351 {
352 /* Update pointers here to avoid doing it twice. */
353 mbedtls_ssl_reset_in_out_pointers( ssl );
354 /* Fields below might not be properly updated with record
355 * splitting or with CID, so they are manually updated here. */
356 ssl->out_msg = ssl->out_buf + written_out;
357 ssl->out_len = ssl->out_buf + len_offset_out;
358 ssl->out_iv = ssl->out_buf + iv_offset_out;
359
360 ssl->in_msg = ssl->in_buf + written_in;
361 ssl->in_len = ssl->in_buf + len_offset_in;
362 ssl->in_iv = ssl->in_buf + iv_offset_in;
363 }
364}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500365#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
366
Jerry Yudb8c48a2022-01-27 14:54:54 +0800367#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800368
369#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
370typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
371 const char *label,
372 const unsigned char *random, size_t rlen,
373 unsigned char *dstbuf, size_t dlen );
374
375static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id );
376
377#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
378
379/* Type for the TLS PRF */
380typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
381 const unsigned char *, size_t,
382 unsigned char *, size_t);
383
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200384MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800385static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
386 int ciphersuite,
387 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200388#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yued14c932022-02-17 13:40:45 +0800389 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200390#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yued14c932022-02-17 13:40:45 +0800391 ssl_tls_prf_t tls_prf,
392 const unsigned char randbytes[64],
Glenn Strauss07c64162022-03-14 12:34:51 -0400393 mbedtls_ssl_protocol_version tls_version,
Jerry Yued14c932022-02-17 13:40:45 +0800394 unsigned endpoint,
395 const mbedtls_ssl_context *ssl );
396
397#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200398MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800399static int tls_prf_sha256( const unsigned char *secret, size_t slen,
400 const char *label,
401 const unsigned char *random, size_t rlen,
402 unsigned char *dstbuf, size_t dlen );
403static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
404static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
405
406#endif /* MBEDTLS_SHA256_C */
407
408#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200409MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800410static int tls_prf_sha384( const unsigned char *secret, size_t slen,
411 const char *label,
412 const unsigned char *random, size_t rlen,
413 unsigned char *dstbuf, size_t dlen );
414
415static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
416static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
417#endif /* MBEDTLS_SHA384_C */
418
419static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
420 unsigned char *buf,
421 size_t buf_len );
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200422MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800423static int ssl_session_load_tls12( mbedtls_ssl_session *session,
424 const unsigned char *buf,
425 size_t len );
426#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
427
Jerry Yu53d23e22022-02-09 16:25:09 +0800428static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
429
Jerry Yudb8c48a2022-01-27 14:54:54 +0800430#if defined(MBEDTLS_SHA256_C)
431static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
Jerry Yu53d23e22022-02-09 16:25:09 +0800432#endif /* MBEDTLS_SHA256_C */
Jerry Yudb8c48a2022-01-27 14:54:54 +0800433
434#if defined(MBEDTLS_SHA384_C)
435static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
Jerry Yu53d23e22022-02-09 16:25:09 +0800436#endif /* MBEDTLS_SHA384_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000437
Ron Eldor51d3ab52019-05-12 14:54:30 +0300438int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
439 const unsigned char *secret, size_t slen,
440 const char *label,
441 const unsigned char *random, size_t rlen,
442 unsigned char *dstbuf, size_t dlen )
443{
444 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
445
446 switch( prf )
447 {
Ron Eldord2f25f72019-05-15 14:54:22 +0300448#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200449#if defined(MBEDTLS_SHA384_C)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300450 case MBEDTLS_SSL_TLS_PRF_SHA384:
451 tls_prf = tls_prf_sha384;
452 break;
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200453#endif /* MBEDTLS_SHA384_C */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300454#if defined(MBEDTLS_SHA256_C)
455 case MBEDTLS_SSL_TLS_PRF_SHA256:
456 tls_prf = tls_prf_sha256;
457 break;
Ron Eldord2f25f72019-05-15 14:54:22 +0300458#endif /* MBEDTLS_SHA256_C */
459#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300460 default:
461 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
462 }
463
464 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
465}
466
Jerry Yuc73c6182022-02-08 20:29:25 +0800467#if defined(MBEDTLS_X509_CRT_PARSE_C)
468static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
469{
470#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
471 if( session->peer_cert != NULL )
472 {
473 mbedtls_x509_crt_free( session->peer_cert );
474 mbedtls_free( session->peer_cert );
475 session->peer_cert = NULL;
476 }
477#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
478 if( session->peer_cert_digest != NULL )
479 {
480 /* Zeroization is not necessary. */
481 mbedtls_free( session->peer_cert_digest );
482 session->peer_cert_digest = NULL;
483 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
484 session->peer_cert_digest_len = 0;
485 }
486#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
487}
488#endif /* MBEDTLS_X509_CRT_PARSE_C */
489
490void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
491 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
492{
493 ((void) ciphersuite_info);
494
495#if defined(MBEDTLS_SHA384_C)
496 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
497 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
498 else
499#endif
500#if defined(MBEDTLS_SHA256_C)
501 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
502 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
503 else
504#endif
505 {
506 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
507 return;
508 }
509}
510
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100511static void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
512 unsigned hs_type,
513 size_t total_hs_len )
514{
515 unsigned char hs_hdr[4];
516
517 /* Build HS header for checksum update. */
518 hs_hdr[0] = MBEDTLS_BYTE_0( hs_type );
519 hs_hdr[1] = MBEDTLS_BYTE_2( total_hs_len );
520 hs_hdr[2] = MBEDTLS_BYTE_1( total_hs_len );
521 hs_hdr[3] = MBEDTLS_BYTE_0( total_hs_len );
522
523 ssl->handshake->update_checksum( ssl, hs_hdr, sizeof( hs_hdr ) );
524}
525
526void mbedtls_ssl_add_hs_msg_to_checksum( mbedtls_ssl_context *ssl,
527 unsigned hs_type,
528 unsigned char const *msg,
529 size_t msg_len )
530{
531 mbedtls_ssl_add_hs_hdr_to_checksum( ssl, hs_type, msg_len );
532 ssl->handshake->update_checksum( ssl, msg, msg_len );
533}
534
Jerry Yuc73c6182022-02-08 20:29:25 +0800535void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
536{
537 ((void) ssl);
538#if defined(MBEDTLS_SHA256_C)
539#if defined(MBEDTLS_USE_PSA_CRYPTO)
540 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
541 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
542#else
543 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
544#endif
545#endif
546#if defined(MBEDTLS_SHA384_C)
547#if defined(MBEDTLS_USE_PSA_CRYPTO)
548 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
549 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
550#else
551 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
552#endif
553#endif
554}
555
556static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
557 const unsigned char *buf, size_t len )
558{
559#if defined(MBEDTLS_SHA256_C)
560#if defined(MBEDTLS_USE_PSA_CRYPTO)
561 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
562#else
563 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
564#endif
565#endif
566#if defined(MBEDTLS_SHA384_C)
567#if defined(MBEDTLS_USE_PSA_CRYPTO)
568 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
569#else
570 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
571#endif
572#endif
573}
574
575#if defined(MBEDTLS_SHA256_C)
576static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
577 const unsigned char *buf, size_t len )
578{
579#if defined(MBEDTLS_USE_PSA_CRYPTO)
580 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
581#else
582 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
583#endif
584}
585#endif
586
587#if defined(MBEDTLS_SHA384_C)
588static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
589 const unsigned char *buf, size_t len )
590{
591#if defined(MBEDTLS_USE_PSA_CRYPTO)
592 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
593#else
594 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
595#endif
596}
597#endif
598
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200599static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200600{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200601 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200602
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200603#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500604#if defined(MBEDTLS_USE_PSA_CRYPTO)
605 handshake->fin_sha256_psa = psa_hash_operation_init();
606 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
607#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200608 mbedtls_sha256_init( &handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +0200609 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200610#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500611#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200612#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500613#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500614 handshake->fin_sha384_psa = psa_hash_operation_init();
615 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -0500616#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200617 mbedtls_sha512_init( &handshake->fin_sha512 );
TRodziewicz26371e42021-06-08 16:45:41 +0200618 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200619#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500620#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200621
622 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200624#if defined(MBEDTLS_DHM_C)
625 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200626#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +0200627#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200628 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200629#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200630#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200631 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +0200632#if defined(MBEDTLS_SSL_CLI_C)
633 handshake->ecjpake_cache = NULL;
634 handshake->ecjpake_cache_len = 0;
635#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200636#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200637
Gilles Peskineeccd8882020-03-10 12:19:08 +0100638#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +0200639 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +0200640#endif
641
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200642#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
643 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
644#endif
Hanno Becker75173122019-02-06 16:18:31 +0000645
646#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
647 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
648 mbedtls_pk_init( &handshake->peer_pubkey );
649#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200650}
651
Hanno Beckera18d1322018-01-03 14:27:32 +0000652void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200653{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200654 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +0200655
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100656#if defined(MBEDTLS_USE_PSA_CRYPTO)
657 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
658 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100659#else
660 mbedtls_cipher_init( &transform->cipher_ctx_enc );
661 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100662#endif
663
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000664#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +0100665#if defined(MBEDTLS_USE_PSA_CRYPTO)
666 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
667 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100668#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200669 mbedtls_md_init( &transform->md_ctx_enc );
670 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +0000671#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100672#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200673}
674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200675void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200676{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200677 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200678}
679
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200680MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200681static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +0000682{
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200683 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +0000684 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200685 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200686 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200687 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200688 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +0200689 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200690
691 /*
692 * Either the pointers are now NULL or cleared properly and can be freed.
693 * Now allocate missing structures.
694 */
695 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200696 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200697 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200698 }
Paul Bakker48916f92012-09-16 19:57:18 +0000699
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200700 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200701 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200702 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200703 }
Paul Bakker48916f92012-09-16 19:57:18 +0000704
Paul Bakker82788fb2014-10-20 13:59:19 +0200705 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200706 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200707 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200708 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500709#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
710 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -0400711
Andrzej Kurek4a063792020-10-21 15:08:44 +0200712 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
713 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500714#endif
Paul Bakker48916f92012-09-16 19:57:18 +0000715
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200716 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +0000717 if( ssl->handshake == NULL ||
718 ssl->transform_negotiate == NULL ||
719 ssl->session_negotiate == NULL )
720 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +0200721 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200722
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200723 mbedtls_free( ssl->handshake );
724 mbedtls_free( ssl->transform_negotiate );
725 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200726
727 ssl->handshake = NULL;
728 ssl->transform_negotiate = NULL;
729 ssl->session_negotiate = NULL;
730
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200731 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +0000732 }
733
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200734 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200735 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Beckera18d1322018-01-03 14:27:32 +0000736 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +0200737 ssl_handshake_params_init( ssl->handshake );
738
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200740 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
741 {
742 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200743
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200744 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
745 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
746 else
747 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200748
Hanno Becker0f57a652020-02-05 10:37:26 +0000749 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200750 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200751#endif
752
Brett Warrene0edc842021-08-17 09:53:13 +0100753/*
754 * curve_list is translated to IANA TLS group identifiers here because
755 * mbedtls_ssl_conf_curves returns void and so can't return
756 * any error codes.
757 */
758#if defined(MBEDTLS_ECP_C)
759#if !defined(MBEDTLS_DEPRECATED_REMOVED)
760 /* Heap allocate and translate curve_list from internal to IANA group ids */
761 if ( ssl->conf->curve_list != NULL )
762 {
763 size_t length;
764 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
765
766 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
767 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
768
769 /* Leave room for zero termination */
770 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
771 if ( group_list == NULL )
772 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
773
774 for( size_t i = 0; i < length; i++ )
775 {
776 const mbedtls_ecp_curve_info *info =
777 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
778 if ( info == NULL )
779 {
780 mbedtls_free( group_list );
781 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
782 }
783 group_list[i] = info->tls_id;
784 }
785
786 group_list[length] = 0;
787
788 ssl->handshake->group_list = group_list;
789 ssl->handshake->group_list_heap_allocated = 1;
790 }
791 else
792 {
793 ssl->handshake->group_list = ssl->conf->group_list;
794 ssl->handshake->group_list_heap_allocated = 0;
795 }
796#endif /* MBEDTLS_DEPRECATED_REMOVED */
797#endif /* MBEDTLS_ECP_C */
798
Jerry Yuf017ee42022-01-12 15:49:48 +0800799#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
800#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +0800801#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +0800802 /* Heap allocate and translate sig_hashes from internal hash identifiers to
803 signature algorithms IANA identifiers. */
804 if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) &&
Jerry Yuf017ee42022-01-12 15:49:48 +0800805 ssl->conf->sig_hashes != NULL )
806 {
807 const int *md;
808 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +0800809 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +0800810 uint16_t *p;
811
Jerry Yub476a442022-01-21 18:14:45 +0800812#if defined(static_assert)
813 static_assert( MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
814 <= ( SIZE_MAX - ( 2 * sizeof(uint16_t) ) ),
815 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big" );
Jerry Yua68dca22022-01-20 16:28:27 +0800816#endif
817
Jerry Yuf017ee42022-01-12 15:49:48 +0800818 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
819 {
820 if( mbedtls_ssl_hash_from_md_alg( *md ) == MBEDTLS_SSL_HASH_NONE )
821 continue;
Jerry Yub476a442022-01-21 18:14:45 +0800822#if defined(MBEDTLS_ECDSA_C)
823 sig_algs_len += sizeof( uint16_t );
824#endif
Jerry Yua68dca22022-01-20 16:28:27 +0800825
Jerry Yub476a442022-01-21 18:14:45 +0800826#if defined(MBEDTLS_RSA_C)
827 sig_algs_len += sizeof( uint16_t );
828#endif
829 if( sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN )
830 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Jerry Yuf017ee42022-01-12 15:49:48 +0800831 }
832
Jerry Yub476a442022-01-21 18:14:45 +0800833 if( sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN )
Jerry Yuf017ee42022-01-12 15:49:48 +0800834 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
835
Jerry Yub476a442022-01-21 18:14:45 +0800836 ssl->handshake->sig_algs = mbedtls_calloc( 1, sig_algs_len +
837 sizeof( uint16_t ));
Jerry Yuf017ee42022-01-12 15:49:48 +0800838 if( ssl->handshake->sig_algs == NULL )
839 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
840
841 p = (uint16_t *)ssl->handshake->sig_algs;
842 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
843 {
844 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *md );
845 if( hash == MBEDTLS_SSL_HASH_NONE )
846 continue;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800847#if defined(MBEDTLS_ECDSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800848 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA);
849 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800850#endif
851#if defined(MBEDTLS_RSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800852 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA);
853 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800854#endif
Jerry Yuf017ee42022-01-12 15:49:48 +0800855 }
Gabor Mezei15b95a62022-05-09 16:37:58 +0200856 *p = MBEDTLS_TLS_SIG_NONE;
Jerry Yuf017ee42022-01-12 15:49:48 +0800857 ssl->handshake->sig_algs_heap_allocated = 1;
858 }
859 else
Jerry Yua69269a2022-01-17 21:06:01 +0800860#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +0800861 {
862 ssl->handshake->sig_algs = ssl->conf->sig_algs;
863 ssl->handshake->sig_algs_heap_allocated = 0;
864 }
865#endif /* MBEDTLS_DEPRECATED_REMOVED */
866#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +0000867 return( 0 );
868}
869
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200870#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200871/* Dummy cookie callbacks for defaults */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200872MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200873static int ssl_cookie_write_dummy( void *ctx,
874 unsigned char **p, unsigned char *end,
875 const unsigned char *cli_id, size_t cli_id_len )
876{
877 ((void) ctx);
878 ((void) p);
879 ((void) end);
880 ((void) cli_id);
881 ((void) cli_id_len);
882
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200883 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200884}
885
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200886MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200887static int ssl_cookie_check_dummy( void *ctx,
888 const unsigned char *cookie, size_t cookie_len,
889 const unsigned char *cli_id, size_t cli_id_len )
890{
891 ((void) ctx);
892 ((void) cookie);
893 ((void) cookie_len);
894 ((void) cli_id);
895 ((void) cli_id_len);
896
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200897 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200898}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200899#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200900
Paul Bakker5121ce52009-01-03 21:22:43 +0000901/*
902 * Initialize an SSL context
903 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200904void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
905{
906 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
907}
908
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200909MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +0800910static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
911{
Ronald Cron086ee0b2022-03-15 15:18:51 +0100912 const mbedtls_ssl_config *conf = ssl->conf;
913
Ronald Cron6f135e12021-12-08 16:57:54 +0100914#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100915 if( mbedtls_ssl_conf_is_tls13_only( conf ) )
916 {
XiaokangQianed582dd2022-04-13 08:21:05 +0000917 if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
918 {
919 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported." ) );
920 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
921 }
922
Jerry Yu60835a82021-08-04 10:13:52 +0800923 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
924 return( 0 );
925 }
926#endif
927
928#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100929 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800930 {
931 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
932 return( 0 );
933 }
934#endif
935
Ronald Cron6f135e12021-12-08 16:57:54 +0100936#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100937 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800938 {
XiaokangQianed582dd2022-04-13 08:21:05 +0000939 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
940 {
941 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2" ) );
942 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
943 }
944
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000945 if( conf->endpoint == MBEDTLS_SSL_IS_SERVER )
946 {
947 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 server is not supported yet." ) );
948 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
949 }
950
951
Ronald Crone1d3f062022-02-10 14:50:54 +0100952 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is TLS 1.3 or TLS 1.2." ) );
953 return( 0 );
Jerry Yu60835a82021-08-04 10:13:52 +0800954 }
955#endif
956
957 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
958 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
959}
960
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200961MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +0800962static int ssl_conf_check(const mbedtls_ssl_context *ssl)
963{
964 int ret;
965 ret = ssl_conf_version_check( ssl );
966 if( ret != 0 )
967 return( ret );
968
969 /* Space for further checks */
970
971 return( 0 );
972}
973
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200974/*
975 * Setup an SSL context
976 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100977
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +0200978int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +0200979 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +0000980{
Janos Follath865b3eb2019-12-16 11:46:15 +0000981 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +0000982 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
983 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +0000984
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +0200985 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +0000986
Jerry Yu60835a82021-08-04 10:13:52 +0800987 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
988 return( ret );
989
Paul Bakker62f2dee2012-09-28 07:31:51 +0000990 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +0100991 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +0000992 */
k-stachowiakc9a5f022018-07-24 13:53:31 +0200993
994 /* Set to NULL in case of an error condition */
995 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +0200996
Darryl Greenb33cc762019-11-28 14:29:44 +0000997#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
998 ssl->in_buf_len = in_buf_len;
999#endif
1000 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001001 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001002 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001003 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001004 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001005 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10001006 }
1007
Darryl Greenb33cc762019-11-28 14:29:44 +00001008#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1009 ssl->out_buf_len = out_buf_len;
1010#endif
1011 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001012 if( ssl->out_buf == NULL )
1013 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001014 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001015 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001016 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001017 }
1018
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00001019 mbedtls_ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001020
Johan Pascalb62bb512015-12-03 21:56:45 +01001021#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +02001022 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
Johan Pascalb62bb512015-12-03 21:56:45 +01001023#endif
1024
Paul Bakker48916f92012-09-16 19:57:18 +00001025 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02001026 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001027
1028 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02001029
1030error:
1031 mbedtls_free( ssl->in_buf );
1032 mbedtls_free( ssl->out_buf );
1033
1034 ssl->conf = NULL;
1035
Darryl Greenb33cc762019-11-28 14:29:44 +00001036#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1037 ssl->in_buf_len = 0;
1038 ssl->out_buf_len = 0;
1039#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001040 ssl->in_buf = NULL;
1041 ssl->out_buf = NULL;
1042
1043 ssl->in_hdr = NULL;
1044 ssl->in_ctr = NULL;
1045 ssl->in_len = NULL;
1046 ssl->in_iv = NULL;
1047 ssl->in_msg = NULL;
1048
1049 ssl->out_hdr = NULL;
1050 ssl->out_ctr = NULL;
1051 ssl->out_len = NULL;
1052 ssl->out_iv = NULL;
1053 ssl->out_msg = NULL;
1054
k-stachowiak9f7798e2018-07-31 16:52:32 +02001055 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001056}
1057
1058/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001059 * Reset an initialized and used SSL context for re-use while retaining
1060 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001061 *
1062 * If partial is non-zero, keep data in the input buffer and client ID.
1063 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001064 */
XiaokangQian78b1fa72022-01-19 06:56:30 +00001065void mbedtls_ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
1066 int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00001067{
Darryl Greenb33cc762019-11-28 14:29:44 +00001068#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1069 size_t in_buf_len = ssl->in_buf_len;
1070 size_t out_buf_len = ssl->out_buf_len;
1071#else
1072 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1073 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1074#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001075
Hanno Beckerb0302c42021-08-03 09:39:42 +01001076#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1077 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001078#endif
1079
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001080 /* Cancel any possibly running timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00001081 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001082
Hanno Beckerb0302c42021-08-03 09:39:42 +01001083 mbedtls_ssl_reset_in_out_pointers( ssl );
1084
1085 /* Reset incoming message parsing */
1086 ssl->in_offt = NULL;
1087 ssl->nb_zero = 0;
1088 ssl->in_msgtype = 0;
1089 ssl->in_msglen = 0;
1090 ssl->in_hslen = 0;
1091 ssl->keep_current_message = 0;
1092 ssl->transform_in = NULL;
1093
1094#if defined(MBEDTLS_SSL_PROTO_DTLS)
1095 ssl->next_record_offset = 0;
1096 ssl->in_epoch = 0;
1097#endif
1098
1099 /* Keep current datagram if partial == 1 */
1100 if( partial == 0 )
1101 {
1102 ssl->in_left = 0;
1103 memset( ssl->in_buf, 0, in_buf_len );
1104 }
1105
1106 /* Reset outgoing message writing */
1107 ssl->out_msgtype = 0;
1108 ssl->out_msglen = 0;
1109 ssl->out_left = 0;
1110 memset( ssl->out_buf, 0, out_buf_len );
1111 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
1112 ssl->transform_out = NULL;
1113
1114#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1115 mbedtls_ssl_dtls_replay_reset( ssl );
1116#endif
1117
XiaokangQian2b01dc32022-01-21 02:53:13 +00001118#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001119 if( ssl->transform )
1120 {
1121 mbedtls_ssl_transform_free( ssl->transform );
1122 mbedtls_free( ssl->transform );
1123 ssl->transform = NULL;
1124 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001125#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1126
XiaokangQian2b01dc32022-01-21 02:53:13 +00001127#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1128 mbedtls_ssl_transform_free( ssl->transform_application );
1129 mbedtls_free( ssl->transform_application );
1130 ssl->transform_application = NULL;
1131
1132 if( ssl->handshake != NULL )
1133 {
1134 mbedtls_ssl_transform_free( ssl->handshake->transform_earlydata );
1135 mbedtls_free( ssl->handshake->transform_earlydata );
1136 ssl->handshake->transform_earlydata = NULL;
1137
1138 mbedtls_ssl_transform_free( ssl->handshake->transform_handshake );
1139 mbedtls_free( ssl->handshake->transform_handshake );
1140 ssl->handshake->transform_handshake = NULL;
1141 }
1142
XiaokangQian2b01dc32022-01-21 02:53:13 +00001143#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001144}
1145
1146int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
1147{
1148 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1149
1150 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
1151
XiaokangQian78b1fa72022-01-19 06:56:30 +00001152 mbedtls_ssl_session_reset_msg_layer( ssl, partial );
Hanno Beckerb0302c42021-08-03 09:39:42 +01001153
1154 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001155#if defined(MBEDTLS_SSL_RENEGOTIATION)
1156 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001157 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001158
1159 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001160 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
1161 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001162#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001163 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001164
Hanno Beckerb0302c42021-08-03 09:39:42 +01001165 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001166 ssl->session_out = NULL;
Paul Bakkerc0463502013-02-14 11:19:38 +01001167 if( ssl->session )
1168 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001169 mbedtls_ssl_session_free( ssl->session );
1170 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01001171 ssl->session = NULL;
1172 }
1173
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001174#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001175 ssl->alpn_chosen = NULL;
1176#endif
1177
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001178#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01001179#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001180 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01001181#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001182 {
1183 mbedtls_free( ssl->cli_id );
1184 ssl->cli_id = NULL;
1185 ssl->cli_id_len = 0;
1186 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001187#endif
1188
Paul Bakker48916f92012-09-16 19:57:18 +00001189 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
1190 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001191
1192 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00001193}
1194
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001195/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001196 * Reset an initialized and used SSL context for re-use while retaining
1197 * all application-set variables, function pointers and data.
1198 */
1199int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
1200{
Hanno Becker43aefe22020-02-05 10:44:56 +00001201 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001202}
1203
1204/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001205 * SSL set accessors
1206 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001207void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00001208{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001209 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001210}
1211
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02001212void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001213{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001214 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001215}
1216
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001217#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001218void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001219{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001220 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001221}
1222#endif
1223
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001224void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001225{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001226 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001227}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001229#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001230
Hanno Becker1841b0a2018-08-24 11:13:57 +01001231void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
1232 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01001233{
1234 ssl->disable_datagram_packing = !allow_packing;
1235}
1236
1237void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
1238 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001239{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001240 conf->hs_timeout_min = min;
1241 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001242}
1243#endif
1244
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001245void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00001246{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001247 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001248}
1249
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001250#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001251void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02001252 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001253 void *p_vrfy )
1254{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001255 conf->f_vrfy = f_vrfy;
1256 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001257}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001258#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001259
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001260void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001261 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00001262 void *p_rng )
1263{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001264 conf->f_rng = f_rng;
1265 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001266}
1267
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001268void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02001269 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00001270 void *p_dbg )
1271{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001272 conf->f_dbg = f_dbg;
1273 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001274}
1275
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001276void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001277 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00001278 mbedtls_ssl_send_t *f_send,
1279 mbedtls_ssl_recv_t *f_recv,
1280 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001281{
1282 ssl->p_bio = p_bio;
1283 ssl->f_send = f_send;
1284 ssl->f_recv = f_recv;
1285 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001286}
1287
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001288#if defined(MBEDTLS_SSL_PROTO_DTLS)
1289void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
1290{
1291 ssl->mtu = mtu;
1292}
1293#endif
1294
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001295void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001296{
1297 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001298}
1299
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001300void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
1301 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00001302 mbedtls_ssl_set_timer_t *f_set_timer,
1303 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001304{
1305 ssl->p_timer = p_timer;
1306 ssl->f_set_timer = f_set_timer;
1307 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001308
1309 /* Make sure we start with no timer running */
Hanno Becker0f57a652020-02-05 10:37:26 +00001310 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001311}
1312
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001313#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001314void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Hanno Beckera637ff62021-04-15 08:42:48 +01001315 void *p_cache,
1316 mbedtls_ssl_cache_get_t *f_get_cache,
1317 mbedtls_ssl_cache_set_t *f_set_cache )
Paul Bakker5121ce52009-01-03 21:22:43 +00001318{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001319 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001320 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001321 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001322}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001323#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001324
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001325#if defined(MBEDTLS_SSL_CLI_C)
1326int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00001327{
Janos Follath865b3eb2019-12-16 11:46:15 +00001328 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001329
1330 if( ssl == NULL ||
1331 session == NULL ||
1332 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001333 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001334 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001335 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001336 }
1337
Hanno Beckere810bbc2021-05-14 16:01:05 +01001338 if( ssl->handshake->resume == 1 )
1339 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1340
Hanno Becker52055ae2019-02-06 14:30:46 +00001341 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
1342 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001343 return( ret );
1344
Paul Bakker0a597072012-09-25 21:55:46 +00001345 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001346
1347 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001348}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001349#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001350
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001351void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
1352 const int *ciphersuites )
1353{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001354 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001355}
1356
Ronald Cron6f135e12021-12-08 16:57:54 +01001357#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yucadebe52021-08-24 10:36:45 +08001358void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
Hanno Becker71f1ed62021-07-24 06:01:47 +01001359 const int kex_modes )
1360{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001361 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001362}
Ronald Cron6f135e12021-12-08 16:57:54 +01001363#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001364
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001365#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001366void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01001367 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001368{
1369 conf->cert_profile = profile;
1370}
1371
Glenn Strauss36872db2022-01-22 05:06:31 -05001372static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
1373{
1374 mbedtls_ssl_key_cert *cur = key_cert, *next;
1375
1376 while( cur != NULL )
1377 {
1378 next = cur->next;
1379 mbedtls_free( cur );
1380 cur = next;
1381 }
1382}
1383
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001384/* Append a new keycert entry to a (possibly empty) list */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001385MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001386static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
1387 mbedtls_x509_crt *cert,
1388 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001389{
niisato8ee24222018-06-25 19:05:48 +09001390 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001391
Glenn Strauss36872db2022-01-22 05:06:31 -05001392 if( cert == NULL )
1393 {
1394 /* Free list if cert is null */
1395 ssl_key_cert_free( *head );
1396 *head = NULL;
1397 return( 0 );
1398 }
1399
niisato8ee24222018-06-25 19:05:48 +09001400 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
1401 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001402 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001403
niisato8ee24222018-06-25 19:05:48 +09001404 new_cert->cert = cert;
1405 new_cert->key = key;
1406 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001407
Glenn Strauss36872db2022-01-22 05:06:31 -05001408 /* Update head if the list was null, else add to the end */
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001409 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01001410 {
niisato8ee24222018-06-25 19:05:48 +09001411 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01001412 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001413 else
1414 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001415 mbedtls_ssl_key_cert *cur = *head;
1416 while( cur->next != NULL )
1417 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09001418 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001419 }
1420
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001421 return( 0 );
1422}
1423
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001424int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001425 mbedtls_x509_crt *own_cert,
1426 mbedtls_pk_context *pk_key )
1427{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02001428 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001429}
1430
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001431void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001432 mbedtls_x509_crt *ca_chain,
1433 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001434{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001435 conf->ca_chain = ca_chain;
1436 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001437
1438#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1439 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1440 * cannot be used together. */
1441 conf->f_ca_cb = NULL;
1442 conf->p_ca_cb = NULL;
1443#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001444}
Hanno Becker5adaad92019-03-27 16:54:37 +00001445
1446#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1447void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00001448 mbedtls_x509_crt_ca_cb_t f_ca_cb,
Hanno Becker5adaad92019-03-27 16:54:37 +00001449 void *p_ca_cb )
1450{
1451 conf->f_ca_cb = f_ca_cb;
1452 conf->p_ca_cb = p_ca_cb;
1453
1454 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1455 * cannot be used together. */
1456 conf->ca_chain = NULL;
1457 conf->ca_crl = NULL;
1458}
1459#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001460#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001461
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001462#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Glenn Strauss69894072022-01-24 12:58:00 -05001463const unsigned char *mbedtls_ssl_get_hs_sni( mbedtls_ssl_context *ssl,
1464 size_t *name_len )
1465{
1466 *name_len = ssl->handshake->sni_name_len;
1467 return( ssl->handshake->sni_name );
1468}
1469
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001470int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
1471 mbedtls_x509_crt *own_cert,
1472 mbedtls_pk_context *pk_key )
1473{
1474 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
1475 own_cert, pk_key ) );
1476}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001477
1478void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
1479 mbedtls_x509_crt *ca_chain,
1480 mbedtls_x509_crl *ca_crl )
1481{
1482 ssl->handshake->sni_ca_chain = ca_chain;
1483 ssl->handshake->sni_ca_crl = ca_crl;
1484}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001485
1486void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
1487 int authmode )
1488{
1489 ssl->handshake->sni_authmode = authmode;
1490}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001491#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1492
Hanno Becker8927c832019-04-03 12:52:50 +01001493#if defined(MBEDTLS_X509_CRT_PARSE_C)
1494void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
1495 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1496 void *p_vrfy )
1497{
1498 ssl->f_vrfy = f_vrfy;
1499 ssl->p_vrfy = p_vrfy;
1500}
1501#endif
1502
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001503#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001504/*
1505 * Set EC J-PAKE password for current handshake
1506 */
1507int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
1508 const unsigned char *pw,
1509 size_t pw_len )
1510{
1511 mbedtls_ecjpake_role role;
1512
Janos Follath8eb64132016-06-03 15:40:57 +01001513 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001514 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1515
1516 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1517 role = MBEDTLS_ECJPAKE_SERVER;
1518 else
1519 role = MBEDTLS_ECJPAKE_CLIENT;
1520
1521 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
1522 role,
1523 MBEDTLS_MD_SHA256,
1524 MBEDTLS_ECP_DP_SECP256R1,
1525 pw, pw_len ) );
1526}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001527#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001528
Gilles Peskineeccd8882020-03-10 12:19:08 +01001529#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001530
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001531MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001532static int ssl_conf_psk_is_configured( mbedtls_ssl_config const *conf )
1533{
1534#if defined(MBEDTLS_USE_PSA_CRYPTO)
1535 if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
1536 return( 1 );
1537#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001538 if( conf->psk != NULL )
1539 return( 1 );
1540
1541 return( 0 );
1542}
1543
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001544static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
1545{
1546 /* Remove reference to existing PSK, if any. */
1547#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001548 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001549 {
1550 /* The maintenance of the PSK key slot is the
1551 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001552 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001553 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001554#endif /* MBEDTLS_USE_PSA_CRYPTO */
1555 if( conf->psk != NULL )
1556 {
1557 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
1558
1559 mbedtls_free( conf->psk );
1560 conf->psk = NULL;
1561 conf->psk_len = 0;
1562 }
1563
1564 /* Remove reference to PSK identity, if any. */
1565 if( conf->psk_identity != NULL )
1566 {
1567 mbedtls_free( conf->psk_identity );
1568 conf->psk_identity = NULL;
1569 conf->psk_identity_len = 0;
1570 }
1571}
1572
Hanno Becker7390c712018-11-15 13:33:04 +00001573/* This function assumes that PSK identity in the SSL config is unset.
1574 * It checks that the provided identity is well-formed and attempts
1575 * to make a copy of it in the SSL config.
1576 * On failure, the PSK identity in the config remains unset. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001577MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker7390c712018-11-15 13:33:04 +00001578static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
1579 unsigned char const *psk_identity,
1580 size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001581{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001582 /* Identity len will be encoded on two bytes */
Hanno Becker7390c712018-11-15 13:33:04 +00001583 if( psk_identity == NULL ||
1584 ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10001585 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001586 {
1587 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1588 }
1589
Hanno Becker7390c712018-11-15 13:33:04 +00001590 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
1591 if( conf->psk_identity == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001592 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker6db455e2013-09-18 17:29:31 +02001593
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001594 conf->psk_identity_len = psk_identity_len;
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001595 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker5ad403f2013-09-18 21:21:30 +02001596
1597 return( 0 );
Paul Bakker6db455e2013-09-18 17:29:31 +02001598}
1599
Hanno Becker7390c712018-11-15 13:33:04 +00001600int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
1601 const unsigned char *psk, size_t psk_len,
1602 const unsigned char *psk_identity, size_t psk_identity_len )
1603{
Janos Follath865b3eb2019-12-16 11:46:15 +00001604 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001605
1606 /* We currently only support one PSK, raw or opaque. */
1607 if( ssl_conf_psk_is_configured( conf ) )
1608 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Becker7390c712018-11-15 13:33:04 +00001609
1610 /* Check and set raw PSK */
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001611 if( psk == NULL )
Hanno Becker7390c712018-11-15 13:33:04 +00001612 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001613 if( psk_len == 0 )
1614 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1615 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1616 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1617
Hanno Becker7390c712018-11-15 13:33:04 +00001618 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
1619 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1620 conf->psk_len = psk_len;
1621 memcpy( conf->psk, psk, conf->psk_len );
1622
1623 /* Check and set PSK Identity */
1624 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
1625 if( ret != 0 )
1626 ssl_conf_remove_psk( conf );
1627
1628 return( ret );
1629}
1630
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001631static void ssl_remove_psk( mbedtls_ssl_context *ssl )
1632{
1633#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001634 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001635 {
Neil Armstrong501c9322022-05-03 09:35:09 +02001636 /* The maintenance of the external PSK key slot is the
1637 * user's responsibility. */
1638 if( ssl->handshake->psk_opaque_is_internal )
1639 {
1640 psa_destroy_key( ssl->handshake->psk_opaque );
1641 ssl->handshake->psk_opaque_is_internal = 0;
1642 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02001643 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001644 }
Neil Armstronge952a302022-05-03 10:22:14 +02001645#else
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001646 if( ssl->handshake->psk != NULL )
1647 {
1648 mbedtls_platform_zeroize( ssl->handshake->psk,
1649 ssl->handshake->psk_len );
1650 mbedtls_free( ssl->handshake->psk );
1651 ssl->handshake->psk_len = 0;
1652 }
Neil Armstronge952a302022-05-03 10:22:14 +02001653#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001654}
1655
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001656int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
1657 const unsigned char *psk, size_t psk_len )
1658{
Neil Armstrong501c9322022-05-03 09:35:09 +02001659#if defined(MBEDTLS_USE_PSA_CRYPTO)
1660 psa_key_attributes_t key_attributes = psa_key_attributes_init();
1661 psa_status_t status;
1662 psa_algorithm_t alg;
1663 mbedtls_svc_key_id_t key;
1664#endif /* MBEDTLS_USE_PSA_CRYPTO */
1665
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001666 if( psk == NULL || ssl->handshake == NULL )
1667 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1668
1669 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1670 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1671
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001672 ssl_remove_psk( ssl );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001673
Neil Armstrong501c9322022-05-03 09:35:09 +02001674#if defined(MBEDTLS_USE_PSA_CRYPTO)
1675 if( ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384)
1676 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
1677 else
1678 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
1679
1680 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
1681 psa_set_key_algorithm( &key_attributes, alg );
1682 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
1683
1684 status = psa_import_key( &key_attributes, psk, psk_len, &key );
1685 if( status != PSA_SUCCESS )
1686 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1687
1688 /* Allow calling psa_destroy_key() on psk remove */
1689 ssl->handshake->psk_opaque_is_internal = 1;
1690 return mbedtls_ssl_set_hs_psk_opaque( ssl, key );
1691#else
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02001692 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001693 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001694
1695 ssl->handshake->psk_len = psk_len;
1696 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
1697
1698 return( 0 );
Neil Armstrong501c9322022-05-03 09:35:09 +02001699#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001700}
1701
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001702#if defined(MBEDTLS_USE_PSA_CRYPTO)
1703int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
Andrzej Kurek03e01462022-01-03 12:53:24 +01001704 mbedtls_svc_key_id_t psk,
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001705 const unsigned char *psk_identity,
1706 size_t psk_identity_len )
1707{
Janos Follath865b3eb2019-12-16 11:46:15 +00001708 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001709
1710 /* We currently only support one PSK, raw or opaque. */
1711 if( ssl_conf_psk_is_configured( conf ) )
1712 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001713
Hanno Becker7390c712018-11-15 13:33:04 +00001714 /* Check and set opaque PSK */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001715 if( mbedtls_svc_key_id_is_null( psk ) )
Hanno Becker7390c712018-11-15 13:33:04 +00001716 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ronald Croncf56a0a2020-08-04 09:51:30 +02001717 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00001718
1719 /* Check and set PSK Identity */
1720 ret = ssl_conf_set_psk_identity( conf, psk_identity,
1721 psk_identity_len );
1722 if( ret != 0 )
1723 ssl_conf_remove_psk( conf );
1724
1725 return( ret );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001726}
1727
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01001728int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
1729 mbedtls_svc_key_id_t psk )
1730{
1731 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
1732 ( ssl->handshake == NULL ) )
1733 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1734
1735 ssl_remove_psk( ssl );
1736 ssl->handshake->psk_opaque = psk;
1737 return( 0 );
1738}
1739#endif /* MBEDTLS_USE_PSA_CRYPTO */
1740
1741void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
1742 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
1743 size_t),
1744 void *p_psk )
1745{
1746 conf->f_psk = f_psk;
1747 conf->p_psk = p_psk;
1748}
1749#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1750
1751#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine301711e2022-04-26 16:57:05 +02001752static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
1753 psa_algorithm_t alg )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001754{
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001755#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001756 if( alg == PSA_ALG_CBC_NO_PADDING )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001757 return( MBEDTLS_SSL_MODE_CBC );
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001758#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001759 if( PSA_ALG_IS_AEAD( alg ) )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001760 return( MBEDTLS_SSL_MODE_AEAD );
Gilles Peskine301711e2022-04-26 16:57:05 +02001761 return( MBEDTLS_SSL_MODE_STREAM );
1762}
1763
1764#else /* MBEDTLS_USE_PSA_CRYPTO */
1765
1766static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
1767 mbedtls_cipher_mode_t mode )
1768{
1769#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
1770 if( mode == MBEDTLS_MODE_CBC )
1771 return( MBEDTLS_SSL_MODE_CBC );
1772#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
1773
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001774#if defined(MBEDTLS_GCM_C) || \
1775 defined(MBEDTLS_CCM_C) || \
1776 defined(MBEDTLS_CHACHAPOLY_C)
1777 if( mode == MBEDTLS_MODE_GCM ||
1778 mode == MBEDTLS_MODE_CCM ||
1779 mode == MBEDTLS_MODE_CHACHAPOLY )
1780 return( MBEDTLS_SSL_MODE_AEAD );
1781#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001782
1783 return( MBEDTLS_SSL_MODE_STREAM );
1784}
Gilles Peskine301711e2022-04-26 16:57:05 +02001785#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001786
Gilles Peskinee108d982022-04-26 16:50:40 +02001787static mbedtls_ssl_mode_t mbedtls_ssl_get_actual_mode(
1788 mbedtls_ssl_mode_t base_mode,
1789 int encrypt_then_mac )
1790{
1791#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
1792 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
1793 base_mode == MBEDTLS_SSL_MODE_CBC )
1794 {
1795 return( MBEDTLS_SSL_MODE_CBC_ETM );
1796 }
1797#else
1798 (void) encrypt_then_mac;
1799#endif
1800 return( base_mode );
1801}
1802
Neil Armstrongab555e02022-04-04 11:07:59 +02001803mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001804 const mbedtls_ssl_transform *transform )
1805{
Gilles Peskinee108d982022-04-26 16:50:40 +02001806 mbedtls_ssl_mode_t base_mode = mbedtls_ssl_get_base_mode(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001807#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskinee108d982022-04-26 16:50:40 +02001808 transform->psa_alg
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001809#else
Gilles Peskinee108d982022-04-26 16:50:40 +02001810 mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc )
1811#endif
1812 );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001813
Gilles Peskinee108d982022-04-26 16:50:40 +02001814 int encrypt_then_mac = 0;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001815#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskinee108d982022-04-26 16:50:40 +02001816 encrypt_then_mac = transform->encrypt_then_mac;
1817#endif
1818 return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001819}
1820
Neil Armstrongab555e02022-04-04 11:07:59 +02001821mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001822#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001823 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001824#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001825 const mbedtls_ssl_ciphersuite_t *suite )
1826{
Gilles Peskinee108d982022-04-26 16:50:40 +02001827 mbedtls_ssl_mode_t base_mode = MBEDTLS_SSL_MODE_STREAM;
1828
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001829#if defined(MBEDTLS_USE_PSA_CRYPTO)
1830 psa_status_t status;
1831 psa_algorithm_t alg;
1832 psa_key_type_t type;
1833 size_t size;
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001834 status = mbedtls_ssl_cipher_to_psa( suite->cipher, 0, &alg, &type, &size );
1835 if( status == PSA_SUCCESS )
Gilles Peskinee108d982022-04-26 16:50:40 +02001836 base_mode = mbedtls_ssl_get_base_mode( alg );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001837#else
1838 const mbedtls_cipher_info_t *cipher =
1839 mbedtls_cipher_info_from_type( suite->cipher );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001840 if( cipher != NULL )
Gilles Peskinee108d982022-04-26 16:50:40 +02001841 {
1842 base_mode =
1843 mbedtls_ssl_get_base_mode(
1844 mbedtls_cipher_info_get_mode( cipher ) );
1845 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001846#endif /* MBEDTLS_USE_PSA_CRYPTO */
1847
Gilles Peskinee108d982022-04-26 16:50:40 +02001848#if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
1849 int encrypt_then_mac = 0;
1850#endif
1851 return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001852}
1853
Neil Armstrong8395d7a2022-05-18 11:44:56 +02001854#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01001855psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01001856 size_t taglen,
1857 psa_algorithm_t *alg,
1858 psa_key_type_t *key_type,
1859 size_t *key_size )
1860{
1861 switch ( mbedtls_cipher_type )
1862 {
1863 case MBEDTLS_CIPHER_AES_128_CBC:
1864 *alg = PSA_ALG_CBC_NO_PADDING;
1865 *key_type = PSA_KEY_TYPE_AES;
1866 *key_size = 128;
1867 break;
1868 case MBEDTLS_CIPHER_AES_128_CCM:
1869 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1870 *key_type = PSA_KEY_TYPE_AES;
1871 *key_size = 128;
1872 break;
1873 case MBEDTLS_CIPHER_AES_128_GCM:
1874 *alg = PSA_ALG_GCM;
1875 *key_type = PSA_KEY_TYPE_AES;
1876 *key_size = 128;
1877 break;
1878 case MBEDTLS_CIPHER_AES_192_CCM:
1879 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1880 *key_type = PSA_KEY_TYPE_AES;
1881 *key_size = 192;
1882 break;
1883 case MBEDTLS_CIPHER_AES_192_GCM:
1884 *alg = PSA_ALG_GCM;
1885 *key_type = PSA_KEY_TYPE_AES;
1886 *key_size = 192;
1887 break;
1888 case MBEDTLS_CIPHER_AES_256_CBC:
1889 *alg = PSA_ALG_CBC_NO_PADDING;
1890 *key_type = PSA_KEY_TYPE_AES;
1891 *key_size = 256;
1892 break;
1893 case MBEDTLS_CIPHER_AES_256_CCM:
1894 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1895 *key_type = PSA_KEY_TYPE_AES;
1896 *key_size = 256;
1897 break;
1898 case MBEDTLS_CIPHER_AES_256_GCM:
1899 *alg = PSA_ALG_GCM;
1900 *key_type = PSA_KEY_TYPE_AES;
1901 *key_size = 256;
1902 break;
1903 case MBEDTLS_CIPHER_ARIA_128_CBC:
1904 *alg = PSA_ALG_CBC_NO_PADDING;
1905 *key_type = PSA_KEY_TYPE_ARIA;
1906 *key_size = 128;
1907 break;
1908 case MBEDTLS_CIPHER_ARIA_128_CCM:
1909 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1910 *key_type = PSA_KEY_TYPE_ARIA;
1911 *key_size = 128;
1912 break;
1913 case MBEDTLS_CIPHER_ARIA_128_GCM:
1914 *alg = PSA_ALG_GCM;
1915 *key_type = PSA_KEY_TYPE_ARIA;
1916 *key_size = 128;
1917 break;
1918 case MBEDTLS_CIPHER_ARIA_192_CCM:
1919 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1920 *key_type = PSA_KEY_TYPE_ARIA;
1921 *key_size = 192;
1922 break;
1923 case MBEDTLS_CIPHER_ARIA_192_GCM:
1924 *alg = PSA_ALG_GCM;
1925 *key_type = PSA_KEY_TYPE_ARIA;
1926 *key_size = 192;
1927 break;
1928 case MBEDTLS_CIPHER_ARIA_256_CBC:
1929 *alg = PSA_ALG_CBC_NO_PADDING;
1930 *key_type = PSA_KEY_TYPE_ARIA;
1931 *key_size = 256;
1932 break;
1933 case MBEDTLS_CIPHER_ARIA_256_CCM:
1934 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1935 *key_type = PSA_KEY_TYPE_ARIA;
1936 *key_size = 256;
1937 break;
1938 case MBEDTLS_CIPHER_ARIA_256_GCM:
1939 *alg = PSA_ALG_GCM;
1940 *key_type = PSA_KEY_TYPE_ARIA;
1941 *key_size = 256;
1942 break;
1943 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
1944 *alg = PSA_ALG_CBC_NO_PADDING;
1945 *key_type = PSA_KEY_TYPE_CAMELLIA;
1946 *key_size = 128;
1947 break;
1948 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
1949 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1950 *key_type = PSA_KEY_TYPE_CAMELLIA;
1951 *key_size = 128;
1952 break;
1953 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
1954 *alg = PSA_ALG_GCM;
1955 *key_type = PSA_KEY_TYPE_CAMELLIA;
1956 *key_size = 128;
1957 break;
1958 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
1959 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1960 *key_type = PSA_KEY_TYPE_CAMELLIA;
1961 *key_size = 192;
1962 break;
1963 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
1964 *alg = PSA_ALG_GCM;
1965 *key_type = PSA_KEY_TYPE_CAMELLIA;
1966 *key_size = 192;
1967 break;
1968 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
1969 *alg = PSA_ALG_CBC_NO_PADDING;
1970 *key_type = PSA_KEY_TYPE_CAMELLIA;
1971 *key_size = 256;
1972 break;
1973 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
1974 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
1975 *key_type = PSA_KEY_TYPE_CAMELLIA;
1976 *key_size = 256;
1977 break;
1978 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
1979 *alg = PSA_ALG_GCM;
1980 *key_type = PSA_KEY_TYPE_CAMELLIA;
1981 *key_size = 256;
1982 break;
1983 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
1984 *alg = PSA_ALG_CHACHA20_POLY1305;
1985 *key_type = PSA_KEY_TYPE_CHACHA20;
1986 *key_size = 256;
1987 break;
1988 case MBEDTLS_CIPHER_NULL:
1989 *alg = MBEDTLS_SSL_NULL_CIPHER;
1990 *key_type = 0;
1991 *key_size = 0;
1992 break;
1993 default:
1994 return PSA_ERROR_NOT_SUPPORTED;
1995 }
1996
1997 return PSA_SUCCESS;
1998}
Neil Armstrong8395d7a2022-05-18 11:44:56 +02001999#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002000
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002001#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckera90658f2017-10-04 15:29:08 +01002002int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
2003 const unsigned char *dhm_P, size_t P_len,
2004 const unsigned char *dhm_G, size_t G_len )
2005{
Janos Follath865b3eb2019-12-16 11:46:15 +00002006 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01002007
Glenn Strausscee11292021-12-20 01:43:17 -05002008 mbedtls_mpi_free( &conf->dhm_P );
2009 mbedtls_mpi_free( &conf->dhm_G );
2010
Hanno Beckera90658f2017-10-04 15:29:08 +01002011 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
2012 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
2013 {
2014 mbedtls_mpi_free( &conf->dhm_P );
2015 mbedtls_mpi_free( &conf->dhm_G );
2016 return( ret );
2017 }
2018
2019 return( 0 );
2020}
Paul Bakker5121ce52009-01-03 21:22:43 +00002021
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002022int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00002023{
Janos Follath865b3eb2019-12-16 11:46:15 +00002024 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00002025
Glenn Strausscee11292021-12-20 01:43:17 -05002026 mbedtls_mpi_free( &conf->dhm_P );
2027 mbedtls_mpi_free( &conf->dhm_G );
2028
Gilles Peskinee5702482021-06-11 21:59:08 +02002029 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
2030 &conf->dhm_P ) ) != 0 ||
2031 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
2032 &conf->dhm_G ) ) != 0 )
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002033 {
2034 mbedtls_mpi_free( &conf->dhm_P );
2035 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00002036 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002037 }
Paul Bakker1b57b062011-01-06 15:48:19 +00002038
2039 return( 0 );
2040}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002041#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00002042
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002043#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
2044/*
2045 * Set the minimum length for Diffie-Hellman parameters
2046 */
2047void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
2048 unsigned int bitlen )
2049{
2050 conf->dhm_min_bitlen = bitlen;
2051}
2052#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
2053
Gilles Peskineeccd8882020-03-10 12:19:08 +01002054#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002055#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002056/*
2057 * Set allowed/preferred hashes for handshake signatures
2058 */
2059void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
2060 const int *hashes )
2061{
2062 conf->sig_hashes = hashes;
2063}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002064#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002065
Jerry Yuf017ee42022-01-12 15:49:48 +08002066/* Configure allowed signature algorithms for handshake */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002067void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
2068 const uint16_t* sig_algs )
2069{
Jerry Yuf017ee42022-01-12 15:49:48 +08002070#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2071 conf->sig_hashes = NULL;
2072#endif /* !MBEDTLS_DEPRECATED_REMOVED */
2073 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01002074}
Gilles Peskineeccd8882020-03-10 12:19:08 +01002075#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002076
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02002077#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01002078#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002079/*
2080 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01002081 *
2082 * mbedtls_ssl_setup() takes the provided list
2083 * and translates it to a list of IANA TLS group identifiers,
2084 * stored in ssl->handshake->group_list.
2085 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002086 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002087void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002088 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002089{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002090 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01002091 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002092}
Brett Warrene0edc842021-08-17 09:53:13 +01002093#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01002094#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002095
Brett Warrene0edc842021-08-17 09:53:13 +01002096/*
2097 * Set the allowed groups
2098 */
2099void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
2100 const uint16_t *group_list )
2101{
2102#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
2103 conf->curve_list = NULL;
2104#endif
2105 conf->group_list = group_list;
2106}
2107
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002108#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002109int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00002110{
Hanno Becker947194e2017-04-07 13:25:49 +01002111 /* Initialize to suppress unnecessary compiler warning */
2112 size_t hostname_len = 0;
2113
2114 /* Check if new hostname is valid before
2115 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01002116 if( hostname != NULL )
2117 {
2118 hostname_len = strlen( hostname );
2119
2120 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
2121 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2122 }
2123
2124 /* Now it's clear that we will overwrite the old hostname,
2125 * so we can free it safely */
2126
2127 if( ssl->hostname != NULL )
2128 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002129 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01002130 mbedtls_free( ssl->hostname );
2131 }
2132
2133 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01002134
Paul Bakker5121ce52009-01-03 21:22:43 +00002135 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01002136 {
2137 ssl->hostname = NULL;
2138 }
2139 else
2140 {
2141 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01002142 if( ssl->hostname == NULL )
2143 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002144
Hanno Becker947194e2017-04-07 13:25:49 +01002145 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002146
Hanno Becker947194e2017-04-07 13:25:49 +01002147 ssl->hostname[hostname_len] = '\0';
2148 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002149
2150 return( 0 );
2151}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01002152#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002153
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002154#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002155void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002156 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00002157 const unsigned char *, size_t),
2158 void *p_sni )
2159{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002160 conf->f_sni = f_sni;
2161 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00002162}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002163#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00002164
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002165#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002166int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002167{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002168 size_t cur_len, tot_len;
2169 const char **p;
2170
2171 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08002172 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
2173 * MUST NOT be truncated."
2174 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002175 */
2176 tot_len = 0;
2177 for( p = protos; *p != NULL; p++ )
2178 {
2179 cur_len = strlen( *p );
2180 tot_len += cur_len;
2181
Ronald Cron8216dd32020-04-23 16:41:44 +02002182 if( ( cur_len == 0 ) ||
2183 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
2184 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002185 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002186 }
2187
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002188 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002189
2190 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002191}
2192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002193const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002194{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002195 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002196}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002197#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002198
Johan Pascalb62bb512015-12-03 21:56:45 +01002199#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldoref72faf2018-07-12 11:54:20 +03002200void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
2201 int support_mki_value )
Ron Eldor591f1622018-01-22 12:30:04 +02002202{
2203 conf->dtls_srtp_mki_support = support_mki_value;
2204}
2205
Ron Eldoref72faf2018-07-12 11:54:20 +03002206int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
2207 unsigned char *mki_value,
Johan Pascalf6417ec2020-09-22 15:15:19 +02002208 uint16_t mki_len )
Ron Eldor591f1622018-01-22 12:30:04 +02002209{
Johan Pascal5ef72d22020-10-28 17:05:47 +01002210 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
Ron Eldora9788042018-12-05 11:04:31 +02002211 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002212 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ron Eldora9788042018-12-05 11:04:31 +02002213 }
Ron Eldor591f1622018-01-22 12:30:04 +02002214
2215 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
Ron Eldora9788042018-12-05 11:04:31 +02002216 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002217 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ron Eldora9788042018-12-05 11:04:31 +02002218 }
Ron Eldor591f1622018-01-22 12:30:04 +02002219
2220 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
2221 ssl->dtls_srtp_info.mki_len = mki_len;
Ron Eldora9788042018-12-05 11:04:31 +02002222 return( 0 );
Ron Eldor591f1622018-01-22 12:30:04 +02002223}
2224
Ron Eldoref72faf2018-07-12 11:54:20 +03002225int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
Johan Pascal253d0262020-09-22 13:04:45 +02002226 const mbedtls_ssl_srtp_profile *profiles )
Johan Pascalb62bb512015-12-03 21:56:45 +01002227{
Johan Pascal253d0262020-09-22 13:04:45 +02002228 const mbedtls_ssl_srtp_profile *p;
2229 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002230
Johan Pascal253d0262020-09-22 13:04:45 +02002231 /* check the profiles list: all entry must be valid,
2232 * its size cannot be more than the total number of supported profiles, currently 4 */
Johan Pascald387aa02020-09-23 18:47:56 +02002233 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
2234 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
2235 p++ )
Johan Pascald576fdb2020-09-22 10:39:53 +02002236 {
Johan Pascal5ef72d22020-10-28 17:05:47 +01002237 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
Johan Pascald576fdb2020-09-22 10:39:53 +02002238 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002239 list_size++;
2240 }
2241 else
2242 {
2243 /* unsupported value, stop parsing and set the size to an error value */
2244 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01002245 }
2246 }
2247
Johan Pascal5ef72d22020-10-28 17:05:47 +01002248 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
Johan Pascald387aa02020-09-23 18:47:56 +02002249 {
Johan Pascal253d0262020-09-22 13:04:45 +02002250 conf->dtls_srtp_profile_list = NULL;
2251 conf->dtls_srtp_profile_list_len = 0;
2252 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2253 }
2254
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002255 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02002256 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01002257
2258 return( 0 );
2259}
2260
Johan Pascal5ef72d22020-10-28 17:05:47 +01002261void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
2262 mbedtls_dtls_srtp_info *dtls_srtp_info )
Johan Pascalb62bb512015-12-03 21:56:45 +01002263{
Johan Pascal2258a4f2020-10-28 13:53:09 +01002264 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
2265 /* do not copy the mki value if there is no chosen profile */
Johan Pascal5ef72d22020-10-28 17:05:47 +01002266 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002267 {
Johan Pascal2258a4f2020-10-28 13:53:09 +01002268 dtls_srtp_info->mki_len = 0;
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002269 }
Johan Pascal2258a4f2020-10-28 13:53:09 +01002270 else
2271 {
2272 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Johan Pascal5ef72d22020-10-28 17:05:47 +01002273 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
2274 ssl->dtls_srtp_info.mki_len );
Johan Pascal2258a4f2020-10-28 13:53:09 +01002275 }
Johan Pascalb62bb512015-12-03 21:56:45 +01002276}
Johan Pascalb62bb512015-12-03 21:56:45 +01002277#endif /* MBEDTLS_SSL_DTLS_SRTP */
2278
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002279void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00002280{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04002281 conf->max_tls_version = (major << 8) | minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00002282}
2283
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002284void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00002285{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04002286 conf->min_tls_version = (major << 8) | minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00002287}
2288
Janos Follath088ce432017-04-10 12:42:31 +01002289#if defined(MBEDTLS_SSL_SRV_C)
2290void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
2291 char cert_req_ca_list )
2292{
2293 conf->cert_req_ca_list = cert_req_ca_list;
2294}
2295#endif
2296
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002297#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002298void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002299{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002300 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002301}
2302#endif
2303
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002304#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002305void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002306{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002307 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002308}
2309#endif
2310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002311#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002312int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002313{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002314 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10002315 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002316 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002317 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002318 }
2319
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01002320 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002321
2322 return( 0 );
2323}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002324#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002325
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002326void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00002327{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002328 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00002329}
2330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002331#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002332void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002333{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002334 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002335}
2336
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002337void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002338{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002339 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002340}
2341
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002342void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002343 const unsigned char period[8] )
2344{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002345 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002346}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002347#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002348
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002349#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002350#if defined(MBEDTLS_SSL_CLI_C)
2351void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002352{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01002353 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002354}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002355#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02002356
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002357#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002358void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
2359 mbedtls_ssl_ticket_write_t *f_ticket_write,
2360 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
2361 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02002362{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002363 conf->f_ticket_write = f_ticket_write;
2364 conf->f_ticket_parse = f_ticket_parse;
2365 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02002366}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002367#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002368#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002369
Hanno Becker7e6c1782021-06-08 09:24:55 +01002370void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
2371 mbedtls_ssl_export_keys_t *f_export_keys,
2372 void *p_export_keys )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002373{
Hanno Becker7e6c1782021-06-08 09:24:55 +01002374 ssl->f_export_keys = f_export_keys;
2375 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03002376}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002377
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002378#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002379void mbedtls_ssl_conf_async_private_cb(
2380 mbedtls_ssl_config *conf,
2381 mbedtls_ssl_async_sign_t *f_async_sign,
2382 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
2383 mbedtls_ssl_async_resume_t *f_async_resume,
2384 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002385 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002386{
2387 conf->f_async_sign_start = f_async_sign;
2388 conf->f_async_decrypt_start = f_async_decrypt;
2389 conf->f_async_resume = f_async_resume;
2390 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002391 conf->p_async_config_data = async_config_data;
2392}
2393
Gilles Peskine8f97af72018-04-26 11:46:10 +02002394void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
2395{
2396 return( conf->p_async_config_data );
2397}
2398
Gilles Peskine1febfef2018-04-30 11:54:39 +02002399void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002400{
2401 if( ssl->handshake == NULL )
2402 return( NULL );
2403 else
2404 return( ssl->handshake->user_async_ctx );
2405}
2406
Gilles Peskine1febfef2018-04-30 11:54:39 +02002407void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002408 void *ctx )
2409{
2410 if( ssl->handshake != NULL )
2411 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002412}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002413#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002414
Paul Bakker5121ce52009-01-03 21:22:43 +00002415/*
2416 * SSL get accessors
2417 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02002418uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002419{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00002420 if( ssl->session != NULL )
2421 return( ssl->session->verify_result );
2422
2423 if( ssl->session_negotiate != NULL )
2424 return( ssl->session_negotiate->verify_result );
2425
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02002426 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00002427}
2428
Glenn Strauss8f526902022-01-13 00:04:49 -05002429int mbedtls_ssl_get_ciphersuite_id_from_ssl( const mbedtls_ssl_context *ssl )
2430{
2431 if( ssl == NULL || ssl->session == NULL )
2432 return( 0 );
2433
2434 return( ssl->session->ciphersuite );
2435}
2436
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002437const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00002438{
Paul Bakker926c8e42013-03-06 10:23:34 +01002439 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002440 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01002441
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002442 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00002443}
2444
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002445const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00002446{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002447#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002448 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002449 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002450 switch( ssl->tls_version )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002451 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002452 case MBEDTLS_SSL_VERSION_TLS1_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002453 return( "DTLSv1.2" );
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002454 default:
2455 return( "unknown (DTLS)" );
2456 }
2457 }
2458#endif
2459
Glenn Strauss60bfe602022-03-14 19:04:24 -04002460 switch( ssl->tls_version )
Paul Bakker43ca69c2011-01-15 17:35:19 +00002461 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002462 case MBEDTLS_SSL_VERSION_TLS1_2:
Paul Bakker1ef83d62012-04-11 12:09:53 +00002463 return( "TLSv1.2" );
Glenn Strauss60bfe602022-03-14 19:04:24 -04002464 case MBEDTLS_SSL_VERSION_TLS1_3:
Gilles Peskinec63a1e02022-01-13 01:10:24 +01002465 return( "TLSv1.3" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002466 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002467 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002468 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00002469}
2470
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002471#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002472size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
2473{
David Horstmann95d516f2021-05-04 18:36:56 +01002474 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002475 size_t read_mfl;
2476
2477 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
2478 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2479 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
2480 {
2481 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
2482 }
2483
2484 /* Check if a smaller max length was negotiated */
2485 if( ssl->session_out != NULL )
2486 {
2487 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
2488 if( read_mfl < max_len )
2489 {
2490 max_len = read_mfl;
2491 }
2492 }
2493
2494 // During a handshake, use the value being negotiated
2495 if( ssl->session_negotiate != NULL )
2496 {
2497 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2498 if( read_mfl < max_len )
2499 {
2500 max_len = read_mfl;
2501 }
2502 }
2503
2504 return( max_len );
2505}
2506
2507size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002508{
2509 size_t max_len;
2510
2511 /*
2512 * Assume mfl_code is correct since it was checked when set
2513 */
Angus Grattond8213d02016-05-25 20:56:48 +10002514 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002515
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002516 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002517 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10002518 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002519 {
Angus Grattond8213d02016-05-25 20:56:48 +10002520 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002521 }
2522
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002523 /* During a handshake, use the value being negotiated */
2524 if( ssl->session_negotiate != NULL &&
2525 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
2526 {
2527 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2528 }
2529
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002530 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002531}
2532#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2533
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002534#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002535size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002536{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04002537 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
2538 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2539 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
2540 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
2541 return ( 0 );
2542
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002543 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
2544 return( ssl->mtu );
2545
2546 if( ssl->mtu == 0 )
2547 return( ssl->handshake->mtu );
2548
2549 return( ssl->mtu < ssl->handshake->mtu ?
2550 ssl->mtu : ssl->handshake->mtu );
2551}
2552#endif /* MBEDTLS_SSL_PROTO_DTLS */
2553
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002554int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
2555{
2556 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
2557
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02002558#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2559 !defined(MBEDTLS_SSL_PROTO_DTLS)
2560 (void) ssl;
2561#endif
2562
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002563#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002564 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002565
2566 if( max_len > mfl )
2567 max_len = mfl;
2568#endif
2569
2570#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002571 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002572 {
Hanno Becker89490712020-02-05 10:50:12 +00002573 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002574 const int ret = mbedtls_ssl_get_record_expansion( ssl );
2575 const size_t overhead = (size_t) ret;
2576
2577 if( ret < 0 )
2578 return( ret );
2579
2580 if( mtu <= overhead )
2581 {
2582 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
2583 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2584 }
2585
2586 if( max_len > mtu - overhead )
2587 max_len = mtu - overhead;
2588 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002589#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002590
Hanno Becker0defedb2018-08-10 12:35:02 +01002591#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2592 !defined(MBEDTLS_SSL_PROTO_DTLS)
2593 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002594#endif
2595
2596 return( (int) max_len );
2597}
2598
Hanno Becker2d8e99b2021-04-21 06:19:50 +01002599int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
2600{
2601 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
2602
2603#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2604 (void) ssl;
2605#endif
2606
2607#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2608 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
2609
2610 if( max_len > mfl )
2611 max_len = mfl;
2612#endif
2613
2614 return( (int) max_len );
2615}
2616
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002617#if defined(MBEDTLS_X509_CRT_PARSE_C)
2618const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00002619{
2620 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002621 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00002622
Hanno Beckere6824572019-02-07 13:18:46 +00002623#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002624 return( ssl->session->peer_cert );
Hanno Beckere6824572019-02-07 13:18:46 +00002625#else
2626 return( NULL );
2627#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002628}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002629#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002630
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002631#if defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerf852b1c2019-02-05 11:42:30 +00002632int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
2633 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002634{
Hanno Beckere810bbc2021-05-14 16:01:05 +01002635 int ret;
2636
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002637 if( ssl == NULL ||
2638 dst == NULL ||
2639 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002640 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002641 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002642 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002643 }
2644
Hanno Beckere810bbc2021-05-14 16:01:05 +01002645 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
2646 * idempotent: Each session can only be exported once.
2647 *
2648 * (This is in preparation for TLS 1.3 support where we will
2649 * need the ability to export multiple sessions (aka tickets),
2650 * which will be achieved by calling mbedtls_ssl_get_session()
2651 * multiple times until it fails.)
2652 *
2653 * Check whether we have already exported the current session,
2654 * and fail if so.
2655 */
2656 if( ssl->session->exported == 1 )
2657 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2658
2659 ret = mbedtls_ssl_session_copy( dst, ssl->session );
2660 if( ret != 0 )
2661 return( ret );
2662
2663 /* Remember that we've exported the session. */
2664 ssl->session->exported = 1;
2665 return( 0 );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002666}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002667#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002668
Paul Bakker5121ce52009-01-03 21:22:43 +00002669/*
Hanno Beckera835da52019-05-16 12:39:07 +01002670 * Define ticket header determining Mbed TLS version
2671 * and structure of the ticket.
2672 */
2673
Hanno Becker94ef3b32019-05-16 12:50:45 +01002674/*
Hanno Becker50b59662019-05-28 14:30:45 +01002675 * Define bitflag determining compile-time settings influencing
2676 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01002677 */
2678
Hanno Becker50b59662019-05-28 14:30:45 +01002679#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01002680#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01002681#else
Hanno Becker3e088662019-05-29 11:10:18 +01002682#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002683#endif /* MBEDTLS_HAVE_TIME */
2684
2685#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01002686#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002687#else
Hanno Becker3e088662019-05-29 11:10:18 +01002688#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002689#endif /* MBEDTLS_X509_CRT_PARSE_C */
2690
2691#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01002692#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002693#else
Hanno Becker3e088662019-05-29 11:10:18 +01002694#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002695#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
2696
2697#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01002698#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002699#else
Hanno Becker3e088662019-05-29 11:10:18 +01002700#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002701#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2702
Hanno Becker94ef3b32019-05-16 12:50:45 +01002703#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01002704#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002705#else
Hanno Becker3e088662019-05-29 11:10:18 +01002706#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002707#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
2708
Hanno Becker94ef3b32019-05-16 12:50:45 +01002709#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2710#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
2711#else
2712#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
2713#endif /* MBEDTLS_SSL_SESSION_TICKETS */
2714
Hanno Becker3e088662019-05-29 11:10:18 +01002715#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
2716#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
2717#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
2718#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01002719#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
2720#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01002721
Hanno Becker50b59662019-05-28 14:30:45 +01002722#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Becker3e088662019-05-29 11:10:18 +01002723 ( (uint16_t) ( \
2724 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
2725 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
2726 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
2727 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
Hanno Becker3e088662019-05-29 11:10:18 +01002728 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Beckerbe34e8e2019-06-04 09:43:16 +01002729 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
Hanno Becker94ef3b32019-05-16 12:50:45 +01002730
Hanno Beckerf8787072019-05-16 12:41:07 +01002731static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01002732 MBEDTLS_VERSION_MAJOR,
2733 MBEDTLS_VERSION_MINOR,
2734 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01002735 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
2736 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
Hanno Beckerf8787072019-05-16 12:41:07 +01002737};
Hanno Beckera835da52019-05-16 12:39:07 +01002738
2739/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002740 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02002741 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002742 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002743 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01002744 *
Hanno Beckerdce50972021-08-01 05:39:23 +01002745 * opaque mbedtls_version[3]; // library version: major, minor, patch
2746 * opaque session_format[2]; // library-version specific 16-bit field
2747 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002748 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01002749 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002750 * Note: When updating the format, remember to keep
2751 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002752 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002753 * // In this version, `session_format` determines
2754 * // the setting of those compile-time
2755 * // configuration options which influence
2756 * // the structure of mbedtls_ssl_session.
2757 *
Glenn Straussda7851c2022-03-14 13:29:48 -04002758 * uint8_t minor_ver; // Protocol minor version. Possible values:
2759 * // - TLS 1.2 (3)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002760 *
Glenn Straussda7851c2022-03-14 13:29:48 -04002761 * select (serialized_session.tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002762 *
Glenn Straussda7851c2022-03-14 13:29:48 -04002763 * case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002764 * serialized_session_tls12 data;
2765 *
2766 * };
2767 *
2768 * } serialized_session;
2769 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002770 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002771
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002772MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002773static int ssl_session_save( const mbedtls_ssl_session *session,
2774 unsigned char omit_header,
2775 unsigned char *buf,
2776 size_t buf_len,
2777 size_t *olen )
2778{
2779 unsigned char *p = buf;
2780 size_t used = 0;
2781
2782 if( !omit_header )
2783 {
2784 /*
2785 * Add Mbed TLS version identifier
2786 */
2787
2788 used += sizeof( ssl_serialized_session_header );
2789
2790 if( used <= buf_len )
2791 {
2792 memcpy( p, ssl_serialized_session_header,
2793 sizeof( ssl_serialized_session_header ) );
2794 p += sizeof( ssl_serialized_session_header );
2795 }
2796 }
2797
2798 /*
2799 * TLS version identifier
2800 */
2801 used += 1;
2802 if( used <= buf_len )
2803 {
Glenn Straussda7851c2022-03-14 13:29:48 -04002804 *p++ = MBEDTLS_BYTE_0( session->tls_version );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002805 }
2806
2807 /* Forward to version-specific serialization routine. */
Glenn Straussda7851c2022-03-14 13:29:48 -04002808 switch( session->tls_version )
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002809 {
2810#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Glenn Straussda7851c2022-03-14 13:29:48 -04002811 case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002812 {
2813 size_t remaining_len = used <= buf_len ? buf_len - used : 0;
2814 used += ssl_session_save_tls12( session, p, remaining_len );
2815 break;
2816 }
2817#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2818
2819 default:
2820 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2821 }
2822
2823 *olen = used;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02002824 if( used > buf_len )
2825 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002826
2827 return( 0 );
2828}
2829
2830/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02002831 * Public wrapper for ssl_session_save()
2832 */
2833int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
2834 unsigned char *buf,
2835 size_t buf_len,
2836 size_t *olen )
2837{
2838 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
2839}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002840
Jerry Yuf1b23ca2022-02-18 11:48:47 +08002841/*
2842 * Deserialize session, see mbedtls_ssl_session_save() for format.
2843 *
2844 * This internal version is wrapped by a public function that cleans up in
2845 * case of error, and has an extra option omit_header.
2846 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002847MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002848static int ssl_session_load( mbedtls_ssl_session *session,
2849 unsigned char omit_header,
2850 const unsigned char *buf,
2851 size_t len )
2852{
2853 const unsigned char *p = buf;
2854 const unsigned char * const end = buf + len;
2855
2856 if( !omit_header )
2857 {
2858 /*
2859 * Check Mbed TLS version identifier
2860 */
2861
2862 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
2863 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2864
2865 if( memcmp( p, ssl_serialized_session_header,
2866 sizeof( ssl_serialized_session_header ) ) != 0 )
2867 {
2868 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
2869 }
2870 p += sizeof( ssl_serialized_session_header );
2871 }
2872
2873 /*
2874 * TLS version identifier
2875 */
2876 if( 1 > (size_t)( end - p ) )
2877 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Glenn Straussda7851c2022-03-14 13:29:48 -04002878 session->tls_version = 0x0300 | *p++;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002879
2880 /* Dispatch according to TLS version. */
Glenn Straussda7851c2022-03-14 13:29:48 -04002881 switch( session->tls_version )
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002882 {
2883#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Glenn Straussda7851c2022-03-14 13:29:48 -04002884 case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002885 {
2886 size_t remaining_len = ( end - p );
2887 return( ssl_session_load_tls12( session, p, remaining_len ) );
2888 }
2889#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2890
2891 default:
2892 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2893 }
2894}
2895
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002896/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02002897 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02002898 */
2899int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
2900 const unsigned char *buf,
2901 size_t len )
2902{
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02002903 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02002904
2905 if( ret != 0 )
2906 mbedtls_ssl_session_free( session );
2907
2908 return( ret );
2909}
2910
2911/*
Paul Bakker1961b702013-01-25 14:49:24 +01002912 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00002913 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002914MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker41934dd2021-08-07 19:13:43 +01002915static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
2916{
2917 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2918
Ronald Cron66dbf912022-02-02 15:33:46 +01002919 /*
2920 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01002921 * that were written into the output buffer by the previous handshake step,
2922 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01002923 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
2924 * We proceed to the next handshake step only when all data from the
2925 * previous one have been sent to the peer, thus we make sure that this is
2926 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
2927 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
2928 * we have to wait before to go ahead.
2929 * In the case of TLS 1.3, handshake step handlers do not send data to the
2930 * peer. Data are only sent here and through
2931 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
Andrzej Kurek5c65c572022-04-13 14:28:52 -04002932 * alert occurred.
Ronald Cron66dbf912022-02-02 15:33:46 +01002933 */
Hanno Becker41934dd2021-08-07 19:13:43 +01002934 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
2935 return( ret );
2936
2937#if defined(MBEDTLS_SSL_PROTO_DTLS)
2938 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2939 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
2940 {
2941 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2942 return( ret );
2943 }
2944#endif /* MBEDTLS_SSL_PROTO_DTLS */
2945
2946 return( ret );
2947}
2948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002949int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002950{
Hanno Becker41934dd2021-08-07 19:13:43 +01002951 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00002952
Hanno Becker41934dd2021-08-07 19:13:43 +01002953 if( ssl == NULL ||
2954 ssl->conf == NULL ||
2955 ssl->handshake == NULL ||
Paul Elliott27b0d942022-03-18 21:55:32 +00002956 mbedtls_ssl_is_handshake_over( ssl ) == 1 )
Hanno Becker41934dd2021-08-07 19:13:43 +01002957 {
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02002958 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker41934dd2021-08-07 19:13:43 +01002959 }
2960
2961 ret = ssl_prepare_handshake_step( ssl );
2962 if( ret != 0 )
2963 return( ret );
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02002964
Jerry Yue7047812021-09-13 19:26:39 +08002965 ret = mbedtls_ssl_handle_pending_alert( ssl );
2966 if( ret != 0 )
2967 goto cleanup;
2968
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002969#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002970 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Jerry Yub9930e72021-08-06 17:11:51 +08002971 {
Ronald Cron27c85e72022-03-08 11:37:55 +01002972 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %s",
2973 mbedtls_ssl_states_str( ssl->state ) ) );
Jerry Yub9930e72021-08-06 17:11:51 +08002974
Ronald Cron9f0fba32022-02-10 16:45:15 +01002975 switch( ssl->state )
2976 {
2977 case MBEDTLS_SSL_HELLO_REQUEST:
2978 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
2979 break;
Jerry Yub9930e72021-08-06 17:11:51 +08002980
Ronald Cron9f0fba32022-02-10 16:45:15 +01002981 case MBEDTLS_SSL_CLIENT_HELLO:
2982 ret = mbedtls_ssl_write_client_hello( ssl );
2983 break;
2984
2985 default:
2986#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Glenn Strauss60bfe602022-03-14 19:04:24 -04002987 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Ronald Cron9f0fba32022-02-10 16:45:15 +01002988 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
2989 else
2990 ret = mbedtls_ssl_handshake_client_step( ssl );
2991#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
2992 ret = mbedtls_ssl_handshake_client_step( ssl );
2993#else
2994 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
2995#endif
2996 }
Jerry Yub9930e72021-08-06 17:11:51 +08002997 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002998#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002999#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003000 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Jerry Yub9930e72021-08-06 17:11:51 +08003001 {
Ronald Cron6f135e12021-12-08 16:57:54 +01003002#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yub9930e72021-08-06 17:11:51 +08003003 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yu27561932021-08-27 17:07:38 +08003004 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
Ronald Cron6f135e12021-12-08 16:57:54 +01003005#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08003006
3007#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3008 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
3009 ret = mbedtls_ssl_handshake_server_step( ssl );
3010#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3011 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003012#endif
3013
Jerry Yue7047812021-09-13 19:26:39 +08003014 if( ret != 0 )
3015 {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08003016 /* handshake_step return error. And it is same
3017 * with alert_reason.
3018 */
Jerry Yu3bf1f972021-09-22 21:37:18 +08003019 if( ssl->send_alert )
Jerry Yue7047812021-09-13 19:26:39 +08003020 {
Jerry Yu3bf1f972021-09-22 21:37:18 +08003021 ret = mbedtls_ssl_handle_pending_alert( ssl );
Jerry Yue7047812021-09-13 19:26:39 +08003022 goto cleanup;
3023 }
3024 }
3025
3026cleanup:
Paul Bakker1961b702013-01-25 14:49:24 +01003027 return( ret );
3028}
3029
3030/*
3031 * Perform the SSL handshake
3032 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003033int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01003034{
3035 int ret = 0;
3036
Hanno Beckera817ea42020-10-20 15:20:23 +01003037 /* Sanity checks */
3038
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003039 if( ssl == NULL || ssl->conf == NULL )
3040 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3041
Hanno Beckera817ea42020-10-20 15:20:23 +01003042#if defined(MBEDTLS_SSL_PROTO_DTLS)
3043 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3044 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
3045 {
3046 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
3047 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
3048 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3049 }
3050#endif /* MBEDTLS_SSL_PROTO_DTLS */
3051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003052 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01003053
Hanno Beckera817ea42020-10-20 15:20:23 +01003054 /* Main handshake loop */
Paul Elliott27b0d942022-03-18 21:55:32 +00003055 while( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01003056 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003057 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003058
3059 if( ret != 0 )
3060 break;
3061 }
3062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003063 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003064
3065 return( ret );
3066}
3067
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003068#if defined(MBEDTLS_SSL_RENEGOTIATION)
3069#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00003070/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003071 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00003072 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003073MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003074static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003075{
Janos Follath865b3eb2019-12-16 11:46:15 +00003076 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003077
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003078 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003079
3080 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003081 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3082 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003083
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003084 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003085 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003086 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003087 return( ret );
3088 }
3089
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003090 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003091
3092 return( 0 );
3093}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003094#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003095
3096/*
3097 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003098 * - any side: calling mbedtls_ssl_renegotiate(),
3099 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
3100 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02003101 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003102 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003103 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003104 */
Hanno Becker40cdaa12020-02-05 10:48:27 +00003105int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003106{
Janos Follath865b3eb2019-12-16 11:46:15 +00003107 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00003108
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003109 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003110
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003111 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3112 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003113
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003114 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
3115 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003116#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003117 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003118 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003119 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003120 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003121 ssl->handshake->out_msg_seq = 1;
3122 else
3123 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003124 }
3125#endif
3126
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003127 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3128 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00003129
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003130 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00003131 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003132 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003133 return( ret );
3134 }
3135
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003136 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003137
3138 return( 0 );
3139}
3140
3141/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003142 * Renegotiate current connection on client,
3143 * or request renegotiation on server
3144 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003145int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003146{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003147 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003148
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003149 if( ssl == NULL || ssl->conf == NULL )
3150 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003152#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003153 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003154 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003155 {
Paul Elliott27b0d942022-03-18 21:55:32 +00003156 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003157 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003158
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003159 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003160
3161 /* Did we already try/start sending HelloRequest? */
3162 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003163 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003164
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003165 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003166 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003167#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003168
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003169#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003170 /*
3171 * On client, either start the renegotiation process or,
3172 * if already in progress, continue the handshake
3173 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003174 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003175 {
Paul Elliott27b0d942022-03-18 21:55:32 +00003176 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003177 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003178
Hanno Becker40cdaa12020-02-05 10:48:27 +00003179 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003180 {
Hanno Becker40cdaa12020-02-05 10:48:27 +00003181 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003182 return( ret );
3183 }
3184 }
3185 else
3186 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003187 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003188 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003189 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003190 return( ret );
3191 }
3192 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003193#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003194
Paul Bakker37ce0ff2013-10-31 14:32:04 +01003195 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003196}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003197#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003198
Gilles Peskine9b562d52018-04-25 20:32:43 +02003199void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003200{
Gilles Peskine9b562d52018-04-25 20:32:43 +02003201 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3202
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003203 if( handshake == NULL )
3204 return;
3205
Brett Warrene0edc842021-08-17 09:53:13 +01003206#if defined(MBEDTLS_ECP_C)
3207#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3208 if ( ssl->handshake->group_list_heap_allocated )
3209 mbedtls_free( (void*) handshake->group_list );
3210 handshake->group_list = NULL;
3211#endif /* MBEDTLS_DEPRECATED_REMOVED */
3212#endif /* MBEDTLS_ECP_C */
3213
Jerry Yuf017ee42022-01-12 15:49:48 +08003214#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3215#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3216 if ( ssl->handshake->sig_algs_heap_allocated )
3217 mbedtls_free( (void*) handshake->sig_algs );
3218 handshake->sig_algs = NULL;
3219#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00003220#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3221 if( ssl->handshake->certificate_request_context )
3222 {
3223 mbedtls_free( (void*) handshake->certificate_request_context );
3224 }
3225#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuf017ee42022-01-12 15:49:48 +08003226#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
3227
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003228#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3229 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
3230 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003231 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003232 handshake->async_in_progress = 0;
3233 }
3234#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3235
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003236#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003237#if defined(MBEDTLS_USE_PSA_CRYPTO)
3238 psa_hash_abort( &handshake->fin_sha256_psa );
3239#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003240 mbedtls_sha256_free( &handshake->fin_sha256 );
3241#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003242#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02003243#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003244#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05003245 psa_hash_abort( &handshake->fin_sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05003246#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003247 mbedtls_sha512_free( &handshake->fin_sha512 );
3248#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003249#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003251#if defined(MBEDTLS_DHM_C)
3252 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00003253#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +02003254#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003255 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02003256#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003257#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003258 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02003259#if defined(MBEDTLS_SSL_CLI_C)
3260 mbedtls_free( handshake->ecjpake_cache );
3261 handshake->ecjpake_cache = NULL;
3262 handshake->ecjpake_cache_len = 0;
3263#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003264#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02003265
Janos Follath4ae5c292016-02-10 11:27:43 +00003266#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
3267 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02003268 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003269 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02003270#endif
3271
Gilles Peskineeccd8882020-03-10 12:19:08 +01003272#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02003273#if defined(MBEDTLS_USE_PSA_CRYPTO)
3274 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
3275 {
3276 /* The maintenance of the external PSK key slot is the
3277 * user's responsibility. */
3278 if( ssl->handshake->psk_opaque_is_internal )
3279 {
3280 psa_destroy_key( ssl->handshake->psk_opaque );
3281 ssl->handshake->psk_opaque_is_internal = 0;
3282 }
3283 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
3284 }
Neil Armstronge952a302022-05-03 10:22:14 +02003285#else
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003286 if( handshake->psk != NULL )
3287 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003288 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003289 mbedtls_free( handshake->psk );
3290 }
Neil Armstronge952a302022-05-03 10:22:14 +02003291#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003292#endif
3293
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003294#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3295 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02003296 /*
3297 * Free only the linked list wrapper, not the keys themselves
3298 * since the belong to the SNI callback
3299 */
Glenn Strauss36872db2022-01-22 05:06:31 -05003300 ssl_key_cert_free( handshake->sni_key_cert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003301#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02003302
Gilles Peskineeccd8882020-03-10 12:19:08 +01003303#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02003304 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Becker3dad3112019-02-05 17:19:52 +00003305 if( handshake->ecrs_peer_cert != NULL )
3306 {
3307 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
3308 mbedtls_free( handshake->ecrs_peer_cert );
3309 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02003310#endif
3311
Hanno Becker75173122019-02-06 16:18:31 +00003312#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3313 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3314 mbedtls_pk_free( &handshake->peer_pubkey );
3315#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3316
XiaokangQian9b93c0d2022-02-09 06:02:25 +00003317#if defined(MBEDTLS_SSL_CLI_C) && \
3318 ( defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
3319 mbedtls_free( handshake->cookie );
3320#endif /* MBEDTLS_SSL_CLI_C &&
3321 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00003322
3323#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker533ab5f2020-02-05 10:49:13 +00003324 mbedtls_ssl_flight_free( handshake->flight );
3325 mbedtls_ssl_buffering_free( ssl );
XiaokangQian8499b6c2022-01-27 09:00:11 +00003326#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02003327
Ronald Cronf12b81d2022-03-15 10:42:41 +01003328#if defined(MBEDTLS_ECDH_C) && \
3329 ( defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
Neil Armstrongf716a702022-04-04 11:23:46 +02003330 if( handshake->ecdh_psa_privkey_is_external == 0 )
Neil Armstrong8113d252022-03-23 10:57:04 +01003331 psa_destroy_key( handshake->ecdh_psa_privkey );
Hanno Becker4a63ed42019-01-08 11:39:35 +00003332#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
3333
Ronald Cron6f135e12021-12-08 16:57:54 +01003334#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yua1a568c2021-11-09 10:17:21 +08003335 mbedtls_ssl_transform_free( handshake->transform_handshake );
3336 mbedtls_ssl_transform_free( handshake->transform_earlydata );
Jerry Yuba9c7272021-10-30 11:54:10 +08003337 mbedtls_free( handshake->transform_earlydata );
3338 mbedtls_free( handshake->transform_handshake );
Ronald Cron6f135e12021-12-08 16:57:54 +01003339#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08003340
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003341
3342#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3343 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
3344 * processes datagrams and the fact that a datagram is allowed to have
3345 * several records in it, it is possible that the I/O buffers are not
3346 * empty at this stage */
Andrzej Kurek4a063792020-10-21 15:08:44 +02003347 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
3348 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003349#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01003350
Jerry Yuba9c7272021-10-30 11:54:10 +08003351 /* mbedtls_platform_zeroize MUST be last one in this function */
3352 mbedtls_platform_zeroize( handshake,
3353 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003354}
3355
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003356void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00003357{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003358 if( session == NULL )
3359 return;
3360
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003361#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker1294a0b2019-02-05 12:38:15 +00003362 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +02003363#endif
Paul Bakker0a597072012-09-25 21:55:46 +00003364
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003365#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003366 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02003367#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02003368
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003369 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003370}
3371
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02003372#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003373
3374#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3375#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
3376#else
3377#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
3378#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3379
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003380#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003381
3382#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3383#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
3384#else
3385#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
3386#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3387
3388#if defined(MBEDTLS_SSL_ALPN)
3389#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
3390#else
3391#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
3392#endif /* MBEDTLS_SSL_ALPN */
3393
3394#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
3395#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
3396#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
3397#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
3398
3399#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
3400 ( (uint32_t) ( \
3401 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
3402 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
3403 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
3404 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
3405 0u ) )
3406
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003407static unsigned char ssl_serialized_context_header[] = {
3408 MBEDTLS_VERSION_MAJOR,
3409 MBEDTLS_VERSION_MINOR,
3410 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01003411 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3412 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3413 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3414 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3415 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003416};
3417
Paul Bakker5121ce52009-01-03 21:22:43 +00003418/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003419 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003420 *
3421 * The format of the serialized data is:
3422 * (in the presentation language of TLS, RFC 8446 section 3)
3423 *
3424 * // header
3425 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003426 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003427 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003428 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003429 * Note: When updating the format, remember to keep these
3430 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003431 *
3432 * // session sub-structure
3433 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
3434 * // transform sub-structure
3435 * uint8 random[64]; // ServerHello.random+ClientHello.random
3436 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
3437 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
3438 * // fields from ssl_context
3439 * uint32 badmac_seen; // DTLS: number of records with failing MAC
3440 * uint64 in_window_top; // DTLS: last validated record seq_num
3441 * uint64 in_window; // DTLS: bitmask for replay protection
3442 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
3443 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
3444 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
3445 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
3446 *
3447 * Note that many fields of the ssl_context or sub-structures are not
3448 * serialized, as they fall in one of the following categories:
3449 *
3450 * 1. forced value (eg in_left must be 0)
3451 * 2. pointer to dynamically-allocated memory (eg session, transform)
3452 * 3. value can be re-derived from other data (eg session keys from MS)
3453 * 4. value was temporary (eg content of input buffer)
3454 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003455 */
3456int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
3457 unsigned char *buf,
3458 size_t buf_len,
3459 size_t *olen )
3460{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003461 unsigned char *p = buf;
3462 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003463 size_t session_len;
3464 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003465
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003466 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003467 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
3468 * this function's documentation.
3469 *
3470 * These are due to assumptions/limitations in the implementation. Some of
3471 * them are likely to stay (no handshake in progress) some might go away
3472 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003473 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003474 /* The initial handshake must be over */
Paul Elliott27b0d942022-03-18 21:55:32 +00003475 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003476 {
3477 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003478 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003479 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003480 if( ssl->handshake != NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003481 {
3482 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003483 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003484 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003485 /* Double-check that sub-structures are indeed ready */
3486 if( ssl->transform == NULL || ssl->session == NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003487 {
3488 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003489 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003490 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003491 /* There must be no pending incoming or outgoing data */
3492 if( mbedtls_ssl_check_pending( ssl ) != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003493 {
3494 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003495 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003496 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003497 if( ssl->out_left != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003498 {
3499 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003500 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003501 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003502 /* Protocol must be DLTS, not TLS */
3503 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003504 {
3505 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003506 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003507 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003508 /* Version must be 1.2 */
Glenn Strauss60bfe602022-03-14 19:04:24 -04003509 if( ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003510 {
3511 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003512 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003513 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003514 /* We must be using an AEAD ciphersuite */
3515 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003516 {
3517 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003518 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003519 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003520 /* Renegotiation must not be enabled */
3521#if defined(MBEDTLS_SSL_RENEGOTIATION)
3522 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003523 {
3524 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003525 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003526 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003527#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003528
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003529 /*
3530 * Version and format identifier
3531 */
3532 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003533
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003534 if( used <= buf_len )
3535 {
3536 memcpy( p, ssl_serialized_context_header,
3537 sizeof( ssl_serialized_context_header ) );
3538 p += sizeof( ssl_serialized_context_header );
3539 }
3540
3541 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003542 * Session (length + data)
3543 */
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003544 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003545 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
3546 return( ret );
3547
3548 used += 4 + session_len;
3549 if( used <= buf_len )
3550 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003551 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
3552 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003553
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003554 ret = ssl_session_save( ssl->session, 1,
3555 p, session_len, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003556 if( ret != 0 )
3557 return( ret );
3558
3559 p += session_len;
3560 }
3561
3562 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003563 * Transform
3564 */
3565 used += sizeof( ssl->transform->randbytes );
3566 if( used <= buf_len )
3567 {
3568 memcpy( p, ssl->transform->randbytes,
3569 sizeof( ssl->transform->randbytes ) );
3570 p += sizeof( ssl->transform->randbytes );
3571 }
3572
3573#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3574 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
3575 if( used <= buf_len )
3576 {
3577 *p++ = ssl->transform->in_cid_len;
3578 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
3579 p += ssl->transform->in_cid_len;
3580
3581 *p++ = ssl->transform->out_cid_len;
3582 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
3583 p += ssl->transform->out_cid_len;
3584 }
3585#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3586
3587 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003588 * Saved fields from top-level ssl_context structure
3589 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003590 used += 4;
3591 if( used <= buf_len )
3592 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003593 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
3594 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003595 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003596
3597#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3598 used += 16;
3599 if( used <= buf_len )
3600 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003601 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
3602 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003603
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003604 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
3605 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003606 }
3607#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3608
3609#if defined(MBEDTLS_SSL_PROTO_DTLS)
3610 used += 1;
3611 if( used <= buf_len )
3612 {
3613 *p++ = ssl->disable_datagram_packing;
3614 }
3615#endif /* MBEDTLS_SSL_PROTO_DTLS */
3616
Jerry Yuae0b2e22021-10-08 15:21:19 +08003617 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003618 if( used <= buf_len )
3619 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08003620 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
3621 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003622 }
3623
3624#if defined(MBEDTLS_SSL_PROTO_DTLS)
3625 used += 2;
3626 if( used <= buf_len )
3627 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003628 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
3629 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003630 }
3631#endif /* MBEDTLS_SSL_PROTO_DTLS */
3632
3633#if defined(MBEDTLS_SSL_ALPN)
3634 {
3635 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnardf041f4e2019-07-24 00:58:27 +02003636 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003637 : 0;
3638
3639 used += 1 + alpn_len;
3640 if( used <= buf_len )
3641 {
3642 *p++ = alpn_len;
3643
3644 if( ssl->alpn_chosen != NULL )
3645 {
3646 memcpy( p, ssl->alpn_chosen, alpn_len );
3647 p += alpn_len;
3648 }
3649 }
3650 }
3651#endif /* MBEDTLS_SSL_ALPN */
3652
3653 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003654 * Done
3655 */
3656 *olen = used;
3657
3658 if( used > buf_len )
3659 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003660
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003661 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
3662
Hanno Becker43aefe22020-02-05 10:44:56 +00003663 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003664}
3665
3666/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003667 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003668 *
3669 * This internal version is wrapped by a public function that cleans up in
3670 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003671 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003672MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003673static int ssl_context_load( mbedtls_ssl_context *ssl,
3674 const unsigned char *buf,
3675 size_t len )
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003676{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003677 const unsigned char *p = buf;
3678 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003679 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00003680 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003681
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003682 /*
3683 * The context should have been freshly setup or reset.
3684 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02003685 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003686 * renegotiating, or if the user mistakenly loaded a session first.)
3687 */
3688 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
3689 ssl->session != NULL )
3690 {
3691 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3692 }
3693
3694 /*
3695 * We can't check that the config matches the initial one, but we can at
3696 * least check it matches the requirements for serializing.
3697 */
3698 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Glenn Strauss2dfcea22022-03-14 17:26:42 -04003699 ssl->conf->max_tls_version < MBEDTLS_SSL_VERSION_TLS1_2 ||
3700 ssl->conf->min_tls_version > MBEDTLS_SSL_VERSION_TLS1_2 ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003701#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02003702 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003703#endif
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02003704 0 )
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003705 {
3706 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3707 }
3708
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003709 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
3710
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003711 /*
3712 * Check version identifier
3713 */
3714 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
3715 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3716
3717 if( memcmp( p, ssl_serialized_context_header,
3718 sizeof( ssl_serialized_context_header ) ) != 0 )
3719 {
3720 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
3721 }
3722 p += sizeof( ssl_serialized_context_header );
3723
3724 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003725 * Session
3726 */
3727 if( (size_t)( end - p ) < 4 )
3728 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3729
3730 session_len = ( (size_t) p[0] << 24 ) |
3731 ( (size_t) p[1] << 16 ) |
3732 ( (size_t) p[2] << 8 ) |
3733 ( (size_t) p[3] );
3734 p += 4;
3735
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003736 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00003737 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003738 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003739 ssl->session_in = ssl->session;
3740 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003741 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003742
3743 if( (size_t)( end - p ) < session_len )
3744 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3745
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003746 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003747 if( ret != 0 )
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003748 {
3749 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003750 return( ret );
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003751 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003752
3753 p += session_len;
3754
3755 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003756 * Transform
3757 */
3758
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003759 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00003760 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003761 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003762 ssl->transform_in = ssl->transform;
3763 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003764 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003765
3766 /* Read random bytes and populate structure */
3767 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
3768 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yu840fbb22022-02-17 14:59:29 +08003769#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerbd257552021-03-22 06:59:27 +00003770 ret = ssl_tls12_populate_transform( ssl->transform,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003771 ssl->session->ciphersuite,
3772 ssl->session->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02003773#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003774 ssl->session->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02003775#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003776 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
3777 p, /* currently pointing to randbytes */
Glenn Strauss07c64162022-03-14 12:34:51 -04003778 MBEDTLS_SSL_VERSION_TLS1_2, /* (D)TLS 1.2 is forced */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003779 ssl->conf->endpoint,
3780 ssl );
3781 if( ret != 0 )
3782 return( ret );
Jerry Yu840fbb22022-02-17 14:59:29 +08003783#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003784 p += sizeof( ssl->transform->randbytes );
3785
3786#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3787 /* Read connection IDs and store them */
3788 if( (size_t)( end - p ) < 1 )
3789 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3790
3791 ssl->transform->in_cid_len = *p++;
3792
Manuel Pégourié-Gonnard5ea13b82019-07-23 15:02:54 +02003793 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003794 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3795
3796 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
3797 p += ssl->transform->in_cid_len;
3798
3799 ssl->transform->out_cid_len = *p++;
3800
3801 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
3802 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3803
3804 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
3805 p += ssl->transform->out_cid_len;
3806#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3807
3808 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003809 * Saved fields from top-level ssl_context structure
3810 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003811 if( (size_t)( end - p ) < 4 )
3812 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3813
3814 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
3815 ( (uint32_t) p[1] << 16 ) |
3816 ( (uint32_t) p[2] << 8 ) |
3817 ( (uint32_t) p[3] );
3818 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003819
3820#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3821 if( (size_t)( end - p ) < 16 )
3822 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3823
3824 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
3825 ( (uint64_t) p[1] << 48 ) |
3826 ( (uint64_t) p[2] << 40 ) |
3827 ( (uint64_t) p[3] << 32 ) |
3828 ( (uint64_t) p[4] << 24 ) |
3829 ( (uint64_t) p[5] << 16 ) |
3830 ( (uint64_t) p[6] << 8 ) |
3831 ( (uint64_t) p[7] );
3832 p += 8;
3833
3834 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
3835 ( (uint64_t) p[1] << 48 ) |
3836 ( (uint64_t) p[2] << 40 ) |
3837 ( (uint64_t) p[3] << 32 ) |
3838 ( (uint64_t) p[4] << 24 ) |
3839 ( (uint64_t) p[5] << 16 ) |
3840 ( (uint64_t) p[6] << 8 ) |
3841 ( (uint64_t) p[7] );
3842 p += 8;
3843#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3844
3845#if defined(MBEDTLS_SSL_PROTO_DTLS)
3846 if( (size_t)( end - p ) < 1 )
3847 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3848
3849 ssl->disable_datagram_packing = *p++;
3850#endif /* MBEDTLS_SSL_PROTO_DTLS */
3851
Jerry Yud9a94fe2021-09-28 18:58:59 +08003852 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003853 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yud9a94fe2021-09-28 18:58:59 +08003854 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
3855 p += sizeof( ssl->cur_out_ctr );
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003856
3857#if defined(MBEDTLS_SSL_PROTO_DTLS)
3858 if( (size_t)( end - p ) < 2 )
3859 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3860
3861 ssl->mtu = ( p[0] << 8 ) | p[1];
3862 p += 2;
3863#endif /* MBEDTLS_SSL_PROTO_DTLS */
3864
3865#if defined(MBEDTLS_SSL_ALPN)
3866 {
3867 uint8_t alpn_len;
3868 const char **cur;
3869
3870 if( (size_t)( end - p ) < 1 )
3871 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3872
3873 alpn_len = *p++;
3874
3875 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
3876 {
3877 /* alpn_chosen should point to an item in the configured list */
3878 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
3879 {
3880 if( strlen( *cur ) == alpn_len &&
3881 memcmp( p, cur, alpn_len ) == 0 )
3882 {
3883 ssl->alpn_chosen = *cur;
3884 break;
3885 }
3886 }
3887 }
3888
3889 /* can only happen on conf mismatch */
3890 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
3891 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3892
3893 p += alpn_len;
3894 }
3895#endif /* MBEDTLS_SSL_ALPN */
3896
3897 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003898 * Forced fields from top-level ssl_context structure
3899 *
3900 * Most of them already set to the correct value by mbedtls_ssl_init() and
3901 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
3902 */
3903 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Glenn Strauss60bfe602022-03-14 19:04:24 -04003904 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003905
Hanno Becker361b10d2019-08-30 10:42:49 +01003906 /* Adjust pointers for header fields of outgoing records to
3907 * the given transform, accounting for explicit IV and CID. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00003908 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
Hanno Becker361b10d2019-08-30 10:42:49 +01003909
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003910#if defined(MBEDTLS_SSL_PROTO_DTLS)
3911 ssl->in_epoch = 1;
3912#endif
3913
3914 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
3915 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00003916 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
3917 * inappropriately. */
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02003918 if( ssl->handshake != NULL )
3919 {
3920 mbedtls_ssl_handshake_free( ssl );
3921 mbedtls_free( ssl->handshake );
3922 ssl->handshake = NULL;
3923 }
3924
3925 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003926 * Done - should have consumed entire buffer
3927 */
3928 if( p != end )
3929 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003930
3931 return( 0 );
3932}
3933
3934/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003935 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003936 */
3937int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
3938 const unsigned char *buf,
3939 size_t len )
3940{
3941 int ret = ssl_context_load( context, buf, len );
3942
3943 if( ret != 0 )
3944 mbedtls_ssl_free( context );
3945
3946 return( ret );
3947}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02003948#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003949
3950/*
Paul Bakker5121ce52009-01-03 21:22:43 +00003951 * Free an SSL context
3952 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003953void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003954{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003955 if( ssl == NULL )
3956 return;
3957
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003958 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003959
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01003960 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003961 {
sander-visserb8aa2072020-05-06 22:05:13 +02003962#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3963 size_t out_buf_len = ssl->out_buf_len;
3964#else
3965 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3966#endif
3967
Darryl Greenb33cc762019-11-28 14:29:44 +00003968 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003969 mbedtls_free( ssl->out_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003970 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00003971 }
3972
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01003973 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003974 {
sander-visserb8aa2072020-05-06 22:05:13 +02003975#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3976 size_t in_buf_len = ssl->in_buf_len;
3977#else
3978 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3979#endif
3980
Darryl Greenb33cc762019-11-28 14:29:44 +00003981 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003982 mbedtls_free( ssl->in_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003983 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00003984 }
3985
Paul Bakker48916f92012-09-16 19:57:18 +00003986 if( ssl->transform )
3987 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003988 mbedtls_ssl_transform_free( ssl->transform );
3989 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00003990 }
3991
3992 if( ssl->handshake )
3993 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02003994 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003995 mbedtls_ssl_transform_free( ssl->transform_negotiate );
3996 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00003997
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003998 mbedtls_free( ssl->handshake );
3999 mbedtls_free( ssl->transform_negotiate );
4000 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00004001 }
4002
Ronald Cron6f135e12021-12-08 16:57:54 +01004003#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker3aa186f2021-08-10 09:24:19 +01004004 mbedtls_ssl_transform_free( ssl->transform_application );
4005 mbedtls_free( ssl->transform_application );
Ronald Cron6f135e12021-12-08 16:57:54 +01004006#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01004007
Paul Bakkerc0463502013-02-14 11:19:38 +01004008 if( ssl->session )
4009 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004010 mbedtls_ssl_session_free( ssl->session );
4011 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01004012 }
4013
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02004014#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02004015 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004016 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004017 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004018 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00004019 }
Paul Bakker0be444a2013-08-27 21:55:01 +02004020#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004021
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004022#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004023 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02004024#endif
4025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004026 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00004027
Paul Bakker86f04f42013-02-14 11:20:09 +01004028 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004029 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004030}
4031
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004032/*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08004033 * Initialize mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004034 */
4035void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
4036{
4037 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
4038}
4039
Gilles Peskineeccd8882020-03-10 12:19:08 +01004040#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004041#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskineae270bf2021-06-02 00:05:29 +02004042/* The selection should be the same as mbedtls_x509_crt_profile_default in
Gilles Peskinea28f0f52021-06-02 15:29:38 +02004043 * x509_crt.c. Here, the order matters. Currently we favor stronger hashes,
4044 * for no fundamental reason.
Gilles Peskineae270bf2021-06-02 00:05:29 +02004045 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
4046 * about this list. */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01004047static int ssl_preset_default_hashes[] = {
4048#if defined(MBEDTLS_SHA512_C)
4049 MBEDTLS_MD_SHA512,
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004050#endif
4051#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01004052 MBEDTLS_MD_SHA384,
4053#endif
4054#if defined(MBEDTLS_SHA256_C)
4055 MBEDTLS_MD_SHA256,
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004056#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01004057 MBEDTLS_MD_NONE
4058};
Jerry Yuf017ee42022-01-12 15:49:48 +08004059#endif /* !MBEDTLS_DEPRECATED_REMOVED */
4060#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01004061
Gilles Peskineae270bf2021-06-02 00:05:29 +02004062/* The selection should be the same as mbedtls_x509_crt_profile_default in
4063 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02004064 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02004065 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02004066 * about this list.
4067 */
Brett Warrene0edc842021-08-17 09:53:13 +01004068static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02004069#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004070 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004071#endif
4072#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004073 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004074#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004075#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004076 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004077#endif
4078#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004079 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004080#endif
4081#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004082 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004083#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02004084#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004085 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004086#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004087#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004088 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004089#endif
4090#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004091 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004092#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004093 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02004094};
Gilles Peskineae270bf2021-06-02 00:05:29 +02004095
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004096static int ssl_preset_suiteb_ciphersuites[] = {
4097 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
4098 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
4099 0
4100};
4101
Gilles Peskineeccd8882020-03-10 12:19:08 +01004102#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004103#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004104static int ssl_preset_suiteb_hashes[] = {
Jerry Yuf017ee42022-01-12 15:49:48 +08004105#if defined(MBEDTLS_SHA256_C)
4106 MBEDTLS_MD_SHA256,
4107#endif
Jerry Yu713013f2022-01-17 18:16:35 +08004108#if defined(MBEDTLS_SHA384_C)
4109 MBEDTLS_MD_SHA384,
4110#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004111 MBEDTLS_MD_NONE
4112};
Jerry Yuf017ee42022-01-12 15:49:48 +08004113#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004114
Jerry Yu909df7b2022-01-22 11:56:27 +08004115/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08004116 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08004117 * rules SHOULD be upheld.
4118 * - No duplicate entries.
4119 * - But if there is a good reason, do not change the order of the algorithms.
4120 * - ssl_tls12_present* is for TLS 1.2 use only.
4121 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08004122 */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004123static uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08004124
Jerry Yued5e9f42022-01-26 11:21:34 +08004125#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
4126 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4127 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
4128#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
4129 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004130
Jerry Yu909df7b2022-01-22 11:56:27 +08004131#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
4132 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4133 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
4134#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4135 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
4136
Jerry Yued5e9f42022-01-26 11:21:34 +08004137#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA512_C) && \
4138 defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
4139 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
4140#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4141 MBEDTLS_ECP_DP_SECP521R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004142
Jerry Yu909df7b2022-01-22 11:56:27 +08004143#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
4144 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4145#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
4146
Ronald Cron8540cf62022-03-16 08:01:09 +01004147#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA512_C)
4148 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
4149#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */
4150
4151#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA384_C)
4152 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
4153#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */
4154
Jerry Yu53037892022-01-25 11:02:06 +08004155#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
4156 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4157#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4158
Gabor Mezei15b95a62022-05-09 16:37:58 +02004159 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004160};
4161
4162/* NOTICE: see above */
4163#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4164static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08004165#if defined(MBEDTLS_SHA512_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004166#if defined(MBEDTLS_ECDSA_C)
4167 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512 ),
Jerry Yu713013f2022-01-17 18:16:35 +08004168#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004169#if defined(MBEDTLS_RSA_C)
4170 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512 ),
4171#endif
4172#endif /* MBEDTLS_SHA512_C */
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004173#if defined(MBEDTLS_SHA384_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004174#if defined(MBEDTLS_ECDSA_C)
4175 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004176#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004177#if defined(MBEDTLS_RSA_C)
4178 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
4179#endif
4180#endif /* MBEDTLS_SHA384_C */
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004181#if defined(MBEDTLS_SHA256_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004182#if defined(MBEDTLS_ECDSA_C)
4183 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004184#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004185#if defined(MBEDTLS_RSA_C)
4186 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
4187#endif
4188#endif /* MBEDTLS_SHA256_C */
Gabor Mezei15b95a62022-05-09 16:37:58 +02004189 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004190};
4191#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4192/* NOTICE: see above */
4193static uint16_t ssl_preset_suiteb_sig_algs[] = {
4194
Jerry Yu909df7b2022-01-22 11:56:27 +08004195#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
4196 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4197 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
4198#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
4199 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
4200
Jerry Yu53037892022-01-25 11:02:06 +08004201#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
4202 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4203 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
4204#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4205 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004206
4207#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
4208 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4209#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004210
Jerry Yu53037892022-01-25 11:02:06 +08004211#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
4212 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4213#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4214
Gabor Mezei15b95a62022-05-09 16:37:58 +02004215 MBEDTLS_TLS_SIG_NONE
Jerry Yu713013f2022-01-17 18:16:35 +08004216};
Jerry Yu6106fdc2022-01-12 16:36:14 +08004217
Jerry Yu909df7b2022-01-22 11:56:27 +08004218/* NOTICE: see above */
4219#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4220static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08004221#if defined(MBEDTLS_SHA256_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004222#if defined(MBEDTLS_ECDSA_C)
4223 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
Jerry Yu713013f2022-01-17 18:16:35 +08004224#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004225#if defined(MBEDTLS_RSA_C)
4226 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
4227#endif
4228#endif /* MBEDTLS_SHA256_C */
Jerry Yu18c833e2022-01-25 10:55:47 +08004229#if defined(MBEDTLS_SHA384_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004230#if defined(MBEDTLS_ECDSA_C)
4231 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
Jerry Yu18c833e2022-01-25 10:55:47 +08004232#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004233#if defined(MBEDTLS_RSA_C)
4234 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
4235#endif
4236#endif /* MBEDTLS_SHA256_C */
Gabor Mezei15b95a62022-05-09 16:37:58 +02004237 MBEDTLS_TLS_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004238};
Jerry Yu909df7b2022-01-22 11:56:27 +08004239#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4240
Jerry Yu1a8b4812022-01-20 17:56:50 +08004241#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004242
Brett Warrene0edc842021-08-17 09:53:13 +01004243static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01004244#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004245 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004246#endif
4247#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004248 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004249#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004250 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004251};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004252
Jerry Yu1a8b4812022-01-20 17:56:50 +08004253#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004254/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08004255 * to make sure there are no duplicated signature algorithm entries. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004256MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf377d642022-01-25 10:43:59 +08004257static int ssl_check_no_sig_alg_duplication( uint16_t * sig_algs )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004258{
4259 size_t i, j;
4260 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08004261
Gabor Mezei15b95a62022-05-09 16:37:58 +02004262 for( i = 0; sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004263 {
Jerry Yuf377d642022-01-25 10:43:59 +08004264 for( j = 0; j < i; j++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004265 {
Jerry Yuf377d642022-01-25 10:43:59 +08004266 if( sig_algs[i] != sig_algs[j] )
4267 continue;
4268 mbedtls_printf( " entry(%04x,%" MBEDTLS_PRINTF_SIZET
4269 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
4270 sig_algs[i], j, i );
4271 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08004272 }
4273 }
4274 return( ret );
4275}
4276
4277#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4278
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004279/*
Tillmann Karras588ad502015-09-25 04:27:22 +02004280 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004281 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004282int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004283 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004284{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004285#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00004286 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004287#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004288
Jerry Yu1a8b4812022-01-20 17:56:50 +08004289#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf377d642022-01-25 10:43:59 +08004290 if( ssl_check_no_sig_alg_duplication( ssl_preset_suiteb_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004291 {
4292 mbedtls_printf( "ssl_preset_suiteb_sig_algs has duplicated entries\n" );
4293 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4294 }
4295
Jerry Yuf377d642022-01-25 10:43:59 +08004296 if( ssl_check_no_sig_alg_duplication( ssl_preset_default_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004297 {
4298 mbedtls_printf( "ssl_preset_default_sig_algs has duplicated entries\n" );
4299 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4300 }
Jerry Yu909df7b2022-01-22 11:56:27 +08004301
4302#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yuf377d642022-01-25 10:43:59 +08004303 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_suiteb_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004304 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004305 mbedtls_printf( "ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004306 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4307 }
4308
Jerry Yuf377d642022-01-25 10:43:59 +08004309 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_default_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004310 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004311 mbedtls_printf( "ssl_tls12_preset_default_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004312 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4313 }
4314#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004315#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4316
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02004317 /* Use the functions here so that they are covered in tests,
4318 * but otherwise access member directly for efficiency */
4319 mbedtls_ssl_conf_endpoint( conf, endpoint );
4320 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004321
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004322 /*
4323 * Things that are common to all presets
4324 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004325#if defined(MBEDTLS_SSL_CLI_C)
4326 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
4327 {
4328 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
4329#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4330 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
4331#endif
4332 }
4333#endif
4334
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004335#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4336 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
4337#endif
4338
4339#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
4340 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
4341#endif
4342
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004343#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004344 conf->f_cookie_write = ssl_cookie_write_dummy;
4345 conf->f_cookie_check = ssl_cookie_check_dummy;
4346#endif
4347
4348#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4349 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
4350#endif
4351
Janos Follath088ce432017-04-10 12:42:31 +01004352#if defined(MBEDTLS_SSL_SRV_C)
4353 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02004354 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01004355#endif
4356
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004357#if defined(MBEDTLS_SSL_PROTO_DTLS)
4358 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
4359 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
4360#endif
4361
4362#if defined(MBEDTLS_SSL_RENEGOTIATION)
4363 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00004364 memset( conf->renego_period, 0x00, 2 );
4365 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004366#endif
4367
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004368#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckere2defad2021-07-24 05:59:17 +01004369 if( endpoint == MBEDTLS_SSL_IS_SERVER )
4370 {
4371 const unsigned char dhm_p[] =
4372 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
4373 const unsigned char dhm_g[] =
4374 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01004375
Hanno Beckere2defad2021-07-24 05:59:17 +01004376 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
4377 dhm_p, sizeof( dhm_p ),
4378 dhm_g, sizeof( dhm_g ) ) ) != 0 )
4379 {
4380 return( ret );
4381 }
4382 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02004383#endif
4384
Ronald Cron6f135e12021-12-08 16:57:54 +01004385#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker71f1ed62021-07-24 06:01:47 +01004386 /*
4387 * Allow all TLS 1.3 key exchange modes by default.
4388 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00004389 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01004390#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01004391
XiaokangQian4d3a6042022-04-21 13:46:17 +00004392 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4393 {
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004394#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
XiaokangQian4d3a6042022-04-21 13:46:17 +00004395 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian060d8672022-04-21 09:24:56 +00004396 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian4d3a6042022-04-21 13:46:17 +00004397#else
XiaokangQian060d8672022-04-21 09:24:56 +00004398 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
XiaokangQian060d8672022-04-21 09:24:56 +00004399#endif
XiaokangQian4d3a6042022-04-21 13:46:17 +00004400 }
4401 else
4402 {
4403#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
4404 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
4405 {
4406 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4407 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4408 }
4409 else
4410 /* Hybrid TLS 1.2 / 1.3 is not supported on server side yet */
4411 {
4412 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4413 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4414 }
4415#elif defined(MBEDTLS_SSL_PROTO_TLS1_3)
4416 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4417 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4418#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
4419 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4420 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4421#else
4422 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4423#endif
4424 }
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004425
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004426 /*
4427 * Preset-specific defaults
4428 */
4429 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004430 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004431 /*
4432 * NSA Suite B
4433 */
4434 case MBEDTLS_SSL_PRESET_SUITEB:
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004435
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004436 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004437
4438#if defined(MBEDTLS_X509_CRT_PARSE_C)
4439 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004440#endif
4441
Gilles Peskineeccd8882020-03-10 12:19:08 +01004442#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004443#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004444 conf->sig_hashes = ssl_preset_suiteb_hashes;
Jerry Yuf017ee42022-01-12 15:49:48 +08004445#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004446#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4447 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4448 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
4449 else
4450#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4451 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004452#endif
4453
Brett Warrene0edc842021-08-17 09:53:13 +01004454#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4455 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004456#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004457 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02004458 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004459
4460 /*
4461 * Default
4462 */
4463 default:
Ronald Cronf6606552022-03-15 11:23:25 +01004464
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004465 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004466
4467#if defined(MBEDTLS_X509_CRT_PARSE_C)
4468 conf->cert_profile = &mbedtls_x509_crt_profile_default;
4469#endif
4470
Gilles Peskineeccd8882020-03-10 12:19:08 +01004471#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004472#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01004473 conf->sig_hashes = ssl_preset_default_hashes;
Jerry Yuf017ee42022-01-12 15:49:48 +08004474#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004475#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4476 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4477 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
4478 else
4479#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4480 conf->sig_algs = ssl_preset_default_sig_algs;
Hanno Beckerdeb68ce2021-08-10 16:04:05 +01004481#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004482
Brett Warrene0edc842021-08-17 09:53:13 +01004483#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4484 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004485#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004486 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004487
4488#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
4489 conf->dhm_min_bitlen = 1024;
4490#endif
4491 }
4492
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004493 return( 0 );
4494}
4495
4496/*
4497 * Free mbedtls_ssl_config
4498 */
4499void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
4500{
4501#if defined(MBEDTLS_DHM_C)
4502 mbedtls_mpi_free( &conf->dhm_P );
4503 mbedtls_mpi_free( &conf->dhm_G );
4504#endif
4505
Gilles Peskineeccd8882020-03-10 12:19:08 +01004506#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02004507#if defined(MBEDTLS_USE_PSA_CRYPTO)
4508 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
4509 {
Neil Armstrong501c9322022-05-03 09:35:09 +02004510 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4511 }
Neil Armstrong8ecd6682022-05-05 11:40:35 +02004512#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004513 if( conf->psk != NULL )
4514 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004515 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004516 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00004517 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004518 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09004519 }
4520
4521 if( conf->psk_identity != NULL )
4522 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004523 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09004524 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00004525 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004526 conf->psk_identity_len = 0;
4527 }
4528#endif
4529
4530#if defined(MBEDTLS_X509_CRT_PARSE_C)
4531 ssl_key_cert_free( conf->key_cert );
4532#endif
4533
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004534 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004535}
4536
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004537#if defined(MBEDTLS_PK_C) && \
4538 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004539/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004540 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004541 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004542unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004543{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004544#if defined(MBEDTLS_RSA_C)
4545 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
4546 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004547#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004548#if defined(MBEDTLS_ECDSA_C)
4549 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
4550 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004551#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004552 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004553}
4554
Hanno Becker7e5437a2017-04-28 17:15:26 +01004555unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
4556{
4557 switch( type ) {
4558 case MBEDTLS_PK_RSA:
4559 return( MBEDTLS_SSL_SIG_RSA );
4560 case MBEDTLS_PK_ECDSA:
4561 case MBEDTLS_PK_ECKEY:
4562 return( MBEDTLS_SSL_SIG_ECDSA );
4563 default:
4564 return( MBEDTLS_SSL_SIG_ANON );
4565 }
4566}
4567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004568mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004569{
4570 switch( sig )
4571 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004572#if defined(MBEDTLS_RSA_C)
4573 case MBEDTLS_SSL_SIG_RSA:
4574 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004575#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004576#if defined(MBEDTLS_ECDSA_C)
4577 case MBEDTLS_SSL_SIG_ECDSA:
4578 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004579#endif
4580 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004581 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004582 }
4583}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004584#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004585
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004586/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004587 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004588 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004589mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004590{
4591 switch( hash )
4592 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004593#if defined(MBEDTLS_MD5_C)
4594 case MBEDTLS_SSL_HASH_MD5:
4595 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004596#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004597#if defined(MBEDTLS_SHA1_C)
4598 case MBEDTLS_SSL_HASH_SHA1:
4599 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004600#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004601#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004602 case MBEDTLS_SSL_HASH_SHA224:
4603 return( MBEDTLS_MD_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004604#endif
4605#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004606 case MBEDTLS_SSL_HASH_SHA256:
4607 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004608#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004609#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004610 case MBEDTLS_SSL_HASH_SHA384:
4611 return( MBEDTLS_MD_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004612#endif
4613#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004614 case MBEDTLS_SSL_HASH_SHA512:
4615 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004616#endif
4617 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004618 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004619 }
4620}
4621
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004622/*
4623 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
4624 */
4625unsigned char mbedtls_ssl_hash_from_md_alg( int md )
4626{
4627 switch( md )
4628 {
4629#if defined(MBEDTLS_MD5_C)
4630 case MBEDTLS_MD_MD5:
4631 return( MBEDTLS_SSL_HASH_MD5 );
4632#endif
4633#if defined(MBEDTLS_SHA1_C)
4634 case MBEDTLS_MD_SHA1:
4635 return( MBEDTLS_SSL_HASH_SHA1 );
4636#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004637#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004638 case MBEDTLS_MD_SHA224:
4639 return( MBEDTLS_SSL_HASH_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004640#endif
4641#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004642 case MBEDTLS_MD_SHA256:
4643 return( MBEDTLS_SSL_HASH_SHA256 );
4644#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004645#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004646 case MBEDTLS_MD_SHA384:
4647 return( MBEDTLS_SSL_HASH_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004648#endif
4649#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004650 case MBEDTLS_MD_SHA512:
4651 return( MBEDTLS_SSL_HASH_SHA512 );
4652#endif
4653 default:
4654 return( MBEDTLS_SSL_HASH_NONE );
4655 }
4656}
4657
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004658/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004659 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004660 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004661 */
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004662int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004663{
Brett Warrene0edc842021-08-17 09:53:13 +01004664 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004665
Brett Warrene0edc842021-08-17 09:53:13 +01004666 if( group_list == NULL )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004667 return( -1 );
4668
Brett Warrene0edc842021-08-17 09:53:13 +01004669 for( ; *group_list != 0; group_list++ )
4670 {
4671 if( *group_list == tls_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004672 return( 0 );
Brett Warrene0edc842021-08-17 09:53:13 +01004673 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004674
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004675 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004676}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004677
4678#if defined(MBEDTLS_ECP_C)
4679/*
4680 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
4681 */
4682int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
4683{
Manuel Pégourié-Gonnard422370d2022-02-07 11:55:21 +01004684 uint16_t tls_id = mbedtls_ecp_curve_info_from_grp_id( grp_id )->tls_id;
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004685 return mbedtls_ssl_check_curve_tls_id( ssl, tls_id );
4686}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02004687#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004688
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004689#if defined(MBEDTLS_X509_CRT_PARSE_C)
4690int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
4691 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004692 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02004693 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004694{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004695 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004696 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004697 const char *ext_oid;
4698 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004699
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004700 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004701 {
4702 /* Server part of the key exchange */
4703 switch( ciphersuite->key_exchange )
4704 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004705 case MBEDTLS_KEY_EXCHANGE_RSA:
4706 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004707 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004708 break;
4709
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004710 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
4711 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
4712 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
4713 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004714 break;
4715
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004716 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
4717 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004718 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004719 break;
4720
4721 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004722 case MBEDTLS_KEY_EXCHANGE_NONE:
4723 case MBEDTLS_KEY_EXCHANGE_PSK:
4724 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
4725 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02004726 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004727 usage = 0;
4728 }
4729 }
4730 else
4731 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004732 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
4733 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004734 }
4735
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004736 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004737 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004738 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004739 ret = -1;
4740 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004741
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004742 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004743 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004744 ext_oid = MBEDTLS_OID_SERVER_AUTH;
4745 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004746 }
4747 else
4748 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004749 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
4750 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004751 }
4752
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004753 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004754 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004755 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004756 ret = -1;
4757 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004758
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004759 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004760}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004761#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02004762
Jerry Yu148165c2021-09-24 23:20:59 +08004763#if defined(MBEDTLS_USE_PSA_CRYPTO)
4764int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
4765 const mbedtls_md_type_t md,
4766 unsigned char *dst,
4767 size_t dst_len,
4768 size_t *olen )
4769{
Ronald Cronf6893e12022-01-07 22:09:01 +01004770 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4771 psa_hash_operation_t *hash_operation_to_clone;
4772 psa_hash_operation_t hash_operation = psa_hash_operation_init();
4773
Jerry Yu148165c2021-09-24 23:20:59 +08004774 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01004775
4776 switch( md )
4777 {
4778#if defined(MBEDTLS_SHA384_C)
4779 case MBEDTLS_MD_SHA384:
4780 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
4781 break;
4782#endif
4783
4784#if defined(MBEDTLS_SHA256_C)
4785 case MBEDTLS_MD_SHA256:
4786 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
4787 break;
4788#endif
4789
4790 default:
4791 goto exit;
4792 }
4793
4794 status = psa_hash_clone( hash_operation_to_clone, &hash_operation );
4795 if( status != PSA_SUCCESS )
4796 goto exit;
4797
4798 status = psa_hash_finish( &hash_operation, dst, dst_len, olen );
4799 if( status != PSA_SUCCESS )
4800 goto exit;
4801
4802exit:
Ronald Cronb788c042022-02-15 09:14:15 +01004803 return( psa_ssl_status_to_mbedtls( status ) );
Jerry Yu148165c2021-09-24 23:20:59 +08004804}
4805#else /* MBEDTLS_USE_PSA_CRYPTO */
4806
Jerry Yu24c0ec32021-09-09 14:21:07 +08004807#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004808MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu000f9762021-09-14 11:12:51 +08004809static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
4810 unsigned char *dst,
4811 size_t dst_len,
4812 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004813{
Jerry Yu24c0ec32021-09-09 14:21:07 +08004814 int ret;
4815 mbedtls_sha512_context sha512;
4816
4817 if( dst_len < 48 )
4818 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4819
4820 mbedtls_sha512_init( &sha512 );
4821 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
4822
4823 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
4824 {
4825 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
4826 goto exit;
4827 }
4828
4829 *olen = 48;
4830
4831exit:
4832
4833 mbedtls_sha512_free( &sha512 );
4834 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004835}
4836#endif /* MBEDTLS_SHA384_C */
4837
4838#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004839MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu000f9762021-09-14 11:12:51 +08004840static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
4841 unsigned char *dst,
4842 size_t dst_len,
4843 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004844{
Jerry Yu24c0ec32021-09-09 14:21:07 +08004845 int ret;
4846 mbedtls_sha256_context sha256;
4847
4848 if( dst_len < 32 )
4849 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4850
4851 mbedtls_sha256_init( &sha256 );
4852 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Jerry Yuc5aef882021-12-23 20:15:02 +08004853
Jerry Yu24c0ec32021-09-09 14:21:07 +08004854 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
4855 {
4856 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
4857 goto exit;
4858 }
4859
4860 *olen = 32;
4861
4862exit:
4863
4864 mbedtls_sha256_free( &sha256 );
4865 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004866}
4867#endif /* MBEDTLS_SHA256_C */
4868
Jerry Yu000f9762021-09-14 11:12:51 +08004869int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
4870 const mbedtls_md_type_t md,
4871 unsigned char *dst,
4872 size_t dst_len,
4873 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08004874{
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004875 switch( md )
4876 {
4877
Jerry Yu24c0ec32021-09-09 14:21:07 +08004878#if defined(MBEDTLS_SHA384_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004879 case MBEDTLS_MD_SHA384:
Jerry Yuc5aef882021-12-23 20:15:02 +08004880 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08004881#endif /* MBEDTLS_SHA384_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004882
Jerry Yu24c0ec32021-09-09 14:21:07 +08004883#if defined(MBEDTLS_SHA256_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004884 case MBEDTLS_MD_SHA256:
Jerry Yuc5aef882021-12-23 20:15:02 +08004885 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08004886#endif /* MBEDTLS_SHA256_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08004887
4888 default:
4889 break;
4890 }
Jerry Yuc5aef882021-12-23 20:15:02 +08004891 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu24c0ec32021-09-09 14:21:07 +08004892}
XiaokangQian647719a2021-12-07 09:16:29 +00004893
Jerry Yu148165c2021-09-24 23:20:59 +08004894#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08004895
Gabor Mezei078e8032022-04-27 21:17:56 +02004896#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
4897/* mbedtls_ssl_parse_sig_alg_ext()
4898 *
4899 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
4900 * value (TLS 1.3 RFC8446):
4901 * enum {
4902 * ....
4903 * ecdsa_secp256r1_sha256( 0x0403 ),
4904 * ecdsa_secp384r1_sha384( 0x0503 ),
4905 * ecdsa_secp521r1_sha512( 0x0603 ),
4906 * ....
4907 * } SignatureScheme;
4908 *
4909 * struct {
4910 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
4911 * } SignatureSchemeList;
4912 *
4913 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
4914 * value (TLS 1.2 RFC5246):
4915 * enum {
4916 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
4917 * sha512(6), (255)
4918 * } HashAlgorithm;
4919 *
4920 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
4921 * SignatureAlgorithm;
4922 *
4923 * struct {
4924 * HashAlgorithm hash;
4925 * SignatureAlgorithm signature;
4926 * } SignatureAndHashAlgorithm;
4927 *
4928 * SignatureAndHashAlgorithm
4929 * supported_signature_algorithms<2..2^16-2>;
4930 *
4931 * The TLS 1.3 signature algorithm extension was defined to be a compatible
4932 * generalization of the TLS 1.2 signature algorithm extension.
4933 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
4934 * `SignatureScheme` field of TLS 1.3
4935 *
4936 */
4937int mbedtls_ssl_parse_sig_alg_ext( mbedtls_ssl_context *ssl,
4938 const unsigned char *buf,
4939 const unsigned char *end )
4940{
4941 const unsigned char *p = buf;
4942 size_t supported_sig_algs_len = 0;
4943 const unsigned char *supported_sig_algs_end;
4944 uint16_t sig_alg;
4945 uint32_t common_idx = 0;
4946
4947 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
4948 supported_sig_algs_len = MBEDTLS_GET_UINT16_BE( p, 0 );
4949 p += 2;
4950
4951 memset( ssl->handshake->received_sig_algs, 0,
4952 sizeof(ssl->handshake->received_sig_algs) );
4953
4954 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, supported_sig_algs_len );
4955 supported_sig_algs_end = p + supported_sig_algs_len;
4956 while( p < supported_sig_algs_end )
4957 {
4958 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, supported_sig_algs_end, 2 );
4959 sig_alg = MBEDTLS_GET_UINT16_BE( p, 0 );
4960 p += 2;
4961
4962 MBEDTLS_SSL_DEBUG_MSG( 4, ( "received signature algorithm: 0x%x",
4963 sig_alg ) );
4964
4965 if( ! mbedtls_ssl_sig_alg_is_supported( ssl, sig_alg ) ||
4966 ! mbedtls_ssl_sig_alg_is_offered( ssl, sig_alg ) )
4967 continue;
4968
4969 if( common_idx + 1 < MBEDTLS_RECEIVED_SIG_ALGS_SIZE )
4970 {
4971 ssl->handshake->received_sig_algs[common_idx] = sig_alg;
4972 common_idx += 1;
4973 }
4974 }
4975 /* Check that we consumed all the message. */
4976 if( p != end )
4977 {
4978 MBEDTLS_SSL_DEBUG_MSG( 1,
4979 ( "Signature algorithms extension length misaligned" ) );
4980 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
4981 MBEDTLS_ERR_SSL_DECODE_ERROR );
4982 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
4983 }
4984
4985 if( common_idx == 0 )
4986 {
4987 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature algorithm in common" ) );
4988 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
4989 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
4990 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
4991 }
4992
Gabor Mezei15b95a62022-05-09 16:37:58 +02004993 ssl->handshake->received_sig_algs[common_idx] = MBEDTLS_TLS_SIG_NONE;
Gabor Mezei078e8032022-04-27 21:17:56 +02004994 return( 0 );
4995}
4996
4997#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4998
Jerry Yudc7bd172022-02-17 13:44:15 +08004999#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5000
5001#if defined(MBEDTLS_USE_PSA_CRYPTO)
5002
5003static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
5004 mbedtls_svc_key_id_t key,
5005 psa_algorithm_t alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005006 const unsigned char* raw_psk, size_t raw_psk_length,
Jerry Yudc7bd172022-02-17 13:44:15 +08005007 const unsigned char* seed, size_t seed_length,
5008 const unsigned char* label, size_t label_length,
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005009 const unsigned char* other_secret,
5010 size_t other_secret_length,
Jerry Yudc7bd172022-02-17 13:44:15 +08005011 size_t capacity )
5012{
5013 psa_status_t status;
5014
5015 status = psa_key_derivation_setup( derivation, alg );
5016 if( status != PSA_SUCCESS )
5017 return( status );
5018
5019 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
5020 {
5021 status = psa_key_derivation_input_bytes( derivation,
5022 PSA_KEY_DERIVATION_INPUT_SEED,
5023 seed, seed_length );
5024 if( status != PSA_SUCCESS )
5025 return( status );
5026
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005027 if ( other_secret != NULL )
Przemek Stekiel1f027032022-04-05 17:12:11 +02005028 {
5029 status = psa_key_derivation_input_bytes( derivation,
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005030 PSA_KEY_DERIVATION_INPUT_OTHER_SECRET,
5031 other_secret, other_secret_length );
Przemek Stekiel1f027032022-04-05 17:12:11 +02005032 if( status != PSA_SUCCESS )
5033 return( status );
5034 }
5035
Jerry Yudc7bd172022-02-17 13:44:15 +08005036 if( mbedtls_svc_key_id_is_null( key ) )
5037 {
5038 status = psa_key_derivation_input_bytes(
5039 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005040 raw_psk, raw_psk_length );
Jerry Yudc7bd172022-02-17 13:44:15 +08005041 }
5042 else
5043 {
5044 status = psa_key_derivation_input_key(
5045 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
5046 }
5047 if( status != PSA_SUCCESS )
5048 return( status );
5049
5050 status = psa_key_derivation_input_bytes( derivation,
5051 PSA_KEY_DERIVATION_INPUT_LABEL,
5052 label, label_length );
5053 if( status != PSA_SUCCESS )
5054 return( status );
5055 }
5056 else
5057 {
5058 return( PSA_ERROR_NOT_SUPPORTED );
5059 }
5060
5061 status = psa_key_derivation_set_capacity( derivation, capacity );
5062 if( status != PSA_SUCCESS )
5063 return( status );
5064
5065 return( PSA_SUCCESS );
5066}
5067
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005068MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005069static int tls_prf_generic( mbedtls_md_type_t md_type,
5070 const unsigned char *secret, size_t slen,
5071 const char *label,
5072 const unsigned char *random, size_t rlen,
5073 unsigned char *dstbuf, size_t dlen )
5074{
5075 psa_status_t status;
5076 psa_algorithm_t alg;
5077 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
5078 psa_key_derivation_operation_t derivation =
5079 PSA_KEY_DERIVATION_OPERATION_INIT;
5080
5081 if( md_type == MBEDTLS_MD_SHA384 )
5082 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
5083 else
5084 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
5085
5086 /* Normally a "secret" should be long enough to be impossible to
5087 * find by brute force, and in particular should not be empty. But
5088 * this PRF is also used to derive an IV, in particular in EAP-TLS,
5089 * and for this use case it makes sense to have a 0-length "secret".
5090 * Since the key API doesn't allow importing a key of length 0,
5091 * keep master_key=0, which setup_psa_key_derivation() understands
5092 * to mean a 0-length "secret" input. */
5093 if( slen != 0 )
5094 {
5095 psa_key_attributes_t key_attributes = psa_key_attributes_init();
5096 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
5097 psa_set_key_algorithm( &key_attributes, alg );
5098 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
5099
5100 status = psa_import_key( &key_attributes, secret, slen, &master_key );
5101 if( status != PSA_SUCCESS )
5102 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5103 }
5104
5105 status = setup_psa_key_derivation( &derivation,
5106 master_key, alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005107 NULL, 0,
Jerry Yudc7bd172022-02-17 13:44:15 +08005108 random, rlen,
5109 (unsigned char const *) label,
5110 (size_t) strlen( label ),
Przemek Stekiel1f027032022-04-05 17:12:11 +02005111 NULL, 0,
Jerry Yudc7bd172022-02-17 13:44:15 +08005112 dlen );
5113 if( status != PSA_SUCCESS )
5114 {
5115 psa_key_derivation_abort( &derivation );
5116 psa_destroy_key( master_key );
5117 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5118 }
5119
5120 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
5121 if( status != PSA_SUCCESS )
5122 {
5123 psa_key_derivation_abort( &derivation );
5124 psa_destroy_key( master_key );
5125 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5126 }
5127
5128 status = psa_key_derivation_abort( &derivation );
5129 if( status != PSA_SUCCESS )
5130 {
5131 psa_destroy_key( master_key );
5132 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5133 }
5134
5135 if( ! mbedtls_svc_key_id_is_null( master_key ) )
5136 status = psa_destroy_key( master_key );
5137 if( status != PSA_SUCCESS )
5138 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5139
5140 return( 0 );
5141}
5142
5143#else /* MBEDTLS_USE_PSA_CRYPTO */
5144
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005145MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005146static int tls_prf_generic( mbedtls_md_type_t md_type,
5147 const unsigned char *secret, size_t slen,
5148 const char *label,
5149 const unsigned char *random, size_t rlen,
5150 unsigned char *dstbuf, size_t dlen )
5151{
5152 size_t nb;
5153 size_t i, j, k, md_len;
5154 unsigned char *tmp;
5155 size_t tmp_len = 0;
5156 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
5157 const mbedtls_md_info_t *md_info;
5158 mbedtls_md_context_t md_ctx;
5159 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5160
5161 mbedtls_md_init( &md_ctx );
5162
5163 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
5164 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5165
5166 md_len = mbedtls_md_get_size( md_info );
5167
5168 tmp_len = md_len + strlen( label ) + rlen;
5169 tmp = mbedtls_calloc( 1, tmp_len );
5170 if( tmp == NULL )
5171 {
5172 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
5173 goto exit;
5174 }
5175
5176 nb = strlen( label );
5177 memcpy( tmp + md_len, label, nb );
5178 memcpy( tmp + md_len + nb, random, rlen );
5179 nb += rlen;
5180
5181 /*
5182 * Compute P_<hash>(secret, label + random)[0..dlen]
5183 */
5184 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
5185 goto exit;
5186
5187 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
5188 if( ret != 0 )
5189 goto exit;
5190 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
5191 if( ret != 0 )
5192 goto exit;
5193 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
5194 if( ret != 0 )
5195 goto exit;
5196
5197 for( i = 0; i < dlen; i += md_len )
5198 {
5199 ret = mbedtls_md_hmac_reset ( &md_ctx );
5200 if( ret != 0 )
5201 goto exit;
5202 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
5203 if( ret != 0 )
5204 goto exit;
5205 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
5206 if( ret != 0 )
5207 goto exit;
5208
5209 ret = mbedtls_md_hmac_reset ( &md_ctx );
5210 if( ret != 0 )
5211 goto exit;
5212 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
5213 if( ret != 0 )
5214 goto exit;
5215 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
5216 if( ret != 0 )
5217 goto exit;
5218
5219 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
5220
5221 for( j = 0; j < k; j++ )
5222 dstbuf[i + j] = h_i[j];
5223 }
5224
5225exit:
5226 mbedtls_md_free( &md_ctx );
5227
5228 mbedtls_platform_zeroize( tmp, tmp_len );
5229 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
5230
5231 mbedtls_free( tmp );
5232
5233 return( ret );
5234}
5235#endif /* MBEDTLS_USE_PSA_CRYPTO */
5236
5237#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005238MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005239static int tls_prf_sha256( const unsigned char *secret, size_t slen,
5240 const char *label,
5241 const unsigned char *random, size_t rlen,
5242 unsigned char *dstbuf, size_t dlen )
5243{
5244 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
5245 label, random, rlen, dstbuf, dlen ) );
5246}
5247#endif /* MBEDTLS_SHA256_C */
5248
5249#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005250MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005251static int tls_prf_sha384( const unsigned char *secret, size_t slen,
5252 const char *label,
5253 const unsigned char *random, size_t rlen,
5254 unsigned char *dstbuf, size_t dlen )
5255{
5256 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
5257 label, random, rlen, dstbuf, dlen ) );
5258}
5259#endif /* MBEDTLS_SHA384_C */
5260
Jerry Yuf009d862022-02-17 14:01:37 +08005261/*
5262 * Set appropriate PRF function and other SSL / TLS1.2 functions
5263 *
5264 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08005265 * - hash associated with the ciphersuite (only used by TLS 1.2)
5266 *
5267 * Outputs:
5268 * - the tls_prf, calc_verify and calc_finished members of handshake structure
5269 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005270MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf009d862022-02-17 14:01:37 +08005271static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
Jerry Yuf009d862022-02-17 14:01:37 +08005272 mbedtls_md_type_t hash )
5273{
Jerry Yuf009d862022-02-17 14:01:37 +08005274#if defined(MBEDTLS_SHA384_C)
Ronald Cron81591aa2022-03-07 09:05:51 +01005275 if( hash == MBEDTLS_MD_SHA384 )
Jerry Yuf009d862022-02-17 14:01:37 +08005276 {
5277 handshake->tls_prf = tls_prf_sha384;
5278 handshake->calc_verify = ssl_calc_verify_tls_sha384;
5279 handshake->calc_finished = ssl_calc_finished_tls_sha384;
5280 }
5281 else
5282#endif
5283#if defined(MBEDTLS_SHA256_C)
Jerry Yuf009d862022-02-17 14:01:37 +08005284 {
Ronald Cron81591aa2022-03-07 09:05:51 +01005285 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005286 handshake->tls_prf = tls_prf_sha256;
5287 handshake->calc_verify = ssl_calc_verify_tls_sha256;
5288 handshake->calc_finished = ssl_calc_finished_tls_sha256;
5289 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005290#else
Jerry Yuf009d862022-02-17 14:01:37 +08005291 {
Jerry Yuf009d862022-02-17 14:01:37 +08005292 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01005293 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005294 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5295 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005296#endif
Jerry Yuf009d862022-02-17 14:01:37 +08005297
5298 return( 0 );
5299}
Jerry Yud6ab2352022-02-17 14:03:43 +08005300
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005301/*
5302 * Compute master secret if needed
5303 *
5304 * Parameters:
5305 * [in/out] handshake
5306 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
5307 * (PSA-PSK) ciphersuite_info, psk_opaque
5308 * [out] premaster (cleared)
5309 * [out] master
5310 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
5311 * debug: conf->f_dbg, conf->p_dbg
5312 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01005313 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005314 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005315MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005316static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
5317 unsigned char *master,
5318 const mbedtls_ssl_context *ssl )
5319{
5320 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5321
5322 /* cf. RFC 5246, Section 8.1:
5323 * "The master secret is always exactly 48 bytes in length." */
5324 size_t const master_secret_len = 48;
5325
5326#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5327 unsigned char session_hash[48];
5328#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
5329
5330 /* The label for the KDF used for key expansion.
5331 * This is either "master secret" or "extended master secret"
5332 * depending on whether the Extended Master Secret extension
5333 * is used. */
5334 char const *lbl = "master secret";
5335
Przemek Stekielae4ed302022-04-05 17:15:55 +02005336 /* The seed for the KDF used for key expansion.
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005337 * - If the Extended Master Secret extension is not used,
5338 * this is ClientHello.Random + ServerHello.Random
5339 * (see Sect. 8.1 in RFC 5246).
5340 * - If the Extended Master Secret extension is used,
5341 * this is the transcript of the handshake so far.
5342 * (see Sect. 4 in RFC 7627). */
Przemek Stekielae4ed302022-04-05 17:15:55 +02005343 unsigned char const *seed = handshake->randbytes;
5344 size_t seed_len = 64;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005345
5346#if !defined(MBEDTLS_DEBUG_C) && \
5347 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
5348 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
5349 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
5350 ssl = NULL; /* make sure we don't use it except for those cases */
5351 (void) ssl;
5352#endif
5353
5354 if( handshake->resume != 0 )
5355 {
5356 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
5357 return( 0 );
5358 }
5359
5360#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5361 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
5362 {
5363 lbl = "extended master secret";
Przemek Stekielae4ed302022-04-05 17:15:55 +02005364 seed = session_hash;
5365 handshake->calc_verify( ssl, session_hash, &seed_len );
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005366
5367 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
Przemek Stekielae4ed302022-04-05 17:15:55 +02005368 session_hash, seed_len );
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005369 }
Przemek Stekiel169bf0b2022-04-29 07:53:29 +02005370#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005371
Przemek Stekiel99114f32022-04-22 11:20:09 +02005372#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Przemek Stekiel8a4b7fd2022-04-28 09:22:22 +02005373 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Neil Armstronge952a302022-05-03 10:22:14 +02005374 if( mbedtls_ssl_ciphersuite_uses_psk( handshake->ciphersuite_info ) == 1 )
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005375 {
5376 /* Perform PSK-to-MS expansion in a single step. */
5377 psa_status_t status;
5378 psa_algorithm_t alg;
5379 mbedtls_svc_key_id_t psk;
5380 psa_key_derivation_operation_t derivation =
5381 PSA_KEY_DERIVATION_OPERATION_INIT;
5382 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
5383
5384 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
5385
5386 psk = mbedtls_ssl_get_opaque_psk( ssl );
5387
5388 if( hash_alg == MBEDTLS_MD_SHA384 )
5389 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
5390 else
5391 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
5392
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005393 size_t other_secret_len = 0;
5394 unsigned char* other_secret = NULL;
Przemek Stekielc2033402022-04-05 17:19:41 +02005395
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005396 switch( handshake->ciphersuite_info->key_exchange )
Przemek Stekielc2033402022-04-05 17:19:41 +02005397 {
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005398 /* Provide other secret.
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005399 * Other secret is stored in premaster, where first 2 bytes hold the
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005400 * length of the other key.
Przemek Stekielc2033402022-04-05 17:19:41 +02005401 */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005402 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Przemek Stekiel8abcee92022-04-28 09:16:28 +02005403 /* For RSA-PSK other key length is always 48 bytes. */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005404 other_secret_len = 48;
5405 other_secret = handshake->premaster + 2;
5406 break;
5407 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005408 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005409 other_secret_len = MBEDTLS_GET_UINT16_BE(handshake->premaster, 0);
5410 other_secret = handshake->premaster + 2;
5411 break;
5412 default:
5413 break;
Przemek Stekielc2033402022-04-05 17:19:41 +02005414 }
5415
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005416 status = setup_psa_key_derivation( &derivation, psk, alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005417 ssl->conf->psk, ssl->conf->psk_len,
Przemek Stekielae4ed302022-04-05 17:15:55 +02005418 seed, seed_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005419 (unsigned char const *) lbl,
5420 (size_t) strlen( lbl ),
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005421 other_secret, other_secret_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005422 master_secret_len );
5423 if( status != PSA_SUCCESS )
5424 {
5425 psa_key_derivation_abort( &derivation );
5426 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5427 }
5428
5429 status = psa_key_derivation_output_bytes( &derivation,
5430 master,
5431 master_secret_len );
5432 if( status != PSA_SUCCESS )
5433 {
5434 psa_key_derivation_abort( &derivation );
5435 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5436 }
5437
5438 status = psa_key_derivation_abort( &derivation );
5439 if( status != PSA_SUCCESS )
5440 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5441 }
5442 else
5443#endif
5444 {
5445 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
Przemek Stekielae4ed302022-04-05 17:15:55 +02005446 lbl, seed, seed_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005447 master,
5448 master_secret_len );
5449 if( ret != 0 )
5450 {
5451 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
5452 return( ret );
5453 }
5454
5455 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
5456 handshake->premaster,
5457 handshake->pmslen );
5458
5459 mbedtls_platform_zeroize( handshake->premaster,
5460 sizeof(handshake->premaster) );
5461 }
5462
5463 return( 0 );
5464}
5465
Jerry Yud62f87e2022-02-17 14:09:02 +08005466int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
5467{
5468 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5469 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5470 ssl->handshake->ciphersuite_info;
5471
5472 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
5473
5474 /* Set PRF, calc_verify and calc_finished function pointers */
5475 ret = ssl_set_handshake_prfs( ssl->handshake,
Jerry Yud62f87e2022-02-17 14:09:02 +08005476 ciphersuite_info->mac );
5477 if( ret != 0 )
5478 {
5479 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
5480 return( ret );
5481 }
5482
5483 /* Compute master secret if needed */
5484 ret = ssl_compute_master( ssl->handshake,
5485 ssl->session_negotiate->master,
5486 ssl );
5487 if( ret != 0 )
5488 {
5489 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
5490 return( ret );
5491 }
5492
5493 /* Swap the client and server random values:
5494 * - MS derivation wanted client+server (RFC 5246 8.1)
5495 * - key derivation wants server+client (RFC 5246 6.3) */
5496 {
5497 unsigned char tmp[64];
5498 memcpy( tmp, ssl->handshake->randbytes, 64 );
5499 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
5500 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
5501 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
5502 }
5503
5504 /* Populate transform structure */
5505 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
5506 ssl->session_negotiate->ciphersuite,
5507 ssl->session_negotiate->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02005508#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yud62f87e2022-02-17 14:09:02 +08005509 ssl->session_negotiate->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02005510#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yud62f87e2022-02-17 14:09:02 +08005511 ssl->handshake->tls_prf,
5512 ssl->handshake->randbytes,
Glenn Strauss60bfe602022-03-14 19:04:24 -04005513 ssl->tls_version,
Jerry Yud62f87e2022-02-17 14:09:02 +08005514 ssl->conf->endpoint,
5515 ssl );
5516 if( ret != 0 )
5517 {
5518 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
5519 return( ret );
5520 }
5521
5522 /* We no longer need Server/ClientHello.random values */
5523 mbedtls_platform_zeroize( ssl->handshake->randbytes,
5524 sizeof( ssl->handshake->randbytes ) );
5525
5526 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
5527
5528 return( 0 );
5529}
Jerry Yu8392e0d2022-02-17 14:10:24 +08005530
Ronald Cron4dcbca92022-03-07 10:21:40 +01005531int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
5532{
Ronald Cron4dcbca92022-03-07 10:21:40 +01005533 switch( md )
5534 {
5535#if defined(MBEDTLS_SHA384_C)
5536 case MBEDTLS_SSL_HASH_SHA384:
5537 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
5538 break;
5539#endif
5540#if defined(MBEDTLS_SHA256_C)
5541 case MBEDTLS_SSL_HASH_SHA256:
5542 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
5543 break;
5544#endif
5545 default:
5546 return( -1 );
5547 }
5548
Ronald Cronc2f13a02022-03-07 10:25:24 +01005549 return( 0 );
Ronald Cron4dcbca92022-03-07 10:21:40 +01005550}
5551
Jerry Yu8392e0d2022-02-17 14:10:24 +08005552#if defined(MBEDTLS_SHA256_C)
5553void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
5554 unsigned char *hash,
5555 size_t *hlen )
5556{
5557#if defined(MBEDTLS_USE_PSA_CRYPTO)
5558 size_t hash_size;
5559 psa_status_t status;
5560 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
5561
5562 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
5563 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
5564 if( status != PSA_SUCCESS )
5565 {
5566 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5567 return;
5568 }
5569
5570 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
5571 if( status != PSA_SUCCESS )
5572 {
5573 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5574 return;
5575 }
5576
5577 *hlen = 32;
5578 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5579 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5580#else
5581 mbedtls_sha256_context sha256;
5582
5583 mbedtls_sha256_init( &sha256 );
5584
5585 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
5586
5587 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
5588 mbedtls_sha256_finish( &sha256, hash );
5589
5590 *hlen = 32;
5591
5592 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
5593 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
5594
5595 mbedtls_sha256_free( &sha256 );
5596#endif /* MBEDTLS_USE_PSA_CRYPTO */
5597 return;
5598}
5599#endif /* MBEDTLS_SHA256_C */
5600
Jerry Yuc1cb3842022-02-17 14:13:48 +08005601#if defined(MBEDTLS_SHA384_C)
5602void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
5603 unsigned char *hash,
5604 size_t *hlen )
5605{
5606#if defined(MBEDTLS_USE_PSA_CRYPTO)
5607 size_t hash_size;
5608 psa_status_t status;
5609 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
5610
5611 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
5612 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
5613 if( status != PSA_SUCCESS )
5614 {
5615 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5616 return;
5617 }
5618
5619 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
5620 if( status != PSA_SUCCESS )
5621 {
5622 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5623 return;
5624 }
5625
5626 *hlen = 48;
5627 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5628 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5629#else
5630 mbedtls_sha512_context sha512;
5631
5632 mbedtls_sha512_init( &sha512 );
5633
5634 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
5635
5636 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
5637 mbedtls_sha512_finish( &sha512, hash );
5638
5639 *hlen = 48;
5640
5641 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
5642 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
5643
5644 mbedtls_sha512_free( &sha512 );
5645#endif /* MBEDTLS_USE_PSA_CRYPTO */
5646 return;
5647}
5648#endif /* MBEDTLS_SHA384_C */
5649
Neil Armstrong80f6f322022-05-03 17:56:38 +02005650#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
5651 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Jerry Yuce3dca42022-02-17 14:16:37 +08005652int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
5653{
5654 unsigned char *p = ssl->handshake->premaster;
5655 unsigned char *end = p + sizeof( ssl->handshake->premaster );
5656 const unsigned char *psk = NULL;
5657 size_t psk_len = 0;
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005658 int psk_ret = mbedtls_ssl_get_psk( ssl, &psk, &psk_len );
Jerry Yuce3dca42022-02-17 14:16:37 +08005659
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005660 if( psk_ret == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
Jerry Yuce3dca42022-02-17 14:16:37 +08005661 {
5662 /*
5663 * This should never happen because the existence of a PSK is always
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005664 * checked before calling this function.
5665 *
5666 * The exception is opaque DHE-PSK. For DHE-PSK fill premaster with
Przemek Stekiel8abcee92022-04-28 09:16:28 +02005667 * the shared secret without PSK.
Jerry Yuce3dca42022-02-17 14:16:37 +08005668 */
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005669 if ( key_ex != MBEDTLS_KEY_EXCHANGE_DHE_PSK )
5670 {
5671 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5672 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5673 }
Jerry Yuce3dca42022-02-17 14:16:37 +08005674 }
5675
5676 /*
5677 * PMS = struct {
5678 * opaque other_secret<0..2^16-1>;
5679 * opaque psk<0..2^16-1>;
5680 * };
5681 * with "other_secret" depending on the particular key exchange
5682 */
5683#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
5684 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
5685 {
5686 if( end - p < 2 )
5687 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5688
5689 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
5690 p += 2;
5691
5692 if( end < p || (size_t)( end - p ) < psk_len )
5693 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5694
5695 memset( p, 0, psk_len );
5696 p += psk_len;
5697 }
5698 else
5699#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
5700#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
5701 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
5702 {
5703 /*
5704 * other_secret already set by the ClientKeyExchange message,
5705 * and is 48 bytes long
5706 */
5707 if( end - p < 2 )
5708 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5709
5710 *p++ = 0;
5711 *p++ = 48;
5712 p += 48;
5713 }
5714 else
5715#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
5716#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
5717 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
5718 {
5719 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5720 size_t len;
5721
5722 /* Write length only when we know the actual value */
5723 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
5724 p + 2, end - ( p + 2 ), &len,
5725 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
5726 {
5727 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
5728 return( ret );
5729 }
5730 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
5731 p += 2 + len;
5732
5733 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
5734 }
5735 else
5736#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Neil Armstrong80f6f322022-05-03 17:56:38 +02005737#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Jerry Yuce3dca42022-02-17 14:16:37 +08005738 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
5739 {
5740 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5741 size_t zlen;
5742
5743 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
5744 p + 2, end - ( p + 2 ),
5745 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
5746 {
5747 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
5748 return( ret );
5749 }
5750
5751 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
5752 p += 2 + zlen;
5753
5754 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
5755 MBEDTLS_DEBUG_ECDH_Z );
5756 }
5757 else
Neil Armstrong80f6f322022-05-03 17:56:38 +02005758#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Jerry Yuce3dca42022-02-17 14:16:37 +08005759 {
5760 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5761 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5762 }
5763
5764 /* opaque psk<0..2^16-1>; */
5765 if( end - p < 2 )
5766 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5767
5768 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
5769 p += 2;
5770
5771 if( end < p || (size_t)( end - p ) < psk_len )
5772 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5773
5774 memcpy( p, psk, psk_len );
5775 p += psk_len;
5776
5777 ssl->handshake->pmslen = p - ssl->handshake->premaster;
5778
5779 return( 0 );
5780}
Neil Armstrong80f6f322022-05-03 17:56:38 +02005781#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08005782
5783#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005784MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuc2c673d2022-02-17 14:20:39 +08005785static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
5786
5787#if defined(MBEDTLS_SSL_PROTO_DTLS)
5788int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
5789{
5790 /* If renegotiation is not enforced, retransmit until we would reach max
5791 * timeout if we were using the usual handshake doubling scheme */
5792 if( ssl->conf->renego_max_records < 0 )
5793 {
5794 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
5795 unsigned char doublings = 1;
5796
5797 while( ratio != 0 )
5798 {
5799 ++doublings;
5800 ratio >>= 1;
5801 }
5802
5803 if( ++ssl->renego_records_seen > doublings )
5804 {
5805 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
5806 return( 0 );
5807 }
5808 }
5809
5810 return( ssl_write_hello_request( ssl ) );
5811}
5812#endif
5813#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08005814
Jerry Yud9526692022-02-17 14:23:47 +08005815/*
5816 * Handshake functions
5817 */
5818#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
5819/* No certificate support -> dummy functions */
5820int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
5821{
5822 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5823 ssl->handshake->ciphersuite_info;
5824
5825 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
5826
5827 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5828 {
5829 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5830 ssl->state++;
5831 return( 0 );
5832 }
5833
5834 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5835 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5836}
5837
5838int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
5839{
5840 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5841 ssl->handshake->ciphersuite_info;
5842
5843 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
5844
5845 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5846 {
5847 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5848 ssl->state++;
5849 return( 0 );
5850 }
5851
5852 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5853 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5854}
5855
5856#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
5857/* Some certificate support -> implement write and parse */
5858
5859int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
5860{
5861 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5862 size_t i, n;
5863 const mbedtls_x509_crt *crt;
5864 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
5865 ssl->handshake->ciphersuite_info;
5866
5867 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
5868
5869 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
5870 {
5871 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5872 ssl->state++;
5873 return( 0 );
5874 }
5875
5876#if defined(MBEDTLS_SSL_CLI_C)
5877 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5878 {
5879 if( ssl->handshake->client_auth == 0 )
5880 {
5881 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5882 ssl->state++;
5883 return( 0 );
5884 }
5885 }
5886#endif /* MBEDTLS_SSL_CLI_C */
5887#if defined(MBEDTLS_SSL_SRV_C)
5888 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5889 {
5890 if( mbedtls_ssl_own_cert( ssl ) == NULL )
5891 {
5892 /* Should never happen because we shouldn't have picked the
5893 * ciphersuite if we don't have a certificate. */
5894 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5895 }
5896 }
5897#endif
5898
5899 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
5900
5901 /*
5902 * 0 . 0 handshake type
5903 * 1 . 3 handshake length
5904 * 4 . 6 length of all certs
5905 * 7 . 9 length of cert. 1
5906 * 10 . n-1 peer certificate
5907 * n . n+2 length of cert. 2
5908 * n+3 . ... upper level cert, etc.
5909 */
5910 i = 7;
5911 crt = mbedtls_ssl_own_cert( ssl );
5912
5913 while( crt != NULL )
5914 {
5915 n = crt->raw.len;
5916 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
5917 {
5918 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
5919 " > %" MBEDTLS_PRINTF_SIZET,
5920 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
5921 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5922 }
5923
5924 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
5925 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
5926 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
5927
5928 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
5929 i += n; crt = crt->next;
5930 }
5931
5932 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
5933 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
5934 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
5935
5936 ssl->out_msglen = i;
5937 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5938 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
5939
5940 ssl->state++;
5941
5942 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
5943 {
5944 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
5945 return( ret );
5946 }
5947
5948 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
5949
5950 return( ret );
5951}
5952
5953#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
5954
5955#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005956MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08005957static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
5958 unsigned char *crt_buf,
5959 size_t crt_buf_len )
5960{
5961 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
5962
5963 if( peer_crt == NULL )
5964 return( -1 );
5965
5966 if( peer_crt->raw.len != crt_buf_len )
5967 return( -1 );
5968
5969 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
5970}
5971#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005972MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08005973static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
5974 unsigned char *crt_buf,
5975 size_t crt_buf_len )
5976{
5977 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5978 unsigned char const * const peer_cert_digest =
5979 ssl->session->peer_cert_digest;
5980 mbedtls_md_type_t const peer_cert_digest_type =
5981 ssl->session->peer_cert_digest_type;
5982 mbedtls_md_info_t const * const digest_info =
5983 mbedtls_md_info_from_type( peer_cert_digest_type );
5984 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
5985 size_t digest_len;
5986
5987 if( peer_cert_digest == NULL || digest_info == NULL )
5988 return( -1 );
5989
5990 digest_len = mbedtls_md_get_size( digest_info );
5991 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
5992 return( -1 );
5993
5994 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
5995 if( ret != 0 )
5996 return( -1 );
5997
5998 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
5999}
6000#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6001#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6002
6003/*
6004 * Once the certificate message is read, parse it into a cert chain and
6005 * perform basic checks, but leave actual verification to the caller
6006 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006007MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006008static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
6009 mbedtls_x509_crt *chain )
6010{
6011 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6012#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6013 int crt_cnt=0;
6014#endif
6015 size_t i, n;
6016 uint8_t alert;
6017
6018 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
6019 {
6020 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6021 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6022 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6023 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
6024 }
6025
6026 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
6027 {
6028 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6029 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6030 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
6031 }
6032
6033 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
6034 {
6035 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6036 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6037 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6038 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6039 }
6040
6041 i = mbedtls_ssl_hs_hdr_len( ssl );
6042
6043 /*
6044 * Same message structure as in mbedtls_ssl_write_certificate()
6045 */
6046 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
6047
6048 if( ssl->in_msg[i] != 0 ||
6049 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
6050 {
6051 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6052 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6053 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6054 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6055 }
6056
6057 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
6058 i += 3;
6059
6060 /* Iterate through and parse the CRTs in the provided chain. */
6061 while( i < ssl->in_hslen )
6062 {
6063 /* Check that there's room for the next CRT's length fields. */
6064 if ( i + 3 > ssl->in_hslen ) {
6065 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6066 mbedtls_ssl_send_alert_message( ssl,
6067 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6068 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6069 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6070 }
6071 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
6072 * anything beyond 2**16 ~ 64K. */
6073 if( ssl->in_msg[i] != 0 )
6074 {
6075 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6076 mbedtls_ssl_send_alert_message( ssl,
6077 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6078 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
6079 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
6080 }
6081
6082 /* Read length of the next CRT in the chain. */
6083 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
6084 | (unsigned int) ssl->in_msg[i + 2];
6085 i += 3;
6086
6087 if( n < 128 || i + n > ssl->in_hslen )
6088 {
6089 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6090 mbedtls_ssl_send_alert_message( ssl,
6091 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6092 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6093 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6094 }
6095
6096 /* Check if we're handling the first CRT in the chain. */
6097#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6098 if( crt_cnt++ == 0 &&
6099 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
6100 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
6101 {
6102 /* During client-side renegotiation, check that the server's
6103 * end-CRTs hasn't changed compared to the initial handshake,
6104 * mitigating the triple handshake attack. On success, reuse
6105 * the original end-CRT instead of parsing it again. */
6106 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
6107 if( ssl_check_peer_crt_unchanged( ssl,
6108 &ssl->in_msg[i],
6109 n ) != 0 )
6110 {
6111 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
6112 mbedtls_ssl_send_alert_message( ssl,
6113 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6114 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
6115 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
6116 }
6117
6118 /* Now we can safely free the original chain. */
6119 ssl_clear_peer_cert( ssl->session );
6120 }
6121#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6122
6123 /* Parse the next certificate in the chain. */
6124#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6125 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
6126#else
6127 /* If we don't need to store the CRT chain permanently, parse
6128 * it in-place from the input buffer instead of making a copy. */
6129 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
6130#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6131 switch( ret )
6132 {
6133 case 0: /*ok*/
6134 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
6135 /* Ignore certificate with an unknown algorithm: maybe a
6136 prior certificate was already trusted. */
6137 break;
6138
6139 case MBEDTLS_ERR_X509_ALLOC_FAILED:
6140 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
6141 goto crt_parse_der_failed;
6142
6143 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
6144 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6145 goto crt_parse_der_failed;
6146
6147 default:
6148 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6149 crt_parse_der_failed:
6150 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
6151 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
6152 return( ret );
6153 }
6154
6155 i += n;
6156 }
6157
6158 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
6159 return( 0 );
6160}
6161
6162#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006163MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006164static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
6165{
6166 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6167 return( -1 );
6168
6169 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
6170 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
6171 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
6172 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
6173 {
6174 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
6175 return( 0 );
6176 }
6177 return( -1 );
6178}
6179#endif /* MBEDTLS_SSL_SRV_C */
6180
6181/* Check if a certificate message is expected.
6182 * Return either
6183 * - SSL_CERTIFICATE_EXPECTED, or
6184 * - SSL_CERTIFICATE_SKIP
6185 * indicating whether a Certificate message is expected or not.
6186 */
6187#define SSL_CERTIFICATE_EXPECTED 0
6188#define SSL_CERTIFICATE_SKIP 1
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006189MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006190static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
6191 int authmode )
6192{
6193 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6194 ssl->handshake->ciphersuite_info;
6195
6196 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6197 return( SSL_CERTIFICATE_SKIP );
6198
6199#if defined(MBEDTLS_SSL_SRV_C)
6200 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6201 {
6202 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
6203 return( SSL_CERTIFICATE_SKIP );
6204
6205 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
6206 {
6207 ssl->session_negotiate->verify_result =
6208 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
6209 return( SSL_CERTIFICATE_SKIP );
6210 }
6211 }
6212#else
6213 ((void) authmode);
6214#endif /* MBEDTLS_SSL_SRV_C */
6215
6216 return( SSL_CERTIFICATE_EXPECTED );
6217}
6218
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006219MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006220static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
6221 int authmode,
6222 mbedtls_x509_crt *chain,
6223 void *rs_ctx )
6224{
6225 int ret = 0;
6226 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6227 ssl->handshake->ciphersuite_info;
6228 int have_ca_chain = 0;
6229
6230 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
6231 void *p_vrfy;
6232
6233 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
6234 return( 0 );
6235
6236 if( ssl->f_vrfy != NULL )
6237 {
6238 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
6239 f_vrfy = ssl->f_vrfy;
6240 p_vrfy = ssl->p_vrfy;
6241 }
6242 else
6243 {
6244 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
6245 f_vrfy = ssl->conf->f_vrfy;
6246 p_vrfy = ssl->conf->p_vrfy;
6247 }
6248
6249 /*
6250 * Main check: verify certificate
6251 */
6252#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
6253 if( ssl->conf->f_ca_cb != NULL )
6254 {
6255 ((void) rs_ctx);
6256 have_ca_chain = 1;
6257
6258 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
6259 ret = mbedtls_x509_crt_verify_with_ca_cb(
6260 chain,
6261 ssl->conf->f_ca_cb,
6262 ssl->conf->p_ca_cb,
6263 ssl->conf->cert_profile,
6264 ssl->hostname,
6265 &ssl->session_negotiate->verify_result,
6266 f_vrfy, p_vrfy );
6267 }
6268 else
6269#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
6270 {
6271 mbedtls_x509_crt *ca_chain;
6272 mbedtls_x509_crl *ca_crl;
6273
6274#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6275 if( ssl->handshake->sni_ca_chain != NULL )
6276 {
6277 ca_chain = ssl->handshake->sni_ca_chain;
6278 ca_crl = ssl->handshake->sni_ca_crl;
6279 }
6280 else
6281#endif
6282 {
6283 ca_chain = ssl->conf->ca_chain;
6284 ca_crl = ssl->conf->ca_crl;
6285 }
6286
6287 if( ca_chain != NULL )
6288 have_ca_chain = 1;
6289
6290 ret = mbedtls_x509_crt_verify_restartable(
6291 chain,
6292 ca_chain, ca_crl,
6293 ssl->conf->cert_profile,
6294 ssl->hostname,
6295 &ssl->session_negotiate->verify_result,
6296 f_vrfy, p_vrfy, rs_ctx );
6297 }
6298
6299 if( ret != 0 )
6300 {
6301 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
6302 }
6303
6304#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6305 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
6306 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
6307#endif
6308
6309 /*
6310 * Secondary checks: always done, but change 'ret' only if it was 0
6311 */
6312
6313#if defined(MBEDTLS_ECP_C)
6314 {
6315 const mbedtls_pk_context *pk = &chain->pk;
6316
Manuel Pégourié-Gonnard66b0d612022-06-17 10:49:29 +02006317 /* If certificate uses an EC key, make sure the curve is OK.
6318 * This is a public key, so it can't be opaque, so can_do() is a good
6319 * enough check to ensure pk_ec() is safe to use here. */
Jerry Yud9526692022-02-17 14:23:47 +08006320 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
6321 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
6322 {
6323 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
6324
6325 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
6326 if( ret == 0 )
6327 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6328 }
6329 }
6330#endif /* MBEDTLS_ECP_C */
6331
6332 if( mbedtls_ssl_check_cert_usage( chain,
6333 ciphersuite_info,
6334 ! ssl->conf->endpoint,
6335 &ssl->session_negotiate->verify_result ) != 0 )
6336 {
6337 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
6338 if( ret == 0 )
6339 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6340 }
6341
6342 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
6343 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
6344 * with details encoded in the verification flags. All other kinds
6345 * of error codes, including those from the user provided f_vrfy
6346 * functions, are treated as fatal and lead to a failure of
6347 * ssl_parse_certificate even if verification was optional. */
6348 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
6349 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
6350 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
6351 {
6352 ret = 0;
6353 }
6354
6355 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
6356 {
6357 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
6358 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
6359 }
6360
6361 if( ret != 0 )
6362 {
6363 uint8_t alert;
6364
6365 /* The certificate may have been rejected for several reasons.
6366 Pick one and send the corresponding alert. Which alert to send
6367 may be a subject of debate in some cases. */
6368 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
6369 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
6370 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
6371 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6372 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
6373 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6374 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
6375 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6376 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
6377 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6378 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
6379 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6380 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
6381 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6382 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
6383 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
6384 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
6385 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
6386 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
6387 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
6388 else
6389 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
6390 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6391 alert );
6392 }
6393
6394#if defined(MBEDTLS_DEBUG_C)
6395 if( ssl->session_negotiate->verify_result != 0 )
6396 {
6397 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
6398 (unsigned int) ssl->session_negotiate->verify_result ) );
6399 }
6400 else
6401 {
6402 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
6403 }
6404#endif /* MBEDTLS_DEBUG_C */
6405
6406 return( ret );
6407}
6408
6409#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006410MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006411static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
6412 unsigned char *start, size_t len )
6413{
6414 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6415 /* Remember digest of the peer's end-CRT. */
6416 ssl->session_negotiate->peer_cert_digest =
6417 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
6418 if( ssl->session_negotiate->peer_cert_digest == NULL )
6419 {
6420 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
6421 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
6422 mbedtls_ssl_send_alert_message( ssl,
6423 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6424 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6425
6426 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
6427 }
6428
6429 ret = mbedtls_md( mbedtls_md_info_from_type(
6430 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
6431 start, len,
6432 ssl->session_negotiate->peer_cert_digest );
6433
6434 ssl->session_negotiate->peer_cert_digest_type =
6435 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
6436 ssl->session_negotiate->peer_cert_digest_len =
6437 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
6438
6439 return( ret );
6440}
6441
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006442MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006443static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
6444 unsigned char *start, size_t len )
6445{
6446 unsigned char *end = start + len;
6447 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6448
6449 /* Make a copy of the peer's raw public key. */
6450 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
6451 ret = mbedtls_pk_parse_subpubkey( &start, end,
6452 &ssl->handshake->peer_pubkey );
6453 if( ret != 0 )
6454 {
6455 /* We should have parsed the public key before. */
6456 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6457 }
6458
6459 return( 0 );
6460}
6461#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6462
6463int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6464{
6465 int ret = 0;
6466 int crt_expected;
6467#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6468 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
6469 ? ssl->handshake->sni_authmode
6470 : ssl->conf->authmode;
6471#else
6472 const int authmode = ssl->conf->authmode;
6473#endif
6474 void *rs_ctx = NULL;
6475 mbedtls_x509_crt *chain = NULL;
6476
6477 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6478
6479 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
6480 if( crt_expected == SSL_CERTIFICATE_SKIP )
6481 {
6482 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6483 goto exit;
6484 }
6485
6486#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6487 if( ssl->handshake->ecrs_enabled &&
6488 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
6489 {
6490 chain = ssl->handshake->ecrs_peer_cert;
6491 ssl->handshake->ecrs_peer_cert = NULL;
6492 goto crt_verify;
6493 }
6494#endif
6495
6496 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
6497 {
6498 /* mbedtls_ssl_read_record may have sent an alert already. We
6499 let it decide whether to alert. */
6500 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6501 goto exit;
6502 }
6503
6504#if defined(MBEDTLS_SSL_SRV_C)
6505 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
6506 {
6507 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
6508
6509 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
6510 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
6511
6512 goto exit;
6513 }
6514#endif /* MBEDTLS_SSL_SRV_C */
6515
6516 /* Clear existing peer CRT structure in case we tried to
6517 * reuse a session but it failed, and allocate a new one. */
6518 ssl_clear_peer_cert( ssl->session_negotiate );
6519
6520 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
6521 if( chain == NULL )
6522 {
6523 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
6524 sizeof( mbedtls_x509_crt ) ) );
6525 mbedtls_ssl_send_alert_message( ssl,
6526 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6527 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6528
6529 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
6530 goto exit;
6531 }
6532 mbedtls_x509_crt_init( chain );
6533
6534 ret = ssl_parse_certificate_chain( ssl, chain );
6535 if( ret != 0 )
6536 goto exit;
6537
6538#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6539 if( ssl->handshake->ecrs_enabled)
6540 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
6541
6542crt_verify:
6543 if( ssl->handshake->ecrs_enabled)
6544 rs_ctx = &ssl->handshake->ecrs_ctx;
6545#endif
6546
6547 ret = ssl_parse_certificate_verify( ssl, authmode,
6548 chain, rs_ctx );
6549 if( ret != 0 )
6550 goto exit;
6551
6552#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6553 {
6554 unsigned char *crt_start, *pk_start;
6555 size_t crt_len, pk_len;
6556
6557 /* We parse the CRT chain without copying, so
6558 * these pointers point into the input buffer,
6559 * and are hence still valid after freeing the
6560 * CRT chain. */
6561
6562 crt_start = chain->raw.p;
6563 crt_len = chain->raw.len;
6564
6565 pk_start = chain->pk_raw.p;
6566 pk_len = chain->pk_raw.len;
6567
6568 /* Free the CRT structures before computing
6569 * digest and copying the peer's public key. */
6570 mbedtls_x509_crt_free( chain );
6571 mbedtls_free( chain );
6572 chain = NULL;
6573
6574 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
6575 if( ret != 0 )
6576 goto exit;
6577
6578 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
6579 if( ret != 0 )
6580 goto exit;
6581 }
6582#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6583 /* Pass ownership to session structure. */
6584 ssl->session_negotiate->peer_cert = chain;
6585 chain = NULL;
6586#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6587
6588 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
6589
6590exit:
6591
6592 if( ret == 0 )
6593 ssl->state++;
6594
6595#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6596 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
6597 {
6598 ssl->handshake->ecrs_peer_cert = chain;
6599 chain = NULL;
6600 }
6601#endif
6602
6603 if( chain != NULL )
6604 {
6605 mbedtls_x509_crt_free( chain );
6606 mbedtls_free( chain );
6607 }
6608
6609 return( ret );
6610}
6611#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6612
Jerry Yu615bd6f2022-02-17 14:25:15 +08006613#if defined(MBEDTLS_SHA256_C)
6614static void ssl_calc_finished_tls_sha256(
6615 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
6616{
6617 int len = 12;
6618 const char *sender;
6619 unsigned char padbuf[32];
6620#if defined(MBEDTLS_USE_PSA_CRYPTO)
6621 size_t hash_size;
6622 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
6623 psa_status_t status;
6624#else
6625 mbedtls_sha256_context sha256;
6626#endif
6627
6628 mbedtls_ssl_session *session = ssl->session_negotiate;
6629 if( !session )
6630 session = ssl->session;
6631
6632 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
6633 ? "client finished"
6634 : "server finished";
6635
6636#if defined(MBEDTLS_USE_PSA_CRYPTO)
6637 sha256_psa = psa_hash_operation_init();
6638
6639 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
6640
6641 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
6642 if( status != PSA_SUCCESS )
6643 {
6644 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6645 return;
6646 }
6647
6648 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
6649 if( status != PSA_SUCCESS )
6650 {
6651 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6652 return;
6653 }
6654 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
6655#else
6656
6657 mbedtls_sha256_init( &sha256 );
6658
6659 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
6660
6661 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
6662
6663 /*
6664 * TLSv1.2:
6665 * hash = PRF( master, finished_label,
6666 * Hash( handshake ) )[0.11]
6667 */
6668
6669#if !defined(MBEDTLS_SHA256_ALT)
6670 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
6671 sha256.state, sizeof( sha256.state ) );
6672#endif
6673
6674 mbedtls_sha256_finish( &sha256, padbuf );
6675 mbedtls_sha256_free( &sha256 );
6676#endif /* MBEDTLS_USE_PSA_CRYPTO */
6677
6678 ssl->handshake->tls_prf( session->master, 48, sender,
6679 padbuf, 32, buf, len );
6680
6681 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
6682
6683 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6684
6685 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6686}
6687#endif /* MBEDTLS_SHA256_C */
6688
Jerry Yub7ba49e2022-02-17 14:25:53 +08006689
6690#if defined(MBEDTLS_SHA384_C)
6691
6692static void ssl_calc_finished_tls_sha384(
6693 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
6694{
6695 int len = 12;
6696 const char *sender;
6697 unsigned char padbuf[48];
6698#if defined(MBEDTLS_USE_PSA_CRYPTO)
6699 size_t hash_size;
6700 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
6701 psa_status_t status;
6702#else
6703 mbedtls_sha512_context sha512;
6704#endif
6705
6706 mbedtls_ssl_session *session = ssl->session_negotiate;
6707 if( !session )
6708 session = ssl->session;
6709
6710 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
6711 ? "client finished"
6712 : "server finished";
6713
6714#if defined(MBEDTLS_USE_PSA_CRYPTO)
6715 sha384_psa = psa_hash_operation_init();
6716
6717 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
6718
6719 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
6720 if( status != PSA_SUCCESS )
6721 {
6722 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6723 return;
6724 }
6725
6726 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
6727 if( status != PSA_SUCCESS )
6728 {
6729 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6730 return;
6731 }
6732 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
6733#else
6734 mbedtls_sha512_init( &sha512 );
6735
6736 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
6737
6738 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
6739
6740 /*
6741 * TLSv1.2:
6742 * hash = PRF( master, finished_label,
6743 * Hash( handshake ) )[0.11]
6744 */
6745
6746#if !defined(MBEDTLS_SHA512_ALT)
6747 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
6748 sha512.state, sizeof( sha512.state ) );
6749#endif
6750 mbedtls_sha512_finish( &sha512, padbuf );
6751
6752 mbedtls_sha512_free( &sha512 );
6753#endif
6754
6755 ssl->handshake->tls_prf( session->master, 48, sender,
6756 padbuf, 48, buf, len );
6757
6758 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
6759
6760 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6761
6762 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6763}
6764#endif /* MBEDTLS_SHA384_C */
6765
Jerry Yuaef00152022-02-17 14:27:31 +08006766void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
6767{
6768 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
6769
6770 /*
6771 * Free our handshake params
6772 */
6773 mbedtls_ssl_handshake_free( ssl );
6774 mbedtls_free( ssl->handshake );
6775 ssl->handshake = NULL;
6776
6777 /*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08006778 * Free the previous transform and switch in the current one
Jerry Yuaef00152022-02-17 14:27:31 +08006779 */
6780 if( ssl->transform )
6781 {
6782 mbedtls_ssl_transform_free( ssl->transform );
6783 mbedtls_free( ssl->transform );
6784 }
6785 ssl->transform = ssl->transform_negotiate;
6786 ssl->transform_negotiate = NULL;
6787
6788 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
6789}
6790
Jerry Yu2a9fff52022-02-17 14:28:51 +08006791void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
6792{
6793 int resume = ssl->handshake->resume;
6794
6795 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
6796
6797#if defined(MBEDTLS_SSL_RENEGOTIATION)
6798 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
6799 {
6800 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
6801 ssl->renego_records_seen = 0;
6802 }
6803#endif
6804
6805 /*
6806 * Free the previous session and switch in the current one
6807 */
6808 if( ssl->session )
6809 {
6810#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6811 /* RFC 7366 3.1: keep the EtM state */
6812 ssl->session_negotiate->encrypt_then_mac =
6813 ssl->session->encrypt_then_mac;
6814#endif
6815
6816 mbedtls_ssl_session_free( ssl->session );
6817 mbedtls_free( ssl->session );
6818 }
6819 ssl->session = ssl->session_negotiate;
6820 ssl->session_negotiate = NULL;
6821
6822 /*
6823 * Add cache entry
6824 */
6825 if( ssl->conf->f_set_cache != NULL &&
6826 ssl->session->id_len != 0 &&
6827 resume == 0 )
6828 {
6829 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
6830 ssl->session->id,
6831 ssl->session->id_len,
6832 ssl->session ) != 0 )
6833 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
6834 }
6835
6836#if defined(MBEDTLS_SSL_PROTO_DTLS)
6837 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
6838 ssl->handshake->flight != NULL )
6839 {
6840 /* Cancel handshake timer */
6841 mbedtls_ssl_set_timer( ssl, 0 );
6842
6843 /* Keep last flight around in case we need to resend it:
6844 * we need the handshake and transform structures for that */
6845 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
6846 }
6847 else
6848#endif
6849 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
6850
6851 ssl->state++;
6852
6853 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
6854}
6855
Jerry Yu3c8e47b2022-02-17 14:30:01 +08006856int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
6857{
6858 int ret, hash_len;
6859
6860 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
6861
6862 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
6863
6864 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
6865
6866 /*
6867 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
6868 * may define some other value. Currently (early 2016), no defined
6869 * ciphersuite does this (and this is unlikely to change as activity has
6870 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
6871 */
6872 hash_len = 12;
6873
6874#if defined(MBEDTLS_SSL_RENEGOTIATION)
6875 ssl->verify_data_len = hash_len;
6876 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
6877#endif
6878
6879 ssl->out_msglen = 4 + hash_len;
6880 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6881 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
6882
6883 /*
6884 * In case of session resuming, invert the client and server
6885 * ChangeCipherSpec messages order.
6886 */
6887 if( ssl->handshake->resume != 0 )
6888 {
6889#if defined(MBEDTLS_SSL_CLI_C)
6890 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6891 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
6892#endif
6893#if defined(MBEDTLS_SSL_SRV_C)
6894 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6895 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
6896#endif
6897 }
6898 else
6899 ssl->state++;
6900
6901 /*
6902 * Switch to our negotiated transform and session parameters for outbound
6903 * data.
6904 */
6905 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
6906
6907#if defined(MBEDTLS_SSL_PROTO_DTLS)
6908 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6909 {
6910 unsigned char i;
6911
6912 /* Remember current epoch settings for resending */
6913 ssl->handshake->alt_transform_out = ssl->transform_out;
6914 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
6915 sizeof( ssl->handshake->alt_out_ctr ) );
6916
6917 /* Set sequence_number to zero */
6918 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
6919
6920
6921 /* Increment epoch */
6922 for( i = 2; i > 0; i-- )
6923 if( ++ssl->cur_out_ctr[i - 1] != 0 )
6924 break;
6925
6926 /* The loop goes to its end iff the counter is wrapping */
6927 if( i == 0 )
6928 {
6929 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
6930 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
6931 }
6932 }
6933 else
6934#endif /* MBEDTLS_SSL_PROTO_DTLS */
6935 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
6936
6937 ssl->transform_out = ssl->transform_negotiate;
6938 ssl->session_out = ssl->session_negotiate;
6939
6940#if defined(MBEDTLS_SSL_PROTO_DTLS)
6941 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6942 mbedtls_ssl_send_flight_completed( ssl );
6943#endif
6944
6945 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
6946 {
6947 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
6948 return( ret );
6949 }
6950
6951#if defined(MBEDTLS_SSL_PROTO_DTLS)
6952 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
6953 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
6954 {
6955 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
6956 return( ret );
6957 }
6958#endif
6959
6960 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
6961
6962 return( 0 );
6963}
6964
Jerry Yu0b3d7c12022-02-17 14:30:51 +08006965#define SSL_MAX_HASH_LEN 12
6966
6967int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
6968{
6969 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6970 unsigned int hash_len = 12;
6971 unsigned char buf[SSL_MAX_HASH_LEN];
6972
6973 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
6974
6975 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
6976
6977 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
6978 {
6979 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6980 goto exit;
6981 }
6982
6983 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
6984 {
6985 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6986 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6987 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6988 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
6989 goto exit;
6990 }
6991
6992 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
6993 {
6994 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6995 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6996 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
6997 goto exit;
6998 }
6999
7000 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
7001 {
7002 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7003 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7004 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
7005 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
7006 goto exit;
7007 }
7008
7009 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
7010 buf, hash_len ) != 0 )
7011 {
7012 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7013 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7014 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
7015 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
7016 goto exit;
7017 }
7018
7019#if defined(MBEDTLS_SSL_RENEGOTIATION)
7020 ssl->verify_data_len = hash_len;
7021 memcpy( ssl->peer_verify_data, buf, hash_len );
7022#endif
7023
7024 if( ssl->handshake->resume != 0 )
7025 {
7026#if defined(MBEDTLS_SSL_CLI_C)
7027 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7028 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
7029#endif
7030#if defined(MBEDTLS_SSL_SRV_C)
7031 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7032 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
7033#endif
7034 }
7035 else
7036 ssl->state++;
7037
7038#if defined(MBEDTLS_SSL_PROTO_DTLS)
7039 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7040 mbedtls_ssl_recv_flight_completed( ssl );
7041#endif
7042
7043 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
7044
7045exit:
7046 mbedtls_platform_zeroize( buf, hash_len );
7047 return( ret );
7048}
7049
Jerry Yu392112c2022-02-17 14:34:10 +08007050#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
7051/*
7052 * Helper to get TLS 1.2 PRF from ciphersuite
7053 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
7054 */
7055static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
7056{
7057#if defined(MBEDTLS_SHA384_C)
7058 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
7059 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
7060
7061 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
7062 return( tls_prf_sha384 );
7063#else
7064 (void) ciphersuite_id;
7065#endif
7066 return( tls_prf_sha256 );
7067}
7068#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08007069
7070static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
7071{
7072 ((void) tls_prf);
7073#if defined(MBEDTLS_SHA384_C)
7074 if( tls_prf == tls_prf_sha384 )
7075 {
7076 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
7077 }
7078 else
7079#endif
7080#if defined(MBEDTLS_SHA256_C)
7081 if( tls_prf == tls_prf_sha256 )
7082 {
7083 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
7084 }
7085 else
7086#endif
7087 return( MBEDTLS_SSL_TLS_PRF_NONE );
7088}
7089
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007090/*
7091 * Populate a transform structure with session keys and all the other
7092 * necessary information.
7093 *
7094 * Parameters:
7095 * - [in/out]: transform: structure to populate
7096 * [in] must be just initialised with mbedtls_ssl_transform_init()
7097 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
7098 * - [in] ciphersuite
7099 * - [in] master
7100 * - [in] encrypt_then_mac
7101 * - [in] compression
7102 * - [in] tls_prf: pointer to PRF to use for key derivation
7103 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Glenn Strauss07c64162022-03-14 12:34:51 -04007104 * - [in] tls_version: TLS version
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007105 * - [in] endpoint: client or server
7106 * - [in] ssl: used for:
7107 * - ssl->conf->{f,p}_export_keys
7108 * [in] optionally used for:
7109 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
7110 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007111MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007112static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
7113 int ciphersuite,
7114 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007115#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007116 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007117#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007118 ssl_tls_prf_t tls_prf,
7119 const unsigned char randbytes[64],
Glenn Strauss07c64162022-03-14 12:34:51 -04007120 mbedtls_ssl_protocol_version tls_version,
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007121 unsigned endpoint,
7122 const mbedtls_ssl_context *ssl )
7123{
7124 int ret = 0;
7125 unsigned char keyblk[256];
7126 unsigned char *key1;
7127 unsigned char *key2;
7128 unsigned char *mac_enc;
7129 unsigned char *mac_dec;
7130 size_t mac_key_len = 0;
7131 size_t iv_copy_len;
7132 size_t keylen;
7133 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007134 mbedtls_ssl_mode_t ssl_mode;
Neil Armstronge4512952022-03-08 09:08:22 +01007135#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007136 const mbedtls_cipher_info_t *cipher_info;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007137 const mbedtls_md_info_t *md_info;
Neil Armstronge4512952022-03-08 09:08:22 +01007138#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007139
7140#if defined(MBEDTLS_USE_PSA_CRYPTO)
7141 psa_key_type_t key_type;
7142 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
7143 psa_algorithm_t alg;
Neil Armstronge4512952022-03-08 09:08:22 +01007144 psa_algorithm_t mac_alg = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007145 size_t key_bits;
7146 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
7147#endif
7148
7149#if !defined(MBEDTLS_DEBUG_C) && \
7150 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
7151 if( ssl->f_export_keys == NULL )
7152 {
7153 ssl = NULL; /* make sure we don't use it except for these cases */
7154 (void) ssl;
7155 }
7156#endif
7157
7158 /*
7159 * Some data just needs copying into the structure
7160 */
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007161#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007162 transform->encrypt_then_mac = encrypt_then_mac;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007163#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Glenn Strauss07c64162022-03-14 12:34:51 -04007164 transform->tls_version = tls_version;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007165
7166#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
7167 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
7168#endif
7169
7170#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Glenn Strauss07c64162022-03-14 12:34:51 -04007171 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007172 {
7173 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
7174 * generation separate. This should never happen. */
7175 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7176 }
7177#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
7178
7179 /*
7180 * Get various info structures
7181 */
7182 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
7183 if( ciphersuite_info == NULL )
7184 {
7185 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
7186 ciphersuite ) );
7187 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7188 }
7189
Neil Armstrongab555e02022-04-04 11:07:59 +02007190 ssl_mode = mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007191#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007192 encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007193#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007194 ciphersuite_info );
7195
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007196 if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
7197 transform->taglen =
7198 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
7199
7200#if defined(MBEDTLS_USE_PSA_CRYPTO)
7201 if( ( status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher,
7202 transform->taglen,
7203 &alg,
7204 &key_type,
7205 &key_bits ) ) != PSA_SUCCESS )
7206 {
7207 ret = psa_ssl_status_to_mbedtls( status );
7208 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", ret );
7209 goto end;
7210 }
7211#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007212 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
7213 if( cipher_info == NULL )
7214 {
7215 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
7216 ciphersuite_info->cipher ) );
7217 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7218 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007219#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007220
Neil Armstronge4512952022-03-08 09:08:22 +01007221#if defined(MBEDTLS_USE_PSA_CRYPTO)
7222 mac_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
7223 if( mac_alg == 0 )
7224 {
7225 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_psa_translate_md for %u not found",
7226 (unsigned) ciphersuite_info->mac ) );
7227 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7228 }
7229#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007230 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
7231 if( md_info == NULL )
7232 {
7233 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
7234 (unsigned) ciphersuite_info->mac ) );
7235 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7236 }
Neil Armstronge4512952022-03-08 09:08:22 +01007237#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007238
7239#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
7240 /* Copy own and peer's CID if the use of the CID
7241 * extension has been negotiated. */
7242 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
7243 {
7244 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
7245
7246 transform->in_cid_len = ssl->own_cid_len;
7247 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
7248 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
7249 transform->in_cid_len );
7250
7251 transform->out_cid_len = ssl->handshake->peer_cid_len;
7252 memcpy( transform->out_cid, ssl->handshake->peer_cid,
7253 ssl->handshake->peer_cid_len );
7254 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
7255 transform->out_cid_len );
7256 }
7257#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
7258
7259 /*
7260 * Compute key block using the PRF
7261 */
7262 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
7263 if( ret != 0 )
7264 {
7265 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
7266 return( ret );
7267 }
7268
7269 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
7270 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
7271 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
7272 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
7273 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
7274
7275 /*
7276 * Determine the appropriate key, IV and MAC length.
7277 */
7278
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007279#if defined(MBEDTLS_USE_PSA_CRYPTO)
7280 keylen = PSA_BITS_TO_BYTES(key_bits);
7281#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007282 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007283#endif
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007284
7285#if defined(MBEDTLS_GCM_C) || \
7286 defined(MBEDTLS_CCM_C) || \
7287 defined(MBEDTLS_CHACHAPOLY_C)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007288 if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007289 {
7290 size_t explicit_ivlen;
7291
7292 transform->maclen = 0;
7293 mac_key_len = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007294
7295 /* All modes haves 96-bit IVs, but the length of the static parts vary
7296 * with mode and version:
7297 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
7298 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
7299 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
7300 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
7301 * sequence number).
7302 */
7303 transform->ivlen = 12;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007304#if defined(MBEDTLS_USE_PSA_CRYPTO)
7305 if( key_type == PSA_KEY_TYPE_CHACHA20 )
7306#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007307 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007308#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007309 transform->fixed_ivlen = 12;
7310 else
7311 transform->fixed_ivlen = 4;
7312
7313 /* Minimum length of encrypted record */
7314 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
7315 transform->minlen = explicit_ivlen + transform->taglen;
7316 }
7317 else
7318#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
7319#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007320 if( ssl_mode == MBEDTLS_SSL_MODE_STREAM ||
7321 ssl_mode == MBEDTLS_SSL_MODE_CBC ||
7322 ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007323 {
Neil Armstronge4512952022-03-08 09:08:22 +01007324#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstrongd1be7672022-04-04 11:21:41 +02007325 size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007326#else
7327 size_t block_size = cipher_info->block_size;
7328#endif /* MBEDTLS_USE_PSA_CRYPTO */
7329
7330#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01007331 /* Get MAC length */
7332 mac_key_len = PSA_HASH_LENGTH(mac_alg);
7333#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007334 /* Initialize HMAC contexts */
7335 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
7336 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
7337 {
7338 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7339 goto end;
7340 }
7341
7342 /* Get MAC length */
7343 mac_key_len = mbedtls_md_get_size( md_info );
Neil Armstronge4512952022-03-08 09:08:22 +01007344#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007345 transform->maclen = mac_key_len;
7346
7347 /* IV length */
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007348#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstrong2230e6c2022-04-27 10:36:14 +02007349 transform->ivlen = PSA_CIPHER_IV_LENGTH( key_type, alg );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007350#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007351 transform->ivlen = cipher_info->iv_size;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007352#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007353
7354 /* Minimum length */
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007355 if( ssl_mode == MBEDTLS_SSL_MODE_STREAM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007356 transform->minlen = transform->maclen;
7357 else
7358 {
7359 /*
7360 * GenericBlockCipher:
7361 * 1. if EtM is in use: one block plus MAC
7362 * otherwise: * first multiple of blocklen greater than maclen
7363 * 2. IV
7364 */
7365#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007366 if( ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007367 {
7368 transform->minlen = transform->maclen
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007369 + block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007370 }
7371 else
7372#endif
7373 {
7374 transform->minlen = transform->maclen
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007375 + block_size
7376 - transform->maclen % block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007377 }
7378
Glenn Strauss07c64162022-03-14 12:34:51 -04007379 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007380 {
7381 transform->minlen += transform->ivlen;
7382 }
7383 else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007384 {
7385 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7386 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7387 goto end;
7388 }
7389 }
7390 }
7391 else
7392#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7393 {
7394 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7395 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7396 }
7397
7398 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
7399 (unsigned) keylen,
7400 (unsigned) transform->minlen,
7401 (unsigned) transform->ivlen,
7402 (unsigned) transform->maclen ) );
7403
7404 /*
7405 * Finally setup the cipher contexts, IVs and MAC secrets.
7406 */
7407#if defined(MBEDTLS_SSL_CLI_C)
7408 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
7409 {
7410 key1 = keyblk + mac_key_len * 2;
7411 key2 = keyblk + mac_key_len * 2 + keylen;
7412
7413 mac_enc = keyblk;
7414 mac_dec = keyblk + mac_key_len;
7415
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007416 iv_copy_len = ( transform->fixed_ivlen ) ?
7417 transform->fixed_ivlen : transform->ivlen;
7418 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
7419 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
7420 iv_copy_len );
7421 }
7422 else
7423#endif /* MBEDTLS_SSL_CLI_C */
7424#if defined(MBEDTLS_SSL_SRV_C)
7425 if( endpoint == MBEDTLS_SSL_IS_SERVER )
7426 {
7427 key1 = keyblk + mac_key_len * 2 + keylen;
7428 key2 = keyblk + mac_key_len * 2;
7429
7430 mac_enc = keyblk + mac_key_len;
7431 mac_dec = keyblk;
7432
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007433 iv_copy_len = ( transform->fixed_ivlen ) ?
7434 transform->fixed_ivlen : transform->ivlen;
7435 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
7436 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
7437 iv_copy_len );
7438 }
7439 else
7440#endif /* MBEDTLS_SSL_SRV_C */
7441 {
7442 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7443 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7444 goto end;
7445 }
7446
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007447 if( ssl != NULL && ssl->f_export_keys != NULL )
7448 {
7449 ssl->f_export_keys( ssl->p_export_keys,
7450 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
7451 master, 48,
7452 randbytes + 32,
7453 randbytes,
7454 tls_prf_get_type( tls_prf ) );
7455 }
7456
7457#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007458 transform->psa_alg = alg;
7459
7460 if ( alg != MBEDTLS_SSL_NULL_CIPHER )
7461 {
7462 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
7463 psa_set_key_algorithm( &attributes, alg );
7464 psa_set_key_type( &attributes, key_type );
7465
7466 if( ( status = psa_import_key( &attributes,
7467 key1,
7468 PSA_BITS_TO_BYTES( key_bits ),
7469 &transform->psa_key_enc ) ) != PSA_SUCCESS )
7470 {
7471 MBEDTLS_SSL_DEBUG_RET( 3, "psa_import_key", (int)status );
7472 ret = psa_ssl_status_to_mbedtls( status );
7473 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7474 goto end;
7475 }
7476
7477 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
7478
7479 if( ( status = psa_import_key( &attributes,
7480 key2,
7481 PSA_BITS_TO_BYTES( key_bits ),
7482 &transform->psa_key_dec ) ) != PSA_SUCCESS )
7483 {
7484 ret = psa_ssl_status_to_mbedtls( status );
7485 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7486 goto end;
7487 }
7488 }
7489#else
7490 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
7491 cipher_info ) ) != 0 )
7492 {
7493 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7494 goto end;
7495 }
7496
7497 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
7498 cipher_info ) ) != 0 )
7499 {
7500 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7501 goto end;
7502 }
7503
7504 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
7505 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7506 MBEDTLS_ENCRYPT ) ) != 0 )
7507 {
7508 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7509 goto end;
7510 }
7511
7512 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
7513 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7514 MBEDTLS_DECRYPT ) ) != 0 )
7515 {
7516 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7517 goto end;
7518 }
7519
7520#if defined(MBEDTLS_CIPHER_MODE_CBC)
7521 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
7522 {
7523 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
7524 MBEDTLS_PADDING_NONE ) ) != 0 )
7525 {
7526 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7527 goto end;
7528 }
7529
7530 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
7531 MBEDTLS_PADDING_NONE ) ) != 0 )
7532 {
7533 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7534 goto end;
7535 }
7536 }
7537#endif /* MBEDTLS_CIPHER_MODE_CBC */
7538#endif /* MBEDTLS_USE_PSA_CRYPTO */
7539
Neil Armstrong29c0c042022-03-17 17:47:28 +01007540#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
7541 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
7542 For AEAD-based ciphersuites, there is nothing to do here. */
7543 if( mac_key_len != 0 )
7544 {
7545#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01007546 transform->psa_mac_alg = PSA_ALG_HMAC( mac_alg );
Neil Armstrong29c0c042022-03-17 17:47:28 +01007547
7548 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
Neil Armstronge4512952022-03-08 09:08:22 +01007549 psa_set_key_algorithm( &attributes, PSA_ALG_HMAC( mac_alg ) );
Neil Armstrong29c0c042022-03-17 17:47:28 +01007550 psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
7551
7552 if( ( status = psa_import_key( &attributes,
7553 mac_enc, mac_key_len,
7554 &transform->psa_mac_enc ) ) != PSA_SUCCESS )
7555 {
7556 ret = psa_ssl_status_to_mbedtls( status );
7557 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7558 goto end;
7559 }
7560
Ronald Cronfb39f152022-03-25 14:36:28 +01007561 if( ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ) ||
7562 ( ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING ) &&
7563 ( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ) ) )
Neil Armstrong29c0c042022-03-17 17:47:28 +01007564 /* mbedtls_ct_hmac() requires the key to be exportable */
7565 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT |
7566 PSA_KEY_USAGE_VERIFY_HASH );
7567 else
7568 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
7569
7570 if( ( status = psa_import_key( &attributes,
7571 mac_dec, mac_key_len,
7572 &transform->psa_mac_dec ) ) != PSA_SUCCESS )
7573 {
7574 ret = psa_ssl_status_to_mbedtls( status );
7575 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7576 goto end;
7577 }
7578#else
7579 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
7580 if( ret != 0 )
7581 goto end;
7582 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
7583 if( ret != 0 )
7584 goto end;
7585#endif /* MBEDTLS_USE_PSA_CRYPTO */
7586 }
7587#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7588
7589 ((void) mac_dec);
7590 ((void) mac_enc);
7591
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007592end:
7593 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
7594 return( ret );
7595}
7596
Jerry Yuee40f9d2022-02-17 14:55:16 +08007597#if defined(MBEDTLS_USE_PSA_CRYPTO)
7598int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7599 unsigned char *hash, size_t *hashlen,
7600 unsigned char *data, size_t data_len,
7601 mbedtls_md_type_t md_alg )
7602{
7603 psa_status_t status;
7604 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
7605 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
7606
7607 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
7608
7609 if( ( status = psa_hash_setup( &hash_operation,
7610 hash_alg ) ) != PSA_SUCCESS )
7611 {
7612 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
7613 goto exit;
7614 }
7615
7616 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
7617 64 ) ) != PSA_SUCCESS )
7618 {
7619 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7620 goto exit;
7621 }
7622
7623 if( ( status = psa_hash_update( &hash_operation,
7624 data, data_len ) ) != PSA_SUCCESS )
7625 {
7626 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7627 goto exit;
7628 }
7629
7630 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
7631 hashlen ) ) != PSA_SUCCESS )
7632 {
7633 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
7634 goto exit;
7635 }
7636
7637exit:
7638 if( status != PSA_SUCCESS )
7639 {
7640 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7641 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7642 switch( status )
7643 {
7644 case PSA_ERROR_NOT_SUPPORTED:
7645 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
7646 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
7647 case PSA_ERROR_BUFFER_TOO_SMALL:
7648 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7649 case PSA_ERROR_INSUFFICIENT_MEMORY:
7650 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7651 default:
7652 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
7653 }
7654 }
7655 return( 0 );
7656}
7657
7658#else
7659
7660int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7661 unsigned char *hash, size_t *hashlen,
7662 unsigned char *data, size_t data_len,
7663 mbedtls_md_type_t md_alg )
7664{
7665 int ret = 0;
7666 mbedtls_md_context_t ctx;
7667 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
7668 *hashlen = mbedtls_md_get_size( md_info );
7669
7670 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
7671
7672 mbedtls_md_init( &ctx );
7673
7674 /*
7675 * digitally-signed struct {
7676 * opaque client_random[32];
7677 * opaque server_random[32];
7678 * ServerDHParams params;
7679 * };
7680 */
7681 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7682 {
7683 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7684 goto exit;
7685 }
7686 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7687 {
7688 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7689 goto exit;
7690 }
7691 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7692 {
7693 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7694 goto exit;
7695 }
7696 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7697 {
7698 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7699 goto exit;
7700 }
7701 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
7702 {
7703 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7704 goto exit;
7705 }
7706
7707exit:
7708 mbedtls_md_free( &ctx );
7709
7710 if( ret != 0 )
7711 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7712 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7713
7714 return( ret );
7715}
7716#endif /* MBEDTLS_USE_PSA_CRYPTO */
7717
Jerry Yud9d91da2022-02-17 14:57:06 +08007718#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7719
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007720/* Find the preferred hash for a given signature algorithm. */
7721unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
7722 mbedtls_ssl_context *ssl,
7723 unsigned int sig_alg )
Jerry Yud9d91da2022-02-17 14:57:06 +08007724{
Gabor Mezei078e8032022-04-27 21:17:56 +02007725 unsigned int i;
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007726 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
Gabor Mezei078e8032022-04-27 21:17:56 +02007727
7728 if( sig_alg == MBEDTLS_SSL_SIG_ANON )
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007729 return( MBEDTLS_SSL_HASH_NONE );
Gabor Mezei078e8032022-04-27 21:17:56 +02007730
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007731 for( i = 0; received_sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++ )
Jerry Yud9d91da2022-02-17 14:57:06 +08007732 {
Gabor Mezei3631cf62022-05-10 12:59:00 +02007733 if( sig_alg == MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(
7734 received_sig_algs[i] ) )
Gabor Mezei696956d2022-05-13 16:27:29 +02007735 return( MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(
7736 received_sig_algs[i] ) );
Jerry Yud9d91da2022-02-17 14:57:06 +08007737 }
Jerry Yud9d91da2022-02-17 14:57:06 +08007738
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007739 return( MBEDTLS_SSL_HASH_NONE );
Jerry Yud9d91da2022-02-17 14:57:06 +08007740}
7741
7742#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7743
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08007744/* Serialization of TLS 1.2 sessions:
7745 *
7746 * struct {
7747 * uint64 start_time;
7748 * uint8 ciphersuite[2]; // defined by the standard
7749 * uint8 compression; // 0 or 1
7750 * uint8 session_id_len; // at most 32
7751 * opaque session_id[32];
7752 * opaque master[48]; // fixed length in the standard
7753 * uint32 verify_result;
7754 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
7755 * opaque ticket<0..2^24-1>; // length 0 means no ticket
7756 * uint32 ticket_lifetime;
7757 * uint8 mfl_code; // up to 255 according to standard
7758 * uint8 encrypt_then_mac; // 0 or 1
7759 * } serialized_session_tls12;
7760 *
7761 */
7762static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
7763 unsigned char *buf,
7764 size_t buf_len )
7765{
7766 unsigned char *p = buf;
7767 size_t used = 0;
7768
7769#if defined(MBEDTLS_HAVE_TIME)
7770 uint64_t start;
7771#endif
7772#if defined(MBEDTLS_X509_CRT_PARSE_C)
7773#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7774 size_t cert_len;
7775#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7776#endif /* MBEDTLS_X509_CRT_PARSE_C */
7777
7778 /*
7779 * Time
7780 */
7781#if defined(MBEDTLS_HAVE_TIME)
7782 used += 8;
7783
7784 if( used <= buf_len )
7785 {
7786 start = (uint64_t) session->start;
7787
7788 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
7789 p += 8;
7790 }
7791#endif /* MBEDTLS_HAVE_TIME */
7792
7793 /*
7794 * Basic mandatory fields
7795 */
7796 used += 2 /* ciphersuite */
7797 + 1 /* compression */
7798 + 1 /* id_len */
7799 + sizeof( session->id )
7800 + sizeof( session->master )
7801 + 4; /* verify_result */
7802
7803 if( used <= buf_len )
7804 {
7805 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
7806 p += 2;
7807
7808 *p++ = MBEDTLS_BYTE_0( session->compression );
7809
7810 *p++ = MBEDTLS_BYTE_0( session->id_len );
7811 memcpy( p, session->id, 32 );
7812 p += 32;
7813
7814 memcpy( p, session->master, 48 );
7815 p += 48;
7816
7817 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
7818 p += 4;
7819 }
7820
7821 /*
7822 * Peer's end-entity certificate
7823 */
7824#if defined(MBEDTLS_X509_CRT_PARSE_C)
7825#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7826 if( session->peer_cert == NULL )
7827 cert_len = 0;
7828 else
7829 cert_len = session->peer_cert->raw.len;
7830
7831 used += 3 + cert_len;
7832
7833 if( used <= buf_len )
7834 {
7835 *p++ = MBEDTLS_BYTE_2( cert_len );
7836 *p++ = MBEDTLS_BYTE_1( cert_len );
7837 *p++ = MBEDTLS_BYTE_0( cert_len );
7838
7839 if( session->peer_cert != NULL )
7840 {
7841 memcpy( p, session->peer_cert->raw.p, cert_len );
7842 p += cert_len;
7843 }
7844 }
7845#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7846 if( session->peer_cert_digest != NULL )
7847 {
7848 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
7849 if( used <= buf_len )
7850 {
7851 *p++ = (unsigned char) session->peer_cert_digest_type;
7852 *p++ = (unsigned char) session->peer_cert_digest_len;
7853 memcpy( p, session->peer_cert_digest,
7854 session->peer_cert_digest_len );
7855 p += session->peer_cert_digest_len;
7856 }
7857 }
7858 else
7859 {
7860 used += 2;
7861 if( used <= buf_len )
7862 {
7863 *p++ = (unsigned char) MBEDTLS_MD_NONE;
7864 *p++ = 0;
7865 }
7866 }
7867#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7868#endif /* MBEDTLS_X509_CRT_PARSE_C */
7869
7870 /*
7871 * Session ticket if any, plus associated data
7872 */
7873#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
7874 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
7875
7876 if( used <= buf_len )
7877 {
7878 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
7879 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
7880 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
7881
7882 if( session->ticket != NULL )
7883 {
7884 memcpy( p, session->ticket, session->ticket_len );
7885 p += session->ticket_len;
7886 }
7887
7888 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
7889 p += 4;
7890 }
7891#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
7892
7893 /*
7894 * Misc extension-related info
7895 */
7896#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
7897 used += 1;
7898
7899 if( used <= buf_len )
7900 *p++ = session->mfl_code;
7901#endif
7902
7903#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7904 used += 1;
7905
7906 if( used <= buf_len )
7907 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
7908#endif
7909
7910 return( used );
7911}
7912
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007913MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08007914static int ssl_session_load_tls12( mbedtls_ssl_session *session,
7915 const unsigned char *buf,
7916 size_t len )
7917{
7918#if defined(MBEDTLS_HAVE_TIME)
7919 uint64_t start;
7920#endif
7921#if defined(MBEDTLS_X509_CRT_PARSE_C)
7922#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7923 size_t cert_len;
7924#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7925#endif /* MBEDTLS_X509_CRT_PARSE_C */
7926
7927 const unsigned char *p = buf;
7928 const unsigned char * const end = buf + len;
7929
7930 /*
7931 * Time
7932 */
7933#if defined(MBEDTLS_HAVE_TIME)
7934 if( 8 > (size_t)( end - p ) )
7935 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7936
7937 start = ( (uint64_t) p[0] << 56 ) |
7938 ( (uint64_t) p[1] << 48 ) |
7939 ( (uint64_t) p[2] << 40 ) |
7940 ( (uint64_t) p[3] << 32 ) |
7941 ( (uint64_t) p[4] << 24 ) |
7942 ( (uint64_t) p[5] << 16 ) |
7943 ( (uint64_t) p[6] << 8 ) |
7944 ( (uint64_t) p[7] );
7945 p += 8;
7946
7947 session->start = (time_t) start;
7948#endif /* MBEDTLS_HAVE_TIME */
7949
7950 /*
7951 * Basic mandatory fields
7952 */
7953 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
7954 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7955
7956 session->ciphersuite = ( p[0] << 8 ) | p[1];
7957 p += 2;
7958
7959 session->compression = *p++;
7960
7961 session->id_len = *p++;
7962 memcpy( session->id, p, 32 );
7963 p += 32;
7964
7965 memcpy( session->master, p, 48 );
7966 p += 48;
7967
7968 session->verify_result = ( (uint32_t) p[0] << 24 ) |
7969 ( (uint32_t) p[1] << 16 ) |
7970 ( (uint32_t) p[2] << 8 ) |
7971 ( (uint32_t) p[3] );
7972 p += 4;
7973
7974 /* Immediately clear invalid pointer values that have been read, in case
7975 * we exit early before we replaced them with valid ones. */
7976#if defined(MBEDTLS_X509_CRT_PARSE_C)
7977#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7978 session->peer_cert = NULL;
7979#else
7980 session->peer_cert_digest = NULL;
7981#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7982#endif /* MBEDTLS_X509_CRT_PARSE_C */
7983#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
7984 session->ticket = NULL;
7985#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
7986
7987 /*
7988 * Peer certificate
7989 */
7990#if defined(MBEDTLS_X509_CRT_PARSE_C)
7991#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7992 /* Deserialize CRT from the end of the ticket. */
7993 if( 3 > (size_t)( end - p ) )
7994 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7995
7996 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
7997 p += 3;
7998
7999 if( cert_len != 0 )
8000 {
8001 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8002
8003 if( cert_len > (size_t)( end - p ) )
8004 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8005
8006 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
8007
8008 if( session->peer_cert == NULL )
8009 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8010
8011 mbedtls_x509_crt_init( session->peer_cert );
8012
8013 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
8014 p, cert_len ) ) != 0 )
8015 {
8016 mbedtls_x509_crt_free( session->peer_cert );
8017 mbedtls_free( session->peer_cert );
8018 session->peer_cert = NULL;
8019 return( ret );
8020 }
8021
8022 p += cert_len;
8023 }
8024#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8025 /* Deserialize CRT digest from the end of the ticket. */
8026 if( 2 > (size_t)( end - p ) )
8027 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8028
8029 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
8030 session->peer_cert_digest_len = (size_t) *p++;
8031
8032 if( session->peer_cert_digest_len != 0 )
8033 {
8034 const mbedtls_md_info_t *md_info =
8035 mbedtls_md_info_from_type( session->peer_cert_digest_type );
8036 if( md_info == NULL )
8037 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8038 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
8039 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8040
8041 if( session->peer_cert_digest_len > (size_t)( end - p ) )
8042 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8043
8044 session->peer_cert_digest =
8045 mbedtls_calloc( 1, session->peer_cert_digest_len );
8046 if( session->peer_cert_digest == NULL )
8047 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8048
8049 memcpy( session->peer_cert_digest, p,
8050 session->peer_cert_digest_len );
8051 p += session->peer_cert_digest_len;
8052 }
8053#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8054#endif /* MBEDTLS_X509_CRT_PARSE_C */
8055
8056 /*
8057 * Session ticket and associated data
8058 */
8059#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8060 if( 3 > (size_t)( end - p ) )
8061 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8062
8063 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
8064 p += 3;
8065
8066 if( session->ticket_len != 0 )
8067 {
8068 if( session->ticket_len > (size_t)( end - p ) )
8069 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8070
8071 session->ticket = mbedtls_calloc( 1, session->ticket_len );
8072 if( session->ticket == NULL )
8073 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8074
8075 memcpy( session->ticket, p, session->ticket_len );
8076 p += session->ticket_len;
8077 }
8078
8079 if( 4 > (size_t)( end - p ) )
8080 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8081
8082 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
8083 ( (uint32_t) p[1] << 16 ) |
8084 ( (uint32_t) p[2] << 8 ) |
8085 ( (uint32_t) p[3] );
8086 p += 4;
8087#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8088
8089 /*
8090 * Misc extension-related info
8091 */
8092#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8093 if( 1 > (size_t)( end - p ) )
8094 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8095
8096 session->mfl_code = *p++;
8097#endif
8098
8099#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
8100 if( 1 > (size_t)( end - p ) )
8101 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8102
8103 session->encrypt_then_mac = *p++;
8104#endif
8105
8106 /* Done, should have consumed entire buffer */
8107 if( p != end )
8108 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8109
8110 return( 0 );
8111}
Jerry Yudc7bd172022-02-17 13:44:15 +08008112#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8113
XiaokangQian75d40ef2022-04-20 11:05:24 +00008114int mbedtls_ssl_validate_ciphersuite(
8115 const mbedtls_ssl_context *ssl,
8116 const mbedtls_ssl_ciphersuite_t *suite_info,
8117 mbedtls_ssl_protocol_version min_tls_version,
8118 mbedtls_ssl_protocol_version max_tls_version )
8119{
8120 (void) ssl;
8121
8122 if( suite_info == NULL )
8123 return( -1 );
8124
8125 if( ( suite_info->min_tls_version > max_tls_version ) ||
8126 ( suite_info->max_tls_version < min_tls_version ) )
8127 {
8128 return( -1 );
8129 }
8130
XiaokangQian060d8672022-04-21 09:24:56 +00008131#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_CLI_C)
XiaokangQian75d40ef2022-04-20 11:05:24 +00008132#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
8133 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
8134 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
8135 {
8136 return( -1 );
8137 }
8138#endif
8139
8140 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
8141#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
8142 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
8143 mbedtls_ssl_conf_has_static_psk( ssl->conf ) == 0 )
8144 {
8145 return( -1 );
8146 }
8147#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
8148#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8149
8150 return( 0 );
8151}
8152
XiaokangQianeaf36512022-04-24 09:07:44 +00008153#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
8154/*
8155 * Function for writing a signature algorithm extension.
8156 *
8157 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
8158 * value (TLS 1.3 RFC8446):
8159 * enum {
8160 * ....
8161 * ecdsa_secp256r1_sha256( 0x0403 ),
8162 * ecdsa_secp384r1_sha384( 0x0503 ),
8163 * ecdsa_secp521r1_sha512( 0x0603 ),
8164 * ....
8165 * } SignatureScheme;
8166 *
8167 * struct {
8168 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
8169 * } SignatureSchemeList;
8170 *
8171 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
8172 * value (TLS 1.2 RFC5246):
8173 * enum {
8174 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
8175 * sha512(6), (255)
8176 * } HashAlgorithm;
8177 *
8178 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
8179 * SignatureAlgorithm;
8180 *
8181 * struct {
8182 * HashAlgorithm hash;
8183 * SignatureAlgorithm signature;
8184 * } SignatureAndHashAlgorithm;
8185 *
8186 * SignatureAndHashAlgorithm
8187 * supported_signature_algorithms<2..2^16-2>;
8188 *
8189 * The TLS 1.3 signature algorithm extension was defined to be a compatible
8190 * generalization of the TLS 1.2 signature algorithm extension.
8191 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
8192 * `SignatureScheme` field of TLS 1.3
8193 *
8194 */
8195int mbedtls_ssl_write_sig_alg_ext( mbedtls_ssl_context *ssl, unsigned char *buf,
8196 const unsigned char *end, size_t *out_len )
8197{
8198 unsigned char *p = buf;
8199 unsigned char *supported_sig_alg; /* Start of supported_signature_algorithms */
8200 size_t supported_sig_alg_len = 0; /* Length of supported_signature_algorithms */
8201
8202 *out_len = 0;
8203
8204 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding signature_algorithms extension" ) );
8205
8206 /* Check if we have space for header and length field:
8207 * - extension_type (2 bytes)
8208 * - extension_data_length (2 bytes)
8209 * - supported_signature_algorithms_length (2 bytes)
8210 */
8211 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
8212 p += 6;
8213
8214 /*
8215 * Write supported_signature_algorithms
8216 */
8217 supported_sig_alg = p;
8218 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs( ssl );
8219 if( sig_alg == NULL )
8220 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
8221
8222 for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ )
8223 {
8224 if( ! mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg ) )
8225 continue;
8226 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
8227 MBEDTLS_PUT_UINT16_BE( *sig_alg, p, 0 );
8228 p += 2;
8229 MBEDTLS_SSL_DEBUG_MSG( 3, ( "signature scheme [%x]", *sig_alg ) );
8230 }
8231
8232 /* Length of supported_signature_algorithms */
8233 supported_sig_alg_len = p - supported_sig_alg;
8234 if( supported_sig_alg_len == 0 )
8235 {
8236 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No signature algorithms defined." ) );
8237 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
8238 }
8239
XiaokangQianeaf36512022-04-24 09:07:44 +00008240 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SIG_ALG, buf, 0 );
XiaokangQianeaf36512022-04-24 09:07:44 +00008241 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len + 2, buf, 2 );
XiaokangQianeaf36512022-04-24 09:07:44 +00008242 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len, buf, 4 );
8243
XiaokangQianeaf36512022-04-24 09:07:44 +00008244 *out_len = p - buf;
8245
8246#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
8247 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SIG_ALG;
8248#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
8249 return( 0 );
8250}
8251#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
8252
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008253#endif /* MBEDTLS_SSL_TLS_C */