blob: 931fdaf04aa559a25d3a9441c6eac52fd3e82f88 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00005 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Paul Bakker5121ce52009-01-03 21:22:43 +00006 */
7/*
Paul Bakker5121ce52009-01-03 21:22:43 +00008 * http://www.ietf.org/rfc/rfc2246.txt
9 * http://www.ietf.org/rfc/rfc4346.txt
10 */
11
Gilles Peskinedb09ef62020-06-03 01:43:33 +020012#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020014#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000015
SimonBd5800b72016-04-26 07:43:27 +010016#include "mbedtls/platform.h"
SimonBd5800b72016-04-26 07:43:27 +010017
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000018#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010019#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010020#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000021#include "ssl_misc.h"
Andrzej Kurek25f27152022-08-17 16:09:31 -040022
Valerio Settib4f50762024-01-17 10:24:52 +010023#include "debug_internal.h"
Janos Follath73c616b2019-12-18 15:07:04 +000024#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050025#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010026#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020027#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020028
Rich Evans00ab4702015-02-06 13:43:58 +000029#include <string.h>
30
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050031#if defined(MBEDTLS_USE_PSA_CRYPTO)
Valerio Setti384fbde2024-01-02 13:26:40 +010032#include "mbedtls/psa_util.h"
Manuel Pégourié-Gonnard02b10d82023-03-28 12:33:20 +020033#include "md_psa.h"
Manuel Pégourié-Gonnard2be8c632023-06-07 13:07:21 +020034#include "psa_util_internal.h"
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050035#include "psa/crypto.h"
36#endif
37
Janos Follath23bdca02016-10-07 14:47:14 +010038#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000039#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020040#endif
41
Andrzej Kurek8a045ce2022-12-23 11:00:06 -050042#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek00644842023-05-30 05:45:00 -040043/* Define local translating functions to save code size by not using too many
44 * arguments in each translating place. */
45static int local_err_translation(psa_status_t status)
46{
47 return psa_status_to_mbedtls(status, psa_to_ssl_errors,
Andrzej Kurek1e4a0302023-05-30 09:45:17 -040048 ARRAY_LENGTH(psa_to_ssl_errors),
Andrzej Kurek00644842023-05-30 05:45:00 -040049 psa_generic_status_to_mbedtls);
50}
51#define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
Andrzej Kurek8a045ce2022-12-23 11:00:06 -050052#endif
53
Ronald Cronad8c17b2022-06-10 17:18:09 +020054#if defined(MBEDTLS_TEST_HOOKS)
55static mbedtls_ssl_chk_buf_ptr_args chk_buf_ptr_fail_args;
56
57void mbedtls_ssl_set_chk_buf_ptr_fail_args(
Gilles Peskine449bd832023-01-11 14:50:10 +010058 const uint8_t *cur, const uint8_t *end, size_t need)
Ronald Cronad8c17b2022-06-10 17:18:09 +020059{
60 chk_buf_ptr_fail_args.cur = cur;
61 chk_buf_ptr_fail_args.end = end;
62 chk_buf_ptr_fail_args.need = need;
63}
64
Gilles Peskine449bd832023-01-11 14:50:10 +010065void mbedtls_ssl_reset_chk_buf_ptr_fail_args(void)
Ronald Cronad8c17b2022-06-10 17:18:09 +020066{
Gilles Peskine449bd832023-01-11 14:50:10 +010067 memset(&chk_buf_ptr_fail_args, 0, sizeof(chk_buf_ptr_fail_args));
Ronald Cronad8c17b2022-06-10 17:18:09 +020068}
69
Gilles Peskine449bd832023-01-11 14:50:10 +010070int mbedtls_ssl_cmp_chk_buf_ptr_fail_args(mbedtls_ssl_chk_buf_ptr_args *args)
Ronald Cronad8c17b2022-06-10 17:18:09 +020071{
Gilles Peskine449bd832023-01-11 14:50:10 +010072 return (chk_buf_ptr_fail_args.cur != args->cur) ||
73 (chk_buf_ptr_fail_args.end != args->end) ||
74 (chk_buf_ptr_fail_args.need != args->need);
Ronald Cronad8c17b2022-06-10 17:18:09 +020075}
76#endif /* MBEDTLS_TEST_HOOKS */
77
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020078#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010079
Hanno Beckera0e20d02019-05-15 14:03:01 +010080#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010081/* Top-level Connection ID API */
82
Gilles Peskine449bd832023-01-11 14:50:10 +010083int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf,
84 size_t len,
85 int ignore_other_cid)
Hanno Beckerad4a1372019-05-03 13:06:44 +010086{
Gilles Peskine449bd832023-01-11 14:50:10 +010087 if (len > MBEDTLS_SSL_CID_IN_LEN_MAX) {
88 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
89 }
Hanno Beckerad4a1372019-05-03 13:06:44 +010090
Gilles Peskine449bd832023-01-11 14:50:10 +010091 if (ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
92 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE) {
93 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker611ac772019-05-14 11:45:26 +010094 }
95
96 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010097 conf->cid_len = len;
Gilles Peskine449bd832023-01-11 14:50:10 +010098 return 0;
Hanno Beckerad4a1372019-05-03 13:06:44 +010099}
100
Gilles Peskine449bd832023-01-11 14:50:10 +0100101int mbedtls_ssl_set_cid(mbedtls_ssl_context *ssl,
102 int enable,
103 unsigned char const *own_cid,
104 size_t own_cid_len)
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100105{
Gilles Peskine449bd832023-01-11 14:50:10 +0100106 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
107 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
108 }
Hanno Becker76a79ab2019-05-03 14:38:32 +0100109
Hanno Beckerca092242019-04-25 16:01:49 +0100110 ssl->negotiate_cid = enable;
Gilles Peskine449bd832023-01-11 14:50:10 +0100111 if (enable == MBEDTLS_SSL_CID_DISABLED) {
112 MBEDTLS_SSL_DEBUG_MSG(3, ("Disable use of CID extension."));
113 return 0;
Hanno Beckerca092242019-04-25 16:01:49 +0100114 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100115 MBEDTLS_SSL_DEBUG_MSG(3, ("Enable use of CID extension."));
116 MBEDTLS_SSL_DEBUG_BUF(3, "Own CID", own_cid, own_cid_len);
Hanno Beckerca092242019-04-25 16:01:49 +0100117
Gilles Peskine449bd832023-01-11 14:50:10 +0100118 if (own_cid_len != ssl->conf->cid_len) {
119 MBEDTLS_SSL_DEBUG_MSG(3, ("CID length %u does not match CID length %u in config",
120 (unsigned) own_cid_len,
121 (unsigned) ssl->conf->cid_len));
122 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerca092242019-04-25 16:01:49 +0100123 }
124
Gilles Peskine449bd832023-01-11 14:50:10 +0100125 memcpy(ssl->own_cid, own_cid, own_cid_len);
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100126 /* Truncation is not an issue here because
127 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
128 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100129
Gilles Peskine449bd832023-01-11 14:50:10 +0100130 return 0;
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100131}
132
Gilles Peskine449bd832023-01-11 14:50:10 +0100133int mbedtls_ssl_get_own_cid(mbedtls_ssl_context *ssl,
134 int *enabled,
135 unsigned char own_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
136 size_t *own_cid_len)
Paul Elliott0113cf12022-03-11 20:26:47 +0000137{
138 *enabled = MBEDTLS_SSL_CID_DISABLED;
139
Gilles Peskine449bd832023-01-11 14:50:10 +0100140 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
141 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
142 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000143
144 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID length is
145 * zero as this is indistinguishable from not requesting to use
146 * the CID extension. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100147 if (ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) {
148 return 0;
149 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000150
Gilles Peskine449bd832023-01-11 14:50:10 +0100151 if (own_cid_len != NULL) {
Paul Elliott0113cf12022-03-11 20:26:47 +0000152 *own_cid_len = ssl->own_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100153 if (own_cid != NULL) {
154 memcpy(own_cid, ssl->own_cid, ssl->own_cid_len);
155 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000156 }
157
158 *enabled = MBEDTLS_SSL_CID_ENABLED;
159
Gilles Peskine449bd832023-01-11 14:50:10 +0100160 return 0;
Paul Elliott0113cf12022-03-11 20:26:47 +0000161}
162
Gilles Peskine449bd832023-01-11 14:50:10 +0100163int mbedtls_ssl_get_peer_cid(mbedtls_ssl_context *ssl,
164 int *enabled,
165 unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
166 size_t *peer_cid_len)
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100167{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100168 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100169
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
171 mbedtls_ssl_is_handshake_over(ssl) == 0) {
172 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker76a79ab2019-05-03 14:38:32 +0100173 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100174
Hanno Beckerc5f24222019-05-03 12:54:52 +0100175 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
176 * were used, but client and server requested the empty CID.
177 * This is indistinguishable from not using the CID extension
178 * in the first place. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100179 if (ssl->transform_in->in_cid_len == 0 &&
180 ssl->transform_in->out_cid_len == 0) {
181 return 0;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100182 }
183
Gilles Peskine449bd832023-01-11 14:50:10 +0100184 if (peer_cid_len != NULL) {
Hanno Becker615ef172019-05-22 16:50:35 +0100185 *peer_cid_len = ssl->transform_in->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100186 if (peer_cid != NULL) {
187 memcpy(peer_cid, ssl->transform_in->out_cid,
188 ssl->transform_in->out_cid_len);
Hanno Becker615ef172019-05-22 16:50:35 +0100189 }
190 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100191
192 *enabled = MBEDTLS_SSL_CID_ENABLED;
193
Gilles Peskine449bd832023-01-11 14:50:10 +0100194 return 0;
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100195}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100196#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100197
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200198#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200200#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200201/*
202 * Convert max_fragment_length codes to length.
203 * RFC 6066 says:
204 * enum{
205 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
206 * } MaxFragmentLength;
207 * and we add 0 -> extension unused
208 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100209static unsigned int ssl_mfl_code_to_length(int mfl)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200210{
Gilles Peskine449bd832023-01-11 14:50:10 +0100211 switch (mfl) {
212 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
213 return MBEDTLS_TLS_EXT_ADV_CONTENT_LEN;
214 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
215 return 512;
216 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
217 return 1024;
218 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
219 return 2048;
220 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
221 return 4096;
222 default:
223 return MBEDTLS_TLS_EXT_ADV_CONTENT_LEN;
Angus Grattond8213d02016-05-25 20:56:48 +1000224 }
225}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200226#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200227
Gilles Peskine449bd832023-01-11 14:50:10 +0100228int mbedtls_ssl_session_copy(mbedtls_ssl_session *dst,
229 const mbedtls_ssl_session *src)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200230{
Gilles Peskine449bd832023-01-11 14:50:10 +0100231 mbedtls_ssl_session_free(dst);
232 memcpy(dst, src, sizeof(mbedtls_ssl_session));
吴敬辉0b716112021-11-29 10:46:35 +0800233#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
234 dst->ticket = NULL;
Xiaokang Qian87306442022-10-12 09:47:38 +0000235#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
236 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000237 dst->hostname = NULL;
吴敬辉0b716112021-11-29 10:46:35 +0800238#endif
Xiaokang Qian87306442022-10-12 09:47:38 +0000239#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
吴敬辉0b716112021-11-29 10:46:35 +0800240
Waleed Elmelegy4dfb0e72024-03-14 01:48:40 +0000241#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_ALPN) && \
242 defined(MBEDTLS_SSL_EARLY_DATA)
243 dst->ticket_alpn = NULL;
244#endif
245
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200246#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000247
248#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100249 if (src->peer_cert != NULL) {
Janos Follath865b3eb2019-12-16 11:46:15 +0000250 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200251
Gilles Peskine449bd832023-01-11 14:50:10 +0100252 dst->peer_cert = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
253 if (dst->peer_cert == NULL) {
254 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
255 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200256
Gilles Peskine449bd832023-01-11 14:50:10 +0100257 mbedtls_x509_crt_init(dst->peer_cert);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200258
Gilles Peskine449bd832023-01-11 14:50:10 +0100259 if ((ret = mbedtls_x509_crt_parse_der(dst->peer_cert, src->peer_cert->raw.p,
260 src->peer_cert->raw.len)) != 0) {
261 mbedtls_free(dst->peer_cert);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200262 dst->peer_cert = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100263 return ret;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200264 }
265 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000266#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +0100267 if (src->peer_cert_digest != NULL) {
Hanno Becker9198ad12019-02-05 17:00:50 +0000268 dst->peer_cert_digest =
Gilles Peskine449bd832023-01-11 14:50:10 +0100269 mbedtls_calloc(1, src->peer_cert_digest_len);
270 if (dst->peer_cert_digest == NULL) {
271 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
272 }
Hanno Becker9198ad12019-02-05 17:00:50 +0000273
Gilles Peskine449bd832023-01-11 14:50:10 +0100274 memcpy(dst->peer_cert_digest, src->peer_cert_digest,
275 src->peer_cert_digest_len);
Hanno Becker9198ad12019-02-05 17:00:50 +0000276 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000277 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000278 }
279#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
280
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200281#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200282
Waleed Elmelegy4dfb0e72024-03-14 01:48:40 +0000283#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_ALPN) && \
284 defined(MBEDTLS_SSL_EARLY_DATA)
285 {
286 int ret = mbedtls_ssl_session_set_ticket_alpn(dst, src->ticket_alpn);
287 if (ret != 0) {
288 return ret;
289 }
290 }
291#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_ALPN && MBEDTLS_SSL_EARLY_DATA */
292
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200293#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100294 if (src->ticket != NULL) {
295 dst->ticket = mbedtls_calloc(1, src->ticket_len);
296 if (dst->ticket == NULL) {
297 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
298 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200299
Gilles Peskine449bd832023-01-11 14:50:10 +0100300 memcpy(dst->ticket, src->ticket, src->ticket_len);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200301 }
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000302
303#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
304 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +0100305 if (src->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000306 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100307 ret = mbedtls_ssl_session_set_hostname(dst, src->hostname);
308 if (ret != 0) {
309 return ret;
310 }
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000311 }
312#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
313 MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200314#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200315
Gilles Peskine449bd832023-01-11 14:50:10 +0100316 return 0;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200317}
318
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500319#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200320MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100321static int resize_buffer(unsigned char **buffer, size_t len_new, size_t *len_old)
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500322{
Gilles Peskine449bd832023-01-11 14:50:10 +0100323 unsigned char *resized_buffer = mbedtls_calloc(1, len_new);
324 if (resized_buffer == NULL) {
Yanray Wang365ee3e2023-11-22 10:28:28 +0800325 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100326 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500327
328 /* We want to copy len_new bytes when downsizing the buffer, and
329 * len_old bytes when upsizing, so we choose the smaller of two sizes,
330 * to fit one buffer into another. Size checks, ensuring that no data is
331 * lost, are done outside of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100332 memcpy(resized_buffer, *buffer,
333 (len_new < *len_old) ? len_new : *len_old);
Tom Cosgroveca8c61b2023-07-17 15:17:40 +0100334 mbedtls_zeroize_and_free(*buffer, *len_old);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500335
336 *buffer = resized_buffer;
337 *len_old = len_new;
338
339 return 0;
340}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200341
Gilles Peskine449bd832023-01-11 14:50:10 +0100342static void handle_buffer_resizing(mbedtls_ssl_context *ssl, int downsizing,
343 size_t in_buf_new_len,
344 size_t out_buf_new_len)
Andrzej Kurek4a063792020-10-21 15:08:44 +0200345{
346 int modified = 0;
347 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
348 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100349 if (ssl->in_buf != NULL) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200350 written_in = ssl->in_msg - ssl->in_buf;
351 iv_offset_in = ssl->in_iv - ssl->in_buf;
352 len_offset_in = ssl->in_len - ssl->in_buf;
Gilles Peskine449bd832023-01-11 14:50:10 +0100353 if (downsizing ?
Andrzej Kurek4a063792020-10-21 15:08:44 +0200354 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
Gilles Peskine449bd832023-01-11 14:50:10 +0100355 ssl->in_buf_len < in_buf_new_len) {
356 if (resize_buffer(&ssl->in_buf, in_buf_new_len, &ssl->in_buf_len) != 0) {
357 MBEDTLS_SSL_DEBUG_MSG(1, ("input buffer resizing failed - out of memory"));
358 } else {
359 MBEDTLS_SSL_DEBUG_MSG(2, ("Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
360 in_buf_new_len));
Andrzej Kurek4a063792020-10-21 15:08:44 +0200361 modified = 1;
362 }
363 }
364 }
365
Gilles Peskine449bd832023-01-11 14:50:10 +0100366 if (ssl->out_buf != NULL) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200367 written_out = ssl->out_msg - ssl->out_buf;
368 iv_offset_out = ssl->out_iv - ssl->out_buf;
369 len_offset_out = ssl->out_len - ssl->out_buf;
Gilles Peskine449bd832023-01-11 14:50:10 +0100370 if (downsizing ?
Andrzej Kurek4a063792020-10-21 15:08:44 +0200371 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
Gilles Peskine449bd832023-01-11 14:50:10 +0100372 ssl->out_buf_len < out_buf_new_len) {
373 if (resize_buffer(&ssl->out_buf, out_buf_new_len, &ssl->out_buf_len) != 0) {
374 MBEDTLS_SSL_DEBUG_MSG(1, ("output buffer resizing failed - out of memory"));
375 } else {
376 MBEDTLS_SSL_DEBUG_MSG(2, ("Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
377 out_buf_new_len));
Andrzej Kurek4a063792020-10-21 15:08:44 +0200378 modified = 1;
379 }
380 }
381 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100382 if (modified) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200383 /* Update pointers here to avoid doing it twice. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100384 mbedtls_ssl_reset_in_out_pointers(ssl);
Andrzej Kurek4a063792020-10-21 15:08:44 +0200385 /* Fields below might not be properly updated with record
386 * splitting or with CID, so they are manually updated here. */
387 ssl->out_msg = ssl->out_buf + written_out;
388 ssl->out_len = ssl->out_buf + len_offset_out;
389 ssl->out_iv = ssl->out_buf + iv_offset_out;
390
391 ssl->in_msg = ssl->in_buf + written_in;
392 ssl->in_len = ssl->in_buf + len_offset_in;
393 ssl->in_iv = ssl->in_buf + iv_offset_in;
394 }
395}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500396#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
397
Jerry Yudb8c48a2022-01-27 14:54:54 +0800398#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800399
400#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Gilles Peskine449bd832023-01-11 14:50:10 +0100401typedef int (*tls_prf_fn)(const unsigned char *secret, size_t slen,
402 const char *label,
403 const unsigned char *random, size_t rlen,
404 unsigned char *dstbuf, size_t dlen);
Jerry Yued14c932022-02-17 13:40:45 +0800405
Gilles Peskine449bd832023-01-11 14:50:10 +0100406static tls_prf_fn ssl_tls12prf_from_cs(int ciphersuite_id);
Jerry Yued14c932022-02-17 13:40:45 +0800407
408#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
409
410/* Type for the TLS PRF */
411typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
412 const unsigned char *, size_t,
413 unsigned char *, size_t);
414
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200415MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100416static int ssl_tls12_populate_transform(mbedtls_ssl_transform *transform,
417 int ciphersuite,
418 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200419#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +0100420 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200421#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +0100422 ssl_tls_prf_t tls_prf,
423 const unsigned char randbytes[64],
424 mbedtls_ssl_protocol_version tls_version,
425 unsigned endpoint,
426 const mbedtls_ssl_context *ssl);
Jerry Yued14c932022-02-17 13:40:45 +0800427
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100428#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200429MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100430static int tls_prf_sha256(const unsigned char *secret, size_t slen,
Ron Eldor51d3ab52019-05-12 14:54:30 +0300431 const char *label,
432 const unsigned char *random, size_t rlen,
Gilles Peskine449bd832023-01-11 14:50:10 +0100433 unsigned char *dstbuf, size_t dlen);
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100434static int ssl_calc_verify_tls_sha256(const mbedtls_ssl_context *, unsigned char *, size_t *);
435static int ssl_calc_finished_tls_sha256(mbedtls_ssl_context *, unsigned char *, int);
Gilles Peskine449bd832023-01-11 14:50:10 +0100436
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100437#endif /* MBEDTLS_MD_CAN_SHA256*/
Gilles Peskine449bd832023-01-11 14:50:10 +0100438
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100439#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +0100440MBEDTLS_CHECK_RETURN_CRITICAL
441static int tls_prf_sha384(const unsigned char *secret, size_t slen,
442 const char *label,
443 const unsigned char *random, size_t rlen,
444 unsigned char *dstbuf, size_t dlen);
445
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100446static int ssl_calc_verify_tls_sha384(const mbedtls_ssl_context *, unsigned char *, size_t *);
447static int ssl_calc_finished_tls_sha384(mbedtls_ssl_context *, unsigned char *, int);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100448#endif /* MBEDTLS_MD_CAN_SHA384*/
Gilles Peskine449bd832023-01-11 14:50:10 +0100449
Gilles Peskine449bd832023-01-11 14:50:10 +0100450MBEDTLS_CHECK_RETURN_CRITICAL
451static int ssl_tls12_session_load(mbedtls_ssl_session *session,
452 const unsigned char *buf,
453 size_t len);
454#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
455
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100456static int ssl_update_checksum_start(mbedtls_ssl_context *, const unsigned char *, size_t);
Gilles Peskine449bd832023-01-11 14:50:10 +0100457
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100458#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100459static int ssl_update_checksum_sha256(mbedtls_ssl_context *, const unsigned char *, size_t);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100460#endif /* MBEDTLS_MD_CAN_SHA256*/
Gilles Peskine449bd832023-01-11 14:50:10 +0100461
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100462#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100463static int ssl_update_checksum_sha384(mbedtls_ssl_context *, const unsigned char *, size_t);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100464#endif /* MBEDTLS_MD_CAN_SHA384*/
Gilles Peskine449bd832023-01-11 14:50:10 +0100465
466int mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf,
467 const unsigned char *secret, size_t slen,
468 const char *label,
469 const unsigned char *random, size_t rlen,
470 unsigned char *dstbuf, size_t dlen)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300471{
472 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
473
Gilles Peskine449bd832023-01-11 14:50:10 +0100474 switch (prf) {
Ron Eldord2f25f72019-05-15 14:54:22 +0300475#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100476#if defined(MBEDTLS_MD_CAN_SHA384)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300477 case MBEDTLS_SSL_TLS_PRF_SHA384:
478 tls_prf = tls_prf_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +0100479 break;
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100480#endif /* MBEDTLS_MD_CAN_SHA384*/
481#if defined(MBEDTLS_MD_CAN_SHA256)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300482 case MBEDTLS_SSL_TLS_PRF_SHA256:
483 tls_prf = tls_prf_sha256;
Gilles Peskine449bd832023-01-11 14:50:10 +0100484 break;
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100485#endif /* MBEDTLS_MD_CAN_SHA256*/
Ron Eldord2f25f72019-05-15 14:54:22 +0300486#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100487 default:
488 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Ron Eldor51d3ab52019-05-12 14:54:30 +0300489 }
490
Gilles Peskine449bd832023-01-11 14:50:10 +0100491 return tls_prf(secret, slen, label, random, rlen, dstbuf, dlen);
Ron Eldor51d3ab52019-05-12 14:54:30 +0300492}
493
Jerry Yuc73c6182022-02-08 20:29:25 +0800494#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100495static void ssl_clear_peer_cert(mbedtls_ssl_session *session)
Jerry Yuc73c6182022-02-08 20:29:25 +0800496{
497#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100498 if (session->peer_cert != NULL) {
499 mbedtls_x509_crt_free(session->peer_cert);
500 mbedtls_free(session->peer_cert);
Jerry Yuc73c6182022-02-08 20:29:25 +0800501 session->peer_cert = NULL;
502 }
503#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +0100504 if (session->peer_cert_digest != NULL) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800505 /* Zeroization is not necessary. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100506 mbedtls_free(session->peer_cert_digest);
Jerry Yuc73c6182022-02-08 20:29:25 +0800507 session->peer_cert_digest = NULL;
508 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
509 session->peer_cert_digest_len = 0;
510 }
511#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
512}
513#endif /* MBEDTLS_X509_CRT_PARSE_C */
514
Gilles Peskine449bd832023-01-11 14:50:10 +0100515uint32_t mbedtls_ssl_get_extension_id(unsigned int extension_type)
Jerry Yu7a485c12022-10-31 13:08:18 +0800516{
Gilles Peskine449bd832023-01-11 14:50:10 +0100517 switch (extension_type) {
Jerry Yu7a485c12022-10-31 13:08:18 +0800518 case MBEDTLS_TLS_EXT_SERVERNAME:
Gilles Peskine449bd832023-01-11 14:50:10 +0100519 return MBEDTLS_SSL_EXT_ID_SERVERNAME;
Jerry Yu7a485c12022-10-31 13:08:18 +0800520
521 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100522 return MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800523
524 case MBEDTLS_TLS_EXT_STATUS_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100525 return MBEDTLS_SSL_EXT_ID_STATUS_REQUEST;
Jerry Yu7a485c12022-10-31 13:08:18 +0800526
527 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100528 return MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800529
530 case MBEDTLS_TLS_EXT_SIG_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100531 return MBEDTLS_SSL_EXT_ID_SIG_ALG;
Jerry Yu7a485c12022-10-31 13:08:18 +0800532
533 case MBEDTLS_TLS_EXT_USE_SRTP:
Gilles Peskine449bd832023-01-11 14:50:10 +0100534 return MBEDTLS_SSL_EXT_ID_USE_SRTP;
Jerry Yu7a485c12022-10-31 13:08:18 +0800535
536 case MBEDTLS_TLS_EXT_HEARTBEAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100537 return MBEDTLS_SSL_EXT_ID_HEARTBEAT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800538
539 case MBEDTLS_TLS_EXT_ALPN:
Gilles Peskine449bd832023-01-11 14:50:10 +0100540 return MBEDTLS_SSL_EXT_ID_ALPN;
Jerry Yu7a485c12022-10-31 13:08:18 +0800541
542 case MBEDTLS_TLS_EXT_SCT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100543 return MBEDTLS_SSL_EXT_ID_SCT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800544
545 case MBEDTLS_TLS_EXT_CLI_CERT_TYPE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100546 return MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800547
548 case MBEDTLS_TLS_EXT_SERV_CERT_TYPE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100549 return MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800550
551 case MBEDTLS_TLS_EXT_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100552 return MBEDTLS_SSL_EXT_ID_PADDING;
Jerry Yu7a485c12022-10-31 13:08:18 +0800553
554 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100555 return MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY;
Jerry Yu7a485c12022-10-31 13:08:18 +0800556
557 case MBEDTLS_TLS_EXT_EARLY_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100558 return MBEDTLS_SSL_EXT_ID_EARLY_DATA;
Jerry Yu7a485c12022-10-31 13:08:18 +0800559
560 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100561 return MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800562
563 case MBEDTLS_TLS_EXT_COOKIE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100564 return MBEDTLS_SSL_EXT_ID_COOKIE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800565
566 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100567 return MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES;
Jerry Yu7a485c12022-10-31 13:08:18 +0800568
569 case MBEDTLS_TLS_EXT_CERT_AUTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100570 return MBEDTLS_SSL_EXT_ID_CERT_AUTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800571
572 case MBEDTLS_TLS_EXT_OID_FILTERS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100573 return MBEDTLS_SSL_EXT_ID_OID_FILTERS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800574
575 case MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100576 return MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800577
578 case MBEDTLS_TLS_EXT_SIG_ALG_CERT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100579 return MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800580
581 case MBEDTLS_TLS_EXT_KEY_SHARE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100582 return MBEDTLS_SSL_EXT_ID_KEY_SHARE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800583
584 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
Gilles Peskine449bd832023-01-11 14:50:10 +0100585 return MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC;
Jerry Yu7a485c12022-10-31 13:08:18 +0800586
587 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100588 return MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800589
590 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
Gilles Peskine449bd832023-01-11 14:50:10 +0100591 return MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC;
Jerry Yu7a485c12022-10-31 13:08:18 +0800592
593 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100594 return MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET;
Jerry Yu7a485c12022-10-31 13:08:18 +0800595
Jan Bruckner151f6422023-02-10 12:45:19 +0100596 case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
597 return MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT;
598
Jerry Yu7a485c12022-10-31 13:08:18 +0800599 case MBEDTLS_TLS_EXT_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100600 return MBEDTLS_SSL_EXT_ID_SESSION_TICKET;
Jerry Yu7a485c12022-10-31 13:08:18 +0800601
602 }
603
Gilles Peskine449bd832023-01-11 14:50:10 +0100604 return MBEDTLS_SSL_EXT_ID_UNRECOGNIZED;
Jerry Yu7a485c12022-10-31 13:08:18 +0800605}
606
Gilles Peskine449bd832023-01-11 14:50:10 +0100607uint32_t mbedtls_ssl_get_extension_mask(unsigned int extension_type)
Jerry Yu7a485c12022-10-31 13:08:18 +0800608{
Gilles Peskine449bd832023-01-11 14:50:10 +0100609 return 1 << mbedtls_ssl_get_extension_id(extension_type);
Jerry Yu7a485c12022-10-31 13:08:18 +0800610}
611
Jerry Yud25cab02022-10-31 12:48:30 +0800612#if defined(MBEDTLS_DEBUG_C)
613static const char *extension_name_table[] = {
Jerry Yuea52ed92022-11-08 21:01:17 +0800614 [MBEDTLS_SSL_EXT_ID_UNRECOGNIZED] = "unrecognized",
Jerry Yud25cab02022-10-31 12:48:30 +0800615 [MBEDTLS_SSL_EXT_ID_SERVERNAME] = "server_name",
616 [MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH] = "max_fragment_length",
617 [MBEDTLS_SSL_EXT_ID_STATUS_REQUEST] = "status_request",
618 [MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS] = "supported_groups",
619 [MBEDTLS_SSL_EXT_ID_SIG_ALG] = "signature_algorithms",
620 [MBEDTLS_SSL_EXT_ID_USE_SRTP] = "use_srtp",
621 [MBEDTLS_SSL_EXT_ID_HEARTBEAT] = "heartbeat",
622 [MBEDTLS_SSL_EXT_ID_ALPN] = "application_layer_protocol_negotiation",
623 [MBEDTLS_SSL_EXT_ID_SCT] = "signed_certificate_timestamp",
624 [MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE] = "client_certificate_type",
625 [MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE] = "server_certificate_type",
626 [MBEDTLS_SSL_EXT_ID_PADDING] = "padding",
627 [MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY] = "pre_shared_key",
628 [MBEDTLS_SSL_EXT_ID_EARLY_DATA] = "early_data",
629 [MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS] = "supported_versions",
630 [MBEDTLS_SSL_EXT_ID_COOKIE] = "cookie",
631 [MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES] = "psk_key_exchange_modes",
632 [MBEDTLS_SSL_EXT_ID_CERT_AUTH] = "certificate_authorities",
633 [MBEDTLS_SSL_EXT_ID_OID_FILTERS] = "oid_filters",
634 [MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH] = "post_handshake_auth",
635 [MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT] = "signature_algorithms_cert",
636 [MBEDTLS_SSL_EXT_ID_KEY_SHARE] = "key_share",
637 [MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC] = "truncated_hmac",
638 [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = "supported_point_formats",
639 [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = "encrypt_then_mac",
640 [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = "extended_master_secret",
Jan Bruckner151f6422023-02-10 12:45:19 +0100641 [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = "session_ticket",
642 [MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT] = "record_size_limit"
Jerry Yud25cab02022-10-31 12:48:30 +0800643};
644
Chien Wong4e9683e2023-12-28 17:07:43 +0800645static const unsigned int extension_type_table[] = {
Jerry Yud25cab02022-10-31 12:48:30 +0800646 [MBEDTLS_SSL_EXT_ID_UNRECOGNIZED] = 0xff,
647 [MBEDTLS_SSL_EXT_ID_SERVERNAME] = MBEDTLS_TLS_EXT_SERVERNAME,
648 [MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH] = MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH,
649 [MBEDTLS_SSL_EXT_ID_STATUS_REQUEST] = MBEDTLS_TLS_EXT_STATUS_REQUEST,
650 [MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS] = MBEDTLS_TLS_EXT_SUPPORTED_GROUPS,
651 [MBEDTLS_SSL_EXT_ID_SIG_ALG] = MBEDTLS_TLS_EXT_SIG_ALG,
652 [MBEDTLS_SSL_EXT_ID_USE_SRTP] = MBEDTLS_TLS_EXT_USE_SRTP,
653 [MBEDTLS_SSL_EXT_ID_HEARTBEAT] = MBEDTLS_TLS_EXT_HEARTBEAT,
654 [MBEDTLS_SSL_EXT_ID_ALPN] = MBEDTLS_TLS_EXT_ALPN,
655 [MBEDTLS_SSL_EXT_ID_SCT] = MBEDTLS_TLS_EXT_SCT,
656 [MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE] = MBEDTLS_TLS_EXT_CLI_CERT_TYPE,
657 [MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE] = MBEDTLS_TLS_EXT_SERV_CERT_TYPE,
658 [MBEDTLS_SSL_EXT_ID_PADDING] = MBEDTLS_TLS_EXT_PADDING,
659 [MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY] = MBEDTLS_TLS_EXT_PRE_SHARED_KEY,
660 [MBEDTLS_SSL_EXT_ID_EARLY_DATA] = MBEDTLS_TLS_EXT_EARLY_DATA,
661 [MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS] = MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS,
662 [MBEDTLS_SSL_EXT_ID_COOKIE] = MBEDTLS_TLS_EXT_COOKIE,
663 [MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES] = MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES,
664 [MBEDTLS_SSL_EXT_ID_CERT_AUTH] = MBEDTLS_TLS_EXT_CERT_AUTH,
665 [MBEDTLS_SSL_EXT_ID_OID_FILTERS] = MBEDTLS_TLS_EXT_OID_FILTERS,
666 [MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH] = MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH,
667 [MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT] = MBEDTLS_TLS_EXT_SIG_ALG_CERT,
668 [MBEDTLS_SSL_EXT_ID_KEY_SHARE] = MBEDTLS_TLS_EXT_KEY_SHARE,
669 [MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC] = MBEDTLS_TLS_EXT_TRUNCATED_HMAC,
670 [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS,
671 [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC,
672 [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET,
Jan Bruckner151f6422023-02-10 12:45:19 +0100673 [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = MBEDTLS_TLS_EXT_SESSION_TICKET,
674 [MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT] = MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT
Jerry Yud25cab02022-10-31 12:48:30 +0800675};
676
Gilles Peskine449bd832023-01-11 14:50:10 +0100677const char *mbedtls_ssl_get_extension_name(unsigned int extension_type)
Jerry Yud25cab02022-10-31 12:48:30 +0800678{
Gilles Peskine449bd832023-01-11 14:50:10 +0100679 return extension_name_table[
680 mbedtls_ssl_get_extension_id(extension_type)];
Jerry Yud25cab02022-10-31 12:48:30 +0800681}
682
Gilles Peskine449bd832023-01-11 14:50:10 +0100683static const char *ssl_tls13_get_hs_msg_name(int hs_msg_type)
Jerry Yud25cab02022-10-31 12:48:30 +0800684{
Gilles Peskine449bd832023-01-11 14:50:10 +0100685 switch (hs_msg_type) {
Jerry Yud25cab02022-10-31 12:48:30 +0800686 case MBEDTLS_SSL_HS_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100687 return "ClientHello";
Jerry Yud25cab02022-10-31 12:48:30 +0800688 case MBEDTLS_SSL_HS_SERVER_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100689 return "ServerHello";
Jerry Yud25cab02022-10-31 12:48:30 +0800690 case MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100691 return "HelloRetryRequest";
Jerry Yud25cab02022-10-31 12:48:30 +0800692 case MBEDTLS_SSL_HS_NEW_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100693 return "NewSessionTicket";
Jerry Yud25cab02022-10-31 12:48:30 +0800694 case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100695 return "EncryptedExtensions";
Jerry Yud25cab02022-10-31 12:48:30 +0800696 case MBEDTLS_SSL_HS_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100697 return "Certificate";
Jerry Yud25cab02022-10-31 12:48:30 +0800698 case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100699 return "CertificateRequest";
Jerry Yud25cab02022-10-31 12:48:30 +0800700 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100701 return "Unknown";
Jerry Yud25cab02022-10-31 12:48:30 +0800702}
703
Gilles Peskine449bd832023-01-11 14:50:10 +0100704void mbedtls_ssl_print_extension(const mbedtls_ssl_context *ssl,
705 int level, const char *file, int line,
706 int hs_msg_type, unsigned int extension_type,
707 const char *extra_msg0, const char *extra_msg1)
Jerry Yud25cab02022-10-31 12:48:30 +0800708{
709 const char *extra_msg;
Gilles Peskine449bd832023-01-11 14:50:10 +0100710 if (extra_msg0 && extra_msg1) {
Jerry Yud25cab02022-10-31 12:48:30 +0800711 mbedtls_debug_print_msg(
712 ssl, level, file, line,
713 "%s: %s(%u) extension %s %s.",
Gilles Peskine449bd832023-01-11 14:50:10 +0100714 ssl_tls13_get_hs_msg_name(hs_msg_type),
715 mbedtls_ssl_get_extension_name(extension_type),
Jerry Yud25cab02022-10-31 12:48:30 +0800716 extension_type,
Gilles Peskine449bd832023-01-11 14:50:10 +0100717 extra_msg0, extra_msg1);
Jerry Yud25cab02022-10-31 12:48:30 +0800718 return;
719 }
720
721 extra_msg = extra_msg0 ? extra_msg0 : extra_msg1;
Gilles Peskine449bd832023-01-11 14:50:10 +0100722 if (extra_msg) {
Jerry Yud25cab02022-10-31 12:48:30 +0800723 mbedtls_debug_print_msg(
724 ssl, level, file, line,
Gilles Peskine449bd832023-01-11 14:50:10 +0100725 "%s: %s(%u) extension %s.", ssl_tls13_get_hs_msg_name(hs_msg_type),
726 mbedtls_ssl_get_extension_name(extension_type), extension_type,
727 extra_msg);
Jerry Yud25cab02022-10-31 12:48:30 +0800728 return;
729 }
730
731 mbedtls_debug_print_msg(
732 ssl, level, file, line,
Gilles Peskine449bd832023-01-11 14:50:10 +0100733 "%s: %s(%u) extension.", ssl_tls13_get_hs_msg_name(hs_msg_type),
734 mbedtls_ssl_get_extension_name(extension_type), extension_type);
Jerry Yud25cab02022-10-31 12:48:30 +0800735}
736
Gilles Peskine449bd832023-01-11 14:50:10 +0100737void mbedtls_ssl_print_extensions(const mbedtls_ssl_context *ssl,
738 int level, const char *file, int line,
739 int hs_msg_type, uint32_t extensions_mask,
740 const char *extra)
Jerry Yud25cab02022-10-31 12:48:30 +0800741{
742
Gilles Peskine449bd832023-01-11 14:50:10 +0100743 for (unsigned i = 0;
744 i < sizeof(extension_name_table) / sizeof(extension_name_table[0]);
745 i++) {
Jerry Yu79aa7212022-11-08 21:30:21 +0800746 mbedtls_ssl_print_extension(
Jerry Yuea52ed92022-11-08 21:01:17 +0800747 ssl, level, file, line, hs_msg_type, extension_type_table[i],
Gilles Peskine449bd832023-01-11 14:50:10 +0100748 extensions_mask & (1 << i) ? "exists" : "does not exist", extra);
Jerry Yud25cab02022-10-31 12:48:30 +0800749 }
750}
751
Pengyu Lvee455c02023-01-12 14:37:24 +0800752#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Pengyu Lvee455c02023-01-12 14:37:24 +0800753static const char *ticket_flag_name_table[] =
754{
755 [0] = "ALLOW_PSK_RESUMPTION",
756 [2] = "ALLOW_PSK_EPHEMERAL_RESUMPTION",
757 [3] = "ALLOW_EARLY_DATA",
758};
759
Pengyu Lv4938a562023-01-16 11:28:49 +0800760void mbedtls_ssl_print_ticket_flags(const mbedtls_ssl_context *ssl,
761 int level, const char *file, int line,
762 unsigned int flags)
Pengyu Lvee455c02023-01-12 14:37:24 +0800763{
764 size_t i;
765
766 mbedtls_debug_print_msg(ssl, level, file, line,
Pengyu Lv4938a562023-01-16 11:28:49 +0800767 "print ticket_flags (0x%02x)", flags);
768
769 flags = flags & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK;
Pengyu Lvee455c02023-01-12 14:37:24 +0800770
771 for (i = 0; i < ARRAY_LENGTH(ticket_flag_name_table); i++) {
Pengyu Lv4938a562023-01-16 11:28:49 +0800772 if ((flags & (1 << i))) {
Pengyu Lvee455c02023-01-12 14:37:24 +0800773 mbedtls_debug_print_msg(ssl, level, file, line, "- %s is set.",
774 ticket_flag_name_table[i]);
775 }
776 }
777}
778#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */
779
Jerry Yud25cab02022-10-31 12:48:30 +0800780#endif /* MBEDTLS_DEBUG_C */
781
Gilles Peskine449bd832023-01-11 14:50:10 +0100782void mbedtls_ssl_optimize_checksum(mbedtls_ssl_context *ssl,
783 const mbedtls_ssl_ciphersuite_t *ciphersuite_info)
Jerry Yuc73c6182022-02-08 20:29:25 +0800784{
785 ((void) ciphersuite_info);
786
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100787#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +0100788 if (ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800789 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +0100790 } else
Jerry Yuc73c6182022-02-08 20:29:25 +0800791#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100792#if defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +0100793 if (ciphersuite_info->mac != MBEDTLS_MD_SHA384) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800794 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
Gilles Peskine449bd832023-01-11 14:50:10 +0100795 } else
Jerry Yuc73c6182022-02-08 20:29:25 +0800796#endif
797 {
Gilles Peskine449bd832023-01-11 14:50:10 +0100798 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yuc73c6182022-02-08 20:29:25 +0800799 return;
800 }
801}
802
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100803int mbedtls_ssl_add_hs_hdr_to_checksum(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100804 unsigned hs_type,
805 size_t total_hs_len)
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100806{
807 unsigned char hs_hdr[4];
808
809 /* Build HS header for checksum update. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100810 hs_hdr[0] = MBEDTLS_BYTE_0(hs_type);
811 hs_hdr[1] = MBEDTLS_BYTE_2(total_hs_len);
812 hs_hdr[2] = MBEDTLS_BYTE_1(total_hs_len);
813 hs_hdr[3] = MBEDTLS_BYTE_0(total_hs_len);
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100814
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100815 return ssl->handshake->update_checksum(ssl, hs_hdr, sizeof(hs_hdr));
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100816}
817
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100818int mbedtls_ssl_add_hs_msg_to_checksum(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100819 unsigned hs_type,
820 unsigned char const *msg,
821 size_t msg_len)
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100822{
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100823 int ret;
824 ret = mbedtls_ssl_add_hs_hdr_to_checksum(ssl, hs_type, msg_len);
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100825 if (ret != 0) {
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100826 return ret;
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100827 }
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100828 return ssl->handshake->update_checksum(ssl, msg, msg_len);
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100829}
830
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100831int mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl)
Jerry Yuc73c6182022-02-08 20:29:25 +0800832{
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100833#if defined(MBEDTLS_MD_CAN_SHA256) || \
834 defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100835#if defined(MBEDTLS_USE_PSA_CRYPTO)
836 psa_status_t status;
837#else
838 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
839#endif
Manuel Pégourié-Gonnard626aaed2023-02-06 22:03:06 +0100840#else /* SHA-256 or SHA-384 */
Jerry Yuc73c6182022-02-08 20:29:25 +0800841 ((void) ssl);
Manuel Pégourié-Gonnard626aaed2023-02-06 22:03:06 +0100842#endif /* SHA-256 or SHA-384 */
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100843#if defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yuc73c6182022-02-08 20:29:25 +0800844#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100845 status = psa_hash_abort(&ssl->handshake->fin_sha256_psa);
846 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200847 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100848 }
849 status = psa_hash_setup(&ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256);
850 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200851 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100852 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800853#else
Manuel Pégourié-Gonnard947cee12023-03-06 11:59:59 +0100854 mbedtls_md_free(&ssl->handshake->fin_sha256);
855 mbedtls_md_init(&ssl->handshake->fin_sha256);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100856 ret = mbedtls_md_setup(&ssl->handshake->fin_sha256,
857 mbedtls_md_info_from_type(MBEDTLS_MD_SHA256),
858 0);
859 if (ret != 0) {
860 return ret;
861 }
862 ret = mbedtls_md_starts(&ssl->handshake->fin_sha256);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100863 if (ret != 0) {
864 return ret;
865 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800866#endif
867#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100868#if defined(MBEDTLS_MD_CAN_SHA384)
Jerry Yuc73c6182022-02-08 20:29:25 +0800869#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100870 status = psa_hash_abort(&ssl->handshake->fin_sha384_psa);
871 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200872 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100873 }
874 status = psa_hash_setup(&ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384);
875 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200876 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100877 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800878#else
Manuel Pégourié-Gonnard947cee12023-03-06 11:59:59 +0100879 mbedtls_md_free(&ssl->handshake->fin_sha384);
880 mbedtls_md_init(&ssl->handshake->fin_sha384);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100881 ret = mbedtls_md_setup(&ssl->handshake->fin_sha384,
882 mbedtls_md_info_from_type(MBEDTLS_MD_SHA384), 0);
883 if (ret != 0) {
884 return ret;
885 }
886 ret = mbedtls_md_starts(&ssl->handshake->fin_sha384);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100887 if (ret != 0) {
888 return ret;
889 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800890#endif
891#endif
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100892 return 0;
Jerry Yuc73c6182022-02-08 20:29:25 +0800893}
894
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100895static int ssl_update_checksum_start(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100896 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800897{
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100898#if defined(MBEDTLS_MD_CAN_SHA256) || \
899 defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100900#if defined(MBEDTLS_USE_PSA_CRYPTO)
901 psa_status_t status;
902#else
903 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
904#endif
Manuel Pégourié-Gonnard626aaed2023-02-06 22:03:06 +0100905#else /* SHA-256 or SHA-384 */
906 ((void) ssl);
907 (void) buf;
908 (void) len;
909#endif /* SHA-256 or SHA-384 */
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100910#if defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yuc73c6182022-02-08 20:29:25 +0800911#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100912 status = psa_hash_update(&ssl->handshake->fin_sha256_psa, buf, len);
913 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200914 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100915 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800916#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100917 ret = mbedtls_md_update(&ssl->handshake->fin_sha256, buf, len);
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100918 if (ret != 0) {
919 return ret;
920 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800921#endif
922#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100923#if defined(MBEDTLS_MD_CAN_SHA384)
Jerry Yuc73c6182022-02-08 20:29:25 +0800924#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100925 status = psa_hash_update(&ssl->handshake->fin_sha384_psa, buf, len);
926 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200927 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100928 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800929#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100930 ret = mbedtls_md_update(&ssl->handshake->fin_sha384, buf, len);
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100931 if (ret != 0) {
932 return ret;
933 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800934#endif
935#endif
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100936 return 0;
Jerry Yuc73c6182022-02-08 20:29:25 +0800937}
938
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100939#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100940static int ssl_update_checksum_sha256(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100941 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800942{
943#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200944 return mbedtls_md_error_from_psa(psa_hash_update(
945 &ssl->handshake->fin_sha256_psa, buf, len));
Jerry Yuc73c6182022-02-08 20:29:25 +0800946#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100947 return mbedtls_md_update(&ssl->handshake->fin_sha256, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800948#endif
949}
950#endif
951
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100952#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100953static int ssl_update_checksum_sha384(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100954 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800955{
956#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200957 return mbedtls_md_error_from_psa(psa_hash_update(
958 &ssl->handshake->fin_sha384_psa, buf, len));
Jerry Yuc73c6182022-02-08 20:29:25 +0800959#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100960 return mbedtls_md_update(&ssl->handshake->fin_sha384, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800961#endif
962}
963#endif
964
Gilles Peskine449bd832023-01-11 14:50:10 +0100965static void ssl_handshake_params_init(mbedtls_ssl_handshake_params *handshake)
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200966{
Gilles Peskine449bd832023-01-11 14:50:10 +0100967 memset(handshake, 0, sizeof(mbedtls_ssl_handshake_params));
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200968
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100969#if defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500970#if defined(MBEDTLS_USE_PSA_CRYPTO)
971 handshake->fin_sha256_psa = psa_hash_operation_init();
Andrzej Kurekeb342242019-01-29 09:14:33 -0500972#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100973 mbedtls_md_init(&handshake->fin_sha256);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200974#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500975#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100976#if defined(MBEDTLS_MD_CAN_SHA384)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500977#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500978 handshake->fin_sha384_psa = psa_hash_operation_init();
Andrzej Kurekeb342242019-01-29 09:14:33 -0500979#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100980 mbedtls_md_init(&handshake->fin_sha384);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200981#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500982#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200983
984 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100985
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200986#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100987 mbedtls_dhm_init(&handshake->dhm_ctx);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200988#endif
Valerio Setti7aeec542023-07-05 18:57:21 +0200989#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
Valerio Setti6eb00542023-07-07 17:04:24 +0200990 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +0100991 mbedtls_ecdh_init(&handshake->ecdh_ctx);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200992#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200993#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +0200994#if defined(MBEDTLS_USE_PSA_CRYPTO)
995 handshake->psa_pake_ctx = psa_pake_operation_init();
996 handshake->psa_pake_password = MBEDTLS_SVC_KEY_ID_INIT;
997#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100998 mbedtls_ecjpake_init(&handshake->ecjpake_ctx);
Neil Armstrongca7d5062022-05-31 14:43:23 +0200999#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02001000#if defined(MBEDTLS_SSL_CLI_C)
1001 handshake->ecjpake_cache = NULL;
1002 handshake->ecjpake_cache_len = 0;
1003#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02001004#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001005
Gilles Peskineeccd8882020-03-10 12:19:08 +01001006#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001007 mbedtls_x509_crt_restart_init(&handshake->ecrs_ctx);
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02001008#endif
1009
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001010#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1011 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
1012#endif
Hanno Becker75173122019-02-06 16:18:31 +00001013
1014#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
1015 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01001016 mbedtls_pk_init(&handshake->peer_pubkey);
Hanno Becker75173122019-02-06 16:18:31 +00001017#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001018}
1019
Gilles Peskine449bd832023-01-11 14:50:10 +01001020void mbedtls_ssl_transform_init(mbedtls_ssl_transform *transform)
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001021{
Gilles Peskine449bd832023-01-11 14:50:10 +01001022 memset(transform, 0, sizeof(mbedtls_ssl_transform));
Paul Bakker84bbeb52014-07-01 14:53:22 +02001023
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +01001024#if defined(MBEDTLS_USE_PSA_CRYPTO)
1025 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
1026 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001027#else
Gilles Peskine449bd832023-01-11 14:50:10 +01001028 mbedtls_cipher_init(&transform->cipher_ctx_enc);
1029 mbedtls_cipher_init(&transform->cipher_ctx_dec);
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +01001030#endif
1031
Hanno Beckerfd86ca82020-11-30 08:54:23 +00001032#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +01001033#if defined(MBEDTLS_USE_PSA_CRYPTO)
1034 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
1035 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +01001036#else
Gilles Peskine449bd832023-01-11 14:50:10 +01001037 mbedtls_md_init(&transform->md_ctx_enc);
1038 mbedtls_md_init(&transform->md_ctx_dec);
Hanno Beckerd56ed242018-01-03 15:32:51 +00001039#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +01001040#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001041}
1042
Gilles Peskine449bd832023-01-11 14:50:10 +01001043void mbedtls_ssl_session_init(mbedtls_ssl_session *session)
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001044{
Gilles Peskine449bd832023-01-11 14:50:10 +01001045 memset(session, 0, sizeof(mbedtls_ssl_session));
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001046}
1047
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001048MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001049static int ssl_handshake_init(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +00001050{
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001051 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1052
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001053 /* Clear old handshake information if present */
Jerry Yu2e199812022-12-01 18:57:19 +08001054#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001055 if (ssl->transform_negotiate) {
1056 mbedtls_ssl_transform_free(ssl->transform_negotiate);
1057 }
Jerry Yu2e199812022-12-01 18:57:19 +08001058#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001059 if (ssl->session_negotiate) {
1060 mbedtls_ssl_session_free(ssl->session_negotiate);
1061 }
1062 if (ssl->handshake) {
1063 mbedtls_ssl_handshake_free(ssl);
1064 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001065
Jerry Yu2e199812022-12-01 18:57:19 +08001066#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001067 /*
1068 * Either the pointers are now NULL or cleared properly and can be freed.
1069 * Now allocate missing structures.
1070 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001071 if (ssl->transform_negotiate == NULL) {
1072 ssl->transform_negotiate = mbedtls_calloc(1, sizeof(mbedtls_ssl_transform));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001073 }
Jerry Yu2e199812022-12-01 18:57:19 +08001074#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48916f92012-09-16 19:57:18 +00001075
Gilles Peskine449bd832023-01-11 14:50:10 +01001076 if (ssl->session_negotiate == NULL) {
1077 ssl->session_negotiate = mbedtls_calloc(1, sizeof(mbedtls_ssl_session));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001078 }
Paul Bakker48916f92012-09-16 19:57:18 +00001079
Gilles Peskine449bd832023-01-11 14:50:10 +01001080 if (ssl->handshake == NULL) {
1081 ssl->handshake = mbedtls_calloc(1, sizeof(mbedtls_ssl_handshake_params));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001082 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05001083#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1084 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -04001085
Gilles Peskine449bd832023-01-11 14:50:10 +01001086 handle_buffer_resizing(ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
1087 MBEDTLS_SSL_OUT_BUFFER_LEN);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05001088#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001089
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001090 /* All pointers should exist and can be directly freed without issue */
Gilles Peskine449bd832023-01-11 14:50:10 +01001091 if (ssl->handshake == NULL ||
Jerry Yu2e199812022-12-01 18:57:19 +08001092#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker48916f92012-09-16 19:57:18 +00001093 ssl->transform_negotiate == NULL ||
Jerry Yu2e199812022-12-01 18:57:19 +08001094#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001095 ssl->session_negotiate == NULL) {
1096 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc() of ssl sub-contexts failed"));
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001097
Gilles Peskine449bd832023-01-11 14:50:10 +01001098 mbedtls_free(ssl->handshake);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001099 ssl->handshake = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08001100
1101#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001102 mbedtls_free(ssl->transform_negotiate);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001103 ssl->transform_negotiate = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08001104#endif
1105
Gilles Peskine449bd832023-01-11 14:50:10 +01001106 mbedtls_free(ssl->session_negotiate);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001107 ssl->session_negotiate = NULL;
1108
Gilles Peskine449bd832023-01-11 14:50:10 +01001109 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Paul Bakker48916f92012-09-16 19:57:18 +00001110 }
1111
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001112#if defined(MBEDTLS_SSL_EARLY_DATA)
1113#if defined(MBEDTLS_SSL_CLI_C)
Ronald Cron05d7cfb2024-03-03 15:39:30 +01001114 ssl->early_data_state = MBEDTLS_SSL_EARLY_DATA_STATE_IDLE;
Ronald Cron5d0ae902024-01-05 14:20:35 +01001115#endif
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001116#if defined(MBEDTLS_SSL_SRV_C)
1117 ssl->discard_early_data_record = MBEDTLS_SSL_EARLY_DATA_NO_DISCARD;
1118#endif
Ronald Cron19bfe0a2024-02-26 16:43:01 +01001119 ssl->total_early_data_size = 0;
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001120#endif /* MBEDTLS_SSL_EARLY_DATA */
Ronald Cron5d0ae902024-01-05 14:20:35 +01001121
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001122 /* Initialize structures */
Gilles Peskine449bd832023-01-11 14:50:10 +01001123 mbedtls_ssl_session_init(ssl->session_negotiate);
1124 ssl_handshake_params_init(ssl->handshake);
Paul Bakker968afaa2014-07-09 11:09:24 +02001125
Jerry Yu2e199812022-12-01 18:57:19 +08001126#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001127 mbedtls_ssl_transform_init(ssl->transform_negotiate);
Jerry Yu2e199812022-12-01 18:57:19 +08001128#endif
1129
Manuel Pégourié-Gonnard537f2312023-02-05 10:17:45 +01001130 /* Setup handshake checksums */
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001131 ret = mbedtls_ssl_reset_checksum(ssl);
1132 if (ret != 0) {
1133 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_checksum", ret);
1134 return ret;
1135 }
Manuel Pégourié-Gonnard537f2312023-02-05 10:17:45 +01001136
Jerry Yud0766ec2022-09-22 10:46:57 +08001137#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
1138 defined(MBEDTLS_SSL_SRV_C) && \
1139 defined(MBEDTLS_SSL_SESSION_TICKETS)
1140 ssl->handshake->new_session_tickets_count =
Gilles Peskine449bd832023-01-11 14:50:10 +01001141 ssl->conf->new_session_tickets_count;
Jerry Yud0766ec2022-09-22 10:46:57 +08001142#endif
1143
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001144#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01001145 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001146 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001147
Gilles Peskine449bd832023-01-11 14:50:10 +01001148 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001149 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Gilles Peskine449bd832023-01-11 14:50:10 +01001150 } else {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001151 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Gilles Peskine449bd832023-01-11 14:50:10 +01001152 }
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001153
Gilles Peskine449bd832023-01-11 14:50:10 +01001154 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001155 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001156#endif
1157
Brett Warrene0edc842021-08-17 09:53:13 +01001158/*
1159 * curve_list is translated to IANA TLS group identifiers here because
1160 * mbedtls_ssl_conf_curves returns void and so can't return
1161 * any error codes.
1162 */
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02001163#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01001164#if !defined(MBEDTLS_DEPRECATED_REMOVED)
1165 /* Heap allocate and translate curve_list from internal to IANA group ids */
Gilles Peskine449bd832023-01-11 14:50:10 +01001166 if (ssl->conf->curve_list != NULL) {
Brett Warrene0edc842021-08-17 09:53:13 +01001167 size_t length;
1168 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
1169
Thomas Daubney850a0792023-05-22 12:05:03 +01001170 for (length = 0; (curve_list[length] != MBEDTLS_ECP_DP_NONE); length++) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001171 }
Brett Warrene0edc842021-08-17 09:53:13 +01001172
1173 /* Leave room for zero termination */
Gilles Peskine449bd832023-01-11 14:50:10 +01001174 uint16_t *group_list = mbedtls_calloc(length + 1, sizeof(uint16_t));
1175 if (group_list == NULL) {
1176 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1177 }
Brett Warrene0edc842021-08-17 09:53:13 +01001178
Gilles Peskine449bd832023-01-11 14:50:10 +01001179 for (size_t i = 0; i < length; i++) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01001180 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
Gilles Peskine449bd832023-01-11 14:50:10 +01001181 curve_list[i]);
1182 if (tls_id == 0) {
1183 mbedtls_free(group_list);
1184 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Brett Warrene0edc842021-08-17 09:53:13 +01001185 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01001186 group_list[i] = tls_id;
Brett Warrene0edc842021-08-17 09:53:13 +01001187 }
1188
1189 group_list[length] = 0;
1190
1191 ssl->handshake->group_list = group_list;
1192 ssl->handshake->group_list_heap_allocated = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001193 } else {
Brett Warrene0edc842021-08-17 09:53:13 +01001194 ssl->handshake->group_list = ssl->conf->group_list;
1195 ssl->handshake->group_list_heap_allocated = 0;
1196 }
1197#endif /* MBEDTLS_DEPRECATED_REMOVED */
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02001198#endif /* MBEDTLS_ECP_C */
Brett Warrene0edc842021-08-17 09:53:13 +01001199
Ronald Crone68ab4f2022-10-05 12:46:29 +02001200#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08001201#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +08001202#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +08001203 /* Heap allocate and translate sig_hashes from internal hash identifiers to
1204 signature algorithms IANA identifiers. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001205 if (mbedtls_ssl_conf_is_tls12_only(ssl->conf) &&
1206 ssl->conf->sig_hashes != NULL) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001207 const int *md;
1208 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +08001209 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +08001210 uint16_t *p;
1211
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001212 MBEDTLS_STATIC_ASSERT(MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
1213 <= (SIZE_MAX - (2 * sizeof(uint16_t))),
1214 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big");
Jerry Yua68dca22022-01-20 16:28:27 +08001215
Gilles Peskine449bd832023-01-11 14:50:10 +01001216 for (md = sig_hashes; *md != MBEDTLS_MD_NONE; md++) {
1217 if (mbedtls_ssl_hash_from_md_alg(*md) == MBEDTLS_SSL_HASH_NONE) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001218 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001219 }
Valerio Settie9646ec2023-08-02 20:02:28 +02001220#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001221 sig_algs_len += sizeof(uint16_t);
Jerry Yub476a442022-01-21 18:14:45 +08001222#endif
Jerry Yua68dca22022-01-20 16:28:27 +08001223
Jerry Yub476a442022-01-21 18:14:45 +08001224#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001225 sig_algs_len += sizeof(uint16_t);
Jerry Yub476a442022-01-21 18:14:45 +08001226#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001227 if (sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN) {
1228 return MBEDTLS_ERR_SSL_BAD_CONFIG;
1229 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001230 }
1231
Gilles Peskine449bd832023-01-11 14:50:10 +01001232 if (sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN) {
1233 return MBEDTLS_ERR_SSL_BAD_CONFIG;
1234 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001235
Gilles Peskine449bd832023-01-11 14:50:10 +01001236 ssl->handshake->sig_algs = mbedtls_calloc(1, sig_algs_len +
1237 sizeof(uint16_t));
1238 if (ssl->handshake->sig_algs == NULL) {
1239 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1240 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001241
Gilles Peskine449bd832023-01-11 14:50:10 +01001242 p = (uint16_t *) ssl->handshake->sig_algs;
1243 for (md = sig_hashes; *md != MBEDTLS_MD_NONE; md++) {
1244 unsigned char hash = mbedtls_ssl_hash_from_md_alg(*md);
1245 if (hash == MBEDTLS_SSL_HASH_NONE) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001246 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001247 }
Valerio Settie9646ec2023-08-02 20:02:28 +02001248#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001249 *p = ((hash << 8) | MBEDTLS_SSL_SIG_ECDSA);
Jerry Yuf017ee42022-01-12 15:49:48 +08001250 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001251#endif
1252#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001253 *p = ((hash << 8) | MBEDTLS_SSL_SIG_RSA);
Jerry Yuf017ee42022-01-12 15:49:48 +08001254 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001255#endif
Jerry Yuf017ee42022-01-12 15:49:48 +08001256 }
Gabor Mezei15b95a62022-05-09 16:37:58 +02001257 *p = MBEDTLS_TLS_SIG_NONE;
Jerry Yuf017ee42022-01-12 15:49:48 +08001258 ssl->handshake->sig_algs_heap_allocated = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001259 } else
Jerry Yua69269a2022-01-17 21:06:01 +08001260#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +08001261 {
Jerry Yuf017ee42022-01-12 15:49:48 +08001262 ssl->handshake->sig_algs_heap_allocated = 0;
1263 }
Jerry Yucc539102022-06-27 16:27:35 +08001264#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Ronald Crone68ab4f2022-10-05 12:46:29 +02001265#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Gilles Peskine449bd832023-01-11 14:50:10 +01001266 return 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001267}
1268
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001269#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001270/* Dummy cookie callbacks for defaults */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001271MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001272static int ssl_cookie_write_dummy(void *ctx,
1273 unsigned char **p, unsigned char *end,
1274 const unsigned char *cli_id, size_t cli_id_len)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001275{
1276 ((void) ctx);
1277 ((void) p);
1278 ((void) end);
1279 ((void) cli_id);
1280 ((void) cli_id_len);
1281
Gilles Peskine449bd832023-01-11 14:50:10 +01001282 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001283}
1284
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001285MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001286static int ssl_cookie_check_dummy(void *ctx,
1287 const unsigned char *cookie, size_t cookie_len,
1288 const unsigned char *cli_id, size_t cli_id_len)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001289{
1290 ((void) ctx);
1291 ((void) cookie);
1292 ((void) cookie_len);
1293 ((void) cli_id);
1294 ((void) cli_id_len);
1295
Gilles Peskine449bd832023-01-11 14:50:10 +01001296 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001297}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001298#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001299
Paul Bakker5121ce52009-01-03 21:22:43 +00001300/*
1301 * Initialize an SSL context
1302 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001303void mbedtls_ssl_init(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001304{
Gilles Peskine449bd832023-01-11 14:50:10 +01001305 memset(ssl, 0, sizeof(mbedtls_ssl_context));
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001306}
1307
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001308MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001309static int ssl_conf_version_check(const mbedtls_ssl_context *ssl)
Jerry Yu60835a82021-08-04 10:13:52 +08001310{
Ronald Cron086ee0b2022-03-15 15:18:51 +01001311 const mbedtls_ssl_config *conf = ssl->conf;
1312
Ronald Cron6f135e12021-12-08 16:57:54 +01001313#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001314 if (mbedtls_ssl_conf_is_tls13_only(conf)) {
1315 if (conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1316 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS 1.3 is not yet supported."));
1317 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQianed582dd2022-04-13 08:21:05 +00001318 }
1319
Gilles Peskine449bd832023-01-11 14:50:10 +01001320 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is tls13 only."));
1321 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001322 }
1323#endif
1324
1325#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001326 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
1327 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is tls12 only."));
1328 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001329 }
1330#endif
1331
Ronald Cron6f135e12021-12-08 16:57:54 +01001332#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001333 if (mbedtls_ssl_conf_is_hybrid_tls12_tls13(conf)) {
1334 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1335 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2"));
1336 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQianed582dd2022-04-13 08:21:05 +00001337 }
1338
Gilles Peskine449bd832023-01-11 14:50:10 +01001339 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is TLS 1.3 or TLS 1.2."));
1340 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001341 }
1342#endif
1343
Gilles Peskine449bd832023-01-11 14:50:10 +01001344 MBEDTLS_SSL_DEBUG_MSG(1, ("The SSL configuration is invalid."));
1345 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Jerry Yu60835a82021-08-04 10:13:52 +08001346}
1347
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001348MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +08001349static int ssl_conf_check(const mbedtls_ssl_context *ssl)
1350{
1351 int ret;
Gilles Peskine449bd832023-01-11 14:50:10 +01001352 ret = ssl_conf_version_check(ssl);
1353 if (ret != 0) {
1354 return ret;
1355 }
Jerry Yu60835a82021-08-04 10:13:52 +08001356
Jerry Yudef7ae42022-10-30 14:13:19 +08001357#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1358 /* RFC 8446 section 4.4.3
1359 *
1360 * If the verification fails, the receiver MUST terminate the handshake with
1361 * a "decrypt_error" alert.
1362 *
1363 * If the client is configured as TLS 1.3 only with optional verify, return
1364 * bad config.
1365 *
1366 */
Pengyu Lv0a1ff2b2023-11-14 11:03:32 +08001367 if (mbedtls_ssl_conf_tls13_is_ephemeral_enabled(
Gilles Peskine449bd832023-01-11 14:50:10 +01001368 (mbedtls_ssl_context *) ssl) &&
Jerry Yudef7ae42022-10-30 14:13:19 +08001369 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
1370 ssl->conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
1371 ssl->conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
Gilles Peskine449bd832023-01-11 14:50:10 +01001372 ssl->conf->authmode == MBEDTLS_SSL_VERIFY_OPTIONAL) {
Jerry Yudef7ae42022-10-30 14:13:19 +08001373 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01001374 1, ("Optional verify auth mode "
1375 "is not available for TLS 1.3 client"));
1376 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Jerry Yudef7ae42022-10-30 14:13:19 +08001377 }
1378#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1379
Yanray Wangb422cab2023-12-01 16:18:10 +08001380 if (ssl->conf->f_rng == NULL) {
1381 MBEDTLS_SSL_DEBUG_MSG(1, ("no RNG provided"));
1382 return MBEDTLS_ERR_SSL_NO_RNG;
1383 }
1384
Jerry Yu60835a82021-08-04 10:13:52 +08001385 /* Space for further checks */
1386
Gilles Peskine449bd832023-01-11 14:50:10 +01001387 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001388}
1389
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001390/*
1391 * Setup an SSL context
1392 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01001393
Gilles Peskine449bd832023-01-11 14:50:10 +01001394int mbedtls_ssl_setup(mbedtls_ssl_context *ssl,
1395 const mbedtls_ssl_config *conf)
Paul Bakker5121ce52009-01-03 21:22:43 +00001396{
Janos Follath865b3eb2019-12-16 11:46:15 +00001397 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +00001398 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1399 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00001400
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001401 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00001402
Gilles Peskine449bd832023-01-11 14:50:10 +01001403 if ((ret = ssl_conf_check(ssl)) != 0) {
1404 return ret;
1405 }
Ronald Cron8a12aee2023-03-08 15:30:43 +01001406 ssl->tls_version = ssl->conf->max_tls_version;
Jerry Yu60835a82021-08-04 10:13:52 +08001407
Paul Bakker62f2dee2012-09-28 07:31:51 +00001408 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01001409 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00001410 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02001411
1412 /* Set to NULL in case of an error condition */
1413 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02001414
Darryl Greenb33cc762019-11-28 14:29:44 +00001415#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1416 ssl->in_buf_len = in_buf_len;
1417#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001418 ssl->in_buf = mbedtls_calloc(1, in_buf_len);
1419 if (ssl->in_buf == NULL) {
1420 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len));
k-stachowiak9f7798e2018-07-31 16:52:32 +02001421 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001422 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10001423 }
1424
Darryl Greenb33cc762019-11-28 14:29:44 +00001425#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1426 ssl->out_buf_len = out_buf_len;
1427#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001428 ssl->out_buf = mbedtls_calloc(1, out_buf_len);
1429 if (ssl->out_buf == NULL) {
1430 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len));
k-stachowiak9f7798e2018-07-31 16:52:32 +02001431 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001432 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001433 }
1434
Gilles Peskine449bd832023-01-11 14:50:10 +01001435 mbedtls_ssl_reset_in_out_pointers(ssl);
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001436
Johan Pascalb62bb512015-12-03 21:56:45 +01001437#if defined(MBEDTLS_SSL_DTLS_SRTP)
Gilles Peskine449bd832023-01-11 14:50:10 +01001438 memset(&ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info));
Johan Pascalb62bb512015-12-03 21:56:45 +01001439#endif
1440
Gilles Peskine449bd832023-01-11 14:50:10 +01001441 if ((ret = ssl_handshake_init(ssl)) != 0) {
k-stachowiaka47911c2018-07-04 17:41:58 +02001442 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +01001443 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001444
Gilles Peskine449bd832023-01-11 14:50:10 +01001445 return 0;
k-stachowiaka47911c2018-07-04 17:41:58 +02001446
1447error:
Gilles Peskine449bd832023-01-11 14:50:10 +01001448 mbedtls_free(ssl->in_buf);
1449 mbedtls_free(ssl->out_buf);
k-stachowiaka47911c2018-07-04 17:41:58 +02001450
1451 ssl->conf = NULL;
1452
Darryl Greenb33cc762019-11-28 14:29:44 +00001453#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1454 ssl->in_buf_len = 0;
1455 ssl->out_buf_len = 0;
1456#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001457 ssl->in_buf = NULL;
1458 ssl->out_buf = NULL;
1459
1460 ssl->in_hdr = NULL;
1461 ssl->in_ctr = NULL;
1462 ssl->in_len = NULL;
1463 ssl->in_iv = NULL;
1464 ssl->in_msg = NULL;
1465
1466 ssl->out_hdr = NULL;
1467 ssl->out_ctr = NULL;
1468 ssl->out_len = NULL;
1469 ssl->out_iv = NULL;
1470 ssl->out_msg = NULL;
1471
Gilles Peskine449bd832023-01-11 14:50:10 +01001472 return ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00001473}
1474
1475/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001476 * Reset an initialized and used SSL context for re-use while retaining
1477 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001478 *
1479 * If partial is non-zero, keep data in the input buffer and client ID.
1480 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001481 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001482void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl,
1483 int partial)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001484{
Darryl Greenb33cc762019-11-28 14:29:44 +00001485#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1486 size_t in_buf_len = ssl->in_buf_len;
1487 size_t out_buf_len = ssl->out_buf_len;
1488#else
1489 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1490 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1491#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001492
Hanno Beckerb0302c42021-08-03 09:39:42 +01001493#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1494 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001495#endif
1496
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001497 /* Cancel any possibly running timer */
Gilles Peskine449bd832023-01-11 14:50:10 +01001498 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001499
Gilles Peskine449bd832023-01-11 14:50:10 +01001500 mbedtls_ssl_reset_in_out_pointers(ssl);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001501
1502 /* Reset incoming message parsing */
1503 ssl->in_offt = NULL;
1504 ssl->nb_zero = 0;
1505 ssl->in_msgtype = 0;
1506 ssl->in_msglen = 0;
1507 ssl->in_hslen = 0;
1508 ssl->keep_current_message = 0;
1509 ssl->transform_in = NULL;
1510
1511#if defined(MBEDTLS_SSL_PROTO_DTLS)
1512 ssl->next_record_offset = 0;
1513 ssl->in_epoch = 0;
1514#endif
1515
1516 /* Keep current datagram if partial == 1 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001517 if (partial == 0) {
Hanno Beckerb0302c42021-08-03 09:39:42 +01001518 ssl->in_left = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001519 memset(ssl->in_buf, 0, in_buf_len);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001520 }
1521
Ronald Cronad8c17b2022-06-10 17:18:09 +02001522 ssl->send_alert = 0;
1523
Hanno Beckerb0302c42021-08-03 09:39:42 +01001524 /* Reset outgoing message writing */
1525 ssl->out_msgtype = 0;
1526 ssl->out_msglen = 0;
1527 ssl->out_left = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001528 memset(ssl->out_buf, 0, out_buf_len);
1529 memset(ssl->cur_out_ctr, 0, sizeof(ssl->cur_out_ctr));
Hanno Beckerb0302c42021-08-03 09:39:42 +01001530 ssl->transform_out = NULL;
1531
1532#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01001533 mbedtls_ssl_dtls_replay_reset(ssl);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001534#endif
1535
XiaokangQian2b01dc32022-01-21 02:53:13 +00001536#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001537 if (ssl->transform) {
1538 mbedtls_ssl_transform_free(ssl->transform);
1539 mbedtls_free(ssl->transform);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001540 ssl->transform = NULL;
1541 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001542#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1543
XiaokangQian2b01dc32022-01-21 02:53:13 +00001544#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001545 mbedtls_ssl_transform_free(ssl->transform_application);
1546 mbedtls_free(ssl->transform_application);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001547 ssl->transform_application = NULL;
1548
Gilles Peskine449bd832023-01-11 14:50:10 +01001549 if (ssl->handshake != NULL) {
Jerry Yu3d9b5902022-11-04 14:07:25 +08001550#if defined(MBEDTLS_SSL_EARLY_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01001551 mbedtls_ssl_transform_free(ssl->handshake->transform_earlydata);
1552 mbedtls_free(ssl->handshake->transform_earlydata);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001553 ssl->handshake->transform_earlydata = NULL;
Jerry Yu3d9b5902022-11-04 14:07:25 +08001554#endif
XiaokangQian2b01dc32022-01-21 02:53:13 +00001555
Gilles Peskine449bd832023-01-11 14:50:10 +01001556 mbedtls_ssl_transform_free(ssl->handshake->transform_handshake);
1557 mbedtls_free(ssl->handshake->transform_handshake);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001558 ssl->handshake->transform_handshake = NULL;
1559 }
1560
XiaokangQian2b01dc32022-01-21 02:53:13 +00001561#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001562}
1563
Gilles Peskine449bd832023-01-11 14:50:10 +01001564int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001565{
1566 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1567
1568 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Ronald Cron195c0bc2024-02-08 08:51:20 +01001569 ssl->tls_version = ssl->conf->max_tls_version;
Hanno Beckerb0302c42021-08-03 09:39:42 +01001570
Gilles Peskine449bd832023-01-11 14:50:10 +01001571 mbedtls_ssl_session_reset_msg_layer(ssl, partial);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001572
1573 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001574#if defined(MBEDTLS_SSL_RENEGOTIATION)
1575 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001576 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001577
1578 ssl->verify_data_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001579 memset(ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN);
1580 memset(ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN);
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001581#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001582 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001583
Hanno Beckerb0302c42021-08-03 09:39:42 +01001584 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001585 ssl->session_out = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001586 if (ssl->session) {
1587 mbedtls_ssl_session_free(ssl->session);
1588 mbedtls_free(ssl->session);
Paul Bakkerc0463502013-02-14 11:19:38 +01001589 ssl->session = NULL;
1590 }
1591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001592#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001593 ssl->alpn_chosen = NULL;
1594#endif
1595
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001596#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
David Horstmann3b2276a2022-10-06 14:49:08 +01001597 int free_cli_id = 1;
Hanno Becker4ccbf062018-08-10 11:20:38 +01001598#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Gilles Peskine449bd832023-01-11 14:50:10 +01001599 free_cli_id = (partial == 0);
Hanno Becker4ccbf062018-08-10 11:20:38 +01001600#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001601 if (free_cli_id) {
1602 mbedtls_free(ssl->cli_id);
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001603 ssl->cli_id = NULL;
1604 ssl->cli_id_len = 0;
1605 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001606#endif
1607
Gilles Peskine449bd832023-01-11 14:50:10 +01001608 if ((ret = ssl_handshake_init(ssl)) != 0) {
1609 return ret;
1610 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001611
Gilles Peskine449bd832023-01-11 14:50:10 +01001612 return 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00001613}
1614
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001615/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001616 * Reset an initialized and used SSL context for re-use while retaining
1617 * all application-set variables, function pointers and data.
1618 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001619int mbedtls_ssl_session_reset(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001620{
Gilles Peskine449bd832023-01-11 14:50:10 +01001621 return mbedtls_ssl_session_reset_int(ssl, 0);
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001622}
1623
1624/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001625 * SSL set accessors
1626 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001627void mbedtls_ssl_conf_endpoint(mbedtls_ssl_config *conf, int endpoint)
Paul Bakker5121ce52009-01-03 21:22:43 +00001628{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001629 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001630}
1631
Gilles Peskine449bd832023-01-11 14:50:10 +01001632void mbedtls_ssl_conf_transport(mbedtls_ssl_config *conf, int transport)
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001633{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001634 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001635}
1636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001637#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01001638void mbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config *conf, char mode)
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001639{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001640 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001641}
1642#endif
1643
Gilles Peskine449bd832023-01-11 14:50:10 +01001644void mbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config *conf, unsigned limit)
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001645{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001646 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001647}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001649#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001650
Gilles Peskine449bd832023-01-11 14:50:10 +01001651void mbedtls_ssl_set_datagram_packing(mbedtls_ssl_context *ssl,
1652 unsigned allow_packing)
Hanno Becker04da1892018-08-14 13:22:10 +01001653{
1654 ssl->disable_datagram_packing = !allow_packing;
1655}
1656
Gilles Peskine449bd832023-01-11 14:50:10 +01001657void mbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config *conf,
1658 uint32_t min, uint32_t max)
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001659{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001660 conf->hs_timeout_min = min;
1661 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001662}
1663#endif
1664
Gilles Peskine449bd832023-01-11 14:50:10 +01001665void mbedtls_ssl_conf_authmode(mbedtls_ssl_config *conf, int authmode)
Paul Bakker5121ce52009-01-03 21:22:43 +00001666{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001667 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001668}
1669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001670#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001671void mbedtls_ssl_conf_verify(mbedtls_ssl_config *conf,
1672 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1673 void *p_vrfy)
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001674{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001675 conf->f_vrfy = f_vrfy;
1676 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001677}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001678#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001679
Gilles Peskine449bd832023-01-11 14:50:10 +01001680void mbedtls_ssl_conf_rng(mbedtls_ssl_config *conf,
1681 int (*f_rng)(void *, unsigned char *, size_t),
1682 void *p_rng)
Paul Bakker5121ce52009-01-03 21:22:43 +00001683{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001684 conf->f_rng = f_rng;
1685 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001686}
1687
Gilles Peskine449bd832023-01-11 14:50:10 +01001688void mbedtls_ssl_conf_dbg(mbedtls_ssl_config *conf,
1689 void (*f_dbg)(void *, int, const char *, int, const char *),
1690 void *p_dbg)
Paul Bakker5121ce52009-01-03 21:22:43 +00001691{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001692 conf->f_dbg = f_dbg;
1693 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001694}
1695
Gilles Peskine449bd832023-01-11 14:50:10 +01001696void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl,
1697 void *p_bio,
1698 mbedtls_ssl_send_t *f_send,
1699 mbedtls_ssl_recv_t *f_recv,
1700 mbedtls_ssl_recv_timeout_t *f_recv_timeout)
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001701{
1702 ssl->p_bio = p_bio;
1703 ssl->f_send = f_send;
1704 ssl->f_recv = f_recv;
1705 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001706}
1707
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001708#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01001709void mbedtls_ssl_set_mtu(mbedtls_ssl_context *ssl, uint16_t mtu)
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001710{
1711 ssl->mtu = mtu;
1712}
1713#endif
1714
Gilles Peskine449bd832023-01-11 14:50:10 +01001715void mbedtls_ssl_conf_read_timeout(mbedtls_ssl_config *conf, uint32_t timeout)
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001716{
1717 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001718}
1719
Gilles Peskine449bd832023-01-11 14:50:10 +01001720void mbedtls_ssl_set_timer_cb(mbedtls_ssl_context *ssl,
1721 void *p_timer,
1722 mbedtls_ssl_set_timer_t *f_set_timer,
1723 mbedtls_ssl_get_timer_t *f_get_timer)
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001724{
1725 ssl->p_timer = p_timer;
1726 ssl->f_set_timer = f_set_timer;
1727 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001728
1729 /* Make sure we start with no timer running */
Gilles Peskine449bd832023-01-11 14:50:10 +01001730 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001731}
1732
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001733#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001734void mbedtls_ssl_conf_session_cache(mbedtls_ssl_config *conf,
1735 void *p_cache,
1736 mbedtls_ssl_cache_get_t *f_get_cache,
1737 mbedtls_ssl_cache_set_t *f_set_cache)
Paul Bakker5121ce52009-01-03 21:22:43 +00001738{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001739 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001740 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001741 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001742}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001743#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001744
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001745#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001746int mbedtls_ssl_set_session(mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session)
Paul Bakker5121ce52009-01-03 21:22:43 +00001747{
Janos Follath865b3eb2019-12-16 11:46:15 +00001748 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001749
Gilles Peskine449bd832023-01-11 14:50:10 +01001750 if (ssl == NULL ||
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001751 session == NULL ||
1752 ssl->session_negotiate == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01001753 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT) {
1754 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001755 }
1756
Gilles Peskine449bd832023-01-11 14:50:10 +01001757 if (ssl->handshake->resume == 1) {
1758 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1759 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01001760
Jerry Yu21092062022-10-10 21:21:31 +08001761#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001762 if (session->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Jerry Yu21092062022-10-10 21:21:31 +08001763 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01001764 mbedtls_ssl_ciphersuite_from_id(session->ciphersuite);
Jerry Yu21092062022-10-10 21:21:31 +08001765
Gilles Peskine449bd832023-01-11 14:50:10 +01001766 if (mbedtls_ssl_validate_ciphersuite(
Jerry Yu21092062022-10-10 21:21:31 +08001767 ssl, ciphersuite_info, MBEDTLS_SSL_VERSION_TLS1_3,
Gilles Peskine449bd832023-01-11 14:50:10 +01001768 MBEDTLS_SSL_VERSION_TLS1_3) != 0) {
1769 MBEDTLS_SSL_DEBUG_MSG(4, ("%d is not a valid TLS 1.3 ciphersuite.",
1770 session->ciphersuite));
1771 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu21092062022-10-10 21:21:31 +08001772 }
Jerry Yu40afab62022-10-08 10:42:13 +08001773 }
Jerry Yu21092062022-10-10 21:21:31 +08001774#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu40afab62022-10-08 10:42:13 +08001775
Gilles Peskine449bd832023-01-11 14:50:10 +01001776 if ((ret = mbedtls_ssl_session_copy(ssl->session_negotiate,
1777 session)) != 0) {
1778 return ret;
1779 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001780
Paul Bakker0a597072012-09-25 21:55:46 +00001781 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001782
Gilles Peskine449bd832023-01-11 14:50:10 +01001783 return 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001784}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001785#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001786
Gilles Peskine449bd832023-01-11 14:50:10 +01001787void mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config *conf,
1788 const int *ciphersuites)
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001789{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001790 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001791}
1792
Ronald Cron6f135e12021-12-08 16:57:54 +01001793#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001794void mbedtls_ssl_conf_tls13_key_exchange_modes(mbedtls_ssl_config *conf,
1795 const int kex_modes)
Hanno Becker71f1ed62021-07-24 06:01:47 +01001796{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001797 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001798}
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001799
1800#if defined(MBEDTLS_SSL_EARLY_DATA)
Yanray Wangd5ed36f2023-11-07 11:40:43 +08001801void mbedtls_ssl_conf_early_data(mbedtls_ssl_config *conf,
1802 int early_data_enabled)
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001803{
1804 conf->early_data_enabled = early_data_enabled;
1805}
Jerry Yucc4e0072022-11-22 17:22:22 +08001806
1807#if defined(MBEDTLS_SSL_SRV_C)
Yanray Wang07517612023-11-07 11:47:36 +08001808void mbedtls_ssl_conf_max_early_data_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01001809 mbedtls_ssl_config *conf, uint32_t max_early_data_size)
Jerry Yucc4e0072022-11-22 17:22:22 +08001810{
Jerry Yu39da9852022-12-06 16:58:36 +08001811 conf->max_early_data_size = max_early_data_size;
Jerry Yucc4e0072022-11-22 17:22:22 +08001812}
1813#endif /* MBEDTLS_SSL_SRV_C */
1814
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001815#endif /* MBEDTLS_SSL_EARLY_DATA */
Ronald Cron6f135e12021-12-08 16:57:54 +01001816#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001817
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001818#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001819void mbedtls_ssl_conf_cert_profile(mbedtls_ssl_config *conf,
1820 const mbedtls_x509_crt_profile *profile)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001821{
1822 conf->cert_profile = profile;
1823}
1824
Gilles Peskine449bd832023-01-11 14:50:10 +01001825static void ssl_key_cert_free(mbedtls_ssl_key_cert *key_cert)
Glenn Strauss36872db2022-01-22 05:06:31 -05001826{
1827 mbedtls_ssl_key_cert *cur = key_cert, *next;
1828
Gilles Peskine449bd832023-01-11 14:50:10 +01001829 while (cur != NULL) {
Glenn Strauss36872db2022-01-22 05:06:31 -05001830 next = cur->next;
Gilles Peskine449bd832023-01-11 14:50:10 +01001831 mbedtls_free(cur);
Glenn Strauss36872db2022-01-22 05:06:31 -05001832 cur = next;
1833 }
1834}
1835
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001836/* Append a new keycert entry to a (possibly empty) list */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001837MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001838static int ssl_append_key_cert(mbedtls_ssl_key_cert **head,
1839 mbedtls_x509_crt *cert,
1840 mbedtls_pk_context *key)
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001841{
niisato8ee24222018-06-25 19:05:48 +09001842 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001843
Gilles Peskine449bd832023-01-11 14:50:10 +01001844 if (cert == NULL) {
Glenn Strauss36872db2022-01-22 05:06:31 -05001845 /* Free list if cert is null */
Gilles Peskine449bd832023-01-11 14:50:10 +01001846 ssl_key_cert_free(*head);
Glenn Strauss36872db2022-01-22 05:06:31 -05001847 *head = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001848 return 0;
Glenn Strauss36872db2022-01-22 05:06:31 -05001849 }
1850
Gilles Peskine449bd832023-01-11 14:50:10 +01001851 new_cert = mbedtls_calloc(1, sizeof(mbedtls_ssl_key_cert));
1852 if (new_cert == NULL) {
1853 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1854 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001855
niisato8ee24222018-06-25 19:05:48 +09001856 new_cert->cert = cert;
1857 new_cert->key = key;
1858 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001859
Glenn Strauss36872db2022-01-22 05:06:31 -05001860 /* Update head if the list was null, else add to the end */
Gilles Peskine449bd832023-01-11 14:50:10 +01001861 if (*head == NULL) {
niisato8ee24222018-06-25 19:05:48 +09001862 *head = new_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001863 } else {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001864 mbedtls_ssl_key_cert *cur = *head;
Gilles Peskine449bd832023-01-11 14:50:10 +01001865 while (cur->next != NULL) {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001866 cur = cur->next;
Gilles Peskine449bd832023-01-11 14:50:10 +01001867 }
niisato8ee24222018-06-25 19:05:48 +09001868 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001869 }
1870
Gilles Peskine449bd832023-01-11 14:50:10 +01001871 return 0;
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001872}
1873
Gilles Peskine449bd832023-01-11 14:50:10 +01001874int mbedtls_ssl_conf_own_cert(mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001875 mbedtls_x509_crt *own_cert,
Gilles Peskine449bd832023-01-11 14:50:10 +01001876 mbedtls_pk_context *pk_key)
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001877{
Gilles Peskine449bd832023-01-11 14:50:10 +01001878 return ssl_append_key_cert(&conf->key_cert, own_cert, pk_key);
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001879}
1880
Gilles Peskine449bd832023-01-11 14:50:10 +01001881void mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001882 mbedtls_x509_crt *ca_chain,
Gilles Peskine449bd832023-01-11 14:50:10 +01001883 mbedtls_x509_crl *ca_crl)
Paul Bakker5121ce52009-01-03 21:22:43 +00001884{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001885 conf->ca_chain = ca_chain;
1886 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001887
1888#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1889 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1890 * cannot be used together. */
1891 conf->f_ca_cb = NULL;
1892 conf->p_ca_cb = NULL;
1893#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001894}
Hanno Becker5adaad92019-03-27 16:54:37 +00001895
1896#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
Gilles Peskine449bd832023-01-11 14:50:10 +01001897void mbedtls_ssl_conf_ca_cb(mbedtls_ssl_config *conf,
1898 mbedtls_x509_crt_ca_cb_t f_ca_cb,
1899 void *p_ca_cb)
Hanno Becker5adaad92019-03-27 16:54:37 +00001900{
1901 conf->f_ca_cb = f_ca_cb;
1902 conf->p_ca_cb = p_ca_cb;
1903
1904 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1905 * cannot be used together. */
1906 conf->ca_chain = NULL;
1907 conf->ca_crl = NULL;
1908}
1909#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001910#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001911
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001912#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01001913const unsigned char *mbedtls_ssl_get_hs_sni(mbedtls_ssl_context *ssl,
1914 size_t *name_len)
Glenn Strauss69894072022-01-24 12:58:00 -05001915{
1916 *name_len = ssl->handshake->sni_name_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01001917 return ssl->handshake->sni_name;
Glenn Strauss69894072022-01-24 12:58:00 -05001918}
1919
Gilles Peskine449bd832023-01-11 14:50:10 +01001920int mbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context *ssl,
1921 mbedtls_x509_crt *own_cert,
1922 mbedtls_pk_context *pk_key)
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001923{
Gilles Peskine449bd832023-01-11 14:50:10 +01001924 return ssl_append_key_cert(&ssl->handshake->sni_key_cert,
1925 own_cert, pk_key);
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001926}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001927
Gilles Peskine449bd832023-01-11 14:50:10 +01001928void mbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context *ssl,
1929 mbedtls_x509_crt *ca_chain,
1930 mbedtls_x509_crl *ca_crl)
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001931{
1932 ssl->handshake->sni_ca_chain = ca_chain;
1933 ssl->handshake->sni_ca_crl = ca_crl;
1934}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001935
Glenn Strauss999ef702022-03-11 01:37:23 -05001936#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001937void mbedtls_ssl_set_hs_dn_hints(mbedtls_ssl_context *ssl,
1938 const mbedtls_x509_crt *crt)
Glenn Strauss999ef702022-03-11 01:37:23 -05001939{
1940 ssl->handshake->dn_hints = crt;
1941}
1942#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
1943
Gilles Peskine449bd832023-01-11 14:50:10 +01001944void mbedtls_ssl_set_hs_authmode(mbedtls_ssl_context *ssl,
1945 int authmode)
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001946{
1947 ssl->handshake->sni_authmode = authmode;
1948}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001949#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1950
Hanno Becker8927c832019-04-03 12:52:50 +01001951#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001952void mbedtls_ssl_set_verify(mbedtls_ssl_context *ssl,
1953 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1954 void *p_vrfy)
Hanno Becker8927c832019-04-03 12:52:50 +01001955{
1956 ssl->f_vrfy = f_vrfy;
1957 ssl->p_vrfy = p_vrfy;
1958}
1959#endif
1960
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001961#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001962
Valerio Setti016f6822022-12-09 14:17:50 +01001963#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemek Stekielfde11282023-03-13 16:06:09 +01001964static const uint8_t jpake_server_id[] = { 's', 'e', 'r', 'v', 'e', 'r' };
1965static const uint8_t jpake_client_id[] = { 'c', 'l', 'i', 'e', 'n', 't' };
1966
Valerio Setti016f6822022-12-09 14:17:50 +01001967static psa_status_t mbedtls_ssl_set_hs_ecjpake_password_common(
Gilles Peskine449bd832023-01-11 14:50:10 +01001968 mbedtls_ssl_context *ssl,
1969 mbedtls_svc_key_id_t pwd)
Valerio Setti016f6822022-12-09 14:17:50 +01001970{
1971 psa_status_t status;
Valerio Setti016f6822022-12-09 14:17:50 +01001972 psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
Przemek Stekielfde11282023-03-13 16:06:09 +01001973 const uint8_t *user = NULL;
Przemek Stekiel4cd20312023-03-01 11:11:28 +01001974 size_t user_len = 0;
Przemek Stekielfde11282023-03-13 16:06:09 +01001975 const uint8_t *peer = NULL;
Przemek Stekiel4cd20312023-03-01 11:11:28 +01001976 size_t peer_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001977 psa_pake_cs_set_algorithm(&cipher_suite, PSA_ALG_JPAKE);
1978 psa_pake_cs_set_primitive(&cipher_suite,
1979 PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC,
1980 PSA_ECC_FAMILY_SECP_R1,
1981 256));
1982 psa_pake_cs_set_hash(&cipher_suite, PSA_ALG_SHA_256);
Valerio Setti016f6822022-12-09 14:17:50 +01001983
Gilles Peskine449bd832023-01-11 14:50:10 +01001984 status = psa_pake_setup(&ssl->handshake->psa_pake_ctx, &cipher_suite);
1985 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01001986 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001987 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001988
Gilles Peskine449bd832023-01-11 14:50:10 +01001989 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Przemek Stekielfde11282023-03-13 16:06:09 +01001990 user = jpake_server_id;
1991 user_len = sizeof(jpake_server_id);
1992 peer = jpake_client_id;
1993 peer_len = sizeof(jpake_client_id);
Gilles Peskine449bd832023-01-11 14:50:10 +01001994 } else {
Przemek Stekielfde11282023-03-13 16:06:09 +01001995 user = jpake_client_id;
1996 user_len = sizeof(jpake_client_id);
1997 peer = jpake_server_id;
1998 peer_len = sizeof(jpake_server_id);
Gilles Peskine449bd832023-01-11 14:50:10 +01001999 }
Neil Armstrongca7d5062022-05-31 14:43:23 +02002000
Przemek Stekiel4cd20312023-03-01 11:11:28 +01002001 status = psa_pake_set_user(&ssl->handshake->psa_pake_ctx, user, user_len);
2002 if (status != PSA_SUCCESS) {
2003 return status;
2004 }
2005
2006 status = psa_pake_set_peer(&ssl->handshake->psa_pake_ctx, peer, peer_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01002007 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01002008 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002009 }
Valerio Setti016f6822022-12-09 14:17:50 +01002010
Gilles Peskine449bd832023-01-11 14:50:10 +01002011 status = psa_pake_set_password_key(&ssl->handshake->psa_pake_ctx, pwd);
2012 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01002013 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002014 }
Valerio Setti016f6822022-12-09 14:17:50 +01002015
2016 ssl->handshake->psa_pake_ctx_is_ok = 1;
2017
Gilles Peskine449bd832023-01-11 14:50:10 +01002018 return PSA_SUCCESS;
Valerio Setti016f6822022-12-09 14:17:50 +01002019}
2020
Gilles Peskine449bd832023-01-11 14:50:10 +01002021int mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context *ssl,
2022 const unsigned char *pw,
2023 size_t pw_len)
Valerio Setti016f6822022-12-09 14:17:50 +01002024{
2025 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
2026 psa_status_t status;
2027
Gilles Peskine449bd832023-01-11 14:50:10 +01002028 if (ssl->handshake == NULL || ssl->conf == NULL) {
2029 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstrongca7d5062022-05-31 14:43:23 +02002030 }
2031
Gilles Peskine449bd832023-01-11 14:50:10 +01002032 /* Empty password is not valid */
2033 if ((pw == NULL) || (pw_len == 0)) {
2034 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2035 }
2036
2037 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE);
2038 psa_set_key_algorithm(&attributes, PSA_ALG_JPAKE);
2039 psa_set_key_type(&attributes, PSA_KEY_TYPE_PASSWORD);
2040
2041 status = psa_import_key(&attributes, pw, pw_len,
2042 &ssl->handshake->psa_pake_password);
2043 if (status != PSA_SUCCESS) {
2044 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2045 }
2046
2047 status = mbedtls_ssl_set_hs_ecjpake_password_common(ssl,
2048 ssl->handshake->psa_pake_password);
2049 if (status != PSA_SUCCESS) {
2050 psa_destroy_key(ssl->handshake->psa_pake_password);
2051 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
2052 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2053 }
2054
2055 return 0;
Valerio Setti02c25b52022-11-15 14:08:42 +01002056}
Valerio Settia9a97dc2022-11-28 18:26:16 +01002057
Gilles Peskine449bd832023-01-11 14:50:10 +01002058int mbedtls_ssl_set_hs_ecjpake_password_opaque(mbedtls_ssl_context *ssl,
2059 mbedtls_svc_key_id_t pwd)
Valerio Settia9a97dc2022-11-28 18:26:16 +01002060{
Valerio Settia9a97dc2022-11-28 18:26:16 +01002061 psa_status_t status;
2062
Gilles Peskine449bd832023-01-11 14:50:10 +01002063 if (ssl->handshake == NULL || ssl->conf == NULL) {
2064 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstrongca7d5062022-05-31 14:43:23 +02002065 }
2066
Gilles Peskine449bd832023-01-11 14:50:10 +01002067 if (mbedtls_svc_key_id_is_null(pwd)) {
2068 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2069 }
2070
2071 status = mbedtls_ssl_set_hs_ecjpake_password_common(ssl, pwd);
2072 if (status != PSA_SUCCESS) {
2073 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
2074 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2075 }
2076
2077 return 0;
Valerio Setti02c25b52022-11-15 14:08:42 +01002078}
2079#else /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01002080int mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context *ssl,
2081 const unsigned char *pw,
2082 size_t pw_len)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002083{
2084 mbedtls_ecjpake_role role;
2085
Gilles Peskine449bd832023-01-11 14:50:10 +01002086 if (ssl->handshake == NULL || ssl->conf == NULL) {
2087 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2088 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002089
Valerio Settic689ed82022-12-07 14:40:38 +01002090 /* Empty password is not valid */
Gilles Peskine449bd832023-01-11 14:50:10 +01002091 if ((pw == NULL) || (pw_len == 0)) {
2092 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2093 }
Valerio Settic689ed82022-12-07 14:40:38 +01002094
Gilles Peskine449bd832023-01-11 14:50:10 +01002095 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002096 role = MBEDTLS_ECJPAKE_SERVER;
Gilles Peskine449bd832023-01-11 14:50:10 +01002097 } else {
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002098 role = MBEDTLS_ECJPAKE_CLIENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01002099 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002100
Gilles Peskine449bd832023-01-11 14:50:10 +01002101 return mbedtls_ecjpake_setup(&ssl->handshake->ecjpake_ctx,
2102 role,
2103 MBEDTLS_MD_SHA256,
2104 MBEDTLS_ECP_DP_SECP256R1,
2105 pw, pw_len);
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002106}
Valerio Setti02c25b52022-11-15 14:08:42 +01002107#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002108#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002109
Ronald Cron73fe8df2022-10-05 14:31:43 +02002110#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002111int mbedtls_ssl_conf_has_static_psk(mbedtls_ssl_config const *conf)
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002112{
Gilles Peskine449bd832023-01-11 14:50:10 +01002113 if (conf->psk_identity == NULL ||
2114 conf->psk_identity_len == 0) {
2115 return 0;
Ronald Crond29e13e2022-10-19 10:33:48 +02002116 }
2117
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002118#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002119 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
2120 return 1;
2121 }
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002122#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Crond29e13e2022-10-19 10:33:48 +02002123
Gilles Peskine449bd832023-01-11 14:50:10 +01002124 if (conf->psk != NULL && conf->psk_len != 0) {
2125 return 1;
2126 }
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002127
Gilles Peskine449bd832023-01-11 14:50:10 +01002128 return 0;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002129}
2130
Gilles Peskine449bd832023-01-11 14:50:10 +01002131static void ssl_conf_remove_psk(mbedtls_ssl_config *conf)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002132{
2133 /* Remove reference to existing PSK, if any. */
2134#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002135 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002136 /* The maintenance of the PSK key slot is the
2137 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02002138 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002139 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002140#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01002141 if (conf->psk != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01002142 mbedtls_zeroize_and_free(conf->psk, conf->psk_len);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002143 conf->psk = NULL;
2144 conf->psk_len = 0;
2145 }
2146
2147 /* Remove reference to PSK identity, if any. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002148 if (conf->psk_identity != NULL) {
2149 mbedtls_free(conf->psk_identity);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002150 conf->psk_identity = NULL;
2151 conf->psk_identity_len = 0;
2152 }
2153}
2154
Hanno Becker7390c712018-11-15 13:33:04 +00002155/* This function assumes that PSK identity in the SSL config is unset.
2156 * It checks that the provided identity is well-formed and attempts
2157 * to make a copy of it in the SSL config.
2158 * On failure, the PSK identity in the config remains unset. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002159MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002160static int ssl_conf_set_psk_identity(mbedtls_ssl_config *conf,
2161 unsigned char const *psk_identity,
2162 size_t psk_identity_len)
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002163{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002164 /* Identity len will be encoded on two bytes */
Gilles Peskine449bd832023-01-11 14:50:10 +01002165 if (psk_identity == NULL ||
Ronald Cron2a87e9b2022-10-19 10:55:26 +02002166 psk_identity_len == 0 ||
Gilles Peskine449bd832023-01-11 14:50:10 +01002167 (psk_identity_len >> 16) != 0 ||
2168 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN) {
2169 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002170 }
2171
Gilles Peskine449bd832023-01-11 14:50:10 +01002172 conf->psk_identity = mbedtls_calloc(1, psk_identity_len);
2173 if (conf->psk_identity == NULL) {
2174 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2175 }
Paul Bakker6db455e2013-09-18 17:29:31 +02002176
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01002177 conf->psk_identity_len = psk_identity_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002178 memcpy(conf->psk_identity, psk_identity, conf->psk_identity_len);
Paul Bakker5ad403f2013-09-18 21:21:30 +02002179
Gilles Peskine449bd832023-01-11 14:50:10 +01002180 return 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02002181}
2182
Gilles Peskine449bd832023-01-11 14:50:10 +01002183int mbedtls_ssl_conf_psk(mbedtls_ssl_config *conf,
2184 const unsigned char *psk, size_t psk_len,
2185 const unsigned char *psk_identity, size_t psk_identity_len)
Hanno Becker7390c712018-11-15 13:33:04 +00002186{
Janos Follath865b3eb2019-12-16 11:46:15 +00002187 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002188
2189 /* We currently only support one PSK, raw or opaque. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002190 if (mbedtls_ssl_conf_has_static_psk(conf)) {
2191 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2192 }
Hanno Becker7390c712018-11-15 13:33:04 +00002193
2194 /* Check and set raw PSK */
Gilles Peskine449bd832023-01-11 14:50:10 +01002195 if (psk == NULL) {
2196 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2197 }
2198 if (psk_len == 0) {
2199 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2200 }
2201 if (psk_len > MBEDTLS_PSK_MAX_LEN) {
2202 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2203 }
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01002204
Gilles Peskine449bd832023-01-11 14:50:10 +01002205 if ((conf->psk = mbedtls_calloc(1, psk_len)) == NULL) {
2206 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2207 }
Hanno Becker7390c712018-11-15 13:33:04 +00002208 conf->psk_len = psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002209 memcpy(conf->psk, psk, conf->psk_len);
Hanno Becker7390c712018-11-15 13:33:04 +00002210
2211 /* Check and set PSK Identity */
Gilles Peskine449bd832023-01-11 14:50:10 +01002212 ret = ssl_conf_set_psk_identity(conf, psk_identity, psk_identity_len);
2213 if (ret != 0) {
2214 ssl_conf_remove_psk(conf);
2215 }
Hanno Becker7390c712018-11-15 13:33:04 +00002216
Gilles Peskine449bd832023-01-11 14:50:10 +01002217 return ret;
Hanno Becker7390c712018-11-15 13:33:04 +00002218}
2219
Gilles Peskine449bd832023-01-11 14:50:10 +01002220static void ssl_remove_psk(mbedtls_ssl_context *ssl)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002221{
2222#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002223 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02002224 /* The maintenance of the external PSK key slot is the
2225 * user's responsibility. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002226 if (ssl->handshake->psk_opaque_is_internal) {
2227 psa_destroy_key(ssl->handshake->psk_opaque);
Neil Armstrong501c9322022-05-03 09:35:09 +02002228 ssl->handshake->psk_opaque_is_internal = 0;
2229 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02002230 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002231 }
Neil Armstronge952a302022-05-03 10:22:14 +02002232#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002233 if (ssl->handshake->psk != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01002234 mbedtls_zeroize_and_free(ssl->handshake->psk,
Gilles Peskine449bd832023-01-11 14:50:10 +01002235 ssl->handshake->psk_len);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002236 ssl->handshake->psk_len = 0;
2237 }
Neil Armstronge952a302022-05-03 10:22:14 +02002238#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002239}
2240
Gilles Peskine449bd832023-01-11 14:50:10 +01002241int mbedtls_ssl_set_hs_psk(mbedtls_ssl_context *ssl,
2242 const unsigned char *psk, size_t psk_len)
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002243{
Neil Armstrong501c9322022-05-03 09:35:09 +02002244#if defined(MBEDTLS_USE_PSA_CRYPTO)
2245 psa_key_attributes_t key_attributes = psa_key_attributes_init();
Jerry Yu5d01c052022-08-17 10:18:10 +08002246 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Jerry Yu24b8c812022-08-20 19:06:56 +08002247 psa_algorithm_t alg = PSA_ALG_NONE;
Jerry Yu5d01c052022-08-17 10:18:10 +08002248 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrong501c9322022-05-03 09:35:09 +02002249#endif /* MBEDTLS_USE_PSA_CRYPTO */
2250
Gilles Peskine449bd832023-01-11 14:50:10 +01002251 if (psk == NULL || ssl->handshake == NULL) {
2252 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2253 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002254
Gilles Peskine449bd832023-01-11 14:50:10 +01002255 if (psk_len > MBEDTLS_PSK_MAX_LEN) {
2256 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2257 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002258
Gilles Peskine449bd832023-01-11 14:50:10 +01002259 ssl_remove_psk(ssl);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002260
Neil Armstrong501c9322022-05-03 09:35:09 +02002261#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yuccc68a42022-07-26 16:39:20 +08002262#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01002263 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
2264 if (ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
2265 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
2266 } else {
2267 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
2268 }
2269 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
Jerry Yuccc68a42022-07-26 16:39:20 +08002270 }
2271#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Neil Armstrong501c9322022-05-03 09:35:09 +02002272
Jerry Yu568ec252022-07-22 21:27:34 +08002273#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01002274 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
2275 alg = PSA_ALG_HKDF_EXTRACT(PSA_ALG_ANY_HASH);
2276 psa_set_key_usage_flags(&key_attributes,
2277 PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_EXPORT);
Jerry Yuccc68a42022-07-26 16:39:20 +08002278 }
2279#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2280
Gilles Peskine449bd832023-01-11 14:50:10 +01002281 psa_set_key_algorithm(&key_attributes, alg);
2282 psa_set_key_type(&key_attributes, PSA_KEY_TYPE_DERIVE);
Neil Armstrong501c9322022-05-03 09:35:09 +02002283
Gilles Peskine449bd832023-01-11 14:50:10 +01002284 status = psa_import_key(&key_attributes, psk, psk_len, &key);
2285 if (status != PSA_SUCCESS) {
2286 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2287 }
Neil Armstrong501c9322022-05-03 09:35:09 +02002288
2289 /* Allow calling psa_destroy_key() on psk remove */
2290 ssl->handshake->psk_opaque_is_internal = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01002291 return mbedtls_ssl_set_hs_psk_opaque(ssl, key);
Neil Armstrong501c9322022-05-03 09:35:09 +02002292#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002293 if ((ssl->handshake->psk = mbedtls_calloc(1, psk_len)) == NULL) {
2294 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2295 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002296
2297 ssl->handshake->psk_len = psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002298 memcpy(ssl->handshake->psk, psk, ssl->handshake->psk_len);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002299
Gilles Peskine449bd832023-01-11 14:50:10 +01002300 return 0;
Neil Armstrong501c9322022-05-03 09:35:09 +02002301#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002302}
2303
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002304#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002305int mbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config *conf,
2306 mbedtls_svc_key_id_t psk,
2307 const unsigned char *psk_identity,
2308 size_t psk_identity_len)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002309{
Janos Follath865b3eb2019-12-16 11:46:15 +00002310 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002311
2312 /* We currently only support one PSK, raw or opaque. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002313 if (mbedtls_ssl_conf_has_static_psk(conf)) {
2314 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2315 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002316
Hanno Becker7390c712018-11-15 13:33:04 +00002317 /* Check and set opaque PSK */
Gilles Peskine449bd832023-01-11 14:50:10 +01002318 if (mbedtls_svc_key_id_is_null(psk)) {
2319 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2320 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02002321 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00002322
2323 /* Check and set PSK Identity */
Gilles Peskine449bd832023-01-11 14:50:10 +01002324 ret = ssl_conf_set_psk_identity(conf, psk_identity,
2325 psk_identity_len);
2326 if (ret != 0) {
2327 ssl_conf_remove_psk(conf);
2328 }
Hanno Becker7390c712018-11-15 13:33:04 +00002329
Gilles Peskine449bd832023-01-11 14:50:10 +01002330 return ret;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002331}
2332
Gilles Peskine449bd832023-01-11 14:50:10 +01002333int mbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context *ssl,
2334 mbedtls_svc_key_id_t psk)
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002335{
Gilles Peskine449bd832023-01-11 14:50:10 +01002336 if ((mbedtls_svc_key_id_is_null(psk)) ||
2337 (ssl->handshake == NULL)) {
2338 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2339 }
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002340
Gilles Peskine449bd832023-01-11 14:50:10 +01002341 ssl_remove_psk(ssl);
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002342 ssl->handshake->psk_opaque = psk;
Gilles Peskine449bd832023-01-11 14:50:10 +01002343 return 0;
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002344}
2345#endif /* MBEDTLS_USE_PSA_CRYPTO */
2346
Jerry Yu8897c072022-08-12 13:56:53 +08002347#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002348void mbedtls_ssl_conf_psk_cb(mbedtls_ssl_config *conf,
2349 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
2350 size_t),
2351 void *p_psk)
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002352{
2353 conf->f_psk = f_psk;
2354 conf->p_psk = p_psk;
2355}
Jerry Yu8897c072022-08-12 13:56:53 +08002356#endif /* MBEDTLS_SSL_SRV_C */
2357
Ronald Cron73fe8df2022-10-05 14:31:43 +02002358#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002359
2360#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine301711e2022-04-26 16:57:05 +02002361static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002362 psa_algorithm_t alg)
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002363{
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002364#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01002365 if (alg == PSA_ALG_CBC_NO_PADDING) {
2366 return MBEDTLS_SSL_MODE_CBC;
2367 }
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002368#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Gilles Peskine449bd832023-01-11 14:50:10 +01002369 if (PSA_ALG_IS_AEAD(alg)) {
2370 return MBEDTLS_SSL_MODE_AEAD;
2371 }
2372 return MBEDTLS_SSL_MODE_STREAM;
Gilles Peskine301711e2022-04-26 16:57:05 +02002373}
2374
2375#else /* MBEDTLS_USE_PSA_CRYPTO */
2376
2377static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002378 mbedtls_cipher_mode_t mode)
Gilles Peskine301711e2022-04-26 16:57:05 +02002379{
2380#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01002381 if (mode == MBEDTLS_MODE_CBC) {
2382 return MBEDTLS_SSL_MODE_CBC;
2383 }
Gilles Peskine301711e2022-04-26 16:57:05 +02002384#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
2385
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002386#if defined(MBEDTLS_GCM_C) || \
2387 defined(MBEDTLS_CCM_C) || \
2388 defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002389 if (mode == MBEDTLS_MODE_GCM ||
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002390 mode == MBEDTLS_MODE_CCM ||
Gilles Peskine449bd832023-01-11 14:50:10 +01002391 mode == MBEDTLS_MODE_CHACHAPOLY) {
2392 return MBEDTLS_SSL_MODE_AEAD;
2393 }
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002394#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002395
Gilles Peskine449bd832023-01-11 14:50:10 +01002396 return MBEDTLS_SSL_MODE_STREAM;
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002397}
Gilles Peskine301711e2022-04-26 16:57:05 +02002398#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002399
Gilles Peskinee108d982022-04-26 16:50:40 +02002400static mbedtls_ssl_mode_t mbedtls_ssl_get_actual_mode(
2401 mbedtls_ssl_mode_t base_mode,
Gilles Peskine449bd832023-01-11 14:50:10 +01002402 int encrypt_then_mac)
Gilles Peskinee108d982022-04-26 16:50:40 +02002403{
2404#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01002405 if (encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
2406 base_mode == MBEDTLS_SSL_MODE_CBC) {
2407 return MBEDTLS_SSL_MODE_CBC_ETM;
Gilles Peskinee108d982022-04-26 16:50:40 +02002408 }
2409#else
2410 (void) encrypt_then_mac;
2411#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002412 return base_mode;
Gilles Peskinee108d982022-04-26 16:50:40 +02002413}
2414
Neil Armstrongab555e02022-04-04 11:07:59 +02002415mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
Gilles Peskine449bd832023-01-11 14:50:10 +01002416 const mbedtls_ssl_transform *transform)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002417{
Gilles Peskinee108d982022-04-26 16:50:40 +02002418 mbedtls_ssl_mode_t base_mode = mbedtls_ssl_get_base_mode(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002419#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002420 transform->psa_alg
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002421#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002422 mbedtls_cipher_get_cipher_mode(&transform->cipher_ctx_enc)
Gilles Peskinee108d982022-04-26 16:50:40 +02002423#endif
2424 );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002425
Gilles Peskinee108d982022-04-26 16:50:40 +02002426 int encrypt_then_mac = 0;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002427#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskinee108d982022-04-26 16:50:40 +02002428 encrypt_then_mac = transform->encrypt_then_mac;
2429#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002430 return mbedtls_ssl_get_actual_mode(base_mode, encrypt_then_mac);
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002431}
2432
Neil Armstrongab555e02022-04-04 11:07:59 +02002433mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002434#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01002435 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002436#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01002437 const mbedtls_ssl_ciphersuite_t *suite)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002438{
Gilles Peskinee108d982022-04-26 16:50:40 +02002439 mbedtls_ssl_mode_t base_mode = MBEDTLS_SSL_MODE_STREAM;
2440
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002441#if defined(MBEDTLS_USE_PSA_CRYPTO)
2442 psa_status_t status;
2443 psa_algorithm_t alg;
2444 psa_key_type_t type;
2445 size_t size;
Dave Rodgman2eab4622023-10-05 13:30:37 +01002446 status = mbedtls_ssl_cipher_to_psa((mbedtls_cipher_type_t) suite->cipher,
2447 0, &alg, &type, &size);
Gilles Peskine449bd832023-01-11 14:50:10 +01002448 if (status == PSA_SUCCESS) {
2449 base_mode = mbedtls_ssl_get_base_mode(alg);
2450 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002451#else
2452 const mbedtls_cipher_info_t *cipher =
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01002453 mbedtls_cipher_info_from_type((mbedtls_cipher_type_t) suite->cipher);
Gilles Peskine449bd832023-01-11 14:50:10 +01002454 if (cipher != NULL) {
Gilles Peskinee108d982022-04-26 16:50:40 +02002455 base_mode =
2456 mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002457 mbedtls_cipher_info_get_mode(cipher));
Gilles Peskinee108d982022-04-26 16:50:40 +02002458 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002459#endif /* MBEDTLS_USE_PSA_CRYPTO */
2460
Gilles Peskinee108d982022-04-26 16:50:40 +02002461#if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
2462 int encrypt_then_mac = 0;
2463#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002464 return mbedtls_ssl_get_actual_mode(base_mode, encrypt_then_mac);
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002465}
2466
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002467#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu251a12e2022-07-13 15:15:48 +08002468
Gilles Peskine449bd832023-01-11 14:50:10 +01002469psa_status_t mbedtls_ssl_cipher_to_psa(mbedtls_cipher_type_t mbedtls_cipher_type,
2470 size_t taglen,
2471 psa_algorithm_t *alg,
2472 psa_key_type_t *key_type,
2473 size_t *key_size)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002474{
Yanray Wang19e4dc82023-11-16 18:02:05 +08002475#if !defined(MBEDTLS_SSL_HAVE_CCM)
2476 (void) taglen;
2477#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002478 switch (mbedtls_cipher_type) {
Yanray Wang1a369d62023-11-16 15:17:31 +08002479#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002480 case MBEDTLS_CIPHER_AES_128_CBC:
2481 *alg = PSA_ALG_CBC_NO_PADDING;
2482 *key_type = PSA_KEY_TYPE_AES;
2483 *key_size = 128;
2484 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002485#endif
2486#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002487 case MBEDTLS_CIPHER_AES_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002488 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002489 *key_type = PSA_KEY_TYPE_AES;
2490 *key_size = 128;
2491 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002492#endif
2493#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002494 case MBEDTLS_CIPHER_AES_128_GCM:
2495 *alg = PSA_ALG_GCM;
2496 *key_type = PSA_KEY_TYPE_AES;
2497 *key_size = 128;
2498 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002499#endif
2500#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002501 case MBEDTLS_CIPHER_AES_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002502 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002503 *key_type = PSA_KEY_TYPE_AES;
2504 *key_size = 192;
2505 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002506#endif
2507#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002508 case MBEDTLS_CIPHER_AES_192_GCM:
2509 *alg = PSA_ALG_GCM;
2510 *key_type = PSA_KEY_TYPE_AES;
2511 *key_size = 192;
2512 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002513#endif
2514#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002515 case MBEDTLS_CIPHER_AES_256_CBC:
2516 *alg = PSA_ALG_CBC_NO_PADDING;
2517 *key_type = PSA_KEY_TYPE_AES;
2518 *key_size = 256;
2519 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002520#endif
2521#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002522 case MBEDTLS_CIPHER_AES_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002523 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002524 *key_type = PSA_KEY_TYPE_AES;
2525 *key_size = 256;
2526 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002527#endif
2528#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002529 case MBEDTLS_CIPHER_AES_256_GCM:
2530 *alg = PSA_ALG_GCM;
2531 *key_type = PSA_KEY_TYPE_AES;
2532 *key_size = 256;
2533 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002534#endif
2535#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002536 case MBEDTLS_CIPHER_ARIA_128_CBC:
2537 *alg = PSA_ALG_CBC_NO_PADDING;
2538 *key_type = PSA_KEY_TYPE_ARIA;
2539 *key_size = 128;
2540 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002541#endif
2542#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002543 case MBEDTLS_CIPHER_ARIA_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002544 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002545 *key_type = PSA_KEY_TYPE_ARIA;
2546 *key_size = 128;
2547 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002548#endif
2549#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002550 case MBEDTLS_CIPHER_ARIA_128_GCM:
2551 *alg = PSA_ALG_GCM;
2552 *key_type = PSA_KEY_TYPE_ARIA;
2553 *key_size = 128;
2554 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002555#endif
2556#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002557 case MBEDTLS_CIPHER_ARIA_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002558 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002559 *key_type = PSA_KEY_TYPE_ARIA;
2560 *key_size = 192;
2561 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002562#endif
2563#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002564 case MBEDTLS_CIPHER_ARIA_192_GCM:
2565 *alg = PSA_ALG_GCM;
2566 *key_type = PSA_KEY_TYPE_ARIA;
2567 *key_size = 192;
2568 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002569#endif
2570#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002571 case MBEDTLS_CIPHER_ARIA_256_CBC:
2572 *alg = PSA_ALG_CBC_NO_PADDING;
2573 *key_type = PSA_KEY_TYPE_ARIA;
2574 *key_size = 256;
2575 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002576#endif
2577#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002578 case MBEDTLS_CIPHER_ARIA_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002579 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002580 *key_type = PSA_KEY_TYPE_ARIA;
2581 *key_size = 256;
2582 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002583#endif
2584#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002585 case MBEDTLS_CIPHER_ARIA_256_GCM:
2586 *alg = PSA_ALG_GCM;
2587 *key_type = PSA_KEY_TYPE_ARIA;
2588 *key_size = 256;
2589 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002590#endif
2591#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002592 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
2593 *alg = PSA_ALG_CBC_NO_PADDING;
2594 *key_type = PSA_KEY_TYPE_CAMELLIA;
2595 *key_size = 128;
2596 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002597#endif
2598#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002599 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002600 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002601 *key_type = PSA_KEY_TYPE_CAMELLIA;
2602 *key_size = 128;
2603 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002604#endif
2605#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002606 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
2607 *alg = PSA_ALG_GCM;
2608 *key_type = PSA_KEY_TYPE_CAMELLIA;
2609 *key_size = 128;
2610 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002611#endif
2612#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002613 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002614 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002615 *key_type = PSA_KEY_TYPE_CAMELLIA;
2616 *key_size = 192;
2617 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002618#endif
2619#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002620 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
2621 *alg = PSA_ALG_GCM;
2622 *key_type = PSA_KEY_TYPE_CAMELLIA;
2623 *key_size = 192;
2624 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002625#endif
2626#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002627 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
2628 *alg = PSA_ALG_CBC_NO_PADDING;
2629 *key_type = PSA_KEY_TYPE_CAMELLIA;
2630 *key_size = 256;
2631 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002632#endif
2633#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002634 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002635 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002636 *key_type = PSA_KEY_TYPE_CAMELLIA;
2637 *key_size = 256;
2638 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002639#endif
2640#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002641 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
2642 *alg = PSA_ALG_GCM;
2643 *key_type = PSA_KEY_TYPE_CAMELLIA;
2644 *key_size = 256;
2645 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002646#endif
2647#if defined(MBEDTLS_SSL_HAVE_CHACHAPOLY)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002648 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
2649 *alg = PSA_ALG_CHACHA20_POLY1305;
2650 *key_type = PSA_KEY_TYPE_CHACHA20;
2651 *key_size = 256;
2652 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002653#endif
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002654 case MBEDTLS_CIPHER_NULL:
2655 *alg = MBEDTLS_SSL_NULL_CIPHER;
2656 *key_type = 0;
2657 *key_size = 0;
2658 break;
2659 default:
2660 return PSA_ERROR_NOT_SUPPORTED;
2661 }
2662
2663 return PSA_SUCCESS;
2664}
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002665#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002666
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002667#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002668int mbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config *conf,
2669 const unsigned char *dhm_P, size_t P_len,
2670 const unsigned char *dhm_G, size_t G_len)
Hanno Beckera90658f2017-10-04 15:29:08 +01002671{
Janos Follath865b3eb2019-12-16 11:46:15 +00002672 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01002673
Gilles Peskine449bd832023-01-11 14:50:10 +01002674 mbedtls_mpi_free(&conf->dhm_P);
2675 mbedtls_mpi_free(&conf->dhm_G);
Glenn Strausscee11292021-12-20 01:43:17 -05002676
Gilles Peskine449bd832023-01-11 14:50:10 +01002677 if ((ret = mbedtls_mpi_read_binary(&conf->dhm_P, dhm_P, P_len)) != 0 ||
2678 (ret = mbedtls_mpi_read_binary(&conf->dhm_G, dhm_G, G_len)) != 0) {
2679 mbedtls_mpi_free(&conf->dhm_P);
2680 mbedtls_mpi_free(&conf->dhm_G);
2681 return ret;
Hanno Beckera90658f2017-10-04 15:29:08 +01002682 }
2683
Gilles Peskine449bd832023-01-11 14:50:10 +01002684 return 0;
Hanno Beckera90658f2017-10-04 15:29:08 +01002685}
Paul Bakker5121ce52009-01-03 21:22:43 +00002686
Gilles Peskine449bd832023-01-11 14:50:10 +01002687int mbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx)
Paul Bakker1b57b062011-01-06 15:48:19 +00002688{
Janos Follath865b3eb2019-12-16 11:46:15 +00002689 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00002690
Gilles Peskine449bd832023-01-11 14:50:10 +01002691 mbedtls_mpi_free(&conf->dhm_P);
2692 mbedtls_mpi_free(&conf->dhm_G);
Glenn Strausscee11292021-12-20 01:43:17 -05002693
Gilles Peskine449bd832023-01-11 14:50:10 +01002694 if ((ret = mbedtls_dhm_get_value(dhm_ctx, MBEDTLS_DHM_PARAM_P,
2695 &conf->dhm_P)) != 0 ||
2696 (ret = mbedtls_dhm_get_value(dhm_ctx, MBEDTLS_DHM_PARAM_G,
2697 &conf->dhm_G)) != 0) {
2698 mbedtls_mpi_free(&conf->dhm_P);
2699 mbedtls_mpi_free(&conf->dhm_G);
2700 return ret;
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002701 }
Paul Bakker1b57b062011-01-06 15:48:19 +00002702
Gilles Peskine449bd832023-01-11 14:50:10 +01002703 return 0;
Paul Bakker1b57b062011-01-06 15:48:19 +00002704}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002705#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00002706
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002707#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
2708/*
2709 * Set the minimum length for Diffie-Hellman parameters
2710 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002711void mbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config *conf,
2712 unsigned int bitlen)
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002713{
2714 conf->dhm_min_bitlen = bitlen;
2715}
2716#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
2717
Ronald Crone68ab4f2022-10-05 12:46:29 +02002718#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002719#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002720/*
2721 * Set allowed/preferred hashes for handshake signatures
2722 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002723void mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config *conf,
2724 const int *hashes)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002725{
2726 conf->sig_hashes = hashes;
2727}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002728#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002729
Jerry Yuf017ee42022-01-12 15:49:48 +08002730/* Configure allowed signature algorithms for handshake */
Gilles Peskine449bd832023-01-11 14:50:10 +01002731void mbedtls_ssl_conf_sig_algs(mbedtls_ssl_config *conf,
2732 const uint16_t *sig_algs)
Hanno Becker1cd6e002021-08-10 13:27:10 +01002733{
Jerry Yuf017ee42022-01-12 15:49:48 +08002734#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2735 conf->sig_hashes = NULL;
2736#endif /* !MBEDTLS_DEPRECATED_REMOVED */
2737 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01002738}
Ronald Crone68ab4f2022-10-05 12:46:29 +02002739#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002740
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02002741#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01002742#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002743/*
2744 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01002745 *
2746 * mbedtls_ssl_setup() takes the provided list
2747 * and translates it to a list of IANA TLS group identifiers,
2748 * stored in ssl->handshake->group_list.
2749 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002750 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002751void mbedtls_ssl_conf_curves(mbedtls_ssl_config *conf,
2752 const mbedtls_ecp_group_id *curve_list)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002753{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002754 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01002755 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002756}
Brett Warrene0edc842021-08-17 09:53:13 +01002757#endif /* MBEDTLS_DEPRECATED_REMOVED */
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02002758#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002759
Brett Warrene0edc842021-08-17 09:53:13 +01002760/*
2761 * Set the allowed groups
2762 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002763void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf,
2764 const uint16_t *group_list)
Brett Warrene0edc842021-08-17 09:53:13 +01002765{
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02002766#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
Brett Warrene0edc842021-08-17 09:53:13 +01002767 conf->curve_list = NULL;
2768#endif
2769 conf->group_list = group_list;
2770}
2771
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002772#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002773int mbedtls_ssl_set_hostname(mbedtls_ssl_context *ssl, const char *hostname)
Paul Bakker5121ce52009-01-03 21:22:43 +00002774{
Hanno Becker947194e2017-04-07 13:25:49 +01002775 /* Initialize to suppress unnecessary compiler warning */
2776 size_t hostname_len = 0;
2777
2778 /* Check if new hostname is valid before
2779 * making any change to current one */
Gilles Peskine449bd832023-01-11 14:50:10 +01002780 if (hostname != NULL) {
2781 hostname_len = strlen(hostname);
Hanno Becker947194e2017-04-07 13:25:49 +01002782
Gilles Peskine449bd832023-01-11 14:50:10 +01002783 if (hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN) {
2784 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2785 }
Hanno Becker947194e2017-04-07 13:25:49 +01002786 }
2787
2788 /* Now it's clear that we will overwrite the old hostname,
2789 * so we can free it safely */
2790
Gilles Peskine449bd832023-01-11 14:50:10 +01002791 if (ssl->hostname != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01002792 mbedtls_zeroize_and_free(ssl->hostname, strlen(ssl->hostname));
Hanno Becker947194e2017-04-07 13:25:49 +01002793 }
2794
2795 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01002796
Gilles Peskine449bd832023-01-11 14:50:10 +01002797 if (hostname == NULL) {
Hanno Becker947194e2017-04-07 13:25:49 +01002798 ssl->hostname = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01002799 } else {
2800 ssl->hostname = mbedtls_calloc(1, hostname_len + 1);
2801 if (ssl->hostname == NULL) {
2802 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2803 }
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002804
Gilles Peskine449bd832023-01-11 14:50:10 +01002805 memcpy(ssl->hostname, hostname, hostname_len);
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002806
Hanno Becker947194e2017-04-07 13:25:49 +01002807 ssl->hostname[hostname_len] = '\0';
2808 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002809
Gilles Peskine449bd832023-01-11 14:50:10 +01002810 return 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00002811}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01002812#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002813
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002814#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002815void mbedtls_ssl_conf_sni(mbedtls_ssl_config *conf,
2816 int (*f_sni)(void *, mbedtls_ssl_context *,
2817 const unsigned char *, size_t),
2818 void *p_sni)
Paul Bakker5701cdc2012-09-27 21:49:42 +00002819{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002820 conf->f_sni = f_sni;
2821 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00002822}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002823#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00002824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002825#if defined(MBEDTLS_SSL_ALPN)
Gilles Peskine449bd832023-01-11 14:50:10 +01002826int mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config *conf, const char **protos)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002827{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002828 size_t cur_len, tot_len;
2829 const char **p;
2830
2831 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08002832 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
2833 * MUST NOT be truncated."
2834 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002835 */
2836 tot_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002837 for (p = protos; *p != NULL; p++) {
2838 cur_len = strlen(*p);
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002839 tot_len += cur_len;
2840
Gilles Peskine449bd832023-01-11 14:50:10 +01002841 if ((cur_len == 0) ||
2842 (cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN) ||
2843 (tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN)) {
2844 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2845 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002846 }
2847
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002848 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002849
Gilles Peskine449bd832023-01-11 14:50:10 +01002850 return 0;
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002851}
2852
Gilles Peskine449bd832023-01-11 14:50:10 +01002853const char *mbedtls_ssl_get_alpn_protocol(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002854{
Gilles Peskine449bd832023-01-11 14:50:10 +01002855 return ssl->alpn_chosen;
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002856}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002857#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002858
Johan Pascalb62bb512015-12-03 21:56:45 +01002859#if defined(MBEDTLS_SSL_DTLS_SRTP)
Gilles Peskine449bd832023-01-11 14:50:10 +01002860void mbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config *conf,
2861 int support_mki_value)
Ron Eldor591f1622018-01-22 12:30:04 +02002862{
2863 conf->dtls_srtp_mki_support = support_mki_value;
2864}
2865
Gilles Peskine449bd832023-01-11 14:50:10 +01002866int mbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context *ssl,
2867 unsigned char *mki_value,
2868 uint16_t mki_len)
Ron Eldor591f1622018-01-22 12:30:04 +02002869{
Gilles Peskine449bd832023-01-11 14:50:10 +01002870 if (mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH) {
2871 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Ron Eldora9788042018-12-05 11:04:31 +02002872 }
Ron Eldor591f1622018-01-22 12:30:04 +02002873
Gilles Peskine449bd832023-01-11 14:50:10 +01002874 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED) {
2875 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Ron Eldora9788042018-12-05 11:04:31 +02002876 }
Ron Eldor591f1622018-01-22 12:30:04 +02002877
Gilles Peskine449bd832023-01-11 14:50:10 +01002878 memcpy(ssl->dtls_srtp_info.mki_value, mki_value, mki_len);
Ron Eldor591f1622018-01-22 12:30:04 +02002879 ssl->dtls_srtp_info.mki_len = mki_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002880 return 0;
Ron Eldor591f1622018-01-22 12:30:04 +02002881}
2882
Gilles Peskine449bd832023-01-11 14:50:10 +01002883int mbedtls_ssl_conf_dtls_srtp_protection_profiles(mbedtls_ssl_config *conf,
2884 const mbedtls_ssl_srtp_profile *profiles)
Johan Pascalb62bb512015-12-03 21:56:45 +01002885{
Johan Pascal253d0262020-09-22 13:04:45 +02002886 const mbedtls_ssl_srtp_profile *p;
2887 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002888
Johan Pascal253d0262020-09-22 13:04:45 +02002889 /* check the profiles list: all entry must be valid,
2890 * its size cannot be more than the total number of supported profiles, currently 4 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002891 for (p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
2892 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
2893 p++) {
2894 if (mbedtls_ssl_check_srtp_profile_value(*p) != MBEDTLS_TLS_SRTP_UNSET) {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002895 list_size++;
Gilles Peskine449bd832023-01-11 14:50:10 +01002896 } else {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002897 /* unsupported value, stop parsing and set the size to an error value */
2898 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01002899 }
2900 }
2901
Gilles Peskine449bd832023-01-11 14:50:10 +01002902 if (list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH) {
2903 conf->dtls_srtp_profile_list = NULL;
2904 conf->dtls_srtp_profile_list_len = 0;
2905 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Johan Pascal253d0262020-09-22 13:04:45 +02002906 }
2907
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002908 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02002909 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01002910
Gilles Peskine449bd832023-01-11 14:50:10 +01002911 return 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002912}
2913
Gilles Peskine449bd832023-01-11 14:50:10 +01002914void mbedtls_ssl_get_dtls_srtp_negotiation_result(const mbedtls_ssl_context *ssl,
2915 mbedtls_dtls_srtp_info *dtls_srtp_info)
Johan Pascalb62bb512015-12-03 21:56:45 +01002916{
Johan Pascal2258a4f2020-10-28 13:53:09 +01002917 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
2918 /* do not copy the mki value if there is no chosen profile */
Gilles Peskine449bd832023-01-11 14:50:10 +01002919 if (dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET) {
Johan Pascal2258a4f2020-10-28 13:53:09 +01002920 dtls_srtp_info->mki_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002921 } else {
Johan Pascal2258a4f2020-10-28 13:53:09 +01002922 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002923 memcpy(dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
2924 ssl->dtls_srtp_info.mki_len);
Johan Pascal2258a4f2020-10-28 13:53:09 +01002925 }
Johan Pascalb62bb512015-12-03 21:56:45 +01002926}
Johan Pascalb62bb512015-12-03 21:56:45 +01002927#endif /* MBEDTLS_SSL_DTLS_SRTP */
2928
Aditya Patwardhan3096f332022-07-26 14:31:46 +05302929#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002930void mbedtls_ssl_conf_max_version(mbedtls_ssl_config *conf, int major, int minor)
Paul Bakker490ecc82011-10-06 13:04:09 +00002931{
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01002932 conf->max_tls_version = (mbedtls_ssl_protocol_version) ((major << 8) | minor);
Paul Bakker490ecc82011-10-06 13:04:09 +00002933}
2934
Gilles Peskine449bd832023-01-11 14:50:10 +01002935void mbedtls_ssl_conf_min_version(mbedtls_ssl_config *conf, int major, int minor)
Paul Bakker1d29fb52012-09-28 13:28:45 +00002936{
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01002937 conf->min_tls_version = (mbedtls_ssl_protocol_version) ((major << 8) | minor);
Paul Bakker1d29fb52012-09-28 13:28:45 +00002938}
Aditya Patwardhan3096f332022-07-26 14:31:46 +05302939#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker1d29fb52012-09-28 13:28:45 +00002940
Janos Follath088ce432017-04-10 12:42:31 +01002941#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002942void mbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config *conf,
2943 char cert_req_ca_list)
Janos Follath088ce432017-04-10 12:42:31 +01002944{
2945 conf->cert_req_ca_list = cert_req_ca_list;
2946}
2947#endif
2948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002949#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01002950void mbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config *conf, char etm)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002951{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002952 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002953}
2954#endif
2955
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002956#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Gilles Peskine449bd832023-01-11 14:50:10 +01002957void mbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config *conf, char ems)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002958{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002959 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002960}
2961#endif
2962
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002963#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01002964int mbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config *conf, unsigned char mfl_code)
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002965{
Gilles Peskine449bd832023-01-11 14:50:10 +01002966 if (mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
2967 ssl_mfl_code_to_length(mfl_code) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN) {
2968 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002969 }
2970
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01002971 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002972
Gilles Peskine449bd832023-01-11 14:50:10 +01002973 return 0;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002974}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002975#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002976
Gilles Peskine449bd832023-01-11 14:50:10 +01002977void mbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config *conf, int allow_legacy)
Paul Bakker48916f92012-09-16 19:57:18 +00002978{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002979 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00002980}
2981
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002982#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002983void mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config *conf, int renegotiation)
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002984{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002985 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002986}
2987
Gilles Peskine449bd832023-01-11 14:50:10 +01002988void mbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config *conf, int max_records)
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002989{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002990 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002991}
2992
Gilles Peskine449bd832023-01-11 14:50:10 +01002993void mbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config *conf,
2994 const unsigned char period[8])
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002995{
Gilles Peskine449bd832023-01-11 14:50:10 +01002996 memcpy(conf->renego_period, period, 8);
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002997}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002998#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002999
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003000#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003001#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003002void mbedtls_ssl_conf_session_tickets(mbedtls_ssl_config *conf, int use_tickets)
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003003{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01003004 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003005}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003006#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02003007
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003008#if defined(MBEDTLS_SSL_SRV_C)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003009
Jerry Yud0766ec2022-09-22 10:46:57 +08003010#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003011void mbedtls_ssl_conf_new_session_tickets(mbedtls_ssl_config *conf,
3012 uint16_t num_tickets)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003013{
Jerry Yud0766ec2022-09-22 10:46:57 +08003014 conf->new_session_tickets_count = num_tickets;
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003015}
3016#endif
3017
Gilles Peskine449bd832023-01-11 14:50:10 +01003018void mbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config *conf,
3019 mbedtls_ssl_ticket_write_t *f_ticket_write,
3020 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
3021 void *p_ticket)
Paul Bakker606b4ba2013-08-14 16:52:14 +02003022{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02003023 conf->f_ticket_write = f_ticket_write;
3024 conf->f_ticket_parse = f_ticket_parse;
3025 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02003026}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003027#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003028#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003029
Gilles Peskine449bd832023-01-11 14:50:10 +01003030void mbedtls_ssl_set_export_keys_cb(mbedtls_ssl_context *ssl,
3031 mbedtls_ssl_export_keys_t *f_export_keys,
3032 void *p_export_keys)
Robert Cragie4feb7ae2015-10-02 13:33:37 +01003033{
Hanno Becker7e6c1782021-06-08 09:24:55 +01003034 ssl->f_export_keys = f_export_keys;
3035 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03003036}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01003037
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003038#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003039void mbedtls_ssl_conf_async_private_cb(
3040 mbedtls_ssl_config *conf,
3041 mbedtls_ssl_async_sign_t *f_async_sign,
3042 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
3043 mbedtls_ssl_async_resume_t *f_async_resume,
3044 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskine449bd832023-01-11 14:50:10 +01003045 void *async_config_data)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003046{
3047 conf->f_async_sign_start = f_async_sign;
3048 conf->f_async_decrypt_start = f_async_decrypt;
3049 conf->f_async_resume = f_async_resume;
3050 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003051 conf->p_async_config_data = async_config_data;
3052}
3053
Gilles Peskine449bd832023-01-11 14:50:10 +01003054void *mbedtls_ssl_conf_get_async_config_data(const mbedtls_ssl_config *conf)
Gilles Peskine8f97af72018-04-26 11:46:10 +02003055{
Gilles Peskine449bd832023-01-11 14:50:10 +01003056 return conf->p_async_config_data;
Gilles Peskine8f97af72018-04-26 11:46:10 +02003057}
3058
Gilles Peskine449bd832023-01-11 14:50:10 +01003059void *mbedtls_ssl_get_async_operation_data(const mbedtls_ssl_context *ssl)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003060{
Gilles Peskine449bd832023-01-11 14:50:10 +01003061 if (ssl->handshake == NULL) {
3062 return NULL;
3063 } else {
3064 return ssl->handshake->user_async_ctx;
3065 }
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003066}
3067
Gilles Peskine449bd832023-01-11 14:50:10 +01003068void mbedtls_ssl_set_async_operation_data(mbedtls_ssl_context *ssl,
3069 void *ctx)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003070{
Gilles Peskine449bd832023-01-11 14:50:10 +01003071 if (ssl->handshake != NULL) {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003072 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01003073 }
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003074}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003075#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003076
Paul Bakker5121ce52009-01-03 21:22:43 +00003077/*
3078 * SSL get accessors
3079 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003080uint32_t mbedtls_ssl_get_verify_result(const mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00003081{
Gilles Peskine449bd832023-01-11 14:50:10 +01003082 if (ssl->session != NULL) {
3083 return ssl->session->verify_result;
3084 }
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00003085
Gilles Peskine449bd832023-01-11 14:50:10 +01003086 if (ssl->session_negotiate != NULL) {
3087 return ssl->session_negotiate->verify_result;
3088 }
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00003089
Gilles Peskine449bd832023-01-11 14:50:10 +01003090 return 0xFFFFFFFF;
Paul Bakker5121ce52009-01-03 21:22:43 +00003091}
3092
Gilles Peskine449bd832023-01-11 14:50:10 +01003093int mbedtls_ssl_get_ciphersuite_id_from_ssl(const mbedtls_ssl_context *ssl)
Glenn Strauss8f526902022-01-13 00:04:49 -05003094{
Gilles Peskine449bd832023-01-11 14:50:10 +01003095 if (ssl == NULL || ssl->session == NULL) {
3096 return 0;
3097 }
Glenn Strauss8f526902022-01-13 00:04:49 -05003098
Gilles Peskine449bd832023-01-11 14:50:10 +01003099 return ssl->session->ciphersuite;
Glenn Strauss8f526902022-01-13 00:04:49 -05003100}
3101
Gilles Peskine449bd832023-01-11 14:50:10 +01003102const char *mbedtls_ssl_get_ciphersuite(const mbedtls_ssl_context *ssl)
Paul Bakker72f62662011-01-16 21:27:44 +00003103{
Gilles Peskine449bd832023-01-11 14:50:10 +01003104 if (ssl == NULL || ssl->session == NULL) {
3105 return NULL;
3106 }
Paul Bakker926c8e42013-03-06 10:23:34 +01003107
Gilles Peskine449bd832023-01-11 14:50:10 +01003108 return mbedtls_ssl_get_ciphersuite_name(ssl->session->ciphersuite);
Paul Bakker72f62662011-01-16 21:27:44 +00003109}
3110
Gilles Peskine449bd832023-01-11 14:50:10 +01003111const char *mbedtls_ssl_get_version(const mbedtls_ssl_context *ssl)
Paul Bakker43ca69c2011-01-15 17:35:19 +00003112{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003113#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003114 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
3115 switch (ssl->tls_version) {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003116 case MBEDTLS_SSL_VERSION_TLS1_2:
Gilles Peskine449bd832023-01-11 14:50:10 +01003117 return "DTLSv1.2";
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003118 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003119 return "unknown (DTLS)";
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003120 }
3121 }
3122#endif
3123
Gilles Peskine449bd832023-01-11 14:50:10 +01003124 switch (ssl->tls_version) {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003125 case MBEDTLS_SSL_VERSION_TLS1_2:
Gilles Peskine449bd832023-01-11 14:50:10 +01003126 return "TLSv1.2";
Glenn Strauss60bfe602022-03-14 19:04:24 -04003127 case MBEDTLS_SSL_VERSION_TLS1_3:
Gilles Peskine449bd832023-01-11 14:50:10 +01003128 return "TLSv1.3";
Paul Bakker43ca69c2011-01-15 17:35:19 +00003129 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003130 return "unknown";
Paul Bakker43ca69c2011-01-15 17:35:19 +00003131 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00003132}
3133
Waleed Elmelegy6a971fd2023-12-28 17:48:16 +00003134#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
3135
3136size_t mbedtls_ssl_get_output_record_size_limit(const mbedtls_ssl_context *ssl)
3137{
3138 const size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
3139 size_t record_size_limit = max_len;
3140
3141 if (ssl->session != NULL &&
3142 ssl->session->record_size_limit >= MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN &&
3143 ssl->session->record_size_limit < max_len) {
3144 record_size_limit = ssl->session->record_size_limit;
3145 }
3146
3147 // TODO: this is currently untested
3148 /* During a handshake, use the value being negotiated */
3149 if (ssl->session_negotiate != NULL &&
3150 ssl->session_negotiate->record_size_limit >= MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN &&
3151 ssl->session_negotiate->record_size_limit < max_len) {
3152 record_size_limit = ssl->session_negotiate->record_size_limit;
3153 }
3154
3155 return record_size_limit;
3156}
3157#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
3158
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003159#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003160size_t mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context *ssl)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003161{
David Horstmann95d516f2021-05-04 18:36:56 +01003162 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003163 size_t read_mfl;
3164
Jerry Yuddda0502022-12-01 19:43:12 +08003165#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003166 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
Gilles Peskine449bd832023-01-11 14:50:10 +01003167 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
3168 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE) {
3169 return ssl_mfl_code_to_length(ssl->conf->mfl_code);
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003170 }
Jerry Yuddda0502022-12-01 19:43:12 +08003171#endif
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003172
3173 /* Check if a smaller max length was negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003174 if (ssl->session_out != NULL) {
3175 read_mfl = ssl_mfl_code_to_length(ssl->session_out->mfl_code);
3176 if (read_mfl < max_len) {
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003177 max_len = read_mfl;
3178 }
3179 }
3180
Jerry Yuddda0502022-12-01 19:43:12 +08003181 /* During a handshake, use the value being negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003182 if (ssl->session_negotiate != NULL) {
3183 read_mfl = ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code);
3184 if (read_mfl < max_len) {
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003185 max_len = read_mfl;
3186 }
3187 }
3188
Gilles Peskine449bd832023-01-11 14:50:10 +01003189 return max_len;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003190}
3191
Gilles Peskine449bd832023-01-11 14:50:10 +01003192size_t mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003193{
3194 size_t max_len;
3195
3196 /*
3197 * Assume mfl_code is correct since it was checked when set
3198 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003199 max_len = ssl_mfl_code_to_length(ssl->conf->mfl_code);
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003200
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003201 /* Check if a smaller max length was negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003202 if (ssl->session_out != NULL &&
3203 ssl_mfl_code_to_length(ssl->session_out->mfl_code) < max_len) {
3204 max_len = ssl_mfl_code_to_length(ssl->session_out->mfl_code);
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003205 }
3206
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003207 /* During a handshake, use the value being negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003208 if (ssl->session_negotiate != NULL &&
3209 ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code) < max_len) {
3210 max_len = ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code);
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003211 }
3212
Gilles Peskine449bd832023-01-11 14:50:10 +01003213 return max_len;
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003214}
3215#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
3216
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003217#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003218size_t mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003219{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04003220 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003221 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
3222 (ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
3223 ssl->state == MBEDTLS_SSL_SERVER_HELLO)) {
3224 return 0;
3225 }
Andrzej Kurekef43ce62018-10-09 08:24:12 -04003226
Gilles Peskine449bd832023-01-11 14:50:10 +01003227 if (ssl->handshake == NULL || ssl->handshake->mtu == 0) {
3228 return ssl->mtu;
3229 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003230
Gilles Peskine449bd832023-01-11 14:50:10 +01003231 if (ssl->mtu == 0) {
3232 return ssl->handshake->mtu;
3233 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003234
Gilles Peskine449bd832023-01-11 14:50:10 +01003235 return ssl->mtu < ssl->handshake->mtu ?
3236 ssl->mtu : ssl->handshake->mtu;
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003237}
3238#endif /* MBEDTLS_SSL_PROTO_DTLS */
3239
Gilles Peskine449bd832023-01-11 14:50:10 +01003240int mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003241{
3242 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
3243
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02003244#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
Jan Brucknerf482dcc2023-03-15 09:09:06 +01003245 !defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) && \
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02003246 !defined(MBEDTLS_SSL_PROTO_DTLS)
3247 (void) ssl;
3248#endif
3249
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003250#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003251 const size_t mfl = mbedtls_ssl_get_output_max_frag_len(ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003252
Gilles Peskine449bd832023-01-11 14:50:10 +01003253 if (max_len > mfl) {
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003254 max_len = mfl;
Gilles Peskine449bd832023-01-11 14:50:10 +01003255 }
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003256#endif
3257
Jan Brucknerf482dcc2023-03-15 09:09:06 +01003258#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
3259 const size_t record_size_limit = mbedtls_ssl_get_output_record_size_limit(ssl);
3260
3261 if (max_len > record_size_limit) {
3262 max_len = record_size_limit;
3263 }
3264#endif
3265
Waleed Elmelegy6a971fd2023-12-28 17:48:16 +00003266 if (ssl->transform_out != NULL &&
3267 ssl->transform_out->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Waleed Elmelegyf5017902024-01-09 14:18:34 +00003268 /*
3269 * In TLS 1.3 case, when records are protected, `max_len` as computed
3270 * above is the maximum length of the TLSInnerPlaintext structure that
3271 * along the plaintext payload contains the inner content type (one byte)
3272 * and some zero padding. Given the algorithm used for padding
3273 * in mbedtls_ssl_encrypt_buf(), compute the maximum length for
3274 * the plaintext payload. Round down to a multiple of
3275 * MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY and
3276 * subtract 1.
Waleed Elmelegy6a971fd2023-12-28 17:48:16 +00003277 */
3278 max_len = ((max_len / MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) *
3279 MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) - 1;
3280 }
3281
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003282#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003283 if (mbedtls_ssl_get_current_mtu(ssl) != 0) {
3284 const size_t mtu = mbedtls_ssl_get_current_mtu(ssl);
3285 const int ret = mbedtls_ssl_get_record_expansion(ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003286 const size_t overhead = (size_t) ret;
3287
Gilles Peskine449bd832023-01-11 14:50:10 +01003288 if (ret < 0) {
3289 return ret;
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003290 }
3291
Gilles Peskine449bd832023-01-11 14:50:10 +01003292 if (mtu <= overhead) {
3293 MBEDTLS_SSL_DEBUG_MSG(1, ("MTU too low for record expansion"));
3294 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3295 }
3296
3297 if (max_len > mtu - overhead) {
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003298 max_len = mtu - overhead;
Gilles Peskine449bd832023-01-11 14:50:10 +01003299 }
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003300 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003301#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003302
Hanno Becker0defedb2018-08-10 12:35:02 +01003303#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
Waleed Elmelegy049cd302023-12-20 17:28:31 +00003304 !defined(MBEDTLS_SSL_PROTO_DTLS) && \
3305 !defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
Hanno Becker0defedb2018-08-10 12:35:02 +01003306 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003307#endif
3308
Gilles Peskine449bd832023-01-11 14:50:10 +01003309 return (int) max_len;
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003310}
3311
Gilles Peskine449bd832023-01-11 14:50:10 +01003312int mbedtls_ssl_get_max_in_record_payload(const mbedtls_ssl_context *ssl)
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003313{
3314 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
3315
3316#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3317 (void) ssl;
3318#endif
3319
3320#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003321 const size_t mfl = mbedtls_ssl_get_input_max_frag_len(ssl);
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003322
Gilles Peskine449bd832023-01-11 14:50:10 +01003323 if (max_len > mfl) {
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003324 max_len = mfl;
Gilles Peskine449bd832023-01-11 14:50:10 +01003325 }
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003326#endif
3327
Gilles Peskine449bd832023-01-11 14:50:10 +01003328 return (int) max_len;
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003329}
3330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003331#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003332const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert(const mbedtls_ssl_context *ssl)
Paul Bakkerb0550d92012-10-30 07:51:03 +00003333{
Gilles Peskine449bd832023-01-11 14:50:10 +01003334 if (ssl == NULL || ssl->session == NULL) {
3335 return NULL;
3336 }
Paul Bakkerb0550d92012-10-30 07:51:03 +00003337
Hanno Beckere6824572019-02-07 13:18:46 +00003338#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01003339 return ssl->session->peer_cert;
Hanno Beckere6824572019-02-07 13:18:46 +00003340#else
Gilles Peskine449bd832023-01-11 14:50:10 +01003341 return NULL;
Hanno Beckere6824572019-02-07 13:18:46 +00003342#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00003343}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003344#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00003345
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003346#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003347int mbedtls_ssl_get_session(const mbedtls_ssl_context *ssl,
3348 mbedtls_ssl_session *dst)
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003349{
Hanno Beckere810bbc2021-05-14 16:01:05 +01003350 int ret;
3351
Gilles Peskine449bd832023-01-11 14:50:10 +01003352 if (ssl == NULL ||
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003353 dst == NULL ||
3354 ssl->session == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01003355 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT) {
3356 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003357 }
3358
Hanno Beckere810bbc2021-05-14 16:01:05 +01003359 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
3360 * idempotent: Each session can only be exported once.
3361 *
3362 * (This is in preparation for TLS 1.3 support where we will
3363 * need the ability to export multiple sessions (aka tickets),
3364 * which will be achieved by calling mbedtls_ssl_get_session()
3365 * multiple times until it fails.)
3366 *
3367 * Check whether we have already exported the current session,
3368 * and fail if so.
3369 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003370 if (ssl->session->exported == 1) {
3371 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3372 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01003373
Gilles Peskine449bd832023-01-11 14:50:10 +01003374 ret = mbedtls_ssl_session_copy(dst, ssl->session);
3375 if (ret != 0) {
3376 return ret;
3377 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01003378
3379 /* Remember that we've exported the session. */
3380 ssl->session->exported = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003381 return 0;
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003382}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003383#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003384
David Horstmanncb01b362024-02-29 17:31:46 +00003385#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3386
3387/* Serialization of TLS 1.2 sessions
David Horstmanne59f9702024-02-29 16:08:57 +00003388 *
David Horstmanncb01b362024-02-29 17:31:46 +00003389 * For more detail, see the description of ssl_session_save().
David Horstmanne59f9702024-02-29 16:08:57 +00003390 */
3391static size_t ssl_tls12_session_save(const mbedtls_ssl_session *session,
3392 unsigned char *buf,
3393 size_t buf_len)
3394{
3395 unsigned char *p = buf;
3396 size_t used = 0;
3397
3398#if defined(MBEDTLS_HAVE_TIME)
3399 uint64_t start;
3400#endif
3401#if defined(MBEDTLS_X509_CRT_PARSE_C)
3402#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3403 size_t cert_len;
3404#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3405#endif /* MBEDTLS_X509_CRT_PARSE_C */
3406
3407 /*
3408 * Time
3409 */
3410#if defined(MBEDTLS_HAVE_TIME)
3411 used += 8;
3412
3413 if (used <= buf_len) {
3414 start = (uint64_t) session->start;
3415
3416 MBEDTLS_PUT_UINT64_BE(start, p, 0);
3417 p += 8;
3418 }
3419#endif /* MBEDTLS_HAVE_TIME */
3420
3421 /*
3422 * Basic mandatory fields
3423 */
3424 used += 1 /* id_len */
3425 + sizeof(session->id)
3426 + sizeof(session->master)
3427 + 4; /* verify_result */
3428
3429 if (used <= buf_len) {
3430 *p++ = MBEDTLS_BYTE_0(session->id_len);
3431 memcpy(p, session->id, 32);
3432 p += 32;
3433
3434 memcpy(p, session->master, 48);
3435 p += 48;
3436
3437 MBEDTLS_PUT_UINT32_BE(session->verify_result, p, 0);
3438 p += 4;
3439 }
3440
3441 /*
3442 * Peer's end-entity certificate
3443 */
3444#if defined(MBEDTLS_X509_CRT_PARSE_C)
3445#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3446 if (session->peer_cert == NULL) {
3447 cert_len = 0;
3448 } else {
3449 cert_len = session->peer_cert->raw.len;
3450 }
3451
3452 used += 3 + cert_len;
3453
3454 if (used <= buf_len) {
3455 *p++ = MBEDTLS_BYTE_2(cert_len);
3456 *p++ = MBEDTLS_BYTE_1(cert_len);
3457 *p++ = MBEDTLS_BYTE_0(cert_len);
3458
3459 if (session->peer_cert != NULL) {
3460 memcpy(p, session->peer_cert->raw.p, cert_len);
3461 p += cert_len;
3462 }
3463 }
3464#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3465 if (session->peer_cert_digest != NULL) {
3466 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
3467 if (used <= buf_len) {
3468 *p++ = (unsigned char) session->peer_cert_digest_type;
3469 *p++ = (unsigned char) session->peer_cert_digest_len;
3470 memcpy(p, session->peer_cert_digest,
3471 session->peer_cert_digest_len);
3472 p += session->peer_cert_digest_len;
3473 }
3474 } else {
3475 used += 2;
3476 if (used <= buf_len) {
3477 *p++ = (unsigned char) MBEDTLS_MD_NONE;
3478 *p++ = 0;
3479 }
3480 }
3481#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3482#endif /* MBEDTLS_X509_CRT_PARSE_C */
3483
3484 /*
3485 * Session ticket if any, plus associated data
3486 */
3487#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3488#if defined(MBEDTLS_SSL_CLI_C)
3489 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
3490 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
3491
3492 if (used <= buf_len) {
3493 *p++ = MBEDTLS_BYTE_2(session->ticket_len);
3494 *p++ = MBEDTLS_BYTE_1(session->ticket_len);
3495 *p++ = MBEDTLS_BYTE_0(session->ticket_len);
3496
3497 if (session->ticket != NULL) {
3498 memcpy(p, session->ticket, session->ticket_len);
3499 p += session->ticket_len;
3500 }
3501
3502 MBEDTLS_PUT_UINT32_BE(session->ticket_lifetime, p, 0);
3503 p += 4;
3504 }
3505 }
3506#endif /* MBEDTLS_SSL_CLI_C */
3507#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
3508 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
3509 used += 8;
3510
3511 if (used <= buf_len) {
3512 MBEDTLS_PUT_UINT64_BE((uint64_t) session->ticket_creation_time, p, 0);
3513 p += 8;
3514 }
3515 }
3516#endif /* MBEDTLS_HAVE_TIME && MBEDTLS_SSL_SRV_C */
3517#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3518
3519 /*
3520 * Misc extension-related info
3521 */
3522#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3523 used += 1;
3524
3525 if (used <= buf_len) {
3526 *p++ = session->mfl_code;
3527 }
3528#endif
3529
3530#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
3531 used += 1;
3532
3533 if (used <= buf_len) {
3534 *p++ = MBEDTLS_BYTE_0(session->encrypt_then_mac);
3535 }
3536#endif
3537
3538 return used;
3539}
3540
3541MBEDTLS_CHECK_RETURN_CRITICAL
3542static int ssl_tls12_session_load(mbedtls_ssl_session *session,
3543 const unsigned char *buf,
3544 size_t len)
3545{
3546#if defined(MBEDTLS_HAVE_TIME)
3547 uint64_t start;
3548#endif
3549#if defined(MBEDTLS_X509_CRT_PARSE_C)
3550#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3551 size_t cert_len;
3552#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3553#endif /* MBEDTLS_X509_CRT_PARSE_C */
3554
3555 const unsigned char *p = buf;
3556 const unsigned char * const end = buf + len;
3557
3558 /*
3559 * Time
3560 */
3561#if defined(MBEDTLS_HAVE_TIME)
3562 if (8 > (size_t) (end - p)) {
3563 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3564 }
3565
3566 start = MBEDTLS_GET_UINT64_BE(p, 0);
3567 p += 8;
3568
3569 session->start = (time_t) start;
3570#endif /* MBEDTLS_HAVE_TIME */
3571
3572 /*
3573 * Basic mandatory fields
3574 */
3575 if (1 + 32 + 48 + 4 > (size_t) (end - p)) {
3576 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3577 }
3578
3579 session->id_len = *p++;
3580 memcpy(session->id, p, 32);
3581 p += 32;
3582
3583 memcpy(session->master, p, 48);
3584 p += 48;
3585
3586 session->verify_result = MBEDTLS_GET_UINT32_BE(p, 0);
3587 p += 4;
3588
3589 /* Immediately clear invalid pointer values that have been read, in case
3590 * we exit early before we replaced them with valid ones. */
3591#if defined(MBEDTLS_X509_CRT_PARSE_C)
3592#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3593 session->peer_cert = NULL;
3594#else
3595 session->peer_cert_digest = NULL;
3596#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3597#endif /* MBEDTLS_X509_CRT_PARSE_C */
3598#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
3599 session->ticket = NULL;
3600#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
3601
3602 /*
3603 * Peer certificate
3604 */
3605#if defined(MBEDTLS_X509_CRT_PARSE_C)
3606#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3607 /* Deserialize CRT from the end of the ticket. */
3608 if (3 > (size_t) (end - p)) {
3609 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3610 }
3611
3612 cert_len = MBEDTLS_GET_UINT24_BE(p, 0);
3613 p += 3;
3614
3615 if (cert_len != 0) {
3616 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3617
3618 if (cert_len > (size_t) (end - p)) {
3619 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3620 }
3621
3622 session->peer_cert = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
3623
3624 if (session->peer_cert == NULL) {
3625 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
3626 }
3627
3628 mbedtls_x509_crt_init(session->peer_cert);
3629
3630 if ((ret = mbedtls_x509_crt_parse_der(session->peer_cert,
3631 p, cert_len)) != 0) {
3632 mbedtls_x509_crt_free(session->peer_cert);
3633 mbedtls_free(session->peer_cert);
3634 session->peer_cert = NULL;
3635 return ret;
3636 }
3637
3638 p += cert_len;
3639 }
3640#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3641 /* Deserialize CRT digest from the end of the ticket. */
3642 if (2 > (size_t) (end - p)) {
3643 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3644 }
3645
3646 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
3647 session->peer_cert_digest_len = (size_t) *p++;
3648
3649 if (session->peer_cert_digest_len != 0) {
3650 const mbedtls_md_info_t *md_info =
3651 mbedtls_md_info_from_type(session->peer_cert_digest_type);
3652 if (md_info == NULL) {
3653 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3654 }
3655 if (session->peer_cert_digest_len != mbedtls_md_get_size(md_info)) {
3656 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3657 }
3658
3659 if (session->peer_cert_digest_len > (size_t) (end - p)) {
3660 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3661 }
3662
3663 session->peer_cert_digest =
3664 mbedtls_calloc(1, session->peer_cert_digest_len);
3665 if (session->peer_cert_digest == NULL) {
3666 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
3667 }
3668
3669 memcpy(session->peer_cert_digest, p,
3670 session->peer_cert_digest_len);
3671 p += session->peer_cert_digest_len;
3672 }
3673#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3674#endif /* MBEDTLS_X509_CRT_PARSE_C */
3675
3676 /*
3677 * Session ticket and associated data
3678 */
3679#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3680#if defined(MBEDTLS_SSL_CLI_C)
3681 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
3682 if (3 > (size_t) (end - p)) {
3683 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3684 }
3685
3686 session->ticket_len = MBEDTLS_GET_UINT24_BE(p, 0);
3687 p += 3;
3688
3689 if (session->ticket_len != 0) {
3690 if (session->ticket_len > (size_t) (end - p)) {
3691 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3692 }
3693
3694 session->ticket = mbedtls_calloc(1, session->ticket_len);
3695 if (session->ticket == NULL) {
3696 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
3697 }
3698
3699 memcpy(session->ticket, p, session->ticket_len);
3700 p += session->ticket_len;
3701 }
3702
3703 if (4 > (size_t) (end - p)) {
3704 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3705 }
3706
3707 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE(p, 0);
3708 p += 4;
3709 }
3710#endif /* MBEDTLS_SSL_CLI_C */
3711#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
3712 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
3713 if (8 > (size_t) (end - p)) {
3714 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3715 }
3716 session->ticket_creation_time = MBEDTLS_GET_UINT64_BE(p, 0);
3717 p += 8;
3718 }
3719#endif /* MBEDTLS_HAVE_TIME && MBEDTLS_SSL_SRV_C */
3720#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3721
3722 /*
3723 * Misc extension-related info
3724 */
3725#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3726 if (1 > (size_t) (end - p)) {
3727 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3728 }
3729
3730 session->mfl_code = *p++;
3731#endif
3732
3733#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
3734 if (1 > (size_t) (end - p)) {
3735 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3736 }
3737
3738 session->encrypt_then_mac = *p++;
3739#endif
3740
3741 /* Done, should have consumed entire buffer */
3742 if (p != end) {
3743 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3744 }
3745
3746 return 0;
3747}
3748
3749#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3750
3751#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3752/* Serialization of TLS 1.3 sessions:
3753 *
David Horstmanncb01b362024-02-29 17:31:46 +00003754 * For more detail, see the description of ssl_session_save().
David Horstmanne59f9702024-02-29 16:08:57 +00003755 */
3756#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3757MBEDTLS_CHECK_RETURN_CRITICAL
3758static int ssl_tls13_session_save(const mbedtls_ssl_session *session,
3759 unsigned char *buf,
3760 size_t buf_len,
3761 size_t *olen)
3762{
3763 unsigned char *p = buf;
3764#if defined(MBEDTLS_SSL_CLI_C) && \
3765 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3766 size_t hostname_len = (session->hostname == NULL) ?
3767 0 : strlen(session->hostname) + 1;
3768#endif
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003769
3770#if defined(MBEDTLS_SSL_SRV_C) && \
3771 defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN)
Waleed Elmelegydaa4da72024-03-13 16:25:34 +00003772 const size_t alpn_len = (session->ticket_alpn == NULL) ?
Waleed Elmelegyb28ab0a2024-03-13 16:48:28 +00003773 0 : strlen(session->ticket_alpn) + 1;
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003774#endif
David Horstmanne59f9702024-02-29 16:08:57 +00003775 size_t needed = 4 /* ticket_age_add */
3776 + 1 /* ticket_flags */
3777 + 1; /* resumption_key length */
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003778
David Horstmanne59f9702024-02-29 16:08:57 +00003779 *olen = 0;
3780
3781 if (session->resumption_key_len > MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN) {
3782 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3783 }
3784 needed += session->resumption_key_len; /* resumption_key */
3785
3786#if defined(MBEDTLS_SSL_EARLY_DATA)
3787 needed += 4; /* max_early_data_size */
3788#endif
3789#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
3790 needed += 2; /* record_size_limit */
3791#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
3792
3793#if defined(MBEDTLS_HAVE_TIME)
3794 needed += 8; /* ticket_creation_time or ticket_reception_time */
3795#endif
3796
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003797#if defined(MBEDTLS_SSL_SRV_C)
3798 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
3799#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN)
Waleed Elmelegydaa4da72024-03-13 16:25:34 +00003800 needed += 2 /* alpn_len */
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003801 + alpn_len; /* alpn */
3802#endif
3803 }
3804#endif /* MBEDTLS_SSL_SRV_C */
3805
David Horstmanne59f9702024-02-29 16:08:57 +00003806#if defined(MBEDTLS_SSL_CLI_C)
3807 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
3808#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3809 needed += 2 /* hostname_len */
3810 + hostname_len; /* hostname */
3811#endif
3812
3813 needed += 4 /* ticket_lifetime */
3814 + 2; /* ticket_len */
3815
3816 /* Check size_t overflow */
3817 if (session->ticket_len > SIZE_MAX - needed) {
3818 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3819 }
3820
3821 needed += session->ticket_len; /* ticket */
3822 }
3823#endif /* MBEDTLS_SSL_CLI_C */
3824
3825 *olen = needed;
3826 if (needed > buf_len) {
3827 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
3828 }
3829
3830 MBEDTLS_PUT_UINT32_BE(session->ticket_age_add, p, 0);
3831 p[4] = session->ticket_flags;
3832
3833 /* save resumption_key */
3834 p[5] = session->resumption_key_len;
3835 p += 6;
3836 memcpy(p, session->resumption_key, session->resumption_key_len);
3837 p += session->resumption_key_len;
3838
3839#if defined(MBEDTLS_SSL_EARLY_DATA)
3840 MBEDTLS_PUT_UINT32_BE(session->max_early_data_size, p, 0);
3841 p += 4;
3842#endif
3843#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
3844 MBEDTLS_PUT_UINT16_BE(session->record_size_limit, p, 0);
3845 p += 2;
3846#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
3847
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003848#if defined(MBEDTLS_SSL_SRV_C)
David Horstmanne59f9702024-02-29 16:08:57 +00003849 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003850#if defined(MBEDTLS_HAVE_TIME)
David Horstmanne59f9702024-02-29 16:08:57 +00003851 MBEDTLS_PUT_UINT64_BE((uint64_t) session->ticket_creation_time, p, 0);
3852 p += 8;
David Horstmanne59f9702024-02-29 16:08:57 +00003853#endif /* MBEDTLS_HAVE_TIME */
3854
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003855#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN)
Waleed Elmelegydaa4da72024-03-13 16:25:34 +00003856 MBEDTLS_PUT_UINT16_BE(alpn_len, p, 0);
3857 p += 2;
3858
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003859 if (alpn_len > 0) {
3860 /* save chosen alpn */
Waleed Elmelegy883f77c2024-03-06 19:09:41 +00003861 memcpy(p, session->ticket_alpn, alpn_len);
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003862 p += alpn_len;
3863 }
3864#endif /* MBEDTLS_SSL_EARLY_DATA && MBEDTLS_SSL_ALPN */
3865 }
3866#endif /* MBEDTLS_SSL_SRV_C */
3867
David Horstmanne59f9702024-02-29 16:08:57 +00003868#if defined(MBEDTLS_SSL_CLI_C)
3869 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
3870#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3871 MBEDTLS_PUT_UINT16_BE(hostname_len, p, 0);
3872 p += 2;
3873 if (hostname_len > 0) {
3874 /* save host name */
3875 memcpy(p, session->hostname, hostname_len);
3876 p += hostname_len;
3877 }
3878#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
3879
3880#if defined(MBEDTLS_HAVE_TIME)
3881 MBEDTLS_PUT_UINT64_BE((uint64_t) session->ticket_reception_time, p, 0);
3882 p += 8;
3883#endif
3884 MBEDTLS_PUT_UINT32_BE(session->ticket_lifetime, p, 0);
3885 p += 4;
3886
3887 MBEDTLS_PUT_UINT16_BE(session->ticket_len, p, 0);
3888 p += 2;
3889
3890 if (session->ticket != NULL && session->ticket_len > 0) {
3891 memcpy(p, session->ticket, session->ticket_len);
3892 p += session->ticket_len;
3893 }
3894 }
3895#endif /* MBEDTLS_SSL_CLI_C */
3896 return 0;
3897}
3898
3899MBEDTLS_CHECK_RETURN_CRITICAL
3900static int ssl_tls13_session_load(mbedtls_ssl_session *session,
3901 const unsigned char *buf,
3902 size_t len)
3903{
3904 const unsigned char *p = buf;
3905 const unsigned char *end = buf + len;
3906
3907 if (end - p < 6) {
3908 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3909 }
3910 session->ticket_age_add = MBEDTLS_GET_UINT32_BE(p, 0);
3911 session->ticket_flags = p[4];
3912
3913 /* load resumption_key */
3914 session->resumption_key_len = p[5];
3915 p += 6;
3916
3917 if (end - p < session->resumption_key_len) {
3918 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3919 }
3920
3921 if (sizeof(session->resumption_key) < session->resumption_key_len) {
3922 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3923 }
3924 memcpy(session->resumption_key, p, session->resumption_key_len);
3925 p += session->resumption_key_len;
3926
3927#if defined(MBEDTLS_SSL_EARLY_DATA)
3928 if (end - p < 4) {
3929 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3930 }
3931 session->max_early_data_size = MBEDTLS_GET_UINT32_BE(p, 0);
3932 p += 4;
3933#endif
3934#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
3935 if (end - p < 2) {
3936 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3937 }
3938 session->record_size_limit = MBEDTLS_GET_UINT16_BE(p, 0);
3939 p += 2;
3940#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
3941
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003942#if defined(MBEDTLS_SSL_SRV_C)
David Horstmanne59f9702024-02-29 16:08:57 +00003943 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003944#if defined(MBEDTLS_HAVE_TIME)
David Horstmanne59f9702024-02-29 16:08:57 +00003945 if (end - p < 8) {
3946 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3947 }
3948 session->ticket_creation_time = MBEDTLS_GET_UINT64_BE(p, 0);
3949 p += 8;
David Horstmanne59f9702024-02-29 16:08:57 +00003950#endif /* MBEDTLS_HAVE_TIME */
3951
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003952#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN)
Waleed Elmelegydaa4da72024-03-13 16:25:34 +00003953 size_t alpn_len;
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003954
Waleed Elmelegydaa4da72024-03-13 16:25:34 +00003955 if (end - p < 2) {
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003956 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3957 }
Waleed Elmelegy883f77c2024-03-06 19:09:41 +00003958
Waleed Elmelegydaa4da72024-03-13 16:25:34 +00003959 alpn_len = MBEDTLS_GET_UINT16_BE(p, 0);
3960 p += 2;
3961
3962 if (end - p < (long int) alpn_len) {
Waleed Elmelegy7dfba342024-03-12 16:22:39 +00003963 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3964 }
3965
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003966 if (alpn_len > 0) {
Waleed Elmelegydaa4da72024-03-13 16:25:34 +00003967 int ret = mbedtls_ssl_session_set_ticket_alpn(session, (char *) p);
3968 if (ret != 0) {
3969 return ret;
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003970 }
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003971 p += alpn_len;
3972 }
3973#endif /* MBEDTLS_SSL_EARLY_DATA && MBEDTLS_SSL_ALPN */
3974 }
3975#endif /* MBEDTLS_SSL_SRV_C */
3976
David Horstmanne59f9702024-02-29 16:08:57 +00003977#if defined(MBEDTLS_SSL_CLI_C)
3978 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
3979#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3980 size_t hostname_len;
3981 /* load host name */
3982 if (end - p < 2) {
3983 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3984 }
3985 hostname_len = MBEDTLS_GET_UINT16_BE(p, 0);
3986 p += 2;
3987
3988 if (end - p < (long int) hostname_len) {
3989 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3990 }
3991 if (hostname_len > 0) {
3992 session->hostname = mbedtls_calloc(1, hostname_len);
3993 if (session->hostname == NULL) {
3994 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
3995 }
3996 memcpy(session->hostname, p, hostname_len);
3997 p += hostname_len;
3998 }
3999#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
4000
4001#if defined(MBEDTLS_HAVE_TIME)
4002 if (end - p < 8) {
4003 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4004 }
4005 session->ticket_reception_time = MBEDTLS_GET_UINT64_BE(p, 0);
4006 p += 8;
4007#endif
4008 if (end - p < 4) {
4009 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4010 }
4011 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE(p, 0);
4012 p += 4;
4013
4014 if (end - p < 2) {
4015 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4016 }
4017 session->ticket_len = MBEDTLS_GET_UINT16_BE(p, 0);
4018 p += 2;
4019
4020 if (end - p < (long int) session->ticket_len) {
4021 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4022 }
4023 if (session->ticket_len > 0) {
4024 session->ticket = mbedtls_calloc(1, session->ticket_len);
4025 if (session->ticket == NULL) {
4026 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
4027 }
4028 memcpy(session->ticket, p, session->ticket_len);
4029 p += session->ticket_len;
4030 }
4031 }
4032#endif /* MBEDTLS_SSL_CLI_C */
4033
4034 return 0;
4035
4036}
4037#else /* MBEDTLS_SSL_SESSION_TICKETS */
4038MBEDTLS_CHECK_RETURN_CRITICAL
4039static int ssl_tls13_session_save(const mbedtls_ssl_session *session,
4040 unsigned char *buf,
4041 size_t buf_len,
4042 size_t *olen)
4043{
4044 ((void) session);
4045 ((void) buf);
4046 ((void) buf_len);
4047 *olen = 0;
4048 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
4049}
4050
4051static int ssl_tls13_session_load(const mbedtls_ssl_session *session,
Norbert Fabritius93b2c322023-01-24 17:48:29 +01004052 const unsigned char *buf,
David Horstmanne59f9702024-02-29 16:08:57 +00004053 size_t buf_len)
4054{
4055 ((void) session);
4056 ((void) buf);
4057 ((void) buf_len);
4058 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
4059}
4060#endif /* !MBEDTLS_SSL_SESSION_TICKETS */
4061#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
4062
Paul Bakker5121ce52009-01-03 21:22:43 +00004063/*
Hanno Beckera835da52019-05-16 12:39:07 +01004064 * Define ticket header determining Mbed TLS version
4065 * and structure of the ticket.
4066 */
4067
Hanno Becker94ef3b32019-05-16 12:50:45 +01004068/*
Hanno Becker50b59662019-05-28 14:30:45 +01004069 * Define bitflag determining compile-time settings influencing
4070 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01004071 */
4072
Hanno Becker50b59662019-05-28 14:30:45 +01004073#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01004074#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01004075#else
Hanno Becker3e088662019-05-29 11:10:18 +01004076#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004077#endif /* MBEDTLS_HAVE_TIME */
4078
4079#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01004080#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004081#else
Hanno Becker3e088662019-05-29 11:10:18 +01004082#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004083#endif /* MBEDTLS_X509_CRT_PARSE_C */
4084
David Horstmann5c5a32f2024-02-13 17:53:35 +00004085#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
David Horstmannf686f1d2024-03-01 11:20:32 +00004086#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_PEER_CRT 1
David Horstmann5c5a32f2024-02-13 17:53:35 +00004087#else
David Horstmannf686f1d2024-03-01 11:20:32 +00004088#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_PEER_CRT 0
David Horstmann5c5a32f2024-02-13 17:53:35 +00004089#endif /* MBEDTLS_SSL_SESSION_TICKETS */
4090
Hanno Becker94ef3b32019-05-16 12:50:45 +01004091#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01004092#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004093#else
Hanno Becker3e088662019-05-29 11:10:18 +01004094#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004095#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
4096
4097#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01004098#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004099#else
Hanno Becker3e088662019-05-29 11:10:18 +01004100#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004101#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4102
Hanno Becker94ef3b32019-05-16 12:50:45 +01004103#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01004104#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01004105#else
Hanno Becker3e088662019-05-29 11:10:18 +01004106#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01004107#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
4108
Hanno Becker94ef3b32019-05-16 12:50:45 +01004109#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4110#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
4111#else
4112#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
4113#endif /* MBEDTLS_SSL_SESSION_TICKETS */
4114
David Horstmann92b258b2024-02-13 17:23:34 +00004115#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
4116#define SSL_SERIALIZED_SESSION_CONFIG_SNI 1
4117#else
4118#define SSL_SERIALIZED_SESSION_CONFIG_SNI 0
4119#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
4120
4121#if defined(MBEDTLS_SSL_EARLY_DATA)
4122#define SSL_SERIALIZED_SESSION_CONFIG_EARLY_DATA 1
4123#else
4124#define SSL_SERIALIZED_SESSION_CONFIG_EARLY_DATA 0
4125#endif /* MBEDTLS_SSL_EARLY_DATA */
4126
4127#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
4128#define SSL_SERIALIZED_SESSION_CONFIG_RECORD_SIZE 1
4129#else
4130#define SSL_SERIALIZED_SESSION_CONFIG_RECORD_SIZE 0
4131#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
4132
Waleed Elmelegy7dfba342024-03-12 16:22:39 +00004133#if defined(MBEDTLS_SSL_ALPN) && defined(MBEDTLS_SSL_SRV_C) && \
4134 defined(MBEDTLS_SSL_EARLY_DATA)
Waleed Elmelegy11025632024-03-07 15:25:52 +00004135#define SSL_SERIALIZED_SESSION_CONFIG_ALPN 1
4136#else
4137#define SSL_SERIALIZED_SESSION_CONFIG_ALPN 0
4138#endif /* MBEDTLS_SSL_ALPN */
4139
Hanno Becker3e088662019-05-29 11:10:18 +01004140#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
4141#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
4142#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
4143#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01004144#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
4145#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
David Horstmannf686f1d2024-03-01 11:20:32 +00004146#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_PEER_CRT_BIT 6
David Horstmann92b258b2024-02-13 17:23:34 +00004147#define SSL_SERIALIZED_SESSION_CONFIG_SNI_BIT 7
4148#define SSL_SERIALIZED_SESSION_CONFIG_EARLY_DATA_BIT 8
4149#define SSL_SERIALIZED_SESSION_CONFIG_RECORD_SIZE_BIT 9
Waleed Elmelegy11025632024-03-07 15:25:52 +00004150#define SSL_SERIALIZED_SESSION_CONFIG_ALPN_BIT 10
Hanno Becker3e088662019-05-29 11:10:18 +01004151
Hanno Becker50b59662019-05-28 14:30:45 +01004152#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Gilles Peskine449bd832023-01-11 14:50:10 +01004153 ((uint16_t) ( \
4154 (SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT) | \
4155 (SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT) | \
4156 (SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << \
4157 SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT) | \
4158 (SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT) | \
4159 (SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT) | \
David Horstmann5c5a32f2024-02-13 17:53:35 +00004160 (SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT) | \
David Horstmann71fa1a92024-03-01 12:32:18 +00004161 (SSL_SERIALIZED_SESSION_CONFIG_KEEP_PEER_CRT << \
4162 SSL_SERIALIZED_SESSION_CONFIG_KEEP_PEER_CRT_BIT) | \
David Horstmann92b258b2024-02-13 17:23:34 +00004163 (SSL_SERIALIZED_SESSION_CONFIG_SNI << SSL_SERIALIZED_SESSION_CONFIG_SNI_BIT) | \
4164 (SSL_SERIALIZED_SESSION_CONFIG_EARLY_DATA << \
4165 SSL_SERIALIZED_SESSION_CONFIG_EARLY_DATA_BIT) | \
4166 (SSL_SERIALIZED_SESSION_CONFIG_RECORD_SIZE << \
Waleed Elmelegy11025632024-03-07 15:25:52 +00004167 SSL_SERIALIZED_SESSION_CONFIG_RECORD_SIZE_BIT) | \
Waleed Elmelegy75e33fa2024-03-07 16:57:58 +00004168 (SSL_SERIALIZED_SESSION_CONFIG_ALPN << \
Waleed Elmelegy11025632024-03-07 15:25:52 +00004169 SSL_SERIALIZED_SESSION_CONFIG_ALPN_BIT)))
Hanno Becker94ef3b32019-05-16 12:50:45 +01004170
Chien Wong4e9683e2023-12-28 17:07:43 +08004171static const unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01004172 MBEDTLS_VERSION_MAJOR,
4173 MBEDTLS_VERSION_MINOR,
4174 MBEDTLS_VERSION_PATCH,
Gilles Peskine449bd832023-01-11 14:50:10 +01004175 MBEDTLS_BYTE_1(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
4176 MBEDTLS_BYTE_0(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
Hanno Beckerf8787072019-05-16 12:41:07 +01004177};
Hanno Beckera835da52019-05-16 12:39:07 +01004178
4179/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004180 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02004181 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004182 *
David Horstmanncb01b362024-02-29 17:31:46 +00004183 * TLS 1.2 session:
4184 *
4185 * struct {
4186 * #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4187 * opaque ticket<0..2^24-1>; // length 0 means no ticket
4188 * uint32 ticket_lifetime;
4189 * #endif
4190 * } ClientOnlyData;
4191 *
4192 * struct {
4193 * #if defined(MBEDTLS_HAVE_TIME)
4194 * uint64 start_time;
4195 * #endif
4196 * uint8 session_id_len; // at most 32
4197 * opaque session_id[32];
4198 * opaque master[48]; // fixed length in the standard
4199 * uint32 verify_result;
4200 * #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
4201 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
4202 * #else
David Horstmann76ba26a2024-03-01 12:03:35 +00004203 * uint8 peer_cert_digest_type;
David Horstmanncb01b362024-02-29 17:31:46 +00004204 * opaque peer_cert_digest<0..2^8-1>
4205 * #endif
4206 * select (endpoint) {
4207 * case client: ClientOnlyData;
4208 * case server: uint64 ticket_creation_time;
4209 * };
4210 * #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4211 * uint8 mfl_code; // up to 255 according to standard
4212 * #endif
4213 * #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4214 * uint8 encrypt_then_mac; // 0 or 1
4215 * #endif
4216 * } serialized_session_tls12;
4217 *
4218 *
4219 * TLS 1.3 Session:
4220 *
4221 * struct {
4222 * #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
4223 * opaque hostname<0..2^16-1>;
4224 * #endif
4225 * #if defined(MBEDTLS_HAVE_TIME)
4226 * uint64 ticket_reception_time;
4227 * #endif
4228 * uint32 ticket_lifetime;
4229 * opaque ticket<1..2^16-1>;
4230 * } ClientOnlyData;
4231 *
4232 * struct {
4233 * uint32 ticket_age_add;
4234 * uint8 ticket_flags;
4235 * opaque resumption_key<0..255>;
4236 * #if defined(MBEDTLS_SSL_EARLY_DATA)
4237 * uint32 max_early_data_size;
4238 * #endif
4239 * #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
4240 * uint16 record_size_limit;
4241 * #endif
4242 * select ( endpoint ) {
4243 * case client: ClientOnlyData;
Waleed Elmelegy7dfba342024-03-12 16:22:39 +00004244 * case server:
David Horstmanncb01b362024-02-29 17:31:46 +00004245 * #if defined(MBEDTLS_HAVE_TIME)
Waleed Elmelegy7dfba342024-03-12 16:22:39 +00004246 * uint64 ticket_creation_time;
David Horstmanncb01b362024-02-29 17:31:46 +00004247 * #endif
Waleed Elmelegyfe9ae082024-03-07 15:47:31 +00004248 * #if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN)
Waleed Elmelegydaa4da72024-03-13 16:25:34 +00004249 * opaque ticket_alpn<0..256>;
David Horstmanncb01b362024-02-29 17:31:46 +00004250 * #endif
4251 * };
4252 * } serialized_session_tls13;
4253 *
4254 *
4255 * SSL session:
4256 *
4257 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01004258 *
Hanno Beckerdce50972021-08-01 05:39:23 +01004259 * opaque mbedtls_version[3]; // library version: major, minor, patch
4260 * opaque session_format[2]; // library-version specific 16-bit field
4261 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004262 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01004263 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004264 * Note: When updating the format, remember to keep
4265 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004266 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004267 * // In this version, `session_format` determines
4268 * // the setting of those compile-time
4269 * // configuration options which influence
4270 * // the structure of mbedtls_ssl_session.
4271 *
Glenn Straussda7851c2022-03-14 13:29:48 -04004272 * uint8_t minor_ver; // Protocol minor version. Possible values:
Jerry Yu0c2a7382022-12-06 13:27:25 +08004273 * // - TLS 1.2 (0x0303)
4274 * // - TLS 1.3 (0x0304)
David Horstmann531aca22024-02-29 18:14:28 +00004275 * uint8_t endpoint;
4276 * uint16_t ciphersuite;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004277 *
Glenn Straussda7851c2022-03-14 13:29:48 -04004278 * select (serialized_session.tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004279 *
Glenn Straussda7851c2022-03-14 13:29:48 -04004280 * case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004281 * serialized_session_tls12 data;
Jerry Yu0c2a7382022-12-06 13:27:25 +08004282 * case MBEDTLS_SSL_VERSION_TLS1_3:
Jerry Yuddda0502022-12-01 19:43:12 +08004283 * serialized_session_tls13 data;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004284 *
4285 * };
4286 *
4287 * } serialized_session;
4288 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004289 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004290
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004291MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01004292static int ssl_session_save(const mbedtls_ssl_session *session,
4293 unsigned char omit_header,
4294 unsigned char *buf,
4295 size_t buf_len,
4296 size_t *olen)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004297{
4298 unsigned char *p = buf;
4299 size_t used = 0;
Jerry Yu251a12e2022-07-13 15:15:48 +08004300 size_t remaining_len;
Jerry Yue36fdd62022-08-17 21:31:36 +08004301#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
4302 size_t out_len;
4303 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4304#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01004305 if (session == NULL) {
4306 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4307 }
Jerry Yu438ddd82022-07-07 06:55:50 +00004308
Gilles Peskine449bd832023-01-11 14:50:10 +01004309 if (!omit_header) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004310 /*
4311 * Add Mbed TLS version identifier
4312 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004313 used += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004314
Gilles Peskine449bd832023-01-11 14:50:10 +01004315 if (used <= buf_len) {
4316 memcpy(p, ssl_serialized_session_header,
4317 sizeof(ssl_serialized_session_header));
4318 p += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004319 }
4320 }
4321
4322 /*
Ronald Cron40a4ab02024-01-15 10:21:30 +01004323 * TLS version identifier, endpoint, ciphersuite
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004324 */
Ronald Cron40a4ab02024-01-15 10:21:30 +01004325 used += 1 /* TLS version */
4326 + 1 /* endpoint */
4327 + 2; /* ciphersuite */
Gilles Peskine449bd832023-01-11 14:50:10 +01004328 if (used <= buf_len) {
4329 *p++ = MBEDTLS_BYTE_0(session->tls_version);
Ronald Cron40a4ab02024-01-15 10:21:30 +01004330 *p++ = session->endpoint;
4331 MBEDTLS_PUT_UINT16_BE(session->ciphersuite, p, 0);
4332 p += 2;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004333 }
4334
4335 /* Forward to version-specific serialization routine. */
Jerry Yufca4d572022-07-21 10:37:48 +08004336 remaining_len = (buf_len >= used) ? buf_len - used : 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004337 switch (session->tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004338#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01004339 case MBEDTLS_SSL_VERSION_TLS1_2:
4340 used += ssl_tls12_session_save(session, p, remaining_len);
4341 break;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004342#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4343
Jerry Yu251a12e2022-07-13 15:15:48 +08004344#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004345 case MBEDTLS_SSL_VERSION_TLS1_3:
4346 ret = ssl_tls13_session_save(session, p, remaining_len, &out_len);
4347 if (ret != 0 && ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) {
4348 return ret;
4349 }
4350 used += out_len;
4351 break;
Jerry Yu251a12e2022-07-13 15:15:48 +08004352#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
4353
Gilles Peskine449bd832023-01-11 14:50:10 +01004354 default:
4355 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004356 }
4357
4358 *olen = used;
Gilles Peskine449bd832023-01-11 14:50:10 +01004359 if (used > buf_len) {
4360 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
4361 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004362
Gilles Peskine449bd832023-01-11 14:50:10 +01004363 return 0;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004364}
4365
4366/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004367 * Public wrapper for ssl_session_save()
4368 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004369int mbedtls_ssl_session_save(const mbedtls_ssl_session *session,
4370 unsigned char *buf,
4371 size_t buf_len,
4372 size_t *olen)
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004373{
Gilles Peskine449bd832023-01-11 14:50:10 +01004374 return ssl_session_save(session, 0, buf, buf_len, olen);
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004375}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004376
Jerry Yuf1b23ca2022-02-18 11:48:47 +08004377/*
4378 * Deserialize session, see mbedtls_ssl_session_save() for format.
4379 *
4380 * This internal version is wrapped by a public function that cleans up in
4381 * case of error, and has an extra option omit_header.
4382 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004383MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01004384static int ssl_session_load(mbedtls_ssl_session *session,
4385 unsigned char omit_header,
4386 const unsigned char *buf,
4387 size_t len)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004388{
4389 const unsigned char *p = buf;
4390 const unsigned char * const end = buf + len;
Jerry Yu438ddd82022-07-07 06:55:50 +00004391 size_t remaining_len;
4392
4393
Gilles Peskine449bd832023-01-11 14:50:10 +01004394 if (session == NULL) {
4395 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4396 }
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004397
Gilles Peskine449bd832023-01-11 14:50:10 +01004398 if (!omit_header) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004399 /*
4400 * Check Mbed TLS version identifier
4401 */
4402
Gilles Peskine449bd832023-01-11 14:50:10 +01004403 if ((size_t) (end - p) < sizeof(ssl_serialized_session_header)) {
4404 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004405 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004406
4407 if (memcmp(p, ssl_serialized_session_header,
4408 sizeof(ssl_serialized_session_header)) != 0) {
4409 return MBEDTLS_ERR_SSL_VERSION_MISMATCH;
4410 }
4411 p += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004412 }
4413
4414 /*
Ronald Cron40a4ab02024-01-15 10:21:30 +01004415 * TLS version identifier, endpoint, ciphersuite
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004416 */
Ronald Cron40a4ab02024-01-15 10:21:30 +01004417 if (4 > (size_t) (end - p)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004418 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4419 }
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01004420 session->tls_version = (mbedtls_ssl_protocol_version) (0x0300 | *p++);
Ronald Cron40a4ab02024-01-15 10:21:30 +01004421 session->endpoint = *p++;
4422 session->ciphersuite = MBEDTLS_GET_UINT16_BE(p, 0);
4423 p += 2;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004424
4425 /* Dispatch according to TLS version. */
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00004426 remaining_len = (size_t) (end - p);
Gilles Peskine449bd832023-01-11 14:50:10 +01004427 switch (session->tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004428#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01004429 case MBEDTLS_SSL_VERSION_TLS1_2:
4430 return ssl_tls12_session_load(session, p, remaining_len);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004431#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4432
Jerry Yu438ddd82022-07-07 06:55:50 +00004433#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004434 case MBEDTLS_SSL_VERSION_TLS1_3:
4435 return ssl_tls13_session_load(session, p, remaining_len);
Jerry Yu438ddd82022-07-07 06:55:50 +00004436#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
4437
Gilles Peskine449bd832023-01-11 14:50:10 +01004438 default:
4439 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01004440 }
4441}
4442
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02004443/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004444 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02004445 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004446int mbedtls_ssl_session_load(mbedtls_ssl_session *session,
4447 const unsigned char *buf,
4448 size_t len)
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02004449{
Gilles Peskine449bd832023-01-11 14:50:10 +01004450 int ret = ssl_session_load(session, 0, buf, len);
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02004451
Gilles Peskine449bd832023-01-11 14:50:10 +01004452 if (ret != 0) {
4453 mbedtls_ssl_session_free(session);
4454 }
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02004455
Gilles Peskine449bd832023-01-11 14:50:10 +01004456 return ret;
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02004457}
4458
4459/*
Paul Bakker1961b702013-01-25 14:49:24 +01004460 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00004461 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004462MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01004463static int ssl_prepare_handshake_step(mbedtls_ssl_context *ssl)
Hanno Becker41934dd2021-08-07 19:13:43 +01004464{
4465 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4466
Ronald Cron66dbf912022-02-02 15:33:46 +01004467 /*
4468 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01004469 * that were written into the output buffer by the previous handshake step,
4470 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01004471 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
4472 * We proceed to the next handshake step only when all data from the
4473 * previous one have been sent to the peer, thus we make sure that this is
4474 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
4475 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
4476 * we have to wait before to go ahead.
4477 * In the case of TLS 1.3, handshake step handlers do not send data to the
4478 * peer. Data are only sent here and through
4479 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
Andrzej Kurek5c65c572022-04-13 14:28:52 -04004480 * alert occurred.
Ronald Cron66dbf912022-02-02 15:33:46 +01004481 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004482 if ((ret = mbedtls_ssl_flush_output(ssl)) != 0) {
4483 return ret;
4484 }
Hanno Becker41934dd2021-08-07 19:13:43 +01004485
4486#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004487 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4488 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING) {
4489 if ((ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
4490 return ret;
4491 }
Hanno Becker41934dd2021-08-07 19:13:43 +01004492 }
4493#endif /* MBEDTLS_SSL_PROTO_DTLS */
4494
Gilles Peskine449bd832023-01-11 14:50:10 +01004495 return ret;
Hanno Becker41934dd2021-08-07 19:13:43 +01004496}
4497
Gilles Peskine449bd832023-01-11 14:50:10 +01004498int mbedtls_ssl_handshake_step(mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00004499{
Hanno Becker41934dd2021-08-07 19:13:43 +01004500 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00004501
Gilles Peskine449bd832023-01-11 14:50:10 +01004502 if (ssl == NULL ||
Hanno Becker41934dd2021-08-07 19:13:43 +01004503 ssl->conf == NULL ||
4504 ssl->handshake == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01004505 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER) {
4506 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker41934dd2021-08-07 19:13:43 +01004507 }
4508
Gilles Peskine449bd832023-01-11 14:50:10 +01004509 ret = ssl_prepare_handshake_step(ssl);
4510 if (ret != 0) {
4511 return ret;
4512 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02004513
Gilles Peskine449bd832023-01-11 14:50:10 +01004514 ret = mbedtls_ssl_handle_pending_alert(ssl);
4515 if (ret != 0) {
Jerry Yue7047812021-09-13 19:26:39 +08004516 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01004517 }
Jerry Yue7047812021-09-13 19:26:39 +08004518
Tom Cosgrove2fdc7b32022-09-21 12:33:17 +01004519 /* If ssl->conf->endpoint is not one of MBEDTLS_SSL_IS_CLIENT or
4520 * MBEDTLS_SSL_IS_SERVER, this is the return code we give */
4521 ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004523#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004524 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
4525 MBEDTLS_SSL_DEBUG_MSG(2, ("client state: %s",
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01004526 mbedtls_ssl_states_str((mbedtls_ssl_states) ssl->state)));
Jerry Yub9930e72021-08-06 17:11:51 +08004527
Gilles Peskine449bd832023-01-11 14:50:10 +01004528 switch (ssl->state) {
Ronald Cron9f0fba32022-02-10 16:45:15 +01004529 case MBEDTLS_SSL_HELLO_REQUEST:
4530 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Tom Cosgrove87d9c6c2022-09-22 09:27:56 +01004531 ret = 0;
Ronald Cron9f0fba32022-02-10 16:45:15 +01004532 break;
Jerry Yub9930e72021-08-06 17:11:51 +08004533
Ronald Cron9f0fba32022-02-10 16:45:15 +01004534 case MBEDTLS_SSL_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01004535 ret = mbedtls_ssl_write_client_hello(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01004536 break;
4537
4538 default:
4539#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004540 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
4541 ret = mbedtls_ssl_tls13_handshake_client_step(ssl);
4542 } else {
4543 ret = mbedtls_ssl_handshake_client_step(ssl);
4544 }
Ronald Cron9f0fba32022-02-10 16:45:15 +01004545#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01004546 ret = mbedtls_ssl_handshake_client_step(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01004547#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004548 ret = mbedtls_ssl_tls13_handshake_client_step(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01004549#endif
4550 }
Jerry Yub9930e72021-08-06 17:11:51 +08004551 }
Ronald Cron6291b232023-03-08 15:51:25 +01004552#endif /* MBEDTLS_SSL_CLI_C */
4553
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004554#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004555 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Ronald Cron6291b232023-03-08 15:51:25 +01004556#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
4557 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004558 ret = mbedtls_ssl_tls13_handshake_server_step(ssl);
Ronald Cron6291b232023-03-08 15:51:25 +01004559 } else {
Gilles Peskine449bd832023-01-11 14:50:10 +01004560 ret = mbedtls_ssl_handshake_server_step(ssl);
4561 }
Ronald Cron6291b232023-03-08 15:51:25 +01004562#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
4563 ret = mbedtls_ssl_handshake_server_step(ssl);
4564#else
4565 ret = mbedtls_ssl_tls13_handshake_server_step(ssl);
Paul Bakker5121ce52009-01-03 21:22:43 +00004566#endif
Ronald Cron6291b232023-03-08 15:51:25 +01004567 }
4568#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00004569
Gilles Peskine449bd832023-01-11 14:50:10 +01004570 if (ret != 0) {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08004571 /* handshake_step return error. And it is same
4572 * with alert_reason.
4573 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004574 if (ssl->send_alert) {
4575 ret = mbedtls_ssl_handle_pending_alert(ssl);
Jerry Yue7047812021-09-13 19:26:39 +08004576 goto cleanup;
4577 }
4578 }
4579
4580cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01004581 return ret;
Paul Bakker1961b702013-01-25 14:49:24 +01004582}
4583
4584/*
4585 * Perform the SSL handshake
4586 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004587int mbedtls_ssl_handshake(mbedtls_ssl_context *ssl)
Paul Bakker1961b702013-01-25 14:49:24 +01004588{
4589 int ret = 0;
4590
Hanno Beckera817ea42020-10-20 15:20:23 +01004591 /* Sanity checks */
4592
Gilles Peskine449bd832023-01-11 14:50:10 +01004593 if (ssl == NULL || ssl->conf == NULL) {
4594 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4595 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02004596
Hanno Beckera817ea42020-10-20 15:20:23 +01004597#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004598 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4599 (ssl->f_set_timer == NULL || ssl->f_get_timer == NULL)) {
4600 MBEDTLS_SSL_DEBUG_MSG(1, ("You must use "
4601 "mbedtls_ssl_set_timer_cb() for DTLS"));
4602 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckera817ea42020-10-20 15:20:23 +01004603 }
4604#endif /* MBEDTLS_SSL_PROTO_DTLS */
4605
Gilles Peskine449bd832023-01-11 14:50:10 +01004606 MBEDTLS_SSL_DEBUG_MSG(2, ("=> handshake"));
Paul Bakker1961b702013-01-25 14:49:24 +01004607
Hanno Beckera817ea42020-10-20 15:20:23 +01004608 /* Main handshake loop */
Gilles Peskine449bd832023-01-11 14:50:10 +01004609 while (ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER) {
4610 ret = mbedtls_ssl_handshake_step(ssl);
Paul Bakker1961b702013-01-25 14:49:24 +01004611
Gilles Peskine449bd832023-01-11 14:50:10 +01004612 if (ret != 0) {
Paul Bakker1961b702013-01-25 14:49:24 +01004613 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01004614 }
Paul Bakker1961b702013-01-25 14:49:24 +01004615 }
4616
Gilles Peskine449bd832023-01-11 14:50:10 +01004617 MBEDTLS_SSL_DEBUG_MSG(2, ("<= handshake"));
Paul Bakker5121ce52009-01-03 21:22:43 +00004618
Gilles Peskine449bd832023-01-11 14:50:10 +01004619 return ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00004620}
4621
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004622#if defined(MBEDTLS_SSL_RENEGOTIATION)
4623#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00004624/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004625 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00004626 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004627MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01004628static int ssl_write_hello_request(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004629{
Janos Follath865b3eb2019-12-16 11:46:15 +00004630 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004631
Gilles Peskine449bd832023-01-11 14:50:10 +01004632 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello request"));
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004633
4634 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004635 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4636 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004637
Gilles Peskine449bd832023-01-11 14:50:10 +01004638 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
4639 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
4640 return ret;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004641 }
4642
Gilles Peskine449bd832023-01-11 14:50:10 +01004643 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello request"));
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004644
Gilles Peskine449bd832023-01-11 14:50:10 +01004645 return 0;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004646}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004647#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004648
4649/*
4650 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004651 * - any side: calling mbedtls_ssl_renegotiate(),
4652 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
4653 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02004654 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004655 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004656 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004657 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004658int mbedtls_ssl_start_renegotiation(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +00004659{
Janos Follath865b3eb2019-12-16 11:46:15 +00004660 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00004661
Gilles Peskine449bd832023-01-11 14:50:10 +01004662 MBEDTLS_SSL_DEBUG_MSG(2, ("=> renegotiate"));
Paul Bakker48916f92012-09-16 19:57:18 +00004663
Gilles Peskine449bd832023-01-11 14:50:10 +01004664 if ((ret = ssl_handshake_init(ssl)) != 0) {
4665 return ret;
4666 }
Paul Bakker48916f92012-09-16 19:57:18 +00004667
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02004668 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
4669 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004670#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004671 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4672 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING) {
4673 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004674 ssl->handshake->out_msg_seq = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004675 } else {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004676 ssl->handshake->in_msg_seq = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004677 }
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02004678 }
4679#endif
4680
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004681 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
4682 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00004683
Gilles Peskine449bd832023-01-11 14:50:10 +01004684 if ((ret = mbedtls_ssl_handshake(ssl)) != 0) {
4685 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_handshake", ret);
4686 return ret;
Paul Bakker48916f92012-09-16 19:57:18 +00004687 }
4688
Gilles Peskine449bd832023-01-11 14:50:10 +01004689 MBEDTLS_SSL_DEBUG_MSG(2, ("<= renegotiate"));
Paul Bakker48916f92012-09-16 19:57:18 +00004690
Gilles Peskine449bd832023-01-11 14:50:10 +01004691 return 0;
Paul Bakker48916f92012-09-16 19:57:18 +00004692}
4693
4694/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004695 * Renegotiate current connection on client,
4696 * or request renegotiation on server
4697 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004698int mbedtls_ssl_renegotiate(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004699{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004700 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004701
Gilles Peskine449bd832023-01-11 14:50:10 +01004702 if (ssl == NULL || ssl->conf == NULL) {
4703 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4704 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02004705
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004706#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004707 /* On server, just send the request */
Gilles Peskine449bd832023-01-11 14:50:10 +01004708 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
4709 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
4710 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4711 }
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004712
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004713 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02004714
4715 /* Did we already try/start sending HelloRequest? */
Gilles Peskine449bd832023-01-11 14:50:10 +01004716 if (ssl->out_left != 0) {
4717 return mbedtls_ssl_flush_output(ssl);
4718 }
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02004719
Gilles Peskine449bd832023-01-11 14:50:10 +01004720 return ssl_write_hello_request(ssl);
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004721 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004722#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004723
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004724#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004725 /*
4726 * On client, either start the renegotiation process or,
4727 * if already in progress, continue the handshake
4728 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004729 if (ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
4730 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
4731 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004732 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004733
4734 if ((ret = mbedtls_ssl_start_renegotiation(ssl)) != 0) {
4735 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_start_renegotiation", ret);
4736 return ret;
4737 }
4738 } else {
4739 if ((ret = mbedtls_ssl_handshake(ssl)) != 0) {
4740 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_handshake", ret);
4741 return ret;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004742 }
4743 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004744#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004745
Gilles Peskine449bd832023-01-11 14:50:10 +01004746 return ret;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004747}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004748#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004749
Gilles Peskine449bd832023-01-11 14:50:10 +01004750void mbedtls_ssl_handshake_free(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +00004751{
Gilles Peskine9b562d52018-04-25 20:32:43 +02004752 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
4753
Gilles Peskine449bd832023-01-11 14:50:10 +01004754 if (handshake == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004755 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01004756 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004757
Valerio Setti6f0441d2023-07-03 12:11:36 +02004758#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
Brett Warrene0edc842021-08-17 09:53:13 +01004759#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004760 if (ssl->handshake->group_list_heap_allocated) {
4761 mbedtls_free((void *) handshake->group_list);
4762 }
Brett Warrene0edc842021-08-17 09:53:13 +01004763 handshake->group_list = NULL;
4764#endif /* MBEDTLS_DEPRECATED_REMOVED */
Valerio Setti6f0441d2023-07-03 12:11:36 +02004765#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
Brett Warrene0edc842021-08-17 09:53:13 +01004766
Ronald Crone68ab4f2022-10-05 12:46:29 +02004767#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004768#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004769 if (ssl->handshake->sig_algs_heap_allocated) {
4770 mbedtls_free((void *) handshake->sig_algs);
4771 }
Jerry Yuf017ee42022-01-12 15:49:48 +08004772 handshake->sig_algs = NULL;
4773#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00004774#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004775 if (ssl->handshake->certificate_request_context) {
4776 mbedtls_free((void *) handshake->certificate_request_context);
Xiaofei Baic234ecf2022-02-08 09:59:23 +00004777 }
4778#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02004779#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yuf017ee42022-01-12 15:49:48 +08004780
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004781#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01004782 if (ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0) {
4783 ssl->conf->f_async_cancel(ssl);
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004784 handshake->async_in_progress = 0;
4785 }
4786#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
4787
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01004788#if defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurekeb342242019-01-29 09:14:33 -05004789#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004790 psa_hash_abort(&handshake->fin_sha256_psa);
Andrzej Kurekeb342242019-01-29 09:14:33 -05004791#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01004792 mbedtls_md_free(&handshake->fin_sha256);
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004793#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05004794#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01004795#if defined(MBEDTLS_MD_CAN_SHA384)
Andrzej Kurekeb342242019-01-29 09:14:33 -05004796#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004797 psa_hash_abort(&handshake->fin_sha384_psa);
Andrzej Kurekeb342242019-01-29 09:14:33 -05004798#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01004799 mbedtls_md_free(&handshake->fin_sha384);
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004800#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05004801#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004802
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004803#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004804 mbedtls_dhm_free(&handshake->dhm_ctx);
Paul Bakker48916f92012-09-16 19:57:18 +00004805#endif
Valerio Setti7aeec542023-07-05 18:57:21 +02004806#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
Valerio Setti6eb00542023-07-07 17:04:24 +02004807 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004808 mbedtls_ecdh_free(&handshake->ecdh_ctx);
Paul Bakker61d113b2013-07-04 11:51:43 +02004809#endif
Valerio Setti02c25b52022-11-15 14:08:42 +01004810
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02004811#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +02004812#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004813 psa_pake_abort(&handshake->psa_pake_ctx);
Valerio Settieb3f7882022-12-08 18:42:58 +01004814 /*
4815 * Opaque keys are not stored in the handshake's data and it's the user
4816 * responsibility to destroy them. Clear ones, instead, are created by
4817 * the TLS library and should be destroyed at the same level
4818 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004819 if (!mbedtls_svc_key_id_is_null(handshake->psa_pake_password)) {
4820 psa_destroy_key(handshake->psa_pake_password);
Valerio Settieb3f7882022-12-08 18:42:58 +01004821 }
Neil Armstrongca7d5062022-05-31 14:43:23 +02004822 handshake->psa_pake_password = MBEDTLS_SVC_KEY_ID_INIT;
4823#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004824 mbedtls_ecjpake_free(&handshake->ecjpake_ctx);
Neil Armstrongca7d5062022-05-31 14:43:23 +02004825#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02004826#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004827 mbedtls_free(handshake->ecjpake_cache);
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02004828 handshake->ecjpake_cache = NULL;
4829 handshake->ecjpake_cache_len = 0;
4830#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02004831#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02004832
Valerio Setti7aeec542023-07-05 18:57:21 +02004833#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) || \
Valerio Setti45d56f32023-07-13 17:23:20 +02004834 defined(MBEDTLS_KEY_EXCHANGE_WITH_ECDSA_ANY_ENABLED) || \
Janos Follath4ae5c292016-02-10 11:27:43 +00004835 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02004836 /* explicit void pointer cast for buggy MS compiler */
Gilles Peskine449bd832023-01-11 14:50:10 +01004837 mbedtls_free((void *) handshake->curves_tls_id);
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02004838#endif
4839
Ronald Cron73fe8df2022-10-05 14:31:43 +02004840#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02004841#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004842 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02004843 /* The maintenance of the external PSK key slot is the
4844 * user's responsibility. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004845 if (ssl->handshake->psk_opaque_is_internal) {
4846 psa_destroy_key(ssl->handshake->psk_opaque);
Neil Armstrong501c9322022-05-03 09:35:09 +02004847 ssl->handshake->psk_opaque_is_internal = 0;
4848 }
4849 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4850 }
Neil Armstronge952a302022-05-03 10:22:14 +02004851#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004852 if (handshake->psk != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004853 mbedtls_zeroize_and_free(handshake->psk, handshake->psk_len);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004854 }
Neil Armstronge952a302022-05-03 10:22:14 +02004855#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Cron73fe8df2022-10-05 14:31:43 +02004856#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004857
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004858#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
4859 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02004860 /*
4861 * Free only the linked list wrapper, not the keys themselves
4862 * since the belong to the SNI callback
4863 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004864 ssl_key_cert_free(handshake->sni_key_cert);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004865#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02004866
Gilles Peskineeccd8882020-03-10 12:19:08 +01004867#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004868 mbedtls_x509_crt_restart_free(&handshake->ecrs_ctx);
4869 if (handshake->ecrs_peer_cert != NULL) {
4870 mbedtls_x509_crt_free(handshake->ecrs_peer_cert);
4871 mbedtls_free(handshake->ecrs_peer_cert);
Hanno Becker3dad3112019-02-05 17:19:52 +00004872 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02004873#endif
4874
Hanno Becker75173122019-02-06 16:18:31 +00004875#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
4876 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01004877 mbedtls_pk_free(&handshake->peer_pubkey);
Hanno Becker75173122019-02-06 16:18:31 +00004878#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4879
XiaokangQian9b93c0d2022-02-09 06:02:25 +00004880#if defined(MBEDTLS_SSL_CLI_C) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01004881 (defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3))
4882 mbedtls_free(handshake->cookie);
XiaokangQian9b93c0d2022-02-09 06:02:25 +00004883#endif /* MBEDTLS_SSL_CLI_C &&
4884 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00004885
4886#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004887 mbedtls_ssl_flight_free(handshake->flight);
4888 mbedtls_ssl_buffering_free(ssl);
XiaokangQian8499b6c2022-01-27 09:00:11 +00004889#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02004890
Valerio Settiea59c432023-07-25 11:14:03 +02004891#if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED)
Przemek Stekiel7ac93be2023-07-04 10:02:38 +02004892 if (handshake->xxdh_psa_privkey_is_external == 0) {
4893 psa_destroy_key(handshake->xxdh_psa_privkey);
Gilles Peskine449bd832023-01-11 14:50:10 +01004894 }
Valerio Settiea59c432023-07-25 11:14:03 +02004895#endif /* MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED */
Hanno Becker4a63ed42019-01-08 11:39:35 +00004896
Ronald Cron6f135e12021-12-08 16:57:54 +01004897#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004898 mbedtls_ssl_transform_free(handshake->transform_handshake);
4899 mbedtls_free(handshake->transform_handshake);
Jerry Yu3d9b5902022-11-04 14:07:25 +08004900#if defined(MBEDTLS_SSL_EARLY_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01004901 mbedtls_ssl_transform_free(handshake->transform_earlydata);
4902 mbedtls_free(handshake->transform_earlydata);
Jerry Yu3d9b5902022-11-04 14:07:25 +08004903#endif
Ronald Cron6f135e12021-12-08 16:57:54 +01004904#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08004905
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004906
4907#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4908 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
4909 * processes datagrams and the fact that a datagram is allowed to have
4910 * several records in it, it is possible that the I/O buffers are not
4911 * empty at this stage */
Gilles Peskine449bd832023-01-11 14:50:10 +01004912 handle_buffer_resizing(ssl, 1, mbedtls_ssl_get_input_buflen(ssl),
4913 mbedtls_ssl_get_output_buflen(ssl));
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004914#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01004915
Jerry Yuba9c7272021-10-30 11:54:10 +08004916 /* mbedtls_platform_zeroize MUST be last one in this function */
Gilles Peskine449bd832023-01-11 14:50:10 +01004917 mbedtls_platform_zeroize(handshake,
4918 sizeof(mbedtls_ssl_handshake_params));
Paul Bakker48916f92012-09-16 19:57:18 +00004919}
4920
Gilles Peskine449bd832023-01-11 14:50:10 +01004921void mbedtls_ssl_session_free(mbedtls_ssl_session *session)
Paul Bakker48916f92012-09-16 19:57:18 +00004922{
Gilles Peskine449bd832023-01-11 14:50:10 +01004923 if (session == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004924 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01004925 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004927#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004928 ssl_clear_peer_cert(session);
Paul Bakkered27a042013-04-18 22:46:23 +02004929#endif
Paul Bakker0a597072012-09-25 21:55:46 +00004930
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004931#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00004932#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
4933 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01004934 mbedtls_free(session->hostname);
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00004935#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01004936 mbedtls_free(session->ticket);
Paul Bakkera503a632013-08-14 13:48:06 +02004937#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02004938
Waleed Elmelegy2824a202024-02-23 17:51:47 +00004939#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN) && \
4940 defined(MBEDTLS_SSL_SRV_C)
Waleed Elmelegy883f77c2024-03-06 19:09:41 +00004941 mbedtls_free(session->ticket_alpn);
Paul Bakker5121ce52009-01-03 21:22:43 +00004942#endif
4943
Gilles Peskine449bd832023-01-11 14:50:10 +01004944 mbedtls_platform_zeroize(session, sizeof(mbedtls_ssl_session));
Paul Bakker5121ce52009-01-03 21:22:43 +00004945}
4946
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004947#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004948
4949#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4950#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
4951#else
4952#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
4953#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4954
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004955#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004956
4957#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4958#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
4959#else
4960#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
4961#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4962
4963#if defined(MBEDTLS_SSL_ALPN)
4964#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
4965#else
4966#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
4967#endif /* MBEDTLS_SSL_ALPN */
4968
4969#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
4970#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
4971#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
4972#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
4973
4974#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
Gilles Peskine449bd832023-01-11 14:50:10 +01004975 ((uint32_t) ( \
4976 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << \
4977 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT) | \
4978 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << \
4979 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT) | \
4980 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << \
4981 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT) | \
4982 (SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT) | \
4983 0u))
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004984
Chien Wong4e9683e2023-12-28 17:07:43 +08004985static const unsigned char ssl_serialized_context_header[] = {
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004986 MBEDTLS_VERSION_MAJOR,
4987 MBEDTLS_VERSION_MINOR,
4988 MBEDTLS_VERSION_PATCH,
Gilles Peskine449bd832023-01-11 14:50:10 +01004989 MBEDTLS_BYTE_1(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
4990 MBEDTLS_BYTE_0(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
4991 MBEDTLS_BYTE_2(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
4992 MBEDTLS_BYTE_1(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
4993 MBEDTLS_BYTE_0(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004994};
4995
Paul Bakker5121ce52009-01-03 21:22:43 +00004996/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004997 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004998 *
4999 * The format of the serialized data is:
5000 * (in the presentation language of TLS, RFC 8446 section 3)
5001 *
5002 * // header
5003 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005004 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02005005 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005006 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02005007 * Note: When updating the format, remember to keep these
5008 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02005009 *
5010 * // session sub-structure
5011 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
5012 * // transform sub-structure
5013 * uint8 random[64]; // ServerHello.random+ClientHello.random
5014 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
5015 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
5016 * // fields from ssl_context
5017 * uint32 badmac_seen; // DTLS: number of records with failing MAC
5018 * uint64 in_window_top; // DTLS: last validated record seq_num
5019 * uint64 in_window; // DTLS: bitmask for replay protection
5020 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
5021 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
5022 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
5023 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
5024 *
5025 * Note that many fields of the ssl_context or sub-structures are not
5026 * serialized, as they fall in one of the following categories:
5027 *
5028 * 1. forced value (eg in_left must be 0)
5029 * 2. pointer to dynamically-allocated memory (eg session, transform)
5030 * 3. value can be re-derived from other data (eg session keys from MS)
5031 * 4. value was temporary (eg content of input buffer)
5032 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005033 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005034int mbedtls_ssl_context_save(mbedtls_ssl_context *ssl,
5035 unsigned char *buf,
5036 size_t buf_len,
5037 size_t *olen)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005038{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005039 unsigned char *p = buf;
5040 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005041 size_t session_len;
5042 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005043
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02005044 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005045 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
5046 * this function's documentation.
5047 *
5048 * These are due to assumptions/limitations in the implementation. Some of
5049 * them are likely to stay (no handshake in progress) some might go away
5050 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02005051 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005052 /* The initial handshake must be over */
Gilles Peskine449bd832023-01-11 14:50:10 +01005053 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
5054 MBEDTLS_SSL_DEBUG_MSG(1, ("Initial handshake isn't over"));
5055 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005056 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005057 if (ssl->handshake != NULL) {
5058 MBEDTLS_SSL_DEBUG_MSG(1, ("Handshake isn't completed"));
5059 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005060 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005061 /* Double-check that sub-structures are indeed ready */
Gilles Peskine449bd832023-01-11 14:50:10 +01005062 if (ssl->transform == NULL || ssl->session == NULL) {
5063 MBEDTLS_SSL_DEBUG_MSG(1, ("Serialised structures aren't ready"));
5064 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005065 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005066 /* There must be no pending incoming or outgoing data */
Gilles Peskine449bd832023-01-11 14:50:10 +01005067 if (mbedtls_ssl_check_pending(ssl) != 0) {
5068 MBEDTLS_SSL_DEBUG_MSG(1, ("There is pending incoming data"));
5069 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005070 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005071 if (ssl->out_left != 0) {
5072 MBEDTLS_SSL_DEBUG_MSG(1, ("There is pending outgoing data"));
5073 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005074 }
Dave Rodgman556e8a32022-12-06 16:31:25 +00005075 /* Protocol must be DTLS, not TLS */
Gilles Peskine449bd832023-01-11 14:50:10 +01005076 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
5077 MBEDTLS_SSL_DEBUG_MSG(1, ("Only DTLS is supported"));
5078 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005079 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005080 /* Version must be 1.2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005081 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2) {
5082 MBEDTLS_SSL_DEBUG_MSG(1, ("Only version 1.2 supported"));
5083 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005084 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005085 /* We must be using an AEAD ciphersuite */
Gilles Peskine449bd832023-01-11 14:50:10 +01005086 if (mbedtls_ssl_transform_uses_aead(ssl->transform) != 1) {
5087 MBEDTLS_SSL_DEBUG_MSG(1, ("Only AEAD ciphersuites supported"));
5088 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005089 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005090 /* Renegotiation must not be enabled */
5091#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01005092 if (ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED) {
5093 MBEDTLS_SSL_DEBUG_MSG(1, ("Renegotiation must not be enabled"));
5094 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03005095 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02005096#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005097
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005098 /*
5099 * Version and format identifier
5100 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005101 used += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005102
Gilles Peskine449bd832023-01-11 14:50:10 +01005103 if (used <= buf_len) {
5104 memcpy(p, ssl_serialized_context_header,
5105 sizeof(ssl_serialized_context_header));
5106 p += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005107 }
5108
5109 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005110 * Session (length + data)
5111 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005112 ret = ssl_session_save(ssl->session, 1, NULL, 0, &session_len);
5113 if (ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) {
5114 return ret;
5115 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005116
5117 used += 4 + session_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01005118 if (used <= buf_len) {
5119 MBEDTLS_PUT_UINT32_BE(session_len, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005120 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005121
Gilles Peskine449bd832023-01-11 14:50:10 +01005122 ret = ssl_session_save(ssl->session, 1,
5123 p, session_len, &session_len);
5124 if (ret != 0) {
5125 return ret;
5126 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005127
5128 p += session_len;
5129 }
5130
5131 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005132 * Transform
5133 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005134 used += sizeof(ssl->transform->randbytes);
5135 if (used <= buf_len) {
5136 memcpy(p, ssl->transform->randbytes,
5137 sizeof(ssl->transform->randbytes));
5138 p += sizeof(ssl->transform->randbytes);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005139 }
5140
5141#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Dave Rodgmanc37ad442023-11-03 23:36:06 +00005142 used += 2U + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01005143 if (used <= buf_len) {
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005144 *p++ = ssl->transform->in_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01005145 memcpy(p, ssl->transform->in_cid, ssl->transform->in_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005146 p += ssl->transform->in_cid_len;
5147
5148 *p++ = ssl->transform->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01005149 memcpy(p, ssl->transform->out_cid, ssl->transform->out_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005150 p += ssl->transform->out_cid_len;
5151 }
5152#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5153
5154 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005155 * Saved fields from top-level ssl_context structure
5156 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005157 used += 4;
Gilles Peskine449bd832023-01-11 14:50:10 +01005158 if (used <= buf_len) {
5159 MBEDTLS_PUT_UINT32_BE(ssl->badmac_seen, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005160 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005161 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005162
5163#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5164 used += 16;
Gilles Peskine449bd832023-01-11 14:50:10 +01005165 if (used <= buf_len) {
5166 MBEDTLS_PUT_UINT64_BE(ssl->in_window_top, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005167 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005168
Gilles Peskine449bd832023-01-11 14:50:10 +01005169 MBEDTLS_PUT_UINT64_BE(ssl->in_window, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005170 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005171 }
5172#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5173
5174#if defined(MBEDTLS_SSL_PROTO_DTLS)
5175 used += 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005176 if (used <= buf_len) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005177 *p++ = ssl->disable_datagram_packing;
5178 }
5179#endif /* MBEDTLS_SSL_PROTO_DTLS */
5180
Jerry Yuae0b2e22021-10-08 15:21:19 +08005181 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Gilles Peskine449bd832023-01-11 14:50:10 +01005182 if (used <= buf_len) {
5183 memcpy(p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN);
Jerry Yuae0b2e22021-10-08 15:21:19 +08005184 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005185 }
5186
5187#if defined(MBEDTLS_SSL_PROTO_DTLS)
5188 used += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01005189 if (used <= buf_len) {
5190 MBEDTLS_PUT_UINT16_BE(ssl->mtu, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01005191 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005192 }
5193#endif /* MBEDTLS_SSL_PROTO_DTLS */
5194
5195#if defined(MBEDTLS_SSL_ALPN)
5196 {
5197 const uint8_t alpn_len = ssl->alpn_chosen
Gilles Peskine449bd832023-01-11 14:50:10 +01005198 ? (uint8_t) strlen(ssl->alpn_chosen)
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005199 : 0;
5200
5201 used += 1 + alpn_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01005202 if (used <= buf_len) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005203 *p++ = alpn_len;
5204
Gilles Peskine449bd832023-01-11 14:50:10 +01005205 if (ssl->alpn_chosen != NULL) {
5206 memcpy(p, ssl->alpn_chosen, alpn_len);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005207 p += alpn_len;
5208 }
5209 }
5210 }
5211#endif /* MBEDTLS_SSL_ALPN */
5212
5213 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005214 * Done
5215 */
5216 *olen = used;
5217
Gilles Peskine449bd832023-01-11 14:50:10 +01005218 if (used > buf_len) {
5219 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
5220 }
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005221
Gilles Peskine449bd832023-01-11 14:50:10 +01005222 MBEDTLS_SSL_DEBUG_BUF(4, "saved context", buf, used);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005223
Gilles Peskine449bd832023-01-11 14:50:10 +01005224 return mbedtls_ssl_session_reset_int(ssl, 0);
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005225}
5226
5227/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02005228 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005229 *
5230 * This internal version is wrapped by a public function that cleans up in
5231 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005232 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005233MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01005234static int ssl_context_load(mbedtls_ssl_context *ssl,
5235 const unsigned char *buf,
5236 size_t len)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005237{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005238 const unsigned char *p = buf;
5239 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005240 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00005241 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04005242#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek894edde2022-09-29 06:31:14 -04005243 tls_prf_fn prf_func = NULL;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04005244#endif
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005245
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005246 /*
5247 * The context should have been freshly setup or reset.
5248 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02005249 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005250 * renegotiating, or if the user mistakenly loaded a session first.)
5251 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005252 if (ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
5253 ssl->session != NULL) {
5254 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005255 }
5256
5257 /*
5258 * We can't check that the config matches the initial one, but we can at
5259 * least check it matches the requirements for serializing.
5260 */
Dave Rodgmane99b24d2023-09-14 15:45:03 +01005261 if (
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005262#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02005263 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005264#endif
Dave Rodgmane99b24d2023-09-14 15:45:03 +01005265 ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
5266 ssl->conf->max_tls_version < MBEDTLS_SSL_VERSION_TLS1_2 ||
5267 ssl->conf->min_tls_version > MBEDTLS_SSL_VERSION_TLS1_2
5268 ) {
Gilles Peskine449bd832023-01-11 14:50:10 +01005269 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02005270 }
5271
Gilles Peskine449bd832023-01-11 14:50:10 +01005272 MBEDTLS_SSL_DEBUG_BUF(4, "context to load", buf, len);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005273
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005274 /*
5275 * Check version identifier
5276 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005277 if ((size_t) (end - p) < sizeof(ssl_serialized_context_header)) {
5278 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005279 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005280
5281 if (memcmp(p, ssl_serialized_context_header,
5282 sizeof(ssl_serialized_context_header)) != 0) {
5283 return MBEDTLS_ERR_SSL_VERSION_MISMATCH;
5284 }
5285 p += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005286
5287 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005288 * Session
5289 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005290 if ((size_t) (end - p) < 4) {
5291 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5292 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005293
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01005294 session_len = MBEDTLS_GET_UINT32_BE(p, 0);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005295 p += 4;
5296
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005297 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00005298 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005299 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005300 ssl->session_in = ssl->session;
5301 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005302 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005303
Gilles Peskine449bd832023-01-11 14:50:10 +01005304 if ((size_t) (end - p) < session_len) {
5305 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5306 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005307
Gilles Peskine449bd832023-01-11 14:50:10 +01005308 ret = ssl_session_load(ssl->session, 1, p, session_len);
5309 if (ret != 0) {
5310 mbedtls_ssl_session_free(ssl->session);
5311 return ret;
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02005312 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005313
5314 p += session_len;
5315
5316 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005317 * Transform
5318 */
5319
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005320 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00005321 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Jerry Yu2e199812022-12-01 18:57:19 +08005322#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005323 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005324 ssl->transform_in = ssl->transform;
5325 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02005326 ssl->transform_negotiate = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08005327#endif
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005328
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04005329#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005330 prf_func = ssl_tls12prf_from_cs(ssl->session->ciphersuite);
5331 if (prf_func == NULL) {
5332 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5333 }
Andrzej Kurek894edde2022-09-29 06:31:14 -04005334
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005335 /* Read random bytes and populate structure */
Gilles Peskine449bd832023-01-11 14:50:10 +01005336 if ((size_t) (end - p) < sizeof(ssl->transform->randbytes)) {
5337 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5338 }
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04005339
Gilles Peskine449bd832023-01-11 14:50:10 +01005340 ret = ssl_tls12_populate_transform(ssl->transform,
5341 ssl->session->ciphersuite,
5342 ssl->session->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02005343#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01005344 ssl->session->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02005345#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01005346 prf_func,
5347 p, /* currently pointing to randbytes */
5348 MBEDTLS_SSL_VERSION_TLS1_2, /* (D)TLS 1.2 is forced */
5349 ssl->conf->endpoint,
5350 ssl);
5351 if (ret != 0) {
5352 return ret;
5353 }
Jerry Yu840fbb22022-02-17 14:59:29 +08005354#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005355 p += sizeof(ssl->transform->randbytes);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005356
5357#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5358 /* Read connection IDs and store them */
Gilles Peskine449bd832023-01-11 14:50:10 +01005359 if ((size_t) (end - p) < 1) {
5360 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5361 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005362
5363 ssl->transform->in_cid_len = *p++;
5364
Gilles Peskine449bd832023-01-11 14:50:10 +01005365 if ((size_t) (end - p) < ssl->transform->in_cid_len + 1u) {
5366 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5367 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005368
Gilles Peskine449bd832023-01-11 14:50:10 +01005369 memcpy(ssl->transform->in_cid, p, ssl->transform->in_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005370 p += ssl->transform->in_cid_len;
5371
5372 ssl->transform->out_cid_len = *p++;
5373
Gilles Peskine449bd832023-01-11 14:50:10 +01005374 if ((size_t) (end - p) < ssl->transform->out_cid_len) {
5375 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5376 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005377
Gilles Peskine449bd832023-01-11 14:50:10 +01005378 memcpy(ssl->transform->out_cid, p, ssl->transform->out_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02005379 p += ssl->transform->out_cid_len;
5380#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5381
5382 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005383 * Saved fields from top-level ssl_context structure
5384 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005385 if ((size_t) (end - p) < 4) {
5386 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5387 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005388
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01005389 ssl->badmac_seen = MBEDTLS_GET_UINT32_BE(p, 0);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005390 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005391
5392#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01005393 if ((size_t) (end - p) < 16) {
5394 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5395 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005396
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01005397 ssl->in_window_top = MBEDTLS_GET_UINT64_BE(p, 0);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005398 p += 8;
5399
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01005400 ssl->in_window = MBEDTLS_GET_UINT64_BE(p, 0);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005401 p += 8;
5402#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5403
5404#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005405 if ((size_t) (end - p) < 1) {
5406 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5407 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005408
5409 ssl->disable_datagram_packing = *p++;
5410#endif /* MBEDTLS_SSL_PROTO_DTLS */
5411
Gilles Peskine449bd832023-01-11 14:50:10 +01005412 if ((size_t) (end - p) < sizeof(ssl->cur_out_ctr)) {
5413 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5414 }
5415 memcpy(ssl->cur_out_ctr, p, sizeof(ssl->cur_out_ctr));
5416 p += sizeof(ssl->cur_out_ctr);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005417
5418#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005419 if ((size_t) (end - p) < 2) {
5420 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5421 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005422
Dave Rodgmana3d0f612023-11-03 23:34:02 +00005423 ssl->mtu = MBEDTLS_GET_UINT16_BE(p, 0);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005424 p += 2;
5425#endif /* MBEDTLS_SSL_PROTO_DTLS */
5426
5427#if defined(MBEDTLS_SSL_ALPN)
5428 {
5429 uint8_t alpn_len;
5430 const char **cur;
5431
Gilles Peskine449bd832023-01-11 14:50:10 +01005432 if ((size_t) (end - p) < 1) {
5433 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5434 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005435
5436 alpn_len = *p++;
5437
Gilles Peskine449bd832023-01-11 14:50:10 +01005438 if (alpn_len != 0 && ssl->conf->alpn_list != NULL) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005439 /* alpn_chosen should point to an item in the configured list */
Gilles Peskine449bd832023-01-11 14:50:10 +01005440 for (cur = ssl->conf->alpn_list; *cur != NULL; cur++) {
5441 if (strlen(*cur) == alpn_len &&
Waleed Elmelegy131b2ff2024-03-14 01:39:39 +00005442 memcmp(p, *cur, alpn_len) == 0) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005443 ssl->alpn_chosen = *cur;
5444 break;
5445 }
5446 }
5447 }
5448
5449 /* can only happen on conf mismatch */
Gilles Peskine449bd832023-01-11 14:50:10 +01005450 if (alpn_len != 0 && ssl->alpn_chosen == NULL) {
5451 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5452 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02005453
5454 p += alpn_len;
5455 }
5456#endif /* MBEDTLS_SSL_ALPN */
5457
5458 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02005459 * Forced fields from top-level ssl_context structure
5460 *
5461 * Most of them already set to the correct value by mbedtls_ssl_init() and
5462 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
5463 */
5464 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Glenn Strauss60bfe602022-03-14 19:04:24 -04005465 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02005466
Hanno Becker361b10d2019-08-30 10:42:49 +01005467 /* Adjust pointers for header fields of outgoing records to
5468 * the given transform, accounting for explicit IV and CID. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005469 mbedtls_ssl_update_out_pointers(ssl, ssl->transform);
Hanno Becker361b10d2019-08-30 10:42:49 +01005470
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02005471#if defined(MBEDTLS_SSL_PROTO_DTLS)
5472 ssl->in_epoch = 1;
5473#endif
5474
5475 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
5476 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00005477 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
5478 * inappropriately. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005479 if (ssl->handshake != NULL) {
5480 mbedtls_ssl_handshake_free(ssl);
5481 mbedtls_free(ssl->handshake);
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02005482 ssl->handshake = NULL;
5483 }
5484
5485 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02005486 * Done - should have consumed entire buffer
5487 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005488 if (p != end) {
5489 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
5490 }
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005491
Gilles Peskine449bd832023-01-11 14:50:10 +01005492 return 0;
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02005493}
5494
5495/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02005496 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005497 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005498int mbedtls_ssl_context_load(mbedtls_ssl_context *context,
5499 const unsigned char *buf,
5500 size_t len)
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005501{
Gilles Peskine449bd832023-01-11 14:50:10 +01005502 int ret = ssl_context_load(context, buf, len);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005503
Gilles Peskine449bd832023-01-11 14:50:10 +01005504 if (ret != 0) {
5505 mbedtls_ssl_free(context);
5506 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005507
Gilles Peskine449bd832023-01-11 14:50:10 +01005508 return ret;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005509}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02005510#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02005511
5512/*
Paul Bakker5121ce52009-01-03 21:22:43 +00005513 * Free an SSL context
5514 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005515void mbedtls_ssl_free(mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00005516{
Gilles Peskine449bd832023-01-11 14:50:10 +01005517 if (ssl == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005518 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01005519 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02005520
Gilles Peskine449bd832023-01-11 14:50:10 +01005521 MBEDTLS_SSL_DEBUG_MSG(2, ("=> free"));
Paul Bakker5121ce52009-01-03 21:22:43 +00005522
Gilles Peskine449bd832023-01-11 14:50:10 +01005523 if (ssl->out_buf != NULL) {
sander-visserb8aa2072020-05-06 22:05:13 +02005524#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
5525 size_t out_buf_len = ssl->out_buf_len;
5526#else
5527 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
5528#endif
5529
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005530 mbedtls_zeroize_and_free(ssl->out_buf, out_buf_len);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05005531 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00005532 }
5533
Gilles Peskine449bd832023-01-11 14:50:10 +01005534 if (ssl->in_buf != NULL) {
sander-visserb8aa2072020-05-06 22:05:13 +02005535#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
5536 size_t in_buf_len = ssl->in_buf_len;
5537#else
5538 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
5539#endif
5540
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005541 mbedtls_zeroize_and_free(ssl->in_buf, in_buf_len);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05005542 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00005543 }
5544
Gilles Peskine449bd832023-01-11 14:50:10 +01005545 if (ssl->transform) {
5546 mbedtls_ssl_transform_free(ssl->transform);
5547 mbedtls_free(ssl->transform);
Paul Bakker48916f92012-09-16 19:57:18 +00005548 }
5549
Gilles Peskine449bd832023-01-11 14:50:10 +01005550 if (ssl->handshake) {
5551 mbedtls_ssl_handshake_free(ssl);
5552 mbedtls_free(ssl->handshake);
Jerry Yu2e199812022-12-01 18:57:19 +08005553
5554#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005555 mbedtls_ssl_transform_free(ssl->transform_negotiate);
5556 mbedtls_free(ssl->transform_negotiate);
Jerry Yu2e199812022-12-01 18:57:19 +08005557#endif
5558
Gilles Peskine449bd832023-01-11 14:50:10 +01005559 mbedtls_ssl_session_free(ssl->session_negotiate);
5560 mbedtls_free(ssl->session_negotiate);
Paul Bakker48916f92012-09-16 19:57:18 +00005561 }
5562
Ronald Cron6f135e12021-12-08 16:57:54 +01005563#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01005564 mbedtls_ssl_transform_free(ssl->transform_application);
5565 mbedtls_free(ssl->transform_application);
Ronald Cron6f135e12021-12-08 16:57:54 +01005566#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01005567
Gilles Peskine449bd832023-01-11 14:50:10 +01005568 if (ssl->session) {
5569 mbedtls_ssl_session_free(ssl->session);
5570 mbedtls_free(ssl->session);
Paul Bakkerc0463502013-02-14 11:19:38 +01005571 }
5572
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02005573#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005574 if (ssl->hostname != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005575 mbedtls_zeroize_and_free(ssl->hostname, strlen(ssl->hostname));
Paul Bakker5121ce52009-01-03 21:22:43 +00005576 }
Paul Bakker0be444a2013-08-27 21:55:01 +02005577#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005578
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02005579#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005580 mbedtls_free(ssl->cli_id);
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02005581#endif
5582
Gilles Peskine449bd832023-01-11 14:50:10 +01005583 MBEDTLS_SSL_DEBUG_MSG(2, ("<= free"));
Paul Bakker2da561c2009-02-05 18:00:28 +00005584
Paul Bakker86f04f42013-02-14 11:20:09 +01005585 /* Actually clear after last debug message */
Gilles Peskine449bd832023-01-11 14:50:10 +01005586 mbedtls_platform_zeroize(ssl, sizeof(mbedtls_ssl_context));
Paul Bakker5121ce52009-01-03 21:22:43 +00005587}
5588
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005589/*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08005590 * Initialize mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005591 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005592void mbedtls_ssl_config_init(mbedtls_ssl_config *conf)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005593{
Gilles Peskine449bd832023-01-11 14:50:10 +01005594 memset(conf, 0, sizeof(mbedtls_ssl_config));
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005595}
5596
Gilles Peskineae270bf2021-06-02 00:05:29 +02005597/* The selection should be the same as mbedtls_x509_crt_profile_default in
5598 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02005599 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02005600 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02005601 * about this list.
5602 */
Chien Wong4e9683e2023-12-28 17:07:43 +08005603static const uint16_t ssl_preset_default_groups[] = {
Valerio Settidb6b4db2023-09-01 09:20:51 +02005604#if defined(MBEDTLS_ECP_HAVE_CURVE25519)
Brett Warrene0edc842021-08-17 09:53:13 +01005605 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02005606#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005607#if defined(MBEDTLS_ECP_HAVE_SECP256R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005608 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02005609#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005610#if defined(MBEDTLS_ECP_HAVE_SECP384R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005611 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005612#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005613#if defined(MBEDTLS_ECP_HAVE_CURVE448)
Brett Warrene0edc842021-08-17 09:53:13 +01005614 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005615#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005616#if defined(MBEDTLS_ECP_HAVE_SECP521R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005617 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005618#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005619#if defined(MBEDTLS_ECP_HAVE_BP256R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005620 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02005621#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005622#if defined(MBEDTLS_ECP_HAVE_BP384R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005623 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005624#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005625#if defined(MBEDTLS_ECP_HAVE_BP512R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005626 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005627#endif
Przemek Stekiel316c19e2023-05-31 15:25:11 +02005628#if defined(PSA_WANT_ALG_FFDH)
Przemek Stekiel383f4712022-12-12 14:48:57 +01005629 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048,
5630 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072,
5631 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096,
5632 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144,
5633 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192,
5634#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005635 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02005636};
Gilles Peskineae270bf2021-06-02 00:05:29 +02005637
Alexey Tsvetkov2ca34372022-06-07 10:21:05 +03005638static const int ssl_preset_suiteb_ciphersuites[] = {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005639 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
5640 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
5641 0
5642};
5643
Ronald Crone68ab4f2022-10-05 12:46:29 +02005644#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01005645
Jerry Yu909df7b2022-01-22 11:56:27 +08005646/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08005647 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08005648 * rules SHOULD be upheld.
5649 * - No duplicate entries.
5650 * - But if there is a good reason, do not change the order of the algorithms.
Jerry Yu09a99fc2022-07-28 14:22:17 +08005651 * - ssl_tls12_preset* is for TLS 1.2 use only.
Jerry Yu370e1462022-01-25 10:36:53 +08005652 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08005653 */
Chien Wong4e9683e2023-12-28 17:07:43 +08005654static const uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08005655
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005656#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005657 defined(MBEDTLS_MD_CAN_SHA256) && \
Valerio Setticf29c5d2023-09-01 09:03:41 +02005658 defined(PSA_WANT_ECC_SECP_R1_256)
Jerry Yued5e9f42022-01-26 11:21:34 +08005659 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005660 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256)
5661#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005662
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005663#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005664 defined(MBEDTLS_MD_CAN_SHA384) && \
Valerio Setticf29c5d2023-09-01 09:03:41 +02005665 defined(PSA_WANT_ECC_SECP_R1_384)
Jerry Yu909df7b2022-01-22 11:56:27 +08005666 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005667 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384)
5668#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005669
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005670#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005671 defined(MBEDTLS_MD_CAN_SHA512) && \
Valerio Setticf29c5d2023-09-01 09:03:41 +02005672 defined(PSA_WANT_ECC_SECP_R1_521)
Jerry Yued5e9f42022-01-26 11:21:34 +08005673 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005674 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512)
5675#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005676
Yanray Wang1136fad2023-11-22 16:54:31 +08005677#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA512)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005678 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
Yanray Wang1136fad2023-11-22 16:54:31 +08005679#endif
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005680
Yanray Wang1136fad2023-11-22 16:54:31 +08005681#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA384)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005682 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
Yanray Wang1136fad2023-11-22 16:54:31 +08005683#endif
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005684
Yanray Wang1136fad2023-11-22 16:54:31 +08005685#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005686 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Yanray Wang1136fad2023-11-22 16:54:31 +08005687#endif
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005688
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005689#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA512)
Jerry Yu693a47a2022-06-23 14:02:28 +08005690 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005691#endif /* MBEDTLS_RSA_C && MBEDTLS_MD_CAN_SHA512 */
Jerry Yu693a47a2022-06-23 14:02:28 +08005692
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005693#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA384)
Jerry Yu693a47a2022-06-23 14:02:28 +08005694 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005695#endif /* MBEDTLS_RSA_C && MBEDTLS_MD_CAN_SHA384 */
Jerry Yu693a47a2022-06-23 14:02:28 +08005696
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005697#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yu693a47a2022-06-23 14:02:28 +08005698 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005699#endif /* MBEDTLS_RSA_C && MBEDTLS_MD_CAN_SHA256 */
Jerry Yu693a47a2022-06-23 14:02:28 +08005700
Gabor Mezei15b95a62022-05-09 16:37:58 +02005701 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08005702};
5703
5704/* NOTICE: see above */
5705#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5706static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Yanray Wang1136fad2023-11-22 16:54:31 +08005707
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005708#if defined(MBEDTLS_MD_CAN_SHA512)
Valerio Settie9646ec2023-08-02 20:02:28 +02005709#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005710 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512),
Jerry Yu713013f2022-01-17 18:16:35 +08005711#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08005712#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5713 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
Yanray Wang1136fad2023-11-22 16:54:31 +08005714#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005715#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005716 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512),
Gabor Mezeic1051b62022-05-10 13:13:58 +02005717#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005718#endif /* MBEDTLS_MD_CAN_SHA512 */
5719
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005720#if defined(MBEDTLS_MD_CAN_SHA384)
Valerio Settie9646ec2023-08-02 20:02:28 +02005721#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005722 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08005723#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08005724#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5725 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
Yanray Wang1136fad2023-11-22 16:54:31 +08005726#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005727#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005728 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384),
Gabor Mezeic1051b62022-05-10 13:13:58 +02005729#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005730#endif /* MBEDTLS_MD_CAN_SHA384 */
5731
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005732#if defined(MBEDTLS_MD_CAN_SHA256)
Valerio Settie9646ec2023-08-02 20:02:28 +02005733#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005734 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08005735#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08005736#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5737 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Yanray Wang1136fad2023-11-22 16:54:31 +08005738#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005739#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005740 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256),
Gabor Mezeic1051b62022-05-10 13:13:58 +02005741#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005742#endif /* MBEDTLS_MD_CAN_SHA256 */
5743
Gabor Mezei15b95a62022-05-09 16:37:58 +02005744 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08005745};
5746#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Yanray Wang1136fad2023-11-22 16:54:31 +08005747
Jerry Yu909df7b2022-01-22 11:56:27 +08005748/* NOTICE: see above */
Chien Wong4e9683e2023-12-28 17:07:43 +08005749static const uint16_t ssl_preset_suiteb_sig_algs[] = {
Jerry Yu909df7b2022-01-22 11:56:27 +08005750
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005751#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Valerio Setti45d56f32023-07-13 17:23:20 +02005752 defined(MBEDTLS_MD_CAN_SHA256) && \
Valerio Settidb6b4db2023-09-01 09:20:51 +02005753 defined(MBEDTLS_ECP_HAVE_SECP256R1)
Jerry Yu909df7b2022-01-22 11:56:27 +08005754 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005755 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256)
5756#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005757
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005758#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Valerio Setti45d56f32023-07-13 17:23:20 +02005759 defined(MBEDTLS_MD_CAN_SHA384) && \
Valerio Settidb6b4db2023-09-01 09:20:51 +02005760 defined(MBEDTLS_ECP_HAVE_SECP384R1)
Jerry Yu53037892022-01-25 11:02:06 +08005761 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005762 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384)
5763#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005764
Gabor Mezei15b95a62022-05-09 16:37:58 +02005765 MBEDTLS_TLS_SIG_NONE
Jerry Yu713013f2022-01-17 18:16:35 +08005766};
Jerry Yu6106fdc2022-01-12 16:36:14 +08005767
Jerry Yu909df7b2022-01-22 11:56:27 +08005768/* NOTICE: see above */
5769#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5770static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Yanray Wang1136fad2023-11-22 16:54:31 +08005771
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005772#if defined(MBEDTLS_MD_CAN_SHA256)
Valerio Settie9646ec2023-08-02 20:02:28 +02005773#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005774 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256),
Jerry Yu713013f2022-01-17 18:16:35 +08005775#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005776#endif /* MBEDTLS_MD_CAN_SHA256 */
Yanray Wang69ceb392023-11-22 16:32:39 +08005777
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005778#if defined(MBEDTLS_MD_CAN_SHA384)
Valerio Settie9646ec2023-08-02 20:02:28 +02005779#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005780 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384),
Jerry Yu18c833e2022-01-25 10:55:47 +08005781#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005782#endif /* MBEDTLS_MD_CAN_SHA384 */
5783
Gabor Mezei15b95a62022-05-09 16:37:58 +02005784 MBEDTLS_TLS_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01005785};
Jerry Yu909df7b2022-01-22 11:56:27 +08005786#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5787
Ronald Crone68ab4f2022-10-05 12:46:29 +02005788#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005789
Chien Wong4e9683e2023-12-28 17:07:43 +08005790static const uint16_t ssl_preset_suiteb_groups[] = {
Valerio Settidb6b4db2023-09-01 09:20:51 +02005791#if defined(MBEDTLS_ECP_HAVE_SECP256R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005792 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01005793#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005794#if defined(MBEDTLS_ECP_HAVE_SECP384R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005795 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01005796#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005797 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005798};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005799
Ronald Crone68ab4f2022-10-05 12:46:29 +02005800#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005801/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08005802 * to make sure there are no duplicated signature algorithm entries. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005803MBEDTLS_CHECK_RETURN_CRITICAL
Chien Wong4e9683e2023-12-28 17:07:43 +08005804static int ssl_check_no_sig_alg_duplication(const uint16_t *sig_algs)
Jerry Yu1a8b4812022-01-20 17:56:50 +08005805{
5806 size_t i, j;
5807 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08005808
Gilles Peskine449bd832023-01-11 14:50:10 +01005809 for (i = 0; sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++) {
5810 for (j = 0; j < i; j++) {
5811 if (sig_algs[i] != sig_algs[j]) {
Jerry Yuf377d642022-01-25 10:43:59 +08005812 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01005813 }
5814 mbedtls_printf(" entry(%04x,%" MBEDTLS_PRINTF_SIZET
5815 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
5816 sig_algs[i], j, i);
Jerry Yuf377d642022-01-25 10:43:59 +08005817 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005818 }
5819 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005820 return ret;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005821}
5822
Ronald Crone68ab4f2022-10-05 12:46:29 +02005823#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08005824
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005825/*
Tillmann Karras588ad502015-09-25 04:27:22 +02005826 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005827 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005828int mbedtls_ssl_config_defaults(mbedtls_ssl_config *conf,
5829 int endpoint, int transport, int preset)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005830{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005831#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00005832 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005833#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005834
Ronald Crone68ab4f2022-10-05 12:46:29 +02005835#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005836 if (ssl_check_no_sig_alg_duplication(ssl_preset_suiteb_sig_algs)) {
5837 mbedtls_printf("ssl_preset_suiteb_sig_algs has duplicated entries\n");
5838 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005839 }
5840
Gilles Peskine449bd832023-01-11 14:50:10 +01005841 if (ssl_check_no_sig_alg_duplication(ssl_preset_default_sig_algs)) {
5842 mbedtls_printf("ssl_preset_default_sig_algs has duplicated entries\n");
5843 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005844 }
Jerry Yu909df7b2022-01-22 11:56:27 +08005845
5846#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005847 if (ssl_check_no_sig_alg_duplication(ssl_tls12_preset_suiteb_sig_algs)) {
5848 mbedtls_printf("ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n");
5849 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu909df7b2022-01-22 11:56:27 +08005850 }
5851
Gilles Peskine449bd832023-01-11 14:50:10 +01005852 if (ssl_check_no_sig_alg_duplication(ssl_tls12_preset_default_sig_algs)) {
5853 mbedtls_printf("ssl_tls12_preset_default_sig_algs has duplicated entries\n");
5854 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu909df7b2022-01-22 11:56:27 +08005855 }
5856#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02005857#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08005858
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02005859 /* Use the functions here so that they are covered in tests,
5860 * but otherwise access member directly for efficiency */
Gilles Peskine449bd832023-01-11 14:50:10 +01005861 mbedtls_ssl_conf_endpoint(conf, endpoint);
5862 mbedtls_ssl_conf_transport(conf, transport);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005863
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005864 /*
5865 * Things that are common to all presets
5866 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005867#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005868 if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005869 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
5870#if defined(MBEDTLS_SSL_SESSION_TICKETS)
5871 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
5872#endif
5873 }
5874#endif
5875
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005876#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5877 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
5878#endif
5879
5880#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5881 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
5882#endif
5883
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02005884#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005885 conf->f_cookie_write = ssl_cookie_write_dummy;
5886 conf->f_cookie_check = ssl_cookie_check_dummy;
5887#endif
5888
5889#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5890 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
5891#endif
5892
Janos Follath088ce432017-04-10 12:42:31 +01005893#if defined(MBEDTLS_SSL_SRV_C)
5894 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02005895 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01005896#endif
5897
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005898#if defined(MBEDTLS_SSL_PROTO_DTLS)
5899 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
5900 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
5901#endif
5902
5903#if defined(MBEDTLS_SSL_RENEGOTIATION)
5904 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005905 memset(conf->renego_period, 0x00, 2);
5906 memset(conf->renego_period + 2, 0xFF, 6);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005907#endif
5908
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005909#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005910 if (endpoint == MBEDTLS_SSL_IS_SERVER) {
Hanno Beckere2defad2021-07-24 05:59:17 +01005911 const unsigned char dhm_p[] =
5912 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
5913 const unsigned char dhm_g[] =
5914 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01005915
Gilles Peskine449bd832023-01-11 14:50:10 +01005916 if ((ret = mbedtls_ssl_conf_dh_param_bin(conf,
5917 dhm_p, sizeof(dhm_p),
5918 dhm_g, sizeof(dhm_g))) != 0) {
5919 return ret;
Hanno Beckere2defad2021-07-24 05:59:17 +01005920 }
5921 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02005922#endif
5923
Ronald Cron6f135e12021-12-08 16:57:54 +01005924#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005925
5926#if defined(MBEDTLS_SSL_EARLY_DATA)
Yanray Wangd5ed36f2023-11-07 11:40:43 +08005927 mbedtls_ssl_conf_early_data(conf, MBEDTLS_SSL_EARLY_DATA_DISABLED);
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005928#if defined(MBEDTLS_SSL_SRV_C)
Yanray Wang07517612023-11-07 11:47:36 +08005929 mbedtls_ssl_conf_max_early_data_size(conf, MBEDTLS_SSL_MAX_EARLY_DATA_SIZE);
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005930#endif
5931#endif /* MBEDTLS_SSL_EARLY_DATA */
5932
Jerry Yud0766ec2022-09-22 10:46:57 +08005933#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08005934 mbedtls_ssl_conf_new_session_tickets(
Gilles Peskine449bd832023-01-11 14:50:10 +01005935 conf, MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS);
Jerry Yu1ad7ace2022-08-09 13:28:39 +08005936#endif
Hanno Becker71f1ed62021-07-24 06:01:47 +01005937 /*
5938 * Allow all TLS 1.3 key exchange modes by default.
5939 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00005940 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01005941#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01005942
Gilles Peskine449bd832023-01-11 14:50:10 +01005943 if (transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Glenn Strauss2dfcea22022-03-14 17:26:42 -04005944#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
XiaokangQian4d3a6042022-04-21 13:46:17 +00005945 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian060d8672022-04-21 09:24:56 +00005946 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005947#else
Gilles Peskine449bd832023-01-11 14:50:10 +01005948 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian060d8672022-04-21 09:24:56 +00005949#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005950 } else {
XiaokangQian4d3a6042022-04-21 13:46:17 +00005951#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron097ba142023-03-08 16:18:00 +01005952 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5953 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005954#elif defined(MBEDTLS_SSL_PROTO_TLS1_3)
5955 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5956 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5957#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
5958 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5959 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5960#else
Gilles Peskine449bd832023-01-11 14:50:10 +01005961 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005962#endif
5963 }
Glenn Strauss2dfcea22022-03-14 17:26:42 -04005964
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005965 /*
5966 * Preset-specific defaults
5967 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005968 switch (preset) {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005969 /*
5970 * NSA Suite B
5971 */
5972 case MBEDTLS_SSL_PRESET_SUITEB:
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005973
Hanno Beckerd60b6c62021-04-29 12:04:11 +01005974 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005975
5976#if defined(MBEDTLS_X509_CRT_PARSE_C)
5977 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005978#endif
5979
Ronald Crone68ab4f2022-10-05 12:46:29 +02005980#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005981#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005982 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
Jerry Yu909df7b2022-01-22 11:56:27 +08005983 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
Gilles Peskine449bd832023-01-11 14:50:10 +01005984 } else
Jerry Yu909df7b2022-01-22 11:56:27 +08005985#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005986 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02005987#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005988
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02005989#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
Brett Warrene0edc842021-08-17 09:53:13 +01005990 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005991#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005992 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02005993 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005994
5995 /*
5996 * Default
5997 */
5998 default:
Ronald Cronf6606552022-03-15 11:23:25 +01005999
Hanno Beckerd60b6c62021-04-29 12:04:11 +01006000 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006001
6002#if defined(MBEDTLS_X509_CRT_PARSE_C)
6003 conf->cert_profile = &mbedtls_x509_crt_profile_default;
6004#endif
6005
Ronald Crone68ab4f2022-10-05 12:46:29 +02006006#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08006007#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01006008 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
Jerry Yu909df7b2022-01-22 11:56:27 +08006009 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
Gilles Peskine449bd832023-01-11 14:50:10 +01006010 } else
Jerry Yu909df7b2022-01-22 11:56:27 +08006011#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006012 conf->sig_algs = ssl_preset_default_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02006013#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006014
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02006015#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
Brett Warrene0edc842021-08-17 09:53:13 +01006016 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006017#endif
Brett Warrene0edc842021-08-17 09:53:13 +01006018 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02006019
6020#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
6021 conf->dhm_min_bitlen = 1024;
6022#endif
6023 }
6024
Gilles Peskine449bd832023-01-11 14:50:10 +01006025 return 0;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006026}
6027
6028/*
6029 * Free mbedtls_ssl_config
6030 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006031void mbedtls_ssl_config_free(mbedtls_ssl_config *conf)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006032{
6033#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006034 mbedtls_mpi_free(&conf->dhm_P);
6035 mbedtls_mpi_free(&conf->dhm_G);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006036#endif
6037
Ronald Cron73fe8df2022-10-05 14:31:43 +02006038#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02006039#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01006040 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02006041 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
6042 }
Neil Armstrong8ecd6682022-05-05 11:40:35 +02006043#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01006044 if (conf->psk != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01006045 mbedtls_zeroize_and_free(conf->psk, conf->psk_len);
Azim Khan27e8a122018-03-21 14:24:11 +00006046 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006047 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09006048 }
6049
Gilles Peskine449bd832023-01-11 14:50:10 +01006050 if (conf->psk_identity != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01006051 mbedtls_zeroize_and_free(conf->psk_identity, conf->psk_identity_len);
Azim Khan27e8a122018-03-21 14:24:11 +00006052 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006053 conf->psk_identity_len = 0;
6054 }
Ronald Cron73fe8df2022-10-05 14:31:43 +02006055#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006056
6057#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006058 ssl_key_cert_free(conf->key_cert);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006059#endif
6060
Gilles Peskine449bd832023-01-11 14:50:10 +01006061 mbedtls_platform_zeroize(conf, sizeof(mbedtls_ssl_config));
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02006062}
6063
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02006064#if defined(MBEDTLS_PK_C) && \
Valerio Settie9646ec2023-08-02 20:02:28 +02006065 (defined(MBEDTLS_RSA_C) || defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED))
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006066/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006067 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006068 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006069unsigned char mbedtls_ssl_sig_from_pk(mbedtls_pk_context *pk)
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006070{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006071#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006072 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_RSA)) {
6073 return MBEDTLS_SSL_SIG_RSA;
6074 }
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006075#endif
Valerio Settie9646ec2023-08-02 20:02:28 +02006076#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006077 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_ECDSA)) {
6078 return MBEDTLS_SSL_SIG_ECDSA;
6079 }
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006080#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006081 return MBEDTLS_SSL_SIG_ANON;
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02006082}
6083
Gilles Peskine449bd832023-01-11 14:50:10 +01006084unsigned char mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type)
Hanno Becker7e5437a2017-04-28 17:15:26 +01006085{
Gilles Peskine449bd832023-01-11 14:50:10 +01006086 switch (type) {
Hanno Becker7e5437a2017-04-28 17:15:26 +01006087 case MBEDTLS_PK_RSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01006088 return MBEDTLS_SSL_SIG_RSA;
Hanno Becker7e5437a2017-04-28 17:15:26 +01006089 case MBEDTLS_PK_ECDSA:
6090 case MBEDTLS_PK_ECKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01006091 return MBEDTLS_SSL_SIG_ECDSA;
Hanno Becker7e5437a2017-04-28 17:15:26 +01006092 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006093 return MBEDTLS_SSL_SIG_ANON;
Hanno Becker7e5437a2017-04-28 17:15:26 +01006094 }
6095}
6096
Gilles Peskine449bd832023-01-11 14:50:10 +01006097mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig(unsigned char sig)
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006098{
Gilles Peskine449bd832023-01-11 14:50:10 +01006099 switch (sig) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006100#if defined(MBEDTLS_RSA_C)
6101 case MBEDTLS_SSL_SIG_RSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01006102 return MBEDTLS_PK_RSA;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006103#endif
Valerio Settie9646ec2023-08-02 20:02:28 +02006104#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006105 case MBEDTLS_SSL_SIG_ECDSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01006106 return MBEDTLS_PK_ECDSA;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006107#endif
6108 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006109 return MBEDTLS_PK_NONE;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006110 }
6111}
Valerio Settie9646ec2023-08-02 20:02:28 +02006112#endif /* MBEDTLS_PK_C &&
6113 ( MBEDTLS_RSA_C || MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006114
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02006115/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006116 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02006117 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006118mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash(unsigned char hash)
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006119{
Gilles Peskine449bd832023-01-11 14:50:10 +01006120 switch (hash) {
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006121#if defined(MBEDTLS_MD_CAN_MD5)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006122 case MBEDTLS_SSL_HASH_MD5:
Gilles Peskine449bd832023-01-11 14:50:10 +01006123 return MBEDTLS_MD_MD5;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006124#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006125#if defined(MBEDTLS_MD_CAN_SHA1)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006126 case MBEDTLS_SSL_HASH_SHA1:
Gilles Peskine449bd832023-01-11 14:50:10 +01006127 return MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006128#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006129#if defined(MBEDTLS_MD_CAN_SHA224)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006130 case MBEDTLS_SSL_HASH_SHA224:
Gilles Peskine449bd832023-01-11 14:50:10 +01006131 return MBEDTLS_MD_SHA224;
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02006132#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006133#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006134 case MBEDTLS_SSL_HASH_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01006135 return MBEDTLS_MD_SHA256;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006136#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006137#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006138 case MBEDTLS_SSL_HASH_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01006139 return MBEDTLS_MD_SHA384;
Mateusz Starzyk3352a532021-04-06 14:28:22 +02006140#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006141#if defined(MBEDTLS_MD_CAN_SHA512)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006142 case MBEDTLS_SSL_HASH_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01006143 return MBEDTLS_MD_SHA512;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006144#endif
6145 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006146 return MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02006147 }
6148}
6149
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006150/*
6151 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
6152 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006153unsigned char mbedtls_ssl_hash_from_md_alg(int md)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006154{
Gilles Peskine449bd832023-01-11 14:50:10 +01006155 switch (md) {
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006156#if defined(MBEDTLS_MD_CAN_MD5)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006157 case MBEDTLS_MD_MD5:
Gilles Peskine449bd832023-01-11 14:50:10 +01006158 return MBEDTLS_SSL_HASH_MD5;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006159#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006160#if defined(MBEDTLS_MD_CAN_SHA1)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006161 case MBEDTLS_MD_SHA1:
Gilles Peskine449bd832023-01-11 14:50:10 +01006162 return MBEDTLS_SSL_HASH_SHA1;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006163#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006164#if defined(MBEDTLS_MD_CAN_SHA224)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006165 case MBEDTLS_MD_SHA224:
Gilles Peskine449bd832023-01-11 14:50:10 +01006166 return MBEDTLS_SSL_HASH_SHA224;
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02006167#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006168#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006169 case MBEDTLS_MD_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01006170 return MBEDTLS_SSL_HASH_SHA256;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006171#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006172#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006173 case MBEDTLS_MD_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01006174 return MBEDTLS_SSL_HASH_SHA384;
Mateusz Starzyk3352a532021-04-06 14:28:22 +02006175#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006176#if defined(MBEDTLS_MD_CAN_SHA512)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006177 case MBEDTLS_MD_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01006178 return MBEDTLS_SSL_HASH_SHA512;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006179#endif
6180 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006181 return MBEDTLS_SSL_HASH_NONE;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006182 }
6183}
6184
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006185/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02006186 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02006187 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006188 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006189int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006190{
Gilles Peskine449bd832023-01-11 14:50:10 +01006191 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl);
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006192
Gilles Peskine449bd832023-01-11 14:50:10 +01006193 if (group_list == NULL) {
6194 return -1;
Brett Warrene0edc842021-08-17 09:53:13 +01006195 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006196
Gilles Peskine449bd832023-01-11 14:50:10 +01006197 for (; *group_list != 0; group_list++) {
6198 if (*group_list == tls_id) {
6199 return 0;
6200 }
6201 }
6202
6203 return -1;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006204}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01006205
Valerio Setti49e69072023-06-27 17:27:51 +02006206#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01006207/*
6208 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
6209 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006210int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id)
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01006211{
Gilles Peskine449bd832023-01-11 14:50:10 +01006212 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id);
Leonid Rozenboim19e59732022-08-08 16:52:38 -07006213
Gilles Peskine449bd832023-01-11 14:50:10 +01006214 if (tls_id == 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07006215 return -1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006216 }
Leonid Rozenboim19e59732022-08-08 16:52:38 -07006217
Gilles Peskine449bd832023-01-11 14:50:10 +01006218 return mbedtls_ssl_check_curve_tls_id(ssl, tls_id);
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01006219}
Valerio Setti49e69072023-06-27 17:27:51 +02006220#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
Valerio Setti67419f02023-01-04 16:12:42 +01006221
Valerio Setti18c9fed2022-12-30 17:44:24 +01006222static const struct {
6223 uint16_t tls_id;
6224 mbedtls_ecp_group_id ecp_group_id;
6225 psa_ecc_family_t psa_family;
6226 uint16_t bits;
Valerio Setti18c9fed2022-12-30 17:44:24 +01006227} tls_id_match_table[] =
6228{
Valerio Settidb6b4db2023-09-01 09:20:51 +02006229#if defined(MBEDTLS_ECP_HAVE_SECP521R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006230 { 25, MBEDTLS_ECP_DP_SECP521R1, PSA_ECC_FAMILY_SECP_R1, 521 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006231#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006232#if defined(MBEDTLS_ECP_HAVE_BP512R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006233 { 28, MBEDTLS_ECP_DP_BP512R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006234#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006235#if defined(MBEDTLS_ECP_HAVE_SECP384R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006236 { 24, MBEDTLS_ECP_DP_SECP384R1, PSA_ECC_FAMILY_SECP_R1, 384 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006237#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006238#if defined(MBEDTLS_ECP_HAVE_BP384R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006239 { 27, MBEDTLS_ECP_DP_BP384R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006240#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006241#if defined(MBEDTLS_ECP_HAVE_SECP256R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006242 { 23, MBEDTLS_ECP_DP_SECP256R1, PSA_ECC_FAMILY_SECP_R1, 256 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006243#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006244#if defined(MBEDTLS_ECP_HAVE_SECP256K1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006245 { 22, MBEDTLS_ECP_DP_SECP256K1, PSA_ECC_FAMILY_SECP_K1, 256 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006246#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006247#if defined(MBEDTLS_ECP_HAVE_BP256R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006248 { 26, MBEDTLS_ECP_DP_BP256R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006249#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006250#if defined(MBEDTLS_ECP_HAVE_SECP224R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006251 { 21, MBEDTLS_ECP_DP_SECP224R1, PSA_ECC_FAMILY_SECP_R1, 224 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006252#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006253#if defined(MBEDTLS_ECP_HAVE_SECP224K1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006254 { 20, MBEDTLS_ECP_DP_SECP224K1, PSA_ECC_FAMILY_SECP_K1, 224 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006255#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006256#if defined(MBEDTLS_ECP_HAVE_SECP192R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006257 { 19, MBEDTLS_ECP_DP_SECP192R1, PSA_ECC_FAMILY_SECP_R1, 192 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006258#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006259#if defined(MBEDTLS_ECP_HAVE_SECP192K1)
Valerio Settiacd32c02023-06-29 18:06:29 +02006260 { 18, MBEDTLS_ECP_DP_SECP192K1, PSA_ECC_FAMILY_SECP_K1, 192 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006261#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006262#if defined(MBEDTLS_ECP_HAVE_CURVE25519)
Valerio Settiacd32c02023-06-29 18:06:29 +02006263 { 29, MBEDTLS_ECP_DP_CURVE25519, PSA_ECC_FAMILY_MONTGOMERY, 255 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006264#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02006265#if defined(MBEDTLS_ECP_HAVE_CURVE448)
Valerio Settiacd32c02023-06-29 18:06:29 +02006266 { 30, MBEDTLS_ECP_DP_CURVE448, PSA_ECC_FAMILY_MONTGOMERY, 448 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006267#endif
Valerio Settiacd32c02023-06-29 18:06:29 +02006268 { 0, MBEDTLS_ECP_DP_NONE, 0, 0 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01006269};
6270
Gilles Peskine449bd832023-01-11 14:50:10 +01006271int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id,
Przemek Stekielda4fba62023-06-02 14:52:28 +02006272 psa_key_type_t *type,
Gilles Peskine449bd832023-01-11 14:50:10 +01006273 size_t *bits)
Valerio Setti18c9fed2022-12-30 17:44:24 +01006274{
Gilles Peskine449bd832023-01-11 14:50:10 +01006275 for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) {
6276 if (tls_id_match_table[i].tls_id == tls_id) {
Przemek Stekielda4fba62023-06-02 14:52:28 +02006277 if (type != NULL) {
6278 *type = PSA_KEY_TYPE_ECC_KEY_PAIR(tls_id_match_table[i].psa_family);
Gilles Peskine449bd832023-01-11 14:50:10 +01006279 }
6280 if (bits != NULL) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01006281 *bits = tls_id_match_table[i].bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01006282 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01006283 return PSA_SUCCESS;
6284 }
6285 }
6286
6287 return PSA_ERROR_NOT_SUPPORTED;
6288}
6289
Gilles Peskine449bd832023-01-11 14:50:10 +01006290mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01006291{
Gilles Peskine449bd832023-01-11 14:50:10 +01006292 for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) {
6293 if (tls_id_match_table[i].tls_id == tls_id) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01006294 return tls_id_match_table[i].ecp_group_id;
Gilles Peskine449bd832023-01-11 14:50:10 +01006295 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01006296 }
6297
6298 return MBEDTLS_ECP_DP_NONE;
6299}
6300
Gilles Peskine449bd832023-01-11 14:50:10 +01006301uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01006302{
Gilles Peskine449bd832023-01-11 14:50:10 +01006303 for (int i = 0; tls_id_match_table[i].ecp_group_id != MBEDTLS_ECP_DP_NONE;
6304 i++) {
6305 if (tls_id_match_table[i].ecp_group_id == grp_id) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01006306 return tls_id_match_table[i].tls_id;
Gilles Peskine449bd832023-01-11 14:50:10 +01006307 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01006308 }
6309
6310 return 0;
6311}
6312
Valerio Setti67419f02023-01-04 16:12:42 +01006313#if defined(MBEDTLS_DEBUG_C)
Valerio Settiacd32c02023-06-29 18:06:29 +02006314static const struct {
6315 uint16_t tls_id;
6316 const char *name;
6317} tls_id_curve_name_table[] =
6318{
Valerio Setti54e23792023-07-07 10:49:27 +02006319 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1, "secp521r1" },
6320 { MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1, "brainpoolP512r1" },
6321 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1, "secp384r1" },
6322 { MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1, "brainpoolP384r1" },
6323 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, "secp256r1" },
6324 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1, "secp256k1" },
6325 { MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1, "brainpoolP256r1" },
6326 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1, "secp224r1" },
6327 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1, "secp224k1" },
6328 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1, "secp192r1" },
6329 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1, "secp192k1" },
6330 { MBEDTLS_SSL_IANA_TLS_GROUP_X25519, "x25519" },
6331 { MBEDTLS_SSL_IANA_TLS_GROUP_X448, "x448" },
Valerio Settiacd32c02023-06-29 18:06:29 +02006332 { 0, NULL },
6333};
6334
Gilles Peskine449bd832023-01-11 14:50:10 +01006335const char *mbedtls_ssl_get_curve_name_from_tls_id(uint16_t tls_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01006336{
Valerio Settiacd32c02023-06-29 18:06:29 +02006337 for (int i = 0; tls_id_curve_name_table[i].tls_id != 0; i++) {
6338 if (tls_id_curve_name_table[i].tls_id == tls_id) {
6339 return tls_id_curve_name_table[i].name;
Gilles Peskine449bd832023-01-11 14:50:10 +01006340 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01006341 }
6342
6343 return NULL;
6344}
Valerio Setti67419f02023-01-04 16:12:42 +01006345#endif
Valerio Setti18c9fed2022-12-30 17:44:24 +01006346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006347#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006348int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert,
6349 const mbedtls_ssl_ciphersuite_t *ciphersuite,
6350 int cert_endpoint,
6351 uint32_t *flags)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006352{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006353 int ret = 0;
Dave Rodgmanc37ad442023-11-03 23:36:06 +00006354 unsigned int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006355 const char *ext_oid;
6356 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006357
Gilles Peskine449bd832023-01-11 14:50:10 +01006358 if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006359 /* Server part of the key exchange */
Gilles Peskine449bd832023-01-11 14:50:10 +01006360 switch (ciphersuite->key_exchange) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006361 case MBEDTLS_KEY_EXCHANGE_RSA:
6362 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006363 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006364 break;
6365
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006366 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
6367 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
6368 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
6369 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006370 break;
6371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006372 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
6373 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006374 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006375 break;
6376
6377 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006378 case MBEDTLS_KEY_EXCHANGE_NONE:
6379 case MBEDTLS_KEY_EXCHANGE_PSK:
6380 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
6381 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02006382 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006383 usage = 0;
6384 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006385 } else {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006386 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
6387 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006388 }
6389
Gilles Peskine449bd832023-01-11 14:50:10 +01006390 if (mbedtls_x509_crt_check_key_usage(cert, usage) != 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006391 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006392 ret = -1;
6393 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006394
Gilles Peskine449bd832023-01-11 14:50:10 +01006395 if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006396 ext_oid = MBEDTLS_OID_SERVER_AUTH;
Gilles Peskine449bd832023-01-11 14:50:10 +01006397 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH);
6398 } else {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006399 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
Gilles Peskine449bd832023-01-11 14:50:10 +01006400 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_CLIENT_AUTH);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006401 }
6402
Gilles Peskine449bd832023-01-11 14:50:10 +01006403 if (mbedtls_x509_crt_check_extended_key_usage(cert, ext_oid, ext_len) != 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006404 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006405 ret = -1;
6406 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02006407
Gilles Peskine449bd832023-01-11 14:50:10 +01006408 return ret;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006409}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006410#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02006411
Jerry Yu148165c2021-09-24 23:20:59 +08006412#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01006413int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl,
6414 const mbedtls_md_type_t md,
6415 unsigned char *dst,
6416 size_t dst_len,
6417 size_t *olen)
Jerry Yu148165c2021-09-24 23:20:59 +08006418{
Ronald Cronf6893e12022-01-07 22:09:01 +01006419 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
6420 psa_hash_operation_t *hash_operation_to_clone;
6421 psa_hash_operation_t hash_operation = psa_hash_operation_init();
6422
Jerry Yu148165c2021-09-24 23:20:59 +08006423 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01006424
Gilles Peskine449bd832023-01-11 14:50:10 +01006425 switch (md) {
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006426#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01006427 case MBEDTLS_MD_SHA384:
6428 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
6429 break;
Ronald Cronf6893e12022-01-07 22:09:01 +01006430#endif
6431
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006432#if defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +01006433 case MBEDTLS_MD_SHA256:
6434 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
6435 break;
Ronald Cronf6893e12022-01-07 22:09:01 +01006436#endif
6437
Gilles Peskine449bd832023-01-11 14:50:10 +01006438 default:
6439 goto exit;
6440 }
6441
6442 status = psa_hash_clone(hash_operation_to_clone, &hash_operation);
6443 if (status != PSA_SUCCESS) {
Ronald Cronf6893e12022-01-07 22:09:01 +01006444 goto exit;
6445 }
6446
Gilles Peskine449bd832023-01-11 14:50:10 +01006447 status = psa_hash_finish(&hash_operation, dst, dst_len, olen);
6448 if (status != PSA_SUCCESS) {
Ronald Cronf6893e12022-01-07 22:09:01 +01006449 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006450 }
Ronald Cronf6893e12022-01-07 22:09:01 +01006451
6452exit:
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006453#if !defined(MBEDTLS_MD_CAN_SHA384) && \
6454 !defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurekeabeb302022-10-17 07:52:51 -04006455 (void) ssl;
6456#endif
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05006457 return PSA_TO_MBEDTLS_ERR(status);
Jerry Yu148165c2021-09-24 23:20:59 +08006458}
6459#else /* MBEDTLS_USE_PSA_CRYPTO */
6460
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006461#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006462MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006463static int ssl_get_handshake_transcript_sha384(mbedtls_ssl_context *ssl,
6464 unsigned char *dst,
6465 size_t dst_len,
6466 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08006467{
Jerry Yu24c0ec32021-09-09 14:21:07 +08006468 int ret;
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01006469 mbedtls_md_context_t sha384;
Jerry Yu24c0ec32021-09-09 14:21:07 +08006470
Gilles Peskine449bd832023-01-11 14:50:10 +01006471 if (dst_len < 48) {
6472 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
6473 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08006474
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01006475 mbedtls_md_init(&sha384);
6476 ret = mbedtls_md_setup(&sha384, mbedtls_md_info_from_type(MBEDTLS_MD_SHA384), 0);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01006477 if (ret != 0) {
6478 goto exit;
6479 }
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01006480 ret = mbedtls_md_clone(&sha384, &ssl->handshake->fin_sha384);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01006481 if (ret != 0) {
6482 goto exit;
6483 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08006484
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01006485 if ((ret = mbedtls_md_finish(&sha384, dst)) != 0) {
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01006486 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_finish", ret);
Jerry Yu24c0ec32021-09-09 14:21:07 +08006487 goto exit;
6488 }
6489
6490 *olen = 48;
6491
6492exit:
6493
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01006494 mbedtls_md_free(&sha384);
Gilles Peskine449bd832023-01-11 14:50:10 +01006495 return ret;
Jerry Yu24c0ec32021-09-09 14:21:07 +08006496}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006497#endif /* MBEDTLS_MD_CAN_SHA384 */
Jerry Yu24c0ec32021-09-09 14:21:07 +08006498
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006499#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006500MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006501static int ssl_get_handshake_transcript_sha256(mbedtls_ssl_context *ssl,
6502 unsigned char *dst,
6503 size_t dst_len,
6504 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08006505{
Jerry Yu24c0ec32021-09-09 14:21:07 +08006506 int ret;
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01006507 mbedtls_md_context_t sha256;
Jerry Yu24c0ec32021-09-09 14:21:07 +08006508
Gilles Peskine449bd832023-01-11 14:50:10 +01006509 if (dst_len < 32) {
6510 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
6511 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08006512
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01006513 mbedtls_md_init(&sha256);
6514 ret = mbedtls_md_setup(&sha256, mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), 0);
6515 if (ret != 0) {
6516 goto exit;
6517 }
6518 ret = mbedtls_md_clone(&sha256, &ssl->handshake->fin_sha256);
6519 if (ret != 0) {
6520 goto exit;
6521 }
Jerry Yuc5aef882021-12-23 20:15:02 +08006522
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01006523 if ((ret = mbedtls_md_finish(&sha256, dst)) != 0) {
6524 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_finish", ret);
Jerry Yu24c0ec32021-09-09 14:21:07 +08006525 goto exit;
6526 }
6527
6528 *olen = 32;
6529
6530exit:
6531
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01006532 mbedtls_md_free(&sha256);
Gilles Peskine449bd832023-01-11 14:50:10 +01006533 return ret;
Jerry Yu24c0ec32021-09-09 14:21:07 +08006534}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006535#endif /* MBEDTLS_MD_CAN_SHA256 */
Jerry Yu24c0ec32021-09-09 14:21:07 +08006536
Gilles Peskine449bd832023-01-11 14:50:10 +01006537int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl,
6538 const mbedtls_md_type_t md,
6539 unsigned char *dst,
6540 size_t dst_len,
6541 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08006542{
Gilles Peskine449bd832023-01-11 14:50:10 +01006543 switch (md) {
Jerry Yuc1ddeef2021-10-08 15:14:45 +08006544
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006545#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01006546 case MBEDTLS_MD_SHA384:
6547 return ssl_get_handshake_transcript_sha384(ssl, dst, dst_len, olen);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006548#endif /* MBEDTLS_MD_CAN_SHA384*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08006549
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006550#if defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +01006551 case MBEDTLS_MD_SHA256:
6552 return ssl_get_handshake_transcript_sha256(ssl, dst, dst_len, olen);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006553#endif /* MBEDTLS_MD_CAN_SHA256*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08006554
Gilles Peskine449bd832023-01-11 14:50:10 +01006555 default:
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006556#if !defined(MBEDTLS_MD_CAN_SHA384) && \
6557 !defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +01006558 (void) ssl;
6559 (void) dst;
6560 (void) dst_len;
6561 (void) olen;
Andrzej Kurek409248a2022-10-24 10:33:21 -04006562#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006563 break;
Jerry Yuc1ddeef2021-10-08 15:14:45 +08006564 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006565 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu24c0ec32021-09-09 14:21:07 +08006566}
XiaokangQian647719a2021-12-07 09:16:29 +00006567
Jerry Yu148165c2021-09-24 23:20:59 +08006568#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08006569
Ronald Crone68ab4f2022-10-05 12:46:29 +02006570#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Gabor Mezei078e8032022-04-27 21:17:56 +02006571/* mbedtls_ssl_parse_sig_alg_ext()
6572 *
6573 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
6574 * value (TLS 1.3 RFC8446):
6575 * enum {
6576 * ....
6577 * ecdsa_secp256r1_sha256( 0x0403 ),
6578 * ecdsa_secp384r1_sha384( 0x0503 ),
6579 * ecdsa_secp521r1_sha512( 0x0603 ),
6580 * ....
6581 * } SignatureScheme;
6582 *
6583 * struct {
6584 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
6585 * } SignatureSchemeList;
6586 *
6587 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
6588 * value (TLS 1.2 RFC5246):
6589 * enum {
6590 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
6591 * sha512(6), (255)
6592 * } HashAlgorithm;
6593 *
6594 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
6595 * SignatureAlgorithm;
6596 *
6597 * struct {
6598 * HashAlgorithm hash;
6599 * SignatureAlgorithm signature;
6600 * } SignatureAndHashAlgorithm;
6601 *
6602 * SignatureAndHashAlgorithm
6603 * supported_signature_algorithms<2..2^16-2>;
6604 *
6605 * The TLS 1.3 signature algorithm extension was defined to be a compatible
6606 * generalization of the TLS 1.2 signature algorithm extension.
6607 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
6608 * `SignatureScheme` field of TLS 1.3
6609 *
6610 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006611int mbedtls_ssl_parse_sig_alg_ext(mbedtls_ssl_context *ssl,
6612 const unsigned char *buf,
6613 const unsigned char *end)
Gabor Mezei078e8032022-04-27 21:17:56 +02006614{
6615 const unsigned char *p = buf;
6616 size_t supported_sig_algs_len = 0;
6617 const unsigned char *supported_sig_algs_end;
6618 uint16_t sig_alg;
6619 uint32_t common_idx = 0;
6620
Gilles Peskine449bd832023-01-11 14:50:10 +01006621 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
6622 supported_sig_algs_len = MBEDTLS_GET_UINT16_BE(p, 0);
Gabor Mezei078e8032022-04-27 21:17:56 +02006623 p += 2;
6624
Gilles Peskine449bd832023-01-11 14:50:10 +01006625 memset(ssl->handshake->received_sig_algs, 0,
6626 sizeof(ssl->handshake->received_sig_algs));
Gabor Mezei078e8032022-04-27 21:17:56 +02006627
Gilles Peskine449bd832023-01-11 14:50:10 +01006628 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, supported_sig_algs_len);
Gabor Mezei078e8032022-04-27 21:17:56 +02006629 supported_sig_algs_end = p + supported_sig_algs_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01006630 while (p < supported_sig_algs_end) {
6631 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, supported_sig_algs_end, 2);
6632 sig_alg = MBEDTLS_GET_UINT16_BE(p, 0);
Gabor Mezei078e8032022-04-27 21:17:56 +02006633 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01006634 MBEDTLS_SSL_DEBUG_MSG(4, ("received signature algorithm: 0x%x %s",
6635 sig_alg,
6636 mbedtls_ssl_sig_alg_to_str(sig_alg)));
Jerry Yu2fe6c632022-06-29 10:02:38 +08006637#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01006638 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
6639 (!(mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg) &&
6640 mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)))) {
Gabor Mezei078e8032022-04-27 21:17:56 +02006641 continue;
Jerry Yu2fe6c632022-06-29 10:02:38 +08006642 }
6643#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gabor Mezei078e8032022-04-27 21:17:56 +02006644
Gilles Peskine449bd832023-01-11 14:50:10 +01006645 MBEDTLS_SSL_DEBUG_MSG(4, ("valid signature algorithm: %s",
6646 mbedtls_ssl_sig_alg_to_str(sig_alg)));
Gabor Mezei078e8032022-04-27 21:17:56 +02006647
Gilles Peskine449bd832023-01-11 14:50:10 +01006648 if (common_idx + 1 < MBEDTLS_RECEIVED_SIG_ALGS_SIZE) {
Gabor Mezei078e8032022-04-27 21:17:56 +02006649 ssl->handshake->received_sig_algs[common_idx] = sig_alg;
6650 common_idx += 1;
6651 }
6652 }
6653 /* Check that we consumed all the message. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006654 if (p != end) {
6655 MBEDTLS_SSL_DEBUG_MSG(1,
6656 ("Signature algorithms extension length misaligned"));
6657 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
6658 MBEDTLS_ERR_SSL_DECODE_ERROR);
6659 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Gabor Mezei078e8032022-04-27 21:17:56 +02006660 }
6661
Gilles Peskine449bd832023-01-11 14:50:10 +01006662 if (common_idx == 0) {
6663 MBEDTLS_SSL_DEBUG_MSG(3, ("no signature algorithm in common"));
6664 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
6665 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
6666 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Gabor Mezei078e8032022-04-27 21:17:56 +02006667 }
6668
Gabor Mezei15b95a62022-05-09 16:37:58 +02006669 ssl->handshake->received_sig_algs[common_idx] = MBEDTLS_TLS_SIG_NONE;
Gilles Peskine449bd832023-01-11 14:50:10 +01006670 return 0;
Gabor Mezei078e8032022-04-27 21:17:56 +02006671}
6672
Ronald Crone68ab4f2022-10-05 12:46:29 +02006673#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Gabor Mezei078e8032022-04-27 21:17:56 +02006674
Jerry Yudc7bd172022-02-17 13:44:15 +08006675#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6676
6677#if defined(MBEDTLS_USE_PSA_CRYPTO)
6678
Gilles Peskine449bd832023-01-11 14:50:10 +01006679static psa_status_t setup_psa_key_derivation(psa_key_derivation_operation_t *derivation,
6680 mbedtls_svc_key_id_t key,
6681 psa_algorithm_t alg,
6682 const unsigned char *raw_psk, size_t raw_psk_length,
6683 const unsigned char *seed, size_t seed_length,
6684 const unsigned char *label, size_t label_length,
6685 const unsigned char *other_secret,
6686 size_t other_secret_length,
6687 size_t capacity)
Jerry Yudc7bd172022-02-17 13:44:15 +08006688{
6689 psa_status_t status;
6690
Gilles Peskine449bd832023-01-11 14:50:10 +01006691 status = psa_key_derivation_setup(derivation, alg);
6692 if (status != PSA_SUCCESS) {
6693 return status;
6694 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006695
Gilles Peskine449bd832023-01-11 14:50:10 +01006696 if (PSA_ALG_IS_TLS12_PRF(alg) || PSA_ALG_IS_TLS12_PSK_TO_MS(alg)) {
6697 status = psa_key_derivation_input_bytes(derivation,
6698 PSA_KEY_DERIVATION_INPUT_SEED,
6699 seed, seed_length);
6700 if (status != PSA_SUCCESS) {
6701 return status;
Przemek Stekiel1f027032022-04-05 17:12:11 +02006702 }
6703
Gilles Peskine449bd832023-01-11 14:50:10 +01006704 if (other_secret != NULL) {
6705 status = psa_key_derivation_input_bytes(derivation,
6706 PSA_KEY_DERIVATION_INPUT_OTHER_SECRET,
6707 other_secret, other_secret_length);
6708 if (status != PSA_SUCCESS) {
6709 return status;
6710 }
6711 }
6712
6713 if (mbedtls_svc_key_id_is_null(key)) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006714 status = psa_key_derivation_input_bytes(
6715 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
Gilles Peskine449bd832023-01-11 14:50:10 +01006716 raw_psk, raw_psk_length);
6717 } else {
Jerry Yudc7bd172022-02-17 13:44:15 +08006718 status = psa_key_derivation_input_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01006719 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key);
Jerry Yudc7bd172022-02-17 13:44:15 +08006720 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006721 if (status != PSA_SUCCESS) {
6722 return status;
6723 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006724
Gilles Peskine449bd832023-01-11 14:50:10 +01006725 status = psa_key_derivation_input_bytes(derivation,
6726 PSA_KEY_DERIVATION_INPUT_LABEL,
6727 label, label_length);
6728 if (status != PSA_SUCCESS) {
6729 return status;
6730 }
6731 } else {
6732 return PSA_ERROR_NOT_SUPPORTED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006733 }
6734
Gilles Peskine449bd832023-01-11 14:50:10 +01006735 status = psa_key_derivation_set_capacity(derivation, capacity);
6736 if (status != PSA_SUCCESS) {
6737 return status;
6738 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006739
Gilles Peskine449bd832023-01-11 14:50:10 +01006740 return PSA_SUCCESS;
Jerry Yudc7bd172022-02-17 13:44:15 +08006741}
6742
Andrzej Kurek57d10632022-10-24 10:32:01 -04006743#if defined(PSA_WANT_ALG_SHA_384) || \
6744 defined(PSA_WANT_ALG_SHA_256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006745MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006746static int tls_prf_generic(mbedtls_md_type_t md_type,
6747 const unsigned char *secret, size_t slen,
6748 const char *label,
6749 const unsigned char *random, size_t rlen,
6750 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006751{
6752 psa_status_t status;
6753 psa_algorithm_t alg;
6754 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
6755 psa_key_derivation_operation_t derivation =
6756 PSA_KEY_DERIVATION_OPERATION_INIT;
6757
Gilles Peskine449bd832023-01-11 14:50:10 +01006758 if (md_type == MBEDTLS_MD_SHA384) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006759 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
Gilles Peskine449bd832023-01-11 14:50:10 +01006760 } else {
Jerry Yudc7bd172022-02-17 13:44:15 +08006761 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
Gilles Peskine449bd832023-01-11 14:50:10 +01006762 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006763
6764 /* Normally a "secret" should be long enough to be impossible to
6765 * find by brute force, and in particular should not be empty. But
6766 * this PRF is also used to derive an IV, in particular in EAP-TLS,
6767 * and for this use case it makes sense to have a 0-length "secret".
6768 * Since the key API doesn't allow importing a key of length 0,
6769 * keep master_key=0, which setup_psa_key_derivation() understands
6770 * to mean a 0-length "secret" input. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006771 if (slen != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006772 psa_key_attributes_t key_attributes = psa_key_attributes_init();
Gilles Peskine449bd832023-01-11 14:50:10 +01006773 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
6774 psa_set_key_algorithm(&key_attributes, alg);
6775 psa_set_key_type(&key_attributes, PSA_KEY_TYPE_DERIVE);
Jerry Yudc7bd172022-02-17 13:44:15 +08006776
Gilles Peskine449bd832023-01-11 14:50:10 +01006777 status = psa_import_key(&key_attributes, secret, slen, &master_key);
6778 if (status != PSA_SUCCESS) {
6779 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6780 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006781 }
6782
Gilles Peskine449bd832023-01-11 14:50:10 +01006783 status = setup_psa_key_derivation(&derivation,
6784 master_key, alg,
6785 NULL, 0,
6786 random, rlen,
6787 (unsigned char const *) label,
6788 (size_t) strlen(label),
6789 NULL, 0,
6790 dlen);
6791 if (status != PSA_SUCCESS) {
6792 psa_key_derivation_abort(&derivation);
6793 psa_destroy_key(master_key);
6794 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006795 }
6796
Gilles Peskine449bd832023-01-11 14:50:10 +01006797 status = psa_key_derivation_output_bytes(&derivation, dstbuf, dlen);
6798 if (status != PSA_SUCCESS) {
6799 psa_key_derivation_abort(&derivation);
6800 psa_destroy_key(master_key);
6801 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006802 }
6803
Gilles Peskine449bd832023-01-11 14:50:10 +01006804 status = psa_key_derivation_abort(&derivation);
6805 if (status != PSA_SUCCESS) {
6806 psa_destroy_key(master_key);
6807 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006808 }
6809
Gilles Peskine449bd832023-01-11 14:50:10 +01006810 if (!mbedtls_svc_key_id_is_null(master_key)) {
6811 status = psa_destroy_key(master_key);
6812 }
6813 if (status != PSA_SUCCESS) {
6814 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6815 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006816
Gilles Peskine449bd832023-01-11 14:50:10 +01006817 return 0;
Jerry Yudc7bd172022-02-17 13:44:15 +08006818}
Andrzej Kurek57d10632022-10-24 10:32:01 -04006819#endif /* PSA_WANT_ALG_SHA_256 || PSA_WANT_ALG_SHA_384 */
Jerry Yudc7bd172022-02-17 13:44:15 +08006820#else /* MBEDTLS_USE_PSA_CRYPTO */
6821
Andrzej Kurek57d10632022-10-24 10:32:01 -04006822#if defined(MBEDTLS_MD_C) && \
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006823 (defined(MBEDTLS_MD_CAN_SHA256) || \
6824 defined(MBEDTLS_MD_CAN_SHA384))
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006825MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006826static int tls_prf_generic(mbedtls_md_type_t md_type,
6827 const unsigned char *secret, size_t slen,
6828 const char *label,
6829 const unsigned char *random, size_t rlen,
6830 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006831{
6832 size_t nb;
6833 size_t i, j, k, md_len;
6834 unsigned char *tmp;
6835 size_t tmp_len = 0;
6836 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
6837 const mbedtls_md_info_t *md_info;
6838 mbedtls_md_context_t md_ctx;
6839 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6840
Gilles Peskine449bd832023-01-11 14:50:10 +01006841 mbedtls_md_init(&md_ctx);
Jerry Yudc7bd172022-02-17 13:44:15 +08006842
Gilles Peskine449bd832023-01-11 14:50:10 +01006843 if ((md_info = mbedtls_md_info_from_type(md_type)) == NULL) {
6844 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
6845 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006846
Gilles Peskine449bd832023-01-11 14:50:10 +01006847 md_len = mbedtls_md_get_size(md_info);
Jerry Yudc7bd172022-02-17 13:44:15 +08006848
Gilles Peskine449bd832023-01-11 14:50:10 +01006849 tmp_len = md_len + strlen(label) + rlen;
6850 tmp = mbedtls_calloc(1, tmp_len);
6851 if (tmp == NULL) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006852 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
6853 goto exit;
6854 }
6855
Gilles Peskine449bd832023-01-11 14:50:10 +01006856 nb = strlen(label);
6857 memcpy(tmp + md_len, label, nb);
6858 memcpy(tmp + md_len + nb, random, rlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006859 nb += rlen;
6860
6861 /*
6862 * Compute P_<hash>(secret, label + random)[0..dlen]
6863 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006864 if ((ret = mbedtls_md_setup(&md_ctx, md_info, 1)) != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006865 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006866 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006867
Gilles Peskine449bd832023-01-11 14:50:10 +01006868 ret = mbedtls_md_hmac_starts(&md_ctx, secret, slen);
6869 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006870 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006871 }
6872 ret = mbedtls_md_hmac_update(&md_ctx, tmp + md_len, nb);
6873 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006874 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006875 }
6876 ret = mbedtls_md_hmac_finish(&md_ctx, tmp);
6877 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006878 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006879 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006880
Gilles Peskine449bd832023-01-11 14:50:10 +01006881 for (i = 0; i < dlen; i += md_len) {
6882 ret = mbedtls_md_hmac_reset(&md_ctx);
6883 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006884 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006885 }
6886 ret = mbedtls_md_hmac_update(&md_ctx, tmp, md_len + nb);
6887 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006888 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006889 }
6890 ret = mbedtls_md_hmac_finish(&md_ctx, h_i);
6891 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006892 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006893 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006894
Gilles Peskine449bd832023-01-11 14:50:10 +01006895 ret = mbedtls_md_hmac_reset(&md_ctx);
6896 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006897 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006898 }
6899 ret = mbedtls_md_hmac_update(&md_ctx, tmp, md_len);
6900 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006901 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006902 }
6903 ret = mbedtls_md_hmac_finish(&md_ctx, tmp);
6904 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006905 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006906 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006907
Gilles Peskine449bd832023-01-11 14:50:10 +01006908 k = (i + md_len > dlen) ? dlen % md_len : md_len;
Jerry Yudc7bd172022-02-17 13:44:15 +08006909
Gilles Peskine449bd832023-01-11 14:50:10 +01006910 for (j = 0; j < k; j++) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006911 dstbuf[i + j] = h_i[j];
Gilles Peskine449bd832023-01-11 14:50:10 +01006912 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006913 }
6914
6915exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006916 mbedtls_md_free(&md_ctx);
Jerry Yudc7bd172022-02-17 13:44:15 +08006917
Gilles Peskine449bd832023-01-11 14:50:10 +01006918 if (tmp != NULL) {
6919 mbedtls_platform_zeroize(tmp, tmp_len);
6920 }
Dave Rodgman29b9b2b2022-11-01 16:08:14 +00006921
Gilles Peskine449bd832023-01-11 14:50:10 +01006922 mbedtls_platform_zeroize(h_i, sizeof(h_i));
Jerry Yudc7bd172022-02-17 13:44:15 +08006923
Gilles Peskine449bd832023-01-11 14:50:10 +01006924 mbedtls_free(tmp);
Jerry Yudc7bd172022-02-17 13:44:15 +08006925
Gilles Peskine449bd832023-01-11 14:50:10 +01006926 return ret;
Jerry Yudc7bd172022-02-17 13:44:15 +08006927}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006928#endif /* MBEDTLS_MD_C && ( MBEDTLS_MD_CAN_SHA256 || MBEDTLS_MD_CAN_SHA384 ) */
Jerry Yudc7bd172022-02-17 13:44:15 +08006929#endif /* MBEDTLS_USE_PSA_CRYPTO */
6930
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006931#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006932MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006933static int tls_prf_sha256(const unsigned char *secret, size_t slen,
6934 const char *label,
6935 const unsigned char *random, size_t rlen,
6936 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006937{
Gilles Peskine449bd832023-01-11 14:50:10 +01006938 return tls_prf_generic(MBEDTLS_MD_SHA256, secret, slen,
6939 label, random, rlen, dstbuf, dlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006940}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006941#endif /* MBEDTLS_MD_CAN_SHA256*/
Jerry Yudc7bd172022-02-17 13:44:15 +08006942
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006943#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006944MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006945static int tls_prf_sha384(const unsigned char *secret, size_t slen,
6946 const char *label,
6947 const unsigned char *random, size_t rlen,
6948 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006949{
Gilles Peskine449bd832023-01-11 14:50:10 +01006950 return tls_prf_generic(MBEDTLS_MD_SHA384, secret, slen,
6951 label, random, rlen, dstbuf, dlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006952}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006953#endif /* MBEDTLS_MD_CAN_SHA384*/
Jerry Yudc7bd172022-02-17 13:44:15 +08006954
Jerry Yuf009d862022-02-17 14:01:37 +08006955/*
6956 * Set appropriate PRF function and other SSL / TLS1.2 functions
6957 *
6958 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08006959 * - hash associated with the ciphersuite (only used by TLS 1.2)
6960 *
6961 * Outputs:
6962 * - the tls_prf, calc_verify and calc_finished members of handshake structure
6963 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006964MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006965static int ssl_set_handshake_prfs(mbedtls_ssl_handshake_params *handshake,
6966 mbedtls_md_type_t hash)
Jerry Yuf009d862022-02-17 14:01:37 +08006967{
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006968#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01006969 if (hash == MBEDTLS_MD_SHA384) {
Jerry Yuf009d862022-02-17 14:01:37 +08006970 handshake->tls_prf = tls_prf_sha384;
6971 handshake->calc_verify = ssl_calc_verify_tls_sha384;
6972 handshake->calc_finished = ssl_calc_finished_tls_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +01006973 } else
Jerry Yuf009d862022-02-17 14:01:37 +08006974#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006975#if defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yuf009d862022-02-17 14:01:37 +08006976 {
Ronald Cron81591aa2022-03-07 09:05:51 +01006977 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08006978 handshake->tls_prf = tls_prf_sha256;
6979 handshake->calc_verify = ssl_calc_verify_tls_sha256;
6980 handshake->calc_finished = ssl_calc_finished_tls_sha256;
6981 }
Ronald Cron81591aa2022-03-07 09:05:51 +01006982#else
Jerry Yuf009d862022-02-17 14:01:37 +08006983 {
Jerry Yuf009d862022-02-17 14:01:37 +08006984 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01006985 (void) hash;
Gilles Peskine449bd832023-01-11 14:50:10 +01006986 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yuf009d862022-02-17 14:01:37 +08006987 }
Ronald Cron81591aa2022-03-07 09:05:51 +01006988#endif
Jerry Yuf009d862022-02-17 14:01:37 +08006989
Gilles Peskine449bd832023-01-11 14:50:10 +01006990 return 0;
Jerry Yuf009d862022-02-17 14:01:37 +08006991}
Jerry Yud6ab2352022-02-17 14:03:43 +08006992
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006993/*
6994 * Compute master secret if needed
6995 *
6996 * Parameters:
6997 * [in/out] handshake
6998 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
6999 * (PSA-PSK) ciphersuite_info, psk_opaque
7000 * [out] premaster (cleared)
7001 * [out] master
7002 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
7003 * debug: conf->f_dbg, conf->p_dbg
7004 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01007005 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007006 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007007MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007008static int ssl_compute_master(mbedtls_ssl_handshake_params *handshake,
7009 unsigned char *master,
7010 const mbedtls_ssl_context *ssl)
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007011{
7012 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7013
7014 /* cf. RFC 5246, Section 8.1:
7015 * "The master secret is always exactly 48 bytes in length." */
7016 size_t const master_secret_len = 48;
7017
7018#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
7019 unsigned char session_hash[48];
7020#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
7021
7022 /* The label for the KDF used for key expansion.
7023 * This is either "master secret" or "extended master secret"
7024 * depending on whether the Extended Master Secret extension
7025 * is used. */
7026 char const *lbl = "master secret";
7027
Przemek Stekielae4ed302022-04-05 17:15:55 +02007028 /* The seed for the KDF used for key expansion.
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007029 * - If the Extended Master Secret extension is not used,
7030 * this is ClientHello.Random + ServerHello.Random
7031 * (see Sect. 8.1 in RFC 5246).
7032 * - If the Extended Master Secret extension is used,
7033 * this is the transcript of the handshake so far.
7034 * (see Sect. 4 in RFC 7627). */
Przemek Stekielae4ed302022-04-05 17:15:55 +02007035 unsigned char const *seed = handshake->randbytes;
7036 size_t seed_len = 64;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007037
7038#if !defined(MBEDTLS_DEBUG_C) && \
7039 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
7040 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01007041 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007042 ssl = NULL; /* make sure we don't use it except for those cases */
7043 (void) ssl;
7044#endif
7045
Gilles Peskine449bd832023-01-11 14:50:10 +01007046 if (handshake->resume != 0) {
7047 MBEDTLS_SSL_DEBUG_MSG(3, ("no premaster (session resumed)"));
7048 return 0;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007049 }
7050
7051#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Gilles Peskine449bd832023-01-11 14:50:10 +01007052 if (handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007053 lbl = "extended master secret";
Przemek Stekielae4ed302022-04-05 17:15:55 +02007054 seed = session_hash;
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01007055 ret = handshake->calc_verify(ssl, session_hash, &seed_len);
7056 if (ret != 0) {
7057 MBEDTLS_SSL_DEBUG_RET(1, "calc_verify", ret);
7058 }
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007059
Gilles Peskine449bd832023-01-11 14:50:10 +01007060 MBEDTLS_SSL_DEBUG_BUF(3, "session hash for extended master secret",
7061 session_hash, seed_len);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007062 }
Przemek Stekiel169bf0b2022-04-29 07:53:29 +02007063#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007064
Przemek Stekiel99114f32022-04-22 11:20:09 +02007065#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Przemek Stekiel8a4b7fd2022-04-28 09:22:22 +02007066 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007067 if (mbedtls_ssl_ciphersuite_uses_psk(handshake->ciphersuite_info) == 1) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007068 /* Perform PSK-to-MS expansion in a single step. */
7069 psa_status_t status;
7070 psa_algorithm_t alg;
7071 mbedtls_svc_key_id_t psk;
7072 psa_key_derivation_operation_t derivation =
7073 PSA_KEY_DERIVATION_OPERATION_INIT;
Dave Rodgman2eab4622023-10-05 13:30:37 +01007074 mbedtls_md_type_t hash_alg = (mbedtls_md_type_t) handshake->ciphersuite_info->mac;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007075
Gilles Peskine449bd832023-01-11 14:50:10 +01007076 MBEDTLS_SSL_DEBUG_MSG(2, ("perform PSA-based PSK-to-MS expansion"));
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007077
Gilles Peskine449bd832023-01-11 14:50:10 +01007078 psk = mbedtls_ssl_get_opaque_psk(ssl);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007079
Gilles Peskine449bd832023-01-11 14:50:10 +01007080 if (hash_alg == MBEDTLS_MD_SHA384) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007081 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
Gilles Peskine449bd832023-01-11 14:50:10 +01007082 } else {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007083 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
Gilles Peskine449bd832023-01-11 14:50:10 +01007084 }
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007085
Przemek Stekiel51a1f362022-04-13 08:57:06 +02007086 size_t other_secret_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007087 unsigned char *other_secret = NULL;
Przemek Stekielc2033402022-04-05 17:19:41 +02007088
Gilles Peskine449bd832023-01-11 14:50:10 +01007089 switch (handshake->ciphersuite_info->key_exchange) {
Przemek Stekiel19b80f82022-04-14 08:29:31 +02007090 /* Provide other secret.
Przemek Stekiel51a1f362022-04-13 08:57:06 +02007091 * Other secret is stored in premaster, where first 2 bytes hold the
Przemek Stekiel19b80f82022-04-14 08:29:31 +02007092 * length of the other key.
Przemek Stekielc2033402022-04-05 17:19:41 +02007093 */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02007094 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Przemek Stekiel8abcee92022-04-28 09:16:28 +02007095 /* For RSA-PSK other key length is always 48 bytes. */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02007096 other_secret_len = 48;
7097 other_secret = handshake->premaster + 2;
7098 break;
7099 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Przemek Stekielb293aaa2022-04-19 12:22:38 +02007100 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
Przemek Stekiel19b80f82022-04-14 08:29:31 +02007101 other_secret_len = MBEDTLS_GET_UINT16_BE(handshake->premaster, 0);
7102 other_secret = handshake->premaster + 2;
7103 break;
7104 default:
7105 break;
Przemek Stekielc2033402022-04-05 17:19:41 +02007106 }
7107
Gilles Peskine449bd832023-01-11 14:50:10 +01007108 status = setup_psa_key_derivation(&derivation, psk, alg,
7109 ssl->conf->psk, ssl->conf->psk_len,
7110 seed, seed_len,
7111 (unsigned char const *) lbl,
7112 (size_t) strlen(lbl),
7113 other_secret, other_secret_len,
7114 master_secret_len);
7115 if (status != PSA_SUCCESS) {
7116 psa_key_derivation_abort(&derivation);
7117 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007118 }
7119
Gilles Peskine449bd832023-01-11 14:50:10 +01007120 status = psa_key_derivation_output_bytes(&derivation,
7121 master,
7122 master_secret_len);
7123 if (status != PSA_SUCCESS) {
7124 psa_key_derivation_abort(&derivation);
7125 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007126 }
7127
Gilles Peskine449bd832023-01-11 14:50:10 +01007128 status = psa_key_derivation_abort(&derivation);
7129 if (status != PSA_SUCCESS) {
7130 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
7131 }
7132 } else
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007133#endif
7134 {
Neil Armstrongca7d5062022-05-31 14:43:23 +02007135#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01007136 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
7137 if (handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
Neil Armstrongca7d5062022-05-31 14:43:23 +02007138 psa_status_t status;
7139 psa_algorithm_t alg = PSA_ALG_TLS12_ECJPAKE_TO_PMS;
7140 psa_key_derivation_operation_t derivation =
7141 PSA_KEY_DERIVATION_OPERATION_INIT;
7142
Gilles Peskine449bd832023-01-11 14:50:10 +01007143 MBEDTLS_SSL_DEBUG_MSG(2, ("perform PSA-based PMS KDF for ECJPAKE"));
Neil Armstrongca7d5062022-05-31 14:43:23 +02007144
7145 handshake->pmslen = PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE;
7146
Gilles Peskine449bd832023-01-11 14:50:10 +01007147 status = psa_key_derivation_setup(&derivation, alg);
7148 if (status != PSA_SUCCESS) {
7149 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02007150 }
7151
Gilles Peskine449bd832023-01-11 14:50:10 +01007152 status = psa_key_derivation_set_capacity(&derivation,
7153 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
7154 if (status != PSA_SUCCESS) {
7155 psa_key_derivation_abort(&derivation);
7156 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02007157 }
7158
Gilles Peskine449bd832023-01-11 14:50:10 +01007159 status = psa_pake_get_implicit_key(&handshake->psa_pake_ctx,
7160 &derivation);
7161 if (status != PSA_SUCCESS) {
7162 psa_key_derivation_abort(&derivation);
7163 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02007164 }
7165
Gilles Peskine449bd832023-01-11 14:50:10 +01007166 status = psa_key_derivation_output_bytes(&derivation,
7167 handshake->premaster,
7168 handshake->pmslen);
7169 if (status != PSA_SUCCESS) {
7170 psa_key_derivation_abort(&derivation);
7171 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
7172 }
7173
7174 status = psa_key_derivation_abort(&derivation);
7175 if (status != PSA_SUCCESS) {
7176 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02007177 }
7178 }
7179#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007180 ret = handshake->tls_prf(handshake->premaster, handshake->pmslen,
7181 lbl, seed, seed_len,
7182 master,
7183 master_secret_len);
7184 if (ret != 0) {
7185 MBEDTLS_SSL_DEBUG_RET(1, "prf", ret);
7186 return ret;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007187 }
7188
Gilles Peskine449bd832023-01-11 14:50:10 +01007189 MBEDTLS_SSL_DEBUG_BUF(3, "premaster secret",
7190 handshake->premaster,
7191 handshake->pmslen);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007192
Gilles Peskine449bd832023-01-11 14:50:10 +01007193 mbedtls_platform_zeroize(handshake->premaster,
7194 sizeof(handshake->premaster));
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007195 }
7196
Gilles Peskine449bd832023-01-11 14:50:10 +01007197 return 0;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08007198}
7199
Gilles Peskine449bd832023-01-11 14:50:10 +01007200int mbedtls_ssl_derive_keys(mbedtls_ssl_context *ssl)
Jerry Yud62f87e2022-02-17 14:09:02 +08007201{
7202 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7203 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
7204 ssl->handshake->ciphersuite_info;
7205
Gilles Peskine449bd832023-01-11 14:50:10 +01007206 MBEDTLS_SSL_DEBUG_MSG(2, ("=> derive keys"));
Jerry Yud62f87e2022-02-17 14:09:02 +08007207
7208 /* Set PRF, calc_verify and calc_finished function pointers */
Gilles Peskine449bd832023-01-11 14:50:10 +01007209 ret = ssl_set_handshake_prfs(ssl->handshake,
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01007210 (mbedtls_md_type_t) ciphersuite_info->mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01007211 if (ret != 0) {
7212 MBEDTLS_SSL_DEBUG_RET(1, "ssl_set_handshake_prfs", ret);
7213 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08007214 }
7215
7216 /* Compute master secret if needed */
Gilles Peskine449bd832023-01-11 14:50:10 +01007217 ret = ssl_compute_master(ssl->handshake,
7218 ssl->session_negotiate->master,
7219 ssl);
7220 if (ret != 0) {
7221 MBEDTLS_SSL_DEBUG_RET(1, "ssl_compute_master", ret);
7222 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08007223 }
7224
7225 /* Swap the client and server random values:
7226 * - MS derivation wanted client+server (RFC 5246 8.1)
7227 * - key derivation wants server+client (RFC 5246 6.3) */
7228 {
7229 unsigned char tmp[64];
Gilles Peskine449bd832023-01-11 14:50:10 +01007230 memcpy(tmp, ssl->handshake->randbytes, 64);
7231 memcpy(ssl->handshake->randbytes, tmp + 32, 32);
7232 memcpy(ssl->handshake->randbytes + 32, tmp, 32);
7233 mbedtls_platform_zeroize(tmp, sizeof(tmp));
Jerry Yud62f87e2022-02-17 14:09:02 +08007234 }
7235
7236 /* Populate transform structure */
Gilles Peskine449bd832023-01-11 14:50:10 +01007237 ret = ssl_tls12_populate_transform(ssl->transform_negotiate,
7238 ssl->session_negotiate->ciphersuite,
7239 ssl->session_negotiate->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007240#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01007241 ssl->session_negotiate->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007242#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01007243 ssl->handshake->tls_prf,
7244 ssl->handshake->randbytes,
7245 ssl->tls_version,
7246 ssl->conf->endpoint,
7247 ssl);
7248 if (ret != 0) {
7249 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls12_populate_transform", ret);
7250 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08007251 }
7252
7253 /* We no longer need Server/ClientHello.random values */
Gilles Peskine449bd832023-01-11 14:50:10 +01007254 mbedtls_platform_zeroize(ssl->handshake->randbytes,
7255 sizeof(ssl->handshake->randbytes));
Jerry Yud62f87e2022-02-17 14:09:02 +08007256
Gilles Peskine449bd832023-01-11 14:50:10 +01007257 MBEDTLS_SSL_DEBUG_MSG(2, ("<= derive keys"));
Jerry Yud62f87e2022-02-17 14:09:02 +08007258
Gilles Peskine449bd832023-01-11 14:50:10 +01007259 return 0;
Jerry Yud62f87e2022-02-17 14:09:02 +08007260}
Jerry Yu8392e0d2022-02-17 14:10:24 +08007261
Gilles Peskine449bd832023-01-11 14:50:10 +01007262int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md)
Ronald Cron4dcbca92022-03-07 10:21:40 +01007263{
Gilles Peskine449bd832023-01-11 14:50:10 +01007264 switch (md) {
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007265#if defined(MBEDTLS_MD_CAN_SHA384)
Ronald Cron4dcbca92022-03-07 10:21:40 +01007266 case MBEDTLS_SSL_HASH_SHA384:
7267 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
7268 break;
7269#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007270#if defined(MBEDTLS_MD_CAN_SHA256)
Ronald Cron4dcbca92022-03-07 10:21:40 +01007271 case MBEDTLS_SSL_HASH_SHA256:
7272 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
7273 break;
7274#endif
7275 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01007276 return -1;
Ronald Cron4dcbca92022-03-07 10:21:40 +01007277 }
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007278#if !defined(MBEDTLS_MD_CAN_SHA384) && \
7279 !defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurekeabeb302022-10-17 07:52:51 -04007280 (void) ssl;
7281#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007282 return 0;
Ronald Cron4dcbca92022-03-07 10:21:40 +01007283}
7284
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007285#if defined(MBEDTLS_USE_PSA_CRYPTO)
7286static int ssl_calc_verify_tls_psa(const mbedtls_ssl_context *ssl,
7287 const psa_hash_operation_t *hs_op,
7288 size_t buffer_size,
7289 unsigned char *hash,
7290 size_t *hlen)
7291{
7292 psa_status_t status;
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007293 psa_hash_operation_t cloned_op = psa_hash_operation_init();
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007294
7295#if !defined(MBEDTLS_DEBUG_C)
7296 (void) ssl;
7297#endif
7298 MBEDTLS_SSL_DEBUG_MSG(2, ("=> PSA calc verify"));
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007299 status = psa_hash_clone(hs_op, &cloned_op);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007300 if (status != PSA_SUCCESS) {
7301 goto exit;
7302 }
7303
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007304 status = psa_hash_finish(&cloned_op, hash, buffer_size, hlen);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007305 if (status != PSA_SUCCESS) {
7306 goto exit;
7307 }
7308
7309 MBEDTLS_SSL_DEBUG_BUF(3, "PSA calculated verify result", hash, *hlen);
7310 MBEDTLS_SSL_DEBUG_MSG(2, ("<= PSA calc verify"));
7311
7312exit:
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007313 psa_hash_abort(&cloned_op);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007314 return mbedtls_md_error_from_psa(status);
7315}
7316#else
7317static int ssl_calc_verify_tls_legacy(const mbedtls_ssl_context *ssl,
7318 const mbedtls_md_context_t *hs_ctx,
7319 unsigned char *hash,
7320 size_t *hlen)
7321{
7322 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007323 mbedtls_md_context_t cloned_ctx;
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007324
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007325 mbedtls_md_init(&cloned_ctx);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007326
7327#if !defined(MBEDTLS_DEBUG_C)
7328 (void) ssl;
7329#endif
7330 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc verify"));
7331
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007332 ret = mbedtls_md_setup(&cloned_ctx, mbedtls_md_info_from_ctx(hs_ctx), 0);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007333 if (ret != 0) {
7334 goto exit;
7335 }
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007336 ret = mbedtls_md_clone(&cloned_ctx, hs_ctx);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007337 if (ret != 0) {
7338 goto exit;
7339 }
7340
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007341 ret = mbedtls_md_finish(&cloned_ctx, hash);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007342 if (ret != 0) {
7343 goto exit;
7344 }
7345
7346 *hlen = mbedtls_md_get_size(mbedtls_md_info_from_ctx(hs_ctx));
7347
7348 MBEDTLS_SSL_DEBUG_BUF(3, "calculated verify result", hash, *hlen);
7349 MBEDTLS_SSL_DEBUG_MSG(2, ("<= calc verify"));
7350
7351exit:
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007352 mbedtls_md_free(&cloned_ctx);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007353 return ret;
7354}
7355#endif /* MBEDTLS_USE_PSA_CRYPTO */
7356
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007357#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +01007358int ssl_calc_verify_tls_sha256(const mbedtls_ssl_context *ssl,
7359 unsigned char *hash,
7360 size_t *hlen)
Jerry Yu8392e0d2022-02-17 14:10:24 +08007361{
7362#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007363 return ssl_calc_verify_tls_psa(ssl, &ssl->handshake->fin_sha256_psa, 32,
7364 hash, hlen);
Jerry Yu8392e0d2022-02-17 14:10:24 +08007365#else
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007366 return ssl_calc_verify_tls_legacy(ssl, &ssl->handshake->fin_sha256,
7367 hash, hlen);
Jerry Yu8392e0d2022-02-17 14:10:24 +08007368#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu8392e0d2022-02-17 14:10:24 +08007369}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007370#endif /* MBEDTLS_MD_CAN_SHA256 */
Jerry Yu8392e0d2022-02-17 14:10:24 +08007371
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007372#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +01007373int ssl_calc_verify_tls_sha384(const mbedtls_ssl_context *ssl,
7374 unsigned char *hash,
7375 size_t *hlen)
Jerry Yuc1cb3842022-02-17 14:13:48 +08007376{
7377#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007378 return ssl_calc_verify_tls_psa(ssl, &ssl->handshake->fin_sha384_psa, 48,
7379 hash, hlen);
Jerry Yuc1cb3842022-02-17 14:13:48 +08007380#else
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02007381 return ssl_calc_verify_tls_legacy(ssl, &ssl->handshake->fin_sha384,
7382 hash, hlen);
Jerry Yuc1cb3842022-02-17 14:13:48 +08007383#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yuc1cb3842022-02-17 14:13:48 +08007384}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007385#endif /* MBEDTLS_MD_CAN_SHA384 */
Jerry Yuc1cb3842022-02-17 14:13:48 +08007386
Neil Armstrong80f6f322022-05-03 17:56:38 +02007387#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
7388 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007389int mbedtls_ssl_psk_derive_premaster(mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex)
Jerry Yuce3dca42022-02-17 14:16:37 +08007390{
7391 unsigned char *p = ssl->handshake->premaster;
Gilles Peskine449bd832023-01-11 14:50:10 +01007392 unsigned char *end = p + sizeof(ssl->handshake->premaster);
Jerry Yuce3dca42022-02-17 14:16:37 +08007393 const unsigned char *psk = NULL;
7394 size_t psk_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007395 int psk_ret = mbedtls_ssl_get_psk(ssl, &psk, &psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08007396
Gilles Peskine449bd832023-01-11 14:50:10 +01007397 if (psk_ret == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED) {
Jerry Yuce3dca42022-02-17 14:16:37 +08007398 /*
7399 * This should never happen because the existence of a PSK is always
Przemek Stekielb293aaa2022-04-19 12:22:38 +02007400 * checked before calling this function.
7401 *
7402 * The exception is opaque DHE-PSK. For DHE-PSK fill premaster with
Przemek Stekiel8abcee92022-04-28 09:16:28 +02007403 * the shared secret without PSK.
Jerry Yuce3dca42022-02-17 14:16:37 +08007404 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007405 if (key_ex != MBEDTLS_KEY_EXCHANGE_DHE_PSK) {
7406 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
7407 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Przemek Stekielb293aaa2022-04-19 12:22:38 +02007408 }
Jerry Yuce3dca42022-02-17 14:16:37 +08007409 }
7410
7411 /*
7412 * PMS = struct {
7413 * opaque other_secret<0..2^16-1>;
7414 * opaque psk<0..2^16-1>;
7415 * };
7416 * with "other_secret" depending on the particular key exchange
7417 */
7418#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007419 if (key_ex == MBEDTLS_KEY_EXCHANGE_PSK) {
7420 if (end - p < 2) {
7421 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
7422 }
Jerry Yuce3dca42022-02-17 14:16:37 +08007423
Gilles Peskine449bd832023-01-11 14:50:10 +01007424 MBEDTLS_PUT_UINT16_BE(psk_len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08007425 p += 2;
7426
Gilles Peskine449bd832023-01-11 14:50:10 +01007427 if (end < p || (size_t) (end - p) < psk_len) {
7428 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
7429 }
Jerry Yuce3dca42022-02-17 14:16:37 +08007430
Gilles Peskine449bd832023-01-11 14:50:10 +01007431 memset(p, 0, psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08007432 p += psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01007433 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08007434#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
7435#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007436 if (key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08007437 /*
7438 * other_secret already set by the ClientKeyExchange message,
7439 * and is 48 bytes long
7440 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007441 if (end - p < 2) {
7442 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
7443 }
Jerry Yuce3dca42022-02-17 14:16:37 +08007444
7445 *p++ = 0;
7446 *p++ = 48;
7447 p += 48;
Gilles Peskine449bd832023-01-11 14:50:10 +01007448 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08007449#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
7450#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007451 if (key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08007452 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7453 size_t len;
7454
7455 /* Write length only when we know the actual value */
Gilles Peskine449bd832023-01-11 14:50:10 +01007456 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx,
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00007457 p + 2, (size_t) (end - (p + 2)), &len,
Gilles Peskine449bd832023-01-11 14:50:10 +01007458 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
7459 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret);
7460 return ret;
Jerry Yuce3dca42022-02-17 14:16:37 +08007461 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007462 MBEDTLS_PUT_UINT16_BE(len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08007463 p += 2 + len;
7464
Gilles Peskine449bd832023-01-11 14:50:10 +01007465 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K);
7466 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08007467#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Neil Armstrong80f6f322022-05-03 17:56:38 +02007468#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007469 if (key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08007470 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7471 size_t zlen;
7472
Gilles Peskine449bd832023-01-11 14:50:10 +01007473 if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx, &zlen,
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00007474 p + 2, (size_t) (end - (p + 2)),
Gilles Peskine449bd832023-01-11 14:50:10 +01007475 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
7476 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret);
7477 return ret;
Jerry Yuce3dca42022-02-17 14:16:37 +08007478 }
7479
Gilles Peskine449bd832023-01-11 14:50:10 +01007480 MBEDTLS_PUT_UINT16_BE(zlen, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08007481 p += 2 + zlen;
7482
Gilles Peskine449bd832023-01-11 14:50:10 +01007483 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
7484 MBEDTLS_DEBUG_ECDH_Z);
7485 } else
Neil Armstrong80f6f322022-05-03 17:56:38 +02007486#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Jerry Yuce3dca42022-02-17 14:16:37 +08007487 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007488 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
7489 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yuce3dca42022-02-17 14:16:37 +08007490 }
7491
7492 /* opaque psk<0..2^16-1>; */
Gilles Peskine449bd832023-01-11 14:50:10 +01007493 if (end - p < 2) {
7494 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
7495 }
Jerry Yuce3dca42022-02-17 14:16:37 +08007496
Gilles Peskine449bd832023-01-11 14:50:10 +01007497 MBEDTLS_PUT_UINT16_BE(psk_len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08007498 p += 2;
7499
Gilles Peskine449bd832023-01-11 14:50:10 +01007500 if (end < p || (size_t) (end - p) < psk_len) {
7501 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
7502 }
Jerry Yuce3dca42022-02-17 14:16:37 +08007503
Gilles Peskine449bd832023-01-11 14:50:10 +01007504 memcpy(p, psk, psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08007505 p += psk_len;
7506
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00007507 ssl->handshake->pmslen = (size_t) (p - ssl->handshake->premaster);
Jerry Yuce3dca42022-02-17 14:16:37 +08007508
Gilles Peskine449bd832023-01-11 14:50:10 +01007509 return 0;
Jerry Yuce3dca42022-02-17 14:16:37 +08007510}
Neil Armstrong80f6f322022-05-03 17:56:38 +02007511#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08007512
7513#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007514MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007515static int ssl_write_hello_request(mbedtls_ssl_context *ssl);
Jerry Yuc2c673d2022-02-17 14:20:39 +08007516
7517#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007518int mbedtls_ssl_resend_hello_request(mbedtls_ssl_context *ssl)
Jerry Yuc2c673d2022-02-17 14:20:39 +08007519{
7520 /* If renegotiation is not enforced, retransmit until we would reach max
7521 * timeout if we were using the usual handshake doubling scheme */
Gilles Peskine449bd832023-01-11 14:50:10 +01007522 if (ssl->conf->renego_max_records < 0) {
Jerry Yuc2c673d2022-02-17 14:20:39 +08007523 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
7524 unsigned char doublings = 1;
7525
Gilles Peskine449bd832023-01-11 14:50:10 +01007526 while (ratio != 0) {
Jerry Yuc2c673d2022-02-17 14:20:39 +08007527 ++doublings;
7528 ratio >>= 1;
7529 }
7530
Gilles Peskine449bd832023-01-11 14:50:10 +01007531 if (++ssl->renego_records_seen > doublings) {
7532 MBEDTLS_SSL_DEBUG_MSG(2, ("no longer retransmitting hello request"));
7533 return 0;
Jerry Yuc2c673d2022-02-17 14:20:39 +08007534 }
7535 }
7536
Gilles Peskine449bd832023-01-11 14:50:10 +01007537 return ssl_write_hello_request(ssl);
Jerry Yuc2c673d2022-02-17 14:20:39 +08007538}
7539#endif
7540#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08007541
Jerry Yud9526692022-02-17 14:23:47 +08007542/*
7543 * Handshake functions
7544 */
7545#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7546/* No certificate support -> dummy functions */
Gilles Peskine449bd832023-01-11 14:50:10 +01007547int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007548{
7549 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7550 ssl->handshake->ciphersuite_info;
7551
Gilles Peskine449bd832023-01-11 14:50:10 +01007552 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007553
Gilles Peskine449bd832023-01-11 14:50:10 +01007554 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7555 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007556 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007557 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007558 }
7559
Gilles Peskine449bd832023-01-11 14:50:10 +01007560 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
7561 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007562}
7563
Gilles Peskine449bd832023-01-11 14:50:10 +01007564int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007565{
7566 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7567 ssl->handshake->ciphersuite_info;
7568
Gilles Peskine449bd832023-01-11 14:50:10 +01007569 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007570
Gilles Peskine449bd832023-01-11 14:50:10 +01007571 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7572 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007573 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007574 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007575 }
7576
Gilles Peskine449bd832023-01-11 14:50:10 +01007577 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
7578 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007579}
7580
7581#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7582/* Some certificate support -> implement write and parse */
7583
Gilles Peskine449bd832023-01-11 14:50:10 +01007584int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007585{
7586 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
7587 size_t i, n;
7588 const mbedtls_x509_crt *crt;
7589 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7590 ssl->handshake->ciphersuite_info;
7591
Gilles Peskine449bd832023-01-11 14:50:10 +01007592 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007593
Gilles Peskine449bd832023-01-11 14:50:10 +01007594 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7595 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007596 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007597 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007598 }
7599
7600#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007601 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
7602 if (ssl->handshake->client_auth == 0) {
7603 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007604 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007605 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007606 }
7607 }
7608#endif /* MBEDTLS_SSL_CLI_C */
7609#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007610 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
7611 if (mbedtls_ssl_own_cert(ssl) == NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007612 /* Should never happen because we shouldn't have picked the
7613 * ciphersuite if we don't have a certificate. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007614 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007615 }
7616 }
7617#endif
7618
Gilles Peskine449bd832023-01-11 14:50:10 +01007619 MBEDTLS_SSL_DEBUG_CRT(3, "own certificate", mbedtls_ssl_own_cert(ssl));
Jerry Yud9526692022-02-17 14:23:47 +08007620
7621 /*
7622 * 0 . 0 handshake type
7623 * 1 . 3 handshake length
7624 * 4 . 6 length of all certs
7625 * 7 . 9 length of cert. 1
7626 * 10 . n-1 peer certificate
7627 * n . n+2 length of cert. 2
7628 * n+3 . ... upper level cert, etc.
7629 */
7630 i = 7;
Gilles Peskine449bd832023-01-11 14:50:10 +01007631 crt = mbedtls_ssl_own_cert(ssl);
Jerry Yud9526692022-02-17 14:23:47 +08007632
Gilles Peskine449bd832023-01-11 14:50:10 +01007633 while (crt != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007634 n = crt->raw.len;
Gilles Peskine449bd832023-01-11 14:50:10 +01007635 if (n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i) {
7636 MBEDTLS_SSL_DEBUG_MSG(1, ("certificate too large, %" MBEDTLS_PRINTF_SIZET
7637 " > %" MBEDTLS_PRINTF_SIZET,
7638 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN));
7639 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
Jerry Yud9526692022-02-17 14:23:47 +08007640 }
7641
Gilles Peskine449bd832023-01-11 14:50:10 +01007642 ssl->out_msg[i] = MBEDTLS_BYTE_2(n);
7643 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1(n);
7644 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0(n);
Jerry Yud9526692022-02-17 14:23:47 +08007645
Gilles Peskine449bd832023-01-11 14:50:10 +01007646 i += 3; memcpy(ssl->out_msg + i, crt->raw.p, n);
Jerry Yud9526692022-02-17 14:23:47 +08007647 i += n; crt = crt->next;
7648 }
7649
Gilles Peskine449bd832023-01-11 14:50:10 +01007650 ssl->out_msg[4] = MBEDTLS_BYTE_2(i - 7);
7651 ssl->out_msg[5] = MBEDTLS_BYTE_1(i - 7);
7652 ssl->out_msg[6] = MBEDTLS_BYTE_0(i - 7);
Jerry Yud9526692022-02-17 14:23:47 +08007653
7654 ssl->out_msglen = i;
7655 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7656 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
7657
7658 ssl->state++;
7659
Gilles Peskine449bd832023-01-11 14:50:10 +01007660 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
7661 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
7662 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007663 }
7664
Gilles Peskine449bd832023-01-11 14:50:10 +01007665 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007666
Gilles Peskine449bd832023-01-11 14:50:10 +01007667 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007668}
7669
7670#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7671
7672#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007673MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007674static int ssl_check_peer_crt_unchanged(mbedtls_ssl_context *ssl,
7675 unsigned char *crt_buf,
7676 size_t crt_buf_len)
Jerry Yud9526692022-02-17 14:23:47 +08007677{
7678 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
7679
Gilles Peskine449bd832023-01-11 14:50:10 +01007680 if (peer_crt == NULL) {
7681 return -1;
7682 }
Jerry Yud9526692022-02-17 14:23:47 +08007683
Gilles Peskine449bd832023-01-11 14:50:10 +01007684 if (peer_crt->raw.len != crt_buf_len) {
7685 return -1;
7686 }
Jerry Yud9526692022-02-17 14:23:47 +08007687
Gilles Peskine449bd832023-01-11 14:50:10 +01007688 return memcmp(peer_crt->raw.p, crt_buf, peer_crt->raw.len);
Jerry Yud9526692022-02-17 14:23:47 +08007689}
7690#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007691MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007692static int ssl_check_peer_crt_unchanged(mbedtls_ssl_context *ssl,
7693 unsigned char *crt_buf,
7694 size_t crt_buf_len)
Jerry Yud9526692022-02-17 14:23:47 +08007695{
7696 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7697 unsigned char const * const peer_cert_digest =
7698 ssl->session->peer_cert_digest;
7699 mbedtls_md_type_t const peer_cert_digest_type =
7700 ssl->session->peer_cert_digest_type;
7701 mbedtls_md_info_t const * const digest_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01007702 mbedtls_md_info_from_type(peer_cert_digest_type);
Jerry Yud9526692022-02-17 14:23:47 +08007703 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
7704 size_t digest_len;
7705
Gilles Peskine449bd832023-01-11 14:50:10 +01007706 if (peer_cert_digest == NULL || digest_info == NULL) {
7707 return -1;
7708 }
Jerry Yud9526692022-02-17 14:23:47 +08007709
Gilles Peskine449bd832023-01-11 14:50:10 +01007710 digest_len = mbedtls_md_get_size(digest_info);
7711 if (digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN) {
7712 return -1;
7713 }
Jerry Yud9526692022-02-17 14:23:47 +08007714
Gilles Peskine449bd832023-01-11 14:50:10 +01007715 ret = mbedtls_md(digest_info, crt_buf, crt_buf_len, tmp_digest);
7716 if (ret != 0) {
7717 return -1;
7718 }
Jerry Yud9526692022-02-17 14:23:47 +08007719
Gilles Peskine449bd832023-01-11 14:50:10 +01007720 return memcmp(tmp_digest, peer_cert_digest, digest_len);
Jerry Yud9526692022-02-17 14:23:47 +08007721}
7722#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7723#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7724
7725/*
7726 * Once the certificate message is read, parse it into a cert chain and
7727 * perform basic checks, but leave actual verification to the caller
7728 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007729MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007730static int ssl_parse_certificate_chain(mbedtls_ssl_context *ssl,
7731 mbedtls_x509_crt *chain)
Jerry Yud9526692022-02-17 14:23:47 +08007732{
7733 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7734#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007735 int crt_cnt = 0;
Jerry Yud9526692022-02-17 14:23:47 +08007736#endif
7737 size_t i, n;
7738 uint8_t alert;
7739
Gilles Peskine449bd832023-01-11 14:50:10 +01007740 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
7741 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7742 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7743 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
7744 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
Jerry Yud9526692022-02-17 14:23:47 +08007745 }
7746
Gilles Peskine449bd832023-01-11 14:50:10 +01007747 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE) {
7748 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7749 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
7750 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
Jerry Yud9526692022-02-17 14:23:47 +08007751 }
7752
Gilles Peskine449bd832023-01-11 14:50:10 +01007753 if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 3 + 3) {
7754 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7755 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7756 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7757 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007758 }
7759
Gilles Peskine449bd832023-01-11 14:50:10 +01007760 i = mbedtls_ssl_hs_hdr_len(ssl);
Jerry Yud9526692022-02-17 14:23:47 +08007761
7762 /*
7763 * Same message structure as in mbedtls_ssl_write_certificate()
7764 */
Dave Rodgmana3d0f612023-11-03 23:34:02 +00007765 n = MBEDTLS_GET_UINT16_BE(ssl->in_msg, i + 1);
Jerry Yud9526692022-02-17 14:23:47 +08007766
Gilles Peskine449bd832023-01-11 14:50:10 +01007767 if (ssl->in_msg[i] != 0 ||
7768 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len(ssl)) {
7769 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7770 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7771 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7772 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007773 }
7774
7775 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
7776 i += 3;
7777
7778 /* Iterate through and parse the CRTs in the provided chain. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007779 while (i < ssl->in_hslen) {
Jerry Yud9526692022-02-17 14:23:47 +08007780 /* Check that there's room for the next CRT's length fields. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007781 if (i + 3 > ssl->in_hslen) {
7782 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7783 mbedtls_ssl_send_alert_message(ssl,
7784 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7785 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7786 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007787 }
7788 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
7789 * anything beyond 2**16 ~ 64K. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007790 if (ssl->in_msg[i] != 0) {
7791 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7792 mbedtls_ssl_send_alert_message(ssl,
7793 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7794 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT);
7795 return MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Jerry Yud9526692022-02-17 14:23:47 +08007796 }
7797
7798 /* Read length of the next CRT in the chain. */
Dave Rodgmana3d0f612023-11-03 23:34:02 +00007799 n = MBEDTLS_GET_UINT16_BE(ssl->in_msg, i + 1);
Jerry Yud9526692022-02-17 14:23:47 +08007800 i += 3;
7801
Gilles Peskine449bd832023-01-11 14:50:10 +01007802 if (n < 128 || i + n > ssl->in_hslen) {
7803 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7804 mbedtls_ssl_send_alert_message(ssl,
7805 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7806 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7807 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007808 }
7809
7810 /* Check if we're handling the first CRT in the chain. */
7811#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007812 if (crt_cnt++ == 0 &&
Jerry Yud9526692022-02-17 14:23:47 +08007813 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Gilles Peskine449bd832023-01-11 14:50:10 +01007814 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
Jerry Yud9526692022-02-17 14:23:47 +08007815 /* During client-side renegotiation, check that the server's
7816 * end-CRTs hasn't changed compared to the initial handshake,
7817 * mitigating the triple handshake attack. On success, reuse
7818 * the original end-CRT instead of parsing it again. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007819 MBEDTLS_SSL_DEBUG_MSG(3, ("Check that peer CRT hasn't changed during renegotiation"));
7820 if (ssl_check_peer_crt_unchanged(ssl,
7821 &ssl->in_msg[i],
7822 n) != 0) {
7823 MBEDTLS_SSL_DEBUG_MSG(1, ("new server cert during renegotiation"));
7824 mbedtls_ssl_send_alert_message(ssl,
7825 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7826 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED);
7827 return MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Jerry Yud9526692022-02-17 14:23:47 +08007828 }
7829
7830 /* Now we can safely free the original chain. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007831 ssl_clear_peer_cert(ssl->session);
Jerry Yud9526692022-02-17 14:23:47 +08007832 }
7833#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7834
7835 /* Parse the next certificate in the chain. */
7836#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007837 ret = mbedtls_x509_crt_parse_der(chain, ssl->in_msg + i, n);
Jerry Yud9526692022-02-17 14:23:47 +08007838#else
7839 /* If we don't need to store the CRT chain permanently, parse
7840 * it in-place from the input buffer instead of making a copy. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007841 ret = mbedtls_x509_crt_parse_der_nocopy(chain, ssl->in_msg + i, n);
Jerry Yud9526692022-02-17 14:23:47 +08007842#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +01007843 switch (ret) {
Jerry Yud9526692022-02-17 14:23:47 +08007844 case 0: /*ok*/
7845 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7846 /* Ignore certificate with an unknown algorithm: maybe a
7847 prior certificate was already trusted. */
7848 break;
7849
7850 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7851 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7852 goto crt_parse_der_failed;
7853
7854 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7855 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7856 goto crt_parse_der_failed;
7857
7858 default:
7859 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007860crt_parse_der_failed:
7861 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert);
7862 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
7863 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007864 }
7865
7866 i += n;
7867 }
7868
Gilles Peskine449bd832023-01-11 14:50:10 +01007869 MBEDTLS_SSL_DEBUG_CRT(3, "peer certificate", chain);
7870 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007871}
7872
7873#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007874MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007875static int ssl_srv_check_client_no_crt_notification(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007876{
Gilles Peskine449bd832023-01-11 14:50:10 +01007877 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
7878 return -1;
7879 }
Jerry Yud9526692022-02-17 14:23:47 +08007880
Gilles Peskine449bd832023-01-11 14:50:10 +01007881 if (ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len(ssl) &&
Jerry Yud9526692022-02-17 14:23:47 +08007882 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7883 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
Gilles Peskine449bd832023-01-11 14:50:10 +01007884 memcmp(ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl), "\0\0\0", 3) == 0) {
7885 MBEDTLS_SSL_DEBUG_MSG(1, ("peer has no certificate"));
7886 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007887 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007888 return -1;
Jerry Yud9526692022-02-17 14:23:47 +08007889}
7890#endif /* MBEDTLS_SSL_SRV_C */
7891
7892/* Check if a certificate message is expected.
7893 * Return either
7894 * - SSL_CERTIFICATE_EXPECTED, or
7895 * - SSL_CERTIFICATE_SKIP
7896 * indicating whether a Certificate message is expected or not.
7897 */
7898#define SSL_CERTIFICATE_EXPECTED 0
7899#define SSL_CERTIFICATE_SKIP 1
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007900MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007901static int ssl_parse_certificate_coordinate(mbedtls_ssl_context *ssl,
7902 int authmode)
Jerry Yud9526692022-02-17 14:23:47 +08007903{
7904 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7905 ssl->handshake->ciphersuite_info;
7906
Gilles Peskine449bd832023-01-11 14:50:10 +01007907 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7908 return SSL_CERTIFICATE_SKIP;
7909 }
Jerry Yud9526692022-02-17 14:23:47 +08007910
7911#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007912 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
7913 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) {
7914 return SSL_CERTIFICATE_SKIP;
7915 }
Jerry Yud9526692022-02-17 14:23:47 +08007916
Gilles Peskine449bd832023-01-11 14:50:10 +01007917 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
Jerry Yud9526692022-02-17 14:23:47 +08007918 ssl->session_negotiate->verify_result =
7919 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
Gilles Peskine449bd832023-01-11 14:50:10 +01007920 return SSL_CERTIFICATE_SKIP;
Jerry Yud9526692022-02-17 14:23:47 +08007921 }
7922 }
7923#else
7924 ((void) authmode);
7925#endif /* MBEDTLS_SSL_SRV_C */
7926
Gilles Peskine449bd832023-01-11 14:50:10 +01007927 return SSL_CERTIFICATE_EXPECTED;
Jerry Yud9526692022-02-17 14:23:47 +08007928}
7929
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007930MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007931static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl,
7932 int authmode,
7933 mbedtls_x509_crt *chain,
7934 void *rs_ctx)
Jerry Yud9526692022-02-17 14:23:47 +08007935{
7936 int ret = 0;
7937 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7938 ssl->handshake->ciphersuite_info;
7939 int have_ca_chain = 0;
7940
7941 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
7942 void *p_vrfy;
7943
Gilles Peskine449bd832023-01-11 14:50:10 +01007944 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
7945 return 0;
7946 }
Jerry Yud9526692022-02-17 14:23:47 +08007947
Gilles Peskine449bd832023-01-11 14:50:10 +01007948 if (ssl->f_vrfy != NULL) {
7949 MBEDTLS_SSL_DEBUG_MSG(3, ("Use context-specific verification callback"));
Jerry Yud9526692022-02-17 14:23:47 +08007950 f_vrfy = ssl->f_vrfy;
7951 p_vrfy = ssl->p_vrfy;
Gilles Peskine449bd832023-01-11 14:50:10 +01007952 } else {
7953 MBEDTLS_SSL_DEBUG_MSG(3, ("Use configuration-specific verification callback"));
Jerry Yud9526692022-02-17 14:23:47 +08007954 f_vrfy = ssl->conf->f_vrfy;
7955 p_vrfy = ssl->conf->p_vrfy;
7956 }
7957
7958 /*
7959 * Main check: verify certificate
7960 */
7961#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
Gilles Peskine449bd832023-01-11 14:50:10 +01007962 if (ssl->conf->f_ca_cb != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007963 ((void) rs_ctx);
7964 have_ca_chain = 1;
7965
Gilles Peskine449bd832023-01-11 14:50:10 +01007966 MBEDTLS_SSL_DEBUG_MSG(3, ("use CA callback for X.509 CRT verification"));
Jerry Yud9526692022-02-17 14:23:47 +08007967 ret = mbedtls_x509_crt_verify_with_ca_cb(
7968 chain,
7969 ssl->conf->f_ca_cb,
7970 ssl->conf->p_ca_cb,
7971 ssl->conf->cert_profile,
7972 ssl->hostname,
7973 &ssl->session_negotiate->verify_result,
Gilles Peskine449bd832023-01-11 14:50:10 +01007974 f_vrfy, p_vrfy);
7975 } else
Jerry Yud9526692022-02-17 14:23:47 +08007976#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
7977 {
7978 mbedtls_x509_crt *ca_chain;
7979 mbedtls_x509_crl *ca_crl;
7980
7981#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01007982 if (ssl->handshake->sni_ca_chain != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007983 ca_chain = ssl->handshake->sni_ca_chain;
7984 ca_crl = ssl->handshake->sni_ca_crl;
Gilles Peskine449bd832023-01-11 14:50:10 +01007985 } else
Jerry Yud9526692022-02-17 14:23:47 +08007986#endif
7987 {
7988 ca_chain = ssl->conf->ca_chain;
7989 ca_crl = ssl->conf->ca_crl;
7990 }
7991
Gilles Peskine449bd832023-01-11 14:50:10 +01007992 if (ca_chain != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007993 have_ca_chain = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007994 }
Jerry Yud9526692022-02-17 14:23:47 +08007995
7996 ret = mbedtls_x509_crt_verify_restartable(
7997 chain,
7998 ca_chain, ca_crl,
7999 ssl->conf->cert_profile,
8000 ssl->hostname,
8001 &ssl->session_negotiate->verify_result,
Gilles Peskine449bd832023-01-11 14:50:10 +01008002 f_vrfy, p_vrfy, rs_ctx);
Jerry Yud9526692022-02-17 14:23:47 +08008003 }
8004
Gilles Peskine449bd832023-01-11 14:50:10 +01008005 if (ret != 0) {
8006 MBEDTLS_SSL_DEBUG_RET(1, "x509_verify_cert", ret);
Jerry Yud9526692022-02-17 14:23:47 +08008007 }
8008
8009#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01008010 if (ret == MBEDTLS_ERR_ECP_IN_PROGRESS) {
8011 return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
8012 }
Jerry Yud9526692022-02-17 14:23:47 +08008013#endif
8014
8015 /*
8016 * Secondary checks: always done, but change 'ret' only if it was 0
8017 */
8018
Valerio Settiacd32c02023-06-29 18:06:29 +02008019#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
Jerry Yud9526692022-02-17 14:23:47 +08008020 {
8021 const mbedtls_pk_context *pk = &chain->pk;
8022
Manuel Pégourié-Gonnard66b0d612022-06-17 10:49:29 +02008023 /* If certificate uses an EC key, make sure the curve is OK.
8024 * This is a public key, so it can't be opaque, so can_do() is a good
8025 * enough check to ensure pk_ec() is safe to use here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008026 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_ECKEY)) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07008027 /* and in the unlikely case the above assumption no longer holds
8028 * we are making sure that pk_ec() here does not return a NULL
8029 */
Valerio Settif9362b72023-11-29 08:42:27 +01008030 mbedtls_ecp_group_id grp_id = mbedtls_pk_get_ec_group_id(pk);
Valerio Settid0405092023-05-24 13:16:40 +02008031 if (grp_id == MBEDTLS_ECP_DP_NONE) {
8032 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid group ID"));
Gilles Peskine449bd832023-01-11 14:50:10 +01008033 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Leonid Rozenboim19e59732022-08-08 16:52:38 -07008034 }
Valerio Setti97207782023-05-18 18:59:06 +02008035 if (mbedtls_ssl_check_curve(ssl, grp_id) != 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07008036 ssl->session_negotiate->verify_result |=
8037 MBEDTLS_X509_BADCERT_BAD_KEY;
8038
Gilles Peskine449bd832023-01-11 14:50:10 +01008039 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (EC key curve)"));
8040 if (ret == 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07008041 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01008042 }
Leonid Rozenboim19e59732022-08-08 16:52:38 -07008043 }
Jerry Yud9526692022-02-17 14:23:47 +08008044 }
8045 }
Valerio Settiacd32c02023-06-29 18:06:29 +02008046#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
Jerry Yud9526692022-02-17 14:23:47 +08008047
Gilles Peskine449bd832023-01-11 14:50:10 +01008048 if (mbedtls_ssl_check_cert_usage(chain,
8049 ciphersuite_info,
8050 !ssl->conf->endpoint,
8051 &ssl->session_negotiate->verify_result) != 0) {
8052 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (usage extensions)"));
8053 if (ret == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008054 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01008055 }
Jerry Yud9526692022-02-17 14:23:47 +08008056 }
8057
8058 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
8059 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
8060 * with details encoded in the verification flags. All other kinds
8061 * of error codes, including those from the user provided f_vrfy
8062 * functions, are treated as fatal and lead to a failure of
8063 * ssl_parse_certificate even if verification was optional. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008064 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
8065 (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
8066 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE)) {
Jerry Yud9526692022-02-17 14:23:47 +08008067 ret = 0;
8068 }
8069
Gilles Peskine449bd832023-01-11 14:50:10 +01008070 if (have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED) {
8071 MBEDTLS_SSL_DEBUG_MSG(1, ("got no CA chain"));
Jerry Yud9526692022-02-17 14:23:47 +08008072 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
8073 }
8074
Gilles Peskine449bd832023-01-11 14:50:10 +01008075 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008076 uint8_t alert;
8077
8078 /* The certificate may have been rejected for several reasons.
8079 Pick one and send the corresponding alert. Which alert to send
8080 may be a subject of debate in some cases. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008081 if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER) {
Jerry Yud9526692022-02-17 14:23:47 +08008082 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
Gilles Peskine449bd832023-01-11 14:50:10 +01008083 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH) {
Jerry Yud9526692022-02-17 14:23:47 +08008084 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01008085 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE) {
Jerry Yud9526692022-02-17 14:23:47 +08008086 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01008087 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE) {
Jerry Yud9526692022-02-17 14:23:47 +08008088 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01008089 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE) {
Jerry Yud9526692022-02-17 14:23:47 +08008090 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01008091 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK) {
Jerry Yud9526692022-02-17 14:23:47 +08008092 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01008093 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY) {
Jerry Yud9526692022-02-17 14:23:47 +08008094 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01008095 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED) {
Jerry Yud9526692022-02-17 14:23:47 +08008096 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
Gilles Peskine449bd832023-01-11 14:50:10 +01008097 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED) {
Jerry Yud9526692022-02-17 14:23:47 +08008098 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
Gilles Peskine449bd832023-01-11 14:50:10 +01008099 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
Jerry Yud9526692022-02-17 14:23:47 +08008100 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
Gilles Peskine449bd832023-01-11 14:50:10 +01008101 } else {
Jerry Yud9526692022-02-17 14:23:47 +08008102 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Gilles Peskine449bd832023-01-11 14:50:10 +01008103 }
8104 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8105 alert);
Jerry Yud9526692022-02-17 14:23:47 +08008106 }
8107
8108#if defined(MBEDTLS_DEBUG_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008109 if (ssl->session_negotiate->verify_result != 0) {
8110 MBEDTLS_SSL_DEBUG_MSG(3, ("! Certificate verification flags %08x",
8111 (unsigned int) ssl->session_negotiate->verify_result));
8112 } else {
8113 MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate verification flags clear"));
Jerry Yud9526692022-02-17 14:23:47 +08008114 }
8115#endif /* MBEDTLS_DEBUG_C */
8116
Gilles Peskine449bd832023-01-11 14:50:10 +01008117 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08008118}
8119
8120#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008121MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01008122static int ssl_remember_peer_crt_digest(mbedtls_ssl_context *ssl,
8123 unsigned char *start, size_t len)
Jerry Yud9526692022-02-17 14:23:47 +08008124{
8125 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8126 /* Remember digest of the peer's end-CRT. */
8127 ssl->session_negotiate->peer_cert_digest =
Gilles Peskine449bd832023-01-11 14:50:10 +01008128 mbedtls_calloc(1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN);
8129 if (ssl->session_negotiate->peer_cert_digest == NULL) {
8130 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%d bytes) failed",
8131 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN));
8132 mbedtls_ssl_send_alert_message(ssl,
8133 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8134 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
Jerry Yud9526692022-02-17 14:23:47 +08008135
Gilles Peskine449bd832023-01-11 14:50:10 +01008136 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Jerry Yud9526692022-02-17 14:23:47 +08008137 }
8138
Gilles Peskine449bd832023-01-11 14:50:10 +01008139 ret = mbedtls_md(mbedtls_md_info_from_type(
8140 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE),
8141 start, len,
8142 ssl->session_negotiate->peer_cert_digest);
Jerry Yud9526692022-02-17 14:23:47 +08008143
8144 ssl->session_negotiate->peer_cert_digest_type =
8145 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
8146 ssl->session_negotiate->peer_cert_digest_len =
8147 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
8148
Gilles Peskine449bd832023-01-11 14:50:10 +01008149 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08008150}
8151
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008152MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01008153static int ssl_remember_peer_pubkey(mbedtls_ssl_context *ssl,
8154 unsigned char *start, size_t len)
Jerry Yud9526692022-02-17 14:23:47 +08008155{
8156 unsigned char *end = start + len;
8157 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8158
8159 /* Make a copy of the peer's raw public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008160 mbedtls_pk_init(&ssl->handshake->peer_pubkey);
8161 ret = mbedtls_pk_parse_subpubkey(&start, end,
8162 &ssl->handshake->peer_pubkey);
8163 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008164 /* We should have parsed the public key before. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008165 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08008166 }
8167
Gilles Peskine449bd832023-01-11 14:50:10 +01008168 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08008169}
8170#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8171
Gilles Peskine449bd832023-01-11 14:50:10 +01008172int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08008173{
8174 int ret = 0;
8175 int crt_expected;
8176#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8177 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
8178 ? ssl->handshake->sni_authmode
8179 : ssl->conf->authmode;
8180#else
8181 const int authmode = ssl->conf->authmode;
8182#endif
8183 void *rs_ctx = NULL;
8184 mbedtls_x509_crt *chain = NULL;
8185
Gilles Peskine449bd832023-01-11 14:50:10 +01008186 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08008187
Gilles Peskine449bd832023-01-11 14:50:10 +01008188 crt_expected = ssl_parse_certificate_coordinate(ssl, authmode);
8189 if (crt_expected == SSL_CERTIFICATE_SKIP) {
8190 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08008191 goto exit;
8192 }
8193
8194#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01008195 if (ssl->handshake->ecrs_enabled &&
8196 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify) {
Jerry Yud9526692022-02-17 14:23:47 +08008197 chain = ssl->handshake->ecrs_peer_cert;
8198 ssl->handshake->ecrs_peer_cert = NULL;
8199 goto crt_verify;
8200 }
8201#endif
8202
Gilles Peskine449bd832023-01-11 14:50:10 +01008203 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008204 /* mbedtls_ssl_read_record may have sent an alert already. We
8205 let it decide whether to alert. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008206 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
Jerry Yud9526692022-02-17 14:23:47 +08008207 goto exit;
8208 }
8209
8210#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008211 if (ssl_srv_check_client_no_crt_notification(ssl) == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008212 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
8213
Gilles Peskine449bd832023-01-11 14:50:10 +01008214 if (authmode != MBEDTLS_SSL_VERIFY_OPTIONAL) {
Jerry Yud9526692022-02-17 14:23:47 +08008215 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01008216 }
Jerry Yud9526692022-02-17 14:23:47 +08008217
8218 goto exit;
8219 }
8220#endif /* MBEDTLS_SSL_SRV_C */
8221
8222 /* Clear existing peer CRT structure in case we tried to
8223 * reuse a session but it failed, and allocate a new one. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008224 ssl_clear_peer_cert(ssl->session_negotiate);
Jerry Yud9526692022-02-17 14:23:47 +08008225
Gilles Peskine449bd832023-01-11 14:50:10 +01008226 chain = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
8227 if (chain == NULL) {
8228 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
8229 sizeof(mbedtls_x509_crt)));
8230 mbedtls_ssl_send_alert_message(ssl,
8231 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8232 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
Jerry Yud9526692022-02-17 14:23:47 +08008233
8234 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
8235 goto exit;
8236 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008237 mbedtls_x509_crt_init(chain);
Jerry Yud9526692022-02-17 14:23:47 +08008238
Gilles Peskine449bd832023-01-11 14:50:10 +01008239 ret = ssl_parse_certificate_chain(ssl, chain);
8240 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008241 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008242 }
Jerry Yud9526692022-02-17 14:23:47 +08008243
8244#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01008245 if (ssl->handshake->ecrs_enabled) {
Jerry Yud9526692022-02-17 14:23:47 +08008246 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Gilles Peskine449bd832023-01-11 14:50:10 +01008247 }
Jerry Yud9526692022-02-17 14:23:47 +08008248
8249crt_verify:
Gilles Peskine449bd832023-01-11 14:50:10 +01008250 if (ssl->handshake->ecrs_enabled) {
Jerry Yud9526692022-02-17 14:23:47 +08008251 rs_ctx = &ssl->handshake->ecrs_ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01008252 }
Jerry Yud9526692022-02-17 14:23:47 +08008253#endif
8254
Gilles Peskine449bd832023-01-11 14:50:10 +01008255 ret = ssl_parse_certificate_verify(ssl, authmode,
8256 chain, rs_ctx);
8257 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008258 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008259 }
Jerry Yud9526692022-02-17 14:23:47 +08008260
8261#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8262 {
8263 unsigned char *crt_start, *pk_start;
8264 size_t crt_len, pk_len;
8265
8266 /* We parse the CRT chain without copying, so
8267 * these pointers point into the input buffer,
8268 * and are hence still valid after freeing the
8269 * CRT chain. */
8270
8271 crt_start = chain->raw.p;
8272 crt_len = chain->raw.len;
8273
8274 pk_start = chain->pk_raw.p;
8275 pk_len = chain->pk_raw.len;
8276
8277 /* Free the CRT structures before computing
8278 * digest and copying the peer's public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008279 mbedtls_x509_crt_free(chain);
8280 mbedtls_free(chain);
Jerry Yud9526692022-02-17 14:23:47 +08008281 chain = NULL;
8282
Gilles Peskine449bd832023-01-11 14:50:10 +01008283 ret = ssl_remember_peer_crt_digest(ssl, crt_start, crt_len);
8284 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008285 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008286 }
Jerry Yud9526692022-02-17 14:23:47 +08008287
Gilles Peskine449bd832023-01-11 14:50:10 +01008288 ret = ssl_remember_peer_pubkey(ssl, pk_start, pk_len);
8289 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008290 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008291 }
Jerry Yud9526692022-02-17 14:23:47 +08008292 }
8293#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8294 /* Pass ownership to session structure. */
8295 ssl->session_negotiate->peer_cert = chain;
8296 chain = NULL;
8297#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8298
Gilles Peskine449bd832023-01-11 14:50:10 +01008299 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08008300
8301exit:
8302
Gilles Peskine449bd832023-01-11 14:50:10 +01008303 if (ret == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08008304 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01008305 }
Jerry Yud9526692022-02-17 14:23:47 +08008306
8307#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01008308 if (ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) {
Jerry Yud9526692022-02-17 14:23:47 +08008309 ssl->handshake->ecrs_peer_cert = chain;
8310 chain = NULL;
8311 }
8312#endif
8313
Gilles Peskine449bd832023-01-11 14:50:10 +01008314 if (chain != NULL) {
8315 mbedtls_x509_crt_free(chain);
8316 mbedtls_free(chain);
Jerry Yud9526692022-02-17 14:23:47 +08008317 }
8318
Gilles Peskine449bd832023-01-11 14:50:10 +01008319 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08008320}
8321#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
8322
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008323static int ssl_calc_finished_tls_generic(mbedtls_ssl_context *ssl, void *ctx,
8324 unsigned char *padbuf, size_t hlen,
8325 unsigned char *buf, int from)
Jerry Yu615bd6f2022-02-17 14:25:15 +08008326{
Dave Rodgmanc37ad442023-11-03 23:36:06 +00008327 unsigned int len = 12;
Jerry Yu615bd6f2022-02-17 14:25:15 +08008328 const char *sender;
Jerry Yu615bd6f2022-02-17 14:25:15 +08008329#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu615bd6f2022-02-17 14:25:15 +08008330 psa_status_t status;
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008331 psa_hash_operation_t *hs_op = ctx;
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008332 psa_hash_operation_t cloned_op = PSA_HASH_OPERATION_INIT;
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008333 size_t hash_size;
Jerry Yu615bd6f2022-02-17 14:25:15 +08008334#else
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01008335 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008336 mbedtls_md_context_t *hs_ctx = ctx;
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008337 mbedtls_md_context_t cloned_ctx;
8338 mbedtls_md_init(&cloned_ctx);
Jerry Yu615bd6f2022-02-17 14:25:15 +08008339#endif
8340
8341 mbedtls_ssl_session *session = ssl->session_negotiate;
Gilles Peskine449bd832023-01-11 14:50:10 +01008342 if (!session) {
Jerry Yu615bd6f2022-02-17 14:25:15 +08008343 session = ssl->session;
Gilles Peskine449bd832023-01-11 14:50:10 +01008344 }
Jerry Yu615bd6f2022-02-17 14:25:15 +08008345
Gilles Peskine449bd832023-01-11 14:50:10 +01008346 sender = (from == MBEDTLS_SSL_IS_CLIENT)
Jerry Yu615bd6f2022-02-17 14:25:15 +08008347 ? "client finished"
8348 : "server finished";
8349
8350#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008351 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc PSA finished tls"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08008352
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008353 status = psa_hash_clone(hs_op, &cloned_op);
Gilles Peskine449bd832023-01-11 14:50:10 +01008354 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01008355 goto exit;
Jerry Yu615bd6f2022-02-17 14:25:15 +08008356 }
8357
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008358 status = psa_hash_finish(&cloned_op, padbuf, hlen, &hash_size);
Gilles Peskine449bd832023-01-11 14:50:10 +01008359 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01008360 goto exit;
Jerry Yu615bd6f2022-02-17 14:25:15 +08008361 }
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008362 MBEDTLS_SSL_DEBUG_BUF(3, "PSA calculated padbuf", padbuf, hlen);
Jerry Yu615bd6f2022-02-17 14:25:15 +08008363#else
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008364 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc finished tls"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08008365
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008366 ret = mbedtls_md_setup(&cloned_ctx, mbedtls_md_info_from_ctx(hs_ctx), 0);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01008367 if (ret != 0) {
8368 goto exit;
8369 }
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008370 ret = mbedtls_md_clone(&cloned_ctx, hs_ctx);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01008371 if (ret != 0) {
8372 goto exit;
8373 }
Jerry Yu615bd6f2022-02-17 14:25:15 +08008374
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008375 ret = mbedtls_md_finish(&cloned_ctx, padbuf);
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008376 if (ret != 0) {
8377 goto exit;
8378 }
8379#endif /* MBEDTLS_USE_PSA_CRYPTO */
8380
8381 MBEDTLS_SSL_DEBUG_BUF(4, "finished output", padbuf, hlen);
8382
Jerry Yu615bd6f2022-02-17 14:25:15 +08008383 /*
8384 * TLSv1.2:
8385 * hash = PRF( master, finished_label,
8386 * Hash( handshake ) )[0.11]
8387 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008388 ssl->handshake->tls_prf(session->master, 48, sender,
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008389 padbuf, hlen, buf, len);
Jerry Yu615bd6f2022-02-17 14:25:15 +08008390
Gilles Peskine449bd832023-01-11 14:50:10 +01008391 MBEDTLS_SSL_DEBUG_BUF(3, "calc finished result", buf, len);
Jerry Yu615bd6f2022-02-17 14:25:15 +08008392
Paul Elliottecb95be2023-08-11 16:41:04 +01008393 mbedtls_platform_zeroize(padbuf, hlen);
Jerry Yu615bd6f2022-02-17 14:25:15 +08008394
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008395 MBEDTLS_SSL_DEBUG_MSG(2, ("<= calc finished"));
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01008396
8397exit:
8398#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008399 psa_hash_abort(&cloned_op);
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +02008400 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01008401#else
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02008402 mbedtls_md_free(&cloned_ctx);
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01008403 return ret;
8404#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu615bd6f2022-02-17 14:25:15 +08008405}
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008406
8407#if defined(MBEDTLS_MD_CAN_SHA256)
8408static int ssl_calc_finished_tls_sha256(
8409 mbedtls_ssl_context *ssl, unsigned char *buf, int from)
8410{
8411 unsigned char padbuf[32];
8412 return ssl_calc_finished_tls_generic(ssl,
8413#if defined(MBEDTLS_USE_PSA_CRYPTO)
8414 &ssl->handshake->fin_sha256_psa,
8415#else
8416 &ssl->handshake->fin_sha256,
8417#endif
8418 padbuf, sizeof(padbuf),
8419 buf, from);
8420}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008421#endif /* MBEDTLS_MD_CAN_SHA256*/
Jerry Yu615bd6f2022-02-17 14:25:15 +08008422
Jerry Yub7ba49e2022-02-17 14:25:53 +08008423
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008424#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +01008425static int ssl_calc_finished_tls_sha384(
Gilles Peskine449bd832023-01-11 14:50:10 +01008426 mbedtls_ssl_context *ssl, unsigned char *buf, int from)
Jerry Yub7ba49e2022-02-17 14:25:53 +08008427{
Jerry Yub7ba49e2022-02-17 14:25:53 +08008428 unsigned char padbuf[48];
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008429 return ssl_calc_finished_tls_generic(ssl,
Jerry Yub7ba49e2022-02-17 14:25:53 +08008430#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008431 &ssl->handshake->fin_sha384_psa,
Jerry Yub7ba49e2022-02-17 14:25:53 +08008432#else
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008433 &ssl->handshake->fin_sha384,
Jerry Yub7ba49e2022-02-17 14:25:53 +08008434#endif
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02008435 padbuf, sizeof(padbuf),
8436 buf, from);
Jerry Yub7ba49e2022-02-17 14:25:53 +08008437}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008438#endif /* MBEDTLS_MD_CAN_SHA384*/
Jerry Yub7ba49e2022-02-17 14:25:53 +08008439
Gilles Peskine449bd832023-01-11 14:50:10 +01008440void mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context *ssl)
Jerry Yuaef00152022-02-17 14:27:31 +08008441{
Gilles Peskine449bd832023-01-11 14:50:10 +01008442 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup: final free"));
Jerry Yuaef00152022-02-17 14:27:31 +08008443
8444 /*
8445 * Free our handshake params
8446 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008447 mbedtls_ssl_handshake_free(ssl);
8448 mbedtls_free(ssl->handshake);
Jerry Yuaef00152022-02-17 14:27:31 +08008449 ssl->handshake = NULL;
8450
8451 /*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08008452 * Free the previous transform and switch in the current one
Jerry Yuaef00152022-02-17 14:27:31 +08008453 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008454 if (ssl->transform) {
8455 mbedtls_ssl_transform_free(ssl->transform);
8456 mbedtls_free(ssl->transform);
Jerry Yuaef00152022-02-17 14:27:31 +08008457 }
8458 ssl->transform = ssl->transform_negotiate;
8459 ssl->transform_negotiate = NULL;
8460
Gilles Peskine449bd832023-01-11 14:50:10 +01008461 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup: final free"));
Jerry Yuaef00152022-02-17 14:27:31 +08008462}
8463
Gilles Peskine449bd832023-01-11 14:50:10 +01008464void mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context *ssl)
Jerry Yu2a9fff52022-02-17 14:28:51 +08008465{
8466 int resume = ssl->handshake->resume;
8467
Gilles Peskine449bd832023-01-11 14:50:10 +01008468 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup"));
Jerry Yu2a9fff52022-02-17 14:28:51 +08008469
8470#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01008471 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08008472 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
8473 ssl->renego_records_seen = 0;
8474 }
8475#endif
8476
8477 /*
8478 * Free the previous session and switch in the current one
8479 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008480 if (ssl->session) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08008481#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
8482 /* RFC 7366 3.1: keep the EtM state */
8483 ssl->session_negotiate->encrypt_then_mac =
Gilles Peskine449bd832023-01-11 14:50:10 +01008484 ssl->session->encrypt_then_mac;
Jerry Yu2a9fff52022-02-17 14:28:51 +08008485#endif
8486
Gilles Peskine449bd832023-01-11 14:50:10 +01008487 mbedtls_ssl_session_free(ssl->session);
8488 mbedtls_free(ssl->session);
Jerry Yu2a9fff52022-02-17 14:28:51 +08008489 }
8490 ssl->session = ssl->session_negotiate;
8491 ssl->session_negotiate = NULL;
8492
8493 /*
8494 * Add cache entry
8495 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008496 if (ssl->conf->f_set_cache != NULL &&
Jerry Yu2a9fff52022-02-17 14:28:51 +08008497 ssl->session->id_len != 0 &&
Gilles Peskine449bd832023-01-11 14:50:10 +01008498 resume == 0) {
8499 if (ssl->conf->f_set_cache(ssl->conf->p_cache,
8500 ssl->session->id,
8501 ssl->session->id_len,
8502 ssl->session) != 0) {
8503 MBEDTLS_SSL_DEBUG_MSG(1, ("cache did not store session"));
8504 }
Jerry Yu2a9fff52022-02-17 14:28:51 +08008505 }
8506
8507#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008508 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
8509 ssl->handshake->flight != NULL) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08008510 /* Cancel handshake timer */
Gilles Peskine449bd832023-01-11 14:50:10 +01008511 mbedtls_ssl_set_timer(ssl, 0);
Jerry Yu2a9fff52022-02-17 14:28:51 +08008512
8513 /* Keep last flight around in case we need to resend it:
8514 * we need the handshake and transform structures for that */
Gilles Peskine449bd832023-01-11 14:50:10 +01008515 MBEDTLS_SSL_DEBUG_MSG(3, ("skip freeing handshake and transform"));
8516 } else
Jerry Yu2a9fff52022-02-17 14:28:51 +08008517#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008518 mbedtls_ssl_handshake_wrapup_free_hs_transform(ssl);
Jerry Yu2a9fff52022-02-17 14:28:51 +08008519
Jerry Yu5ed73ff2022-10-27 13:08:42 +08008520 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Jerry Yu2a9fff52022-02-17 14:28:51 +08008521
Gilles Peskine449bd832023-01-11 14:50:10 +01008522 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup"));
Jerry Yu2a9fff52022-02-17 14:28:51 +08008523}
8524
Gilles Peskine449bd832023-01-11 14:50:10 +01008525int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl)
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008526{
Dave Rodgmanc37ad442023-11-03 23:36:06 +00008527 int ret;
8528 unsigned int hash_len;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008529
Gilles Peskine449bd832023-01-11 14:50:10 +01008530 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008531
Gilles Peskine449bd832023-01-11 14:50:10 +01008532 mbedtls_ssl_update_out_pointers(ssl, ssl->transform_negotiate);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008533
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01008534 ret = ssl->handshake->calc_finished(ssl, ssl->out_msg + 4, ssl->conf->endpoint);
8535 if (ret != 0) {
8536 MBEDTLS_SSL_DEBUG_RET(1, "calc_finished", ret);
8537 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008538
8539 /*
8540 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
8541 * may define some other value. Currently (early 2016), no defined
8542 * ciphersuite does this (and this is unlikely to change as activity has
8543 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
8544 */
8545 hash_len = 12;
8546
8547#if defined(MBEDTLS_SSL_RENEGOTIATION)
8548 ssl->verify_data_len = hash_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008549 memcpy(ssl->own_verify_data, ssl->out_msg + 4, hash_len);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008550#endif
8551
8552 ssl->out_msglen = 4 + hash_len;
8553 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8554 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
8555
8556 /*
8557 * In case of session resuming, invert the client and server
8558 * ChangeCipherSpec messages order.
8559 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008560 if (ssl->handshake->resume != 0) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008561#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008562 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008563 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Gilles Peskine449bd832023-01-11 14:50:10 +01008564 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008565#endif
8566#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008567 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008568 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Gilles Peskine449bd832023-01-11 14:50:10 +01008569 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008570#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008571 } else {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008572 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01008573 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008574
8575 /*
8576 * Switch to our negotiated transform and session parameters for outbound
8577 * data.
8578 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008579 MBEDTLS_SSL_DEBUG_MSG(3, ("switching to new transform spec for outbound data"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008580
8581#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008582 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008583 unsigned char i;
8584
8585 /* Remember current epoch settings for resending */
8586 ssl->handshake->alt_transform_out = ssl->transform_out;
Gilles Peskine449bd832023-01-11 14:50:10 +01008587 memcpy(ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
8588 sizeof(ssl->handshake->alt_out_ctr));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008589
8590 /* Set sequence_number to zero */
Gilles Peskine449bd832023-01-11 14:50:10 +01008591 memset(&ssl->cur_out_ctr[2], 0, sizeof(ssl->cur_out_ctr) - 2);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008592
8593
8594 /* Increment epoch */
Gilles Peskine449bd832023-01-11 14:50:10 +01008595 for (i = 2; i > 0; i--) {
8596 if (++ssl->cur_out_ctr[i - 1] != 0) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008597 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01008598 }
8599 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008600
8601 /* The loop goes to its end iff the counter is wrapping */
Gilles Peskine449bd832023-01-11 14:50:10 +01008602 if (i == 0) {
8603 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS epoch would wrap"));
8604 return MBEDTLS_ERR_SSL_COUNTER_WRAPPING;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008605 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008606 } else
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008607#endif /* MBEDTLS_SSL_PROTO_DTLS */
Gilles Peskine449bd832023-01-11 14:50:10 +01008608 memset(ssl->cur_out_ctr, 0, sizeof(ssl->cur_out_ctr));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008609
8610 ssl->transform_out = ssl->transform_negotiate;
8611 ssl->session_out = ssl->session_negotiate;
8612
8613#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008614 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
8615 mbedtls_ssl_send_flight_completed(ssl);
8616 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008617#endif
8618
Gilles Peskine449bd832023-01-11 14:50:10 +01008619 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
8620 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
8621 return ret;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008622 }
8623
8624#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008625 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
8626 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
8627 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret);
8628 return ret;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008629 }
8630#endif
8631
Gilles Peskine449bd832023-01-11 14:50:10 +01008632 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write finished"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008633
Gilles Peskine449bd832023-01-11 14:50:10 +01008634 return 0;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008635}
8636
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008637#define SSL_MAX_HASH_LEN 12
8638
Gilles Peskine449bd832023-01-11 14:50:10 +01008639int mbedtls_ssl_parse_finished(mbedtls_ssl_context *ssl)
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008640{
8641 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8642 unsigned int hash_len = 12;
8643 unsigned char buf[SSL_MAX_HASH_LEN];
8644
Gilles Peskine449bd832023-01-11 14:50:10 +01008645 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished"));
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008646
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01008647 ret = ssl->handshake->calc_finished(ssl, buf, ssl->conf->endpoint ^ 1);
8648 if (ret != 0) {
8649 MBEDTLS_SSL_DEBUG_RET(1, "calc_finished", ret);
8650 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008651
Gilles Peskine449bd832023-01-11 14:50:10 +01008652 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) {
8653 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008654 goto exit;
8655 }
8656
Gilles Peskine449bd832023-01-11 14:50:10 +01008657 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
8658 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
8659 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8660 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008661 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
8662 goto exit;
8663 }
8664
Gilles Peskine449bd832023-01-11 14:50:10 +01008665 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED) {
8666 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8667 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008668 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
8669 goto exit;
8670 }
8671
Gilles Peskine449bd832023-01-11 14:50:10 +01008672 if (ssl->in_hslen != mbedtls_ssl_hs_hdr_len(ssl) + hash_len) {
8673 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
8674 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8675 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008676 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
8677 goto exit;
8678 }
8679
Gilles Peskine449bd832023-01-11 14:50:10 +01008680 if (mbedtls_ct_memcmp(ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl),
8681 buf, hash_len) != 0) {
8682 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
8683 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8684 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008685 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
8686 goto exit;
8687 }
8688
8689#if defined(MBEDTLS_SSL_RENEGOTIATION)
8690 ssl->verify_data_len = hash_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008691 memcpy(ssl->peer_verify_data, buf, hash_len);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008692#endif
8693
Gilles Peskine449bd832023-01-11 14:50:10 +01008694 if (ssl->handshake->resume != 0) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008695#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008696 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008697 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Gilles Peskine449bd832023-01-11 14:50:10 +01008698 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008699#endif
8700#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008701 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008702 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Gilles Peskine449bd832023-01-11 14:50:10 +01008703 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008704#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008705 } else {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008706 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01008707 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008708
8709#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008710 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
8711 mbedtls_ssl_recv_flight_completed(ssl);
8712 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008713#endif
8714
Gilles Peskine449bd832023-01-11 14:50:10 +01008715 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse finished"));
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008716
8717exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01008718 mbedtls_platform_zeroize(buf, hash_len);
8719 return ret;
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008720}
8721
Jerry Yu392112c2022-02-17 14:34:10 +08008722#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
8723/*
8724 * Helper to get TLS 1.2 PRF from ciphersuite
8725 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
8726 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008727static tls_prf_fn ssl_tls12prf_from_cs(int ciphersuite_id)
Jerry Yu392112c2022-02-17 14:34:10 +08008728{
Jerry Yu392112c2022-02-17 14:34:10 +08008729 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01008730 mbedtls_ssl_ciphersuite_from_id(ciphersuite_id);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008731#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01008732 if (ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
8733 return tls_prf_sha384;
8734 } else
Jerry Yu392112c2022-02-17 14:34:10 +08008735#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008736#if defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurek894edde2022-09-29 06:31:14 -04008737 {
Gilles Peskine449bd832023-01-11 14:50:10 +01008738 if (ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA256) {
8739 return tls_prf_sha256;
8740 }
Andrzej Kurek894edde2022-09-29 06:31:14 -04008741 }
8742#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008743#if !defined(MBEDTLS_MD_CAN_SHA384) && \
8744 !defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurek894edde2022-09-29 06:31:14 -04008745 (void) ciphersuite_info;
8746#endif
Andrzej Kurekeabeb302022-10-17 07:52:51 -04008747
Gilles Peskine449bd832023-01-11 14:50:10 +01008748 return NULL;
Jerry Yu392112c2022-02-17 14:34:10 +08008749}
8750#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08008751
Gilles Peskine449bd832023-01-11 14:50:10 +01008752static mbedtls_tls_prf_types tls_prf_get_type(mbedtls_ssl_tls_prf_cb *tls_prf)
Jerry Yue93ffcd2022-02-17 14:37:06 +08008753{
8754 ((void) tls_prf);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008755#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01008756 if (tls_prf == tls_prf_sha384) {
8757 return MBEDTLS_SSL_TLS_PRF_SHA384;
8758 } else
Jerry Yue93ffcd2022-02-17 14:37:06 +08008759#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008760#if defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +01008761 if (tls_prf == tls_prf_sha256) {
8762 return MBEDTLS_SSL_TLS_PRF_SHA256;
8763 } else
Jerry Yue93ffcd2022-02-17 14:37:06 +08008764#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008765 return MBEDTLS_SSL_TLS_PRF_NONE;
Jerry Yue93ffcd2022-02-17 14:37:06 +08008766}
8767
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008768/*
8769 * Populate a transform structure with session keys and all the other
8770 * necessary information.
8771 *
8772 * Parameters:
8773 * - [in/out]: transform: structure to populate
8774 * [in] must be just initialised with mbedtls_ssl_transform_init()
8775 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
8776 * - [in] ciphersuite
8777 * - [in] master
8778 * - [in] encrypt_then_mac
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008779 * - [in] tls_prf: pointer to PRF to use for key derivation
8780 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Glenn Strauss07c64162022-03-14 12:34:51 -04008781 * - [in] tls_version: TLS version
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008782 * - [in] endpoint: client or server
8783 * - [in] ssl: used for:
8784 * - ssl->conf->{f,p}_export_keys
8785 * [in] optionally used for:
8786 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
8787 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008788MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01008789static int ssl_tls12_populate_transform(mbedtls_ssl_transform *transform,
8790 int ciphersuite,
8791 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008792#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01008793 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008794#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01008795 ssl_tls_prf_t tls_prf,
8796 const unsigned char randbytes[64],
8797 mbedtls_ssl_protocol_version tls_version,
8798 unsigned endpoint,
8799 const mbedtls_ssl_context *ssl)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008800{
8801 int ret = 0;
8802 unsigned char keyblk[256];
8803 unsigned char *key1;
8804 unsigned char *key2;
8805 unsigned char *mac_enc;
8806 unsigned char *mac_dec;
8807 size_t mac_key_len = 0;
8808 size_t iv_copy_len;
8809 size_t keylen;
8810 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008811 mbedtls_ssl_mode_t ssl_mode;
Neil Armstronge4512952022-03-08 09:08:22 +01008812#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008813 const mbedtls_cipher_info_t *cipher_info;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008814 const mbedtls_md_info_t *md_info;
Neil Armstronge4512952022-03-08 09:08:22 +01008815#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008816
8817#if defined(MBEDTLS_USE_PSA_CRYPTO)
8818 psa_key_type_t key_type;
8819 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
8820 psa_algorithm_t alg;
Neil Armstronge4512952022-03-08 09:08:22 +01008821 psa_algorithm_t mac_alg = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008822 size_t key_bits;
8823 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
8824#endif
8825
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008826 /*
8827 * Some data just needs copying into the structure
8828 */
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008829#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008830 transform->encrypt_then_mac = encrypt_then_mac;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008831#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Glenn Strauss07c64162022-03-14 12:34:51 -04008832 transform->tls_version = tls_version;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008833
8834#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01008835 memcpy(transform->randbytes, randbytes, sizeof(transform->randbytes));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008836#endif
8837
8838#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01008839 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008840 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
8841 * generation separate. This should never happen. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008842 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008843 }
8844#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
8845
8846 /*
8847 * Get various info structures
8848 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008849 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(ciphersuite);
8850 if (ciphersuite_info == NULL) {
8851 MBEDTLS_SSL_DEBUG_MSG(1, ("ciphersuite info for %d not found",
8852 ciphersuite));
8853 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008854 }
8855
Neil Armstrongab555e02022-04-04 11:07:59 +02008856 ssl_mode = mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008857#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01008858 encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008859#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01008860 ciphersuite_info);
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008861
Gilles Peskine449bd832023-01-11 14:50:10 +01008862 if (ssl_mode == MBEDTLS_SSL_MODE_AEAD) {
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008863 transform->taglen =
8864 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Gilles Peskine449bd832023-01-11 14:50:10 +01008865 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008866
8867#if defined(MBEDTLS_USE_PSA_CRYPTO)
Dave Rodgman2eab4622023-10-05 13:30:37 +01008868 if ((status = mbedtls_ssl_cipher_to_psa((mbedtls_cipher_type_t) ciphersuite_info->cipher,
Gilles Peskine449bd832023-01-11 14:50:10 +01008869 transform->taglen,
8870 &alg,
8871 &key_type,
8872 &key_bits)) != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05008873 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01008874 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_cipher_to_psa", ret);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008875 goto end;
8876 }
8877#else
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01008878 cipher_info = mbedtls_cipher_info_from_type((mbedtls_cipher_type_t) ciphersuite_info->cipher);
Gilles Peskine449bd832023-01-11 14:50:10 +01008879 if (cipher_info == NULL) {
8880 MBEDTLS_SSL_DEBUG_MSG(1, ("cipher info for %u not found",
8881 ciphersuite_info->cipher));
8882 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008883 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008884#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008885
Neil Armstronge4512952022-03-08 09:08:22 +01008886#if defined(MBEDTLS_USE_PSA_CRYPTO)
Dave Rodgman2eab4622023-10-05 13:30:37 +01008887 mac_alg = mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) ciphersuite_info->mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01008888 if (mac_alg == 0) {
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02008889 MBEDTLS_SSL_DEBUG_MSG(1, ("mbedtls_md_psa_alg_from_type for %u not found",
Gilles Peskine449bd832023-01-11 14:50:10 +01008890 (unsigned) ciphersuite_info->mac));
8891 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstronge4512952022-03-08 09:08:22 +01008892 }
8893#else
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01008894 md_info = mbedtls_md_info_from_type((mbedtls_md_type_t) ciphersuite_info->mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01008895 if (md_info == NULL) {
8896 MBEDTLS_SSL_DEBUG_MSG(1, ("mbedtls_md info for %u not found",
8897 (unsigned) ciphersuite_info->mac));
8898 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008899 }
Neil Armstronge4512952022-03-08 09:08:22 +01008900#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008901
8902#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
8903 /* Copy own and peer's CID if the use of the CID
8904 * extension has been negotiated. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008905 if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED) {
8906 MBEDTLS_SSL_DEBUG_MSG(3, ("Copy CIDs into SSL transform"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008907
8908 transform->in_cid_len = ssl->own_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008909 memcpy(transform->in_cid, ssl->own_cid, ssl->own_cid_len);
8910 MBEDTLS_SSL_DEBUG_BUF(3, "Incoming CID", transform->in_cid,
8911 transform->in_cid_len);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008912
8913 transform->out_cid_len = ssl->handshake->peer_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008914 memcpy(transform->out_cid, ssl->handshake->peer_cid,
8915 ssl->handshake->peer_cid_len);
8916 MBEDTLS_SSL_DEBUG_BUF(3, "Outgoing CID", transform->out_cid,
8917 transform->out_cid_len);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008918 }
8919#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
8920
8921 /*
8922 * Compute key block using the PRF
8923 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008924 ret = tls_prf(master, 48, "key expansion", randbytes, 64, keyblk, 256);
8925 if (ret != 0) {
8926 MBEDTLS_SSL_DEBUG_RET(1, "prf", ret);
8927 return ret;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008928 }
8929
Gilles Peskine449bd832023-01-11 14:50:10 +01008930 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite = %s",
8931 mbedtls_ssl_get_ciphersuite_name(ciphersuite)));
8932 MBEDTLS_SSL_DEBUG_BUF(3, "master secret", master, 48);
8933 MBEDTLS_SSL_DEBUG_BUF(4, "random bytes", randbytes, 64);
8934 MBEDTLS_SSL_DEBUG_BUF(4, "key block", keyblk, 256);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008935
8936 /*
8937 * Determine the appropriate key, IV and MAC length.
8938 */
8939
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008940#if defined(MBEDTLS_USE_PSA_CRYPTO)
8941 keylen = PSA_BITS_TO_BYTES(key_bits);
8942#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008943 keylen = mbedtls_cipher_info_get_key_bitlen(cipher_info) / 8;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008944#endif
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008945
Valerio Settie5707042023-10-11 11:54:42 +02008946#if defined(MBEDTLS_SSL_HAVE_AEAD)
Gilles Peskine449bd832023-01-11 14:50:10 +01008947 if (ssl_mode == MBEDTLS_SSL_MODE_AEAD) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008948 size_t explicit_ivlen;
8949
8950 transform->maclen = 0;
8951 mac_key_len = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008952
8953 /* All modes haves 96-bit IVs, but the length of the static parts vary
8954 * with mode and version:
8955 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
8956 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
8957 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
8958 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
8959 * sequence number).
8960 */
8961 transform->ivlen = 12;
David Horstmann3b2276a2022-10-06 14:49:08 +01008962
8963 int is_chachapoly = 0;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008964#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008965 is_chachapoly = (key_type == PSA_KEY_TYPE_CHACHA20);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008966#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008967 is_chachapoly = (mbedtls_cipher_info_get_mode(cipher_info)
8968 == MBEDTLS_MODE_CHACHAPOLY);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008969#endif /* MBEDTLS_USE_PSA_CRYPTO */
David Horstmann3b2276a2022-10-06 14:49:08 +01008970
Gilles Peskine449bd832023-01-11 14:50:10 +01008971 if (is_chachapoly) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008972 transform->fixed_ivlen = 12;
Gilles Peskine449bd832023-01-11 14:50:10 +01008973 } else {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008974 transform->fixed_ivlen = 4;
Gilles Peskine449bd832023-01-11 14:50:10 +01008975 }
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008976
8977 /* Minimum length of encrypted record */
8978 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
8979 transform->minlen = explicit_ivlen + transform->taglen;
Gilles Peskine449bd832023-01-11 14:50:10 +01008980 } else
Valerio Settie5707042023-10-11 11:54:42 +02008981#endif /* MBEDTLS_SSL_HAVE_AEAD */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008982#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01008983 if (ssl_mode == MBEDTLS_SSL_MODE_STREAM ||
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008984 ssl_mode == MBEDTLS_SSL_MODE_CBC ||
Gilles Peskine449bd832023-01-11 14:50:10 +01008985 ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM) {
Neil Armstronge4512952022-03-08 09:08:22 +01008986#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008987 size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008988#else
Dave Rodgman85a88132023-06-24 11:41:50 +01008989 size_t block_size = mbedtls_cipher_info_get_block_size(cipher_info);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008990#endif /* MBEDTLS_USE_PSA_CRYPTO */
8991
8992#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01008993 /* Get MAC length */
8994 mac_key_len = PSA_HASH_LENGTH(mac_alg);
8995#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008996 /* Initialize HMAC contexts */
Gilles Peskine449bd832023-01-11 14:50:10 +01008997 if ((ret = mbedtls_md_setup(&transform->md_ctx_enc, md_info, 1)) != 0 ||
8998 (ret = mbedtls_md_setup(&transform->md_ctx_dec, md_info, 1)) != 0) {
8999 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009000 goto end;
9001 }
9002
9003 /* Get MAC length */
Gilles Peskine449bd832023-01-11 14:50:10 +01009004 mac_key_len = mbedtls_md_get_size(md_info);
Neil Armstronge4512952022-03-08 09:08:22 +01009005#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009006 transform->maclen = mac_key_len;
9007
9008 /* IV length */
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02009009#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01009010 transform->ivlen = PSA_CIPHER_IV_LENGTH(key_type, alg);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02009011#else
Dave Rodgmanbb521fd2023-06-24 11:21:25 +01009012 transform->ivlen = mbedtls_cipher_info_get_iv_size(cipher_info);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02009013#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009014
9015 /* Minimum length */
Gilles Peskine449bd832023-01-11 14:50:10 +01009016 if (ssl_mode == MBEDTLS_SSL_MODE_STREAM) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009017 transform->minlen = transform->maclen;
Gilles Peskine449bd832023-01-11 14:50:10 +01009018 } else {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009019 /*
9020 * GenericBlockCipher:
9021 * 1. if EtM is in use: one block plus MAC
9022 * otherwise: * first multiple of blocklen greater than maclen
9023 * 2. IV
9024 */
9025#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01009026 if (ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009027 transform->minlen = transform->maclen
Gilles Peskine449bd832023-01-11 14:50:10 +01009028 + block_size;
9029 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009030#endif
9031 {
9032 transform->minlen = transform->maclen
Gilles Peskine449bd832023-01-11 14:50:10 +01009033 + block_size
9034 - transform->maclen % block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009035 }
9036
Gilles Peskine449bd832023-01-11 14:50:10 +01009037 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009038 transform->minlen += transform->ivlen;
Gilles Peskine449bd832023-01-11 14:50:10 +01009039 } else {
9040 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009041 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
9042 goto end;
9043 }
9044 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009045 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009046#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
9047 {
Gilles Peskine449bd832023-01-11 14:50:10 +01009048 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
9049 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009050 }
9051
Gilles Peskine449bd832023-01-11 14:50:10 +01009052 MBEDTLS_SSL_DEBUG_MSG(3, ("keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
9053 (unsigned) keylen,
9054 (unsigned) transform->minlen,
9055 (unsigned) transform->ivlen,
9056 (unsigned) transform->maclen));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009057
9058 /*
9059 * Finally setup the cipher contexts, IVs and MAC secrets.
9060 */
9061#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01009062 if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009063 key1 = keyblk + mac_key_len * 2;
9064 key2 = keyblk + mac_key_len * 2 + keylen;
9065
9066 mac_enc = keyblk;
9067 mac_dec = keyblk + mac_key_len;
9068
Gilles Peskine449bd832023-01-11 14:50:10 +01009069 iv_copy_len = (transform->fixed_ivlen) ?
9070 transform->fixed_ivlen : transform->ivlen;
9071 memcpy(transform->iv_enc, key2 + keylen, iv_copy_len);
9072 memcpy(transform->iv_dec, key2 + keylen + iv_copy_len,
9073 iv_copy_len);
9074 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009075#endif /* MBEDTLS_SSL_CLI_C */
9076#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01009077 if (endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009078 key1 = keyblk + mac_key_len * 2 + keylen;
9079 key2 = keyblk + mac_key_len * 2;
9080
9081 mac_enc = keyblk + mac_key_len;
9082 mac_dec = keyblk;
9083
Gilles Peskine449bd832023-01-11 14:50:10 +01009084 iv_copy_len = (transform->fixed_ivlen) ?
9085 transform->fixed_ivlen : transform->ivlen;
9086 memcpy(transform->iv_dec, key1 + keylen, iv_copy_len);
9087 memcpy(transform->iv_enc, key1 + keylen + iv_copy_len,
9088 iv_copy_len);
9089 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009090#endif /* MBEDTLS_SSL_SRV_C */
9091 {
Gilles Peskine449bd832023-01-11 14:50:10 +01009092 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009093 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
9094 goto end;
9095 }
9096
Paul Elliott4fb19552023-10-18 12:15:30 +01009097 if (ssl->f_export_keys != NULL) {
Gilles Peskine449bd832023-01-11 14:50:10 +01009098 ssl->f_export_keys(ssl->p_export_keys,
9099 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
9100 master, 48,
9101 randbytes + 32,
9102 randbytes,
9103 tls_prf_get_type(tls_prf));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009104 }
9105
9106#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009107 transform->psa_alg = alg;
9108
Gilles Peskine449bd832023-01-11 14:50:10 +01009109 if (alg != MBEDTLS_SSL_NULL_CIPHER) {
9110 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
9111 psa_set_key_algorithm(&attributes, alg);
9112 psa_set_key_type(&attributes, key_type);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009113
Gilles Peskine449bd832023-01-11 14:50:10 +01009114 if ((status = psa_import_key(&attributes,
9115 key1,
9116 PSA_BITS_TO_BYTES(key_bits),
9117 &transform->psa_key_enc)) != PSA_SUCCESS) {
9118 MBEDTLS_SSL_DEBUG_RET(3, "psa_import_key", (int) status);
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05009119 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01009120 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_key", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009121 goto end;
9122 }
9123
Gilles Peskine449bd832023-01-11 14:50:10 +01009124 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009125
Gilles Peskine449bd832023-01-11 14:50:10 +01009126 if ((status = psa_import_key(&attributes,
9127 key2,
9128 PSA_BITS_TO_BYTES(key_bits),
9129 &transform->psa_key_dec)) != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05009130 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01009131 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_key", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009132 goto end;
9133 }
9134 }
9135#else
Gilles Peskine449bd832023-01-11 14:50:10 +01009136 if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_enc,
9137 cipher_info)) != 0) {
9138 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009139 goto end;
9140 }
9141
Gilles Peskine449bd832023-01-11 14:50:10 +01009142 if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_dec,
9143 cipher_info)) != 0) {
9144 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009145 goto end;
9146 }
9147
Gilles Peskine449bd832023-01-11 14:50:10 +01009148 if ((ret = mbedtls_cipher_setkey(&transform->cipher_ctx_enc, key1,
9149 (int) mbedtls_cipher_info_get_key_bitlen(cipher_info),
9150 MBEDTLS_ENCRYPT)) != 0) {
9151 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setkey", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009152 goto end;
9153 }
9154
Gilles Peskine449bd832023-01-11 14:50:10 +01009155 if ((ret = mbedtls_cipher_setkey(&transform->cipher_ctx_dec, key2,
9156 (int) mbedtls_cipher_info_get_key_bitlen(cipher_info),
9157 MBEDTLS_DECRYPT)) != 0) {
9158 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setkey", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009159 goto end;
9160 }
9161
9162#if defined(MBEDTLS_CIPHER_MODE_CBC)
Gilles Peskine449bd832023-01-11 14:50:10 +01009163 if (mbedtls_cipher_info_get_mode(cipher_info) == MBEDTLS_MODE_CBC) {
9164 if ((ret = mbedtls_cipher_set_padding_mode(&transform->cipher_ctx_enc,
9165 MBEDTLS_PADDING_NONE)) != 0) {
9166 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_set_padding_mode", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009167 goto end;
9168 }
9169
Gilles Peskine449bd832023-01-11 14:50:10 +01009170 if ((ret = mbedtls_cipher_set_padding_mode(&transform->cipher_ctx_dec,
9171 MBEDTLS_PADDING_NONE)) != 0) {
9172 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_set_padding_mode", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009173 goto end;
9174 }
9175 }
9176#endif /* MBEDTLS_CIPHER_MODE_CBC */
9177#endif /* MBEDTLS_USE_PSA_CRYPTO */
9178
Neil Armstrong29c0c042022-03-17 17:47:28 +01009179#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
9180 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
9181 For AEAD-based ciphersuites, there is nothing to do here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01009182 if (mac_key_len != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01009183#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01009184 transform->psa_mac_alg = PSA_ALG_HMAC(mac_alg);
Neil Armstrong29c0c042022-03-17 17:47:28 +01009185
Gilles Peskine449bd832023-01-11 14:50:10 +01009186 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
9187 psa_set_key_algorithm(&attributes, PSA_ALG_HMAC(mac_alg));
9188 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Neil Armstrong29c0c042022-03-17 17:47:28 +01009189
Gilles Peskine449bd832023-01-11 14:50:10 +01009190 if ((status = psa_import_key(&attributes,
9191 mac_enc, mac_key_len,
9192 &transform->psa_mac_enc)) != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05009193 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01009194 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_mac_key", ret);
Neil Armstrong29c0c042022-03-17 17:47:28 +01009195 goto end;
9196 }
9197
Gilles Peskine449bd832023-01-11 14:50:10 +01009198 if ((transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER) ||
9199 ((transform->psa_alg == PSA_ALG_CBC_NO_PADDING)
Andrzej Kurek8c95ac42022-08-17 16:17:00 -04009200#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01009201 && (transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED)
Andrzej Kurek8c95ac42022-08-17 16:17:00 -04009202#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01009203 )) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01009204 /* mbedtls_ct_hmac() requires the key to be exportable */
Gilles Peskine449bd832023-01-11 14:50:10 +01009205 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT |
9206 PSA_KEY_USAGE_VERIFY_HASH);
9207 } else {
9208 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_VERIFY_HASH);
9209 }
Neil Armstrong29c0c042022-03-17 17:47:28 +01009210
Gilles Peskine449bd832023-01-11 14:50:10 +01009211 if ((status = psa_import_key(&attributes,
9212 mac_dec, mac_key_len,
9213 &transform->psa_mac_dec)) != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05009214 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01009215 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_mac_key", ret);
Neil Armstrong29c0c042022-03-17 17:47:28 +01009216 goto end;
9217 }
9218#else
Gilles Peskine449bd832023-01-11 14:50:10 +01009219 ret = mbedtls_md_hmac_starts(&transform->md_ctx_enc, mac_enc, mac_key_len);
9220 if (ret != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01009221 goto end;
Gilles Peskine449bd832023-01-11 14:50:10 +01009222 }
9223 ret = mbedtls_md_hmac_starts(&transform->md_ctx_dec, mac_dec, mac_key_len);
9224 if (ret != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01009225 goto end;
Gilles Peskine449bd832023-01-11 14:50:10 +01009226 }
Neil Armstrong29c0c042022-03-17 17:47:28 +01009227#endif /* MBEDTLS_USE_PSA_CRYPTO */
9228 }
9229#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
9230
9231 ((void) mac_dec);
9232 ((void) mac_enc);
9233
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009234end:
Gilles Peskine449bd832023-01-11 14:50:10 +01009235 mbedtls_platform_zeroize(keyblk, sizeof(keyblk));
9236 return ret;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08009237}
9238
Valerio Settia08b1a42022-11-17 15:10:02 +01009239#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
9240 defined(MBEDTLS_USE_PSA_CRYPTO)
Valerio Setti6b3dab02022-11-17 17:14:54 +01009241int mbedtls_psa_ecjpake_read_round(
Gilles Peskine449bd832023-01-11 14:50:10 +01009242 psa_pake_operation_t *pake_ctx,
9243 const unsigned char *buf,
9244 size_t len, mbedtls_ecjpake_rounds_t round)
Valerio Settia08b1a42022-11-17 15:10:02 +01009245{
9246 psa_status_t status;
9247 size_t input_offset = 0;
Valerio Setti819de862022-11-17 18:05:19 +01009248 /*
Valerio Setti6b3dab02022-11-17 17:14:54 +01009249 * At round one repeat the KEY_SHARE, ZK_PUBLIC & ZF_PROOF twice
9250 * At round two perform a single cycle
9251 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009252 unsigned int remaining_steps = (round == MBEDTLS_ECJPAKE_ROUND_ONE) ? 2 : 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01009253
Gilles Peskine449bd832023-01-11 14:50:10 +01009254 for (; remaining_steps > 0; remaining_steps--) {
9255 for (psa_pake_step_t step = PSA_PAKE_STEP_KEY_SHARE;
Valerio Settia08b1a42022-11-17 15:10:02 +01009256 step <= PSA_PAKE_STEP_ZK_PROOF;
Gilles Peskine449bd832023-01-11 14:50:10 +01009257 ++step) {
Valerio Settia08b1a42022-11-17 15:10:02 +01009258 /* Length is stored at the first byte */
9259 size_t length = buf[input_offset];
9260 input_offset += 1;
9261
Gilles Peskine449bd832023-01-11 14:50:10 +01009262 if (input_offset + length > len) {
Valerio Settia08b1a42022-11-17 15:10:02 +01009263 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
9264 }
9265
Gilles Peskine449bd832023-01-11 14:50:10 +01009266 status = psa_pake_input(pake_ctx, step,
9267 buf + input_offset, length);
9268 if (status != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05009269 return PSA_TO_MBEDTLS_ERR(status);
Valerio Settia08b1a42022-11-17 15:10:02 +01009270 }
9271
9272 input_offset += length;
9273 }
9274 }
9275
Gilles Peskine449bd832023-01-11 14:50:10 +01009276 if (input_offset != len) {
Valerio Setti61ea17d2022-11-18 12:11:00 +01009277 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01009278 }
Valerio Setti30ebe112022-11-17 16:23:34 +01009279
Gilles Peskine449bd832023-01-11 14:50:10 +01009280 return 0;
Valerio Settia08b1a42022-11-17 15:10:02 +01009281}
9282
Valerio Setti6b3dab02022-11-17 17:14:54 +01009283int mbedtls_psa_ecjpake_write_round(
Gilles Peskine449bd832023-01-11 14:50:10 +01009284 psa_pake_operation_t *pake_ctx,
9285 unsigned char *buf,
9286 size_t len, size_t *olen,
9287 mbedtls_ecjpake_rounds_t round)
Valerio Settia08b1a42022-11-17 15:10:02 +01009288{
9289 psa_status_t status;
9290 size_t output_offset = 0;
9291 size_t output_len;
Valerio Setti819de862022-11-17 18:05:19 +01009292 /*
Valerio Setti6b3dab02022-11-17 17:14:54 +01009293 * At round one repeat the KEY_SHARE, ZK_PUBLIC & ZF_PROOF twice
9294 * At round two perform a single cycle
9295 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009296 unsigned int remaining_steps = (round == MBEDTLS_ECJPAKE_ROUND_ONE) ? 2 : 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01009297
Gilles Peskine449bd832023-01-11 14:50:10 +01009298 for (; remaining_steps > 0; remaining_steps--) {
9299 for (psa_pake_step_t step = PSA_PAKE_STEP_KEY_SHARE;
9300 step <= PSA_PAKE_STEP_ZK_PROOF;
9301 ++step) {
Valerio Setti79f6b6b2022-11-21 14:17:03 +01009302 /*
Valerio Settid4a9b1a2022-11-22 11:11:10 +01009303 * For each step, prepend 1 byte with the length of the data as
9304 * given by psa_pake_output().
Valerio Setti79f6b6b2022-11-21 14:17:03 +01009305 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009306 status = psa_pake_output(pake_ctx, step,
9307 buf + output_offset + 1,
9308 len - output_offset - 1,
9309 &output_len);
9310 if (status != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05009311 return PSA_TO_MBEDTLS_ERR(status);
Valerio Settia08b1a42022-11-17 15:10:02 +01009312 }
9313
Valerio Setti99d88c12022-11-22 16:03:43 +01009314 *(buf + output_offset) = (uint8_t) output_len;
Valerio Setti79f6b6b2022-11-21 14:17:03 +01009315
9316 output_offset += output_len + 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01009317 }
9318 }
9319
9320 *olen = output_offset;
9321
Gilles Peskine449bd832023-01-11 14:50:10 +01009322 return 0;
Valerio Settia08b1a42022-11-17 15:10:02 +01009323}
Valerio Settia08b1a42022-11-17 15:10:02 +01009324#endif //MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED && MBEDTLS_USE_PSA_CRYPTO
9325
Jerry Yuee40f9d2022-02-17 14:55:16 +08009326#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01009327int mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context *ssl,
9328 unsigned char *hash, size_t *hashlen,
9329 unsigned char *data, size_t data_len,
9330 mbedtls_md_type_t md_alg)
Jerry Yuee40f9d2022-02-17 14:55:16 +08009331{
9332 psa_status_t status;
9333 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02009334 psa_algorithm_t hash_alg = mbedtls_md_psa_alg_from_type(md_alg);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009335
Gilles Peskine449bd832023-01-11 14:50:10 +01009336 MBEDTLS_SSL_DEBUG_MSG(3, ("Perform PSA-based computation of digest of ServerKeyExchange"));
Jerry Yuee40f9d2022-02-17 14:55:16 +08009337
Gilles Peskine449bd832023-01-11 14:50:10 +01009338 if ((status = psa_hash_setup(&hash_operation,
9339 hash_alg)) != PSA_SUCCESS) {
9340 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_setup", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009341 goto exit;
9342 }
9343
Gilles Peskine449bd832023-01-11 14:50:10 +01009344 if ((status = psa_hash_update(&hash_operation, ssl->handshake->randbytes,
9345 64)) != PSA_SUCCESS) {
9346 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_update", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009347 goto exit;
9348 }
9349
Gilles Peskine449bd832023-01-11 14:50:10 +01009350 if ((status = psa_hash_update(&hash_operation,
9351 data, data_len)) != PSA_SUCCESS) {
9352 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_update", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009353 goto exit;
9354 }
9355
Gilles Peskine449bd832023-01-11 14:50:10 +01009356 if ((status = psa_hash_finish(&hash_operation, hash, PSA_HASH_MAX_SIZE,
9357 hashlen)) != PSA_SUCCESS) {
9358 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_finish", status);
9359 goto exit;
Jerry Yuee40f9d2022-02-17 14:55:16 +08009360 }
9361
9362exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01009363 if (status != PSA_SUCCESS) {
9364 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
9365 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
9366 switch (status) {
Jerry Yuee40f9d2022-02-17 14:55:16 +08009367 case PSA_ERROR_NOT_SUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +01009368 return MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE;
Jerry Yuee40f9d2022-02-17 14:55:16 +08009369 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
9370 case PSA_ERROR_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +01009371 return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
Jerry Yuee40f9d2022-02-17 14:55:16 +08009372 case PSA_ERROR_INSUFFICIENT_MEMORY:
Gilles Peskine449bd832023-01-11 14:50:10 +01009373 return MBEDTLS_ERR_MD_ALLOC_FAILED;
Jerry Yuee40f9d2022-02-17 14:55:16 +08009374 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01009375 return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
Jerry Yuee40f9d2022-02-17 14:55:16 +08009376 }
9377 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009378 return 0;
Jerry Yuee40f9d2022-02-17 14:55:16 +08009379}
9380
9381#else
9382
Gilles Peskine449bd832023-01-11 14:50:10 +01009383int mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context *ssl,
9384 unsigned char *hash, size_t *hashlen,
9385 unsigned char *data, size_t data_len,
9386 mbedtls_md_type_t md_alg)
Jerry Yuee40f9d2022-02-17 14:55:16 +08009387{
9388 int ret = 0;
9389 mbedtls_md_context_t ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01009390 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_alg);
9391 *hashlen = mbedtls_md_get_size(md_info);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009392
Gilles Peskine449bd832023-01-11 14:50:10 +01009393 MBEDTLS_SSL_DEBUG_MSG(3, ("Perform mbedtls-based computation of digest of ServerKeyExchange"));
Jerry Yuee40f9d2022-02-17 14:55:16 +08009394
Gilles Peskine449bd832023-01-11 14:50:10 +01009395 mbedtls_md_init(&ctx);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009396
9397 /*
9398 * digitally-signed struct {
9399 * opaque client_random[32];
9400 * opaque server_random[32];
9401 * ServerDHParams params;
9402 * };
9403 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009404 if ((ret = mbedtls_md_setup(&ctx, md_info, 0)) != 0) {
9405 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_setup", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009406 goto exit;
9407 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009408 if ((ret = mbedtls_md_starts(&ctx)) != 0) {
9409 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_starts", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009410 goto exit;
9411 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009412 if ((ret = mbedtls_md_update(&ctx, ssl->handshake->randbytes, 64)) != 0) {
9413 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_update", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009414 goto exit;
9415 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009416 if ((ret = mbedtls_md_update(&ctx, data, data_len)) != 0) {
9417 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_update", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009418 goto exit;
9419 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009420 if ((ret = mbedtls_md_finish(&ctx, hash)) != 0) {
9421 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_finish", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009422 goto exit;
9423 }
9424
9425exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01009426 mbedtls_md_free(&ctx);
Jerry Yuee40f9d2022-02-17 14:55:16 +08009427
Gilles Peskine449bd832023-01-11 14:50:10 +01009428 if (ret != 0) {
9429 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
9430 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
9431 }
Jerry Yuee40f9d2022-02-17 14:55:16 +08009432
Gilles Peskine449bd832023-01-11 14:50:10 +01009433 return ret;
Jerry Yuee40f9d2022-02-17 14:55:16 +08009434}
9435#endif /* MBEDTLS_USE_PSA_CRYPTO */
9436
Jerry Yud9d91da2022-02-17 14:57:06 +08009437#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
9438
Gabor Mezeia3d016c2022-05-10 12:44:09 +02009439/* Find the preferred hash for a given signature algorithm. */
9440unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01009441 mbedtls_ssl_context *ssl,
9442 unsigned int sig_alg)
Jerry Yud9d91da2022-02-17 14:57:06 +08009443{
Gabor Mezei078e8032022-04-27 21:17:56 +02009444 unsigned int i;
Gabor Mezeia3d016c2022-05-10 12:44:09 +02009445 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
Gabor Mezei078e8032022-04-27 21:17:56 +02009446
Gilles Peskine449bd832023-01-11 14:50:10 +01009447 if (sig_alg == MBEDTLS_SSL_SIG_ANON) {
9448 return MBEDTLS_SSL_HASH_NONE;
9449 }
Gabor Mezei078e8032022-04-27 21:17:56 +02009450
Gilles Peskine449bd832023-01-11 14:50:10 +01009451 for (i = 0; received_sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009452 unsigned int hash_alg_received =
Gilles Peskine449bd832023-01-11 14:50:10 +01009453 MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(
9454 received_sig_algs[i]);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009455 unsigned int sig_alg_received =
Gilles Peskine449bd832023-01-11 14:50:10 +01009456 MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(
9457 received_sig_algs[i]);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009458
Manuel Pégourié-Gonnard47bb3802023-06-05 12:40:32 +02009459 mbedtls_md_type_t md_alg =
9460 mbedtls_ssl_md_alg_from_hash((unsigned char) hash_alg_received);
9461 if (md_alg == MBEDTLS_MD_NONE) {
9462 continue;
9463 }
9464
Gilles Peskine449bd832023-01-11 14:50:10 +01009465 if (sig_alg == sig_alg_received) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009466#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01009467 if (ssl->handshake->key_cert && ssl->handshake->key_cert->key) {
Neil Armstrong96eceb82022-06-30 18:05:05 +02009468 psa_algorithm_t psa_hash_alg =
Manuel Pégourié-Gonnard47bb3802023-06-05 12:40:32 +02009469 mbedtls_md_psa_alg_from_type(md_alg);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009470
Gilles Peskine449bd832023-01-11 14:50:10 +01009471 if (sig_alg_received == MBEDTLS_SSL_SIG_ECDSA &&
9472 !mbedtls_pk_can_do_ext(ssl->handshake->key_cert->key,
9473 PSA_ALG_ECDSA(psa_hash_alg),
9474 PSA_KEY_USAGE_SIGN_HASH)) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009475 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01009476 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009477
Gilles Peskine449bd832023-01-11 14:50:10 +01009478 if (sig_alg_received == MBEDTLS_SSL_SIG_RSA &&
9479 !mbedtls_pk_can_do_ext(ssl->handshake->key_cert->key,
9480 PSA_ALG_RSA_PKCS1V15_SIGN(
9481 psa_hash_alg),
9482 PSA_KEY_USAGE_SIGN_HASH)) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009483 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01009484 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009485 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009486#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong96eceb82022-06-30 18:05:05 +02009487
Gilles Peskine449bd832023-01-11 14:50:10 +01009488 return hash_alg_received;
Neil Armstrong9f1176a2022-06-24 18:19:19 +02009489 }
Jerry Yud9d91da2022-02-17 14:57:06 +08009490 }
Jerry Yud9d91da2022-02-17 14:57:06 +08009491
Gilles Peskine449bd832023-01-11 14:50:10 +01009492 return MBEDTLS_SSL_HASH_NONE;
Jerry Yud9d91da2022-02-17 14:57:06 +08009493}
9494
9495#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
9496
Jerry Yudc7bd172022-02-17 13:44:15 +08009497#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9498
XiaokangQian75d40ef2022-04-20 11:05:24 +00009499int mbedtls_ssl_validate_ciphersuite(
9500 const mbedtls_ssl_context *ssl,
9501 const mbedtls_ssl_ciphersuite_t *suite_info,
9502 mbedtls_ssl_protocol_version min_tls_version,
Gilles Peskine449bd832023-01-11 14:50:10 +01009503 mbedtls_ssl_protocol_version max_tls_version)
XiaokangQian75d40ef2022-04-20 11:05:24 +00009504{
9505 (void) ssl;
9506
Gilles Peskine449bd832023-01-11 14:50:10 +01009507 if (suite_info == NULL) {
9508 return -1;
9509 }
XiaokangQian75d40ef2022-04-20 11:05:24 +00009510
Gilles Peskine449bd832023-01-11 14:50:10 +01009511 if ((suite_info->min_tls_version > max_tls_version) ||
9512 (suite_info->max_tls_version < min_tls_version)) {
9513 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009514 }
9515
XiaokangQian060d8672022-04-21 09:24:56 +00009516#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_CLI_C)
XiaokangQian75d40ef2022-04-20 11:05:24 +00009517#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009518#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01009519 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
9520 ssl->handshake->psa_pake_ctx_is_ok != 1)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009521#else
Gilles Peskine449bd832023-01-11 14:50:10 +01009522 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
9523 mbedtls_ecjpake_check(&ssl->handshake->ecjpake_ctx) != 0)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009524#endif /* MBEDTLS_USE_PSA_CRYPTO */
XiaokangQian75d40ef2022-04-20 11:05:24 +00009525 {
Gilles Peskine449bd832023-01-11 14:50:10 +01009526 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009527 }
9528#endif
9529
9530 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
9531#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01009532 if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) &&
9533 mbedtls_ssl_conf_has_static_psk(ssl->conf) == 0) {
9534 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009535 }
9536#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
9537#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9538
Gilles Peskine449bd832023-01-11 14:50:10 +01009539 return 0;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009540}
9541
Ronald Crone68ab4f2022-10-05 12:46:29 +02009542#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
XiaokangQianeaf36512022-04-24 09:07:44 +00009543/*
9544 * Function for writing a signature algorithm extension.
9545 *
9546 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
9547 * value (TLS 1.3 RFC8446):
9548 * enum {
9549 * ....
9550 * ecdsa_secp256r1_sha256( 0x0403 ),
9551 * ecdsa_secp384r1_sha384( 0x0503 ),
9552 * ecdsa_secp521r1_sha512( 0x0603 ),
9553 * ....
9554 * } SignatureScheme;
9555 *
9556 * struct {
9557 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
9558 * } SignatureSchemeList;
9559 *
9560 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
9561 * value (TLS 1.2 RFC5246):
9562 * enum {
9563 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
9564 * sha512(6), (255)
9565 * } HashAlgorithm;
9566 *
9567 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
9568 * SignatureAlgorithm;
9569 *
9570 * struct {
9571 * HashAlgorithm hash;
9572 * SignatureAlgorithm signature;
9573 * } SignatureAndHashAlgorithm;
9574 *
9575 * SignatureAndHashAlgorithm
9576 * supported_signature_algorithms<2..2^16-2>;
9577 *
9578 * The TLS 1.3 signature algorithm extension was defined to be a compatible
9579 * generalization of the TLS 1.2 signature algorithm extension.
9580 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
9581 * `SignatureScheme` field of TLS 1.3
9582 *
9583 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009584int mbedtls_ssl_write_sig_alg_ext(mbedtls_ssl_context *ssl, unsigned char *buf,
9585 const unsigned char *end, size_t *out_len)
XiaokangQianeaf36512022-04-24 09:07:44 +00009586{
9587 unsigned char *p = buf;
9588 unsigned char *supported_sig_alg; /* Start of supported_signature_algorithms */
9589 size_t supported_sig_alg_len = 0; /* Length of supported_signature_algorithms */
9590
9591 *out_len = 0;
9592
Gilles Peskine449bd832023-01-11 14:50:10 +01009593 MBEDTLS_SSL_DEBUG_MSG(3, ("adding signature_algorithms extension"));
XiaokangQianeaf36512022-04-24 09:07:44 +00009594
9595 /* Check if we have space for header and length field:
9596 * - extension_type (2 bytes)
9597 * - extension_data_length (2 bytes)
9598 * - supported_signature_algorithms_length (2 bytes)
9599 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009600 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
XiaokangQianeaf36512022-04-24 09:07:44 +00009601 p += 6;
9602
9603 /*
9604 * Write supported_signature_algorithms
9605 */
9606 supported_sig_alg = p;
Gilles Peskine449bd832023-01-11 14:50:10 +01009607 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl);
9608 if (sig_alg == NULL) {
9609 return MBEDTLS_ERR_SSL_BAD_CONFIG;
9610 }
XiaokangQianeaf36512022-04-24 09:07:44 +00009611
Gilles Peskine449bd832023-01-11 14:50:10 +01009612 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
9613 MBEDTLS_SSL_DEBUG_MSG(3, ("got signature scheme [%x] %s",
9614 *sig_alg,
9615 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
9616 if (!mbedtls_ssl_sig_alg_is_supported(ssl, *sig_alg)) {
XiaokangQianeaf36512022-04-24 09:07:44 +00009617 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01009618 }
9619 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
9620 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, 0);
XiaokangQianeaf36512022-04-24 09:07:44 +00009621 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01009622 MBEDTLS_SSL_DEBUG_MSG(3, ("sent signature scheme [%x] %s",
9623 *sig_alg,
9624 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
XiaokangQianeaf36512022-04-24 09:07:44 +00009625 }
9626
9627 /* Length of supported_signature_algorithms */
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00009628 supported_sig_alg_len = (size_t) (p - supported_sig_alg);
Gilles Peskine449bd832023-01-11 14:50:10 +01009629 if (supported_sig_alg_len == 0) {
9630 MBEDTLS_SSL_DEBUG_MSG(1, ("No signature algorithms defined."));
9631 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
XiaokangQianeaf36512022-04-24 09:07:44 +00009632 }
9633
Gilles Peskine449bd832023-01-11 14:50:10 +01009634 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SIG_ALG, buf, 0);
9635 MBEDTLS_PUT_UINT16_BE(supported_sig_alg_len + 2, buf, 2);
9636 MBEDTLS_PUT_UINT16_BE(supported_sig_alg_len, buf, 4);
XiaokangQianeaf36512022-04-24 09:07:44 +00009637
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00009638 *out_len = (size_t) (p - buf);
XiaokangQianeaf36512022-04-24 09:07:44 +00009639
9640#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01009641 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_SIG_ALG);
XiaokangQianeaf36512022-04-24 09:07:44 +00009642#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu0c354a22022-08-29 15:25:36 +08009643
Gilles Peskine449bd832023-01-11 14:50:10 +01009644 return 0;
XiaokangQianeaf36512022-04-24 09:07:44 +00009645}
Ronald Crone68ab4f2022-10-05 12:46:29 +02009646#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
XiaokangQianeaf36512022-04-24 09:07:44 +00009647
XiaokangQian40a35232022-05-07 09:02:40 +00009648#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
XiaokangQian9b2b7712022-05-17 02:57:00 +00009649/*
9650 * mbedtls_ssl_parse_server_name_ext
9651 *
9652 * Structure of server_name extension:
9653 *
9654 * enum {
9655 * host_name(0), (255)
9656 * } NameType;
9657 * opaque HostName<1..2^16-1>;
9658 *
9659 * struct {
9660 * NameType name_type;
9661 * select (name_type) {
9662 * case host_name: HostName;
9663 * } name;
9664 * } ServerName;
9665 * struct {
9666 * ServerName server_name_list<1..2^16-1>
9667 * } ServerNameList;
9668 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02009669MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01009670int mbedtls_ssl_parse_server_name_ext(mbedtls_ssl_context *ssl,
9671 const unsigned char *buf,
9672 const unsigned char *end)
XiaokangQian40a35232022-05-07 09:02:40 +00009673{
9674 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
9675 const unsigned char *p = buf;
XiaokangQian9b2b7712022-05-17 02:57:00 +00009676 size_t server_name_list_len, hostname_len;
9677 const unsigned char *server_name_list_end;
XiaokangQian40a35232022-05-07 09:02:40 +00009678
Gilles Peskine449bd832023-01-11 14:50:10 +01009679 MBEDTLS_SSL_DEBUG_MSG(3, ("parse ServerName extension"));
XiaokangQian40a35232022-05-07 09:02:40 +00009680
Gilles Peskine449bd832023-01-11 14:50:10 +01009681 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
9682 server_name_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian40a35232022-05-07 09:02:40 +00009683 p += 2;
9684
Gilles Peskine449bd832023-01-11 14:50:10 +01009685 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, server_name_list_len);
XiaokangQian9b2b7712022-05-17 02:57:00 +00009686 server_name_list_end = p + server_name_list_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009687 while (p < server_name_list_end) {
9688 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, server_name_list_end, 3);
9689 hostname_len = MBEDTLS_GET_UINT16_BE(p, 1);
9690 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, server_name_list_end,
9691 hostname_len + 3);
XiaokangQian40a35232022-05-07 09:02:40 +00009692
Gilles Peskine449bd832023-01-11 14:50:10 +01009693 if (p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME) {
XiaokangQian75fe8c72022-06-15 09:42:45 +00009694 /* sni_name is intended to be used only during the parsing of the
9695 * ClientHello message (it is reset to NULL before the end of
9696 * the message parsing). Thus it is ok to just point to the
9697 * reception buffer and not make a copy of it.
9698 */
XiaokangQianf2a94202022-05-20 06:44:24 +00009699 ssl->handshake->sni_name = p + 3;
9700 ssl->handshake->sni_name_len = hostname_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009701 if (ssl->conf->f_sni == NULL) {
9702 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009703 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009704 ret = ssl->conf->f_sni(ssl->conf->p_sni,
9705 ssl, p + 3, hostname_len);
9706 if (ret != 0) {
9707 MBEDTLS_SSL_DEBUG_RET(1, "ssl_sni_wrapper", ret);
9708 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME,
9709 MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME);
9710 return MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME;
9711 }
9712 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009713 }
9714
9715 p += hostname_len + 3;
9716 }
9717
Gilles Peskine449bd832023-01-11 14:50:10 +01009718 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009719}
9720#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9721
XiaokangQianacb39922022-06-17 10:18:48 +00009722#if defined(MBEDTLS_SSL_ALPN)
Ronald Cronce7d76e2022-07-08 18:56:49 +02009723MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01009724int mbedtls_ssl_parse_alpn_ext(mbedtls_ssl_context *ssl,
9725 const unsigned char *buf,
9726 const unsigned char *end)
XiaokangQianacb39922022-06-17 10:18:48 +00009727{
9728 const unsigned char *p = buf;
XiaokangQianc7403452022-06-23 03:24:12 +00009729 size_t protocol_name_list_len;
XiaokangQian95d5f542022-06-24 02:29:26 +00009730 const unsigned char *protocol_name_list;
9731 const unsigned char *protocol_name_list_end;
XiaokangQianc7403452022-06-23 03:24:12 +00009732 size_t protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009733
9734 /* If ALPN not configured, just ignore the extension */
Gilles Peskine449bd832023-01-11 14:50:10 +01009735 if (ssl->conf->alpn_list == NULL) {
9736 return 0;
9737 }
XiaokangQianacb39922022-06-17 10:18:48 +00009738
9739 /*
XiaokangQianc7403452022-06-23 03:24:12 +00009740 * RFC7301, section 3.1
9741 * opaque ProtocolName<1..2^8-1>;
XiaokangQianacb39922022-06-17 10:18:48 +00009742 *
XiaokangQianc7403452022-06-23 03:24:12 +00009743 * struct {
9744 * ProtocolName protocol_name_list<2..2^16-1>
9745 * } ProtocolNameList;
XiaokangQianacb39922022-06-17 10:18:48 +00009746 */
9747
XiaokangQianc7403452022-06-23 03:24:12 +00009748 /*
XiaokangQian0b776e22022-06-24 09:04:59 +00009749 * protocol_name_list_len 2 bytes
9750 * protocol_name_len 1 bytes
9751 * protocol_name >=1 byte
XiaokangQianc7403452022-06-23 03:24:12 +00009752 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009753 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 4);
XiaokangQianacb39922022-06-17 10:18:48 +00009754
Gilles Peskine449bd832023-01-11 14:50:10 +01009755 protocol_name_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQianacb39922022-06-17 10:18:48 +00009756 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01009757 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, protocol_name_list_len);
XiaokangQian95d5f542022-06-24 02:29:26 +00009758 protocol_name_list = p;
9759 protocol_name_list_end = p + protocol_name_list_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009760
9761 /* Validate peer's list (lengths) */
Gilles Peskine449bd832023-01-11 14:50:10 +01009762 while (p < protocol_name_list_end) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009763 protocol_name_len = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +01009764 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, protocol_name_list_end,
9765 protocol_name_len);
9766 if (protocol_name_len == 0) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009767 MBEDTLS_SSL_PEND_FATAL_ALERT(
9768 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01009769 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
9770 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
XiaokangQian95d5f542022-06-24 02:29:26 +00009771 }
9772
9773 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009774 }
9775
9776 /* Use our order of preference */
Gilles Peskine449bd832023-01-11 14:50:10 +01009777 for (const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++) {
9778 size_t const alpn_len = strlen(*alpn);
XiaokangQian95d5f542022-06-24 02:29:26 +00009779 p = protocol_name_list;
Gilles Peskine449bd832023-01-11 14:50:10 +01009780 while (p < protocol_name_list_end) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009781 protocol_name_len = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +01009782 if (protocol_name_len == alpn_len &&
9783 memcmp(p, *alpn, alpn_len) == 0) {
XiaokangQianacb39922022-06-17 10:18:48 +00009784 ssl->alpn_chosen = *alpn;
Gilles Peskine449bd832023-01-11 14:50:10 +01009785 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009786 }
XiaokangQian95d5f542022-06-24 02:29:26 +00009787
9788 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009789 }
9790 }
9791
XiaokangQian95d5f542022-06-24 02:29:26 +00009792 /* If we get here, no match was found */
XiaokangQianacb39922022-06-17 10:18:48 +00009793 MBEDTLS_SSL_PEND_FATAL_ALERT(
Gilles Peskine449bd832023-01-11 14:50:10 +01009794 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL,
9795 MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL);
9796 return MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL;
XiaokangQianacb39922022-06-17 10:18:48 +00009797}
9798
Gilles Peskine449bd832023-01-11 14:50:10 +01009799int mbedtls_ssl_write_alpn_ext(mbedtls_ssl_context *ssl,
9800 unsigned char *buf,
9801 unsigned char *end,
9802 size_t *out_len)
XiaokangQianacb39922022-06-17 10:18:48 +00009803{
9804 unsigned char *p = buf;
XiaokangQian95d5f542022-06-24 02:29:26 +00009805 size_t protocol_name_len;
XiaokangQianc7403452022-06-23 03:24:12 +00009806 *out_len = 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009807
Gilles Peskine449bd832023-01-11 14:50:10 +01009808 if (ssl->alpn_chosen == NULL) {
9809 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009810 }
9811
Gilles Peskine449bd832023-01-11 14:50:10 +01009812 protocol_name_len = strlen(ssl->alpn_chosen);
9813 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 7 + protocol_name_len);
XiaokangQianacb39922022-06-17 10:18:48 +00009814
Gilles Peskine449bd832023-01-11 14:50:10 +01009815 MBEDTLS_SSL_DEBUG_MSG(3, ("server side, adding alpn extension"));
XiaokangQianacb39922022-06-17 10:18:48 +00009816 /*
9817 * 0 . 1 ext identifier
9818 * 2 . 3 ext length
9819 * 4 . 5 protocol list length
9820 * 6 . 6 protocol name length
9821 * 7 . 7+n protocol name
9822 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009823 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ALPN, p, 0);
XiaokangQianacb39922022-06-17 10:18:48 +00009824
XiaokangQian95d5f542022-06-24 02:29:26 +00009825 *out_len = 7 + protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009826
Gilles Peskine449bd832023-01-11 14:50:10 +01009827 MBEDTLS_PUT_UINT16_BE(protocol_name_len + 3, p, 2);
9828 MBEDTLS_PUT_UINT16_BE(protocol_name_len + 1, p, 4);
XiaokangQian0b776e22022-06-24 09:04:59 +00009829 /* Note: the length of the chosen protocol has been checked to be less
9830 * than 255 bytes in `mbedtls_ssl_conf_alpn_protocols`.
9831 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009832 p[6] = MBEDTLS_BYTE_0(protocol_name_len);
XiaokangQianacb39922022-06-17 10:18:48 +00009833
Gilles Peskine449bd832023-01-11 14:50:10 +01009834 memcpy(p + 7, ssl->alpn_chosen, protocol_name_len);
Jerry Yub95dd362022-11-08 21:19:34 +08009835
9836#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01009837 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_ALPN);
Jerry Yub95dd362022-11-08 21:19:34 +08009838#endif
9839
Gilles Peskine449bd832023-01-11 14:50:10 +01009840 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009841}
9842#endif /* MBEDTLS_SSL_ALPN */
9843
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009844#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
Xiaokang Qian03409292022-10-12 02:49:52 +00009845 defined(MBEDTLS_SSL_SESSION_TICKETS) && \
Xiaokang Qianed0620c2022-10-12 06:58:13 +00009846 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00009847 defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01009848int mbedtls_ssl_session_set_hostname(mbedtls_ssl_session *session,
9849 const char *hostname)
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009850{
9851 /* Initialize to suppress unnecessary compiler warning */
9852 size_t hostname_len = 0;
9853
9854 /* Check if new hostname is valid before
9855 * making any change to current one */
Gilles Peskine449bd832023-01-11 14:50:10 +01009856 if (hostname != NULL) {
9857 hostname_len = strlen(hostname);
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009858
Gilles Peskine449bd832023-01-11 14:50:10 +01009859 if (hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN) {
9860 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9861 }
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009862 }
9863
9864 /* Now it's clear that we will overwrite the old hostname,
9865 * so we can free it safely */
Gilles Peskine449bd832023-01-11 14:50:10 +01009866 if (session->hostname != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01009867 mbedtls_zeroize_and_free(session->hostname,
Gilles Peskine449bd832023-01-11 14:50:10 +01009868 strlen(session->hostname));
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009869 }
9870
9871 /* Passing NULL as hostname shall clear the old one */
Gilles Peskine449bd832023-01-11 14:50:10 +01009872 if (hostname == NULL) {
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009873 session->hostname = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01009874 } else {
9875 session->hostname = mbedtls_calloc(1, hostname_len + 1);
9876 if (session->hostname == NULL) {
9877 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9878 }
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009879
Gilles Peskine449bd832023-01-11 14:50:10 +01009880 memcpy(session->hostname, hostname, hostname_len);
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009881 }
9882
Gilles Peskine449bd832023-01-11 14:50:10 +01009883 return 0;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009884}
Xiaokang Qian03409292022-10-12 02:49:52 +00009885#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
9886 MBEDTLS_SSL_SESSION_TICKETS &&
Xiaokang Qianed0620c2022-10-12 06:58:13 +00009887 MBEDTLS_SSL_SERVER_NAME_INDICATION &&
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00009888 MBEDTLS_SSL_CLI_C */
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009889
Waleed Elmelegy883f77c2024-03-06 19:09:41 +00009890#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_EARLY_DATA) && \
9891 defined(MBEDTLS_SSL_ALPN)
Waleed Elmelegy7dfba342024-03-12 16:22:39 +00009892int mbedtls_ssl_session_set_ticket_alpn(mbedtls_ssl_session *session,
9893 const char *alpn)
Waleed Elmelegy883f77c2024-03-06 19:09:41 +00009894{
9895 size_t alpn_len = 0;
9896
9897 if (alpn != NULL) {
9898 alpn_len = strlen(alpn);
9899
9900 if (alpn_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN) {
9901 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9902 }
9903 }
9904
9905 if (session->ticket_alpn != NULL) {
9906 mbedtls_zeroize_and_free(session->ticket_alpn,
9907 strlen(session->ticket_alpn));
Waleed Elmelegy7dfba342024-03-12 16:22:39 +00009908 session->ticket_alpn = NULL;
Waleed Elmelegy883f77c2024-03-06 19:09:41 +00009909 }
9910
Waleed Elmelegy7dfba342024-03-12 16:22:39 +00009911 if (alpn != NULL) {
9912 session->ticket_alpn = mbedtls_calloc(alpn_len + 1, 1);
Waleed Elmelegy883f77c2024-03-06 19:09:41 +00009913 if (session->ticket_alpn == NULL) {
9914 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9915 }
Waleed Elmelegy7dfba342024-03-12 16:22:39 +00009916 memcpy(session->ticket_alpn, alpn, alpn_len);
Waleed Elmelegy883f77c2024-03-06 19:09:41 +00009917 }
9918
9919 return 0;
9920}
9921#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_EARLY_DATA && MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009922#endif /* MBEDTLS_SSL_TLS_C */