1 /*
2 * TLS shared functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19 /*
20 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
24 #include "common.h"
25
26 #if defined(MBEDTLS_SSL_TLS_C)
27
28 #if defined(MBEDTLS_PLATFORM_C)
29 #include "mbedtls/platform.h"
30 #else
31 #include <stdlib.h>
32 #define mbedtls_calloc calloc
33 #define mbedtls_free free
34 #endif
35
36 #include "mbedtls/ssl.h"
37 #include "ssl_misc.h"
38 #include "mbedtls/debug.h"
39 #include "mbedtls/error.h"
40 #include "mbedtls/platform_util.h"
41 #include "mbedtls/version.h"
42 #include "mbedtls/constant_time.h"
43
44 #include <string.h>
45
46 #if defined(MBEDTLS_USE_PSA_CRYPTO)
47 #include "mbedtls/psa_util.h"
48 #include "psa/crypto.h"
49 #endif
50
51 #if defined(MBEDTLS_X509_CRT_PARSE_C)
52 #include "mbedtls/oid.h"
53 #endif
54
55 #if defined(MBEDTLS_SSL_PROTO_DTLS)
56
57 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
58 /* Top-level Connection ID API */
59
mbedtls_ssl_conf_cid(mbedtls_ssl_config * conf,size_t len,int ignore_other_cid)60 int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
61 size_t len,
62 int ignore_other_cid )
63 {
64 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
65 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
66
67 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
68 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
69 {
70 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
71 }
72
73 conf->ignore_unexpected_cid = ignore_other_cid;
74 conf->cid_len = len;
75 return( 0 );
76 }
77
mbedtls_ssl_set_cid(mbedtls_ssl_context * ssl,int enable,unsigned char const * own_cid,size_t own_cid_len)78 int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
79 int enable,
80 unsigned char const *own_cid,
81 size_t own_cid_len )
82 {
83 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
84 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
85
86 ssl->negotiate_cid = enable;
87 if( enable == MBEDTLS_SSL_CID_DISABLED )
88 {
89 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
90 return( 0 );
91 }
92 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
93 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
94
95 if( own_cid_len != ssl->conf->cid_len )
96 {
97 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
98 (unsigned) own_cid_len,
99 (unsigned) ssl->conf->cid_len ) );
100 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
101 }
102
103 memcpy( ssl->own_cid, own_cid, own_cid_len );
104 /* Truncation is not an issue here because
105 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
106 ssl->own_cid_len = (uint8_t) own_cid_len;
107
108 return( 0 );
109 }
110
mbedtls_ssl_get_peer_cid(mbedtls_ssl_context * ssl,int * enabled,unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],size_t * peer_cid_len)111 int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
112 int *enabled,
113 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
114 size_t *peer_cid_len )
115 {
116 *enabled = MBEDTLS_SSL_CID_DISABLED;
117
118 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
119 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
120 {
121 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
122 }
123
124 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
125 * were used, but client and server requested the empty CID.
126 * This is indistinguishable from not using the CID extension
127 * in the first place. */
128 if( ssl->transform_in->in_cid_len == 0 &&
129 ssl->transform_in->out_cid_len == 0 )
130 {
131 return( 0 );
132 }
133
134 if( peer_cid_len != NULL )
135 {
136 *peer_cid_len = ssl->transform_in->out_cid_len;
137 if( peer_cid != NULL )
138 {
139 memcpy( peer_cid, ssl->transform_in->out_cid,
140 ssl->transform_in->out_cid_len );
141 }
142 }
143
144 *enabled = MBEDTLS_SSL_CID_ENABLED;
145
146 return( 0 );
147 }
148 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
149
150 #endif /* MBEDTLS_SSL_PROTO_DTLS */
151
152 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
153 /*
154 * Convert max_fragment_length codes to length.
155 * RFC 6066 says:
156 * enum{
157 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
158 * } MaxFragmentLength;
159 * and we add 0 -> extension unused
160 */
ssl_mfl_code_to_length(int mfl)161 static unsigned int ssl_mfl_code_to_length( int mfl )
162 {
163 switch( mfl )
164 {
165 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
166 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
167 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
168 return 512;
169 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
170 return 1024;
171 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
172 return 2048;
173 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
174 return 4096;
175 default:
176 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
177 }
178 }
179 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
180
mbedtls_ssl_session_copy(mbedtls_ssl_session * dst,const mbedtls_ssl_session * src)181 int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
182 const mbedtls_ssl_session *src )
183 {
184 mbedtls_ssl_session_free( dst );
185 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
186
187 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
188 dst->ticket = NULL;
189 #endif
190
191 #if defined(MBEDTLS_X509_CRT_PARSE_C)
192
193 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
194 if( src->peer_cert != NULL )
195 {
196 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
197
198 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
199 if( dst->peer_cert == NULL )
200 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
201
202 mbedtls_x509_crt_init( dst->peer_cert );
203
204 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
205 src->peer_cert->raw.len ) ) != 0 )
206 {
207 mbedtls_free( dst->peer_cert );
208 dst->peer_cert = NULL;
209 return( ret );
210 }
211 }
212 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
213 if( src->peer_cert_digest != NULL )
214 {
215 dst->peer_cert_digest =
216 mbedtls_calloc( 1, src->peer_cert_digest_len );
217 if( dst->peer_cert_digest == NULL )
218 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
219
220 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
221 src->peer_cert_digest_len );
222 dst->peer_cert_digest_type = src->peer_cert_digest_type;
223 dst->peer_cert_digest_len = src->peer_cert_digest_len;
224 }
225 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
226
227 #endif /* MBEDTLS_X509_CRT_PARSE_C */
228
229 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
230 if( src->ticket != NULL )
231 {
232 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
233 if( dst->ticket == NULL )
234 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
235
236 memcpy( dst->ticket, src->ticket, src->ticket_len );
237 }
238 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
239
240 return( 0 );
241 }
242
243 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
resize_buffer(unsigned char ** buffer,size_t len_new,size_t * len_old)244 static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
245 {
246 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
247 if( resized_buffer == NULL )
248 return -1;
249
250 /* We want to copy len_new bytes when downsizing the buffer, and
251 * len_old bytes when upsizing, so we choose the smaller of two sizes,
252 * to fit one buffer into another. Size checks, ensuring that no data is
253 * lost, are done outside of this function. */
254 memcpy( resized_buffer, *buffer,
255 ( len_new < *len_old ) ? len_new : *len_old );
256 mbedtls_platform_zeroize( *buffer, *len_old );
257 mbedtls_free( *buffer );
258
259 *buffer = resized_buffer;
260 *len_old = len_new;
261
262 return 0;
263 }
264
handle_buffer_resizing(mbedtls_ssl_context * ssl,int downsizing,size_t in_buf_new_len,size_t out_buf_new_len)265 static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
266 size_t in_buf_new_len,
267 size_t out_buf_new_len )
268 {
269 int modified = 0;
270 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
271 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
272 if( ssl->in_buf != NULL )
273 {
274 written_in = ssl->in_msg - ssl->in_buf;
275 iv_offset_in = ssl->in_iv - ssl->in_buf;
276 len_offset_in = ssl->in_len - ssl->in_buf;
277 if( downsizing ?
278 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
279 ssl->in_buf_len < in_buf_new_len )
280 {
281 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
282 {
283 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
284 }
285 else
286 {
287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
288 in_buf_new_len ) );
289 modified = 1;
290 }
291 }
292 }
293
294 if( ssl->out_buf != NULL )
295 {
296 written_out = ssl->out_msg - ssl->out_buf;
297 iv_offset_out = ssl->out_iv - ssl->out_buf;
298 len_offset_out = ssl->out_len - ssl->out_buf;
299 if( downsizing ?
300 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
301 ssl->out_buf_len < out_buf_new_len )
302 {
303 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
304 {
305 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
306 }
307 else
308 {
309 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
310 out_buf_new_len ) );
311 modified = 1;
312 }
313 }
314 }
315 if( modified )
316 {
317 /* Update pointers here to avoid doing it twice. */
318 mbedtls_ssl_reset_in_out_pointers( ssl );
319 /* Fields below might not be properly updated with record
320 * splitting or with CID, so they are manually updated here. */
321 ssl->out_msg = ssl->out_buf + written_out;
322 ssl->out_len = ssl->out_buf + len_offset_out;
323 ssl->out_iv = ssl->out_buf + iv_offset_out;
324
325 ssl->in_msg = ssl->in_buf + written_in;
326 ssl->in_len = ssl->in_buf + len_offset_in;
327 ssl->in_iv = ssl->in_buf + iv_offset_in;
328 }
329 }
330 #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
331
332 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
333 #if defined(MBEDTLS_USE_PSA_CRYPTO)
334
setup_psa_key_derivation(psa_key_derivation_operation_t * derivation,psa_key_id_t key,psa_algorithm_t alg,const unsigned char * seed,size_t seed_length,const unsigned char * label,size_t label_length,size_t capacity)335 static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
336 psa_key_id_t key,
337 psa_algorithm_t alg,
338 const unsigned char* seed, size_t seed_length,
339 const unsigned char* label, size_t label_length,
340 size_t capacity )
341 {
342 psa_status_t status;
343
344 status = psa_key_derivation_setup( derivation, alg );
345 if( status != PSA_SUCCESS )
346 return( status );
347
348 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
349 {
350 status = psa_key_derivation_input_bytes( derivation,
351 PSA_KEY_DERIVATION_INPUT_SEED,
352 seed, seed_length );
353 if( status != PSA_SUCCESS )
354 return( status );
355
356 if( mbedtls_svc_key_id_is_null( key ) )
357 {
358 status = psa_key_derivation_input_bytes(
359 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
360 NULL, 0 );
361 }
362 else
363 {
364 status = psa_key_derivation_input_key(
365 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
366 }
367 if( status != PSA_SUCCESS )
368 return( status );
369
370 status = psa_key_derivation_input_bytes( derivation,
371 PSA_KEY_DERIVATION_INPUT_LABEL,
372 label, label_length );
373 if( status != PSA_SUCCESS )
374 return( status );
375 }
376 else
377 {
378 return( PSA_ERROR_NOT_SUPPORTED );
379 }
380
381 status = psa_key_derivation_set_capacity( derivation, capacity );
382 if( status != PSA_SUCCESS )
383 return( status );
384
385 return( PSA_SUCCESS );
386 }
387
tls_prf_generic(mbedtls_md_type_t md_type,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)388 static int tls_prf_generic( mbedtls_md_type_t md_type,
389 const unsigned char *secret, size_t slen,
390 const char *label,
391 const unsigned char *random, size_t rlen,
392 unsigned char *dstbuf, size_t dlen )
393 {
394 psa_status_t status;
395 psa_algorithm_t alg;
396 psa_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
397 psa_key_derivation_operation_t derivation =
398 PSA_KEY_DERIVATION_OPERATION_INIT;
399
400 if( md_type == MBEDTLS_MD_SHA384 )
401 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
402 else
403 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
404
405 /* Normally a "secret" should be long enough to be impossible to
406 * find by brute force, and in particular should not be empty. But
407 * this PRF is also used to derive an IV, in particular in EAP-TLS,
408 * and for this use case it makes sense to have a 0-length "secret".
409 * Since the key API doesn't allow importing a key of length 0,
410 * keep master_key=0, which setup_psa_key_derivation() understands
411 * to mean a 0-length "secret" input. */
412 if( slen != 0 )
413 {
414 psa_key_attributes_t key_attributes = psa_key_attributes_init();
415 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
416 psa_set_key_algorithm( &key_attributes, alg );
417 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
418
419 status = psa_import_key( &key_attributes, secret, slen, &master_key );
420 if( status != PSA_SUCCESS )
421 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
422 }
423
424 status = setup_psa_key_derivation( &derivation,
425 master_key, alg,
426 random, rlen,
427 (unsigned char const *) label,
428 (size_t) strlen( label ),
429 dlen );
430 if( status != PSA_SUCCESS )
431 {
432 psa_key_derivation_abort( &derivation );
433 psa_destroy_key( master_key );
434 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
435 }
436
437 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
438 if( status != PSA_SUCCESS )
439 {
440 psa_key_derivation_abort( &derivation );
441 psa_destroy_key( master_key );
442 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
443 }
444
445 status = psa_key_derivation_abort( &derivation );
446 if( status != PSA_SUCCESS )
447 {
448 psa_destroy_key( master_key );
449 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
450 }
451
452 if( ! mbedtls_svc_key_id_is_null( master_key ) )
453 status = psa_destroy_key( master_key );
454 if( status != PSA_SUCCESS )
455 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
456
457 return( 0 );
458 }
459
460 #else /* MBEDTLS_USE_PSA_CRYPTO */
461
tls_prf_generic(mbedtls_md_type_t md_type,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)462 static int tls_prf_generic( mbedtls_md_type_t md_type,
463 const unsigned char *secret, size_t slen,
464 const char *label,
465 const unsigned char *random, size_t rlen,
466 unsigned char *dstbuf, size_t dlen )
467 {
468 size_t nb;
469 size_t i, j, k, md_len;
470 unsigned char *tmp;
471 size_t tmp_len = 0;
472 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
473 const mbedtls_md_info_t *md_info;
474 mbedtls_md_context_t md_ctx;
475 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
476
477 mbedtls_md_init( &md_ctx );
478
479 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
480 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
481
482 md_len = mbedtls_md_get_size( md_info );
483
484 tmp_len = md_len + strlen( label ) + rlen;
485 tmp = mbedtls_calloc( 1, tmp_len );
486 if( tmp == NULL )
487 {
488 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
489 goto exit;
490 }
491
492 nb = strlen( label );
493 memcpy( tmp + md_len, label, nb );
494 memcpy( tmp + md_len + nb, random, rlen );
495 nb += rlen;
496
497 /*
498 * Compute P_<hash>(secret, label + random)[0..dlen]
499 */
500 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
501 goto exit;
502
503 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
504 if( ret != 0 )
505 goto exit;
506 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
507 if( ret != 0 )
508 goto exit;
509 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
510 if( ret != 0 )
511 goto exit;
512
513 for( i = 0; i < dlen; i += md_len )
514 {
515 ret = mbedtls_md_hmac_reset ( &md_ctx );
516 if( ret != 0 )
517 goto exit;
518 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
519 if( ret != 0 )
520 goto exit;
521 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
522 if( ret != 0 )
523 goto exit;
524
525 ret = mbedtls_md_hmac_reset ( &md_ctx );
526 if( ret != 0 )
527 goto exit;
528 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
529 if( ret != 0 )
530 goto exit;
531 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
532 if( ret != 0 )
533 goto exit;
534
535 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
536
537 for( j = 0; j < k; j++ )
538 dstbuf[i + j] = h_i[j];
539 }
540
541 exit:
542 mbedtls_md_free( &md_ctx );
543
544 mbedtls_platform_zeroize( tmp, tmp_len );
545 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
546
547 mbedtls_free( tmp );
548
549 return( ret );
550 }
551 #endif /* MBEDTLS_USE_PSA_CRYPTO */
552 #if defined(MBEDTLS_SHA256_C)
tls_prf_sha256(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)553 static int tls_prf_sha256( const unsigned char *secret, size_t slen,
554 const char *label,
555 const unsigned char *random, size_t rlen,
556 unsigned char *dstbuf, size_t dlen )
557 {
558 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
559 label, random, rlen, dstbuf, dlen ) );
560 }
561 #endif /* MBEDTLS_SHA256_C */
562
563 #if defined(MBEDTLS_SHA384_C)
tls_prf_sha384(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)564 static int tls_prf_sha384( const unsigned char *secret, size_t slen,
565 const char *label,
566 const unsigned char *random, size_t rlen,
567 unsigned char *dstbuf, size_t dlen )
568 {
569 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
570 label, random, rlen, dstbuf, dlen ) );
571 }
572 #endif /* MBEDTLS_SHA384_C */
573 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
574
575 static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
576
577 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
578 #if defined(MBEDTLS_SHA256_C)
579 static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
580 static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
581 static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
582 #endif
583
584 #if defined(MBEDTLS_SHA384_C)
585 static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
586 static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
587 static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
588 #endif
589 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
590
591 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \
592 defined(MBEDTLS_USE_PSA_CRYPTO)
ssl_use_opaque_psk(mbedtls_ssl_context const * ssl)593 static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
594 {
595 if( ssl->conf->f_psk != NULL )
596 {
597 /* If we've used a callback to select the PSK,
598 * the static configuration is irrelevant. */
599 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
600 return( 1 );
601
602 return( 0 );
603 }
604
605 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
606 return( 1 );
607
608 return( 0 );
609 }
610 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
611 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
612
tls_prf_get_type(mbedtls_ssl_tls_prf_cb * tls_prf)613 static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
614 {
615 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
616 #if defined(MBEDTLS_SHA384_C)
617 if( tls_prf == tls_prf_sha384 )
618 {
619 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
620 }
621 else
622 #endif
623 #if defined(MBEDTLS_SHA256_C)
624 if( tls_prf == tls_prf_sha256 )
625 {
626 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
627 }
628 else
629 #endif
630 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
631 return( MBEDTLS_SSL_TLS_PRF_NONE );
632 }
633
mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)634 int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
635 const unsigned char *secret, size_t slen,
636 const char *label,
637 const unsigned char *random, size_t rlen,
638 unsigned char *dstbuf, size_t dlen )
639 {
640 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
641
642 switch( prf )
643 {
644 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
645 #if defined(MBEDTLS_SHA384_C)
646 case MBEDTLS_SSL_TLS_PRF_SHA384:
647 tls_prf = tls_prf_sha384;
648 break;
649 #endif /* MBEDTLS_SHA384_C */
650 #if defined(MBEDTLS_SHA256_C)
651 case MBEDTLS_SSL_TLS_PRF_SHA256:
652 tls_prf = tls_prf_sha256;
653 break;
654 #endif /* MBEDTLS_SHA256_C */
655 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
656 default:
657 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
658 }
659
660 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
661 }
662
663 /* Type for the TLS PRF */
664 typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
665 const unsigned char *, size_t,
666 unsigned char *, size_t);
667
668 /*
669 * Populate a transform structure with session keys and all the other
670 * necessary information.
671 *
672 * Parameters:
673 * - [in/out]: transform: structure to populate
674 * [in] must be just initialised with mbedtls_ssl_transform_init()
675 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
676 * - [in] ciphersuite
677 * - [in] master
678 * - [in] encrypt_then_mac
679 * - [in] compression
680 * - [in] tls_prf: pointer to PRF to use for key derivation
681 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
682 * - [in] minor_ver: SSL/TLS minor version
683 * - [in] endpoint: client or server
684 * - [in] ssl: used for:
685 * - ssl->conf->{f,p}_export_keys
686 * [in] optionally used for:
687 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
688 */
ssl_tls12_populate_transform(mbedtls_ssl_transform * transform,int ciphersuite,const unsigned char master[48],int encrypt_then_mac,ssl_tls_prf_t tls_prf,const unsigned char randbytes[64],int minor_ver,unsigned endpoint,const mbedtls_ssl_context * ssl)689 static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
690 int ciphersuite,
691 const unsigned char master[48],
692 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
693 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
694 int encrypt_then_mac,
695 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
696 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
697 ssl_tls_prf_t tls_prf,
698 const unsigned char randbytes[64],
699 int minor_ver,
700 unsigned endpoint,
701 const mbedtls_ssl_context *ssl )
702 {
703 int ret = 0;
704 #if defined(MBEDTLS_USE_PSA_CRYPTO)
705 int psa_fallthrough;
706 #endif /* MBEDTLS_USE_PSA_CRYPTO */
707 unsigned char keyblk[256];
708 unsigned char *key1;
709 unsigned char *key2;
710 unsigned char *mac_enc;
711 unsigned char *mac_dec;
712 size_t mac_key_len = 0;
713 size_t iv_copy_len;
714 size_t keylen;
715 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
716 const mbedtls_cipher_info_t *cipher_info;
717 const mbedtls_md_info_t *md_info;
718
719 #if !defined(MBEDTLS_DEBUG_C) && \
720 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
721 if( ssl->f_export_keys == NULL )
722 {
723 ssl = NULL; /* make sure we don't use it except for these cases */
724 (void) ssl;
725 }
726 #endif
727
728 /*
729 * Some data just needs copying into the structure
730 */
731 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
732 defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
733 transform->encrypt_then_mac = encrypt_then_mac;
734 #endif
735 transform->minor_ver = minor_ver;
736
737 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
738 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
739 #endif
740
741 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
742 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
743 {
744 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
745 * generation separate. This should never happen. */
746 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
747 }
748 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
749
750 /*
751 * Get various info structures
752 */
753 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
754 if( ciphersuite_info == NULL )
755 {
756 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
757 ciphersuite ) );
758 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
759 }
760
761 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
762 if( cipher_info == NULL )
763 {
764 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
765 ciphersuite_info->cipher ) );
766 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
767 }
768
769 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
770 if( md_info == NULL )
771 {
772 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
773 (unsigned) ciphersuite_info->mac ) );
774 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
775 }
776
777 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
778 /* Copy own and peer's CID if the use of the CID
779 * extension has been negotiated. */
780 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
781 {
782 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
783
784 transform->in_cid_len = ssl->own_cid_len;
785 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
786 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
787 transform->in_cid_len );
788
789 transform->out_cid_len = ssl->handshake->peer_cid_len;
790 memcpy( transform->out_cid, ssl->handshake->peer_cid,
791 ssl->handshake->peer_cid_len );
792 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
793 transform->out_cid_len );
794 }
795 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
796
797 /*
798 * Compute key block using the PRF
799 */
800 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
801 if( ret != 0 )
802 {
803 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
804 return( ret );
805 }
806
807 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
808 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
809 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
810 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
811 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
812
813 /*
814 * Determine the appropriate key, IV and MAC length.
815 */
816
817 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
818
819 #if defined(MBEDTLS_GCM_C) || \
820 defined(MBEDTLS_CCM_C) || \
821 defined(MBEDTLS_CHACHAPOLY_C)
822 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_GCM ||
823 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CCM ||
824 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
825 {
826 size_t explicit_ivlen;
827
828 transform->maclen = 0;
829 mac_key_len = 0;
830 transform->taglen =
831 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
832
833 /* All modes haves 96-bit IVs, but the length of the static parts vary
834 * with mode and version:
835 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
836 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
837 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
838 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
839 * sequence number).
840 */
841 transform->ivlen = 12;
842 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
843 transform->fixed_ivlen = 12;
844 else
845 transform->fixed_ivlen = 4;
846
847 /* Minimum length of encrypted record */
848 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
849 transform->minlen = explicit_ivlen + transform->taglen;
850 }
851 else
852 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
853 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
854 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM ||
855 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
856 {
857 /* Initialize HMAC contexts */
858 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
859 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
860 {
861 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
862 goto end;
863 }
864
865 /* Get MAC length */
866 mac_key_len = mbedtls_md_get_size( md_info );
867 transform->maclen = mac_key_len;
868
869 /* IV length */
870 transform->ivlen = cipher_info->iv_size;
871
872 /* Minimum length */
873 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM )
874 transform->minlen = transform->maclen;
875 else
876 {
877 /*
878 * GenericBlockCipher:
879 * 1. if EtM is in use: one block plus MAC
880 * otherwise: * first multiple of blocklen greater than maclen
881 * 2. IV
882 */
883 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
884 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
885 {
886 transform->minlen = transform->maclen
887 + cipher_info->block_size;
888 }
889 else
890 #endif
891 {
892 transform->minlen = transform->maclen
893 + cipher_info->block_size
894 - transform->maclen % cipher_info->block_size;
895 }
896
897 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
898 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
899 {
900 transform->minlen += transform->ivlen;
901 }
902 else
903 #endif
904 {
905 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
906 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
907 goto end;
908 }
909 }
910 }
911 else
912 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
913 {
914 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
915 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
916 }
917
918 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
919 (unsigned) keylen,
920 (unsigned) transform->minlen,
921 (unsigned) transform->ivlen,
922 (unsigned) transform->maclen ) );
923
924 /*
925 * Finally setup the cipher contexts, IVs and MAC secrets.
926 */
927 #if defined(MBEDTLS_SSL_CLI_C)
928 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
929 {
930 key1 = keyblk + mac_key_len * 2;
931 key2 = keyblk + mac_key_len * 2 + keylen;
932
933 mac_enc = keyblk;
934 mac_dec = keyblk + mac_key_len;
935
936 /*
937 * This is not used in TLS v1.1.
938 */
939 iv_copy_len = ( transform->fixed_ivlen ) ?
940 transform->fixed_ivlen : transform->ivlen;
941 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
942 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
943 iv_copy_len );
944 }
945 else
946 #endif /* MBEDTLS_SSL_CLI_C */
947 #if defined(MBEDTLS_SSL_SRV_C)
948 if( endpoint == MBEDTLS_SSL_IS_SERVER )
949 {
950 key1 = keyblk + mac_key_len * 2 + keylen;
951 key2 = keyblk + mac_key_len * 2;
952
953 mac_enc = keyblk + mac_key_len;
954 mac_dec = keyblk;
955
956 /*
957 * This is not used in TLS v1.1.
958 */
959 iv_copy_len = ( transform->fixed_ivlen ) ?
960 transform->fixed_ivlen : transform->ivlen;
961 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
962 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
963 iv_copy_len );
964 }
965 else
966 #endif /* MBEDTLS_SSL_SRV_C */
967 {
968 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
969 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
970 goto end;
971 }
972
973 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
974 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
975 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
976 For AEAD-based ciphersuites, there is nothing to do here. */
977 if( mac_key_len != 0 )
978 {
979 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
980 if( ret != 0 )
981 goto end;
982 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
983 if( ret != 0 )
984 goto end;
985 }
986 #endif
987 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
988
989 ((void) mac_dec);
990 ((void) mac_enc);
991
992 if( ssl != NULL && ssl->f_export_keys != NULL )
993 {
994 ssl->f_export_keys( ssl->p_export_keys,
995 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
996 master, 48,
997 randbytes + 32,
998 randbytes,
999 tls_prf_get_type( tls_prf ) );
1000 }
1001
1002 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1003 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_enc,
1004 cipher_info, transform->taglen );
1005 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
1006 {
1007 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1008 goto end;
1009 }
1010
1011 if( ret == 0 )
1012 {
1013 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based encryption cipher context" ) );
1014 psa_fallthrough = 0;
1015 }
1016 else
1017 {
1018 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record encryption - fall through to default setup." ) );
1019 psa_fallthrough = 1;
1020 }
1021
1022 if( psa_fallthrough == 1 )
1023 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1024 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
1025 cipher_info ) ) != 0 )
1026 {
1027 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1028 goto end;
1029 }
1030
1031 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1032 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_dec,
1033 cipher_info, transform->taglen );
1034 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
1035 {
1036 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1037 goto end;
1038 }
1039
1040 if( ret == 0 )
1041 {
1042 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based decryption cipher context" ) );
1043 psa_fallthrough = 0;
1044 }
1045 else
1046 {
1047 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record decryption - fall through to default setup." ) );
1048 psa_fallthrough = 1;
1049 }
1050
1051 if( psa_fallthrough == 1 )
1052 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1053 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
1054 cipher_info ) ) != 0 )
1055 {
1056 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1057 goto end;
1058 }
1059
1060 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
1061 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
1062 MBEDTLS_ENCRYPT ) ) != 0 )
1063 {
1064 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1065 goto end;
1066 }
1067
1068 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
1069 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
1070 MBEDTLS_DECRYPT ) ) != 0 )
1071 {
1072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1073 goto end;
1074 }
1075
1076 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1077 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
1078 {
1079 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1080 MBEDTLS_PADDING_NONE ) ) != 0 )
1081 {
1082 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1083 goto end;
1084 }
1085
1086 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1087 MBEDTLS_PADDING_NONE ) ) != 0 )
1088 {
1089 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1090 goto end;
1091 }
1092 }
1093 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1094
1095
1096 end:
1097 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
1098 return( ret );
1099 }
1100
1101 /*
1102 * Set appropriate PRF function and other SSL / TLS1.2 functions
1103 *
1104 * Inputs:
1105 * - SSL/TLS minor version
1106 * - hash associated with the ciphersuite (only used by TLS 1.2)
1107 *
1108 * Outputs:
1109 * - the tls_prf, calc_verify and calc_finished members of handshake structure
1110 */
ssl_set_handshake_prfs(mbedtls_ssl_handshake_params * handshake,int minor_ver,mbedtls_md_type_t hash)1111 static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
1112 int minor_ver,
1113 mbedtls_md_type_t hash )
1114 {
1115 #if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA384_C)
1116 (void) hash;
1117 #endif
1118
1119 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1120 #if defined(MBEDTLS_SHA384_C)
1121 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1122 hash == MBEDTLS_MD_SHA384 )
1123 {
1124 handshake->tls_prf = tls_prf_sha384;
1125 handshake->calc_verify = ssl_calc_verify_tls_sha384;
1126 handshake->calc_finished = ssl_calc_finished_tls_sha384;
1127 }
1128 else
1129 #endif
1130 #if defined(MBEDTLS_SHA256_C)
1131 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1132 {
1133 handshake->tls_prf = tls_prf_sha256;
1134 handshake->calc_verify = ssl_calc_verify_tls_sha256;
1135 handshake->calc_finished = ssl_calc_finished_tls_sha256;
1136 }
1137 else
1138 #endif
1139 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1140 {
1141 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1142 }
1143
1144 return( 0 );
1145 }
1146
1147 /*
1148 * Compute master secret if needed
1149 *
1150 * Parameters:
1151 * [in/out] handshake
1152 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
1153 * (PSA-PSK) ciphersuite_info, psk_opaque
1154 * [out] premaster (cleared)
1155 * [out] master
1156 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
1157 * debug: conf->f_dbg, conf->p_dbg
1158 * EMS: passed to calc_verify (debug + session_negotiate)
1159 * PSA-PSA: minor_ver, conf
1160 */
ssl_compute_master(mbedtls_ssl_handshake_params * handshake,unsigned char * master,const mbedtls_ssl_context * ssl)1161 static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
1162 unsigned char *master,
1163 const mbedtls_ssl_context *ssl )
1164 {
1165 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1166
1167 /* cf. RFC 5246, Section 8.1:
1168 * "The master secret is always exactly 48 bytes in length." */
1169 size_t const master_secret_len = 48;
1170
1171 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1172 unsigned char session_hash[48];
1173 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1174
1175 /* The label for the KDF used for key expansion.
1176 * This is either "master secret" or "extended master secret"
1177 * depending on whether the Extended Master Secret extension
1178 * is used. */
1179 char const *lbl = "master secret";
1180
1181 /* The salt for the KDF used for key expansion.
1182 * - If the Extended Master Secret extension is not used,
1183 * this is ClientHello.Random + ServerHello.Random
1184 * (see Sect. 8.1 in RFC 5246).
1185 * - If the Extended Master Secret extension is used,
1186 * this is the transcript of the handshake so far.
1187 * (see Sect. 4 in RFC 7627). */
1188 unsigned char const *salt = handshake->randbytes;
1189 size_t salt_len = 64;
1190
1191 #if !defined(MBEDTLS_DEBUG_C) && \
1192 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
1193 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
1194 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
1195 ssl = NULL; /* make sure we don't use it except for those cases */
1196 (void) ssl;
1197 #endif
1198
1199 if( handshake->resume != 0 )
1200 {
1201 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
1202 return( 0 );
1203 }
1204
1205 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1206 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
1207 {
1208 lbl = "extended master secret";
1209 salt = session_hash;
1210 handshake->calc_verify( ssl, session_hash, &salt_len );
1211
1212 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
1213 session_hash, salt_len );
1214 }
1215 #endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */
1216
1217 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
1218 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1219 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
1220 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1221 ssl_use_opaque_psk( ssl ) == 1 )
1222 {
1223 /* Perform PSK-to-MS expansion in a single step. */
1224 psa_status_t status;
1225 psa_algorithm_t alg;
1226 psa_key_id_t psk;
1227 psa_key_derivation_operation_t derivation =
1228 PSA_KEY_DERIVATION_OPERATION_INIT;
1229 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
1230
1231 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
1232
1233 psk = mbedtls_ssl_get_opaque_psk( ssl );
1234
1235 if( hash_alg == MBEDTLS_MD_SHA384 )
1236 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
1237 else
1238 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
1239
1240 status = setup_psa_key_derivation( &derivation, psk, alg,
1241 salt, salt_len,
1242 (unsigned char const *) lbl,
1243 (size_t) strlen( lbl ),
1244 master_secret_len );
1245 if( status != PSA_SUCCESS )
1246 {
1247 psa_key_derivation_abort( &derivation );
1248 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1249 }
1250
1251 status = psa_key_derivation_output_bytes( &derivation,
1252 master,
1253 master_secret_len );
1254 if( status != PSA_SUCCESS )
1255 {
1256 psa_key_derivation_abort( &derivation );
1257 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1258 }
1259
1260 status = psa_key_derivation_abort( &derivation );
1261 if( status != PSA_SUCCESS )
1262 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1263 }
1264 else
1265 #endif
1266 {
1267 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
1268 lbl, salt, salt_len,
1269 master,
1270 master_secret_len );
1271 if( ret != 0 )
1272 {
1273 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
1274 return( ret );
1275 }
1276
1277 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
1278 handshake->premaster,
1279 handshake->pmslen );
1280
1281 mbedtls_platform_zeroize( handshake->premaster,
1282 sizeof(handshake->premaster) );
1283 }
1284
1285 return( 0 );
1286 }
1287
mbedtls_ssl_derive_keys(mbedtls_ssl_context * ssl)1288 int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
1289 {
1290 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1291 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
1292 ssl->handshake->ciphersuite_info;
1293
1294 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
1295
1296 /* Set PRF, calc_verify and calc_finished function pointers */
1297 ret = ssl_set_handshake_prfs( ssl->handshake,
1298 ssl->minor_ver,
1299 ciphersuite_info->mac );
1300 if( ret != 0 )
1301 {
1302 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
1303 return( ret );
1304 }
1305
1306 /* Compute master secret if needed */
1307 ret = ssl_compute_master( ssl->handshake,
1308 ssl->session_negotiate->master,
1309 ssl );
1310 if( ret != 0 )
1311 {
1312 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
1313 return( ret );
1314 }
1315
1316 /* Swap the client and server random values:
1317 * - MS derivation wanted client+server (RFC 5246 8.1)
1318 * - key derivation wants server+client (RFC 5246 6.3) */
1319 {
1320 unsigned char tmp[64];
1321 memcpy( tmp, ssl->handshake->randbytes, 64 );
1322 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
1323 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
1324 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
1325 }
1326
1327 /* Populate transform structure */
1328 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
1329 ssl->session_negotiate->ciphersuite,
1330 ssl->session_negotiate->master,
1331 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
1332 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1333 ssl->session_negotiate->encrypt_then_mac,
1334 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
1335 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
1336 ssl->handshake->tls_prf,
1337 ssl->handshake->randbytes,
1338 ssl->minor_ver,
1339 ssl->conf->endpoint,
1340 ssl );
1341 if( ret != 0 )
1342 {
1343 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
1344 return( ret );
1345 }
1346
1347 /* We no longer need Server/ClientHello.random values */
1348 mbedtls_platform_zeroize( ssl->handshake->randbytes,
1349 sizeof( ssl->handshake->randbytes ) );
1350
1351 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
1352
1353 return( 0 );
1354 }
1355
1356 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1357 #if defined(MBEDTLS_SHA256_C)
ssl_calc_verify_tls_sha256(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1358 void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1359 unsigned char *hash,
1360 size_t *hlen )
1361 {
1362 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1363 size_t hash_size;
1364 psa_status_t status;
1365 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
1366
1367 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
1368 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
1369 if( status != PSA_SUCCESS )
1370 {
1371 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1372 return;
1373 }
1374
1375 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
1376 if( status != PSA_SUCCESS )
1377 {
1378 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1379 return;
1380 }
1381
1382 *hlen = 32;
1383 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
1384 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1385 #else
1386 mbedtls_sha256_context sha256;
1387
1388 mbedtls_sha256_init( &sha256 );
1389
1390 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1391
1392 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1393 mbedtls_sha256_finish( &sha256, hash );
1394
1395 *hlen = 32;
1396
1397 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1398 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1399
1400 mbedtls_sha256_free( &sha256 );
1401 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1402 return;
1403 }
1404 #endif /* MBEDTLS_SHA256_C */
1405
1406 #if defined(MBEDTLS_SHA384_C)
ssl_calc_verify_tls_sha384(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1407 void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1408 unsigned char *hash,
1409 size_t *hlen )
1410 {
1411 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1412 size_t hash_size;
1413 psa_status_t status;
1414 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
1415
1416 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
1417 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
1418 if( status != PSA_SUCCESS )
1419 {
1420 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1421 return;
1422 }
1423
1424 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
1425 if( status != PSA_SUCCESS )
1426 {
1427 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1428 return;
1429 }
1430
1431 *hlen = 48;
1432 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
1433 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1434 #else
1435 mbedtls_sha512_context sha512;
1436
1437 mbedtls_sha512_init( &sha512 );
1438
1439 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1440
1441 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1442 mbedtls_sha512_finish( &sha512, hash );
1443
1444 *hlen = 48;
1445
1446 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1448
1449 mbedtls_sha512_free( &sha512 );
1450 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1451 return;
1452 }
1453 #endif /* MBEDTLS_SHA384_C */
1454 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1455
1456 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
mbedtls_ssl_psk_derive_premaster(mbedtls_ssl_context * ssl,mbedtls_key_exchange_type_t key_ex)1457 int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
1458 {
1459 unsigned char *p = ssl->handshake->premaster;
1460 unsigned char *end = p + sizeof( ssl->handshake->premaster );
1461 const unsigned char *psk = NULL;
1462 size_t psk_len = 0;
1463
1464 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
1465 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
1466 {
1467 /*
1468 * This should never happen because the existence of a PSK is always
1469 * checked before calling this function
1470 */
1471 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1472 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1473 }
1474
1475 /*
1476 * PMS = struct {
1477 * opaque other_secret<0..2^16-1>;
1478 * opaque psk<0..2^16-1>;
1479 * };
1480 * with "other_secret" depending on the particular key exchange
1481 */
1482 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1483 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
1484 {
1485 if( end - p < 2 )
1486 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1487
1488 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
1489 p += 2;
1490
1491 if( end < p || (size_t)( end - p ) < psk_len )
1492 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1493
1494 memset( p, 0, psk_len );
1495 p += psk_len;
1496 }
1497 else
1498 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1499 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1500 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
1501 {
1502 /*
1503 * other_secret already set by the ClientKeyExchange message,
1504 * and is 48 bytes long
1505 */
1506 if( end - p < 2 )
1507 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1508
1509 *p++ = 0;
1510 *p++ = 48;
1511 p += 48;
1512 }
1513 else
1514 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1515 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1516 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
1517 {
1518 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1519 size_t len;
1520
1521 /* Write length only when we know the actual value */
1522 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
1523 p + 2, end - ( p + 2 ), &len,
1524 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
1525 {
1526 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
1527 return( ret );
1528 }
1529 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
1530 p += 2 + len;
1531
1532 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
1533 }
1534 else
1535 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1536 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1537 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
1538 {
1539 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1540 size_t zlen;
1541
1542 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
1543 p + 2, end - ( p + 2 ),
1544 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
1545 {
1546 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
1547 return( ret );
1548 }
1549
1550 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
1551 p += 2 + zlen;
1552
1553 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
1554 MBEDTLS_DEBUG_ECDH_Z );
1555 }
1556 else
1557 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
1558 {
1559 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1560 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1561 }
1562
1563 /* opaque psk<0..2^16-1>; */
1564 if( end - p < 2 )
1565 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1566
1567 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
1568 p += 2;
1569
1570 if( end < p || (size_t)( end - p ) < psk_len )
1571 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1572
1573 memcpy( p, psk, psk_len );
1574 p += psk_len;
1575
1576 ssl->handshake->pmslen = p - ssl->handshake->premaster;
1577
1578 return( 0 );
1579 }
1580 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1581
1582 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
1583 static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
1584
1585 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_resend_hello_request(mbedtls_ssl_context * ssl)1586 int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
1587 {
1588 /* If renegotiation is not enforced, retransmit until we would reach max
1589 * timeout if we were using the usual handshake doubling scheme */
1590 if( ssl->conf->renego_max_records < 0 )
1591 {
1592 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
1593 unsigned char doublings = 1;
1594
1595 while( ratio != 0 )
1596 {
1597 ++doublings;
1598 ratio >>= 1;
1599 }
1600
1601 if( ++ssl->renego_records_seen > doublings )
1602 {
1603 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
1604 return( 0 );
1605 }
1606 }
1607
1608 return( ssl_write_hello_request( ssl ) );
1609 }
1610 #endif
1611 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
1612
1613 #if defined(MBEDTLS_X509_CRT_PARSE_C)
ssl_clear_peer_cert(mbedtls_ssl_session * session)1614 static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
1615 {
1616 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
1617 if( session->peer_cert != NULL )
1618 {
1619 mbedtls_x509_crt_free( session->peer_cert );
1620 mbedtls_free( session->peer_cert );
1621 session->peer_cert = NULL;
1622 }
1623 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1624 if( session->peer_cert_digest != NULL )
1625 {
1626 /* Zeroization is not necessary. */
1627 mbedtls_free( session->peer_cert_digest );
1628 session->peer_cert_digest = NULL;
1629 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
1630 session->peer_cert_digest_len = 0;
1631 }
1632 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1633 }
1634 #endif /* MBEDTLS_X509_CRT_PARSE_C */
1635
1636 /*
1637 * Handshake functions
1638 */
1639 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1640 /* No certificate support -> dummy functions */
mbedtls_ssl_write_certificate(mbedtls_ssl_context * ssl)1641 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
1642 {
1643 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1644 ssl->handshake->ciphersuite_info;
1645
1646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
1647
1648 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
1649 {
1650 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1651 ssl->state++;
1652 return( 0 );
1653 }
1654
1655 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1656 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1657 }
1658
mbedtls_ssl_parse_certificate(mbedtls_ssl_context * ssl)1659 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
1660 {
1661 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1662 ssl->handshake->ciphersuite_info;
1663
1664 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
1665
1666 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
1667 {
1668 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
1669 ssl->state++;
1670 return( 0 );
1671 }
1672
1673 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1674 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1675 }
1676
1677 #else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1678 /* Some certificate support -> implement write and parse */
1679
mbedtls_ssl_write_certificate(mbedtls_ssl_context * ssl)1680 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
1681 {
1682 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1683 size_t i, n;
1684 const mbedtls_x509_crt *crt;
1685 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1686 ssl->handshake->ciphersuite_info;
1687
1688 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
1689
1690 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
1691 {
1692 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1693 ssl->state++;
1694 return( 0 );
1695 }
1696
1697 #if defined(MBEDTLS_SSL_CLI_C)
1698 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
1699 {
1700 if( ssl->client_auth == 0 )
1701 {
1702 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1703 ssl->state++;
1704 return( 0 );
1705 }
1706 }
1707 #endif /* MBEDTLS_SSL_CLI_C */
1708 #if defined(MBEDTLS_SSL_SRV_C)
1709 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1710 {
1711 if( mbedtls_ssl_own_cert( ssl ) == NULL )
1712 {
1713 /* Should never happen because we shouldn't have picked the
1714 * ciphersuite if we don't have a certificate. */
1715 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1716 }
1717 }
1718 #endif
1719
1720 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
1721
1722 /*
1723 * 0 . 0 handshake type
1724 * 1 . 3 handshake length
1725 * 4 . 6 length of all certs
1726 * 7 . 9 length of cert. 1
1727 * 10 . n-1 peer certificate
1728 * n . n+2 length of cert. 2
1729 * n+3 . ... upper level cert, etc.
1730 */
1731 i = 7;
1732 crt = mbedtls_ssl_own_cert( ssl );
1733
1734 while( crt != NULL )
1735 {
1736 n = crt->raw.len;
1737 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
1738 {
1739 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
1740 " > %" MBEDTLS_PRINTF_SIZET,
1741 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
1742 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
1743 }
1744
1745 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
1746 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
1747 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
1748
1749 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
1750 i += n; crt = crt->next;
1751 }
1752
1753 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
1754 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
1755 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
1756
1757 ssl->out_msglen = i;
1758 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
1759 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
1760
1761 ssl->state++;
1762
1763 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
1764 {
1765 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
1766 return( ret );
1767 }
1768
1769 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
1770
1771 return( ret );
1772 }
1773
1774 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1775
1776 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ssl_check_peer_crt_unchanged(mbedtls_ssl_context * ssl,unsigned char * crt_buf,size_t crt_buf_len)1777 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
1778 unsigned char *crt_buf,
1779 size_t crt_buf_len )
1780 {
1781 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
1782
1783 if( peer_crt == NULL )
1784 return( -1 );
1785
1786 if( peer_crt->raw.len != crt_buf_len )
1787 return( -1 );
1788
1789 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
1790 }
1791 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
ssl_check_peer_crt_unchanged(mbedtls_ssl_context * ssl,unsigned char * crt_buf,size_t crt_buf_len)1792 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
1793 unsigned char *crt_buf,
1794 size_t crt_buf_len )
1795 {
1796 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1797 unsigned char const * const peer_cert_digest =
1798 ssl->session->peer_cert_digest;
1799 mbedtls_md_type_t const peer_cert_digest_type =
1800 ssl->session->peer_cert_digest_type;
1801 mbedtls_md_info_t const * const digest_info =
1802 mbedtls_md_info_from_type( peer_cert_digest_type );
1803 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
1804 size_t digest_len;
1805
1806 if( peer_cert_digest == NULL || digest_info == NULL )
1807 return( -1 );
1808
1809 digest_len = mbedtls_md_get_size( digest_info );
1810 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
1811 return( -1 );
1812
1813 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
1814 if( ret != 0 )
1815 return( -1 );
1816
1817 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
1818 }
1819 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1820 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
1821
1822 /*
1823 * Once the certificate message is read, parse it into a cert chain and
1824 * perform basic checks, but leave actual verification to the caller
1825 */
ssl_parse_certificate_chain(mbedtls_ssl_context * ssl,mbedtls_x509_crt * chain)1826 static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
1827 mbedtls_x509_crt *chain )
1828 {
1829 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1830 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1831 int crt_cnt=0;
1832 #endif
1833 size_t i, n;
1834 uint8_t alert;
1835
1836 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
1837 {
1838 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1839 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1840 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
1841 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1842 }
1843
1844 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
1845 {
1846 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1847 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
1848 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1849 }
1850
1851 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
1852 {
1853 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1854 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1855 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1856 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1857 }
1858
1859 i = mbedtls_ssl_hs_hdr_len( ssl );
1860
1861 /*
1862 * Same message structure as in mbedtls_ssl_write_certificate()
1863 */
1864 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
1865
1866 if( ssl->in_msg[i] != 0 ||
1867 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
1868 {
1869 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1870 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1871 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1872 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1873 }
1874
1875 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
1876 i += 3;
1877
1878 /* Iterate through and parse the CRTs in the provided chain. */
1879 while( i < ssl->in_hslen )
1880 {
1881 /* Check that there's room for the next CRT's length fields. */
1882 if ( i + 3 > ssl->in_hslen ) {
1883 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1884 mbedtls_ssl_send_alert_message( ssl,
1885 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1886 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1887 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1888 }
1889 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
1890 * anything beyond 2**16 ~ 64K. */
1891 if( ssl->in_msg[i] != 0 )
1892 {
1893 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1894 mbedtls_ssl_send_alert_message( ssl,
1895 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1896 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
1897 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
1898 }
1899
1900 /* Read length of the next CRT in the chain. */
1901 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
1902 | (unsigned int) ssl->in_msg[i + 2];
1903 i += 3;
1904
1905 if( n < 128 || i + n > ssl->in_hslen )
1906 {
1907 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1908 mbedtls_ssl_send_alert_message( ssl,
1909 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1910 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1911 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1912 }
1913
1914 /* Check if we're handling the first CRT in the chain. */
1915 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1916 if( crt_cnt++ == 0 &&
1917 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
1918 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
1919 {
1920 /* During client-side renegotiation, check that the server's
1921 * end-CRTs hasn't changed compared to the initial handshake,
1922 * mitigating the triple handshake attack. On success, reuse
1923 * the original end-CRT instead of parsing it again. */
1924 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
1925 if( ssl_check_peer_crt_unchanged( ssl,
1926 &ssl->in_msg[i],
1927 n ) != 0 )
1928 {
1929 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
1930 mbedtls_ssl_send_alert_message( ssl,
1931 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1932 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
1933 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
1934 }
1935
1936 /* Now we can safely free the original chain. */
1937 ssl_clear_peer_cert( ssl->session );
1938 }
1939 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
1940
1941 /* Parse the next certificate in the chain. */
1942 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
1943 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
1944 #else
1945 /* If we don't need to store the CRT chain permanently, parse
1946 * it in-place from the input buffer instead of making a copy. */
1947 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
1948 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1949 switch( ret )
1950 {
1951 case 0: /*ok*/
1952 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
1953 /* Ignore certificate with an unknown algorithm: maybe a
1954 prior certificate was already trusted. */
1955 break;
1956
1957 case MBEDTLS_ERR_X509_ALLOC_FAILED:
1958 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
1959 goto crt_parse_der_failed;
1960
1961 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
1962 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
1963 goto crt_parse_der_failed;
1964
1965 default:
1966 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
1967 crt_parse_der_failed:
1968 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
1969 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
1970 return( ret );
1971 }
1972
1973 i += n;
1974 }
1975
1976 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
1977 return( 0 );
1978 }
1979
1980 #if defined(MBEDTLS_SSL_SRV_C)
ssl_srv_check_client_no_crt_notification(mbedtls_ssl_context * ssl)1981 static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
1982 {
1983 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
1984 return( -1 );
1985
1986 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1987 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
1988 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
1989 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
1990 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
1991 {
1992 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
1993 return( 0 );
1994 }
1995
1996 return( -1 );
1997 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1998 }
1999 #endif /* MBEDTLS_SSL_SRV_C */
2000
2001 /* Check if a certificate message is expected.
2002 * Return either
2003 * - SSL_CERTIFICATE_EXPECTED, or
2004 * - SSL_CERTIFICATE_SKIP
2005 * indicating whether a Certificate message is expected or not.
2006 */
2007 #define SSL_CERTIFICATE_EXPECTED 0
2008 #define SSL_CERTIFICATE_SKIP 1
ssl_parse_certificate_coordinate(mbedtls_ssl_context * ssl,int authmode)2009 static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
2010 int authmode )
2011 {
2012 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2013 ssl->handshake->ciphersuite_info;
2014
2015 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2016 return( SSL_CERTIFICATE_SKIP );
2017
2018 #if defined(MBEDTLS_SSL_SRV_C)
2019 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2020 {
2021 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2022 return( SSL_CERTIFICATE_SKIP );
2023
2024 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2025 {
2026 ssl->session_negotiate->verify_result =
2027 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
2028 return( SSL_CERTIFICATE_SKIP );
2029 }
2030 }
2031 #else
2032 ((void) authmode);
2033 #endif /* MBEDTLS_SSL_SRV_C */
2034
2035 return( SSL_CERTIFICATE_EXPECTED );
2036 }
2037
ssl_parse_certificate_verify(mbedtls_ssl_context * ssl,int authmode,mbedtls_x509_crt * chain,void * rs_ctx)2038 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
2039 int authmode,
2040 mbedtls_x509_crt *chain,
2041 void *rs_ctx )
2042 {
2043 int ret = 0;
2044 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2045 ssl->handshake->ciphersuite_info;
2046 int have_ca_chain = 0;
2047
2048 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
2049 void *p_vrfy;
2050
2051 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2052 return( 0 );
2053
2054 if( ssl->f_vrfy != NULL )
2055 {
2056 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
2057 f_vrfy = ssl->f_vrfy;
2058 p_vrfy = ssl->p_vrfy;
2059 }
2060 else
2061 {
2062 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
2063 f_vrfy = ssl->conf->f_vrfy;
2064 p_vrfy = ssl->conf->p_vrfy;
2065 }
2066
2067 /*
2068 * Main check: verify certificate
2069 */
2070 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
2071 if( ssl->conf->f_ca_cb != NULL )
2072 {
2073 ((void) rs_ctx);
2074 have_ca_chain = 1;
2075
2076 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
2077 ret = mbedtls_x509_crt_verify_with_ca_cb(
2078 chain,
2079 ssl->conf->f_ca_cb,
2080 ssl->conf->p_ca_cb,
2081 ssl->conf->cert_profile,
2082 ssl->hostname,
2083 &ssl->session_negotiate->verify_result,
2084 f_vrfy, p_vrfy );
2085 }
2086 else
2087 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
2088 {
2089 mbedtls_x509_crt *ca_chain;
2090 mbedtls_x509_crl *ca_crl;
2091
2092 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2093 if( ssl->handshake->sni_ca_chain != NULL )
2094 {
2095 ca_chain = ssl->handshake->sni_ca_chain;
2096 ca_crl = ssl->handshake->sni_ca_crl;
2097 }
2098 else
2099 #endif
2100 {
2101 ca_chain = ssl->conf->ca_chain;
2102 ca_crl = ssl->conf->ca_crl;
2103 }
2104
2105 if( ca_chain != NULL )
2106 have_ca_chain = 1;
2107
2108 ret = mbedtls_x509_crt_verify_restartable(
2109 chain,
2110 ca_chain, ca_crl,
2111 ssl->conf->cert_profile,
2112 ssl->hostname,
2113 &ssl->session_negotiate->verify_result,
2114 f_vrfy, p_vrfy, rs_ctx );
2115 }
2116
2117 if( ret != 0 )
2118 {
2119 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
2120 }
2121
2122 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2123 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2124 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
2125 #endif
2126
2127 /*
2128 * Secondary checks: always done, but change 'ret' only if it was 0
2129 */
2130
2131 #if defined(MBEDTLS_ECP_C)
2132 {
2133 const mbedtls_pk_context *pk = &chain->pk;
2134
2135 /* If certificate uses an EC key, make sure the curve is OK */
2136 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
2137 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
2138 {
2139 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
2140
2141 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
2142 if( ret == 0 )
2143 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
2144 }
2145 }
2146 #endif /* MBEDTLS_ECP_C */
2147
2148 if( mbedtls_ssl_check_cert_usage( chain,
2149 ciphersuite_info,
2150 ! ssl->conf->endpoint,
2151 &ssl->session_negotiate->verify_result ) != 0 )
2152 {
2153 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
2154 if( ret == 0 )
2155 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
2156 }
2157
2158 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
2159 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
2160 * with details encoded in the verification flags. All other kinds
2161 * of error codes, including those from the user provided f_vrfy
2162 * functions, are treated as fatal and lead to a failure of
2163 * ssl_parse_certificate even if verification was optional. */
2164 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
2165 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
2166 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
2167 {
2168 ret = 0;
2169 }
2170
2171 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
2172 {
2173 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
2174 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
2175 }
2176
2177 if( ret != 0 )
2178 {
2179 uint8_t alert;
2180
2181 /* The certificate may have been rejected for several reasons.
2182 Pick one and send the corresponding alert. Which alert to send
2183 may be a subject of debate in some cases. */
2184 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
2185 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
2186 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
2187 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
2188 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
2189 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2190 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
2191 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2192 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
2193 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2194 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
2195 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2196 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
2197 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2198 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
2199 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
2200 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
2201 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
2202 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
2203 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
2204 else
2205 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
2206 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2207 alert );
2208 }
2209
2210 #if defined(MBEDTLS_DEBUG_C)
2211 if( ssl->session_negotiate->verify_result != 0 )
2212 {
2213 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
2214 (unsigned int) ssl->session_negotiate->verify_result ) );
2215 }
2216 else
2217 {
2218 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
2219 }
2220 #endif /* MBEDTLS_DEBUG_C */
2221
2222 return( ret );
2223 }
2224
2225 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ssl_remember_peer_crt_digest(mbedtls_ssl_context * ssl,unsigned char * start,size_t len)2226 static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
2227 unsigned char *start, size_t len )
2228 {
2229 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2230 /* Remember digest of the peer's end-CRT. */
2231 ssl->session_negotiate->peer_cert_digest =
2232 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
2233 if( ssl->session_negotiate->peer_cert_digest == NULL )
2234 {
2235 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
2236 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
2237 mbedtls_ssl_send_alert_message( ssl,
2238 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2239 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2240
2241 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2242 }
2243
2244 ret = mbedtls_md( mbedtls_md_info_from_type(
2245 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
2246 start, len,
2247 ssl->session_negotiate->peer_cert_digest );
2248
2249 ssl->session_negotiate->peer_cert_digest_type =
2250 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
2251 ssl->session_negotiate->peer_cert_digest_len =
2252 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
2253
2254 return( ret );
2255 }
2256
ssl_remember_peer_pubkey(mbedtls_ssl_context * ssl,unsigned char * start,size_t len)2257 static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
2258 unsigned char *start, size_t len )
2259 {
2260 unsigned char *end = start + len;
2261 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2262
2263 /* Make a copy of the peer's raw public key. */
2264 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
2265 ret = mbedtls_pk_parse_subpubkey( &start, end,
2266 &ssl->handshake->peer_pubkey );
2267 if( ret != 0 )
2268 {
2269 /* We should have parsed the public key before. */
2270 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2271 }
2272
2273 return( 0 );
2274 }
2275 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2276
mbedtls_ssl_parse_certificate(mbedtls_ssl_context * ssl)2277 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
2278 {
2279 int ret = 0;
2280 int crt_expected;
2281 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2282 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
2283 ? ssl->handshake->sni_authmode
2284 : ssl->conf->authmode;
2285 #else
2286 const int authmode = ssl->conf->authmode;
2287 #endif
2288 void *rs_ctx = NULL;
2289 mbedtls_x509_crt *chain = NULL;
2290
2291 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2292
2293 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
2294 if( crt_expected == SSL_CERTIFICATE_SKIP )
2295 {
2296 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
2297 goto exit;
2298 }
2299
2300 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2301 if( ssl->handshake->ecrs_enabled &&
2302 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
2303 {
2304 chain = ssl->handshake->ecrs_peer_cert;
2305 ssl->handshake->ecrs_peer_cert = NULL;
2306 goto crt_verify;
2307 }
2308 #endif
2309
2310 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2311 {
2312 /* mbedtls_ssl_read_record may have sent an alert already. We
2313 let it decide whether to alert. */
2314 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2315 goto exit;
2316 }
2317
2318 #if defined(MBEDTLS_SSL_SRV_C)
2319 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
2320 {
2321 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
2322
2323 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
2324 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
2325
2326 goto exit;
2327 }
2328 #endif /* MBEDTLS_SSL_SRV_C */
2329
2330 /* Clear existing peer CRT structure in case we tried to
2331 * reuse a session but it failed, and allocate a new one. */
2332 ssl_clear_peer_cert( ssl->session_negotiate );
2333
2334 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
2335 if( chain == NULL )
2336 {
2337 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
2338 sizeof( mbedtls_x509_crt ) ) );
2339 mbedtls_ssl_send_alert_message( ssl,
2340 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2341 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2342
2343 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
2344 goto exit;
2345 }
2346 mbedtls_x509_crt_init( chain );
2347
2348 ret = ssl_parse_certificate_chain( ssl, chain );
2349 if( ret != 0 )
2350 goto exit;
2351
2352 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2353 if( ssl->handshake->ecrs_enabled)
2354 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
2355
2356 crt_verify:
2357 if( ssl->handshake->ecrs_enabled)
2358 rs_ctx = &ssl->handshake->ecrs_ctx;
2359 #endif
2360
2361 ret = ssl_parse_certificate_verify( ssl, authmode,
2362 chain, rs_ctx );
2363 if( ret != 0 )
2364 goto exit;
2365
2366 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2367 {
2368 unsigned char *crt_start, *pk_start;
2369 size_t crt_len, pk_len;
2370
2371 /* We parse the CRT chain without copying, so
2372 * these pointers point into the input buffer,
2373 * and are hence still valid after freeing the
2374 * CRT chain. */
2375
2376 crt_start = chain->raw.p;
2377 crt_len = chain->raw.len;
2378
2379 pk_start = chain->pk_raw.p;
2380 pk_len = chain->pk_raw.len;
2381
2382 /* Free the CRT structures before computing
2383 * digest and copying the peer's public key. */
2384 mbedtls_x509_crt_free( chain );
2385 mbedtls_free( chain );
2386 chain = NULL;
2387
2388 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
2389 if( ret != 0 )
2390 goto exit;
2391
2392 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
2393 if( ret != 0 )
2394 goto exit;
2395 }
2396 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2397 /* Pass ownership to session structure. */
2398 ssl->session_negotiate->peer_cert = chain;
2399 chain = NULL;
2400 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2401
2402 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
2403
2404 exit:
2405
2406 if( ret == 0 )
2407 ssl->state++;
2408
2409 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2410 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
2411 {
2412 ssl->handshake->ecrs_peer_cert = chain;
2413 chain = NULL;
2414 }
2415 #endif
2416
2417 if( chain != NULL )
2418 {
2419 mbedtls_x509_crt_free( chain );
2420 mbedtls_free( chain );
2421 }
2422
2423 return( ret );
2424 }
2425 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
2426
mbedtls_ssl_optimize_checksum(mbedtls_ssl_context * ssl,const mbedtls_ssl_ciphersuite_t * ciphersuite_info)2427 void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
2428 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
2429 {
2430 ((void) ciphersuite_info);
2431
2432 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2433 #if defined(MBEDTLS_SHA384_C)
2434 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
2435 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
2436 else
2437 #endif
2438 #if defined(MBEDTLS_SHA256_C)
2439 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
2440 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
2441 else
2442 #endif
2443 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2444 {
2445 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2446 return;
2447 }
2448 }
2449
mbedtls_ssl_reset_checksum(mbedtls_ssl_context * ssl)2450 void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
2451 {
2452 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2453 #if defined(MBEDTLS_SHA256_C)
2454 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2455 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
2456 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2457 #else
2458 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
2459 #endif
2460 #endif
2461 #if defined(MBEDTLS_SHA384_C)
2462 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2463 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
2464 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
2465 #else
2466 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
2467 #endif
2468 #endif
2469 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2470 }
2471
ssl_update_checksum_start(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2472 static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
2473 const unsigned char *buf, size_t len )
2474 {
2475 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2476 #if defined(MBEDTLS_SHA256_C)
2477 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2478 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2479 #else
2480 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
2481 #endif
2482 #endif
2483 #if defined(MBEDTLS_SHA384_C)
2484 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2485 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
2486 #else
2487 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
2488 #endif
2489 #endif
2490 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2491 }
2492
2493 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2494 #if defined(MBEDTLS_SHA256_C)
ssl_update_checksum_sha256(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2495 static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
2496 const unsigned char *buf, size_t len )
2497 {
2498 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2499 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2500 #else
2501 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
2502 #endif
2503 }
2504 #endif
2505
2506 #if defined(MBEDTLS_SHA384_C)
ssl_update_checksum_sha384(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2507 static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
2508 const unsigned char *buf, size_t len )
2509 {
2510 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2511 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
2512 #else
2513 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
2514 #endif
2515 }
2516 #endif
2517 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2518
2519 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2520 #if defined(MBEDTLS_SHA256_C)
ssl_calc_finished_tls_sha256(mbedtls_ssl_context * ssl,unsigned char * buf,int from)2521 static void ssl_calc_finished_tls_sha256(
2522 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
2523 {
2524 int len = 12;
2525 const char *sender;
2526 unsigned char padbuf[32];
2527 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2528 size_t hash_size;
2529 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
2530 psa_status_t status;
2531 #else
2532 mbedtls_sha256_context sha256;
2533 #endif
2534
2535 mbedtls_ssl_session *session = ssl->session_negotiate;
2536 if( !session )
2537 session = ssl->session;
2538
2539 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
2540 ? "client finished"
2541 : "server finished";
2542
2543 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2544 sha256_psa = psa_hash_operation_init();
2545
2546 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
2547
2548 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
2549 if( status != PSA_SUCCESS )
2550 {
2551 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
2552 return;
2553 }
2554
2555 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
2556 if( status != PSA_SUCCESS )
2557 {
2558 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
2559 return;
2560 }
2561 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
2562 #else
2563
2564 mbedtls_sha256_init( &sha256 );
2565
2566 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
2567
2568 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
2569
2570 /*
2571 * TLSv1.2:
2572 * hash = PRF( master, finished_label,
2573 * Hash( handshake ) )[0.11]
2574 */
2575
2576 #if !defined(MBEDTLS_SHA256_ALT)
2577 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
2578 sha256.state, sizeof( sha256.state ) );
2579 #endif
2580
2581 mbedtls_sha256_finish( &sha256, padbuf );
2582 mbedtls_sha256_free( &sha256 );
2583 #endif /* MBEDTLS_USE_PSA_CRYPTO */
2584
2585 ssl->handshake->tls_prf( session->master, 48, sender,
2586 padbuf, 32, buf, len );
2587
2588 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
2589
2590 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
2591
2592 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
2593 }
2594 #endif /* MBEDTLS_SHA256_C */
2595
2596 #if defined(MBEDTLS_SHA384_C)
2597
ssl_calc_finished_tls_sha384(mbedtls_ssl_context * ssl,unsigned char * buf,int from)2598 static void ssl_calc_finished_tls_sha384(
2599 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
2600 {
2601 int len = 12;
2602 const char *sender;
2603 unsigned char padbuf[48];
2604 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2605 size_t hash_size;
2606 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
2607 psa_status_t status;
2608 #else
2609 mbedtls_sha512_context sha512;
2610 #endif
2611
2612 mbedtls_ssl_session *session = ssl->session_negotiate;
2613 if( !session )
2614 session = ssl->session;
2615
2616 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
2617 ? "client finished"
2618 : "server finished";
2619
2620 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2621 sha384_psa = psa_hash_operation_init();
2622
2623 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
2624
2625 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
2626 if( status != PSA_SUCCESS )
2627 {
2628 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
2629 return;
2630 }
2631
2632 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
2633 if( status != PSA_SUCCESS )
2634 {
2635 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
2636 return;
2637 }
2638 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
2639 #else
2640 mbedtls_sha512_init( &sha512 );
2641
2642 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
2643
2644 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
2645
2646 /*
2647 * TLSv1.2:
2648 * hash = PRF( master, finished_label,
2649 * Hash( handshake ) )[0.11]
2650 */
2651
2652 #if !defined(MBEDTLS_SHA512_ALT)
2653 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
2654 sha512.state, sizeof( sha512.state ) );
2655 #endif
2656 mbedtls_sha512_finish( &sha512, padbuf );
2657
2658 mbedtls_sha512_free( &sha512 );
2659 #endif
2660
2661 ssl->handshake->tls_prf( session->master, 48, sender,
2662 padbuf, 48, buf, len );
2663
2664 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
2665
2666 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
2667
2668 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
2669 }
2670 #endif /* MBEDTLS_SHA384_C */
2671 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2672
mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context * ssl)2673 void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
2674 {
2675 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
2676
2677 /*
2678 * Free our handshake params
2679 */
2680 mbedtls_ssl_handshake_free( ssl );
2681 mbedtls_free( ssl->handshake );
2682 ssl->handshake = NULL;
2683
2684 /*
2685 * Free the previous transform and swith in the current one
2686 */
2687 if( ssl->transform )
2688 {
2689 mbedtls_ssl_transform_free( ssl->transform );
2690 mbedtls_free( ssl->transform );
2691 }
2692 ssl->transform = ssl->transform_negotiate;
2693 ssl->transform_negotiate = NULL;
2694
2695 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
2696 }
2697
mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context * ssl)2698 void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
2699 {
2700 int resume = ssl->handshake->resume;
2701
2702 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
2703
2704 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2705 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
2706 {
2707 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
2708 ssl->renego_records_seen = 0;
2709 }
2710 #endif
2711
2712 /*
2713 * Free the previous session and switch in the current one
2714 */
2715 if( ssl->session )
2716 {
2717 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2718 /* RFC 7366 3.1: keep the EtM state */
2719 ssl->session_negotiate->encrypt_then_mac =
2720 ssl->session->encrypt_then_mac;
2721 #endif
2722
2723 mbedtls_ssl_session_free( ssl->session );
2724 mbedtls_free( ssl->session );
2725 }
2726 ssl->session = ssl->session_negotiate;
2727 ssl->session_negotiate = NULL;
2728
2729 /*
2730 * Add cache entry
2731 */
2732 if( ssl->conf->f_set_cache != NULL &&
2733 ssl->session->id_len != 0 &&
2734 resume == 0 )
2735 {
2736 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
2737 ssl->session->id,
2738 ssl->session->id_len,
2739 ssl->session ) != 0 )
2740 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
2741 }
2742
2743 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2744 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2745 ssl->handshake->flight != NULL )
2746 {
2747 /* Cancel handshake timer */
2748 mbedtls_ssl_set_timer( ssl, 0 );
2749
2750 /* Keep last flight around in case we need to resend it:
2751 * we need the handshake and transform structures for that */
2752 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
2753 }
2754 else
2755 #endif
2756 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
2757
2758 ssl->state++;
2759
2760 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
2761 }
2762
mbedtls_ssl_write_finished(mbedtls_ssl_context * ssl)2763 int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
2764 {
2765 int ret, hash_len;
2766
2767 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
2768
2769 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
2770
2771 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
2772
2773 /*
2774 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
2775 * may define some other value. Currently (early 2016), no defined
2776 * ciphersuite does this (and this is unlikely to change as activity has
2777 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
2778 */
2779 hash_len = 12;
2780
2781 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2782 ssl->verify_data_len = hash_len;
2783 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
2784 #endif
2785
2786 ssl->out_msglen = 4 + hash_len;
2787 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2788 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
2789
2790 /*
2791 * In case of session resuming, invert the client and server
2792 * ChangeCipherSpec messages order.
2793 */
2794 if( ssl->handshake->resume != 0 )
2795 {
2796 #if defined(MBEDTLS_SSL_CLI_C)
2797 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
2798 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
2799 #endif
2800 #if defined(MBEDTLS_SSL_SRV_C)
2801 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2802 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
2803 #endif
2804 }
2805 else
2806 ssl->state++;
2807
2808 /*
2809 * Switch to our negotiated transform and session parameters for outbound
2810 * data.
2811 */
2812 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
2813
2814 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2815 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2816 {
2817 unsigned char i;
2818
2819 /* Remember current epoch settings for resending */
2820 ssl->handshake->alt_transform_out = ssl->transform_out;
2821 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
2822 sizeof( ssl->handshake->alt_out_ctr ) );
2823
2824 /* Set sequence_number to zero */
2825 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
2826
2827
2828 /* Increment epoch */
2829 for( i = 2; i > 0; i-- )
2830 if( ++ssl->cur_out_ctr[i - 1] != 0 )
2831 break;
2832
2833 /* The loop goes to its end iff the counter is wrapping */
2834 if( i == 0 )
2835 {
2836 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
2837 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
2838 }
2839 }
2840 else
2841 #endif /* MBEDTLS_SSL_PROTO_DTLS */
2842 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
2843
2844 ssl->transform_out = ssl->transform_negotiate;
2845 ssl->session_out = ssl->session_negotiate;
2846
2847 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2848 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2849 mbedtls_ssl_send_flight_completed( ssl );
2850 #endif
2851
2852 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
2853 {
2854 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
2855 return( ret );
2856 }
2857
2858 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2859 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2860 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2861 {
2862 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
2863 return( ret );
2864 }
2865 #endif
2866
2867 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
2868
2869 return( 0 );
2870 }
2871
2872 #define SSL_MAX_HASH_LEN 12
2873
mbedtls_ssl_parse_finished(mbedtls_ssl_context * ssl)2874 int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
2875 {
2876 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2877 unsigned int hash_len = 12;
2878 unsigned char buf[SSL_MAX_HASH_LEN];
2879
2880 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
2881
2882 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
2883
2884 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2885 {
2886 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2887 goto exit;
2888 }
2889
2890 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2891 {
2892 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2893 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2894 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2895 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
2896 goto exit;
2897 }
2898
2899 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
2900 {
2901 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2902 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2903 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
2904 goto exit;
2905 }
2906
2907 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
2908 {
2909 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2910 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2911 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2912 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
2913 goto exit;
2914 }
2915
2916 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
2917 buf, hash_len ) != 0 )
2918 {
2919 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2920 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2921 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
2922 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2923 goto exit;
2924 }
2925
2926 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2927 ssl->verify_data_len = hash_len;
2928 memcpy( ssl->peer_verify_data, buf, hash_len );
2929 #endif
2930
2931 if( ssl->handshake->resume != 0 )
2932 {
2933 #if defined(MBEDTLS_SSL_CLI_C)
2934 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
2935 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
2936 #endif
2937 #if defined(MBEDTLS_SSL_SRV_C)
2938 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2939 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
2940 #endif
2941 }
2942 else
2943 ssl->state++;
2944
2945 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2946 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2947 mbedtls_ssl_recv_flight_completed( ssl );
2948 #endif
2949
2950 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
2951
2952 exit:
2953 mbedtls_platform_zeroize( buf, hash_len );
2954 return( ret );
2955 }
2956
ssl_handshake_params_init(mbedtls_ssl_handshake_params * handshake)2957 static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
2958 {
2959 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
2960
2961 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2962 #if defined(MBEDTLS_SHA256_C)
2963 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2964 handshake->fin_sha256_psa = psa_hash_operation_init();
2965 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2966 #else
2967 mbedtls_sha256_init( &handshake->fin_sha256 );
2968 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
2969 #endif
2970 #endif
2971 #if defined(MBEDTLS_SHA384_C)
2972 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2973 handshake->fin_sha384_psa = psa_hash_operation_init();
2974 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
2975 #else
2976 mbedtls_sha512_init( &handshake->fin_sha512 );
2977 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
2978 #endif
2979 #endif
2980 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2981
2982 handshake->update_checksum = ssl_update_checksum_start;
2983
2984 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
2985 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
2986 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
2987 #endif
2988
2989 #if defined(MBEDTLS_DHM_C)
2990 mbedtls_dhm_init( &handshake->dhm_ctx );
2991 #endif
2992 #if defined(MBEDTLS_ECDH_C)
2993 mbedtls_ecdh_init( &handshake->ecdh_ctx );
2994 #endif
2995 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2996 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
2997 #if defined(MBEDTLS_SSL_CLI_C)
2998 handshake->ecjpake_cache = NULL;
2999 handshake->ecjpake_cache_len = 0;
3000 #endif
3001 #endif
3002
3003 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3004 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
3005 #endif
3006
3007 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3008 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
3009 #endif
3010
3011 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3012 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3013 mbedtls_pk_init( &handshake->peer_pubkey );
3014 #endif
3015 }
3016
mbedtls_ssl_transform_init(mbedtls_ssl_transform * transform)3017 void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
3018 {
3019 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
3020
3021 mbedtls_cipher_init( &transform->cipher_ctx_enc );
3022 mbedtls_cipher_init( &transform->cipher_ctx_dec );
3023
3024 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
3025 mbedtls_md_init( &transform->md_ctx_enc );
3026 mbedtls_md_init( &transform->md_ctx_dec );
3027 #endif
3028 }
3029
mbedtls_ssl_session_init(mbedtls_ssl_session * session)3030 void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
3031 {
3032 memset( session, 0, sizeof(mbedtls_ssl_session) );
3033 }
3034
ssl_handshake_init(mbedtls_ssl_context * ssl)3035 static int ssl_handshake_init( mbedtls_ssl_context *ssl )
3036 {
3037 /* Clear old handshake information if present */
3038 if( ssl->transform_negotiate )
3039 mbedtls_ssl_transform_free( ssl->transform_negotiate );
3040 if( ssl->session_negotiate )
3041 mbedtls_ssl_session_free( ssl->session_negotiate );
3042 if( ssl->handshake )
3043 mbedtls_ssl_handshake_free( ssl );
3044
3045 /*
3046 * Either the pointers are now NULL or cleared properly and can be freed.
3047 * Now allocate missing structures.
3048 */
3049 if( ssl->transform_negotiate == NULL )
3050 {
3051 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
3052 }
3053
3054 if( ssl->session_negotiate == NULL )
3055 {
3056 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
3057 }
3058
3059 if( ssl->handshake == NULL )
3060 {
3061 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
3062 }
3063 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3064 /* If the buffers are too small - reallocate */
3065
3066 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
3067 MBEDTLS_SSL_OUT_BUFFER_LEN );
3068 #endif
3069
3070 /* All pointers should exist and can be directly freed without issue */
3071 if( ssl->handshake == NULL ||
3072 ssl->transform_negotiate == NULL ||
3073 ssl->session_negotiate == NULL )
3074 {
3075 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
3076
3077 mbedtls_free( ssl->handshake );
3078 mbedtls_free( ssl->transform_negotiate );
3079 mbedtls_free( ssl->session_negotiate );
3080
3081 ssl->handshake = NULL;
3082 ssl->transform_negotiate = NULL;
3083 ssl->session_negotiate = NULL;
3084
3085 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3086 }
3087
3088 /* Initialize structures */
3089 mbedtls_ssl_session_init( ssl->session_negotiate );
3090 mbedtls_ssl_transform_init( ssl->transform_negotiate );
3091 ssl_handshake_params_init( ssl->handshake );
3092
3093 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3094 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3095 {
3096 ssl->handshake->alt_transform_out = ssl->transform_out;
3097
3098 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3099 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
3100 else
3101 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
3102
3103 mbedtls_ssl_set_timer( ssl, 0 );
3104 }
3105 #endif
3106
3107 /*
3108 * curve_list is translated to IANA TLS group identifiers here because
3109 * mbedtls_ssl_conf_curves returns void and so can't return
3110 * any error codes.
3111 */
3112 #if defined(MBEDTLS_ECP_C)
3113 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
3114 /* Heap allocate and translate curve_list from internal to IANA group ids */
3115 if ( ssl->conf->curve_list != NULL )
3116 {
3117 size_t length;
3118 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
3119
3120 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
3121 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
3122
3123 /* Leave room for zero termination */
3124 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
3125 if ( group_list == NULL )
3126 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3127
3128 for( size_t i = 0; i < length; i++ )
3129 {
3130 const mbedtls_ecp_curve_info *info =
3131 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
3132 if ( info == NULL )
3133 {
3134 mbedtls_free( group_list );
3135 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3136 }
3137 group_list[i] = info->tls_id;
3138 }
3139
3140 group_list[length] = 0;
3141
3142 ssl->handshake->group_list = group_list;
3143 ssl->handshake->group_list_heap_allocated = 1;
3144 }
3145 else
3146 {
3147 ssl->handshake->group_list = ssl->conf->group_list;
3148 ssl->handshake->group_list_heap_allocated = 0;
3149 }
3150 #endif /* MBEDTLS_DEPRECATED_REMOVED */
3151 #endif /* MBEDTLS_ECP_C */
3152
3153 return( 0 );
3154 }
3155
3156 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
3157 /* Dummy cookie callbacks for defaults */
ssl_cookie_write_dummy(void * ctx,unsigned char ** p,unsigned char * end,const unsigned char * cli_id,size_t cli_id_len)3158 static int ssl_cookie_write_dummy( void *ctx,
3159 unsigned char **p, unsigned char *end,
3160 const unsigned char *cli_id, size_t cli_id_len )
3161 {
3162 ((void) ctx);
3163 ((void) p);
3164 ((void) end);
3165 ((void) cli_id);
3166 ((void) cli_id_len);
3167
3168 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3169 }
3170
ssl_cookie_check_dummy(void * ctx,const unsigned char * cookie,size_t cookie_len,const unsigned char * cli_id,size_t cli_id_len)3171 static int ssl_cookie_check_dummy( void *ctx,
3172 const unsigned char *cookie, size_t cookie_len,
3173 const unsigned char *cli_id, size_t cli_id_len )
3174 {
3175 ((void) ctx);
3176 ((void) cookie);
3177 ((void) cookie_len);
3178 ((void) cli_id);
3179 ((void) cli_id_len);
3180
3181 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3182 }
3183 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
3184
3185 /*
3186 * Initialize an SSL context
3187 */
mbedtls_ssl_init(mbedtls_ssl_context * ssl)3188 void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
3189 {
3190 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
3191 }
3192
ssl_conf_version_check(const mbedtls_ssl_context * ssl)3193 static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
3194 {
3195 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3196 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
3197 {
3198 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3199 {
3200 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported" ) );
3201 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3202 }
3203 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
3204 return( 0 );
3205 }
3206 #endif
3207
3208 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3209 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
3210 {
3211 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
3212 return( 0 );
3213 }
3214 #endif
3215
3216 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
3217 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( ssl->conf ) )
3218 {
3219 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Hybrid TLS 1.2 + TLS 1.3 configurations are not yet supported" ) );
3220 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3221 }
3222 #endif
3223
3224 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
3225 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3226 }
3227
ssl_conf_check(const mbedtls_ssl_context * ssl)3228 static int ssl_conf_check(const mbedtls_ssl_context *ssl)
3229 {
3230 int ret;
3231 ret = ssl_conf_version_check( ssl );
3232 if( ret != 0 )
3233 return( ret );
3234
3235 /* Space for further checks */
3236
3237 return( 0 );
3238 }
3239
3240 /*
3241 * Setup an SSL context
3242 */
3243
mbedtls_ssl_setup(mbedtls_ssl_context * ssl,const mbedtls_ssl_config * conf)3244 int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
3245 const mbedtls_ssl_config *conf )
3246 {
3247 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3248 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3249 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3250
3251 ssl->conf = conf;
3252
3253 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
3254 return( ret );
3255
3256 /*
3257 * Prepare base structures
3258 */
3259
3260 /* Set to NULL in case of an error condition */
3261 ssl->out_buf = NULL;
3262
3263 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3264 ssl->in_buf_len = in_buf_len;
3265 #endif
3266 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
3267 if( ssl->in_buf == NULL )
3268 {
3269 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
3270 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
3271 goto error;
3272 }
3273
3274 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3275 ssl->out_buf_len = out_buf_len;
3276 #endif
3277 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
3278 if( ssl->out_buf == NULL )
3279 {
3280 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
3281 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
3282 goto error;
3283 }
3284
3285 mbedtls_ssl_reset_in_out_pointers( ssl );
3286
3287 #if defined(MBEDTLS_SSL_DTLS_SRTP)
3288 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
3289 #endif
3290
3291 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3292 goto error;
3293
3294 return( 0 );
3295
3296 error:
3297 mbedtls_free( ssl->in_buf );
3298 mbedtls_free( ssl->out_buf );
3299
3300 ssl->conf = NULL;
3301
3302 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3303 ssl->in_buf_len = 0;
3304 ssl->out_buf_len = 0;
3305 #endif
3306 ssl->in_buf = NULL;
3307 ssl->out_buf = NULL;
3308
3309 ssl->in_hdr = NULL;
3310 ssl->in_ctr = NULL;
3311 ssl->in_len = NULL;
3312 ssl->in_iv = NULL;
3313 ssl->in_msg = NULL;
3314
3315 ssl->out_hdr = NULL;
3316 ssl->out_ctr = NULL;
3317 ssl->out_len = NULL;
3318 ssl->out_iv = NULL;
3319 ssl->out_msg = NULL;
3320
3321 return( ret );
3322 }
3323
3324 /*
3325 * Reset an initialized and used SSL context for re-use while retaining
3326 * all application-set variables, function pointers and data.
3327 *
3328 * If partial is non-zero, keep data in the input buffer and client ID.
3329 * (Use when a DTLS client reconnects from the same port.)
3330 */
ssl_session_reset_msg_layer(mbedtls_ssl_context * ssl,int partial)3331 static void ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
3332 int partial )
3333 {
3334 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3335 size_t in_buf_len = ssl->in_buf_len;
3336 size_t out_buf_len = ssl->out_buf_len;
3337 #else
3338 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3339 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3340 #endif
3341
3342 #if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
3343 partial = 0;
3344 #endif
3345
3346 /* Cancel any possibly running timer */
3347 mbedtls_ssl_set_timer( ssl, 0 );
3348
3349 mbedtls_ssl_reset_in_out_pointers( ssl );
3350
3351 /* Reset incoming message parsing */
3352 ssl->in_offt = NULL;
3353 ssl->nb_zero = 0;
3354 ssl->in_msgtype = 0;
3355 ssl->in_msglen = 0;
3356 ssl->in_hslen = 0;
3357 ssl->keep_current_message = 0;
3358 ssl->transform_in = NULL;
3359
3360 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3361 ssl->next_record_offset = 0;
3362 ssl->in_epoch = 0;
3363 #endif
3364
3365 /* Keep current datagram if partial == 1 */
3366 if( partial == 0 )
3367 {
3368 ssl->in_left = 0;
3369 memset( ssl->in_buf, 0, in_buf_len );
3370 }
3371
3372 /* Reset outgoing message writing */
3373 ssl->out_msgtype = 0;
3374 ssl->out_msglen = 0;
3375 ssl->out_left = 0;
3376 memset( ssl->out_buf, 0, out_buf_len );
3377 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
3378 ssl->transform_out = NULL;
3379
3380 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3381 mbedtls_ssl_dtls_replay_reset( ssl );
3382 #endif
3383
3384 if( ssl->transform )
3385 {
3386 mbedtls_ssl_transform_free( ssl->transform );
3387 mbedtls_free( ssl->transform );
3388 ssl->transform = NULL;
3389 }
3390 }
3391
mbedtls_ssl_session_reset_int(mbedtls_ssl_context * ssl,int partial)3392 int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
3393 {
3394 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3395
3396 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3397
3398 ssl_session_reset_msg_layer( ssl, partial );
3399
3400 /* Reset renegotiation state */
3401 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3402 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
3403 ssl->renego_records_seen = 0;
3404
3405 ssl->verify_data_len = 0;
3406 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
3407 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
3408 #endif
3409 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
3410
3411 ssl->session_in = NULL;
3412 ssl->session_out = NULL;
3413 if( ssl->session )
3414 {
3415 mbedtls_ssl_session_free( ssl->session );
3416 mbedtls_free( ssl->session );
3417 ssl->session = NULL;
3418 }
3419
3420 #if defined(MBEDTLS_SSL_ALPN)
3421 ssl->alpn_chosen = NULL;
3422 #endif
3423
3424 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
3425 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
3426 if( partial == 0 )
3427 #endif
3428 {
3429 mbedtls_free( ssl->cli_id );
3430 ssl->cli_id = NULL;
3431 ssl->cli_id_len = 0;
3432 }
3433 #endif
3434
3435 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3436 return( ret );
3437
3438 return( 0 );
3439 }
3440
3441 /*
3442 * Reset an initialized and used SSL context for re-use while retaining
3443 * all application-set variables, function pointers and data.
3444 */
mbedtls_ssl_session_reset(mbedtls_ssl_context * ssl)3445 int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
3446 {
3447 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
3448 }
3449
3450 /*
3451 * SSL set accessors
3452 */
mbedtls_ssl_conf_endpoint(mbedtls_ssl_config * conf,int endpoint)3453 void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
3454 {
3455 conf->endpoint = endpoint;
3456 }
3457
mbedtls_ssl_conf_transport(mbedtls_ssl_config * conf,int transport)3458 void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
3459 {
3460 conf->transport = transport;
3461 }
3462
3463 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
mbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config * conf,char mode)3464 void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
3465 {
3466 conf->anti_replay = mode;
3467 }
3468 #endif
3469
mbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config * conf,unsigned limit)3470 void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
3471 {
3472 conf->badmac_limit = limit;
3473 }
3474
3475 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3476
mbedtls_ssl_set_datagram_packing(mbedtls_ssl_context * ssl,unsigned allow_packing)3477 void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
3478 unsigned allow_packing )
3479 {
3480 ssl->disable_datagram_packing = !allow_packing;
3481 }
3482
mbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config * conf,uint32_t min,uint32_t max)3483 void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
3484 uint32_t min, uint32_t max )
3485 {
3486 conf->hs_timeout_min = min;
3487 conf->hs_timeout_max = max;
3488 }
3489 #endif
3490
mbedtls_ssl_conf_authmode(mbedtls_ssl_config * conf,int authmode)3491 void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
3492 {
3493 conf->authmode = authmode;
3494 }
3495
3496 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_conf_verify(mbedtls_ssl_config * conf,int (* f_vrfy)(void *,mbedtls_x509_crt *,int,uint32_t *),void * p_vrfy)3497 void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
3498 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
3499 void *p_vrfy )
3500 {
3501 conf->f_vrfy = f_vrfy;
3502 conf->p_vrfy = p_vrfy;
3503 }
3504 #endif /* MBEDTLS_X509_CRT_PARSE_C */
3505
mbedtls_ssl_conf_rng(mbedtls_ssl_config * conf,int (* f_rng)(void *,unsigned char *,size_t),void * p_rng)3506 void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
3507 int (*f_rng)(void *, unsigned char *, size_t),
3508 void *p_rng )
3509 {
3510 conf->f_rng = f_rng;
3511 conf->p_rng = p_rng;
3512 }
3513
mbedtls_ssl_conf_dbg(mbedtls_ssl_config * conf,void (* f_dbg)(void *,int,const char *,int,const char *),void * p_dbg)3514 void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
3515 void (*f_dbg)(void *, int, const char *, int, const char *),
3516 void *p_dbg )
3517 {
3518 conf->f_dbg = f_dbg;
3519 conf->p_dbg = p_dbg;
3520 }
3521
mbedtls_ssl_set_bio(mbedtls_ssl_context * ssl,void * p_bio,mbedtls_ssl_send_t * f_send,mbedtls_ssl_recv_t * f_recv,mbedtls_ssl_recv_timeout_t * f_recv_timeout)3522 void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
3523 void *p_bio,
3524 mbedtls_ssl_send_t *f_send,
3525 mbedtls_ssl_recv_t *f_recv,
3526 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
3527 {
3528 ssl->p_bio = p_bio;
3529 ssl->f_send = f_send;
3530 ssl->f_recv = f_recv;
3531 ssl->f_recv_timeout = f_recv_timeout;
3532 }
3533
3534 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_set_mtu(mbedtls_ssl_context * ssl,uint16_t mtu)3535 void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
3536 {
3537 ssl->mtu = mtu;
3538 }
3539 #endif
3540
mbedtls_ssl_conf_read_timeout(mbedtls_ssl_config * conf,uint32_t timeout)3541 void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
3542 {
3543 conf->read_timeout = timeout;
3544 }
3545
mbedtls_ssl_set_timer_cb(mbedtls_ssl_context * ssl,void * p_timer,mbedtls_ssl_set_timer_t * f_set_timer,mbedtls_ssl_get_timer_t * f_get_timer)3546 void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
3547 void *p_timer,
3548 mbedtls_ssl_set_timer_t *f_set_timer,
3549 mbedtls_ssl_get_timer_t *f_get_timer )
3550 {
3551 ssl->p_timer = p_timer;
3552 ssl->f_set_timer = f_set_timer;
3553 ssl->f_get_timer = f_get_timer;
3554
3555 /* Make sure we start with no timer running */
3556 mbedtls_ssl_set_timer( ssl, 0 );
3557 }
3558
3559 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_session_cache(mbedtls_ssl_config * conf,void * p_cache,mbedtls_ssl_cache_get_t * f_get_cache,mbedtls_ssl_cache_set_t * f_set_cache)3560 void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
3561 void *p_cache,
3562 mbedtls_ssl_cache_get_t *f_get_cache,
3563 mbedtls_ssl_cache_set_t *f_set_cache )
3564 {
3565 conf->p_cache = p_cache;
3566 conf->f_get_cache = f_get_cache;
3567 conf->f_set_cache = f_set_cache;
3568 }
3569 #endif /* MBEDTLS_SSL_SRV_C */
3570
3571 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_set_session(mbedtls_ssl_context * ssl,const mbedtls_ssl_session * session)3572 int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
3573 {
3574 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3575
3576 if( ssl == NULL ||
3577 session == NULL ||
3578 ssl->session_negotiate == NULL ||
3579 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
3580 {
3581 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3582 }
3583
3584 if( ssl->handshake->resume == 1 )
3585 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3586
3587 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
3588 session ) ) != 0 )
3589 return( ret );
3590
3591 ssl->handshake->resume = 1;
3592
3593 return( 0 );
3594 }
3595 #endif /* MBEDTLS_SSL_CLI_C */
3596
mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config * conf,const int * ciphersuites)3597 void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
3598 const int *ciphersuites )
3599 {
3600 conf->ciphersuite_list = ciphersuites;
3601 }
3602
3603 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
mbedtls_ssl_conf_tls13_key_exchange_modes(mbedtls_ssl_config * conf,const int kex_modes)3604 void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
3605 const int kex_modes )
3606 {
3607 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
3608 }
3609 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3610
3611 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_conf_cert_profile(mbedtls_ssl_config * conf,const mbedtls_x509_crt_profile * profile)3612 void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
3613 const mbedtls_x509_crt_profile *profile )
3614 {
3615 conf->cert_profile = profile;
3616 }
3617
3618 /* Append a new keycert entry to a (possibly empty) list */
ssl_append_key_cert(mbedtls_ssl_key_cert ** head,mbedtls_x509_crt * cert,mbedtls_pk_context * key)3619 static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
3620 mbedtls_x509_crt *cert,
3621 mbedtls_pk_context *key )
3622 {
3623 mbedtls_ssl_key_cert *new_cert;
3624
3625 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
3626 if( new_cert == NULL )
3627 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3628
3629 new_cert->cert = cert;
3630 new_cert->key = key;
3631 new_cert->next = NULL;
3632
3633 /* Update head is the list was null, else add to the end */
3634 if( *head == NULL )
3635 {
3636 *head = new_cert;
3637 }
3638 else
3639 {
3640 mbedtls_ssl_key_cert *cur = *head;
3641 while( cur->next != NULL )
3642 cur = cur->next;
3643 cur->next = new_cert;
3644 }
3645
3646 return( 0 );
3647 }
3648
mbedtls_ssl_conf_own_cert(mbedtls_ssl_config * conf,mbedtls_x509_crt * own_cert,mbedtls_pk_context * pk_key)3649 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
3650 mbedtls_x509_crt *own_cert,
3651 mbedtls_pk_context *pk_key )
3652 {
3653 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
3654 }
3655
mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config * conf,mbedtls_x509_crt * ca_chain,mbedtls_x509_crl * ca_crl)3656 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
3657 mbedtls_x509_crt *ca_chain,
3658 mbedtls_x509_crl *ca_crl )
3659 {
3660 conf->ca_chain = ca_chain;
3661 conf->ca_crl = ca_crl;
3662
3663 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
3664 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
3665 * cannot be used together. */
3666 conf->f_ca_cb = NULL;
3667 conf->p_ca_cb = NULL;
3668 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
3669 }
3670
3671 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
mbedtls_ssl_conf_ca_cb(mbedtls_ssl_config * conf,mbedtls_x509_crt_ca_cb_t f_ca_cb,void * p_ca_cb)3672 void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
3673 mbedtls_x509_crt_ca_cb_t f_ca_cb,
3674 void *p_ca_cb )
3675 {
3676 conf->f_ca_cb = f_ca_cb;
3677 conf->p_ca_cb = p_ca_cb;
3678
3679 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
3680 * cannot be used together. */
3681 conf->ca_chain = NULL;
3682 conf->ca_crl = NULL;
3683 }
3684 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
3685 #endif /* MBEDTLS_X509_CRT_PARSE_C */
3686
3687 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context * ssl,mbedtls_x509_crt * own_cert,mbedtls_pk_context * pk_key)3688 int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
3689 mbedtls_x509_crt *own_cert,
3690 mbedtls_pk_context *pk_key )
3691 {
3692 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
3693 own_cert, pk_key ) );
3694 }
3695
mbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context * ssl,mbedtls_x509_crt * ca_chain,mbedtls_x509_crl * ca_crl)3696 void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
3697 mbedtls_x509_crt *ca_chain,
3698 mbedtls_x509_crl *ca_crl )
3699 {
3700 ssl->handshake->sni_ca_chain = ca_chain;
3701 ssl->handshake->sni_ca_crl = ca_crl;
3702 }
3703
mbedtls_ssl_set_hs_authmode(mbedtls_ssl_context * ssl,int authmode)3704 void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
3705 int authmode )
3706 {
3707 ssl->handshake->sni_authmode = authmode;
3708 }
3709 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
3710
3711 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_set_verify(mbedtls_ssl_context * ssl,int (* f_vrfy)(void *,mbedtls_x509_crt *,int,uint32_t *),void * p_vrfy)3712 void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
3713 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
3714 void *p_vrfy )
3715 {
3716 ssl->f_vrfy = f_vrfy;
3717 ssl->p_vrfy = p_vrfy;
3718 }
3719 #endif
3720
3721 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3722 /*
3723 * Set EC J-PAKE password for current handshake
3724 */
mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context * ssl,const unsigned char * pw,size_t pw_len)3725 int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
3726 const unsigned char *pw,
3727 size_t pw_len )
3728 {
3729 mbedtls_ecjpake_role role;
3730
3731 if( ssl->handshake == NULL || ssl->conf == NULL )
3732 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3733
3734 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
3735 role = MBEDTLS_ECJPAKE_SERVER;
3736 else
3737 role = MBEDTLS_ECJPAKE_CLIENT;
3738
3739 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
3740 role,
3741 MBEDTLS_MD_SHA256,
3742 MBEDTLS_ECP_DP_SECP256R1,
3743 pw, pw_len ) );
3744 }
3745 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
3746
3747 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
3748
ssl_conf_psk_is_configured(mbedtls_ssl_config const * conf)3749 static int ssl_conf_psk_is_configured( mbedtls_ssl_config const *conf )
3750 {
3751 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3752 if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
3753 return( 1 );
3754 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3755
3756 if( conf->psk != NULL )
3757 return( 1 );
3758
3759 return( 0 );
3760 }
3761
ssl_conf_remove_psk(mbedtls_ssl_config * conf)3762 static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
3763 {
3764 /* Remove reference to existing PSK, if any. */
3765 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3766 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
3767 {
3768 /* The maintenance of the PSK key slot is the
3769 * user's responsibility. */
3770 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
3771 }
3772 /* This and the following branch should never
3773 * be taken simultaenously as we maintain the
3774 * invariant that raw and opaque PSKs are never
3775 * configured simultaneously. As a safeguard,
3776 * though, `else` is omitted here. */
3777 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3778 if( conf->psk != NULL )
3779 {
3780 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
3781
3782 mbedtls_free( conf->psk );
3783 conf->psk = NULL;
3784 conf->psk_len = 0;
3785 }
3786
3787 /* Remove reference to PSK identity, if any. */
3788 if( conf->psk_identity != NULL )
3789 {
3790 mbedtls_free( conf->psk_identity );
3791 conf->psk_identity = NULL;
3792 conf->psk_identity_len = 0;
3793 }
3794 }
3795
3796 /* This function assumes that PSK identity in the SSL config is unset.
3797 * It checks that the provided identity is well-formed and attempts
3798 * to make a copy of it in the SSL config.
3799 * On failure, the PSK identity in the config remains unset. */
ssl_conf_set_psk_identity(mbedtls_ssl_config * conf,unsigned char const * psk_identity,size_t psk_identity_len)3800 static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
3801 unsigned char const *psk_identity,
3802 size_t psk_identity_len )
3803 {
3804 /* Identity len will be encoded on two bytes */
3805 if( psk_identity == NULL ||
3806 ( psk_identity_len >> 16 ) != 0 ||
3807 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
3808 {
3809 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3810 }
3811
3812 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
3813 if( conf->psk_identity == NULL )
3814 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3815
3816 conf->psk_identity_len = psk_identity_len;
3817 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
3818
3819 return( 0 );
3820 }
3821
mbedtls_ssl_conf_psk(mbedtls_ssl_config * conf,const unsigned char * psk,size_t psk_len,const unsigned char * psk_identity,size_t psk_identity_len)3822 int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
3823 const unsigned char *psk, size_t psk_len,
3824 const unsigned char *psk_identity, size_t psk_identity_len )
3825 {
3826 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3827
3828 /* We currently only support one PSK, raw or opaque. */
3829 if( ssl_conf_psk_is_configured( conf ) )
3830 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3831
3832 /* Check and set raw PSK */
3833 if( psk == NULL )
3834 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3835 if( psk_len == 0 )
3836 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3837 if( psk_len > MBEDTLS_PSK_MAX_LEN )
3838 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3839
3840 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
3841 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3842 conf->psk_len = psk_len;
3843 memcpy( conf->psk, psk, conf->psk_len );
3844
3845 /* Check and set PSK Identity */
3846 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
3847 if( ret != 0 )
3848 ssl_conf_remove_psk( conf );
3849
3850 return( ret );
3851 }
3852
ssl_remove_psk(mbedtls_ssl_context * ssl)3853 static void ssl_remove_psk( mbedtls_ssl_context *ssl )
3854 {
3855 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3856 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
3857 {
3858 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
3859 }
3860 else
3861 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3862 if( ssl->handshake->psk != NULL )
3863 {
3864 mbedtls_platform_zeroize( ssl->handshake->psk,
3865 ssl->handshake->psk_len );
3866 mbedtls_free( ssl->handshake->psk );
3867 ssl->handshake->psk_len = 0;
3868 }
3869 }
3870
mbedtls_ssl_set_hs_psk(mbedtls_ssl_context * ssl,const unsigned char * psk,size_t psk_len)3871 int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
3872 const unsigned char *psk, size_t psk_len )
3873 {
3874 if( psk == NULL || ssl->handshake == NULL )
3875 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3876
3877 if( psk_len > MBEDTLS_PSK_MAX_LEN )
3878 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3879
3880 ssl_remove_psk( ssl );
3881
3882 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
3883 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3884
3885 ssl->handshake->psk_len = psk_len;
3886 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
3887
3888 return( 0 );
3889 }
3890
3891 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config * conf,psa_key_id_t psk,const unsigned char * psk_identity,size_t psk_identity_len)3892 int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
3893 psa_key_id_t psk,
3894 const unsigned char *psk_identity,
3895 size_t psk_identity_len )
3896 {
3897 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3898
3899 /* We currently only support one PSK, raw or opaque. */
3900 if( ssl_conf_psk_is_configured( conf ) )
3901 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3902
3903 /* Check and set opaque PSK */
3904 if( mbedtls_svc_key_id_is_null( psk ) )
3905 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3906 conf->psk_opaque = psk;
3907
3908 /* Check and set PSK Identity */
3909 ret = ssl_conf_set_psk_identity( conf, psk_identity,
3910 psk_identity_len );
3911 if( ret != 0 )
3912 ssl_conf_remove_psk( conf );
3913
3914 return( ret );
3915 }
3916
mbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context * ssl,psa_key_id_t psk)3917 int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
3918 psa_key_id_t psk )
3919 {
3920 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
3921 ( ssl->handshake == NULL ) )
3922 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3923
3924 ssl_remove_psk( ssl );
3925 ssl->handshake->psk_opaque = psk;
3926 return( 0 );
3927 }
3928 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3929
mbedtls_ssl_conf_psk_cb(mbedtls_ssl_config * conf,int (* f_psk)(void *,mbedtls_ssl_context *,const unsigned char *,size_t),void * p_psk)3930 void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
3931 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
3932 size_t),
3933 void *p_psk )
3934 {
3935 conf->f_psk = f_psk;
3936 conf->p_psk = p_psk;
3937 }
3938 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
3939
3940 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config * conf,const unsigned char * dhm_P,size_t P_len,const unsigned char * dhm_G,size_t G_len)3941 int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
3942 const unsigned char *dhm_P, size_t P_len,
3943 const unsigned char *dhm_G, size_t G_len )
3944 {
3945 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3946
3947 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
3948 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
3949 {
3950 mbedtls_mpi_free( &conf->dhm_P );
3951 mbedtls_mpi_free( &conf->dhm_G );
3952 return( ret );
3953 }
3954
3955 return( 0 );
3956 }
3957
mbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config * conf,mbedtls_dhm_context * dhm_ctx)3958 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
3959 {
3960 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3961
3962 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
3963 &conf->dhm_P ) ) != 0 ||
3964 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
3965 &conf->dhm_G ) ) != 0 )
3966 {
3967 mbedtls_mpi_free( &conf->dhm_P );
3968 mbedtls_mpi_free( &conf->dhm_G );
3969 return( ret );
3970 }
3971
3972 return( 0 );
3973 }
3974 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
3975
3976 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
3977 /*
3978 * Set the minimum length for Diffie-Hellman parameters
3979 */
mbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config * conf,unsigned int bitlen)3980 void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
3981 unsigned int bitlen )
3982 {
3983 conf->dhm_min_bitlen = bitlen;
3984 }
3985 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
3986
3987 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3988 /*
3989 * Set allowed/preferred hashes for handshake signatures
3990 */
mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config * conf,const int * hashes)3991 void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
3992 const int *hashes )
3993 {
3994 conf->sig_hashes = hashes;
3995 }
3996
3997 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3998 /* Configure allowed signature algorithms for use in TLS 1.3 */
mbedtls_ssl_conf_sig_algs(mbedtls_ssl_config * conf,const uint16_t * sig_algs)3999 void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
4000 const uint16_t* sig_algs )
4001 {
4002 conf->tls13_sig_algs = sig_algs;
4003 }
4004 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
4005 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4006
4007 #if defined(MBEDTLS_ECP_C)
4008 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
4009 /*
4010 * Set the allowed elliptic curves
4011 *
4012 * mbedtls_ssl_setup() takes the provided list
4013 * and translates it to a list of IANA TLS group identifiers,
4014 * stored in ssl->handshake->group_list.
4015 *
4016 */
mbedtls_ssl_conf_curves(mbedtls_ssl_config * conf,const mbedtls_ecp_group_id * curve_list)4017 void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
4018 const mbedtls_ecp_group_id *curve_list )
4019 {
4020 conf->curve_list = curve_list;
4021 conf->group_list = NULL;
4022 }
4023 #endif /* MBEDTLS_DEPRECATED_REMOVED */
4024 #endif /* MBEDTLS_ECP_C */
4025
4026 /*
4027 * Set the allowed groups
4028 */
mbedtls_ssl_conf_groups(mbedtls_ssl_config * conf,const uint16_t * group_list)4029 void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
4030 const uint16_t *group_list )
4031 {
4032 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4033 conf->curve_list = NULL;
4034 #endif
4035 conf->group_list = group_list;
4036 }
4037
4038 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_set_hostname(mbedtls_ssl_context * ssl,const char * hostname)4039 int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
4040 {
4041 /* Initialize to suppress unnecessary compiler warning */
4042 size_t hostname_len = 0;
4043
4044 /* Check if new hostname is valid before
4045 * making any change to current one */
4046 if( hostname != NULL )
4047 {
4048 hostname_len = strlen( hostname );
4049
4050 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
4051 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4052 }
4053
4054 /* Now it's clear that we will overwrite the old hostname,
4055 * so we can free it safely */
4056
4057 if( ssl->hostname != NULL )
4058 {
4059 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
4060 mbedtls_free( ssl->hostname );
4061 }
4062
4063 /* Passing NULL as hostname shall clear the old one */
4064
4065 if( hostname == NULL )
4066 {
4067 ssl->hostname = NULL;
4068 }
4069 else
4070 {
4071 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
4072 if( ssl->hostname == NULL )
4073 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4074
4075 memcpy( ssl->hostname, hostname, hostname_len );
4076
4077 ssl->hostname[hostname_len] = '\0';
4078 }
4079
4080 return( 0 );
4081 }
4082 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4083
4084 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedtls_ssl_conf_sni(mbedtls_ssl_config * conf,int (* f_sni)(void *,mbedtls_ssl_context *,const unsigned char *,size_t),void * p_sni)4085 void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
4086 int (*f_sni)(void *, mbedtls_ssl_context *,
4087 const unsigned char *, size_t),
4088 void *p_sni )
4089 {
4090 conf->f_sni = f_sni;
4091 conf->p_sni = p_sni;
4092 }
4093 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
4094
4095 #if defined(MBEDTLS_SSL_ALPN)
mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config * conf,const char ** protos)4096 int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
4097 {
4098 size_t cur_len, tot_len;
4099 const char **p;
4100
4101 /*
4102 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
4103 * MUST NOT be truncated."
4104 * We check lengths now rather than later.
4105 */
4106 tot_len = 0;
4107 for( p = protos; *p != NULL; p++ )
4108 {
4109 cur_len = strlen( *p );
4110 tot_len += cur_len;
4111
4112 if( ( cur_len == 0 ) ||
4113 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
4114 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
4115 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4116 }
4117
4118 conf->alpn_list = protos;
4119
4120 return( 0 );
4121 }
4122
mbedtls_ssl_get_alpn_protocol(const mbedtls_ssl_context * ssl)4123 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
4124 {
4125 return( ssl->alpn_chosen );
4126 }
4127 #endif /* MBEDTLS_SSL_ALPN */
4128
4129 #if defined(MBEDTLS_SSL_DTLS_SRTP)
mbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config * conf,int support_mki_value)4130 void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
4131 int support_mki_value )
4132 {
4133 conf->dtls_srtp_mki_support = support_mki_value;
4134 }
4135
mbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context * ssl,unsigned char * mki_value,uint16_t mki_len)4136 int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
4137 unsigned char *mki_value,
4138 uint16_t mki_len )
4139 {
4140 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
4141 {
4142 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4143 }
4144
4145 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
4146 {
4147 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4148 }
4149
4150 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
4151 ssl->dtls_srtp_info.mki_len = mki_len;
4152 return( 0 );
4153 }
4154
mbedtls_ssl_conf_dtls_srtp_protection_profiles(mbedtls_ssl_config * conf,const mbedtls_ssl_srtp_profile * profiles)4155 int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
4156 const mbedtls_ssl_srtp_profile *profiles )
4157 {
4158 const mbedtls_ssl_srtp_profile *p;
4159 size_t list_size = 0;
4160
4161 /* check the profiles list: all entry must be valid,
4162 * its size cannot be more than the total number of supported profiles, currently 4 */
4163 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
4164 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
4165 p++ )
4166 {
4167 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
4168 {
4169 list_size++;
4170 }
4171 else
4172 {
4173 /* unsupported value, stop parsing and set the size to an error value */
4174 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
4175 }
4176 }
4177
4178 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
4179 {
4180 conf->dtls_srtp_profile_list = NULL;
4181 conf->dtls_srtp_profile_list_len = 0;
4182 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4183 }
4184
4185 conf->dtls_srtp_profile_list = profiles;
4186 conf->dtls_srtp_profile_list_len = list_size;
4187
4188 return( 0 );
4189 }
4190
mbedtls_ssl_get_dtls_srtp_negotiation_result(const mbedtls_ssl_context * ssl,mbedtls_dtls_srtp_info * dtls_srtp_info)4191 void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
4192 mbedtls_dtls_srtp_info *dtls_srtp_info )
4193 {
4194 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
4195 /* do not copy the mki value if there is no chosen profile */
4196 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
4197 {
4198 dtls_srtp_info->mki_len = 0;
4199 }
4200 else
4201 {
4202 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
4203 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
4204 ssl->dtls_srtp_info.mki_len );
4205 }
4206 }
4207 #endif /* MBEDTLS_SSL_DTLS_SRTP */
4208
mbedtls_ssl_conf_max_version(mbedtls_ssl_config * conf,int major,int minor)4209 void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
4210 {
4211 conf->max_major_ver = major;
4212 conf->max_minor_ver = minor;
4213 }
4214
mbedtls_ssl_conf_min_version(mbedtls_ssl_config * conf,int major,int minor)4215 void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
4216 {
4217 conf->min_major_ver = major;
4218 conf->min_minor_ver = minor;
4219 }
4220
4221 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config * conf,char cert_req_ca_list)4222 void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
4223 char cert_req_ca_list )
4224 {
4225 conf->cert_req_ca_list = cert_req_ca_list;
4226 }
4227 #endif
4228
4229 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
mbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config * conf,char etm)4230 void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
4231 {
4232 conf->encrypt_then_mac = etm;
4233 }
4234 #endif
4235
4236 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
mbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config * conf,char ems)4237 void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
4238 {
4239 conf->extended_ms = ems;
4240 }
4241 #endif
4242
4243 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config * conf,unsigned char mfl_code)4244 int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
4245 {
4246 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
4247 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
4248 {
4249 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4250 }
4251
4252 conf->mfl_code = mfl_code;
4253
4254 return( 0 );
4255 }
4256 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4257
mbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config * conf,int allow_legacy)4258 void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
4259 {
4260 conf->allow_legacy_renegotiation = allow_legacy;
4261 }
4262
4263 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config * conf,int renegotiation)4264 void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
4265 {
4266 conf->disable_renegotiation = renegotiation;
4267 }
4268
mbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config * conf,int max_records)4269 void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
4270 {
4271 conf->renego_max_records = max_records;
4272 }
4273
mbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config * conf,const unsigned char period[8])4274 void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
4275 const unsigned char period[8] )
4276 {
4277 memcpy( conf->renego_period, period, 8 );
4278 }
4279 #endif /* MBEDTLS_SSL_RENEGOTIATION */
4280
4281 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4282 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_conf_session_tickets(mbedtls_ssl_config * conf,int use_tickets)4283 void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
4284 {
4285 conf->session_tickets = use_tickets;
4286 }
4287 #endif
4288
4289 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config * conf,mbedtls_ssl_ticket_write_t * f_ticket_write,mbedtls_ssl_ticket_parse_t * f_ticket_parse,void * p_ticket)4290 void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
4291 mbedtls_ssl_ticket_write_t *f_ticket_write,
4292 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
4293 void *p_ticket )
4294 {
4295 conf->f_ticket_write = f_ticket_write;
4296 conf->f_ticket_parse = f_ticket_parse;
4297 conf->p_ticket = p_ticket;
4298 }
4299 #endif
4300 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4301
mbedtls_ssl_set_export_keys_cb(mbedtls_ssl_context * ssl,mbedtls_ssl_export_keys_t * f_export_keys,void * p_export_keys)4302 void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
4303 mbedtls_ssl_export_keys_t *f_export_keys,
4304 void *p_export_keys )
4305 {
4306 ssl->f_export_keys = f_export_keys;
4307 ssl->p_export_keys = p_export_keys;
4308 }
4309
4310 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
mbedtls_ssl_conf_async_private_cb(mbedtls_ssl_config * conf,mbedtls_ssl_async_sign_t * f_async_sign,mbedtls_ssl_async_decrypt_t * f_async_decrypt,mbedtls_ssl_async_resume_t * f_async_resume,mbedtls_ssl_async_cancel_t * f_async_cancel,void * async_config_data)4311 void mbedtls_ssl_conf_async_private_cb(
4312 mbedtls_ssl_config *conf,
4313 mbedtls_ssl_async_sign_t *f_async_sign,
4314 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
4315 mbedtls_ssl_async_resume_t *f_async_resume,
4316 mbedtls_ssl_async_cancel_t *f_async_cancel,
4317 void *async_config_data )
4318 {
4319 conf->f_async_sign_start = f_async_sign;
4320 conf->f_async_decrypt_start = f_async_decrypt;
4321 conf->f_async_resume = f_async_resume;
4322 conf->f_async_cancel = f_async_cancel;
4323 conf->p_async_config_data = async_config_data;
4324 }
4325
mbedtls_ssl_conf_get_async_config_data(const mbedtls_ssl_config * conf)4326 void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
4327 {
4328 return( conf->p_async_config_data );
4329 }
4330
mbedtls_ssl_get_async_operation_data(const mbedtls_ssl_context * ssl)4331 void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
4332 {
4333 if( ssl->handshake == NULL )
4334 return( NULL );
4335 else
4336 return( ssl->handshake->user_async_ctx );
4337 }
4338
mbedtls_ssl_set_async_operation_data(mbedtls_ssl_context * ssl,void * ctx)4339 void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
4340 void *ctx )
4341 {
4342 if( ssl->handshake != NULL )
4343 ssl->handshake->user_async_ctx = ctx;
4344 }
4345 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
4346
4347 /*
4348 * SSL get accessors
4349 */
mbedtls_ssl_get_verify_result(const mbedtls_ssl_context * ssl)4350 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
4351 {
4352 if( ssl->session != NULL )
4353 return( ssl->session->verify_result );
4354
4355 if( ssl->session_negotiate != NULL )
4356 return( ssl->session_negotiate->verify_result );
4357
4358 return( 0xFFFFFFFF );
4359 }
4360
mbedtls_ssl_get_ciphersuite(const mbedtls_ssl_context * ssl)4361 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
4362 {
4363 if( ssl == NULL || ssl->session == NULL )
4364 return( NULL );
4365
4366 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
4367 }
4368
mbedtls_ssl_get_version(const mbedtls_ssl_context * ssl)4369 const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
4370 {
4371 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4372 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4373 {
4374 switch( ssl->minor_ver )
4375 {
4376 case MBEDTLS_SSL_MINOR_VERSION_3:
4377 return( "DTLSv1.2" );
4378
4379 default:
4380 return( "unknown (DTLS)" );
4381 }
4382 }
4383 #endif
4384
4385 switch( ssl->minor_ver )
4386 {
4387 case MBEDTLS_SSL_MINOR_VERSION_3:
4388 return( "TLSv1.2" );
4389
4390 default:
4391 return( "unknown" );
4392 }
4393 }
4394
4395 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context * ssl)4396 size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
4397 {
4398 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
4399 size_t read_mfl;
4400
4401 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
4402 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
4403 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
4404 {
4405 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
4406 }
4407
4408 /* Check if a smaller max length was negotiated */
4409 if( ssl->session_out != NULL )
4410 {
4411 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
4412 if( read_mfl < max_len )
4413 {
4414 max_len = read_mfl;
4415 }
4416 }
4417
4418 // During a handshake, use the value being negotiated
4419 if( ssl->session_negotiate != NULL )
4420 {
4421 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
4422 if( read_mfl < max_len )
4423 {
4424 max_len = read_mfl;
4425 }
4426 }
4427
4428 return( max_len );
4429 }
4430
mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context * ssl)4431 size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
4432 {
4433 size_t max_len;
4434
4435 /*
4436 * Assume mfl_code is correct since it was checked when set
4437 */
4438 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
4439
4440 /* Check if a smaller max length was negotiated */
4441 if( ssl->session_out != NULL &&
4442 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
4443 {
4444 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
4445 }
4446
4447 /* During a handshake, use the value being negotiated */
4448 if( ssl->session_negotiate != NULL &&
4449 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
4450 {
4451 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
4452 }
4453
4454 return( max_len );
4455 }
4456 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4457
4458 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context * ssl)4459 size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
4460 {
4461 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
4462 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
4463 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
4464 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
4465 return ( 0 );
4466
4467 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
4468 return( ssl->mtu );
4469
4470 if( ssl->mtu == 0 )
4471 return( ssl->handshake->mtu );
4472
4473 return( ssl->mtu < ssl->handshake->mtu ?
4474 ssl->mtu : ssl->handshake->mtu );
4475 }
4476 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4477
mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context * ssl)4478 int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
4479 {
4480 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
4481
4482 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
4483 !defined(MBEDTLS_SSL_PROTO_DTLS)
4484 (void) ssl;
4485 #endif
4486
4487 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4488 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
4489
4490 if( max_len > mfl )
4491 max_len = mfl;
4492 #endif
4493
4494 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4495 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
4496 {
4497 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
4498 const int ret = mbedtls_ssl_get_record_expansion( ssl );
4499 const size_t overhead = (size_t) ret;
4500
4501 if( ret < 0 )
4502 return( ret );
4503
4504 if( mtu <= overhead )
4505 {
4506 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
4507 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4508 }
4509
4510 if( max_len > mtu - overhead )
4511 max_len = mtu - overhead;
4512 }
4513 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4514
4515 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
4516 !defined(MBEDTLS_SSL_PROTO_DTLS)
4517 ((void) ssl);
4518 #endif
4519
4520 return( (int) max_len );
4521 }
4522
mbedtls_ssl_get_max_in_record_payload(const mbedtls_ssl_context * ssl)4523 int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
4524 {
4525 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
4526
4527 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4528 (void) ssl;
4529 #endif
4530
4531 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4532 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
4533
4534 if( max_len > mfl )
4535 max_len = mfl;
4536 #endif
4537
4538 return( (int) max_len );
4539 }
4540
4541 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_get_peer_cert(const mbedtls_ssl_context * ssl)4542 const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
4543 {
4544 if( ssl == NULL || ssl->session == NULL )
4545 return( NULL );
4546
4547 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4548 return( ssl->session->peer_cert );
4549 #else
4550 return( NULL );
4551 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4552 }
4553 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4554
4555 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_get_session(const mbedtls_ssl_context * ssl,mbedtls_ssl_session * dst)4556 int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
4557 mbedtls_ssl_session *dst )
4558 {
4559 int ret;
4560
4561 if( ssl == NULL ||
4562 dst == NULL ||
4563 ssl->session == NULL ||
4564 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
4565 {
4566 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4567 }
4568
4569 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
4570 * idempotent: Each session can only be exported once.
4571 *
4572 * (This is in preparation for TLS 1.3 support where we will
4573 * need the ability to export multiple sessions (aka tickets),
4574 * which will be achieved by calling mbedtls_ssl_get_session()
4575 * multiple times until it fails.)
4576 *
4577 * Check whether we have already exported the current session,
4578 * and fail if so.
4579 */
4580 if( ssl->session->exported == 1 )
4581 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4582
4583 ret = mbedtls_ssl_session_copy( dst, ssl->session );
4584 if( ret != 0 )
4585 return( ret );
4586
4587 /* Remember that we've exported the session. */
4588 ssl->session->exported = 1;
4589 return( 0 );
4590 }
4591 #endif /* MBEDTLS_SSL_CLI_C */
4592
4593 /*
4594 * Define ticket header determining Mbed TLS version
4595 * and structure of the ticket.
4596 */
4597
4598 /*
4599 * Define bitflag determining compile-time settings influencing
4600 * structure of serialized SSL sessions.
4601 */
4602
4603 #if defined(MBEDTLS_HAVE_TIME)
4604 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
4605 #else
4606 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
4607 #endif /* MBEDTLS_HAVE_TIME */
4608
4609 #if defined(MBEDTLS_X509_CRT_PARSE_C)
4610 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
4611 #else
4612 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
4613 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4614
4615 #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
4616 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
4617 #else
4618 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
4619 #endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
4620
4621 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4622 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
4623 #else
4624 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
4625 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4626
4627 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4628 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
4629 #else
4630 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
4631 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
4632
4633 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4634 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
4635 #else
4636 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
4637 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4638
4639 #define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
4640 #define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
4641 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
4642 #define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
4643 #define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
4644 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
4645
4646 #define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
4647 ( (uint16_t) ( \
4648 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
4649 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
4650 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
4651 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
4652 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
4653 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
4654
4655 static unsigned char ssl_serialized_session_header[] = {
4656 MBEDTLS_VERSION_MAJOR,
4657 MBEDTLS_VERSION_MINOR,
4658 MBEDTLS_VERSION_PATCH,
4659 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
4660 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
4661 };
4662
4663 /*
4664 * Serialize a session in the following format:
4665 * (in the presentation language of TLS, RFC 8446 section 3)
4666 *
4667 * struct {
4668 *
4669 * opaque mbedtls_version[3]; // library version: major, minor, patch
4670 * opaque session_format[2]; // library-version specific 16-bit field
4671 * // determining the format of the remaining
4672 * // serialized data.
4673 *
4674 * Note: When updating the format, remember to keep
4675 * these version+format bytes.
4676 *
4677 * // In this version, `session_format` determines
4678 * // the setting of those compile-time
4679 * // configuration options which influence
4680 * // the structure of mbedtls_ssl_session.
4681 *
4682 * uint8_t minor_ver; // Protocol-version. Possible values:
4683 * // - TLS 1.2 (MBEDTLS_SSL_MINOR_VERSION_3)
4684 *
4685 * select (serialized_session.minor_ver) {
4686 *
4687 * case MBEDTLS_SSL_MINOR_VERSION_3: // TLS 1.2
4688 * serialized_session_tls12 data;
4689 *
4690 * };
4691 *
4692 * } serialized_session;
4693 *
4694 */
4695
4696 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4697 /* Serialization of TLS 1.2 sessions:
4698 *
4699 * struct {
4700 * uint64 start_time;
4701 * uint8 ciphersuite[2]; // defined by the standard
4702 * uint8 compression; // 0 or 1
4703 * uint8 session_id_len; // at most 32
4704 * opaque session_id[32];
4705 * opaque master[48]; // fixed length in the standard
4706 * uint32 verify_result;
4707 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
4708 * opaque ticket<0..2^24-1>; // length 0 means no ticket
4709 * uint32 ticket_lifetime;
4710 * uint8 mfl_code; // up to 255 according to standard
4711 * uint8 encrypt_then_mac; // 0 or 1
4712 * } serialized_session_tls12;
4713 *
4714 */
ssl_session_save_tls12(const mbedtls_ssl_session * session,unsigned char * buf,size_t buf_len)4715 static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
4716 unsigned char *buf,
4717 size_t buf_len )
4718 {
4719 unsigned char *p = buf;
4720 size_t used = 0;
4721
4722 #if defined(MBEDTLS_HAVE_TIME)
4723 uint64_t start;
4724 #endif
4725 #if defined(MBEDTLS_X509_CRT_PARSE_C)
4726 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4727 size_t cert_len;
4728 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4729 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4730
4731 /*
4732 * Time
4733 */
4734 #if defined(MBEDTLS_HAVE_TIME)
4735 used += 8;
4736
4737 if( used <= buf_len )
4738 {
4739 start = (uint64_t) session->start;
4740
4741 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
4742 p += 8;
4743 }
4744 #endif /* MBEDTLS_HAVE_TIME */
4745
4746 /*
4747 * Basic mandatory fields
4748 */
4749 used += 2 /* ciphersuite */
4750 + 1 /* compression */
4751 + 1 /* id_len */
4752 + sizeof( session->id )
4753 + sizeof( session->master )
4754 + 4; /* verify_result */
4755
4756 if( used <= buf_len )
4757 {
4758 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
4759 p += 2;
4760
4761 *p++ = MBEDTLS_BYTE_0( session->compression );
4762
4763 *p++ = MBEDTLS_BYTE_0( session->id_len );
4764 memcpy( p, session->id, 32 );
4765 p += 32;
4766
4767 memcpy( p, session->master, 48 );
4768 p += 48;
4769
4770 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
4771 p += 4;
4772 }
4773
4774 /*
4775 * Peer's end-entity certificate
4776 */
4777 #if defined(MBEDTLS_X509_CRT_PARSE_C)
4778 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4779 if( session->peer_cert == NULL )
4780 cert_len = 0;
4781 else
4782 cert_len = session->peer_cert->raw.len;
4783
4784 used += 3 + cert_len;
4785
4786 if( used <= buf_len )
4787 {
4788 *p++ = MBEDTLS_BYTE_2( cert_len );
4789 *p++ = MBEDTLS_BYTE_1( cert_len );
4790 *p++ = MBEDTLS_BYTE_0( cert_len );
4791
4792 if( session->peer_cert != NULL )
4793 {
4794 memcpy( p, session->peer_cert->raw.p, cert_len );
4795 p += cert_len;
4796 }
4797 }
4798 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4799 if( session->peer_cert_digest != NULL )
4800 {
4801 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
4802 if( used <= buf_len )
4803 {
4804 *p++ = (unsigned char) session->peer_cert_digest_type;
4805 *p++ = (unsigned char) session->peer_cert_digest_len;
4806 memcpy( p, session->peer_cert_digest,
4807 session->peer_cert_digest_len );
4808 p += session->peer_cert_digest_len;
4809 }
4810 }
4811 else
4812 {
4813 used += 2;
4814 if( used <= buf_len )
4815 {
4816 *p++ = (unsigned char) MBEDTLS_MD_NONE;
4817 *p++ = 0;
4818 }
4819 }
4820 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4821 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4822
4823 /*
4824 * Session ticket if any, plus associated data
4825 */
4826 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
4827 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
4828
4829 if( used <= buf_len )
4830 {
4831 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
4832 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
4833 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
4834
4835 if( session->ticket != NULL )
4836 {
4837 memcpy( p, session->ticket, session->ticket_len );
4838 p += session->ticket_len;
4839 }
4840
4841 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
4842 p += 4;
4843 }
4844 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
4845
4846 /*
4847 * Misc extension-related info
4848 */
4849 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4850 used += 1;
4851
4852 if( used <= buf_len )
4853 *p++ = session->mfl_code;
4854 #endif
4855
4856 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4857 used += 1;
4858
4859 if( used <= buf_len )
4860 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
4861 #endif
4862
4863 return( used );
4864 }
4865 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4866
ssl_session_save(const mbedtls_ssl_session * session,unsigned char omit_header,unsigned char * buf,size_t buf_len,size_t * olen)4867 static int ssl_session_save( const mbedtls_ssl_session *session,
4868 unsigned char omit_header,
4869 unsigned char *buf,
4870 size_t buf_len,
4871 size_t *olen )
4872 {
4873 unsigned char *p = buf;
4874 size_t used = 0;
4875
4876 if( !omit_header )
4877 {
4878 /*
4879 * Add Mbed TLS version identifier
4880 */
4881
4882 used += sizeof( ssl_serialized_session_header );
4883
4884 if( used <= buf_len )
4885 {
4886 memcpy( p, ssl_serialized_session_header,
4887 sizeof( ssl_serialized_session_header ) );
4888 p += sizeof( ssl_serialized_session_header );
4889 }
4890 }
4891
4892 /*
4893 * TLS version identifier
4894 */
4895 used += 1;
4896 if( used <= buf_len )
4897 {
4898 *p++ = session->minor_ver;
4899 }
4900
4901 /* Forward to version-specific serialization routine. */
4902 switch( session->minor_ver )
4903 {
4904 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4905 case MBEDTLS_SSL_MINOR_VERSION_3:
4906 {
4907 size_t remaining_len = used <= buf_len ? buf_len - used : 0;
4908 used += ssl_session_save_tls12( session, p, remaining_len );
4909 break;
4910 }
4911 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4912
4913 default:
4914 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4915 }
4916
4917 *olen = used;
4918 if( used > buf_len )
4919 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
4920
4921 return( 0 );
4922 }
4923
4924 /*
4925 * Public wrapper for ssl_session_save()
4926 */
mbedtls_ssl_session_save(const mbedtls_ssl_session * session,unsigned char * buf,size_t buf_len,size_t * olen)4927 int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
4928 unsigned char *buf,
4929 size_t buf_len,
4930 size_t *olen )
4931 {
4932 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
4933 }
4934
4935 /*
4936 * Deserialize session, see mbedtls_ssl_session_save() for format.
4937 *
4938 * This internal version is wrapped by a public function that cleans up in
4939 * case of error, and has an extra option omit_header.
4940 */
ssl_session_load_tls12(mbedtls_ssl_session * session,const unsigned char * buf,size_t len)4941 static int ssl_session_load_tls12( mbedtls_ssl_session *session,
4942 const unsigned char *buf,
4943 size_t len )
4944 {
4945 #if defined(MBEDTLS_HAVE_TIME)
4946 uint64_t start;
4947 #endif
4948 #if defined(MBEDTLS_X509_CRT_PARSE_C)
4949 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4950 size_t cert_len;
4951 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4952 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4953
4954 const unsigned char *p = buf;
4955 const unsigned char * const end = buf + len;
4956
4957 /*
4958 * Time
4959 */
4960 #if defined(MBEDTLS_HAVE_TIME)
4961 if( 8 > (size_t)( end - p ) )
4962 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4963
4964 start = ( (uint64_t) p[0] << 56 ) |
4965 ( (uint64_t) p[1] << 48 ) |
4966 ( (uint64_t) p[2] << 40 ) |
4967 ( (uint64_t) p[3] << 32 ) |
4968 ( (uint64_t) p[4] << 24 ) |
4969 ( (uint64_t) p[5] << 16 ) |
4970 ( (uint64_t) p[6] << 8 ) |
4971 ( (uint64_t) p[7] );
4972 p += 8;
4973
4974 session->start = (time_t) start;
4975 #endif /* MBEDTLS_HAVE_TIME */
4976
4977 /*
4978 * Basic mandatory fields
4979 */
4980 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
4981 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4982
4983 session->ciphersuite = ( p[0] << 8 ) | p[1];
4984 p += 2;
4985
4986 session->compression = *p++;
4987
4988 session->id_len = *p++;
4989 memcpy( session->id, p, 32 );
4990 p += 32;
4991
4992 memcpy( session->master, p, 48 );
4993 p += 48;
4994
4995 session->verify_result = ( (uint32_t) p[0] << 24 ) |
4996 ( (uint32_t) p[1] << 16 ) |
4997 ( (uint32_t) p[2] << 8 ) |
4998 ( (uint32_t) p[3] );
4999 p += 4;
5000
5001 /* Immediately clear invalid pointer values that have been read, in case
5002 * we exit early before we replaced them with valid ones. */
5003 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5004 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5005 session->peer_cert = NULL;
5006 #else
5007 session->peer_cert_digest = NULL;
5008 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5009 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5010 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5011 session->ticket = NULL;
5012 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5013
5014 /*
5015 * Peer certificate
5016 */
5017 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5018 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5019 /* Deserialize CRT from the end of the ticket. */
5020 if( 3 > (size_t)( end - p ) )
5021 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5022
5023 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5024 p += 3;
5025
5026 if( cert_len != 0 )
5027 {
5028 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5029
5030 if( cert_len > (size_t)( end - p ) )
5031 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5032
5033 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
5034
5035 if( session->peer_cert == NULL )
5036 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5037
5038 mbedtls_x509_crt_init( session->peer_cert );
5039
5040 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
5041 p, cert_len ) ) != 0 )
5042 {
5043 mbedtls_x509_crt_free( session->peer_cert );
5044 mbedtls_free( session->peer_cert );
5045 session->peer_cert = NULL;
5046 return( ret );
5047 }
5048
5049 p += cert_len;
5050 }
5051 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5052 /* Deserialize CRT digest from the end of the ticket. */
5053 if( 2 > (size_t)( end - p ) )
5054 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5055
5056 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
5057 session->peer_cert_digest_len = (size_t) *p++;
5058
5059 if( session->peer_cert_digest_len != 0 )
5060 {
5061 const mbedtls_md_info_t *md_info =
5062 mbedtls_md_info_from_type( session->peer_cert_digest_type );
5063 if( md_info == NULL )
5064 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5065 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
5066 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5067
5068 if( session->peer_cert_digest_len > (size_t)( end - p ) )
5069 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5070
5071 session->peer_cert_digest =
5072 mbedtls_calloc( 1, session->peer_cert_digest_len );
5073 if( session->peer_cert_digest == NULL )
5074 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5075
5076 memcpy( session->peer_cert_digest, p,
5077 session->peer_cert_digest_len );
5078 p += session->peer_cert_digest_len;
5079 }
5080 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5081 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5082
5083 /*
5084 * Session ticket and associated data
5085 */
5086 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5087 if( 3 > (size_t)( end - p ) )
5088 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5089
5090 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5091 p += 3;
5092
5093 if( session->ticket_len != 0 )
5094 {
5095 if( session->ticket_len > (size_t)( end - p ) )
5096 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5097
5098 session->ticket = mbedtls_calloc( 1, session->ticket_len );
5099 if( session->ticket == NULL )
5100 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5101
5102 memcpy( session->ticket, p, session->ticket_len );
5103 p += session->ticket_len;
5104 }
5105
5106 if( 4 > (size_t)( end - p ) )
5107 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5108
5109 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
5110 ( (uint32_t) p[1] << 16 ) |
5111 ( (uint32_t) p[2] << 8 ) |
5112 ( (uint32_t) p[3] );
5113 p += 4;
5114 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5115
5116 /*
5117 * Misc extension-related info
5118 */
5119 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5120 if( 1 > (size_t)( end - p ) )
5121 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5122
5123 session->mfl_code = *p++;
5124 #endif
5125
5126 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5127 if( 1 > (size_t)( end - p ) )
5128 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5129
5130 session->encrypt_then_mac = *p++;
5131 #endif
5132
5133 /* Done, should have consumed entire buffer */
5134 if( p != end )
5135 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5136
5137 return( 0 );
5138 }
5139
ssl_session_load(mbedtls_ssl_session * session,unsigned char omit_header,const unsigned char * buf,size_t len)5140 static int ssl_session_load( mbedtls_ssl_session *session,
5141 unsigned char omit_header,
5142 const unsigned char *buf,
5143 size_t len )
5144 {
5145 const unsigned char *p = buf;
5146 const unsigned char * const end = buf + len;
5147
5148 if( !omit_header )
5149 {
5150 /*
5151 * Check Mbed TLS version identifier
5152 */
5153
5154 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
5155 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5156
5157 if( memcmp( p, ssl_serialized_session_header,
5158 sizeof( ssl_serialized_session_header ) ) != 0 )
5159 {
5160 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
5161 }
5162 p += sizeof( ssl_serialized_session_header );
5163 }
5164
5165 /*
5166 * TLS version identifier
5167 */
5168 if( 1 > (size_t)( end - p ) )
5169 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5170 session->minor_ver = *p++;
5171
5172 /* Dispatch according to TLS version. */
5173 switch( session->minor_ver )
5174 {
5175 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5176 case MBEDTLS_SSL_MINOR_VERSION_3: /* TLS 1.2 */
5177 {
5178 size_t remaining_len = ( end - p );
5179 return( ssl_session_load_tls12( session, p, remaining_len ) );
5180 }
5181 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5182
5183 default:
5184 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5185 }
5186 }
5187
5188 /*
5189 * Deserialize session: public wrapper for error cleaning
5190 */
mbedtls_ssl_session_load(mbedtls_ssl_session * session,const unsigned char * buf,size_t len)5191 int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
5192 const unsigned char *buf,
5193 size_t len )
5194 {
5195 int ret = ssl_session_load( session, 0, buf, len );
5196
5197 if( ret != 0 )
5198 mbedtls_ssl_session_free( session );
5199
5200 return( ret );
5201 }
5202
5203 /*
5204 * Perform a single step of the SSL handshake
5205 */
ssl_prepare_handshake_step(mbedtls_ssl_context * ssl)5206 static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
5207 {
5208 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5209
5210 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
5211 return( ret );
5212
5213 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5214 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5215 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
5216 {
5217 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
5218 return( ret );
5219 }
5220 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5221
5222 return( ret );
5223 }
5224
mbedtls_ssl_handshake_step(mbedtls_ssl_context * ssl)5225 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
5226 {
5227 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5228
5229 if( ssl == NULL ||
5230 ssl->conf == NULL ||
5231 ssl->handshake == NULL ||
5232 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
5233 {
5234 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5235 }
5236
5237 ret = ssl_prepare_handshake_step( ssl );
5238 if( ret != 0 )
5239 return( ret );
5240
5241 ret = mbedtls_ssl_handle_pending_alert( ssl );
5242 if( ret != 0 )
5243 goto cleanup;
5244
5245 #if defined(MBEDTLS_SSL_CLI_C)
5246 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5247 {
5248 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
5249 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
5250 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
5251 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
5252
5253 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5254 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
5255 ret = mbedtls_ssl_handshake_client_step( ssl );
5256 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5257 }
5258 #endif
5259 #if defined(MBEDTLS_SSL_SRV_C)
5260 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5261 {
5262 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
5263 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
5264 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
5265 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
5266
5267 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5268 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
5269 ret = mbedtls_ssl_handshake_server_step( ssl );
5270 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5271 }
5272 #endif
5273
5274 if( ret != 0 )
5275 {
5276 /* handshake_step return error. And it is same
5277 * with alert_reason.
5278 */
5279 if( ssl->send_alert )
5280 {
5281 ret = mbedtls_ssl_handle_pending_alert( ssl );
5282 goto cleanup;
5283 }
5284 }
5285
5286 cleanup:
5287 return( ret );
5288 }
5289
5290 /*
5291 * Perform the SSL handshake
5292 */
mbedtls_ssl_handshake(mbedtls_ssl_context * ssl)5293 int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
5294 {
5295 int ret = 0;
5296
5297 /* Sanity checks */
5298
5299 if( ssl == NULL || ssl->conf == NULL )
5300 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5301
5302 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5303 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5304 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
5305 {
5306 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
5307 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
5308 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5309 }
5310 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5311
5312 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
5313
5314 /* Main handshake loop */
5315 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5316 {
5317 ret = mbedtls_ssl_handshake_step( ssl );
5318
5319 if( ret != 0 )
5320 break;
5321 }
5322
5323 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
5324
5325 return( ret );
5326 }
5327
5328 #if defined(MBEDTLS_SSL_RENEGOTIATION)
5329 #if defined(MBEDTLS_SSL_SRV_C)
5330 /*
5331 * Write HelloRequest to request renegotiation on server
5332 */
ssl_write_hello_request(mbedtls_ssl_context * ssl)5333 static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
5334 {
5335 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5336
5337 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
5338
5339 ssl->out_msglen = 4;
5340 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5341 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
5342
5343 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
5344 {
5345 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
5346 return( ret );
5347 }
5348
5349 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
5350
5351 return( 0 );
5352 }
5353 #endif /* MBEDTLS_SSL_SRV_C */
5354
5355 /*
5356 * Actually renegotiate current connection, triggered by either:
5357 * - any side: calling mbedtls_ssl_renegotiate(),
5358 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
5359 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
5360 * the initial handshake is completed.
5361 * If the handshake doesn't complete due to waiting for I/O, it will continue
5362 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
5363 */
mbedtls_ssl_start_renegotiation(mbedtls_ssl_context * ssl)5364 int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
5365 {
5366 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5367
5368 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
5369
5370 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
5371 return( ret );
5372
5373 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
5374 * the ServerHello will have message_seq = 1" */
5375 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5376 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5377 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
5378 {
5379 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5380 ssl->handshake->out_msg_seq = 1;
5381 else
5382 ssl->handshake->in_msg_seq = 1;
5383 }
5384 #endif
5385
5386 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
5387 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
5388
5389 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
5390 {
5391 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
5392 return( ret );
5393 }
5394
5395 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
5396
5397 return( 0 );
5398 }
5399
5400 /*
5401 * Renegotiate current connection on client,
5402 * or request renegotiation on server
5403 */
mbedtls_ssl_renegotiate(mbedtls_ssl_context * ssl)5404 int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
5405 {
5406 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5407
5408 if( ssl == NULL || ssl->conf == NULL )
5409 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5410
5411 #if defined(MBEDTLS_SSL_SRV_C)
5412 /* On server, just send the request */
5413 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5414 {
5415 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5416 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5417
5418 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
5419
5420 /* Did we already try/start sending HelloRequest? */
5421 if( ssl->out_left != 0 )
5422 return( mbedtls_ssl_flush_output( ssl ) );
5423
5424 return( ssl_write_hello_request( ssl ) );
5425 }
5426 #endif /* MBEDTLS_SSL_SRV_C */
5427
5428 #if defined(MBEDTLS_SSL_CLI_C)
5429 /*
5430 * On client, either start the renegotiation process or,
5431 * if already in progress, continue the handshake
5432 */
5433 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
5434 {
5435 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5436 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5437
5438 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
5439 {
5440 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
5441 return( ret );
5442 }
5443 }
5444 else
5445 {
5446 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
5447 {
5448 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
5449 return( ret );
5450 }
5451 }
5452 #endif /* MBEDTLS_SSL_CLI_C */
5453
5454 return( ret );
5455 }
5456 #endif /* MBEDTLS_SSL_RENEGOTIATION */
5457
5458 #if defined(MBEDTLS_X509_CRT_PARSE_C)
ssl_key_cert_free(mbedtls_ssl_key_cert * key_cert)5459 static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
5460 {
5461 mbedtls_ssl_key_cert *cur = key_cert, *next;
5462
5463 while( cur != NULL )
5464 {
5465 next = cur->next;
5466 mbedtls_free( cur );
5467 cur = next;
5468 }
5469 }
5470 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5471
mbedtls_ssl_handshake_free(mbedtls_ssl_context * ssl)5472 void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
5473 {
5474 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
5475
5476 if( handshake == NULL )
5477 return;
5478
5479 #if defined(MBEDTLS_ECP_C)
5480 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
5481 if ( ssl->handshake->group_list_heap_allocated )
5482 mbedtls_free( (void*) handshake->group_list );
5483 handshake->group_list = NULL;
5484 #endif /* MBEDTLS_DEPRECATED_REMOVED */
5485 #endif /* MBEDTLS_ECP_C */
5486
5487 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
5488 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
5489 {
5490 ssl->conf->f_async_cancel( ssl );
5491 handshake->async_in_progress = 0;
5492 }
5493 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
5494
5495 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5496 #if defined(MBEDTLS_SHA256_C)
5497 #if defined(MBEDTLS_USE_PSA_CRYPTO)
5498 psa_hash_abort( &handshake->fin_sha256_psa );
5499 #else
5500 mbedtls_sha256_free( &handshake->fin_sha256 );
5501 #endif
5502 #endif
5503 #if defined(MBEDTLS_SHA384_C)
5504 #if defined(MBEDTLS_USE_PSA_CRYPTO)
5505 psa_hash_abort( &handshake->fin_sha384_psa );
5506 #else
5507 mbedtls_sha512_free( &handshake->fin_sha512 );
5508 #endif
5509 #endif
5510 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5511
5512 #if defined(MBEDTLS_DHM_C)
5513 mbedtls_dhm_free( &handshake->dhm_ctx );
5514 #endif
5515 #if defined(MBEDTLS_ECDH_C)
5516 mbedtls_ecdh_free( &handshake->ecdh_ctx );
5517 #endif
5518 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
5519 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
5520 #if defined(MBEDTLS_SSL_CLI_C)
5521 mbedtls_free( handshake->ecjpake_cache );
5522 handshake->ecjpake_cache = NULL;
5523 handshake->ecjpake_cache_len = 0;
5524 #endif
5525 #endif
5526
5527 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
5528 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
5529 /* explicit void pointer cast for buggy MS compiler */
5530 mbedtls_free( (void *) handshake->curves );
5531 #endif
5532
5533 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
5534 if( handshake->psk != NULL )
5535 {
5536 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
5537 mbedtls_free( handshake->psk );
5538 }
5539 #endif
5540
5541 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
5542 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
5543 /*
5544 * Free only the linked list wrapper, not the keys themselves
5545 * since the belong to the SNI callback
5546 */
5547 if( handshake->sni_key_cert != NULL )
5548 {
5549 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
5550
5551 while( cur != NULL )
5552 {
5553 next = cur->next;
5554 mbedtls_free( cur );
5555 cur = next;
5556 }
5557 }
5558 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
5559
5560 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
5561 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
5562 if( handshake->ecrs_peer_cert != NULL )
5563 {
5564 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
5565 mbedtls_free( handshake->ecrs_peer_cert );
5566 }
5567 #endif
5568
5569 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
5570 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5571 mbedtls_pk_free( &handshake->peer_pubkey );
5572 #endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5573
5574 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5575 mbedtls_free( handshake->verify_cookie );
5576 mbedtls_ssl_flight_free( handshake->flight );
5577 mbedtls_ssl_buffering_free( ssl );
5578 #endif
5579
5580 #if defined(MBEDTLS_ECDH_C) && \
5581 defined(MBEDTLS_USE_PSA_CRYPTO)
5582 psa_destroy_key( handshake->ecdh_psa_privkey );
5583 #endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
5584
5585 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
5586 mbedtls_ssl_transform_free( handshake->transform_handshake );
5587 mbedtls_ssl_transform_free( handshake->transform_earlydata );
5588 mbedtls_free( handshake->transform_earlydata );
5589 mbedtls_free( handshake->transform_handshake );
5590 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
5591
5592
5593 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
5594 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
5595 * processes datagrams and the fact that a datagram is allowed to have
5596 * several records in it, it is possible that the I/O buffers are not
5597 * empty at this stage */
5598 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
5599 mbedtls_ssl_get_output_buflen( ssl ) );
5600 #endif
5601
5602 /* mbedtls_platform_zeroize MUST be last one in this function */
5603 mbedtls_platform_zeroize( handshake,
5604 sizeof( mbedtls_ssl_handshake_params ) );
5605 }
5606
mbedtls_ssl_session_free(mbedtls_ssl_session * session)5607 void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
5608 {
5609 if( session == NULL )
5610 return;
5611
5612 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5613 ssl_clear_peer_cert( session );
5614 #endif
5615
5616 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5617 mbedtls_free( session->ticket );
5618 #endif
5619
5620 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
5621 }
5622
5623 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
5624
5625 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5626 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
5627 #else
5628 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
5629 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5630
5631 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
5632
5633 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5634 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
5635 #else
5636 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
5637 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5638
5639 #if defined(MBEDTLS_SSL_ALPN)
5640 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
5641 #else
5642 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
5643 #endif /* MBEDTLS_SSL_ALPN */
5644
5645 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
5646 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
5647 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
5648 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
5649
5650 #define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
5651 ( (uint32_t) ( \
5652 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
5653 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
5654 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
5655 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
5656 0u ) )
5657
5658 static unsigned char ssl_serialized_context_header[] = {
5659 MBEDTLS_VERSION_MAJOR,
5660 MBEDTLS_VERSION_MINOR,
5661 MBEDTLS_VERSION_PATCH,
5662 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5663 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5664 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5665 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5666 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5667 };
5668
5669 /*
5670 * Serialize a full SSL context
5671 *
5672 * The format of the serialized data is:
5673 * (in the presentation language of TLS, RFC 8446 section 3)
5674 *
5675 * // header
5676 * opaque mbedtls_version[3]; // major, minor, patch
5677 * opaque context_format[5]; // version-specific field determining
5678 * // the format of the remaining
5679 * // serialized data.
5680 * Note: When updating the format, remember to keep these
5681 * version+format bytes. (We may make their size part of the API.)
5682 *
5683 * // session sub-structure
5684 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
5685 * // transform sub-structure
5686 * uint8 random[64]; // ServerHello.random+ClientHello.random
5687 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
5688 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
5689 * // fields from ssl_context
5690 * uint32 badmac_seen; // DTLS: number of records with failing MAC
5691 * uint64 in_window_top; // DTLS: last validated record seq_num
5692 * uint64 in_window; // DTLS: bitmask for replay protection
5693 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
5694 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
5695 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
5696 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
5697 *
5698 * Note that many fields of the ssl_context or sub-structures are not
5699 * serialized, as they fall in one of the following categories:
5700 *
5701 * 1. forced value (eg in_left must be 0)
5702 * 2. pointer to dynamically-allocated memory (eg session, transform)
5703 * 3. value can be re-derived from other data (eg session keys from MS)
5704 * 4. value was temporary (eg content of input buffer)
5705 * 5. value will be provided by the user again (eg I/O callbacks and context)
5706 */
mbedtls_ssl_context_save(mbedtls_ssl_context * ssl,unsigned char * buf,size_t buf_len,size_t * olen)5707 int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
5708 unsigned char *buf,
5709 size_t buf_len,
5710 size_t *olen )
5711 {
5712 unsigned char *p = buf;
5713 size_t used = 0;
5714 size_t session_len;
5715 int ret = 0;
5716
5717 /*
5718 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
5719 * this function's documentation.
5720 *
5721 * These are due to assumptions/limitations in the implementation. Some of
5722 * them are likely to stay (no handshake in progress) some might go away
5723 * (only DTLS) but are currently used to simplify the implementation.
5724 */
5725 /* The initial handshake must be over */
5726 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5727 {
5728 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
5729 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5730 }
5731 if( ssl->handshake != NULL )
5732 {
5733 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
5734 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5735 }
5736 /* Double-check that sub-structures are indeed ready */
5737 if( ssl->transform == NULL || ssl->session == NULL )
5738 {
5739 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
5740 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5741 }
5742 /* There must be no pending incoming or outgoing data */
5743 if( mbedtls_ssl_check_pending( ssl ) != 0 )
5744 {
5745 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
5746 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5747 }
5748 if( ssl->out_left != 0 )
5749 {
5750 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
5751 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5752 }
5753 /* Protocol must be DLTS, not TLS */
5754 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5755 {
5756 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
5757 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5758 }
5759 /* Version must be 1.2 */
5760 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
5761 {
5762 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
5763 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5764 }
5765 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
5766 {
5767 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
5768 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5769 }
5770 /* We must be using an AEAD ciphersuite */
5771 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
5772 {
5773 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
5774 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5775 }
5776 /* Renegotiation must not be enabled */
5777 #if defined(MBEDTLS_SSL_RENEGOTIATION)
5778 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
5779 {
5780 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
5781 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5782 }
5783 #endif
5784
5785 /*
5786 * Version and format identifier
5787 */
5788 used += sizeof( ssl_serialized_context_header );
5789
5790 if( used <= buf_len )
5791 {
5792 memcpy( p, ssl_serialized_context_header,
5793 sizeof( ssl_serialized_context_header ) );
5794 p += sizeof( ssl_serialized_context_header );
5795 }
5796
5797 /*
5798 * Session (length + data)
5799 */
5800 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
5801 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
5802 return( ret );
5803
5804 used += 4 + session_len;
5805 if( used <= buf_len )
5806 {
5807 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
5808 p += 4;
5809
5810 ret = ssl_session_save( ssl->session, 1,
5811 p, session_len, &session_len );
5812 if( ret != 0 )
5813 return( ret );
5814
5815 p += session_len;
5816 }
5817
5818 /*
5819 * Transform
5820 */
5821 used += sizeof( ssl->transform->randbytes );
5822 if( used <= buf_len )
5823 {
5824 memcpy( p, ssl->transform->randbytes,
5825 sizeof( ssl->transform->randbytes ) );
5826 p += sizeof( ssl->transform->randbytes );
5827 }
5828
5829 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5830 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
5831 if( used <= buf_len )
5832 {
5833 *p++ = ssl->transform->in_cid_len;
5834 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
5835 p += ssl->transform->in_cid_len;
5836
5837 *p++ = ssl->transform->out_cid_len;
5838 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
5839 p += ssl->transform->out_cid_len;
5840 }
5841 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5842
5843 /*
5844 * Saved fields from top-level ssl_context structure
5845 */
5846 used += 4;
5847 if( used <= buf_len )
5848 {
5849 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
5850 p += 4;
5851 }
5852
5853 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5854 used += 16;
5855 if( used <= buf_len )
5856 {
5857 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
5858 p += 8;
5859
5860 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
5861 p += 8;
5862 }
5863 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5864
5865 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5866 used += 1;
5867 if( used <= buf_len )
5868 {
5869 *p++ = ssl->disable_datagram_packing;
5870 }
5871 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5872
5873 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
5874 if( used <= buf_len )
5875 {
5876 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
5877 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
5878 }
5879
5880 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5881 used += 2;
5882 if( used <= buf_len )
5883 {
5884 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
5885 p += 2;
5886 }
5887 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5888
5889 #if defined(MBEDTLS_SSL_ALPN)
5890 {
5891 const uint8_t alpn_len = ssl->alpn_chosen
5892 ? (uint8_t) strlen( ssl->alpn_chosen )
5893 : 0;
5894
5895 used += 1 + alpn_len;
5896 if( used <= buf_len )
5897 {
5898 *p++ = alpn_len;
5899
5900 if( ssl->alpn_chosen != NULL )
5901 {
5902 memcpy( p, ssl->alpn_chosen, alpn_len );
5903 p += alpn_len;
5904 }
5905 }
5906 }
5907 #endif /* MBEDTLS_SSL_ALPN */
5908
5909 /*
5910 * Done
5911 */
5912 *olen = used;
5913
5914 if( used > buf_len )
5915 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5916
5917 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
5918
5919 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
5920 }
5921
5922 /*
5923 * Helper to get TLS 1.2 PRF from ciphersuite
5924 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
5925 */
5926 typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
5927 const char *label,
5928 const unsigned char *random, size_t rlen,
5929 unsigned char *dstbuf, size_t dlen );
ssl_tls12prf_from_cs(int ciphersuite_id)5930 static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
5931 {
5932 #if defined(MBEDTLS_SHA384_C)
5933 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5934 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
5935
5936 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
5937 return( tls_prf_sha384 );
5938 #else
5939 (void) ciphersuite_id;
5940 #endif
5941 return( tls_prf_sha256 );
5942 }
5943
5944 /*
5945 * Deserialize context, see mbedtls_ssl_context_save() for format.
5946 *
5947 * This internal version is wrapped by a public function that cleans up in
5948 * case of error.
5949 */
ssl_context_load(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)5950 static int ssl_context_load( mbedtls_ssl_context *ssl,
5951 const unsigned char *buf,
5952 size_t len )
5953 {
5954 const unsigned char *p = buf;
5955 const unsigned char * const end = buf + len;
5956 size_t session_len;
5957 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5958
5959 /*
5960 * The context should have been freshly setup or reset.
5961 * Give the user an error in case of obvious misuse.
5962 * (Checking session is useful because it won't be NULL if we're
5963 * renegotiating, or if the user mistakenly loaded a session first.)
5964 */
5965 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
5966 ssl->session != NULL )
5967 {
5968 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5969 }
5970
5971 /*
5972 * We can't check that the config matches the initial one, but we can at
5973 * least check it matches the requirements for serializing.
5974 */
5975 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
5976 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
5977 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 ||
5978 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ||
5979 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 ||
5980 #if defined(MBEDTLS_SSL_RENEGOTIATION)
5981 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
5982 #endif
5983 0 )
5984 {
5985 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5986 }
5987
5988 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
5989
5990 /*
5991 * Check version identifier
5992 */
5993 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
5994 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5995
5996 if( memcmp( p, ssl_serialized_context_header,
5997 sizeof( ssl_serialized_context_header ) ) != 0 )
5998 {
5999 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
6000 }
6001 p += sizeof( ssl_serialized_context_header );
6002
6003 /*
6004 * Session
6005 */
6006 if( (size_t)( end - p ) < 4 )
6007 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6008
6009 session_len = ( (size_t) p[0] << 24 ) |
6010 ( (size_t) p[1] << 16 ) |
6011 ( (size_t) p[2] << 8 ) |
6012 ( (size_t) p[3] );
6013 p += 4;
6014
6015 /* This has been allocated by ssl_handshake_init(), called by
6016 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
6017 ssl->session = ssl->session_negotiate;
6018 ssl->session_in = ssl->session;
6019 ssl->session_out = ssl->session;
6020 ssl->session_negotiate = NULL;
6021
6022 if( (size_t)( end - p ) < session_len )
6023 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6024
6025 ret = ssl_session_load( ssl->session, 1, p, session_len );
6026 if( ret != 0 )
6027 {
6028 mbedtls_ssl_session_free( ssl->session );
6029 return( ret );
6030 }
6031
6032 p += session_len;
6033
6034 /*
6035 * Transform
6036 */
6037
6038 /* This has been allocated by ssl_handshake_init(), called by
6039 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
6040 ssl->transform = ssl->transform_negotiate;
6041 ssl->transform_in = ssl->transform;
6042 ssl->transform_out = ssl->transform;
6043 ssl->transform_negotiate = NULL;
6044
6045 /* Read random bytes and populate structure */
6046 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
6047 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6048
6049 ret = ssl_tls12_populate_transform( ssl->transform,
6050 ssl->session->ciphersuite,
6051 ssl->session->master,
6052 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
6053 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6054 ssl->session->encrypt_then_mac,
6055 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
6056 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
6057 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
6058 p, /* currently pointing to randbytes */
6059 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
6060 ssl->conf->endpoint,
6061 ssl );
6062 if( ret != 0 )
6063 return( ret );
6064
6065 p += sizeof( ssl->transform->randbytes );
6066
6067 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6068 /* Read connection IDs and store them */
6069 if( (size_t)( end - p ) < 1 )
6070 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6071
6072 ssl->transform->in_cid_len = *p++;
6073
6074 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
6075 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6076
6077 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
6078 p += ssl->transform->in_cid_len;
6079
6080 ssl->transform->out_cid_len = *p++;
6081
6082 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
6083 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6084
6085 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
6086 p += ssl->transform->out_cid_len;
6087 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6088
6089 /*
6090 * Saved fields from top-level ssl_context structure
6091 */
6092 if( (size_t)( end - p ) < 4 )
6093 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6094
6095 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
6096 ( (uint32_t) p[1] << 16 ) |
6097 ( (uint32_t) p[2] << 8 ) |
6098 ( (uint32_t) p[3] );
6099 p += 4;
6100
6101 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6102 if( (size_t)( end - p ) < 16 )
6103 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6104
6105 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
6106 ( (uint64_t) p[1] << 48 ) |
6107 ( (uint64_t) p[2] << 40 ) |
6108 ( (uint64_t) p[3] << 32 ) |
6109 ( (uint64_t) p[4] << 24 ) |
6110 ( (uint64_t) p[5] << 16 ) |
6111 ( (uint64_t) p[6] << 8 ) |
6112 ( (uint64_t) p[7] );
6113 p += 8;
6114
6115 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
6116 ( (uint64_t) p[1] << 48 ) |
6117 ( (uint64_t) p[2] << 40 ) |
6118 ( (uint64_t) p[3] << 32 ) |
6119 ( (uint64_t) p[4] << 24 ) |
6120 ( (uint64_t) p[5] << 16 ) |
6121 ( (uint64_t) p[6] << 8 ) |
6122 ( (uint64_t) p[7] );
6123 p += 8;
6124 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6125
6126 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6127 if( (size_t)( end - p ) < 1 )
6128 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6129
6130 ssl->disable_datagram_packing = *p++;
6131 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6132
6133 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
6134 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6135 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
6136 p += sizeof( ssl->cur_out_ctr );
6137
6138 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6139 if( (size_t)( end - p ) < 2 )
6140 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6141
6142 ssl->mtu = ( p[0] << 8 ) | p[1];
6143 p += 2;
6144 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6145
6146 #if defined(MBEDTLS_SSL_ALPN)
6147 {
6148 uint8_t alpn_len;
6149 const char **cur;
6150
6151 if( (size_t)( end - p ) < 1 )
6152 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6153
6154 alpn_len = *p++;
6155
6156 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
6157 {
6158 /* alpn_chosen should point to an item in the configured list */
6159 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
6160 {
6161 if( strlen( *cur ) == alpn_len &&
6162 memcmp( p, cur, alpn_len ) == 0 )
6163 {
6164 ssl->alpn_chosen = *cur;
6165 break;
6166 }
6167 }
6168 }
6169
6170 /* can only happen on conf mismatch */
6171 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
6172 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6173
6174 p += alpn_len;
6175 }
6176 #endif /* MBEDTLS_SSL_ALPN */
6177
6178 /*
6179 * Forced fields from top-level ssl_context structure
6180 *
6181 * Most of them already set to the correct value by mbedtls_ssl_init() and
6182 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
6183 */
6184 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
6185
6186 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6187 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6188
6189 /* Adjust pointers for header fields of outgoing records to
6190 * the given transform, accounting for explicit IV and CID. */
6191 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
6192
6193 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6194 ssl->in_epoch = 1;
6195 #endif
6196
6197 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
6198 * which we don't want - otherwise we'd end up freeing the wrong transform
6199 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
6200 * inappropriately. */
6201 if( ssl->handshake != NULL )
6202 {
6203 mbedtls_ssl_handshake_free( ssl );
6204 mbedtls_free( ssl->handshake );
6205 ssl->handshake = NULL;
6206 }
6207
6208 /*
6209 * Done - should have consumed entire buffer
6210 */
6211 if( p != end )
6212 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6213
6214 return( 0 );
6215 }
6216
6217 /*
6218 * Deserialize context: public wrapper for error cleaning
6219 */
mbedtls_ssl_context_load(mbedtls_ssl_context * context,const unsigned char * buf,size_t len)6220 int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
6221 const unsigned char *buf,
6222 size_t len )
6223 {
6224 int ret = ssl_context_load( context, buf, len );
6225
6226 if( ret != 0 )
6227 mbedtls_ssl_free( context );
6228
6229 return( ret );
6230 }
6231 #endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
6232
6233 /*
6234 * Free an SSL context
6235 */
mbedtls_ssl_free(mbedtls_ssl_context * ssl)6236 void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
6237 {
6238 if( ssl == NULL )
6239 return;
6240
6241 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
6242
6243 if( ssl->out_buf != NULL )
6244 {
6245 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6246 size_t out_buf_len = ssl->out_buf_len;
6247 #else
6248 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
6249 #endif
6250
6251 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
6252 mbedtls_free( ssl->out_buf );
6253 ssl->out_buf = NULL;
6254 }
6255
6256 if( ssl->in_buf != NULL )
6257 {
6258 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6259 size_t in_buf_len = ssl->in_buf_len;
6260 #else
6261 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6262 #endif
6263
6264 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
6265 mbedtls_free( ssl->in_buf );
6266 ssl->in_buf = NULL;
6267 }
6268
6269 if( ssl->transform )
6270 {
6271 mbedtls_ssl_transform_free( ssl->transform );
6272 mbedtls_free( ssl->transform );
6273 }
6274
6275 if( ssl->handshake )
6276 {
6277 mbedtls_ssl_handshake_free( ssl );
6278 mbedtls_ssl_transform_free( ssl->transform_negotiate );
6279 mbedtls_ssl_session_free( ssl->session_negotiate );
6280
6281 mbedtls_free( ssl->handshake );
6282 mbedtls_free( ssl->transform_negotiate );
6283 mbedtls_free( ssl->session_negotiate );
6284 }
6285
6286 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6287 mbedtls_ssl_transform_free( ssl->transform_application );
6288 mbedtls_free( ssl->transform_application );
6289 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6290
6291 if( ssl->session )
6292 {
6293 mbedtls_ssl_session_free( ssl->session );
6294 mbedtls_free( ssl->session );
6295 }
6296
6297 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6298 if( ssl->hostname != NULL )
6299 {
6300 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
6301 mbedtls_free( ssl->hostname );
6302 }
6303 #endif
6304
6305 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6306 mbedtls_free( ssl->cli_id );
6307 #endif
6308
6309 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
6310
6311 /* Actually clear after last debug message */
6312 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
6313 }
6314
6315 /*
6316 * Initialze mbedtls_ssl_config
6317 */
mbedtls_ssl_config_init(mbedtls_ssl_config * conf)6318 void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
6319 {
6320 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
6321 }
6322
6323 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6324 /* The selection should be the same as mbedtls_x509_crt_profile_default in
6325 * x509_crt.c. Here, the order matters. Currently we favor stronger hashes,
6326 * for no fundamental reason.
6327 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
6328 * about this list. */
6329 static int ssl_preset_default_hashes[] = {
6330 #if defined(MBEDTLS_SHA512_C)
6331 MBEDTLS_MD_SHA512,
6332 #endif
6333 #if defined(MBEDTLS_SHA384_C)
6334 MBEDTLS_MD_SHA384,
6335 #endif
6336 #if defined(MBEDTLS_SHA256_C)
6337 MBEDTLS_MD_SHA256,
6338 #endif
6339 MBEDTLS_MD_NONE
6340 };
6341 #endif
6342
6343 /* The selection should be the same as mbedtls_x509_crt_profile_default in
6344 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
6345 * curves with a lower resource usage come first.
6346 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
6347 * about this list.
6348 */
6349 static uint16_t ssl_preset_default_groups[] = {
6350 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
6351 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
6352 #endif
6353 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6354 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
6355 #endif
6356 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6357 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
6358 #endif
6359 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
6360 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
6361 #endif
6362 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
6363 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
6364 #endif
6365 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
6366 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
6367 #endif
6368 #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
6369 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
6370 #endif
6371 #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
6372 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
6373 #endif
6374 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
6375 };
6376
6377 static int ssl_preset_suiteb_ciphersuites[] = {
6378 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
6379 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
6380 0
6381 };
6382
6383 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6384 static int ssl_preset_suiteb_hashes[] = {
6385 MBEDTLS_MD_SHA256,
6386 MBEDTLS_MD_SHA384,
6387 MBEDTLS_MD_NONE
6388 };
6389
6390 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6391 static uint16_t ssl_preset_default_sig_algs[] = {
6392 /* ECDSA algorithms */
6393 #if defined(MBEDTLS_ECDSA_C)
6394 #if defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6395 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
6396 #endif /* MBEDTLS_SHA256_C && MBEDTLS_ECP_DP_SECP256R1_ENABLED */
6397 #if defined(MBEDTLS_SHA384_C) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6398 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
6399 #endif /* MBEDTLS_SHA384_C && MBEDTLS_ECP_DP_SECP384R1_ENABLED */
6400 #if defined(MBEDTLS_SHA512_C) && defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
6401 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
6402 #endif /* MBEDTLS_SHA512_C && MBEDTLS_ECP_DP_SECP521R1_ENABLED */
6403 #endif /* MBEDTLS_ECDSA_C */
6404
6405 /* RSA algorithms */
6406 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
6407 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
6408 #endif
6409 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
6410
6411 MBEDTLS_TLS1_3_SIG_NONE
6412 };
6413
6414 static uint16_t ssl_preset_suiteb_sig_algs[] = {
6415 /* ECDSA algorithms */
6416 #if defined(MBEDTLS_ECDSA_C)
6417 #if defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6418 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
6419 #endif /* MBEDTLS_SHA256_C && MBEDTLS_ECP_DP_SECP256R1_ENABLED */
6420 #if defined(MBEDTLS_SHA384_C) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6421 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
6422 #endif /* MBEDTLS_SHA384_C && MBEDTLS_ECP_DP_SECP384R1_ENABLED */
6423 #endif /* MBEDTLS_ECDSA_C */
6424
6425 /* RSA algorithms */
6426 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
6427 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
6428 #endif
6429 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
6430
6431 MBEDTLS_TLS1_3_SIG_NONE
6432 };
6433 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6434 #endif
6435
6436 static uint16_t ssl_preset_suiteb_groups[] = {
6437 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6438 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
6439 #endif
6440 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6441 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
6442 #endif
6443 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
6444 };
6445
6446 /*
6447 * Load default in mbedtls_ssl_config
6448 */
mbedtls_ssl_config_defaults(mbedtls_ssl_config * conf,int endpoint,int transport,int preset)6449 int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
6450 int endpoint, int transport, int preset )
6451 {
6452 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
6453 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6454 #endif
6455
6456 /* Use the functions here so that they are covered in tests,
6457 * but otherwise access member directly for efficiency */
6458 mbedtls_ssl_conf_endpoint( conf, endpoint );
6459 mbedtls_ssl_conf_transport( conf, transport );
6460
6461 /*
6462 * Things that are common to all presets
6463 */
6464 #if defined(MBEDTLS_SSL_CLI_C)
6465 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
6466 {
6467 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
6468 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
6469 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
6470 #endif
6471 }
6472 #endif
6473
6474 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6475 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
6476 #endif
6477
6478 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6479 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
6480 #endif
6481
6482 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6483 conf->f_cookie_write = ssl_cookie_write_dummy;
6484 conf->f_cookie_check = ssl_cookie_check_dummy;
6485 #endif
6486
6487 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6488 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
6489 #endif
6490
6491 #if defined(MBEDTLS_SSL_SRV_C)
6492 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
6493 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
6494 #endif
6495
6496 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6497 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
6498 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
6499 #endif
6500
6501 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6502 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
6503 memset( conf->renego_period, 0x00, 2 );
6504 memset( conf->renego_period + 2, 0xFF, 6 );
6505 #endif
6506
6507 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
6508 if( endpoint == MBEDTLS_SSL_IS_SERVER )
6509 {
6510 const unsigned char dhm_p[] =
6511 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
6512 const unsigned char dhm_g[] =
6513 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
6514
6515 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
6516 dhm_p, sizeof( dhm_p ),
6517 dhm_g, sizeof( dhm_g ) ) ) != 0 )
6518 {
6519 return( ret );
6520 }
6521 }
6522 #endif
6523
6524 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6525 /*
6526 * Allow all TLS 1.3 key exchange modes by default.
6527 */
6528 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
6529 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6530
6531 /*
6532 * Preset-specific defaults
6533 */
6534 switch( preset )
6535 {
6536 /*
6537 * NSA Suite B
6538 */
6539 case MBEDTLS_SSL_PRESET_SUITEB:
6540 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6541 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
6542 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
6543 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
6544
6545 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
6546
6547 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6548 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
6549 #endif
6550
6551 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6552 conf->sig_hashes = ssl_preset_suiteb_hashes;
6553 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6554 conf->tls13_sig_algs = ssl_preset_suiteb_sig_algs;
6555 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6556 #endif
6557
6558 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
6559 conf->curve_list = NULL;
6560 #endif
6561 conf->group_list = ssl_preset_suiteb_groups;
6562 break;
6563
6564 /*
6565 * Default
6566 */
6567 default:
6568 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
6569 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
6570 MBEDTLS_SSL_MIN_MAJOR_VERSION :
6571 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
6572 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
6573 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
6574 MBEDTLS_SSL_MIN_MINOR_VERSION :
6575 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
6576 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
6577 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
6578
6579 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6580 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6581 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6582 #endif
6583 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
6584
6585 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6586 conf->cert_profile = &mbedtls_x509_crt_profile_default;
6587 #endif
6588
6589 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6590 conf->sig_hashes = ssl_preset_default_hashes;
6591 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6592 conf->tls13_sig_algs = ssl_preset_default_sig_algs;
6593 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6594 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6595
6596 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
6597 conf->curve_list = NULL;
6598 #endif
6599 conf->group_list = ssl_preset_default_groups;
6600
6601 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
6602 conf->dhm_min_bitlen = 1024;
6603 #endif
6604 }
6605
6606 return( 0 );
6607 }
6608
6609 /*
6610 * Free mbedtls_ssl_config
6611 */
mbedtls_ssl_config_free(mbedtls_ssl_config * conf)6612 void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
6613 {
6614 #if defined(MBEDTLS_DHM_C)
6615 mbedtls_mpi_free( &conf->dhm_P );
6616 mbedtls_mpi_free( &conf->dhm_G );
6617 #endif
6618
6619 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
6620 if( conf->psk != NULL )
6621 {
6622 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
6623 mbedtls_free( conf->psk );
6624 conf->psk = NULL;
6625 conf->psk_len = 0;
6626 }
6627
6628 if( conf->psk_identity != NULL )
6629 {
6630 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
6631 mbedtls_free( conf->psk_identity );
6632 conf->psk_identity = NULL;
6633 conf->psk_identity_len = 0;
6634 }
6635 #endif
6636
6637 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6638 ssl_key_cert_free( conf->key_cert );
6639 #endif
6640
6641 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
6642 }
6643
6644 #if defined(MBEDTLS_PK_C) && \
6645 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
6646 /*
6647 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
6648 */
mbedtls_ssl_sig_from_pk(mbedtls_pk_context * pk)6649 unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
6650 {
6651 #if defined(MBEDTLS_RSA_C)
6652 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
6653 return( MBEDTLS_SSL_SIG_RSA );
6654 #endif
6655 #if defined(MBEDTLS_ECDSA_C)
6656 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
6657 return( MBEDTLS_SSL_SIG_ECDSA );
6658 #endif
6659 return( MBEDTLS_SSL_SIG_ANON );
6660 }
6661
mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type)6662 unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
6663 {
6664 switch( type ) {
6665 case MBEDTLS_PK_RSA:
6666 return( MBEDTLS_SSL_SIG_RSA );
6667 case MBEDTLS_PK_ECDSA:
6668 case MBEDTLS_PK_ECKEY:
6669 return( MBEDTLS_SSL_SIG_ECDSA );
6670 default:
6671 return( MBEDTLS_SSL_SIG_ANON );
6672 }
6673 }
6674
mbedtls_ssl_pk_alg_from_sig(unsigned char sig)6675 mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
6676 {
6677 switch( sig )
6678 {
6679 #if defined(MBEDTLS_RSA_C)
6680 case MBEDTLS_SSL_SIG_RSA:
6681 return( MBEDTLS_PK_RSA );
6682 #endif
6683 #if defined(MBEDTLS_ECDSA_C)
6684 case MBEDTLS_SSL_SIG_ECDSA:
6685 return( MBEDTLS_PK_ECDSA );
6686 #endif
6687 default:
6688 return( MBEDTLS_PK_NONE );
6689 }
6690 }
6691 #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
6692
6693 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
6694 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6695
6696 /* Find an entry in a signature-hash set matching a given hash algorithm. */
mbedtls_ssl_sig_hash_set_find(mbedtls_ssl_sig_hash_set_t * set,mbedtls_pk_type_t sig_alg)6697 mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
6698 mbedtls_pk_type_t sig_alg )
6699 {
6700 switch( sig_alg )
6701 {
6702 case MBEDTLS_PK_RSA:
6703 return( set->rsa );
6704 case MBEDTLS_PK_ECDSA:
6705 return( set->ecdsa );
6706 default:
6707 return( MBEDTLS_MD_NONE );
6708 }
6709 }
6710
6711 /* Add a signature-hash-pair to a signature-hash set */
mbedtls_ssl_sig_hash_set_add(mbedtls_ssl_sig_hash_set_t * set,mbedtls_pk_type_t sig_alg,mbedtls_md_type_t md_alg)6712 void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
6713 mbedtls_pk_type_t sig_alg,
6714 mbedtls_md_type_t md_alg )
6715 {
6716 switch( sig_alg )
6717 {
6718 case MBEDTLS_PK_RSA:
6719 if( set->rsa == MBEDTLS_MD_NONE )
6720 set->rsa = md_alg;
6721 break;
6722
6723 case MBEDTLS_PK_ECDSA:
6724 if( set->ecdsa == MBEDTLS_MD_NONE )
6725 set->ecdsa = md_alg;
6726 break;
6727
6728 default:
6729 break;
6730 }
6731 }
6732
6733 /* Allow exactly one hash algorithm for each signature. */
mbedtls_ssl_sig_hash_set_const_hash(mbedtls_ssl_sig_hash_set_t * set,mbedtls_md_type_t md_alg)6734 void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
6735 mbedtls_md_type_t md_alg )
6736 {
6737 set->rsa = md_alg;
6738 set->ecdsa = md_alg;
6739 }
6740
6741 #endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
6742 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6743
6744 /*
6745 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
6746 */
mbedtls_ssl_md_alg_from_hash(unsigned char hash)6747 mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
6748 {
6749 switch( hash )
6750 {
6751 #if defined(MBEDTLS_MD5_C)
6752 case MBEDTLS_SSL_HASH_MD5:
6753 return( MBEDTLS_MD_MD5 );
6754 #endif
6755 #if defined(MBEDTLS_SHA1_C)
6756 case MBEDTLS_SSL_HASH_SHA1:
6757 return( MBEDTLS_MD_SHA1 );
6758 #endif
6759 #if defined(MBEDTLS_SHA224_C)
6760 case MBEDTLS_SSL_HASH_SHA224:
6761 return( MBEDTLS_MD_SHA224 );
6762 #endif
6763 #if defined(MBEDTLS_SHA256_C)
6764 case MBEDTLS_SSL_HASH_SHA256:
6765 return( MBEDTLS_MD_SHA256 );
6766 #endif
6767 #if defined(MBEDTLS_SHA384_C)
6768 case MBEDTLS_SSL_HASH_SHA384:
6769 return( MBEDTLS_MD_SHA384 );
6770 #endif
6771 #if defined(MBEDTLS_SHA512_C)
6772 case MBEDTLS_SSL_HASH_SHA512:
6773 return( MBEDTLS_MD_SHA512 );
6774 #endif
6775 default:
6776 return( MBEDTLS_MD_NONE );
6777 }
6778 }
6779
6780 /*
6781 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
6782 */
mbedtls_ssl_hash_from_md_alg(int md)6783 unsigned char mbedtls_ssl_hash_from_md_alg( int md )
6784 {
6785 switch( md )
6786 {
6787 #if defined(MBEDTLS_MD5_C)
6788 case MBEDTLS_MD_MD5:
6789 return( MBEDTLS_SSL_HASH_MD5 );
6790 #endif
6791 #if defined(MBEDTLS_SHA1_C)
6792 case MBEDTLS_MD_SHA1:
6793 return( MBEDTLS_SSL_HASH_SHA1 );
6794 #endif
6795 #if defined(MBEDTLS_SHA224_C)
6796 case MBEDTLS_MD_SHA224:
6797 return( MBEDTLS_SSL_HASH_SHA224 );
6798 #endif
6799 #if defined(MBEDTLS_SHA256_C)
6800 case MBEDTLS_MD_SHA256:
6801 return( MBEDTLS_SSL_HASH_SHA256 );
6802 #endif
6803 #if defined(MBEDTLS_SHA384_C)
6804 case MBEDTLS_MD_SHA384:
6805 return( MBEDTLS_SSL_HASH_SHA384 );
6806 #endif
6807 #if defined(MBEDTLS_SHA512_C)
6808 case MBEDTLS_MD_SHA512:
6809 return( MBEDTLS_SSL_HASH_SHA512 );
6810 #endif
6811 default:
6812 return( MBEDTLS_SSL_HASH_NONE );
6813 }
6814 }
6815
6816 #if defined(MBEDTLS_ECP_C)
6817 /*
6818 * Check if a curve proposed by the peer is in our list.
6819 * Return 0 if we're willing to use it, -1 otherwise.
6820 */
mbedtls_ssl_check_curve(const mbedtls_ssl_context * ssl,mbedtls_ecp_group_id grp_id)6821 int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
6822 {
6823 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
6824
6825 if( group_list == NULL )
6826 return( -1 );
6827 uint16_t tls_id = mbedtls_ecp_curve_info_from_grp_id(grp_id)->tls_id;
6828
6829 for( ; *group_list != 0; group_list++ )
6830 {
6831 if( *group_list == tls_id )
6832 return( 0 );
6833 }
6834
6835 return( -1 );
6836 }
6837 #endif /* MBEDTLS_ECP_C */
6838
6839 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6840 /*
6841 * Check if a hash proposed by the peer is in our list.
6842 * Return 0 if we're willing to use it, -1 otherwise.
6843 */
mbedtls_ssl_check_sig_hash(const mbedtls_ssl_context * ssl,mbedtls_md_type_t md)6844 int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
6845 mbedtls_md_type_t md )
6846 {
6847 const int *cur;
6848
6849 if( ssl->conf->sig_hashes == NULL )
6850 return( -1 );
6851
6852 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
6853 if( *cur == (int) md )
6854 return( 0 );
6855
6856 return( -1 );
6857 }
6858 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6859
6860 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt * cert,const mbedtls_ssl_ciphersuite_t * ciphersuite,int cert_endpoint,uint32_t * flags)6861 int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
6862 const mbedtls_ssl_ciphersuite_t *ciphersuite,
6863 int cert_endpoint,
6864 uint32_t *flags )
6865 {
6866 int ret = 0;
6867 int usage = 0;
6868 const char *ext_oid;
6869 size_t ext_len;
6870
6871 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
6872 {
6873 /* Server part of the key exchange */
6874 switch( ciphersuite->key_exchange )
6875 {
6876 case MBEDTLS_KEY_EXCHANGE_RSA:
6877 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
6878 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
6879 break;
6880
6881 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
6882 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
6883 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
6884 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
6885 break;
6886
6887 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
6888 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
6889 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
6890 break;
6891
6892 /* Don't use default: we want warnings when adding new values */
6893 case MBEDTLS_KEY_EXCHANGE_NONE:
6894 case MBEDTLS_KEY_EXCHANGE_PSK:
6895 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
6896 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
6897 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
6898 usage = 0;
6899 }
6900 }
6901 else
6902 {
6903 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
6904 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
6905 }
6906
6907 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
6908 {
6909 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
6910 ret = -1;
6911 }
6912
6913 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
6914 {
6915 ext_oid = MBEDTLS_OID_SERVER_AUTH;
6916 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
6917 }
6918 else
6919 {
6920 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
6921 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
6922 }
6923
6924 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
6925 {
6926 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
6927 ret = -1;
6928 }
6929
6930 return( ret );
6931 }
6932 #endif /* MBEDTLS_X509_CRT_PARSE_C */
6933
mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context * ssl,int md)6934 int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
6935 {
6936 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6937 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
6938 return( -1 );
6939
6940 switch( md )
6941 {
6942 #if defined(MBEDTLS_SHA384_C)
6943 case MBEDTLS_SSL_HASH_SHA384:
6944 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
6945 break;
6946 #endif
6947 #if defined(MBEDTLS_SHA256_C)
6948 case MBEDTLS_SSL_HASH_SHA256:
6949 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
6950 break;
6951 #endif
6952 default:
6953 return( -1 );
6954 }
6955
6956 return 0;
6957 #else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
6958 (void) ssl;
6959 (void) md;
6960
6961 return( -1 );
6962 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6963 }
6964
6965 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6966
6967 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hashlen,unsigned char * data,size_t data_len,mbedtls_md_type_t md_alg)6968 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
6969 unsigned char *hash, size_t *hashlen,
6970 unsigned char *data, size_t data_len,
6971 mbedtls_md_type_t md_alg )
6972 {
6973 psa_status_t status;
6974 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
6975 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
6976
6977 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
6978
6979 if( ( status = psa_hash_setup( &hash_operation,
6980 hash_alg ) ) != PSA_SUCCESS )
6981 {
6982 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
6983 goto exit;
6984 }
6985
6986 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
6987 64 ) ) != PSA_SUCCESS )
6988 {
6989 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
6990 goto exit;
6991 }
6992
6993 if( ( status = psa_hash_update( &hash_operation,
6994 data, data_len ) ) != PSA_SUCCESS )
6995 {
6996 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
6997 goto exit;
6998 }
6999
7000 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
7001 hashlen ) ) != PSA_SUCCESS )
7002 {
7003 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
7004 goto exit;
7005 }
7006
7007 exit:
7008 if( status != PSA_SUCCESS )
7009 {
7010 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7011 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7012 switch( status )
7013 {
7014 case PSA_ERROR_NOT_SUPPORTED:
7015 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
7016 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
7017 case PSA_ERROR_BUFFER_TOO_SMALL:
7018 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7019 case PSA_ERROR_INSUFFICIENT_MEMORY:
7020 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7021 default:
7022 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
7023 }
7024 }
7025 return( 0 );
7026 }
7027
7028 #else
7029
mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hashlen,unsigned char * data,size_t data_len,mbedtls_md_type_t md_alg)7030 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7031 unsigned char *hash, size_t *hashlen,
7032 unsigned char *data, size_t data_len,
7033 mbedtls_md_type_t md_alg )
7034 {
7035 int ret = 0;
7036 mbedtls_md_context_t ctx;
7037 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
7038 *hashlen = mbedtls_md_get_size( md_info );
7039
7040 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
7041
7042 mbedtls_md_init( &ctx );
7043
7044 /*
7045 * digitally-signed struct {
7046 * opaque client_random[32];
7047 * opaque server_random[32];
7048 * ServerDHParams params;
7049 * };
7050 */
7051 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7052 {
7053 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7054 goto exit;
7055 }
7056 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7057 {
7058 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7059 goto exit;
7060 }
7061 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7062 {
7063 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7064 goto exit;
7065 }
7066 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7067 {
7068 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7069 goto exit;
7070 }
7071 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
7072 {
7073 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7074 goto exit;
7075 }
7076
7077 exit:
7078 mbedtls_md_free( &ctx );
7079
7080 if( ret != 0 )
7081 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7082 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7083
7084 return( ret );
7085 }
7086 #endif /* MBEDTLS_USE_PSA_CRYPTO */
7087
7088 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7089
7090 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context * ssl,const mbedtls_md_type_t md,unsigned char * dst,size_t dst_len,size_t * olen)7091 int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
7092 const mbedtls_md_type_t md,
7093 unsigned char *dst,
7094 size_t dst_len,
7095 size_t *olen )
7096 {
7097 ((void) ssl);
7098 ((void) md);
7099 ((void) dst);
7100 ((void) dst_len);
7101 *olen = 0;
7102 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE);
7103 }
7104 #else /* MBEDTLS_USE_PSA_CRYPTO */
7105
7106 #if defined(MBEDTLS_SHA384_C)
ssl_get_handshake_transcript_sha384(mbedtls_ssl_context * ssl,unsigned char * dst,size_t dst_len,size_t * olen)7107 static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
7108 unsigned char *dst,
7109 size_t dst_len,
7110 size_t *olen )
7111 {
7112 int ret;
7113 mbedtls_sha512_context sha512;
7114
7115 if( dst_len < 48 )
7116 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7117
7118 mbedtls_sha512_init( &sha512 );
7119 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
7120
7121 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
7122 {
7123 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
7124 goto exit;
7125 }
7126
7127 *olen = 48;
7128
7129 exit:
7130
7131 mbedtls_sha512_free( &sha512 );
7132 return( ret );
7133 }
7134 #endif /* MBEDTLS_SHA384_C */
7135
7136 #if defined(MBEDTLS_SHA256_C)
ssl_get_handshake_transcript_sha256(mbedtls_ssl_context * ssl,unsigned char * dst,size_t dst_len,size_t * olen)7137 static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
7138 unsigned char *dst,
7139 size_t dst_len,
7140 size_t *olen )
7141 {
7142 int ret;
7143 mbedtls_sha256_context sha256;
7144
7145 if( dst_len < 32 )
7146 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7147
7148 mbedtls_sha256_init( &sha256 );
7149 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
7150
7151 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
7152 {
7153 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
7154 goto exit;
7155 }
7156
7157 *olen = 32;
7158
7159 exit:
7160
7161 mbedtls_sha256_free( &sha256 );
7162 return( ret );
7163 }
7164 #endif /* MBEDTLS_SHA256_C */
7165
mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context * ssl,const mbedtls_md_type_t md,unsigned char * dst,size_t dst_len,size_t * olen)7166 int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
7167 const mbedtls_md_type_t md,
7168 unsigned char *dst,
7169 size_t dst_len,
7170 size_t *olen )
7171 {
7172 switch( md )
7173 {
7174
7175 #if defined(MBEDTLS_SHA384_C)
7176 case MBEDTLS_MD_SHA384:
7177 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
7178 #endif /* MBEDTLS_SHA384_C */
7179
7180 #if defined(MBEDTLS_SHA256_C)
7181 case MBEDTLS_MD_SHA256:
7182 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
7183 #endif /* MBEDTLS_SHA256_C */
7184
7185 default:
7186 break;
7187 }
7188 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7189 }
7190 #endif /* !MBEDTLS_USE_PSA_CRYPTO */
7191
7192 #endif /* MBEDTLS_SSL_TLS_C */
7193