1 /*
2 * TLS shared functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19 /*
20 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
24 #include "common.h"
25
26 #if defined(MBEDTLS_SSL_TLS_C)
27
28 #if defined(MBEDTLS_PLATFORM_C)
29 #include "mbedtls/platform.h"
30 #else
31 #include <stdlib.h>
32 #define mbedtls_calloc calloc
33 #define mbedtls_free free
34 #endif
35
36 #include "mbedtls/ssl.h"
37 #include "ssl_misc.h"
38 #include "mbedtls/debug.h"
39 #include "mbedtls/error.h"
40 #include "mbedtls/platform_util.h"
41 #include "mbedtls/version.h"
42 #include "mbedtls/constant_time.h"
43
44 #include <string.h>
45
46 #if defined(MBEDTLS_USE_PSA_CRYPTO)
47 #include "mbedtls/psa_util.h"
48 #include "psa/crypto.h"
49 #endif
50
51 #if defined(MBEDTLS_X509_CRT_PARSE_C)
52 #include "mbedtls/oid.h"
53 #endif
54
55 #if defined(MBEDTLS_SSL_PROTO_DTLS)
56
57 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
58 /* Top-level Connection ID API */
59
mbedtls_ssl_conf_cid(mbedtls_ssl_config * conf,size_t len,int ignore_other_cid)60 int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
61 size_t len,
62 int ignore_other_cid )
63 {
64 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
65 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
66
67 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
68 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
69 {
70 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
71 }
72
73 conf->ignore_unexpected_cid = ignore_other_cid;
74 conf->cid_len = len;
75 return( 0 );
76 }
77
mbedtls_ssl_set_cid(mbedtls_ssl_context * ssl,int enable,unsigned char const * own_cid,size_t own_cid_len)78 int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
79 int enable,
80 unsigned char const *own_cid,
81 size_t own_cid_len )
82 {
83 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
84 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
85
86 ssl->negotiate_cid = enable;
87 if( enable == MBEDTLS_SSL_CID_DISABLED )
88 {
89 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
90 return( 0 );
91 }
92 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
93 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
94
95 if( own_cid_len != ssl->conf->cid_len )
96 {
97 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
98 (unsigned) own_cid_len,
99 (unsigned) ssl->conf->cid_len ) );
100 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
101 }
102
103 memcpy( ssl->own_cid, own_cid, own_cid_len );
104 /* Truncation is not an issue here because
105 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
106 ssl->own_cid_len = (uint8_t) own_cid_len;
107
108 return( 0 );
109 }
110
mbedtls_ssl_get_peer_cid(mbedtls_ssl_context * ssl,int * enabled,unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],size_t * peer_cid_len)111 int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
112 int *enabled,
113 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
114 size_t *peer_cid_len )
115 {
116 *enabled = MBEDTLS_SSL_CID_DISABLED;
117
118 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
119 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
120 {
121 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
122 }
123
124 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
125 * were used, but client and server requested the empty CID.
126 * This is indistinguishable from not using the CID extension
127 * in the first place. */
128 if( ssl->transform_in->in_cid_len == 0 &&
129 ssl->transform_in->out_cid_len == 0 )
130 {
131 return( 0 );
132 }
133
134 if( peer_cid_len != NULL )
135 {
136 *peer_cid_len = ssl->transform_in->out_cid_len;
137 if( peer_cid != NULL )
138 {
139 memcpy( peer_cid, ssl->transform_in->out_cid,
140 ssl->transform_in->out_cid_len );
141 }
142 }
143
144 *enabled = MBEDTLS_SSL_CID_ENABLED;
145
146 return( 0 );
147 }
148 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
149
150 #endif /* MBEDTLS_SSL_PROTO_DTLS */
151
152 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
153 /*
154 * Convert max_fragment_length codes to length.
155 * RFC 6066 says:
156 * enum{
157 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
158 * } MaxFragmentLength;
159 * and we add 0 -> extension unused
160 */
ssl_mfl_code_to_length(int mfl)161 static unsigned int ssl_mfl_code_to_length( int mfl )
162 {
163 switch( mfl )
164 {
165 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
166 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
167 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
168 return 512;
169 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
170 return 1024;
171 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
172 return 2048;
173 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
174 return 4096;
175 default:
176 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
177 }
178 }
179 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
180
mbedtls_ssl_session_copy(mbedtls_ssl_session * dst,const mbedtls_ssl_session * src)181 int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
182 const mbedtls_ssl_session *src )
183 {
184 mbedtls_ssl_session_free( dst );
185 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
186
187 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
188 dst->ticket = NULL;
189 #endif
190
191 #if defined(MBEDTLS_X509_CRT_PARSE_C)
192
193 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
194 if( src->peer_cert != NULL )
195 {
196 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
197
198 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
199 if( dst->peer_cert == NULL )
200 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
201
202 mbedtls_x509_crt_init( dst->peer_cert );
203
204 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
205 src->peer_cert->raw.len ) ) != 0 )
206 {
207 mbedtls_free( dst->peer_cert );
208 dst->peer_cert = NULL;
209 return( ret );
210 }
211 }
212 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
213 if( src->peer_cert_digest != NULL )
214 {
215 dst->peer_cert_digest =
216 mbedtls_calloc( 1, src->peer_cert_digest_len );
217 if( dst->peer_cert_digest == NULL )
218 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
219
220 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
221 src->peer_cert_digest_len );
222 dst->peer_cert_digest_type = src->peer_cert_digest_type;
223 dst->peer_cert_digest_len = src->peer_cert_digest_len;
224 }
225 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
226
227 #endif /* MBEDTLS_X509_CRT_PARSE_C */
228
229 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
230 if( src->ticket != NULL )
231 {
232 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
233 if( dst->ticket == NULL )
234 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
235
236 memcpy( dst->ticket, src->ticket, src->ticket_len );
237 }
238 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
239
240 return( 0 );
241 }
242
243 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
resize_buffer(unsigned char ** buffer,size_t len_new,size_t * len_old)244 static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
245 {
246 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
247 if( resized_buffer == NULL )
248 return -1;
249
250 /* We want to copy len_new bytes when downsizing the buffer, and
251 * len_old bytes when upsizing, so we choose the smaller of two sizes,
252 * to fit one buffer into another. Size checks, ensuring that no data is
253 * lost, are done outside of this function. */
254 memcpy( resized_buffer, *buffer,
255 ( len_new < *len_old ) ? len_new : *len_old );
256 mbedtls_platform_zeroize( *buffer, *len_old );
257 mbedtls_free( *buffer );
258
259 *buffer = resized_buffer;
260 *len_old = len_new;
261
262 return 0;
263 }
264
handle_buffer_resizing(mbedtls_ssl_context * ssl,int downsizing,size_t in_buf_new_len,size_t out_buf_new_len)265 static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
266 size_t in_buf_new_len,
267 size_t out_buf_new_len )
268 {
269 int modified = 0;
270 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
271 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
272 if( ssl->in_buf != NULL )
273 {
274 written_in = ssl->in_msg - ssl->in_buf;
275 iv_offset_in = ssl->in_iv - ssl->in_buf;
276 len_offset_in = ssl->in_len - ssl->in_buf;
277 if( downsizing ?
278 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
279 ssl->in_buf_len < in_buf_new_len )
280 {
281 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
282 {
283 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
284 }
285 else
286 {
287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
288 in_buf_new_len ) );
289 modified = 1;
290 }
291 }
292 }
293
294 if( ssl->out_buf != NULL )
295 {
296 written_out = ssl->out_msg - ssl->out_buf;
297 iv_offset_out = ssl->out_iv - ssl->out_buf;
298 len_offset_out = ssl->out_len - ssl->out_buf;
299 if( downsizing ?
300 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
301 ssl->out_buf_len < out_buf_new_len )
302 {
303 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
304 {
305 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
306 }
307 else
308 {
309 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
310 out_buf_new_len ) );
311 modified = 1;
312 }
313 }
314 }
315 if( modified )
316 {
317 /* Update pointers here to avoid doing it twice. */
318 mbedtls_ssl_reset_in_out_pointers( ssl );
319 /* Fields below might not be properly updated with record
320 * splitting or with CID, so they are manually updated here. */
321 ssl->out_msg = ssl->out_buf + written_out;
322 ssl->out_len = ssl->out_buf + len_offset_out;
323 ssl->out_iv = ssl->out_buf + iv_offset_out;
324
325 ssl->in_msg = ssl->in_buf + written_in;
326 ssl->in_len = ssl->in_buf + len_offset_in;
327 ssl->in_iv = ssl->in_buf + iv_offset_in;
328 }
329 }
330 #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
331
332 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
333 #if defined(MBEDTLS_USE_PSA_CRYPTO)
334
setup_psa_key_derivation(psa_key_derivation_operation_t * derivation,psa_key_id_t key,psa_algorithm_t alg,const unsigned char * seed,size_t seed_length,const unsigned char * label,size_t label_length,size_t capacity)335 static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
336 psa_key_id_t key,
337 psa_algorithm_t alg,
338 const unsigned char* seed, size_t seed_length,
339 const unsigned char* label, size_t label_length,
340 size_t capacity )
341 {
342 psa_status_t status;
343
344 status = psa_key_derivation_setup( derivation, alg );
345 if( status != PSA_SUCCESS )
346 return( status );
347
348 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
349 {
350 status = psa_key_derivation_input_bytes( derivation,
351 PSA_KEY_DERIVATION_INPUT_SEED,
352 seed, seed_length );
353 if( status != PSA_SUCCESS )
354 return( status );
355
356 if( mbedtls_svc_key_id_is_null( key ) )
357 {
358 status = psa_key_derivation_input_bytes(
359 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
360 NULL, 0 );
361 }
362 else
363 {
364 status = psa_key_derivation_input_key(
365 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
366 }
367 if( status != PSA_SUCCESS )
368 return( status );
369
370 status = psa_key_derivation_input_bytes( derivation,
371 PSA_KEY_DERIVATION_INPUT_LABEL,
372 label, label_length );
373 if( status != PSA_SUCCESS )
374 return( status );
375 }
376 else
377 {
378 return( PSA_ERROR_NOT_SUPPORTED );
379 }
380
381 status = psa_key_derivation_set_capacity( derivation, capacity );
382 if( status != PSA_SUCCESS )
383 return( status );
384
385 return( PSA_SUCCESS );
386 }
387
tls_prf_generic(mbedtls_md_type_t md_type,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)388 static int tls_prf_generic( mbedtls_md_type_t md_type,
389 const unsigned char *secret, size_t slen,
390 const char *label,
391 const unsigned char *random, size_t rlen,
392 unsigned char *dstbuf, size_t dlen )
393 {
394 psa_status_t status;
395 psa_algorithm_t alg;
396 psa_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
397 psa_key_derivation_operation_t derivation =
398 PSA_KEY_DERIVATION_OPERATION_INIT;
399
400 if( md_type == MBEDTLS_MD_SHA384 )
401 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
402 else
403 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
404
405 /* Normally a "secret" should be long enough to be impossible to
406 * find by brute force, and in particular should not be empty. But
407 * this PRF is also used to derive an IV, in particular in EAP-TLS,
408 * and for this use case it makes sense to have a 0-length "secret".
409 * Since the key API doesn't allow importing a key of length 0,
410 * keep master_key=0, which setup_psa_key_derivation() understands
411 * to mean a 0-length "secret" input. */
412 if( slen != 0 )
413 {
414 psa_key_attributes_t key_attributes = psa_key_attributes_init();
415 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
416 psa_set_key_algorithm( &key_attributes, alg );
417 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
418
419 status = psa_import_key( &key_attributes, secret, slen, &master_key );
420 if( status != PSA_SUCCESS )
421 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
422 }
423
424 status = setup_psa_key_derivation( &derivation,
425 master_key, alg,
426 random, rlen,
427 (unsigned char const *) label,
428 (size_t) strlen( label ),
429 dlen );
430 if( status != PSA_SUCCESS )
431 {
432 psa_key_derivation_abort( &derivation );
433 psa_destroy_key( master_key );
434 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
435 }
436
437 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
438 if( status != PSA_SUCCESS )
439 {
440 psa_key_derivation_abort( &derivation );
441 psa_destroy_key( master_key );
442 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
443 }
444
445 status = psa_key_derivation_abort( &derivation );
446 if( status != PSA_SUCCESS )
447 {
448 psa_destroy_key( master_key );
449 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
450 }
451
452 if( ! mbedtls_svc_key_id_is_null( master_key ) )
453 status = psa_destroy_key( master_key );
454 if( status != PSA_SUCCESS )
455 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
456
457 return( 0 );
458 }
459
460 #else /* MBEDTLS_USE_PSA_CRYPTO */
461
tls_prf_generic(mbedtls_md_type_t md_type,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)462 static int tls_prf_generic( mbedtls_md_type_t md_type,
463 const unsigned char *secret, size_t slen,
464 const char *label,
465 const unsigned char *random, size_t rlen,
466 unsigned char *dstbuf, size_t dlen )
467 {
468 size_t nb;
469 size_t i, j, k, md_len;
470 unsigned char *tmp;
471 size_t tmp_len = 0;
472 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
473 const mbedtls_md_info_t *md_info;
474 mbedtls_md_context_t md_ctx;
475 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
476
477 mbedtls_md_init( &md_ctx );
478
479 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
480 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
481
482 md_len = mbedtls_md_get_size( md_info );
483
484 tmp_len = md_len + strlen( label ) + rlen;
485 tmp = mbedtls_calloc( 1, tmp_len );
486 if( tmp == NULL )
487 {
488 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
489 goto exit;
490 }
491
492 nb = strlen( label );
493 memcpy( tmp + md_len, label, nb );
494 memcpy( tmp + md_len + nb, random, rlen );
495 nb += rlen;
496
497 /*
498 * Compute P_<hash>(secret, label + random)[0..dlen]
499 */
500 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
501 goto exit;
502
503 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
504 if( ret != 0 )
505 goto exit;
506 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
507 if( ret != 0 )
508 goto exit;
509 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
510 if( ret != 0 )
511 goto exit;
512
513 for( i = 0; i < dlen; i += md_len )
514 {
515 ret = mbedtls_md_hmac_reset ( &md_ctx );
516 if( ret != 0 )
517 goto exit;
518 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
519 if( ret != 0 )
520 goto exit;
521 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
522 if( ret != 0 )
523 goto exit;
524
525 ret = mbedtls_md_hmac_reset ( &md_ctx );
526 if( ret != 0 )
527 goto exit;
528 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
529 if( ret != 0 )
530 goto exit;
531 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
532 if( ret != 0 )
533 goto exit;
534
535 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
536
537 for( j = 0; j < k; j++ )
538 dstbuf[i + j] = h_i[j];
539 }
540
541 exit:
542 mbedtls_md_free( &md_ctx );
543
544 mbedtls_platform_zeroize( tmp, tmp_len );
545 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
546
547 mbedtls_free( tmp );
548
549 return( ret );
550 }
551 #endif /* MBEDTLS_USE_PSA_CRYPTO */
552 #if defined(MBEDTLS_SHA256_C)
tls_prf_sha256(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)553 static int tls_prf_sha256( const unsigned char *secret, size_t slen,
554 const char *label,
555 const unsigned char *random, size_t rlen,
556 unsigned char *dstbuf, size_t dlen )
557 {
558 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
559 label, random, rlen, dstbuf, dlen ) );
560 }
561 #endif /* MBEDTLS_SHA256_C */
562
563 #if defined(MBEDTLS_SHA384_C)
tls_prf_sha384(const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)564 static int tls_prf_sha384( const unsigned char *secret, size_t slen,
565 const char *label,
566 const unsigned char *random, size_t rlen,
567 unsigned char *dstbuf, size_t dlen )
568 {
569 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
570 label, random, rlen, dstbuf, dlen ) );
571 }
572 #endif /* MBEDTLS_SHA384_C */
573 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
574
575 static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
576
577 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
578 #if defined(MBEDTLS_SHA256_C)
579 static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
580 static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
581 static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
582 #endif
583
584 #if defined(MBEDTLS_SHA384_C)
585 static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
586 static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
587 static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
588 #endif
589 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
590
591 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \
592 defined(MBEDTLS_USE_PSA_CRYPTO)
ssl_use_opaque_psk(mbedtls_ssl_context const * ssl)593 static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
594 {
595 if( ssl->conf->f_psk != NULL )
596 {
597 /* If we've used a callback to select the PSK,
598 * the static configuration is irrelevant. */
599 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
600 return( 1 );
601
602 return( 0 );
603 }
604
605 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
606 return( 1 );
607
608 return( 0 );
609 }
610 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
611 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
612
tls_prf_get_type(mbedtls_ssl_tls_prf_cb * tls_prf)613 static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
614 {
615 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
616 #if defined(MBEDTLS_SHA384_C)
617 if( tls_prf == tls_prf_sha384 )
618 {
619 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
620 }
621 else
622 #endif
623 #if defined(MBEDTLS_SHA256_C)
624 if( tls_prf == tls_prf_sha256 )
625 {
626 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
627 }
628 else
629 #endif
630 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
631 return( MBEDTLS_SSL_TLS_PRF_NONE );
632 }
633
mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf,const unsigned char * secret,size_t slen,const char * label,const unsigned char * random,size_t rlen,unsigned char * dstbuf,size_t dlen)634 int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
635 const unsigned char *secret, size_t slen,
636 const char *label,
637 const unsigned char *random, size_t rlen,
638 unsigned char *dstbuf, size_t dlen )
639 {
640 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
641
642 switch( prf )
643 {
644 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
645 #if defined(MBEDTLS_SHA384_C)
646 case MBEDTLS_SSL_TLS_PRF_SHA384:
647 tls_prf = tls_prf_sha384;
648 break;
649 #endif /* MBEDTLS_SHA384_C */
650 #if defined(MBEDTLS_SHA256_C)
651 case MBEDTLS_SSL_TLS_PRF_SHA256:
652 tls_prf = tls_prf_sha256;
653 break;
654 #endif /* MBEDTLS_SHA256_C */
655 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
656 default:
657 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
658 }
659
660 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
661 }
662
663 /* Type for the TLS PRF */
664 typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
665 const unsigned char *, size_t,
666 unsigned char *, size_t);
667
668 /*
669 * Populate a transform structure with session keys and all the other
670 * necessary information.
671 *
672 * Parameters:
673 * - [in/out]: transform: structure to populate
674 * [in] must be just initialised with mbedtls_ssl_transform_init()
675 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
676 * - [in] ciphersuite
677 * - [in] master
678 * - [in] encrypt_then_mac
679 * - [in] compression
680 * - [in] tls_prf: pointer to PRF to use for key derivation
681 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
682 * - [in] minor_ver: SSL/TLS minor version
683 * - [in] endpoint: client or server
684 * - [in] ssl: used for:
685 * - ssl->conf->{f,p}_export_keys
686 * [in] optionally used for:
687 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
688 */
ssl_tls12_populate_transform(mbedtls_ssl_transform * transform,int ciphersuite,const unsigned char master[48],int encrypt_then_mac,ssl_tls_prf_t tls_prf,const unsigned char randbytes[64],int minor_ver,unsigned endpoint,const mbedtls_ssl_context * ssl)689 static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
690 int ciphersuite,
691 const unsigned char master[48],
692 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
693 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
694 int encrypt_then_mac,
695 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
696 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
697 ssl_tls_prf_t tls_prf,
698 const unsigned char randbytes[64],
699 int minor_ver,
700 unsigned endpoint,
701 const mbedtls_ssl_context *ssl )
702 {
703 int ret = 0;
704 #if defined(MBEDTLS_USE_PSA_CRYPTO)
705 int psa_fallthrough;
706 #endif /* MBEDTLS_USE_PSA_CRYPTO */
707 unsigned char keyblk[256];
708 unsigned char *key1;
709 unsigned char *key2;
710 unsigned char *mac_enc;
711 unsigned char *mac_dec;
712 size_t mac_key_len = 0;
713 size_t iv_copy_len;
714 size_t keylen;
715 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
716 const mbedtls_cipher_info_t *cipher_info;
717 const mbedtls_md_info_t *md_info;
718
719 #if !defined(MBEDTLS_DEBUG_C) && \
720 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
721 if( ssl->f_export_keys == NULL )
722 {
723 ssl = NULL; /* make sure we don't use it except for these cases */
724 (void) ssl;
725 }
726 #endif
727
728 /*
729 * Some data just needs copying into the structure
730 */
731 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
732 defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
733 transform->encrypt_then_mac = encrypt_then_mac;
734 #endif
735 transform->minor_ver = minor_ver;
736
737 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
738 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
739 #endif
740
741 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
742 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
743 {
744 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
745 * generation separate. This should never happen. */
746 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
747 }
748 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
749
750 /*
751 * Get various info structures
752 */
753 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
754 if( ciphersuite_info == NULL )
755 {
756 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
757 ciphersuite ) );
758 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
759 }
760
761 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
762 if( cipher_info == NULL )
763 {
764 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
765 ciphersuite_info->cipher ) );
766 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
767 }
768
769 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
770 if( md_info == NULL )
771 {
772 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
773 (unsigned) ciphersuite_info->mac ) );
774 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
775 }
776
777 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
778 /* Copy own and peer's CID if the use of the CID
779 * extension has been negotiated. */
780 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
781 {
782 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
783
784 transform->in_cid_len = ssl->own_cid_len;
785 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
786 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
787 transform->in_cid_len );
788
789 transform->out_cid_len = ssl->handshake->peer_cid_len;
790 memcpy( transform->out_cid, ssl->handshake->peer_cid,
791 ssl->handshake->peer_cid_len );
792 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
793 transform->out_cid_len );
794 }
795 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
796
797 /*
798 * Compute key block using the PRF
799 */
800 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
801 if( ret != 0 )
802 {
803 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
804 return( ret );
805 }
806
807 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
808 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
809 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
810 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
811 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
812
813 /*
814 * Determine the appropriate key, IV and MAC length.
815 */
816
817 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
818
819 #if defined(MBEDTLS_GCM_C) || \
820 defined(MBEDTLS_CCM_C) || \
821 defined(MBEDTLS_CHACHAPOLY_C)
822 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_GCM ||
823 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CCM ||
824 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
825 {
826 size_t explicit_ivlen;
827
828 transform->maclen = 0;
829 mac_key_len = 0;
830 transform->taglen =
831 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
832
833 /* All modes haves 96-bit IVs, but the length of the static parts vary
834 * with mode and version:
835 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
836 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
837 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
838 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
839 * sequence number).
840 */
841 transform->ivlen = 12;
842 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
843 transform->fixed_ivlen = 12;
844 else
845 transform->fixed_ivlen = 4;
846
847 /* Minimum length of encrypted record */
848 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
849 transform->minlen = explicit_ivlen + transform->taglen;
850 }
851 else
852 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
853 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
854 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM ||
855 mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
856 {
857 /* Initialize HMAC contexts */
858 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
859 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
860 {
861 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
862 goto end;
863 }
864
865 /* Get MAC length */
866 mac_key_len = mbedtls_md_get_size( md_info );
867 transform->maclen = mac_key_len;
868
869 /* IV length */
870 transform->ivlen = cipher_info->iv_size;
871
872 /* Minimum length */
873 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_STREAM )
874 transform->minlen = transform->maclen;
875 else
876 {
877 /*
878 * GenericBlockCipher:
879 * 1. if EtM is in use: one block plus MAC
880 * otherwise: * first multiple of blocklen greater than maclen
881 * 2. IV
882 */
883 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
884 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
885 {
886 transform->minlen = transform->maclen
887 + cipher_info->block_size;
888 }
889 else
890 #endif
891 {
892 transform->minlen = transform->maclen
893 + cipher_info->block_size
894 - transform->maclen % cipher_info->block_size;
895 }
896
897 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
898 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
899 {
900 transform->minlen += transform->ivlen;
901 }
902 else
903 #endif
904 {
905 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
906 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
907 goto end;
908 }
909 }
910 }
911 else
912 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
913 {
914 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
915 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
916 }
917
918 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
919 (unsigned) keylen,
920 (unsigned) transform->minlen,
921 (unsigned) transform->ivlen,
922 (unsigned) transform->maclen ) );
923
924 /*
925 * Finally setup the cipher contexts, IVs and MAC secrets.
926 */
927 #if defined(MBEDTLS_SSL_CLI_C)
928 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
929 {
930 key1 = keyblk + mac_key_len * 2;
931 key2 = keyblk + mac_key_len * 2 + keylen;
932
933 mac_enc = keyblk;
934 mac_dec = keyblk + mac_key_len;
935
936 /*
937 * This is not used in TLS v1.1.
938 */
939 iv_copy_len = ( transform->fixed_ivlen ) ?
940 transform->fixed_ivlen : transform->ivlen;
941 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
942 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
943 iv_copy_len );
944 }
945 else
946 #endif /* MBEDTLS_SSL_CLI_C */
947 #if defined(MBEDTLS_SSL_SRV_C)
948 if( endpoint == MBEDTLS_SSL_IS_SERVER )
949 {
950 key1 = keyblk + mac_key_len * 2 + keylen;
951 key2 = keyblk + mac_key_len * 2;
952
953 mac_enc = keyblk + mac_key_len;
954 mac_dec = keyblk;
955
956 /*
957 * This is not used in TLS v1.1.
958 */
959 iv_copy_len = ( transform->fixed_ivlen ) ?
960 transform->fixed_ivlen : transform->ivlen;
961 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
962 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
963 iv_copy_len );
964 }
965 else
966 #endif /* MBEDTLS_SSL_SRV_C */
967 {
968 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
969 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
970 goto end;
971 }
972
973 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
974 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
975 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
976 For AEAD-based ciphersuites, there is nothing to do here. */
977 if( mac_key_len != 0 )
978 {
979 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
980 if( ret != 0 )
981 goto end;
982 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
983 if( ret != 0 )
984 goto end;
985 }
986 #endif
987 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
988
989 ((void) mac_dec);
990 ((void) mac_enc);
991
992 if( ssl != NULL && ssl->f_export_keys != NULL )
993 {
994 ssl->f_export_keys( ssl->p_export_keys,
995 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
996 master, 48,
997 randbytes + 32,
998 randbytes,
999 tls_prf_get_type( tls_prf ) );
1000 }
1001
1002 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1003 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_enc,
1004 cipher_info, transform->taglen );
1005 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
1006 {
1007 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1008 goto end;
1009 }
1010
1011 if( ret == 0 )
1012 {
1013 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based encryption cipher context" ) );
1014 psa_fallthrough = 0;
1015 }
1016 else
1017 {
1018 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record encryption - fall through to default setup." ) );
1019 psa_fallthrough = 1;
1020 }
1021
1022 if( psa_fallthrough == 1 )
1023 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1024 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
1025 cipher_info ) ) != 0 )
1026 {
1027 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1028 goto end;
1029 }
1030
1031 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1032 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_dec,
1033 cipher_info, transform->taglen );
1034 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
1035 {
1036 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret );
1037 goto end;
1038 }
1039
1040 if( ret == 0 )
1041 {
1042 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based decryption cipher context" ) );
1043 psa_fallthrough = 0;
1044 }
1045 else
1046 {
1047 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record decryption - fall through to default setup." ) );
1048 psa_fallthrough = 1;
1049 }
1050
1051 if( psa_fallthrough == 1 )
1052 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1053 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
1054 cipher_info ) ) != 0 )
1055 {
1056 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
1057 goto end;
1058 }
1059
1060 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
1061 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
1062 MBEDTLS_ENCRYPT ) ) != 0 )
1063 {
1064 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1065 goto end;
1066 }
1067
1068 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
1069 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
1070 MBEDTLS_DECRYPT ) ) != 0 )
1071 {
1072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
1073 goto end;
1074 }
1075
1076 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1077 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
1078 {
1079 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1080 MBEDTLS_PADDING_NONE ) ) != 0 )
1081 {
1082 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1083 goto end;
1084 }
1085
1086 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1087 MBEDTLS_PADDING_NONE ) ) != 0 )
1088 {
1089 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
1090 goto end;
1091 }
1092 }
1093 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1094
1095
1096 end:
1097 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
1098 return( ret );
1099 }
1100
1101 /*
1102 * Set appropriate PRF function and other SSL / TLS1.2 functions
1103 *
1104 * Inputs:
1105 * - SSL/TLS minor version
1106 * - hash associated with the ciphersuite (only used by TLS 1.2)
1107 *
1108 * Outputs:
1109 * - the tls_prf, calc_verify and calc_finished members of handshake structure
1110 */
ssl_set_handshake_prfs(mbedtls_ssl_handshake_params * handshake,int minor_ver,mbedtls_md_type_t hash)1111 static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
1112 int minor_ver,
1113 mbedtls_md_type_t hash )
1114 {
1115 #if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA384_C)
1116 (void) hash;
1117 #endif
1118
1119 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1120 #if defined(MBEDTLS_SHA384_C)
1121 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1122 hash == MBEDTLS_MD_SHA384 )
1123 {
1124 handshake->tls_prf = tls_prf_sha384;
1125 handshake->calc_verify = ssl_calc_verify_tls_sha384;
1126 handshake->calc_finished = ssl_calc_finished_tls_sha384;
1127 }
1128 else
1129 #endif
1130 #if defined(MBEDTLS_SHA256_C)
1131 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1132 {
1133 handshake->tls_prf = tls_prf_sha256;
1134 handshake->calc_verify = ssl_calc_verify_tls_sha256;
1135 handshake->calc_finished = ssl_calc_finished_tls_sha256;
1136 }
1137 else
1138 #endif
1139 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1140 {
1141 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1142 }
1143
1144 return( 0 );
1145 }
1146
1147 /*
1148 * Compute master secret if needed
1149 *
1150 * Parameters:
1151 * [in/out] handshake
1152 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
1153 * (PSA-PSK) ciphersuite_info, psk_opaque
1154 * [out] premaster (cleared)
1155 * [out] master
1156 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
1157 * debug: conf->f_dbg, conf->p_dbg
1158 * EMS: passed to calc_verify (debug + session_negotiate)
1159 * PSA-PSA: minor_ver, conf
1160 */
ssl_compute_master(mbedtls_ssl_handshake_params * handshake,unsigned char * master,const mbedtls_ssl_context * ssl)1161 static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
1162 unsigned char *master,
1163 const mbedtls_ssl_context *ssl )
1164 {
1165 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1166
1167 /* cf. RFC 5246, Section 8.1:
1168 * "The master secret is always exactly 48 bytes in length." */
1169 size_t const master_secret_len = 48;
1170
1171 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1172 unsigned char session_hash[48];
1173 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1174
1175 /* The label for the KDF used for key expansion.
1176 * This is either "master secret" or "extended master secret"
1177 * depending on whether the Extended Master Secret extension
1178 * is used. */
1179 char const *lbl = "master secret";
1180
1181 /* The salt for the KDF used for key expansion.
1182 * - If the Extended Master Secret extension is not used,
1183 * this is ClientHello.Random + ServerHello.Random
1184 * (see Sect. 8.1 in RFC 5246).
1185 * - If the Extended Master Secret extension is used,
1186 * this is the transcript of the handshake so far.
1187 * (see Sect. 4 in RFC 7627). */
1188 unsigned char const *salt = handshake->randbytes;
1189 size_t salt_len = 64;
1190
1191 #if !defined(MBEDTLS_DEBUG_C) && \
1192 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
1193 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
1194 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
1195 ssl = NULL; /* make sure we don't use it except for those cases */
1196 (void) ssl;
1197 #endif
1198
1199 if( handshake->resume != 0 )
1200 {
1201 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
1202 return( 0 );
1203 }
1204
1205 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1206 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
1207 {
1208 lbl = "extended master secret";
1209 salt = session_hash;
1210 handshake->calc_verify( ssl, session_hash, &salt_len );
1211
1212 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
1213 session_hash, salt_len );
1214 }
1215 #endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */
1216
1217 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
1218 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1219 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
1220 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1221 ssl_use_opaque_psk( ssl ) == 1 )
1222 {
1223 /* Perform PSK-to-MS expansion in a single step. */
1224 psa_status_t status;
1225 psa_algorithm_t alg;
1226 psa_key_id_t psk;
1227 psa_key_derivation_operation_t derivation =
1228 PSA_KEY_DERIVATION_OPERATION_INIT;
1229 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
1230
1231 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
1232
1233 psk = mbedtls_ssl_get_opaque_psk( ssl );
1234
1235 if( hash_alg == MBEDTLS_MD_SHA384 )
1236 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
1237 else
1238 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
1239
1240 status = setup_psa_key_derivation( &derivation, psk, alg,
1241 salt, salt_len,
1242 (unsigned char const *) lbl,
1243 (size_t) strlen( lbl ),
1244 master_secret_len );
1245 if( status != PSA_SUCCESS )
1246 {
1247 psa_key_derivation_abort( &derivation );
1248 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1249 }
1250
1251 status = psa_key_derivation_output_bytes( &derivation,
1252 master,
1253 master_secret_len );
1254 if( status != PSA_SUCCESS )
1255 {
1256 psa_key_derivation_abort( &derivation );
1257 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1258 }
1259
1260 status = psa_key_derivation_abort( &derivation );
1261 if( status != PSA_SUCCESS )
1262 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1263 }
1264 else
1265 #endif
1266 {
1267 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
1268 lbl, salt, salt_len,
1269 master,
1270 master_secret_len );
1271 if( ret != 0 )
1272 {
1273 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
1274 return( ret );
1275 }
1276
1277 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
1278 handshake->premaster,
1279 handshake->pmslen );
1280
1281 mbedtls_platform_zeroize( handshake->premaster,
1282 sizeof(handshake->premaster) );
1283 }
1284
1285 return( 0 );
1286 }
1287
mbedtls_ssl_derive_keys(mbedtls_ssl_context * ssl)1288 int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
1289 {
1290 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1291 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
1292 ssl->handshake->ciphersuite_info;
1293
1294 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
1295
1296 /* Set PRF, calc_verify and calc_finished function pointers */
1297 ret = ssl_set_handshake_prfs( ssl->handshake,
1298 ssl->minor_ver,
1299 ciphersuite_info->mac );
1300 if( ret != 0 )
1301 {
1302 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
1303 return( ret );
1304 }
1305
1306 /* Compute master secret if needed */
1307 ret = ssl_compute_master( ssl->handshake,
1308 ssl->session_negotiate->master,
1309 ssl );
1310 if( ret != 0 )
1311 {
1312 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
1313 return( ret );
1314 }
1315
1316 /* Swap the client and server random values:
1317 * - MS derivation wanted client+server (RFC 5246 8.1)
1318 * - key derivation wants server+client (RFC 5246 6.3) */
1319 {
1320 unsigned char tmp[64];
1321 memcpy( tmp, ssl->handshake->randbytes, 64 );
1322 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
1323 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
1324 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
1325 }
1326
1327 /* Populate transform structure */
1328 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
1329 ssl->session_negotiate->ciphersuite,
1330 ssl->session_negotiate->master,
1331 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
1332 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1333 ssl->session_negotiate->encrypt_then_mac,
1334 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
1335 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
1336 ssl->handshake->tls_prf,
1337 ssl->handshake->randbytes,
1338 ssl->minor_ver,
1339 ssl->conf->endpoint,
1340 ssl );
1341 if( ret != 0 )
1342 {
1343 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
1344 return( ret );
1345 }
1346
1347 /* We no longer need Server/ClientHello.random values */
1348 mbedtls_platform_zeroize( ssl->handshake->randbytes,
1349 sizeof( ssl->handshake->randbytes ) );
1350
1351 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
1352
1353 return( 0 );
1354 }
1355
1356 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1357 #if defined(MBEDTLS_SHA256_C)
ssl_calc_verify_tls_sha256(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1358 void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1359 unsigned char *hash,
1360 size_t *hlen )
1361 {
1362 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1363 size_t hash_size;
1364 psa_status_t status;
1365 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
1366
1367 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
1368 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
1369 if( status != PSA_SUCCESS )
1370 {
1371 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1372 return;
1373 }
1374
1375 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
1376 if( status != PSA_SUCCESS )
1377 {
1378 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1379 return;
1380 }
1381
1382 *hlen = 32;
1383 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
1384 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1385 #else
1386 mbedtls_sha256_context sha256;
1387
1388 mbedtls_sha256_init( &sha256 );
1389
1390 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1391
1392 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1393 mbedtls_sha256_finish( &sha256, hash );
1394
1395 *hlen = 32;
1396
1397 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1398 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1399
1400 mbedtls_sha256_free( &sha256 );
1401 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1402 return;
1403 }
1404 #endif /* MBEDTLS_SHA256_C */
1405
1406 #if defined(MBEDTLS_SHA384_C)
ssl_calc_verify_tls_sha384(const mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hlen)1407 void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1408 unsigned char *hash,
1409 size_t *hlen )
1410 {
1411 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1412 size_t hash_size;
1413 psa_status_t status;
1414 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
1415
1416 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
1417 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
1418 if( status != PSA_SUCCESS )
1419 {
1420 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
1421 return;
1422 }
1423
1424 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
1425 if( status != PSA_SUCCESS )
1426 {
1427 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
1428 return;
1429 }
1430
1431 *hlen = 48;
1432 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
1433 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
1434 #else
1435 mbedtls_sha512_context sha512;
1436
1437 mbedtls_sha512_init( &sha512 );
1438
1439 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1440
1441 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1442 mbedtls_sha512_finish( &sha512, hash );
1443
1444 *hlen = 48;
1445
1446 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1448
1449 mbedtls_sha512_free( &sha512 );
1450 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1451 return;
1452 }
1453 #endif /* MBEDTLS_SHA384_C */
1454 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1455
1456 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
mbedtls_ssl_psk_derive_premaster(mbedtls_ssl_context * ssl,mbedtls_key_exchange_type_t key_ex)1457 int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
1458 {
1459 unsigned char *p = ssl->handshake->premaster;
1460 unsigned char *end = p + sizeof( ssl->handshake->premaster );
1461 const unsigned char *psk = NULL;
1462 size_t psk_len = 0;
1463
1464 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
1465 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
1466 {
1467 /*
1468 * This should never happen because the existence of a PSK is always
1469 * checked before calling this function
1470 */
1471 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1472 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1473 }
1474
1475 /*
1476 * PMS = struct {
1477 * opaque other_secret<0..2^16-1>;
1478 * opaque psk<0..2^16-1>;
1479 * };
1480 * with "other_secret" depending on the particular key exchange
1481 */
1482 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1483 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
1484 {
1485 if( end - p < 2 )
1486 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1487
1488 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
1489 p += 2;
1490
1491 if( end < p || (size_t)( end - p ) < psk_len )
1492 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1493
1494 memset( p, 0, psk_len );
1495 p += psk_len;
1496 }
1497 else
1498 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1499 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1500 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
1501 {
1502 /*
1503 * other_secret already set by the ClientKeyExchange message,
1504 * and is 48 bytes long
1505 */
1506 if( end - p < 2 )
1507 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1508
1509 *p++ = 0;
1510 *p++ = 48;
1511 p += 48;
1512 }
1513 else
1514 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1515 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1516 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
1517 {
1518 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1519 size_t len;
1520
1521 /* Write length only when we know the actual value */
1522 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
1523 p + 2, end - ( p + 2 ), &len,
1524 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
1525 {
1526 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
1527 return( ret );
1528 }
1529 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
1530 p += 2 + len;
1531
1532 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
1533 }
1534 else
1535 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1536 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1537 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
1538 {
1539 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1540 size_t zlen;
1541
1542 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
1543 p + 2, end - ( p + 2 ),
1544 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
1545 {
1546 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
1547 return( ret );
1548 }
1549
1550 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
1551 p += 2 + zlen;
1552
1553 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
1554 MBEDTLS_DEBUG_ECDH_Z );
1555 }
1556 else
1557 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
1558 {
1559 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1560 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1561 }
1562
1563 /* opaque psk<0..2^16-1>; */
1564 if( end - p < 2 )
1565 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1566
1567 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
1568 p += 2;
1569
1570 if( end < p || (size_t)( end - p ) < psk_len )
1571 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1572
1573 memcpy( p, psk, psk_len );
1574 p += psk_len;
1575
1576 ssl->handshake->pmslen = p - ssl->handshake->premaster;
1577
1578 return( 0 );
1579 }
1580 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1581
1582 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
1583 static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
1584
1585 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_resend_hello_request(mbedtls_ssl_context * ssl)1586 int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
1587 {
1588 /* If renegotiation is not enforced, retransmit until we would reach max
1589 * timeout if we were using the usual handshake doubling scheme */
1590 if( ssl->conf->renego_max_records < 0 )
1591 {
1592 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
1593 unsigned char doublings = 1;
1594
1595 while( ratio != 0 )
1596 {
1597 ++doublings;
1598 ratio >>= 1;
1599 }
1600
1601 if( ++ssl->renego_records_seen > doublings )
1602 {
1603 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
1604 return( 0 );
1605 }
1606 }
1607
1608 return( ssl_write_hello_request( ssl ) );
1609 }
1610 #endif
1611 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
1612
1613 #if defined(MBEDTLS_X509_CRT_PARSE_C)
ssl_clear_peer_cert(mbedtls_ssl_session * session)1614 static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
1615 {
1616 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
1617 if( session->peer_cert != NULL )
1618 {
1619 mbedtls_x509_crt_free( session->peer_cert );
1620 mbedtls_free( session->peer_cert );
1621 session->peer_cert = NULL;
1622 }
1623 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1624 if( session->peer_cert_digest != NULL )
1625 {
1626 /* Zeroization is not necessary. */
1627 mbedtls_free( session->peer_cert_digest );
1628 session->peer_cert_digest = NULL;
1629 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
1630 session->peer_cert_digest_len = 0;
1631 }
1632 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1633 }
1634 #endif /* MBEDTLS_X509_CRT_PARSE_C */
1635
1636 /*
1637 * Handshake functions
1638 */
1639 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1640 /* No certificate support -> dummy functions */
mbedtls_ssl_write_certificate(mbedtls_ssl_context * ssl)1641 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
1642 {
1643 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1644 ssl->handshake->ciphersuite_info;
1645
1646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
1647
1648 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
1649 {
1650 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1651 ssl->state++;
1652 return( 0 );
1653 }
1654
1655 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1656 #ifdef ESCP_MBDTLS_CUSTOMIZATION
1657 TRACE_VISUAL("err");
1658 #endif
1659 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1660 }
1661
mbedtls_ssl_parse_certificate(mbedtls_ssl_context * ssl)1662 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
1663 {
1664 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1665 ssl->handshake->ciphersuite_info;
1666
1667 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
1668
1669 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
1670 {
1671 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
1672 ssl->state++;
1673 return( 0 );
1674 }
1675
1676 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1677 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1678 }
1679
1680 #else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1681 /* Some certificate support -> implement write and parse */
1682
mbedtls_ssl_write_certificate(mbedtls_ssl_context * ssl)1683 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
1684 {
1685 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1686 size_t i, n;
1687 const mbedtls_x509_crt *crt;
1688 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1689 ssl->handshake->ciphersuite_info;
1690
1691 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
1692
1693 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
1694 {
1695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1696 ssl->state++;
1697 return( 0 );
1698 }
1699
1700 #if defined(MBEDTLS_SSL_CLI_C)
1701 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
1702 {
1703 if( ssl->client_auth == 0 )
1704 {
1705 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1706 ssl->state++;
1707 return( 0 );
1708 }
1709 }
1710 #endif /* MBEDTLS_SSL_CLI_C */
1711 #if defined(MBEDTLS_SSL_SRV_C)
1712 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1713 {
1714 if( mbedtls_ssl_own_cert( ssl ) == NULL )
1715 {
1716 /* Should never happen because we shouldn't have picked the
1717 * ciphersuite if we don't have a certificate. */
1718 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1719 }
1720 }
1721 #endif
1722
1723 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
1724
1725 /*
1726 * 0 . 0 handshake type
1727 * 1 . 3 handshake length
1728 * 4 . 6 length of all certs
1729 * 7 . 9 length of cert. 1
1730 * 10 . n-1 peer certificate
1731 * n . n+2 length of cert. 2
1732 * n+3 . ... upper level cert, etc.
1733 */
1734 i = 7;
1735 crt = mbedtls_ssl_own_cert( ssl );
1736
1737 while( crt != NULL )
1738 {
1739 n = crt->raw.len;
1740 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
1741 {
1742 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
1743 " > %" MBEDTLS_PRINTF_SIZET,
1744 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
1745 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
1746 }
1747
1748 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
1749 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
1750 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
1751
1752 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
1753 i += n; crt = crt->next;
1754 }
1755
1756 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
1757 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
1758 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
1759
1760 ssl->out_msglen = i;
1761 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
1762 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
1763
1764 ssl->state++;
1765
1766 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
1767 {
1768 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
1769 return( ret );
1770 }
1771
1772 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
1773
1774 return( ret );
1775 }
1776
1777 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1778
1779 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ssl_check_peer_crt_unchanged(mbedtls_ssl_context * ssl,unsigned char * crt_buf,size_t crt_buf_len)1780 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
1781 unsigned char *crt_buf,
1782 size_t crt_buf_len )
1783 {
1784 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
1785
1786 if( peer_crt == NULL )
1787 return( -1 );
1788
1789 if( peer_crt->raw.len != crt_buf_len )
1790 return( -1 );
1791
1792 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
1793 }
1794 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
ssl_check_peer_crt_unchanged(mbedtls_ssl_context * ssl,unsigned char * crt_buf,size_t crt_buf_len)1795 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
1796 unsigned char *crt_buf,
1797 size_t crt_buf_len )
1798 {
1799 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1800 unsigned char const * const peer_cert_digest =
1801 ssl->session->peer_cert_digest;
1802 mbedtls_md_type_t const peer_cert_digest_type =
1803 ssl->session->peer_cert_digest_type;
1804 mbedtls_md_info_t const * const digest_info =
1805 mbedtls_md_info_from_type( peer_cert_digest_type );
1806 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
1807 size_t digest_len;
1808
1809 if( peer_cert_digest == NULL || digest_info == NULL )
1810 return( -1 );
1811
1812 digest_len = mbedtls_md_get_size( digest_info );
1813 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
1814 return( -1 );
1815
1816 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
1817 if( ret != 0 )
1818 return( -1 );
1819
1820 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
1821 }
1822 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1823 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
1824
1825 /*
1826 * Once the certificate message is read, parse it into a cert chain and
1827 * perform basic checks, but leave actual verification to the caller
1828 */
ssl_parse_certificate_chain(mbedtls_ssl_context * ssl,mbedtls_x509_crt * chain)1829 static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
1830 mbedtls_x509_crt *chain )
1831 {
1832 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1833 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1834 int crt_cnt=0;
1835 #endif
1836 size_t i, n;
1837 uint8_t alert;
1838
1839 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
1840 {
1841 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1842 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1843 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
1844 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1845 }
1846
1847 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
1848 {
1849 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1850 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
1851 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1852 }
1853
1854 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
1855 {
1856 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1857 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1858 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1859 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1860 }
1861
1862 i = mbedtls_ssl_hs_hdr_len( ssl );
1863
1864 /*
1865 * Same message structure as in mbedtls_ssl_write_certificate()
1866 */
1867 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
1868
1869 if( ssl->in_msg[i] != 0 ||
1870 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
1871 {
1872 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1873 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1874 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1875 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1876 }
1877
1878 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
1879 i += 3;
1880
1881 /* Iterate through and parse the CRTs in the provided chain. */
1882 while( i < ssl->in_hslen )
1883 {
1884 /* Check that there's room for the next CRT's length fields. */
1885 if ( i + 3 > ssl->in_hslen ) {
1886 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1887 mbedtls_ssl_send_alert_message( ssl,
1888 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1889 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1890 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1891 }
1892 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
1893 * anything beyond 2**16 ~ 64K. */
1894 if( ssl->in_msg[i] != 0 )
1895 {
1896 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1897 mbedtls_ssl_send_alert_message( ssl,
1898 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1899 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
1900 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
1901 }
1902
1903 /* Read length of the next CRT in the chain. */
1904 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
1905 | (unsigned int) ssl->in_msg[i + 2];
1906 i += 3;
1907
1908 if( n < 128 || i + n > ssl->in_hslen )
1909 {
1910 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1911 mbedtls_ssl_send_alert_message( ssl,
1912 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1913 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1914 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1915 }
1916
1917 /* Check if we're handling the first CRT in the chain. */
1918 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
1919 if( crt_cnt++ == 0 &&
1920 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
1921 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
1922 {
1923 /* During client-side renegotiation, check that the server's
1924 * end-CRTs hasn't changed compared to the initial handshake,
1925 * mitigating the triple handshake attack. On success, reuse
1926 * the original end-CRT instead of parsing it again. */
1927 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
1928 if( ssl_check_peer_crt_unchanged( ssl,
1929 &ssl->in_msg[i],
1930 n ) != 0 )
1931 {
1932 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
1933 mbedtls_ssl_send_alert_message( ssl,
1934 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1935 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
1936 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
1937 }
1938
1939 /* Now we can safely free the original chain. */
1940 ssl_clear_peer_cert( ssl->session );
1941 }
1942 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
1943
1944 /* Parse the next certificate in the chain. */
1945 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
1946 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
1947 #else
1948 /* If we don't need to store the CRT chain permanently, parse
1949 * it in-place from the input buffer instead of making a copy. */
1950 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
1951 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
1952 switch( ret )
1953 {
1954 case 0: /*ok*/
1955 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
1956 /* Ignore certificate with an unknown algorithm: maybe a
1957 prior certificate was already trusted. */
1958 break;
1959
1960 case MBEDTLS_ERR_X509_ALLOC_FAILED:
1961 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
1962 goto crt_parse_der_failed;
1963
1964 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
1965 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
1966 goto crt_parse_der_failed;
1967
1968 default:
1969 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
1970 crt_parse_der_failed:
1971 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
1972 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
1973 return( ret );
1974 }
1975
1976 i += n;
1977 }
1978
1979 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
1980 return( 0 );
1981 }
1982
1983 #if defined(MBEDTLS_SSL_SRV_C)
ssl_srv_check_client_no_crt_notification(mbedtls_ssl_context * ssl)1984 static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
1985 {
1986 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
1987 return( -1 );
1988
1989 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1990 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
1991 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
1992 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
1993 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
1994 {
1995 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
1996 return( 0 );
1997 }
1998
1999 return( -1 );
2000 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2001 }
2002 #endif /* MBEDTLS_SSL_SRV_C */
2003
2004 /* Check if a certificate message is expected.
2005 * Return either
2006 * - SSL_CERTIFICATE_EXPECTED, or
2007 * - SSL_CERTIFICATE_SKIP
2008 * indicating whether a Certificate message is expected or not.
2009 */
2010 #define SSL_CERTIFICATE_EXPECTED 0
2011 #define SSL_CERTIFICATE_SKIP 1
ssl_parse_certificate_coordinate(mbedtls_ssl_context * ssl,int authmode)2012 static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
2013 int authmode )
2014 {
2015 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2016 ssl->handshake->ciphersuite_info;
2017
2018 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
2019 return( SSL_CERTIFICATE_SKIP );
2020
2021 #if defined(MBEDTLS_SSL_SRV_C)
2022 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2023 {
2024 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2025 return( SSL_CERTIFICATE_SKIP );
2026
2027 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2028 {
2029 ssl->session_negotiate->verify_result =
2030 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
2031 return( SSL_CERTIFICATE_SKIP );
2032 }
2033 }
2034 #else
2035 ((void) authmode);
2036 #endif /* MBEDTLS_SSL_SRV_C */
2037
2038 return( SSL_CERTIFICATE_EXPECTED );
2039 }
2040
ssl_parse_certificate_verify(mbedtls_ssl_context * ssl,int authmode,mbedtls_x509_crt * chain,void * rs_ctx)2041 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
2042 int authmode,
2043 mbedtls_x509_crt *chain,
2044 void *rs_ctx )
2045 {
2046 int ret = 0;
2047 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2048 ssl->handshake->ciphersuite_info;
2049 int have_ca_chain = 0;
2050
2051 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
2052 void *p_vrfy;
2053
2054 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
2055 return( 0 );
2056
2057 if( ssl->f_vrfy != NULL )
2058 {
2059 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
2060 f_vrfy = ssl->f_vrfy;
2061 p_vrfy = ssl->p_vrfy;
2062 }
2063 else
2064 {
2065 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
2066 f_vrfy = ssl->conf->f_vrfy;
2067 p_vrfy = ssl->conf->p_vrfy;
2068 }
2069
2070 /*
2071 * Main check: verify certificate
2072 */
2073 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
2074 if( ssl->conf->f_ca_cb != NULL )
2075 {
2076 ((void) rs_ctx);
2077 have_ca_chain = 1;
2078
2079 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
2080 ret = mbedtls_x509_crt_verify_with_ca_cb(
2081 chain,
2082 ssl->conf->f_ca_cb,
2083 ssl->conf->p_ca_cb,
2084 ssl->conf->cert_profile,
2085 ssl->hostname,
2086 &ssl->session_negotiate->verify_result,
2087 f_vrfy, p_vrfy );
2088 }
2089 else
2090 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
2091 {
2092 mbedtls_x509_crt *ca_chain;
2093 mbedtls_x509_crl *ca_crl;
2094
2095 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2096 if( ssl->handshake->sni_ca_chain != NULL )
2097 {
2098 ca_chain = ssl->handshake->sni_ca_chain;
2099 ca_crl = ssl->handshake->sni_ca_crl;
2100 }
2101 else
2102 #endif
2103 {
2104 ca_chain = ssl->conf->ca_chain;
2105 ca_crl = ssl->conf->ca_crl;
2106 }
2107
2108 if( ca_chain != NULL )
2109 have_ca_chain = 1;
2110
2111 ret = mbedtls_x509_crt_verify_restartable(
2112 chain,
2113 ca_chain, ca_crl,
2114 ssl->conf->cert_profile,
2115 ssl->hostname,
2116 &ssl->session_negotiate->verify_result,
2117 f_vrfy, p_vrfy, rs_ctx );
2118 }
2119
2120 if( ret != 0 )
2121 {
2122 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
2123 }
2124
2125 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2126 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2127 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
2128 #endif
2129
2130 /*
2131 * Secondary checks: always done, but change 'ret' only if it was 0
2132 */
2133
2134 #if defined(MBEDTLS_ECP_C)
2135 {
2136 const mbedtls_pk_context *pk = &chain->pk;
2137
2138 /* If certificate uses an EC key, make sure the curve is OK */
2139 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
2140 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
2141 {
2142 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
2143
2144 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
2145 if( ret == 0 )
2146 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
2147 }
2148 }
2149 #endif /* MBEDTLS_ECP_C */
2150
2151 if( mbedtls_ssl_check_cert_usage( chain,
2152 ciphersuite_info,
2153 ! ssl->conf->endpoint,
2154 &ssl->session_negotiate->verify_result ) != 0 )
2155 {
2156 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
2157 if( ret == 0 )
2158 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
2159 }
2160
2161 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
2162 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
2163 * with details encoded in the verification flags. All other kinds
2164 * of error codes, including those from the user provided f_vrfy
2165 * functions, are treated as fatal and lead to a failure of
2166 * ssl_parse_certificate even if verification was optional. */
2167 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
2168 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
2169 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
2170 {
2171 ret = 0;
2172 }
2173
2174 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
2175 {
2176 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
2177 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
2178 }
2179
2180 if( ret != 0 )
2181 {
2182 uint8_t alert;
2183
2184 /* The certificate may have been rejected for several reasons.
2185 Pick one and send the corresponding alert. Which alert to send
2186 may be a subject of debate in some cases. */
2187 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
2188 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
2189 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
2190 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
2191 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
2192 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2193 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
2194 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2195 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
2196 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2197 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
2198 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2199 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
2200 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
2201 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
2202 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
2203 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
2204 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
2205 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
2206 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
2207 else
2208 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
2209 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2210 alert );
2211 }
2212
2213 #if defined(MBEDTLS_DEBUG_C)
2214 if( ssl->session_negotiate->verify_result != 0 )
2215 {
2216 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
2217 (unsigned int) ssl->session_negotiate->verify_result ) );
2218 }
2219 else
2220 {
2221 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
2222 }
2223 #endif /* MBEDTLS_DEBUG_C */
2224
2225 return( ret );
2226 }
2227
2228 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ssl_remember_peer_crt_digest(mbedtls_ssl_context * ssl,unsigned char * start,size_t len)2229 static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
2230 unsigned char *start, size_t len )
2231 {
2232 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2233 /* Remember digest of the peer's end-CRT. */
2234 ssl->session_negotiate->peer_cert_digest =
2235 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
2236 if( ssl->session_negotiate->peer_cert_digest == NULL )
2237 {
2238 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
2239 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
2240 mbedtls_ssl_send_alert_message( ssl,
2241 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2242 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2243
2244 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2245 }
2246
2247 ret = mbedtls_md( mbedtls_md_info_from_type(
2248 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
2249 start, len,
2250 ssl->session_negotiate->peer_cert_digest );
2251
2252 ssl->session_negotiate->peer_cert_digest_type =
2253 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
2254 ssl->session_negotiate->peer_cert_digest_len =
2255 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
2256
2257 return( ret );
2258 }
2259
ssl_remember_peer_pubkey(mbedtls_ssl_context * ssl,unsigned char * start,size_t len)2260 static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
2261 unsigned char *start, size_t len )
2262 {
2263 unsigned char *end = start + len;
2264 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2265
2266 /* Make a copy of the peer's raw public key. */
2267 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
2268 ret = mbedtls_pk_parse_subpubkey( &start, end,
2269 &ssl->handshake->peer_pubkey );
2270 if( ret != 0 )
2271 {
2272 /* We should have parsed the public key before. */
2273 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2274 }
2275
2276 return( 0 );
2277 }
2278 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2279
mbedtls_ssl_parse_certificate(mbedtls_ssl_context * ssl)2280 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
2281 {
2282 int ret = 0;
2283 int crt_expected;
2284 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2285 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
2286 ? ssl->handshake->sni_authmode
2287 : ssl->conf->authmode;
2288 #else
2289 const int authmode = ssl->conf->authmode;
2290 #endif
2291 void *rs_ctx = NULL;
2292 mbedtls_x509_crt *chain = NULL;
2293
2294 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2295
2296 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
2297 if( crt_expected == SSL_CERTIFICATE_SKIP )
2298 {
2299 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
2300 goto exit;
2301 }
2302
2303 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2304 if( ssl->handshake->ecrs_enabled &&
2305 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
2306 {
2307 chain = ssl->handshake->ecrs_peer_cert;
2308 ssl->handshake->ecrs_peer_cert = NULL;
2309 goto crt_verify;
2310 }
2311 #endif
2312
2313 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2314 {
2315 /* mbedtls_ssl_read_record may have sent an alert already. We
2316 let it decide whether to alert. */
2317 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2318 goto exit;
2319 }
2320
2321 #if defined(MBEDTLS_SSL_SRV_C)
2322 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
2323 {
2324 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
2325
2326 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
2327 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
2328
2329 goto exit;
2330 }
2331 #endif /* MBEDTLS_SSL_SRV_C */
2332
2333 /* Clear existing peer CRT structure in case we tried to
2334 * reuse a session but it failed, and allocate a new one. */
2335 ssl_clear_peer_cert( ssl->session_negotiate );
2336
2337 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
2338 if( chain == NULL )
2339 {
2340 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
2341 sizeof( mbedtls_x509_crt ) ) );
2342 mbedtls_ssl_send_alert_message( ssl,
2343 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2344 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2345
2346 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
2347 goto exit;
2348 }
2349 mbedtls_x509_crt_init( chain );
2350
2351 ret = ssl_parse_certificate_chain( ssl, chain );
2352 if( ret != 0 )
2353 goto exit;
2354
2355 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2356 if( ssl->handshake->ecrs_enabled)
2357 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
2358
2359 crt_verify:
2360 if( ssl->handshake->ecrs_enabled)
2361 rs_ctx = &ssl->handshake->ecrs_ctx;
2362 #endif
2363
2364 ret = ssl_parse_certificate_verify( ssl, authmode,
2365 chain, rs_ctx );
2366 if( ret != 0 )
2367 goto exit;
2368
2369 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2370 {
2371 unsigned char *crt_start, *pk_start;
2372 size_t crt_len, pk_len;
2373
2374 /* We parse the CRT chain without copying, so
2375 * these pointers point into the input buffer,
2376 * and are hence still valid after freeing the
2377 * CRT chain. */
2378
2379 crt_start = chain->raw.p;
2380 crt_len = chain->raw.len;
2381
2382 pk_start = chain->pk_raw.p;
2383 pk_len = chain->pk_raw.len;
2384
2385 /* Free the CRT structures before computing
2386 * digest and copying the peer's public key. */
2387 mbedtls_x509_crt_free( chain );
2388 mbedtls_free( chain );
2389 chain = NULL;
2390
2391 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
2392 if( ret != 0 )
2393 goto exit;
2394
2395 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
2396 if( ret != 0 )
2397 goto exit;
2398 }
2399 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2400 /* Pass ownership to session structure. */
2401 ssl->session_negotiate->peer_cert = chain;
2402 chain = NULL;
2403 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2404
2405 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
2406
2407 exit:
2408
2409 if( ret == 0 )
2410 ssl->state++;
2411
2412 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2413 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
2414 {
2415 ssl->handshake->ecrs_peer_cert = chain;
2416 chain = NULL;
2417 }
2418 #endif
2419
2420 if( chain != NULL )
2421 {
2422 mbedtls_x509_crt_free( chain );
2423 mbedtls_free( chain );
2424 }
2425
2426 return( ret );
2427 }
2428 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
2429
mbedtls_ssl_optimize_checksum(mbedtls_ssl_context * ssl,const mbedtls_ssl_ciphersuite_t * ciphersuite_info)2430 void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
2431 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
2432 {
2433 ((void) ciphersuite_info);
2434
2435 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2436 #if defined(MBEDTLS_SHA384_C)
2437 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
2438 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
2439 else
2440 #endif
2441 #if defined(MBEDTLS_SHA256_C)
2442 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
2443 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
2444 else
2445 #endif
2446 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2447 {
2448 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2449 return;
2450 }
2451 }
2452
mbedtls_ssl_reset_checksum(mbedtls_ssl_context * ssl)2453 void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
2454 {
2455 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2456 #if defined(MBEDTLS_SHA256_C)
2457 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2458 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
2459 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2460 #else
2461 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
2462 #endif
2463 #endif
2464 #if defined(MBEDTLS_SHA384_C)
2465 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2466 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
2467 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
2468 #else
2469 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
2470 #endif
2471 #endif
2472 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2473 }
2474
ssl_update_checksum_start(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2475 static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
2476 const unsigned char *buf, size_t len )
2477 {
2478 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2479 #if defined(MBEDTLS_SHA256_C)
2480 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2481 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2482 #else
2483 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
2484 #endif
2485 #endif
2486 #if defined(MBEDTLS_SHA384_C)
2487 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2488 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
2489 #else
2490 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
2491 #endif
2492 #endif
2493 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2494 }
2495
2496 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2497 #if defined(MBEDTLS_SHA256_C)
ssl_update_checksum_sha256(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2498 static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
2499 const unsigned char *buf, size_t len )
2500 {
2501 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2502 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
2503 #else
2504 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
2505 #endif
2506 }
2507 #endif
2508
2509 #if defined(MBEDTLS_SHA384_C)
ssl_update_checksum_sha384(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)2510 static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
2511 const unsigned char *buf, size_t len )
2512 {
2513 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2514 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
2515 #else
2516 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
2517 #endif
2518 }
2519 #endif
2520 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2521
2522 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2523 #if defined(MBEDTLS_SHA256_C)
ssl_calc_finished_tls_sha256(mbedtls_ssl_context * ssl,unsigned char * buf,int from)2524 static void ssl_calc_finished_tls_sha256(
2525 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
2526 {
2527 int len = 12;
2528 const char *sender;
2529 unsigned char padbuf[32];
2530 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2531 size_t hash_size;
2532 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
2533 psa_status_t status;
2534 #else
2535 mbedtls_sha256_context sha256;
2536 #endif
2537
2538 mbedtls_ssl_session *session = ssl->session_negotiate;
2539 if( !session )
2540 session = ssl->session;
2541
2542 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
2543 ? "client finished"
2544 : "server finished";
2545
2546 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2547 sha256_psa = psa_hash_operation_init();
2548
2549 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
2550
2551 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
2552 if( status != PSA_SUCCESS )
2553 {
2554 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
2555 return;
2556 }
2557
2558 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
2559 if( status != PSA_SUCCESS )
2560 {
2561 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
2562 return;
2563 }
2564 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
2565 #else
2566
2567 mbedtls_sha256_init( &sha256 );
2568
2569 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
2570
2571 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
2572
2573 /*
2574 * TLSv1.2:
2575 * hash = PRF( master, finished_label,
2576 * Hash( handshake ) )[0.11]
2577 */
2578
2579 #if !defined(MBEDTLS_SHA256_ALT)
2580 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
2581 sha256.state, sizeof( sha256.state ) );
2582 #endif
2583
2584 mbedtls_sha256_finish( &sha256, padbuf );
2585 mbedtls_sha256_free( &sha256 );
2586 #endif /* MBEDTLS_USE_PSA_CRYPTO */
2587
2588 ssl->handshake->tls_prf( session->master, 48, sender,
2589 padbuf, 32, buf, len );
2590
2591 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
2592
2593 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
2594
2595 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
2596 }
2597 #endif /* MBEDTLS_SHA256_C */
2598
2599 #if defined(MBEDTLS_SHA384_C)
2600
ssl_calc_finished_tls_sha384(mbedtls_ssl_context * ssl,unsigned char * buf,int from)2601 static void ssl_calc_finished_tls_sha384(
2602 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
2603 {
2604 int len = 12;
2605 const char *sender;
2606 unsigned char padbuf[48];
2607 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2608 size_t hash_size;
2609 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
2610 psa_status_t status;
2611 #else
2612 mbedtls_sha512_context sha512;
2613 #endif
2614
2615 mbedtls_ssl_session *session = ssl->session_negotiate;
2616 if( !session )
2617 session = ssl->session;
2618
2619 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
2620 ? "client finished"
2621 : "server finished";
2622
2623 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2624 sha384_psa = psa_hash_operation_init();
2625
2626 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
2627
2628 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
2629 if( status != PSA_SUCCESS )
2630 {
2631 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
2632 return;
2633 }
2634
2635 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
2636 if( status != PSA_SUCCESS )
2637 {
2638 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
2639 return;
2640 }
2641 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
2642 #else
2643 mbedtls_sha512_init( &sha512 );
2644
2645 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
2646
2647 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
2648
2649 /*
2650 * TLSv1.2:
2651 * hash = PRF( master, finished_label,
2652 * Hash( handshake ) )[0.11]
2653 */
2654
2655 #if !defined(MBEDTLS_SHA512_ALT)
2656 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
2657 sha512.state, sizeof( sha512.state ) );
2658 #endif
2659 mbedtls_sha512_finish( &sha512, padbuf );
2660
2661 mbedtls_sha512_free( &sha512 );
2662 #endif
2663
2664 ssl->handshake->tls_prf( session->master, 48, sender,
2665 padbuf, 48, buf, len );
2666
2667 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
2668
2669 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
2670
2671 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
2672 }
2673 #endif /* MBEDTLS_SHA384_C */
2674 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2675
mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context * ssl)2676 void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
2677 {
2678 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
2679
2680 /*
2681 * Free our handshake params
2682 */
2683 mbedtls_ssl_handshake_free( ssl );
2684 mbedtls_free( ssl->handshake );
2685 ssl->handshake = NULL;
2686
2687 /*
2688 * Free the previous transform and swith in the current one
2689 */
2690 if( ssl->transform )
2691 {
2692 mbedtls_ssl_transform_free( ssl->transform );
2693 mbedtls_free( ssl->transform );
2694 }
2695 ssl->transform = ssl->transform_negotiate;
2696 ssl->transform_negotiate = NULL;
2697
2698 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
2699 }
2700
mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context * ssl)2701 void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
2702 {
2703 int resume = ssl->handshake->resume;
2704
2705 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
2706
2707 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2708 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
2709 {
2710 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
2711 ssl->renego_records_seen = 0;
2712 }
2713 #endif
2714
2715 /*
2716 * Free the previous session and switch in the current one
2717 */
2718 if( ssl->session )
2719 {
2720 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2721 /* RFC 7366 3.1: keep the EtM state */
2722 ssl->session_negotiate->encrypt_then_mac =
2723 ssl->session->encrypt_then_mac;
2724 #endif
2725
2726 mbedtls_ssl_session_free( ssl->session );
2727 mbedtls_free( ssl->session );
2728 }
2729 ssl->session = ssl->session_negotiate;
2730 ssl->session_negotiate = NULL;
2731
2732 /*
2733 * Add cache entry
2734 */
2735 if( ssl->conf->f_set_cache != NULL &&
2736 ssl->session->id_len != 0 &&
2737 resume == 0 )
2738 {
2739 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
2740 ssl->session->id,
2741 ssl->session->id_len,
2742 ssl->session ) != 0 )
2743 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
2744 }
2745
2746 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2747 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2748 ssl->handshake->flight != NULL )
2749 {
2750 /* Cancel handshake timer */
2751 mbedtls_ssl_set_timer( ssl, 0 );
2752
2753 /* Keep last flight around in case we need to resend it:
2754 * we need the handshake and transform structures for that */
2755 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
2756 }
2757 else
2758 #endif
2759 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
2760
2761 ssl->state++;
2762
2763 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
2764 }
2765
mbedtls_ssl_write_finished(mbedtls_ssl_context * ssl)2766 int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
2767 {
2768 int ret, hash_len;
2769
2770 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
2771
2772 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
2773
2774 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
2775
2776 /*
2777 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
2778 * may define some other value. Currently (early 2016), no defined
2779 * ciphersuite does this (and this is unlikely to change as activity has
2780 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
2781 */
2782 hash_len = 12;
2783
2784 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2785 ssl->verify_data_len = hash_len;
2786 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
2787 #endif
2788
2789 ssl->out_msglen = 4 + hash_len;
2790 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2791 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
2792
2793 /*
2794 * In case of session resuming, invert the client and server
2795 * ChangeCipherSpec messages order.
2796 */
2797 if( ssl->handshake->resume != 0 )
2798 {
2799 #if defined(MBEDTLS_SSL_CLI_C)
2800 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
2801 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
2802 #endif
2803 #if defined(MBEDTLS_SSL_SRV_C)
2804 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2805 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
2806 #endif
2807 }
2808 else
2809 ssl->state++;
2810
2811 /*
2812 * Switch to our negotiated transform and session parameters for outbound
2813 * data.
2814 */
2815 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
2816
2817 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2818 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2819 {
2820 unsigned char i;
2821
2822 /* Remember current epoch settings for resending */
2823 ssl->handshake->alt_transform_out = ssl->transform_out;
2824 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
2825 sizeof( ssl->handshake->alt_out_ctr ) );
2826
2827 /* Set sequence_number to zero */
2828 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
2829
2830
2831 /* Increment epoch */
2832 for( i = 2; i > 0; i-- )
2833 if( ++ssl->cur_out_ctr[i - 1] != 0 )
2834 break;
2835
2836 /* The loop goes to its end iff the counter is wrapping */
2837 if( i == 0 )
2838 {
2839 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
2840 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
2841 }
2842 }
2843 else
2844 #endif /* MBEDTLS_SSL_PROTO_DTLS */
2845 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
2846
2847 ssl->transform_out = ssl->transform_negotiate;
2848 ssl->session_out = ssl->session_negotiate;
2849
2850 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2851 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2852 mbedtls_ssl_send_flight_completed( ssl );
2853 #endif
2854
2855 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
2856 {
2857 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
2858 return( ret );
2859 }
2860
2861 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2862 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2863 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2864 {
2865 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
2866 return( ret );
2867 }
2868 #endif
2869
2870 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
2871
2872 return( 0 );
2873 }
2874
2875 #define SSL_MAX_HASH_LEN 12
2876
mbedtls_ssl_parse_finished(mbedtls_ssl_context * ssl)2877 int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
2878 {
2879 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2880 unsigned int hash_len = 12;
2881 unsigned char buf[SSL_MAX_HASH_LEN];
2882
2883 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
2884
2885 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
2886
2887 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2888 {
2889 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2890 goto exit;
2891 }
2892
2893 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2894 {
2895 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2896 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2897 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2898 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
2899 goto exit;
2900 }
2901
2902 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
2903 {
2904 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2905 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2906 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
2907 goto exit;
2908 }
2909
2910 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
2911 {
2912 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2913 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2914 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2915 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
2916 goto exit;
2917 }
2918
2919 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
2920 buf, hash_len ) != 0 )
2921 {
2922 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2923 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2924 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
2925 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2926 goto exit;
2927 }
2928
2929 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2930 ssl->verify_data_len = hash_len;
2931 memcpy( ssl->peer_verify_data, buf, hash_len );
2932 #endif
2933
2934 if( ssl->handshake->resume != 0 )
2935 {
2936 #if defined(MBEDTLS_SSL_CLI_C)
2937 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
2938 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
2939 #endif
2940 #if defined(MBEDTLS_SSL_SRV_C)
2941 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
2942 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
2943 #endif
2944 }
2945 else
2946 ssl->state++;
2947
2948 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2949 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2950 mbedtls_ssl_recv_flight_completed( ssl );
2951 #endif
2952
2953 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
2954
2955 exit:
2956 mbedtls_platform_zeroize( buf, hash_len );
2957 return( ret );
2958 }
2959
ssl_handshake_params_init(mbedtls_ssl_handshake_params * handshake)2960 static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
2961 {
2962 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
2963
2964 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2965 #if defined(MBEDTLS_SHA256_C)
2966 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2967 handshake->fin_sha256_psa = psa_hash_operation_init();
2968 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
2969 #else
2970 mbedtls_sha256_init( &handshake->fin_sha256 );
2971 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
2972 #endif
2973 #endif
2974 #if defined(MBEDTLS_SHA384_C)
2975 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2976 handshake->fin_sha384_psa = psa_hash_operation_init();
2977 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
2978 #else
2979 mbedtls_sha512_init( &handshake->fin_sha512 );
2980 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
2981 #endif
2982 #endif
2983 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2984
2985 handshake->update_checksum = ssl_update_checksum_start;
2986
2987 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
2988 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
2989 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
2990 #endif
2991
2992 #if defined(MBEDTLS_DHM_C)
2993 mbedtls_dhm_init( &handshake->dhm_ctx );
2994 #endif
2995 #if defined(MBEDTLS_ECDH_C)
2996 mbedtls_ecdh_init( &handshake->ecdh_ctx );
2997 #endif
2998 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2999 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
3000 #if defined(MBEDTLS_SSL_CLI_C)
3001 handshake->ecjpake_cache = NULL;
3002 handshake->ecjpake_cache_len = 0;
3003 #endif
3004 #endif
3005
3006 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3007 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
3008 #endif
3009
3010 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3011 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
3012 #endif
3013
3014 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3015 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3016 mbedtls_pk_init( &handshake->peer_pubkey );
3017 #endif
3018 }
3019
mbedtls_ssl_transform_init(mbedtls_ssl_transform * transform)3020 void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
3021 {
3022 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
3023
3024 mbedtls_cipher_init( &transform->cipher_ctx_enc );
3025 mbedtls_cipher_init( &transform->cipher_ctx_dec );
3026
3027 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
3028 mbedtls_md_init( &transform->md_ctx_enc );
3029 mbedtls_md_init( &transform->md_ctx_dec );
3030 #endif
3031 }
3032
mbedtls_ssl_session_init(mbedtls_ssl_session * session)3033 void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
3034 {
3035 memset( session, 0, sizeof(mbedtls_ssl_session) );
3036 }
3037
ssl_handshake_init(mbedtls_ssl_context * ssl)3038 static int ssl_handshake_init( mbedtls_ssl_context *ssl )
3039 {
3040 /* Clear old handshake information if present */
3041 if( ssl->transform_negotiate )
3042 mbedtls_ssl_transform_free( ssl->transform_negotiate );
3043 if( ssl->session_negotiate )
3044 mbedtls_ssl_session_free( ssl->session_negotiate );
3045 if( ssl->handshake )
3046 mbedtls_ssl_handshake_free( ssl );
3047
3048 /*
3049 * Either the pointers are now NULL or cleared properly and can be freed.
3050 * Now allocate missing structures.
3051 */
3052 if( ssl->transform_negotiate == NULL )
3053 {
3054 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
3055 }
3056
3057 if( ssl->session_negotiate == NULL )
3058 {
3059 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
3060 }
3061
3062 if( ssl->handshake == NULL )
3063 {
3064 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
3065 }
3066 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3067 /* If the buffers are too small - reallocate */
3068
3069 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
3070 MBEDTLS_SSL_OUT_BUFFER_LEN );
3071 #endif
3072
3073 /* All pointers should exist and can be directly freed without issue */
3074 if( ssl->handshake == NULL ||
3075 ssl->transform_negotiate == NULL ||
3076 ssl->session_negotiate == NULL )
3077 {
3078 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
3079
3080 mbedtls_free( ssl->handshake );
3081 mbedtls_free( ssl->transform_negotiate );
3082 mbedtls_free( ssl->session_negotiate );
3083
3084 ssl->handshake = NULL;
3085 ssl->transform_negotiate = NULL;
3086 ssl->session_negotiate = NULL;
3087
3088 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3089 }
3090
3091 /* Initialize structures */
3092 mbedtls_ssl_session_init( ssl->session_negotiate );
3093 mbedtls_ssl_transform_init( ssl->transform_negotiate );
3094 ssl_handshake_params_init( ssl->handshake );
3095
3096 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3097 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3098 {
3099 ssl->handshake->alt_transform_out = ssl->transform_out;
3100
3101 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
3102 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
3103 else
3104 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
3105
3106 mbedtls_ssl_set_timer( ssl, 0 );
3107 }
3108 #endif
3109
3110 /*
3111 * curve_list is translated to IANA TLS group identifiers here because
3112 * mbedtls_ssl_conf_curves returns void and so can't return
3113 * any error codes.
3114 */
3115 #if defined(MBEDTLS_ECP_C)
3116 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
3117 /* Heap allocate and translate curve_list from internal to IANA group ids */
3118 if ( ssl->conf->curve_list != NULL )
3119 {
3120 size_t length;
3121 size_t i;
3122 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
3123
3124 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
3125 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
3126
3127 /* Leave room for zero termination */
3128 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
3129 if ( group_list == NULL )
3130 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3131
3132 for( i = 0; i < length; i++ )
3133 {
3134 const mbedtls_ecp_curve_info *info =
3135 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
3136 if ( info == NULL )
3137 {
3138 mbedtls_free( group_list );
3139 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3140 }
3141 group_list[i] = info->tls_id;
3142 }
3143
3144 group_list[length] = 0;
3145
3146 ssl->handshake->group_list = group_list;
3147 ssl->handshake->group_list_heap_allocated = 1;
3148 }
3149 else
3150 {
3151 ssl->handshake->group_list = ssl->conf->group_list;
3152 ssl->handshake->group_list_heap_allocated = 0;
3153 }
3154 #endif /* MBEDTLS_DEPRECATED_REMOVED */
3155 #endif /* MBEDTLS_ECP_C */
3156
3157 return( 0 );
3158 }
3159
3160 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
3161 /* Dummy cookie callbacks for defaults */
ssl_cookie_write_dummy(void * ctx,unsigned char ** p,unsigned char * end,const unsigned char * cli_id,size_t cli_id_len)3162 static int ssl_cookie_write_dummy( void *ctx,
3163 unsigned char **p, unsigned char *end,
3164 const unsigned char *cli_id, size_t cli_id_len )
3165 {
3166 ((void) ctx);
3167 ((void) p);
3168 ((void) end);
3169 ((void) cli_id);
3170 ((void) cli_id_len);
3171
3172 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3173 }
3174
ssl_cookie_check_dummy(void * ctx,const unsigned char * cookie,size_t cookie_len,const unsigned char * cli_id,size_t cli_id_len)3175 static int ssl_cookie_check_dummy( void *ctx,
3176 const unsigned char *cookie, size_t cookie_len,
3177 const unsigned char *cli_id, size_t cli_id_len )
3178 {
3179 ((void) ctx);
3180 ((void) cookie);
3181 ((void) cookie_len);
3182 ((void) cli_id);
3183 ((void) cli_id_len);
3184
3185 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3186 }
3187 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
3188
3189 /*
3190 * Initialize an SSL context
3191 */
mbedtls_ssl_init(mbedtls_ssl_context * ssl)3192 void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
3193 {
3194 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
3195 }
3196
ssl_conf_version_check(const mbedtls_ssl_context * ssl)3197 static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
3198 {
3199 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3200 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
3201 {
3202 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3203 {
3204 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported" ) );
3205 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3206 }
3207 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
3208 return( 0 );
3209 }
3210 #endif
3211
3212 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3213 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
3214 {
3215 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
3216 return( 0 );
3217 }
3218 #endif
3219
3220 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
3221 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( ssl->conf ) )
3222 {
3223 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Hybrid TLS 1.2 + TLS 1.3 configurations are not yet supported" ) );
3224 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3225 }
3226 #endif
3227
3228 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
3229 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
3230 }
3231
ssl_conf_check(const mbedtls_ssl_context * ssl)3232 static int ssl_conf_check(const mbedtls_ssl_context *ssl)
3233 {
3234 int ret;
3235 ret = ssl_conf_version_check( ssl );
3236 if( ret != 0 )
3237 return( ret );
3238
3239 /* Space for further checks */
3240
3241 return( 0 );
3242 }
3243
3244 /*
3245 * Setup an SSL context
3246 */
3247
mbedtls_ssl_setup(mbedtls_ssl_context * ssl,const mbedtls_ssl_config * conf)3248 int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
3249 const mbedtls_ssl_config *conf )
3250 {
3251 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3252 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3253 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3254
3255 ssl->conf = conf;
3256
3257 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
3258 return( ret );
3259
3260 /*
3261 * Prepare base structures
3262 */
3263
3264 /* Set to NULL in case of an error condition */
3265 ssl->out_buf = NULL;
3266
3267 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3268 ssl->in_buf_len = in_buf_len;
3269 #endif
3270 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
3271 if( ssl->in_buf == NULL )
3272 {
3273 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
3274 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
3275 goto error;
3276 }
3277
3278 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3279 ssl->out_buf_len = out_buf_len;
3280 #endif
3281 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
3282 if( ssl->out_buf == NULL )
3283 {
3284 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
3285 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
3286 goto error;
3287 }
3288
3289 mbedtls_ssl_reset_in_out_pointers( ssl );
3290
3291 #if defined(MBEDTLS_SSL_DTLS_SRTP)
3292 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
3293 #endif
3294
3295 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3296 goto error;
3297
3298 return( 0 );
3299
3300 error:
3301 mbedtls_free( ssl->in_buf );
3302 mbedtls_free( ssl->out_buf );
3303
3304 ssl->conf = NULL;
3305
3306 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3307 ssl->in_buf_len = 0;
3308 ssl->out_buf_len = 0;
3309 #endif
3310 ssl->in_buf = NULL;
3311 ssl->out_buf = NULL;
3312
3313 ssl->in_hdr = NULL;
3314 ssl->in_ctr = NULL;
3315 ssl->in_len = NULL;
3316 ssl->in_iv = NULL;
3317 ssl->in_msg = NULL;
3318
3319 ssl->out_hdr = NULL;
3320 ssl->out_ctr = NULL;
3321 ssl->out_len = NULL;
3322 ssl->out_iv = NULL;
3323 ssl->out_msg = NULL;
3324
3325 return( ret );
3326 }
3327
3328 /*
3329 * Reset an initialized and used SSL context for re-use while retaining
3330 * all application-set variables, function pointers and data.
3331 *
3332 * If partial is non-zero, keep data in the input buffer and client ID.
3333 * (Use when a DTLS client reconnects from the same port.)
3334 */
ssl_session_reset_msg_layer(mbedtls_ssl_context * ssl,int partial)3335 static void ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
3336 int partial )
3337 {
3338 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3339 size_t in_buf_len = ssl->in_buf_len;
3340 size_t out_buf_len = ssl->out_buf_len;
3341 #else
3342 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
3343 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
3344 #endif
3345
3346 #if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
3347 partial = 0;
3348 #endif
3349
3350 /* Cancel any possibly running timer */
3351 mbedtls_ssl_set_timer( ssl, 0 );
3352
3353 mbedtls_ssl_reset_in_out_pointers( ssl );
3354
3355 /* Reset incoming message parsing */
3356 ssl->in_offt = NULL;
3357 ssl->nb_zero = 0;
3358 ssl->in_msgtype = 0;
3359 ssl->in_msglen = 0;
3360 ssl->in_hslen = 0;
3361 ssl->keep_current_message = 0;
3362 ssl->transform_in = NULL;
3363
3364 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3365 ssl->next_record_offset = 0;
3366 ssl->in_epoch = 0;
3367 #endif
3368
3369 /* Keep current datagram if partial == 1 */
3370 if( partial == 0 )
3371 {
3372 ssl->in_left = 0;
3373 memset( ssl->in_buf, 0, in_buf_len );
3374 }
3375
3376 /* Reset outgoing message writing */
3377 ssl->out_msgtype = 0;
3378 ssl->out_msglen = 0;
3379 ssl->out_left = 0;
3380 memset( ssl->out_buf, 0, out_buf_len );
3381 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
3382 ssl->transform_out = NULL;
3383
3384 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3385 mbedtls_ssl_dtls_replay_reset( ssl );
3386 #endif
3387
3388 if( ssl->transform )
3389 {
3390 mbedtls_ssl_transform_free( ssl->transform );
3391 mbedtls_free( ssl->transform );
3392 ssl->transform = NULL;
3393 }
3394 }
3395
mbedtls_ssl_session_reset_int(mbedtls_ssl_context * ssl,int partial)3396 int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
3397 {
3398 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3399
3400 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3401
3402 ssl_session_reset_msg_layer( ssl, partial );
3403
3404 /* Reset renegotiation state */
3405 #if defined(MBEDTLS_SSL_RENEGOTIATION)
3406 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
3407 ssl->renego_records_seen = 0;
3408
3409 ssl->verify_data_len = 0;
3410 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
3411 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
3412 #endif
3413 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
3414
3415 ssl->session_in = NULL;
3416 ssl->session_out = NULL;
3417 if( ssl->session )
3418 {
3419 mbedtls_ssl_session_free( ssl->session );
3420 mbedtls_free( ssl->session );
3421 ssl->session = NULL;
3422 }
3423
3424 #if defined(MBEDTLS_SSL_ALPN)
3425 ssl->alpn_chosen = NULL;
3426 #endif
3427
3428 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
3429 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
3430 if( partial == 0 )
3431 #endif
3432 {
3433 mbedtls_free( ssl->cli_id );
3434 ssl->cli_id = NULL;
3435 ssl->cli_id_len = 0;
3436 }
3437 #endif
3438
3439 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3440 return( ret );
3441
3442 return( 0 );
3443 }
3444
3445 /*
3446 * Reset an initialized and used SSL context for re-use while retaining
3447 * all application-set variables, function pointers and data.
3448 */
mbedtls_ssl_session_reset(mbedtls_ssl_context * ssl)3449 int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
3450 {
3451 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
3452 }
3453
3454 /*
3455 * SSL set accessors
3456 */
mbedtls_ssl_conf_endpoint(mbedtls_ssl_config * conf,int endpoint)3457 void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
3458 {
3459 conf->endpoint = endpoint;
3460 }
3461
mbedtls_ssl_conf_transport(mbedtls_ssl_config * conf,int transport)3462 void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
3463 {
3464 conf->transport = transport;
3465 }
3466
3467 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
mbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config * conf,char mode)3468 void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
3469 {
3470 conf->anti_replay = mode;
3471 }
3472 #endif
3473
mbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config * conf,unsigned limit)3474 void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
3475 {
3476 conf->badmac_limit = limit;
3477 }
3478
3479 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3480
mbedtls_ssl_set_datagram_packing(mbedtls_ssl_context * ssl,unsigned allow_packing)3481 void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
3482 unsigned allow_packing )
3483 {
3484 ssl->disable_datagram_packing = !allow_packing;
3485 }
3486
mbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config * conf,uint32_t min,uint32_t max)3487 void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
3488 uint32_t min, uint32_t max )
3489 {
3490 conf->hs_timeout_min = min;
3491 conf->hs_timeout_max = max;
3492 }
3493 #endif
3494
mbedtls_ssl_conf_authmode(mbedtls_ssl_config * conf,int authmode)3495 void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
3496 {
3497 conf->authmode = authmode;
3498 }
3499
3500 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_conf_verify(mbedtls_ssl_config * conf,int (* f_vrfy)(void *,mbedtls_x509_crt *,int,uint32_t *),void * p_vrfy)3501 void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
3502 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
3503 void *p_vrfy )
3504 {
3505 conf->f_vrfy = f_vrfy;
3506 conf->p_vrfy = p_vrfy;
3507 }
3508 #endif /* MBEDTLS_X509_CRT_PARSE_C */
3509
mbedtls_ssl_conf_rng(mbedtls_ssl_config * conf,int (* f_rng)(void *,unsigned char *,size_t),void * p_rng)3510 void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
3511 int (*f_rng)(void *, unsigned char *, size_t),
3512 void *p_rng )
3513 {
3514 conf->f_rng = f_rng;
3515 conf->p_rng = p_rng;
3516 }
3517
mbedtls_ssl_conf_dbg(mbedtls_ssl_config * conf,void (* f_dbg)(void *,int,const char *,int,const char *),void * p_dbg)3518 void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
3519 void (*f_dbg)(void *, int, const char *, int, const char *),
3520 void *p_dbg )
3521 {
3522 conf->f_dbg = f_dbg;
3523 conf->p_dbg = p_dbg;
3524 }
3525
mbedtls_ssl_set_bio(mbedtls_ssl_context * ssl,void * p_bio,mbedtls_ssl_send_t * f_send,mbedtls_ssl_recv_t * f_recv,mbedtls_ssl_recv_timeout_t * f_recv_timeout)3526 void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
3527 void *p_bio,
3528 mbedtls_ssl_send_t *f_send,
3529 mbedtls_ssl_recv_t *f_recv,
3530 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
3531 {
3532 ssl->p_bio = p_bio;
3533 ssl->f_send = f_send;
3534 ssl->f_recv = f_recv;
3535 ssl->f_recv_timeout = f_recv_timeout;
3536 }
3537
3538 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_set_mtu(mbedtls_ssl_context * ssl,uint16_t mtu)3539 void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
3540 {
3541 ssl->mtu = mtu;
3542 }
3543 #endif
3544
mbedtls_ssl_conf_read_timeout(mbedtls_ssl_config * conf,uint32_t timeout)3545 void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
3546 {
3547 conf->read_timeout = timeout;
3548 }
3549
mbedtls_ssl_set_timer_cb(mbedtls_ssl_context * ssl,void * p_timer,mbedtls_ssl_set_timer_t * f_set_timer,mbedtls_ssl_get_timer_t * f_get_timer)3550 void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
3551 void *p_timer,
3552 mbedtls_ssl_set_timer_t *f_set_timer,
3553 mbedtls_ssl_get_timer_t *f_get_timer )
3554 {
3555 ssl->p_timer = p_timer;
3556 ssl->f_set_timer = f_set_timer;
3557 ssl->f_get_timer = f_get_timer;
3558
3559 /* Make sure we start with no timer running */
3560 mbedtls_ssl_set_timer( ssl, 0 );
3561 }
3562
3563 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_session_cache(mbedtls_ssl_config * conf,void * p_cache,mbedtls_ssl_cache_get_t * f_get_cache,mbedtls_ssl_cache_set_t * f_set_cache)3564 void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
3565 void *p_cache,
3566 mbedtls_ssl_cache_get_t *f_get_cache,
3567 mbedtls_ssl_cache_set_t *f_set_cache )
3568 {
3569 conf->p_cache = p_cache;
3570 conf->f_get_cache = f_get_cache;
3571 conf->f_set_cache = f_set_cache;
3572 }
3573 #endif /* MBEDTLS_SSL_SRV_C */
3574
3575 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_set_session(mbedtls_ssl_context * ssl,const mbedtls_ssl_session * session)3576 int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
3577 {
3578 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3579
3580 if( ssl == NULL ||
3581 session == NULL ||
3582 ssl->session_negotiate == NULL ||
3583 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
3584 {
3585 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3586 }
3587
3588 if( ssl->handshake->resume == 1 )
3589 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3590
3591 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
3592 session ) ) != 0 )
3593 return( ret );
3594
3595 ssl->handshake->resume = 1;
3596
3597 return( 0 );
3598 }
3599 #endif /* MBEDTLS_SSL_CLI_C */
3600
mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config * conf,const int * ciphersuites)3601 void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
3602 const int *ciphersuites )
3603 {
3604 conf->ciphersuite_list = ciphersuites;
3605 }
3606
3607 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
mbedtls_ssl_conf_tls13_key_exchange_modes(mbedtls_ssl_config * conf,const int kex_modes)3608 void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
3609 const int kex_modes )
3610 {
3611 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
3612 }
3613 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3614
3615 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_conf_cert_profile(mbedtls_ssl_config * conf,const mbedtls_x509_crt_profile * profile)3616 void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
3617 const mbedtls_x509_crt_profile *profile )
3618 {
3619 conf->cert_profile = profile;
3620 }
3621
3622 /* Append a new keycert entry to a (possibly empty) list */
ssl_append_key_cert(mbedtls_ssl_key_cert ** head,mbedtls_x509_crt * cert,mbedtls_pk_context * key)3623 static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
3624 mbedtls_x509_crt *cert,
3625 mbedtls_pk_context *key )
3626 {
3627 mbedtls_ssl_key_cert *new_cert;
3628
3629 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
3630 if( new_cert == NULL )
3631 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3632
3633 new_cert->cert = cert;
3634 new_cert->key = key;
3635 new_cert->next = NULL;
3636
3637 /* Update head is the list was null, else add to the end */
3638 if( *head == NULL )
3639 {
3640 *head = new_cert;
3641 }
3642 else
3643 {
3644 mbedtls_ssl_key_cert *cur = *head;
3645 while( cur->next != NULL )
3646 cur = cur->next;
3647 cur->next = new_cert;
3648 }
3649
3650 return( 0 );
3651 }
3652
mbedtls_ssl_conf_own_cert(mbedtls_ssl_config * conf,mbedtls_x509_crt * own_cert,mbedtls_pk_context * pk_key)3653 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
3654 mbedtls_x509_crt *own_cert,
3655 mbedtls_pk_context *pk_key )
3656 {
3657 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
3658 }
3659
mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config * conf,mbedtls_x509_crt * ca_chain,mbedtls_x509_crl * ca_crl)3660 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
3661 mbedtls_x509_crt *ca_chain,
3662 mbedtls_x509_crl *ca_crl )
3663 {
3664 conf->ca_chain = ca_chain;
3665 conf->ca_crl = ca_crl;
3666
3667 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
3668 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
3669 * cannot be used together. */
3670 conf->f_ca_cb = NULL;
3671 conf->p_ca_cb = NULL;
3672 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
3673 }
3674
3675 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
mbedtls_ssl_conf_ca_cb(mbedtls_ssl_config * conf,mbedtls_x509_crt_ca_cb_t f_ca_cb,void * p_ca_cb)3676 void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
3677 mbedtls_x509_crt_ca_cb_t f_ca_cb,
3678 void *p_ca_cb )
3679 {
3680 conf->f_ca_cb = f_ca_cb;
3681 conf->p_ca_cb = p_ca_cb;
3682
3683 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
3684 * cannot be used together. */
3685 conf->ca_chain = NULL;
3686 conf->ca_crl = NULL;
3687 }
3688 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
3689 #endif /* MBEDTLS_X509_CRT_PARSE_C */
3690
3691 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context * ssl,mbedtls_x509_crt * own_cert,mbedtls_pk_context * pk_key)3692 int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
3693 mbedtls_x509_crt *own_cert,
3694 mbedtls_pk_context *pk_key )
3695 {
3696 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
3697 own_cert, pk_key ) );
3698 }
3699
mbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context * ssl,mbedtls_x509_crt * ca_chain,mbedtls_x509_crl * ca_crl)3700 void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
3701 mbedtls_x509_crt *ca_chain,
3702 mbedtls_x509_crl *ca_crl )
3703 {
3704 ssl->handshake->sni_ca_chain = ca_chain;
3705 ssl->handshake->sni_ca_crl = ca_crl;
3706 }
3707
mbedtls_ssl_set_hs_authmode(mbedtls_ssl_context * ssl,int authmode)3708 void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
3709 int authmode )
3710 {
3711 ssl->handshake->sni_authmode = authmode;
3712 }
3713 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
3714
3715 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_set_verify(mbedtls_ssl_context * ssl,int (* f_vrfy)(void *,mbedtls_x509_crt *,int,uint32_t *),void * p_vrfy)3716 void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
3717 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
3718 void *p_vrfy )
3719 {
3720 ssl->f_vrfy = f_vrfy;
3721 ssl->p_vrfy = p_vrfy;
3722 }
3723 #endif
3724
3725 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3726 /*
3727 * Set EC J-PAKE password for current handshake
3728 */
mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context * ssl,const unsigned char * pw,size_t pw_len)3729 int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
3730 const unsigned char *pw,
3731 size_t pw_len )
3732 {
3733 mbedtls_ecjpake_role role;
3734
3735 if( ssl->handshake == NULL || ssl->conf == NULL )
3736 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3737
3738 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
3739 role = MBEDTLS_ECJPAKE_SERVER;
3740 else
3741 role = MBEDTLS_ECJPAKE_CLIENT;
3742
3743 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
3744 role,
3745 MBEDTLS_MD_SHA256,
3746 MBEDTLS_ECP_DP_SECP256R1,
3747 pw, pw_len ) );
3748 }
3749 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
3750
3751 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
3752
ssl_conf_psk_is_configured(mbedtls_ssl_config const * conf)3753 static int ssl_conf_psk_is_configured( mbedtls_ssl_config const *conf )
3754 {
3755 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3756 if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
3757 return( 1 );
3758 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3759
3760 if( conf->psk != NULL )
3761 return( 1 );
3762
3763 return( 0 );
3764 }
3765
ssl_conf_remove_psk(mbedtls_ssl_config * conf)3766 static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
3767 {
3768 /* Remove reference to existing PSK, if any. */
3769 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3770 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
3771 {
3772 /* The maintenance of the PSK key slot is the
3773 * user's responsibility. */
3774 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
3775 }
3776 /* This and the following branch should never
3777 * be taken simultaenously as we maintain the
3778 * invariant that raw and opaque PSKs are never
3779 * configured simultaneously. As a safeguard,
3780 * though, `else` is omitted here. */
3781 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3782 if( conf->psk != NULL )
3783 {
3784 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
3785
3786 mbedtls_free( conf->psk );
3787 conf->psk = NULL;
3788 conf->psk_len = 0;
3789 }
3790
3791 /* Remove reference to PSK identity, if any. */
3792 if( conf->psk_identity != NULL )
3793 {
3794 mbedtls_free( conf->psk_identity );
3795 conf->psk_identity = NULL;
3796 conf->psk_identity_len = 0;
3797 }
3798 }
3799
3800 /* This function assumes that PSK identity in the SSL config is unset.
3801 * It checks that the provided identity is well-formed and attempts
3802 * to make a copy of it in the SSL config.
3803 * On failure, the PSK identity in the config remains unset. */
ssl_conf_set_psk_identity(mbedtls_ssl_config * conf,unsigned char const * psk_identity,size_t psk_identity_len)3804 static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
3805 unsigned char const *psk_identity,
3806 size_t psk_identity_len )
3807 {
3808 /* Identity len will be encoded on two bytes */
3809 if( psk_identity == NULL ||
3810 ( psk_identity_len >> 16 ) != 0 ||
3811 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
3812 {
3813 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3814 }
3815
3816 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
3817 if( conf->psk_identity == NULL )
3818 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3819
3820 conf->psk_identity_len = psk_identity_len;
3821 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
3822
3823 return( 0 );
3824 }
3825
mbedtls_ssl_conf_psk(mbedtls_ssl_config * conf,const unsigned char * psk,size_t psk_len,const unsigned char * psk_identity,size_t psk_identity_len)3826 int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
3827 const unsigned char *psk, size_t psk_len,
3828 const unsigned char *psk_identity, size_t psk_identity_len )
3829 {
3830 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3831
3832 /* We currently only support one PSK, raw or opaque. */
3833 if( ssl_conf_psk_is_configured( conf ) )
3834 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3835
3836 /* Check and set raw PSK */
3837 if( psk == NULL )
3838 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3839 if( psk_len == 0 )
3840 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3841 if( psk_len > MBEDTLS_PSK_MAX_LEN )
3842 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3843
3844 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
3845 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3846 conf->psk_len = psk_len;
3847 memcpy( conf->psk, psk, conf->psk_len );
3848
3849 /* Check and set PSK Identity */
3850 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
3851 if( ret != 0 )
3852 ssl_conf_remove_psk( conf );
3853
3854 return( ret );
3855 }
3856
ssl_remove_psk(mbedtls_ssl_context * ssl)3857 static void ssl_remove_psk( mbedtls_ssl_context *ssl )
3858 {
3859 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3860 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
3861 {
3862 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
3863 }
3864 else
3865 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3866 if( ssl->handshake->psk != NULL )
3867 {
3868 mbedtls_platform_zeroize( ssl->handshake->psk,
3869 ssl->handshake->psk_len );
3870 mbedtls_free( ssl->handshake->psk );
3871 ssl->handshake->psk_len = 0;
3872 }
3873 }
3874
mbedtls_ssl_set_hs_psk(mbedtls_ssl_context * ssl,const unsigned char * psk,size_t psk_len)3875 int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
3876 const unsigned char *psk, size_t psk_len )
3877 {
3878 if( psk == NULL || ssl->handshake == NULL )
3879 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3880
3881 if( psk_len > MBEDTLS_PSK_MAX_LEN )
3882 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3883
3884 ssl_remove_psk( ssl );
3885
3886 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
3887 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3888
3889 ssl->handshake->psk_len = psk_len;
3890 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
3891
3892 return( 0 );
3893 }
3894
3895 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config * conf,psa_key_id_t psk,const unsigned char * psk_identity,size_t psk_identity_len)3896 int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
3897 psa_key_id_t psk,
3898 const unsigned char *psk_identity,
3899 size_t psk_identity_len )
3900 {
3901 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3902
3903 /* We currently only support one PSK, raw or opaque. */
3904 if( ssl_conf_psk_is_configured( conf ) )
3905 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3906
3907 /* Check and set opaque PSK */
3908 if( mbedtls_svc_key_id_is_null( psk ) )
3909 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3910 conf->psk_opaque = psk;
3911
3912 /* Check and set PSK Identity */
3913 ret = ssl_conf_set_psk_identity( conf, psk_identity,
3914 psk_identity_len );
3915 if( ret != 0 )
3916 ssl_conf_remove_psk( conf );
3917
3918 return( ret );
3919 }
3920
mbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context * ssl,psa_key_id_t psk)3921 int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
3922 psa_key_id_t psk )
3923 {
3924 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
3925 ( ssl->handshake == NULL ) )
3926 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3927
3928 ssl_remove_psk( ssl );
3929 ssl->handshake->psk_opaque = psk;
3930 return( 0 );
3931 }
3932 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3933
mbedtls_ssl_conf_psk_cb(mbedtls_ssl_config * conf,int (* f_psk)(void *,mbedtls_ssl_context *,const unsigned char *,size_t),void * p_psk)3934 void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
3935 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
3936 size_t),
3937 void *p_psk )
3938 {
3939 conf->f_psk = f_psk;
3940 conf->p_psk = p_psk;
3941 }
3942 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
3943
3944 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config * conf,const unsigned char * dhm_P,size_t P_len,const unsigned char * dhm_G,size_t G_len)3945 int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
3946 const unsigned char *dhm_P, size_t P_len,
3947 const unsigned char *dhm_G, size_t G_len )
3948 {
3949 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3950
3951 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
3952 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
3953 {
3954 mbedtls_mpi_free( &conf->dhm_P );
3955 mbedtls_mpi_free( &conf->dhm_G );
3956 return( ret );
3957 }
3958
3959 return( 0 );
3960 }
3961
mbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config * conf,mbedtls_dhm_context * dhm_ctx)3962 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
3963 {
3964 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3965
3966 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
3967 &conf->dhm_P ) ) != 0 ||
3968 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
3969 &conf->dhm_G ) ) != 0 )
3970 {
3971 mbedtls_mpi_free( &conf->dhm_P );
3972 mbedtls_mpi_free( &conf->dhm_G );
3973 return( ret );
3974 }
3975
3976 return( 0 );
3977 }
3978 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
3979
3980 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
3981 /*
3982 * Set the minimum length for Diffie-Hellman parameters
3983 */
mbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config * conf,unsigned int bitlen)3984 void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
3985 unsigned int bitlen )
3986 {
3987 conf->dhm_min_bitlen = bitlen;
3988 }
3989 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
3990
3991 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3992 /*
3993 * Set allowed/preferred hashes for handshake signatures
3994 */
mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config * conf,const int * hashes)3995 void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
3996 const int *hashes )
3997 {
3998 conf->sig_hashes = hashes;
3999 }
4000
4001 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
4002 /* Configure allowed signature algorithms for use in TLS 1.3 */
mbedtls_ssl_conf_sig_algs(mbedtls_ssl_config * conf,const uint16_t * sig_algs)4003 void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
4004 const uint16_t* sig_algs )
4005 {
4006 conf->tls13_sig_algs = sig_algs;
4007 }
4008 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
4009 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4010
4011 #if defined(MBEDTLS_ECP_C)
4012 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
4013 /*
4014 * Set the allowed elliptic curves
4015 *
4016 * mbedtls_ssl_setup() takes the provided list
4017 * and translates it to a list of IANA TLS group identifiers,
4018 * stored in ssl->handshake->group_list.
4019 *
4020 */
mbedtls_ssl_conf_curves(mbedtls_ssl_config * conf,const mbedtls_ecp_group_id * curve_list)4021 void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
4022 const mbedtls_ecp_group_id *curve_list )
4023 {
4024 conf->curve_list = curve_list;
4025 conf->group_list = NULL;
4026 }
4027 #endif /* MBEDTLS_DEPRECATED_REMOVED */
4028 #endif /* MBEDTLS_ECP_C */
4029
4030 /*
4031 * Set the allowed groups
4032 */
mbedtls_ssl_conf_groups(mbedtls_ssl_config * conf,const uint16_t * group_list)4033 void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
4034 const uint16_t *group_list )
4035 {
4036 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4037 conf->curve_list = NULL;
4038 #endif
4039 conf->group_list = group_list;
4040 }
4041
4042 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_set_hostname(mbedtls_ssl_context * ssl,const char * hostname)4043 int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
4044 {
4045 /* Initialize to suppress unnecessary compiler warning */
4046 size_t hostname_len = 0;
4047
4048 /* Check if new hostname is valid before
4049 * making any change to current one */
4050 if( hostname != NULL )
4051 {
4052 hostname_len = strlen( hostname );
4053
4054 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
4055 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4056 }
4057
4058 /* Now it's clear that we will overwrite the old hostname,
4059 * so we can free it safely */
4060
4061 if( ssl->hostname != NULL )
4062 {
4063 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
4064 mbedtls_free( ssl->hostname );
4065 }
4066
4067 /* Passing NULL as hostname shall clear the old one */
4068
4069 if( hostname == NULL )
4070 {
4071 ssl->hostname = NULL;
4072 }
4073 else
4074 {
4075 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
4076 if( ssl->hostname == NULL )
4077 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4078
4079 memcpy( ssl->hostname, hostname, hostname_len );
4080
4081 ssl->hostname[hostname_len] = '\0';
4082 }
4083
4084 return( 0 );
4085 }
4086 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4087
4088 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedtls_ssl_conf_sni(mbedtls_ssl_config * conf,int (* f_sni)(void *,mbedtls_ssl_context *,const unsigned char *,size_t),void * p_sni)4089 void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
4090 int (*f_sni)(void *, mbedtls_ssl_context *,
4091 const unsigned char *, size_t),
4092 void *p_sni )
4093 {
4094 conf->f_sni = f_sni;
4095 conf->p_sni = p_sni;
4096 }
4097 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
4098
4099 #if defined(MBEDTLS_SSL_ALPN)
mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config * conf,const char ** protos)4100 int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
4101 {
4102 size_t cur_len, tot_len;
4103 const char **p;
4104
4105 /*
4106 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
4107 * MUST NOT be truncated."
4108 * We check lengths now rather than later.
4109 */
4110 tot_len = 0;
4111 for( p = protos; *p != NULL; p++ )
4112 {
4113 cur_len = strlen( *p );
4114 tot_len += cur_len;
4115
4116 if( ( cur_len == 0 ) ||
4117 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
4118 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
4119 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4120 }
4121
4122 conf->alpn_list = protos;
4123
4124 return( 0 );
4125 }
4126
mbedtls_ssl_get_alpn_protocol(const mbedtls_ssl_context * ssl)4127 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
4128 {
4129 return( ssl->alpn_chosen );
4130 }
4131 #endif /* MBEDTLS_SSL_ALPN */
4132
4133 #if defined(MBEDTLS_SSL_DTLS_SRTP)
mbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config * conf,int support_mki_value)4134 void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
4135 int support_mki_value )
4136 {
4137 conf->dtls_srtp_mki_support = support_mki_value;
4138 }
4139
mbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context * ssl,unsigned char * mki_value,uint16_t mki_len)4140 int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
4141 unsigned char *mki_value,
4142 uint16_t mki_len )
4143 {
4144 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
4145 {
4146 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4147 }
4148
4149 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
4150 {
4151 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4152 }
4153
4154 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
4155 ssl->dtls_srtp_info.mki_len = mki_len;
4156 return( 0 );
4157 }
4158
mbedtls_ssl_conf_dtls_srtp_protection_profiles(mbedtls_ssl_config * conf,const mbedtls_ssl_srtp_profile * profiles)4159 int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
4160 const mbedtls_ssl_srtp_profile *profiles )
4161 {
4162 const mbedtls_ssl_srtp_profile *p;
4163 size_t list_size = 0;
4164
4165 /* check the profiles list: all entry must be valid,
4166 * its size cannot be more than the total number of supported profiles, currently 4 */
4167 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
4168 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
4169 p++ )
4170 {
4171 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
4172 {
4173 list_size++;
4174 }
4175 else
4176 {
4177 /* unsupported value, stop parsing and set the size to an error value */
4178 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
4179 }
4180 }
4181
4182 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
4183 {
4184 conf->dtls_srtp_profile_list = NULL;
4185 conf->dtls_srtp_profile_list_len = 0;
4186 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4187 }
4188
4189 conf->dtls_srtp_profile_list = profiles;
4190 conf->dtls_srtp_profile_list_len = list_size;
4191
4192 return( 0 );
4193 }
4194
mbedtls_ssl_get_dtls_srtp_negotiation_result(const mbedtls_ssl_context * ssl,mbedtls_dtls_srtp_info * dtls_srtp_info)4195 void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
4196 mbedtls_dtls_srtp_info *dtls_srtp_info )
4197 {
4198 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
4199 /* do not copy the mki value if there is no chosen profile */
4200 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
4201 {
4202 dtls_srtp_info->mki_len = 0;
4203 }
4204 else
4205 {
4206 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
4207 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
4208 ssl->dtls_srtp_info.mki_len );
4209 }
4210 }
4211 #endif /* MBEDTLS_SSL_DTLS_SRTP */
4212
mbedtls_ssl_conf_max_version(mbedtls_ssl_config * conf,int major,int minor)4213 void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
4214 {
4215 conf->max_major_ver = major;
4216 conf->max_minor_ver = minor;
4217 }
4218
mbedtls_ssl_conf_min_version(mbedtls_ssl_config * conf,int major,int minor)4219 void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
4220 {
4221 conf->min_major_ver = major;
4222 conf->min_minor_ver = minor;
4223 }
4224
4225 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config * conf,char cert_req_ca_list)4226 void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
4227 char cert_req_ca_list )
4228 {
4229 conf->cert_req_ca_list = cert_req_ca_list;
4230 }
4231 #endif
4232
4233 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
mbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config * conf,char etm)4234 void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
4235 {
4236 conf->encrypt_then_mac = etm;
4237 }
4238 #endif
4239
4240 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
mbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config * conf,char ems)4241 void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
4242 {
4243 conf->extended_ms = ems;
4244 }
4245 #endif
4246
4247 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config * conf,unsigned char mfl_code)4248 int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
4249 {
4250 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
4251 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
4252 {
4253 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4254 }
4255
4256 conf->mfl_code = mfl_code;
4257
4258 return( 0 );
4259 }
4260 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4261
mbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config * conf,int allow_legacy)4262 void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
4263 {
4264 conf->allow_legacy_renegotiation = allow_legacy;
4265 }
4266
4267 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config * conf,int renegotiation)4268 void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
4269 {
4270 conf->disable_renegotiation = renegotiation;
4271 }
4272
mbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config * conf,int max_records)4273 void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
4274 {
4275 conf->renego_max_records = max_records;
4276 }
4277
mbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config * conf,const unsigned char period[8])4278 void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
4279 const unsigned char period[8] )
4280 {
4281 memcpy( conf->renego_period, period, 8 );
4282 }
4283 #endif /* MBEDTLS_SSL_RENEGOTIATION */
4284
4285 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4286 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_conf_session_tickets(mbedtls_ssl_config * conf,int use_tickets)4287 void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
4288 {
4289 conf->session_tickets = use_tickets;
4290 }
4291 #endif
4292
4293 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config * conf,mbedtls_ssl_ticket_write_t * f_ticket_write,mbedtls_ssl_ticket_parse_t * f_ticket_parse,void * p_ticket)4294 void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
4295 mbedtls_ssl_ticket_write_t *f_ticket_write,
4296 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
4297 void *p_ticket )
4298 {
4299 conf->f_ticket_write = f_ticket_write;
4300 conf->f_ticket_parse = f_ticket_parse;
4301 conf->p_ticket = p_ticket;
4302 }
4303 #endif
4304 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4305
mbedtls_ssl_set_export_keys_cb(mbedtls_ssl_context * ssl,mbedtls_ssl_export_keys_t * f_export_keys,void * p_export_keys)4306 void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
4307 mbedtls_ssl_export_keys_t *f_export_keys,
4308 void *p_export_keys )
4309 {
4310 ssl->f_export_keys = f_export_keys;
4311 ssl->p_export_keys = p_export_keys;
4312 }
4313
4314 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
mbedtls_ssl_conf_async_private_cb(mbedtls_ssl_config * conf,mbedtls_ssl_async_sign_t * f_async_sign,mbedtls_ssl_async_decrypt_t * f_async_decrypt,mbedtls_ssl_async_resume_t * f_async_resume,mbedtls_ssl_async_cancel_t * f_async_cancel,void * async_config_data)4315 void mbedtls_ssl_conf_async_private_cb(
4316 mbedtls_ssl_config *conf,
4317 mbedtls_ssl_async_sign_t *f_async_sign,
4318 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
4319 mbedtls_ssl_async_resume_t *f_async_resume,
4320 mbedtls_ssl_async_cancel_t *f_async_cancel,
4321 void *async_config_data )
4322 {
4323 conf->f_async_sign_start = f_async_sign;
4324 conf->f_async_decrypt_start = f_async_decrypt;
4325 conf->f_async_resume = f_async_resume;
4326 conf->f_async_cancel = f_async_cancel;
4327 conf->p_async_config_data = async_config_data;
4328 }
4329
mbedtls_ssl_conf_get_async_config_data(const mbedtls_ssl_config * conf)4330 void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
4331 {
4332 return( conf->p_async_config_data );
4333 }
4334
mbedtls_ssl_get_async_operation_data(const mbedtls_ssl_context * ssl)4335 void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
4336 {
4337 if( ssl->handshake == NULL )
4338 return( NULL );
4339 else
4340 return( ssl->handshake->user_async_ctx );
4341 }
4342
mbedtls_ssl_set_async_operation_data(mbedtls_ssl_context * ssl,void * ctx)4343 void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
4344 void *ctx )
4345 {
4346 if( ssl->handshake != NULL )
4347 ssl->handshake->user_async_ctx = ctx;
4348 }
4349 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
4350
4351 /*
4352 * SSL get accessors
4353 */
mbedtls_ssl_get_verify_result(const mbedtls_ssl_context * ssl)4354 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
4355 {
4356 if( ssl->session != NULL )
4357 return( ssl->session->verify_result );
4358
4359 if( ssl->session_negotiate != NULL )
4360 return( ssl->session_negotiate->verify_result );
4361
4362 return( 0xFFFFFFFF );
4363 }
4364
mbedtls_ssl_get_ciphersuite(const mbedtls_ssl_context * ssl)4365 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
4366 {
4367 if( ssl == NULL || ssl->session == NULL )
4368 return( NULL );
4369
4370 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
4371 }
4372
mbedtls_ssl_get_version(const mbedtls_ssl_context * ssl)4373 const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
4374 {
4375 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4376 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4377 {
4378 switch( ssl->minor_ver )
4379 {
4380 case MBEDTLS_SSL_MINOR_VERSION_3:
4381 return( "DTLSv1.2" );
4382
4383 default:
4384 return( "unknown (DTLS)" );
4385 }
4386 }
4387 #endif
4388
4389 switch( ssl->minor_ver )
4390 {
4391 case MBEDTLS_SSL_MINOR_VERSION_3:
4392 return( "TLSv1.2" );
4393
4394 default:
4395 return( "unknown" );
4396 }
4397 }
4398
4399 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context * ssl)4400 size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
4401 {
4402 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
4403 size_t read_mfl;
4404
4405 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
4406 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
4407 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
4408 {
4409 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
4410 }
4411
4412 /* Check if a smaller max length was negotiated */
4413 if( ssl->session_out != NULL )
4414 {
4415 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
4416 if( read_mfl < max_len )
4417 {
4418 max_len = read_mfl;
4419 }
4420 }
4421
4422 // During a handshake, use the value being negotiated
4423 if( ssl->session_negotiate != NULL )
4424 {
4425 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
4426 if( read_mfl < max_len )
4427 {
4428 max_len = read_mfl;
4429 }
4430 }
4431
4432 return( max_len );
4433 }
4434
mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context * ssl)4435 size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
4436 {
4437 size_t max_len;
4438
4439 /*
4440 * Assume mfl_code is correct since it was checked when set
4441 */
4442 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
4443
4444 /* Check if a smaller max length was negotiated */
4445 if( ssl->session_out != NULL &&
4446 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
4447 {
4448 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
4449 }
4450
4451 /* During a handshake, use the value being negotiated */
4452 if( ssl->session_negotiate != NULL &&
4453 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
4454 {
4455 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
4456 }
4457
4458 return( max_len );
4459 }
4460 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4461
4462 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context * ssl)4463 size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
4464 {
4465 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
4466 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
4467 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
4468 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
4469 return ( 0 );
4470
4471 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
4472 return( ssl->mtu );
4473
4474 if( ssl->mtu == 0 )
4475 return( ssl->handshake->mtu );
4476
4477 return( ssl->mtu < ssl->handshake->mtu ?
4478 ssl->mtu : ssl->handshake->mtu );
4479 }
4480 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4481
mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context * ssl)4482 int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
4483 {
4484 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
4485
4486 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
4487 !defined(MBEDTLS_SSL_PROTO_DTLS)
4488 (void) ssl;
4489 #endif
4490
4491 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4492 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
4493
4494 if( max_len > mfl )
4495 max_len = mfl;
4496 #endif
4497
4498 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4499 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
4500 {
4501 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
4502 const int ret = mbedtls_ssl_get_record_expansion( ssl );
4503 const size_t overhead = (size_t) ret;
4504
4505 if( ret < 0 )
4506 return( ret );
4507
4508 if( mtu <= overhead )
4509 {
4510 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
4511 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4512 }
4513
4514 if( max_len > mtu - overhead )
4515 max_len = mtu - overhead;
4516 }
4517 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4518
4519 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
4520 !defined(MBEDTLS_SSL_PROTO_DTLS)
4521 ((void) ssl);
4522 #endif
4523
4524 return( (int) max_len );
4525 }
4526
mbedtls_ssl_get_max_in_record_payload(const mbedtls_ssl_context * ssl)4527 int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
4528 {
4529 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
4530
4531 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4532 (void) ssl;
4533 #endif
4534
4535 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4536 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
4537
4538 if( max_len > mfl )
4539 max_len = mfl;
4540 #endif
4541
4542 return( (int) max_len );
4543 }
4544
4545 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_get_peer_cert(const mbedtls_ssl_context * ssl)4546 const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
4547 {
4548 if( ssl == NULL || ssl->session == NULL )
4549 return( NULL );
4550
4551 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4552 return( ssl->session->peer_cert );
4553 #else
4554 return( NULL );
4555 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4556 }
4557 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4558
4559 #if defined(MBEDTLS_SSL_CLI_C)
mbedtls_ssl_get_session(const mbedtls_ssl_context * ssl,mbedtls_ssl_session * dst)4560 int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
4561 mbedtls_ssl_session *dst )
4562 {
4563 int ret;
4564
4565 if( ssl == NULL ||
4566 dst == NULL ||
4567 ssl->session == NULL ||
4568 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
4569 {
4570 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4571 }
4572
4573 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
4574 * idempotent: Each session can only be exported once.
4575 *
4576 * (This is in preparation for TLS 1.3 support where we will
4577 * need the ability to export multiple sessions (aka tickets),
4578 * which will be achieved by calling mbedtls_ssl_get_session()
4579 * multiple times until it fails.)
4580 *
4581 * Check whether we have already exported the current session,
4582 * and fail if so.
4583 */
4584 if( ssl->session->exported == 1 )
4585 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4586
4587 ret = mbedtls_ssl_session_copy( dst, ssl->session );
4588 if( ret != 0 )
4589 return( ret );
4590
4591 /* Remember that we've exported the session. */
4592 ssl->session->exported = 1;
4593 return( 0 );
4594 }
4595 #endif /* MBEDTLS_SSL_CLI_C */
4596
4597 /*
4598 * Define ticket header determining Mbed TLS version
4599 * and structure of the ticket.
4600 */
4601
4602 /*
4603 * Define bitflag determining compile-time settings influencing
4604 * structure of serialized SSL sessions.
4605 */
4606
4607 #if defined(MBEDTLS_HAVE_TIME)
4608 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
4609 #else
4610 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
4611 #endif /* MBEDTLS_HAVE_TIME */
4612
4613 #if defined(MBEDTLS_X509_CRT_PARSE_C)
4614 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
4615 #else
4616 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
4617 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4618
4619 #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
4620 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
4621 #else
4622 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
4623 #endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
4624
4625 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4626 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
4627 #else
4628 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
4629 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
4630
4631 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4632 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
4633 #else
4634 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
4635 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
4636
4637 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4638 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
4639 #else
4640 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
4641 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4642
4643 #define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
4644 #define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
4645 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
4646 #define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
4647 #define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
4648 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
4649
4650 #define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
4651 ( (uint16_t) ( \
4652 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
4653 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
4654 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
4655 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
4656 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
4657 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
4658
4659 static unsigned char ssl_serialized_session_header[] = {
4660 MBEDTLS_VERSION_MAJOR,
4661 MBEDTLS_VERSION_MINOR,
4662 MBEDTLS_VERSION_PATCH,
4663 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
4664 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
4665 };
4666
4667 /*
4668 * Serialize a session in the following format:
4669 * (in the presentation language of TLS, RFC 8446 section 3)
4670 *
4671 * struct {
4672 *
4673 * opaque mbedtls_version[3]; // library version: major, minor, patch
4674 * opaque session_format[2]; // library-version specific 16-bit field
4675 * // determining the format of the remaining
4676 * // serialized data.
4677 *
4678 * Note: When updating the format, remember to keep
4679 * these version+format bytes.
4680 *
4681 * // In this version, `session_format` determines
4682 * // the setting of those compile-time
4683 * // configuration options which influence
4684 * // the structure of mbedtls_ssl_session.
4685 *
4686 * uint8_t minor_ver; // Protocol-version. Possible values:
4687 * // - TLS 1.2 (MBEDTLS_SSL_MINOR_VERSION_3)
4688 *
4689 * select (serialized_session.minor_ver) {
4690 *
4691 * case MBEDTLS_SSL_MINOR_VERSION_3: // TLS 1.2
4692 * serialized_session_tls12 data;
4693 *
4694 * };
4695 *
4696 * } serialized_session;
4697 *
4698 */
4699
4700 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4701 /* Serialization of TLS 1.2 sessions:
4702 *
4703 * struct {
4704 * uint64 start_time;
4705 * uint8 ciphersuite[2]; // defined by the standard
4706 * uint8 compression; // 0 or 1
4707 * uint8 session_id_len; // at most 32
4708 * opaque session_id[32];
4709 * opaque master[48]; // fixed length in the standard
4710 * uint32 verify_result;
4711 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
4712 * opaque ticket<0..2^24-1>; // length 0 means no ticket
4713 * uint32 ticket_lifetime;
4714 * uint8 mfl_code; // up to 255 according to standard
4715 * uint8 encrypt_then_mac; // 0 or 1
4716 * } serialized_session_tls12;
4717 *
4718 */
ssl_session_save_tls12(const mbedtls_ssl_session * session,unsigned char * buf,size_t buf_len)4719 static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
4720 unsigned char *buf,
4721 size_t buf_len )
4722 {
4723 unsigned char *p = buf;
4724 size_t used = 0;
4725
4726 #if defined(MBEDTLS_HAVE_TIME)
4727 uint64_t start;
4728 #endif
4729 #if defined(MBEDTLS_X509_CRT_PARSE_C)
4730 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4731 size_t cert_len;
4732 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4733 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4734
4735 /*
4736 * Time
4737 */
4738 #if defined(MBEDTLS_HAVE_TIME)
4739 used += 8;
4740
4741 if( used <= buf_len )
4742 {
4743 start = (uint64_t) session->start;
4744
4745 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
4746 p += 8;
4747 }
4748 #endif /* MBEDTLS_HAVE_TIME */
4749
4750 /*
4751 * Basic mandatory fields
4752 */
4753 used += 2 /* ciphersuite */
4754 + 1 /* compression */
4755 + 1 /* id_len */
4756 + sizeof( session->id )
4757 + sizeof( session->master )
4758 + 4; /* verify_result */
4759
4760 if( used <= buf_len )
4761 {
4762 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
4763 p += 2;
4764
4765 *p++ = MBEDTLS_BYTE_0( session->compression );
4766
4767 *p++ = MBEDTLS_BYTE_0( session->id_len );
4768 memcpy( p, session->id, 32 );
4769 p += 32;
4770
4771 memcpy( p, session->master, 48 );
4772 p += 48;
4773
4774 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
4775 p += 4;
4776 }
4777
4778 /*
4779 * Peer's end-entity certificate
4780 */
4781 #if defined(MBEDTLS_X509_CRT_PARSE_C)
4782 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4783 if( session->peer_cert == NULL )
4784 cert_len = 0;
4785 else
4786 cert_len = session->peer_cert->raw.len;
4787
4788 used += 3 + cert_len;
4789
4790 if( used <= buf_len )
4791 {
4792 *p++ = MBEDTLS_BYTE_2( cert_len );
4793 *p++ = MBEDTLS_BYTE_1( cert_len );
4794 *p++ = MBEDTLS_BYTE_0( cert_len );
4795
4796 if( session->peer_cert != NULL )
4797 {
4798 memcpy( p, session->peer_cert->raw.p, cert_len );
4799 p += cert_len;
4800 }
4801 }
4802 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4803 if( session->peer_cert_digest != NULL )
4804 {
4805 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
4806 if( used <= buf_len )
4807 {
4808 *p++ = (unsigned char) session->peer_cert_digest_type;
4809 *p++ = (unsigned char) session->peer_cert_digest_len;
4810 memcpy( p, session->peer_cert_digest,
4811 session->peer_cert_digest_len );
4812 p += session->peer_cert_digest_len;
4813 }
4814 }
4815 else
4816 {
4817 used += 2;
4818 if( used <= buf_len )
4819 {
4820 *p++ = (unsigned char) MBEDTLS_MD_NONE;
4821 *p++ = 0;
4822 }
4823 }
4824 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4825 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4826
4827 /*
4828 * Session ticket if any, plus associated data
4829 */
4830 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
4831 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
4832
4833 if( used <= buf_len )
4834 {
4835 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
4836 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
4837 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
4838
4839 if( session->ticket != NULL )
4840 {
4841 memcpy( p, session->ticket, session->ticket_len );
4842 p += session->ticket_len;
4843 }
4844
4845 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
4846 p += 4;
4847 }
4848 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
4849
4850 /*
4851 * Misc extension-related info
4852 */
4853 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
4854 used += 1;
4855
4856 if( used <= buf_len )
4857 *p++ = session->mfl_code;
4858 #endif
4859
4860 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4861 used += 1;
4862
4863 if( used <= buf_len )
4864 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
4865 #endif
4866
4867 return( used );
4868 }
4869 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4870
ssl_session_save(const mbedtls_ssl_session * session,unsigned char omit_header,unsigned char * buf,size_t buf_len,size_t * olen)4871 static int ssl_session_save( const mbedtls_ssl_session *session,
4872 unsigned char omit_header,
4873 unsigned char *buf,
4874 size_t buf_len,
4875 size_t *olen )
4876 {
4877 unsigned char *p = buf;
4878 size_t used = 0;
4879
4880 if( !omit_header )
4881 {
4882 /*
4883 * Add Mbed TLS version identifier
4884 */
4885
4886 used += sizeof( ssl_serialized_session_header );
4887
4888 if( used <= buf_len )
4889 {
4890 memcpy( p, ssl_serialized_session_header,
4891 sizeof( ssl_serialized_session_header ) );
4892 p += sizeof( ssl_serialized_session_header );
4893 }
4894 }
4895
4896 /*
4897 * TLS version identifier
4898 */
4899 used += 1;
4900 if( used <= buf_len )
4901 {
4902 *p++ = session->minor_ver;
4903 }
4904
4905 /* Forward to version-specific serialization routine. */
4906 switch( session->minor_ver )
4907 {
4908 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4909 case MBEDTLS_SSL_MINOR_VERSION_3:
4910 {
4911 size_t remaining_len = used <= buf_len ? buf_len - used : 0;
4912 used += ssl_session_save_tls12( session, p, remaining_len );
4913 break;
4914 }
4915 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4916
4917 default:
4918 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4919 }
4920
4921 *olen = used;
4922 if( used > buf_len )
4923 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
4924
4925 return( 0 );
4926 }
4927
4928 /*
4929 * Public wrapper for ssl_session_save()
4930 */
mbedtls_ssl_session_save(const mbedtls_ssl_session * session,unsigned char * buf,size_t buf_len,size_t * olen)4931 int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
4932 unsigned char *buf,
4933 size_t buf_len,
4934 size_t *olen )
4935 {
4936 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
4937 }
4938
4939 /*
4940 * Deserialize session, see mbedtls_ssl_session_save() for format.
4941 *
4942 * This internal version is wrapped by a public function that cleans up in
4943 * case of error, and has an extra option omit_header.
4944 */
ssl_session_load_tls12(mbedtls_ssl_session * session,const unsigned char * buf,size_t len)4945 static int ssl_session_load_tls12( mbedtls_ssl_session *session,
4946 const unsigned char *buf,
4947 size_t len )
4948 {
4949 #if defined(MBEDTLS_HAVE_TIME)
4950 uint64_t start;
4951 #endif
4952 #if defined(MBEDTLS_X509_CRT_PARSE_C)
4953 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4954 size_t cert_len;
4955 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4956 #endif /* MBEDTLS_X509_CRT_PARSE_C */
4957
4958 const unsigned char *p = buf;
4959 const unsigned char * const end = buf + len;
4960
4961 /*
4962 * Time
4963 */
4964 #if defined(MBEDTLS_HAVE_TIME)
4965 if( 8 > (size_t)( end - p ) )
4966 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4967
4968 start = ( (uint64_t) p[0] << 56 ) |
4969 ( (uint64_t) p[1] << 48 ) |
4970 ( (uint64_t) p[2] << 40 ) |
4971 ( (uint64_t) p[3] << 32 ) |
4972 ( (uint64_t) p[4] << 24 ) |
4973 ( (uint64_t) p[5] << 16 ) |
4974 ( (uint64_t) p[6] << 8 ) |
4975 ( (uint64_t) p[7] );
4976 p += 8;
4977
4978 session->start = (time_t) start;
4979 #endif /* MBEDTLS_HAVE_TIME */
4980
4981 /*
4982 * Basic mandatory fields
4983 */
4984 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
4985 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4986
4987 session->ciphersuite = ( p[0] << 8 ) | p[1];
4988 p += 2;
4989
4990 session->compression = *p++;
4991
4992 session->id_len = *p++;
4993 memcpy( session->id, p, 32 );
4994 p += 32;
4995
4996 memcpy( session->master, p, 48 );
4997 p += 48;
4998
4999 session->verify_result = ( (uint32_t) p[0] << 24 ) |
5000 ( (uint32_t) p[1] << 16 ) |
5001 ( (uint32_t) p[2] << 8 ) |
5002 ( (uint32_t) p[3] );
5003 p += 4;
5004
5005 /* Immediately clear invalid pointer values that have been read, in case
5006 * we exit early before we replaced them with valid ones. */
5007 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5008 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5009 session->peer_cert = NULL;
5010 #else
5011 session->peer_cert_digest = NULL;
5012 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5013 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5014 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5015 session->ticket = NULL;
5016 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5017
5018 /*
5019 * Peer certificate
5020 */
5021 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5022 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5023 /* Deserialize CRT from the end of the ticket. */
5024 if( 3 > (size_t)( end - p ) )
5025 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5026
5027 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5028 p += 3;
5029
5030 if( cert_len != 0 )
5031 {
5032 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5033
5034 if( cert_len > (size_t)( end - p ) )
5035 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5036
5037 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
5038
5039 if( session->peer_cert == NULL )
5040 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5041
5042 mbedtls_x509_crt_init( session->peer_cert );
5043
5044 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
5045 p, cert_len ) ) != 0 )
5046 {
5047 mbedtls_x509_crt_free( session->peer_cert );
5048 mbedtls_free( session->peer_cert );
5049 session->peer_cert = NULL;
5050 return( ret );
5051 }
5052
5053 p += cert_len;
5054 }
5055 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5056 /* Deserialize CRT digest from the end of the ticket. */
5057 if( 2 > (size_t)( end - p ) )
5058 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5059
5060 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
5061 session->peer_cert_digest_len = (size_t) *p++;
5062
5063 if( session->peer_cert_digest_len != 0 )
5064 {
5065 const mbedtls_md_info_t *md_info =
5066 mbedtls_md_info_from_type( session->peer_cert_digest_type );
5067 if( md_info == NULL )
5068 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5069 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
5070 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5071
5072 if( session->peer_cert_digest_len > (size_t)( end - p ) )
5073 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5074
5075 session->peer_cert_digest =
5076 mbedtls_calloc( 1, session->peer_cert_digest_len );
5077 if( session->peer_cert_digest == NULL )
5078 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5079
5080 memcpy( session->peer_cert_digest, p,
5081 session->peer_cert_digest_len );
5082 p += session->peer_cert_digest_len;
5083 }
5084 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5085 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5086
5087 /*
5088 * Session ticket and associated data
5089 */
5090 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5091 if( 3 > (size_t)( end - p ) )
5092 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5093
5094 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
5095 p += 3;
5096
5097 if( session->ticket_len != 0 )
5098 {
5099 if( session->ticket_len > (size_t)( end - p ) )
5100 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5101
5102 session->ticket = mbedtls_calloc( 1, session->ticket_len );
5103 if( session->ticket == NULL )
5104 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
5105
5106 memcpy( session->ticket, p, session->ticket_len );
5107 p += session->ticket_len;
5108 }
5109
5110 if( 4 > (size_t)( end - p ) )
5111 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5112
5113 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
5114 ( (uint32_t) p[1] << 16 ) |
5115 ( (uint32_t) p[2] << 8 ) |
5116 ( (uint32_t) p[3] );
5117 p += 4;
5118 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
5119
5120 /*
5121 * Misc extension-related info
5122 */
5123 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
5124 if( 1 > (size_t)( end - p ) )
5125 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5126
5127 session->mfl_code = *p++;
5128 #endif
5129
5130 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5131 if( 1 > (size_t)( end - p ) )
5132 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5133
5134 session->encrypt_then_mac = *p++;
5135 #endif
5136
5137 /* Done, should have consumed entire buffer */
5138 if( p != end )
5139 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5140
5141 return( 0 );
5142 }
5143
ssl_session_load(mbedtls_ssl_session * session,unsigned char omit_header,const unsigned char * buf,size_t len)5144 static int ssl_session_load( mbedtls_ssl_session *session,
5145 unsigned char omit_header,
5146 const unsigned char *buf,
5147 size_t len )
5148 {
5149 const unsigned char *p = buf;
5150 const unsigned char * const end = buf + len;
5151
5152 if( !omit_header )
5153 {
5154 /*
5155 * Check Mbed TLS version identifier
5156 */
5157
5158 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
5159 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5160
5161 if( memcmp( p, ssl_serialized_session_header,
5162 sizeof( ssl_serialized_session_header ) ) != 0 )
5163 {
5164 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
5165 }
5166 p += sizeof( ssl_serialized_session_header );
5167 }
5168
5169 /*
5170 * TLS version identifier
5171 */
5172 if( 1 > (size_t)( end - p ) )
5173 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5174 session->minor_ver = *p++;
5175
5176 /* Dispatch according to TLS version. */
5177 switch( session->minor_ver )
5178 {
5179 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5180 case MBEDTLS_SSL_MINOR_VERSION_3: /* TLS 1.2 */
5181 {
5182 size_t remaining_len = ( end - p );
5183 return( ssl_session_load_tls12( session, p, remaining_len ) );
5184 }
5185 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5186
5187 default:
5188 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5189 }
5190 }
5191
5192 /*
5193 * Deserialize session: public wrapper for error cleaning
5194 */
mbedtls_ssl_session_load(mbedtls_ssl_session * session,const unsigned char * buf,size_t len)5195 int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
5196 const unsigned char *buf,
5197 size_t len )
5198 {
5199 int ret = ssl_session_load( session, 0, buf, len );
5200
5201 if( ret != 0 )
5202 mbedtls_ssl_session_free( session );
5203
5204 return( ret );
5205 }
5206
5207 /*
5208 * Perform a single step of the SSL handshake
5209 */
ssl_prepare_handshake_step(mbedtls_ssl_context * ssl)5210 static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
5211 {
5212 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5213
5214 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
5215 return( ret );
5216
5217 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5218 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5219 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
5220 {
5221 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
5222 return( ret );
5223 }
5224 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5225
5226 return( ret );
5227 }
5228
mbedtls_ssl_handshake_step(mbedtls_ssl_context * ssl)5229 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
5230 {
5231 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5232
5233 if( ssl == NULL ||
5234 ssl->conf == NULL ||
5235 ssl->handshake == NULL ||
5236 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
5237 {
5238 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5239 }
5240
5241 ret = ssl_prepare_handshake_step( ssl );
5242 if( ret != 0 )
5243 return( ret );
5244
5245 ret = mbedtls_ssl_handle_pending_alert( ssl );
5246 if( ret != 0 )
5247 goto cleanup;
5248
5249 #if defined(MBEDTLS_SSL_CLI_C)
5250 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
5251 {
5252 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
5253 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
5254 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
5255 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
5256
5257 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5258 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
5259 ret = mbedtls_ssl_handshake_client_step( ssl );
5260 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5261 }
5262 #endif
5263 #if defined(MBEDTLS_SSL_SRV_C)
5264 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5265 {
5266 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
5267 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
5268 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
5269 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
5270
5271 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5272 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
5273 ret = mbedtls_ssl_handshake_server_step( ssl );
5274 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5275 }
5276 #endif
5277
5278 if( ret != 0 )
5279 {
5280 /* handshake_step return error. And it is same
5281 * with alert_reason.
5282 */
5283 if( ssl->send_alert )
5284 {
5285 ret = mbedtls_ssl_handle_pending_alert( ssl );
5286 goto cleanup;
5287 }
5288 }
5289
5290 cleanup:
5291 return( ret );
5292 }
5293
5294 /*
5295 * Perform the SSL handshake
5296 */
mbedtls_ssl_handshake(mbedtls_ssl_context * ssl)5297 int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
5298 {
5299 int ret = 0;
5300
5301 /* Sanity checks */
5302
5303 if( ssl == NULL || ssl->conf == NULL )
5304 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5305
5306 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5307 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5308 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
5309 {
5310 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
5311 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
5312 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5313 }
5314 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5315
5316 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
5317
5318 /* Main handshake loop */
5319 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5320 {
5321 ret = mbedtls_ssl_handshake_step( ssl );
5322
5323 if( ret != 0 )
5324 break;
5325 }
5326
5327 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
5328
5329 return( ret );
5330 }
5331
5332 #if defined(MBEDTLS_SSL_RENEGOTIATION)
5333 #if defined(MBEDTLS_SSL_SRV_C)
5334 /*
5335 * Write HelloRequest to request renegotiation on server
5336 */
ssl_write_hello_request(mbedtls_ssl_context * ssl)5337 static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
5338 {
5339 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5340
5341 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
5342
5343 ssl->out_msglen = 4;
5344 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5345 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
5346
5347 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
5348 {
5349 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
5350 return( ret );
5351 }
5352
5353 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
5354
5355 return( 0 );
5356 }
5357 #endif /* MBEDTLS_SSL_SRV_C */
5358
5359 /*
5360 * Actually renegotiate current connection, triggered by either:
5361 * - any side: calling mbedtls_ssl_renegotiate(),
5362 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
5363 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
5364 * the initial handshake is completed.
5365 * If the handshake doesn't complete due to waiting for I/O, it will continue
5366 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
5367 */
mbedtls_ssl_start_renegotiation(mbedtls_ssl_context * ssl)5368 int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
5369 {
5370 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5371
5372 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
5373
5374 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
5375 return( ret );
5376
5377 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
5378 * the ServerHello will have message_seq = 1" */
5379 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5380 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5381 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
5382 {
5383 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5384 ssl->handshake->out_msg_seq = 1;
5385 else
5386 ssl->handshake->in_msg_seq = 1;
5387 }
5388 #endif
5389
5390 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
5391 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
5392
5393 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
5394 {
5395 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
5396 return( ret );
5397 }
5398
5399 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
5400
5401 return( 0 );
5402 }
5403
5404 /*
5405 * Renegotiate current connection on client,
5406 * or request renegotiation on server
5407 */
mbedtls_ssl_renegotiate(mbedtls_ssl_context * ssl)5408 int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
5409 {
5410 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
5411
5412 if( ssl == NULL || ssl->conf == NULL )
5413 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5414
5415 #if defined(MBEDTLS_SSL_SRV_C)
5416 /* On server, just send the request */
5417 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
5418 {
5419 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5420 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5421
5422 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
5423
5424 /* Did we already try/start sending HelloRequest? */
5425 if( ssl->out_left != 0 )
5426 return( mbedtls_ssl_flush_output( ssl ) );
5427
5428 return( ssl_write_hello_request( ssl ) );
5429 }
5430 #endif /* MBEDTLS_SSL_SRV_C */
5431
5432 #if defined(MBEDTLS_SSL_CLI_C)
5433 /*
5434 * On client, either start the renegotiation process or,
5435 * if already in progress, continue the handshake
5436 */
5437 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
5438 {
5439 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5440 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5441
5442 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
5443 {
5444 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
5445 return( ret );
5446 }
5447 }
5448 else
5449 {
5450 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
5451 {
5452 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
5453 return( ret );
5454 }
5455 }
5456 #endif /* MBEDTLS_SSL_CLI_C */
5457
5458 return( ret );
5459 }
5460 #endif /* MBEDTLS_SSL_RENEGOTIATION */
5461
5462 #if defined(MBEDTLS_X509_CRT_PARSE_C)
ssl_key_cert_free(mbedtls_ssl_key_cert * key_cert)5463 static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
5464 {
5465 mbedtls_ssl_key_cert *cur = key_cert, *next;
5466
5467 while( cur != NULL )
5468 {
5469 next = cur->next;
5470 mbedtls_free( cur );
5471 cur = next;
5472 }
5473 }
5474 #endif /* MBEDTLS_X509_CRT_PARSE_C */
5475
mbedtls_ssl_handshake_free(mbedtls_ssl_context * ssl)5476 void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
5477 {
5478 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
5479
5480 if( handshake == NULL )
5481 return;
5482
5483 #if defined(MBEDTLS_ECP_C)
5484 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
5485 if ( ssl->handshake->group_list_heap_allocated )
5486 mbedtls_free( (void*) handshake->group_list );
5487 handshake->group_list = NULL;
5488 #endif /* MBEDTLS_DEPRECATED_REMOVED */
5489 #endif /* MBEDTLS_ECP_C */
5490
5491 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
5492 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
5493 {
5494 ssl->conf->f_async_cancel( ssl );
5495 handshake->async_in_progress = 0;
5496 }
5497 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
5498
5499 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5500 #if defined(MBEDTLS_SHA256_C)
5501 #if defined(MBEDTLS_USE_PSA_CRYPTO)
5502 psa_hash_abort( &handshake->fin_sha256_psa );
5503 #else
5504 mbedtls_sha256_free( &handshake->fin_sha256 );
5505 #endif
5506 #endif
5507 #if defined(MBEDTLS_SHA384_C)
5508 #if defined(MBEDTLS_USE_PSA_CRYPTO)
5509 psa_hash_abort( &handshake->fin_sha384_psa );
5510 #else
5511 mbedtls_sha512_free( &handshake->fin_sha512 );
5512 #endif
5513 #endif
5514 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5515
5516 #if defined(MBEDTLS_DHM_C)
5517 mbedtls_dhm_free( &handshake->dhm_ctx );
5518 #endif
5519 #if defined(MBEDTLS_ECDH_C)
5520 mbedtls_ecdh_free( &handshake->ecdh_ctx );
5521 #endif
5522 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
5523 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
5524 #if defined(MBEDTLS_SSL_CLI_C)
5525 mbedtls_free( handshake->ecjpake_cache );
5526 handshake->ecjpake_cache = NULL;
5527 handshake->ecjpake_cache_len = 0;
5528 #endif
5529 #endif
5530
5531 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
5532 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
5533 /* explicit void pointer cast for buggy MS compiler */
5534 mbedtls_free( (void *) handshake->curves );
5535 #endif
5536
5537 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
5538 if( handshake->psk != NULL )
5539 {
5540 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
5541 mbedtls_free( handshake->psk );
5542 }
5543 #endif
5544
5545 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
5546 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
5547 /*
5548 * Free only the linked list wrapper, not the keys themselves
5549 * since the belong to the SNI callback
5550 */
5551 if( handshake->sni_key_cert != NULL )
5552 {
5553 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
5554
5555 while( cur != NULL )
5556 {
5557 next = cur->next;
5558 mbedtls_free( cur );
5559 cur = next;
5560 }
5561 }
5562 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
5563
5564 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
5565 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
5566 if( handshake->ecrs_peer_cert != NULL )
5567 {
5568 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
5569 mbedtls_free( handshake->ecrs_peer_cert );
5570 }
5571 #endif
5572
5573 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
5574 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
5575 mbedtls_pk_free( &handshake->peer_pubkey );
5576 #endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
5577
5578 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5579 mbedtls_free( handshake->verify_cookie );
5580 mbedtls_ssl_flight_free( handshake->flight );
5581 mbedtls_ssl_buffering_free( ssl );
5582 #endif
5583
5584 #if defined(MBEDTLS_ECDH_C) && \
5585 defined(MBEDTLS_USE_PSA_CRYPTO)
5586 psa_destroy_key( handshake->ecdh_psa_privkey );
5587 #endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
5588
5589 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
5590 mbedtls_ssl_transform_free( handshake->transform_handshake );
5591 mbedtls_ssl_transform_free( handshake->transform_earlydata );
5592 mbedtls_free( handshake->transform_earlydata );
5593 mbedtls_free( handshake->transform_handshake );
5594 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
5595
5596
5597 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
5598 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
5599 * processes datagrams and the fact that a datagram is allowed to have
5600 * several records in it, it is possible that the I/O buffers are not
5601 * empty at this stage */
5602 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
5603 mbedtls_ssl_get_output_buflen( ssl ) );
5604 #endif
5605
5606 /* mbedtls_platform_zeroize MUST be last one in this function */
5607 mbedtls_platform_zeroize( handshake,
5608 sizeof( mbedtls_ssl_handshake_params ) );
5609 }
5610
mbedtls_ssl_session_free(mbedtls_ssl_session * session)5611 void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
5612 {
5613 if( session == NULL )
5614 return;
5615
5616 #if defined(MBEDTLS_X509_CRT_PARSE_C)
5617 ssl_clear_peer_cert( session );
5618 #endif
5619
5620 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
5621 mbedtls_free( session->ticket );
5622 #endif
5623
5624 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
5625 }
5626
5627 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
5628
5629 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5630 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
5631 #else
5632 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
5633 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5634
5635 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
5636
5637 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5638 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
5639 #else
5640 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
5641 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5642
5643 #if defined(MBEDTLS_SSL_ALPN)
5644 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
5645 #else
5646 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
5647 #endif /* MBEDTLS_SSL_ALPN */
5648
5649 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
5650 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
5651 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
5652 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
5653
5654 #define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
5655 ( (uint32_t) ( \
5656 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
5657 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
5658 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
5659 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
5660 0u ) )
5661
5662 static unsigned char ssl_serialized_context_header[] = {
5663 MBEDTLS_VERSION_MAJOR,
5664 MBEDTLS_VERSION_MINOR,
5665 MBEDTLS_VERSION_PATCH,
5666 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5667 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
5668 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5669 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5670 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
5671 };
5672
5673 /*
5674 * Serialize a full SSL context
5675 *
5676 * The format of the serialized data is:
5677 * (in the presentation language of TLS, RFC 8446 section 3)
5678 *
5679 * // header
5680 * opaque mbedtls_version[3]; // major, minor, patch
5681 * opaque context_format[5]; // version-specific field determining
5682 * // the format of the remaining
5683 * // serialized data.
5684 * Note: When updating the format, remember to keep these
5685 * version+format bytes. (We may make their size part of the API.)
5686 *
5687 * // session sub-structure
5688 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
5689 * // transform sub-structure
5690 * uint8 random[64]; // ServerHello.random+ClientHello.random
5691 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
5692 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
5693 * // fields from ssl_context
5694 * uint32 badmac_seen; // DTLS: number of records with failing MAC
5695 * uint64 in_window_top; // DTLS: last validated record seq_num
5696 * uint64 in_window; // DTLS: bitmask for replay protection
5697 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
5698 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
5699 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
5700 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
5701 *
5702 * Note that many fields of the ssl_context or sub-structures are not
5703 * serialized, as they fall in one of the following categories:
5704 *
5705 * 1. forced value (eg in_left must be 0)
5706 * 2. pointer to dynamically-allocated memory (eg session, transform)
5707 * 3. value can be re-derived from other data (eg session keys from MS)
5708 * 4. value was temporary (eg content of input buffer)
5709 * 5. value will be provided by the user again (eg I/O callbacks and context)
5710 */
mbedtls_ssl_context_save(mbedtls_ssl_context * ssl,unsigned char * buf,size_t buf_len,size_t * olen)5711 int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
5712 unsigned char *buf,
5713 size_t buf_len,
5714 size_t *olen )
5715 {
5716 unsigned char *p = buf;
5717 size_t used = 0;
5718 size_t session_len;
5719 int ret = 0;
5720
5721 /*
5722 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
5723 * this function's documentation.
5724 *
5725 * These are due to assumptions/limitations in the implementation. Some of
5726 * them are likely to stay (no handshake in progress) some might go away
5727 * (only DTLS) but are currently used to simplify the implementation.
5728 */
5729 /* The initial handshake must be over */
5730 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
5731 {
5732 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
5733 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5734 }
5735 if( ssl->handshake != NULL )
5736 {
5737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
5738 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5739 }
5740 /* Double-check that sub-structures are indeed ready */
5741 if( ssl->transform == NULL || ssl->session == NULL )
5742 {
5743 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
5744 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5745 }
5746 /* There must be no pending incoming or outgoing data */
5747 if( mbedtls_ssl_check_pending( ssl ) != 0 )
5748 {
5749 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
5750 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5751 }
5752 if( ssl->out_left != 0 )
5753 {
5754 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
5755 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5756 }
5757 /* Protocol must be DLTS, not TLS */
5758 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5759 {
5760 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
5761 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5762 }
5763 /* Version must be 1.2 */
5764 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
5765 {
5766 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
5767 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5768 }
5769 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
5770 {
5771 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
5772 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5773 }
5774 /* We must be using an AEAD ciphersuite */
5775 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
5776 {
5777 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
5778 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5779 }
5780 /* Renegotiation must not be enabled */
5781 #if defined(MBEDTLS_SSL_RENEGOTIATION)
5782 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
5783 {
5784 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
5785 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5786 }
5787 #endif
5788
5789 /*
5790 * Version and format identifier
5791 */
5792 used += sizeof( ssl_serialized_context_header );
5793
5794 if( used <= buf_len )
5795 {
5796 memcpy( p, ssl_serialized_context_header,
5797 sizeof( ssl_serialized_context_header ) );
5798 p += sizeof( ssl_serialized_context_header );
5799 }
5800
5801 /*
5802 * Session (length + data)
5803 */
5804 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
5805 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
5806 return( ret );
5807
5808 used += 4 + session_len;
5809 if( used <= buf_len )
5810 {
5811 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
5812 p += 4;
5813
5814 ret = ssl_session_save( ssl->session, 1,
5815 p, session_len, &session_len );
5816 if( ret != 0 )
5817 return( ret );
5818
5819 p += session_len;
5820 }
5821
5822 /*
5823 * Transform
5824 */
5825 used += sizeof( ssl->transform->randbytes );
5826 if( used <= buf_len )
5827 {
5828 memcpy( p, ssl->transform->randbytes,
5829 sizeof( ssl->transform->randbytes ) );
5830 p += sizeof( ssl->transform->randbytes );
5831 }
5832
5833 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5834 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
5835 if( used <= buf_len )
5836 {
5837 *p++ = ssl->transform->in_cid_len;
5838 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
5839 p += ssl->transform->in_cid_len;
5840
5841 *p++ = ssl->transform->out_cid_len;
5842 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
5843 p += ssl->transform->out_cid_len;
5844 }
5845 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5846
5847 /*
5848 * Saved fields from top-level ssl_context structure
5849 */
5850 used += 4;
5851 if( used <= buf_len )
5852 {
5853 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
5854 p += 4;
5855 }
5856
5857 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5858 used += 16;
5859 if( used <= buf_len )
5860 {
5861 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
5862 p += 8;
5863
5864 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
5865 p += 8;
5866 }
5867 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
5868
5869 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5870 used += 1;
5871 if( used <= buf_len )
5872 {
5873 *p++ = ssl->disable_datagram_packing;
5874 }
5875 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5876
5877 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
5878 if( used <= buf_len )
5879 {
5880 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
5881 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
5882 }
5883
5884 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5885 used += 2;
5886 if( used <= buf_len )
5887 {
5888 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
5889 p += 2;
5890 }
5891 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5892
5893 #if defined(MBEDTLS_SSL_ALPN)
5894 {
5895 const uint8_t alpn_len = ssl->alpn_chosen
5896 ? (uint8_t) strlen( ssl->alpn_chosen )
5897 : 0;
5898
5899 used += 1 + alpn_len;
5900 if( used <= buf_len )
5901 {
5902 *p++ = alpn_len;
5903
5904 if( ssl->alpn_chosen != NULL )
5905 {
5906 memcpy( p, ssl->alpn_chosen, alpn_len );
5907 p += alpn_len;
5908 }
5909 }
5910 }
5911 #endif /* MBEDTLS_SSL_ALPN */
5912
5913 /*
5914 * Done
5915 */
5916 *olen = used;
5917
5918 if( used > buf_len )
5919 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5920
5921 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
5922
5923 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
5924 }
5925
5926 /*
5927 * Helper to get TLS 1.2 PRF from ciphersuite
5928 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
5929 */
5930 typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
5931 const char *label,
5932 const unsigned char *random, size_t rlen,
5933 unsigned char *dstbuf, size_t dlen );
ssl_tls12prf_from_cs(int ciphersuite_id)5934 static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
5935 {
5936 #if defined(MBEDTLS_SHA384_C)
5937 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5938 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
5939
5940 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
5941 return( tls_prf_sha384 );
5942 #else
5943 (void) ciphersuite_id;
5944 #endif
5945 return( tls_prf_sha256 );
5946 }
5947
5948 /*
5949 * Deserialize context, see mbedtls_ssl_context_save() for format.
5950 *
5951 * This internal version is wrapped by a public function that cleans up in
5952 * case of error.
5953 */
ssl_context_load(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)5954 static int ssl_context_load( mbedtls_ssl_context *ssl,
5955 const unsigned char *buf,
5956 size_t len )
5957 {
5958 const unsigned char *p = buf;
5959 const unsigned char * const end = buf + len;
5960 size_t session_len;
5961 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5962
5963 /*
5964 * The context should have been freshly setup or reset.
5965 * Give the user an error in case of obvious misuse.
5966 * (Checking session is useful because it won't be NULL if we're
5967 * renegotiating, or if the user mistakenly loaded a session first.)
5968 */
5969 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
5970 ssl->session != NULL )
5971 {
5972 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5973 }
5974
5975 /*
5976 * We can't check that the config matches the initial one, but we can at
5977 * least check it matches the requirements for serializing.
5978 */
5979 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
5980 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
5981 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 ||
5982 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ||
5983 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 ||
5984 #if defined(MBEDTLS_SSL_RENEGOTIATION)
5985 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
5986 #endif
5987 0 )
5988 {
5989 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5990 }
5991
5992 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
5993
5994 /*
5995 * Check version identifier
5996 */
5997 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
5998 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5999
6000 if( memcmp( p, ssl_serialized_context_header,
6001 sizeof( ssl_serialized_context_header ) ) != 0 )
6002 {
6003 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
6004 }
6005 p += sizeof( ssl_serialized_context_header );
6006
6007 /*
6008 * Session
6009 */
6010 if( (size_t)( end - p ) < 4 )
6011 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6012
6013 session_len = ( (size_t) p[0] << 24 ) |
6014 ( (size_t) p[1] << 16 ) |
6015 ( (size_t) p[2] << 8 ) |
6016 ( (size_t) p[3] );
6017 p += 4;
6018
6019 /* This has been allocated by ssl_handshake_init(), called by
6020 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
6021 ssl->session = ssl->session_negotiate;
6022 ssl->session_in = ssl->session;
6023 ssl->session_out = ssl->session;
6024 ssl->session_negotiate = NULL;
6025
6026 if( (size_t)( end - p ) < session_len )
6027 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6028
6029 ret = ssl_session_load( ssl->session, 1, p, session_len );
6030 if( ret != 0 )
6031 {
6032 mbedtls_ssl_session_free( ssl->session );
6033 return( ret );
6034 }
6035
6036 p += session_len;
6037
6038 /*
6039 * Transform
6040 */
6041
6042 /* This has been allocated by ssl_handshake_init(), called by
6043 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
6044 ssl->transform = ssl->transform_negotiate;
6045 ssl->transform_in = ssl->transform;
6046 ssl->transform_out = ssl->transform;
6047 ssl->transform_negotiate = NULL;
6048
6049 /* Read random bytes and populate structure */
6050 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
6051 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6052
6053 ret = ssl_tls12_populate_transform( ssl->transform,
6054 ssl->session->ciphersuite,
6055 ssl->session->master,
6056 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) && \
6057 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6058 ssl->session->encrypt_then_mac,
6059 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC &&
6060 MBEDTLS_SSL_SOME_SUITES_USE_MAC */
6061 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
6062 p, /* currently pointing to randbytes */
6063 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
6064 ssl->conf->endpoint,
6065 ssl );
6066 if( ret != 0 )
6067 return( ret );
6068
6069 p += sizeof( ssl->transform->randbytes );
6070
6071 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6072 /* Read connection IDs and store them */
6073 if( (size_t)( end - p ) < 1 )
6074 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6075
6076 ssl->transform->in_cid_len = *p++;
6077
6078 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
6079 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6080
6081 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
6082 p += ssl->transform->in_cid_len;
6083
6084 ssl->transform->out_cid_len = *p++;
6085
6086 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
6087 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6088
6089 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
6090 p += ssl->transform->out_cid_len;
6091 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
6092
6093 /*
6094 * Saved fields from top-level ssl_context structure
6095 */
6096 if( (size_t)( end - p ) < 4 )
6097 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6098
6099 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
6100 ( (uint32_t) p[1] << 16 ) |
6101 ( (uint32_t) p[2] << 8 ) |
6102 ( (uint32_t) p[3] );
6103 p += 4;
6104
6105 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6106 if( (size_t)( end - p ) < 16 )
6107 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6108
6109 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
6110 ( (uint64_t) p[1] << 48 ) |
6111 ( (uint64_t) p[2] << 40 ) |
6112 ( (uint64_t) p[3] << 32 ) |
6113 ( (uint64_t) p[4] << 24 ) |
6114 ( (uint64_t) p[5] << 16 ) |
6115 ( (uint64_t) p[6] << 8 ) |
6116 ( (uint64_t) p[7] );
6117 p += 8;
6118
6119 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
6120 ( (uint64_t) p[1] << 48 ) |
6121 ( (uint64_t) p[2] << 40 ) |
6122 ( (uint64_t) p[3] << 32 ) |
6123 ( (uint64_t) p[4] << 24 ) |
6124 ( (uint64_t) p[5] << 16 ) |
6125 ( (uint64_t) p[6] << 8 ) |
6126 ( (uint64_t) p[7] );
6127 p += 8;
6128 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
6129
6130 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6131 if( (size_t)( end - p ) < 1 )
6132 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6133
6134 ssl->disable_datagram_packing = *p++;
6135 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6136
6137 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
6138 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6139 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
6140 p += sizeof( ssl->cur_out_ctr );
6141
6142 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6143 if( (size_t)( end - p ) < 2 )
6144 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6145
6146 ssl->mtu = ( p[0] << 8 ) | p[1];
6147 p += 2;
6148 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6149
6150 #if defined(MBEDTLS_SSL_ALPN)
6151 {
6152 uint8_t alpn_len;
6153 const char **cur;
6154
6155 if( (size_t)( end - p ) < 1 )
6156 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6157
6158 alpn_len = *p++;
6159
6160 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
6161 {
6162 /* alpn_chosen should point to an item in the configured list */
6163 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
6164 {
6165 if( strlen( *cur ) == alpn_len &&
6166 memcmp( p, cur, alpn_len ) == 0 )
6167 {
6168 ssl->alpn_chosen = *cur;
6169 break;
6170 }
6171 }
6172 }
6173
6174 /* can only happen on conf mismatch */
6175 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
6176 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6177
6178 p += alpn_len;
6179 }
6180 #endif /* MBEDTLS_SSL_ALPN */
6181
6182 /*
6183 * Forced fields from top-level ssl_context structure
6184 *
6185 * Most of them already set to the correct value by mbedtls_ssl_init() and
6186 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
6187 */
6188 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
6189
6190 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6191 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6192
6193 /* Adjust pointers for header fields of outgoing records to
6194 * the given transform, accounting for explicit IV and CID. */
6195 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
6196
6197 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6198 ssl->in_epoch = 1;
6199 #endif
6200
6201 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
6202 * which we don't want - otherwise we'd end up freeing the wrong transform
6203 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
6204 * inappropriately. */
6205 if( ssl->handshake != NULL )
6206 {
6207 mbedtls_ssl_handshake_free( ssl );
6208 mbedtls_free( ssl->handshake );
6209 ssl->handshake = NULL;
6210 }
6211
6212 /*
6213 * Done - should have consumed entire buffer
6214 */
6215 if( p != end )
6216 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6217
6218 return( 0 );
6219 }
6220
6221 /*
6222 * Deserialize context: public wrapper for error cleaning
6223 */
mbedtls_ssl_context_load(mbedtls_ssl_context * context,const unsigned char * buf,size_t len)6224 int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
6225 const unsigned char *buf,
6226 size_t len )
6227 {
6228 int ret = ssl_context_load( context, buf, len );
6229
6230 if( ret != 0 )
6231 mbedtls_ssl_free( context );
6232
6233 return( ret );
6234 }
6235 #endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
6236
6237 /*
6238 * Free an SSL context
6239 */
mbedtls_ssl_free(mbedtls_ssl_context * ssl)6240 void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
6241 {
6242 if( ssl == NULL )
6243 return;
6244
6245 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
6246
6247 if( ssl->out_buf != NULL )
6248 {
6249 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6250 size_t out_buf_len = ssl->out_buf_len;
6251 #else
6252 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
6253 #endif
6254
6255 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
6256 mbedtls_free( ssl->out_buf );
6257 ssl->out_buf = NULL;
6258 }
6259
6260 if( ssl->in_buf != NULL )
6261 {
6262 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
6263 size_t in_buf_len = ssl->in_buf_len;
6264 #else
6265 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
6266 #endif
6267
6268 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
6269 mbedtls_free( ssl->in_buf );
6270 ssl->in_buf = NULL;
6271 }
6272
6273 if( ssl->transform )
6274 {
6275 mbedtls_ssl_transform_free( ssl->transform );
6276 mbedtls_free( ssl->transform );
6277 }
6278
6279 if( ssl->handshake )
6280 {
6281 mbedtls_ssl_handshake_free( ssl );
6282 mbedtls_ssl_transform_free( ssl->transform_negotiate );
6283 mbedtls_ssl_session_free( ssl->session_negotiate );
6284
6285 mbedtls_free( ssl->handshake );
6286 mbedtls_free( ssl->transform_negotiate );
6287 mbedtls_free( ssl->session_negotiate );
6288 }
6289
6290 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6291 mbedtls_ssl_transform_free( ssl->transform_application );
6292 mbedtls_free( ssl->transform_application );
6293 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6294
6295 if( ssl->session )
6296 {
6297 mbedtls_ssl_session_free( ssl->session );
6298 mbedtls_free( ssl->session );
6299 }
6300
6301 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6302 if( ssl->hostname != NULL )
6303 {
6304 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
6305 mbedtls_free( ssl->hostname );
6306 }
6307 #endif
6308
6309 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6310 mbedtls_free( ssl->cli_id );
6311 #endif
6312
6313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
6314
6315 /* Actually clear after last debug message */
6316 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
6317 }
6318
6319 /*
6320 * Initialze mbedtls_ssl_config
6321 */
mbedtls_ssl_config_init(mbedtls_ssl_config * conf)6322 void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
6323 {
6324 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
6325 }
6326
6327 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6328 /* The selection should be the same as mbedtls_x509_crt_profile_default in
6329 * x509_crt.c. Here, the order matters. Currently we favor stronger hashes,
6330 * for no fundamental reason.
6331 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
6332 * about this list. */
6333 static int ssl_preset_default_hashes[] = {
6334 #if defined(MBEDTLS_SHA512_C)
6335 MBEDTLS_MD_SHA512,
6336 #endif
6337 #if defined(MBEDTLS_SHA384_C)
6338 MBEDTLS_MD_SHA384,
6339 #endif
6340 #if defined(MBEDTLS_SHA256_C)
6341 MBEDTLS_MD_SHA256,
6342 #endif
6343 MBEDTLS_MD_NONE
6344 };
6345 #endif
6346
6347 /* The selection should be the same as mbedtls_x509_crt_profile_default in
6348 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
6349 * curves with a lower resource usage come first.
6350 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
6351 * about this list.
6352 */
6353 static uint16_t ssl_preset_default_groups[] = {
6354 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
6355 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
6356 #endif
6357 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6358 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
6359 #endif
6360 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6361 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
6362 #endif
6363 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
6364 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
6365 #endif
6366 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
6367 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
6368 #endif
6369 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
6370 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
6371 #endif
6372 #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
6373 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
6374 #endif
6375 #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
6376 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
6377 #endif
6378 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
6379 };
6380
6381 static int ssl_preset_suiteb_ciphersuites[] = {
6382 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
6383 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
6384 0
6385 };
6386
6387 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6388 static int ssl_preset_suiteb_hashes[] = {
6389 MBEDTLS_MD_SHA256,
6390 MBEDTLS_MD_SHA384,
6391 MBEDTLS_MD_NONE
6392 };
6393
6394 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6395 static uint16_t ssl_preset_default_sig_algs[] = {
6396 /* ECDSA algorithms */
6397 #if defined(MBEDTLS_ECDSA_C)
6398 #if defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6399 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
6400 #endif /* MBEDTLS_SHA256_C && MBEDTLS_ECP_DP_SECP256R1_ENABLED */
6401 #if defined(MBEDTLS_SHA384_C) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6402 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
6403 #endif /* MBEDTLS_SHA384_C && MBEDTLS_ECP_DP_SECP384R1_ENABLED */
6404 #if defined(MBEDTLS_SHA512_C) && defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
6405 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
6406 #endif /* MBEDTLS_SHA512_C && MBEDTLS_ECP_DP_SECP521R1_ENABLED */
6407 #endif /* MBEDTLS_ECDSA_C */
6408
6409 /* RSA algorithms */
6410 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
6411 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
6412 #endif
6413 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
6414
6415 MBEDTLS_TLS1_3_SIG_NONE
6416 };
6417
6418 static uint16_t ssl_preset_suiteb_sig_algs[] = {
6419 /* ECDSA algorithms */
6420 #if defined(MBEDTLS_ECDSA_C)
6421 #if defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6422 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
6423 #endif /* MBEDTLS_SHA256_C && MBEDTLS_ECP_DP_SECP256R1_ENABLED */
6424 #if defined(MBEDTLS_SHA384_C) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6425 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
6426 #endif /* MBEDTLS_SHA384_C && MBEDTLS_ECP_DP_SECP384R1_ENABLED */
6427 #endif /* MBEDTLS_ECDSA_C */
6428
6429 /* RSA algorithms */
6430 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
6431 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
6432 #endif
6433 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
6434
6435 MBEDTLS_TLS1_3_SIG_NONE
6436 };
6437 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6438 #endif
6439
6440 static uint16_t ssl_preset_suiteb_groups[] = {
6441 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
6442 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
6443 #endif
6444 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
6445 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
6446 #endif
6447 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
6448 };
6449
6450 /*
6451 * Load default in mbedtls_ssl_config
6452 */
mbedtls_ssl_config_defaults(mbedtls_ssl_config * conf,int endpoint,int transport,int preset)6453 int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
6454 int endpoint, int transport, int preset )
6455 {
6456 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
6457 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6458 #endif
6459
6460 /* Use the functions here so that they are covered in tests,
6461 * but otherwise access member directly for efficiency */
6462 mbedtls_ssl_conf_endpoint( conf, endpoint );
6463 mbedtls_ssl_conf_transport( conf, transport );
6464
6465 /*
6466 * Things that are common to all presets
6467 */
6468 #if defined(MBEDTLS_SSL_CLI_C)
6469 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
6470 {
6471 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
6472 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
6473 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
6474 #endif
6475 }
6476 #endif
6477
6478 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6479 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
6480 #endif
6481
6482 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6483 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
6484 #endif
6485
6486 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6487 conf->f_cookie_write = ssl_cookie_write_dummy;
6488 conf->f_cookie_check = ssl_cookie_check_dummy;
6489 #endif
6490
6491 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6492 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
6493 #endif
6494
6495 #if defined(MBEDTLS_SSL_SRV_C)
6496 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
6497 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
6498 #endif
6499
6500 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6501 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
6502 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
6503 #endif
6504
6505 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6506 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
6507 memset( conf->renego_period, 0x00, 2 );
6508 memset( conf->renego_period + 2, 0xFF, 6 );
6509 #endif
6510
6511 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
6512 if( endpoint == MBEDTLS_SSL_IS_SERVER )
6513 {
6514 const unsigned char dhm_p[] =
6515 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
6516 const unsigned char dhm_g[] =
6517 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
6518
6519 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
6520 dhm_p, sizeof( dhm_p ),
6521 dhm_g, sizeof( dhm_g ) ) ) != 0 )
6522 {
6523 return( ret );
6524 }
6525 }
6526 #endif
6527
6528 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6529 /*
6530 * Allow all TLS 1.3 key exchange modes by default.
6531 */
6532 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
6533 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6534
6535 /*
6536 * Preset-specific defaults
6537 */
6538 switch( preset )
6539 {
6540 /*
6541 * NSA Suite B
6542 */
6543 case MBEDTLS_SSL_PRESET_SUITEB:
6544 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
6545 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
6546 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
6547 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
6548
6549 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
6550
6551 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6552 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
6553 #endif
6554
6555 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6556 conf->sig_hashes = ssl_preset_suiteb_hashes;
6557 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6558 conf->tls13_sig_algs = ssl_preset_suiteb_sig_algs;
6559 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6560 #endif
6561
6562 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
6563 conf->curve_list = NULL;
6564 #endif
6565 conf->group_list = ssl_preset_suiteb_groups;
6566 break;
6567
6568 /*
6569 * Default
6570 */
6571 default:
6572 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
6573 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
6574 MBEDTLS_SSL_MIN_MAJOR_VERSION :
6575 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
6576 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
6577 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
6578 MBEDTLS_SSL_MIN_MINOR_VERSION :
6579 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
6580 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
6581 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
6582
6583 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6584 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6585 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
6586 #endif
6587 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
6588
6589 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6590 conf->cert_profile = &mbedtls_x509_crt_profile_default;
6591 #endif
6592
6593 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6594 conf->sig_hashes = ssl_preset_default_hashes;
6595 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
6596 conf->tls13_sig_algs = ssl_preset_default_sig_algs;
6597 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
6598 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6599
6600 #if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
6601 conf->curve_list = NULL;
6602 #endif
6603 conf->group_list = ssl_preset_default_groups;
6604
6605 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
6606 conf->dhm_min_bitlen = 1024;
6607 #endif
6608 }
6609
6610 return( 0 );
6611 }
6612
6613 /*
6614 * Free mbedtls_ssl_config
6615 */
mbedtls_ssl_config_free(mbedtls_ssl_config * conf)6616 void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
6617 {
6618 #if defined(MBEDTLS_DHM_C)
6619 mbedtls_mpi_free( &conf->dhm_P );
6620 mbedtls_mpi_free( &conf->dhm_G );
6621 #endif
6622
6623 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
6624 if( conf->psk != NULL )
6625 {
6626 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
6627 mbedtls_free( conf->psk );
6628 conf->psk = NULL;
6629 conf->psk_len = 0;
6630 }
6631
6632 if( conf->psk_identity != NULL )
6633 {
6634 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
6635 mbedtls_free( conf->psk_identity );
6636 conf->psk_identity = NULL;
6637 conf->psk_identity_len = 0;
6638 }
6639 #endif
6640
6641 #if defined(MBEDTLS_X509_CRT_PARSE_C)
6642 ssl_key_cert_free( conf->key_cert );
6643 #endif
6644
6645 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
6646 }
6647
6648 #if defined(MBEDTLS_PK_C) && \
6649 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
6650 /*
6651 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
6652 */
mbedtls_ssl_sig_from_pk(mbedtls_pk_context * pk)6653 unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
6654 {
6655 #if defined(MBEDTLS_RSA_C)
6656 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
6657 return( MBEDTLS_SSL_SIG_RSA );
6658 #endif
6659 #if defined(MBEDTLS_ECDSA_C)
6660 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
6661 return( MBEDTLS_SSL_SIG_ECDSA );
6662 #endif
6663 return( MBEDTLS_SSL_SIG_ANON );
6664 }
6665
mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type)6666 unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
6667 {
6668 switch( type ) {
6669 case MBEDTLS_PK_RSA:
6670 return( MBEDTLS_SSL_SIG_RSA );
6671 case MBEDTLS_PK_ECDSA:
6672 case MBEDTLS_PK_ECKEY:
6673 return( MBEDTLS_SSL_SIG_ECDSA );
6674 default:
6675 return( MBEDTLS_SSL_SIG_ANON );
6676 }
6677 }
6678
mbedtls_ssl_pk_alg_from_sig(unsigned char sig)6679 mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
6680 {
6681 switch( sig )
6682 {
6683 #if defined(MBEDTLS_RSA_C)
6684 case MBEDTLS_SSL_SIG_RSA:
6685 return( MBEDTLS_PK_RSA );
6686 #endif
6687 #if defined(MBEDTLS_ECDSA_C)
6688 case MBEDTLS_SSL_SIG_ECDSA:
6689 return( MBEDTLS_PK_ECDSA );
6690 #endif
6691 default:
6692 return( MBEDTLS_PK_NONE );
6693 }
6694 }
6695 #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
6696
6697 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
6698 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6699
6700 /* Find an entry in a signature-hash set matching a given hash algorithm. */
mbedtls_ssl_sig_hash_set_find(mbedtls_ssl_sig_hash_set_t * set,mbedtls_pk_type_t sig_alg)6701 mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
6702 mbedtls_pk_type_t sig_alg )
6703 {
6704 switch( sig_alg )
6705 {
6706 case MBEDTLS_PK_RSA:
6707 return( set->rsa );
6708 case MBEDTLS_PK_ECDSA:
6709 return( set->ecdsa );
6710 default:
6711 return( MBEDTLS_MD_NONE );
6712 }
6713 }
6714
6715 /* Add a signature-hash-pair to a signature-hash set */
mbedtls_ssl_sig_hash_set_add(mbedtls_ssl_sig_hash_set_t * set,mbedtls_pk_type_t sig_alg,mbedtls_md_type_t md_alg)6716 void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
6717 mbedtls_pk_type_t sig_alg,
6718 mbedtls_md_type_t md_alg )
6719 {
6720 switch( sig_alg )
6721 {
6722 case MBEDTLS_PK_RSA:
6723 if( set->rsa == MBEDTLS_MD_NONE )
6724 set->rsa = md_alg;
6725 break;
6726
6727 case MBEDTLS_PK_ECDSA:
6728 if( set->ecdsa == MBEDTLS_MD_NONE )
6729 set->ecdsa = md_alg;
6730 break;
6731
6732 default:
6733 break;
6734 }
6735 }
6736
6737 /* Allow exactly one hash algorithm for each signature. */
mbedtls_ssl_sig_hash_set_const_hash(mbedtls_ssl_sig_hash_set_t * set,mbedtls_md_type_t md_alg)6738 void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
6739 mbedtls_md_type_t md_alg )
6740 {
6741 set->rsa = md_alg;
6742 set->ecdsa = md_alg;
6743 }
6744
6745 #endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
6746 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6747
6748 /*
6749 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
6750 */
mbedtls_ssl_md_alg_from_hash(unsigned char hash)6751 mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
6752 {
6753 switch( hash )
6754 {
6755 #if defined(MBEDTLS_MD5_C)
6756 case MBEDTLS_SSL_HASH_MD5:
6757 return( MBEDTLS_MD_MD5 );
6758 #endif
6759 #if defined(MBEDTLS_SHA1_C)
6760 case MBEDTLS_SSL_HASH_SHA1:
6761 return( MBEDTLS_MD_SHA1 );
6762 #endif
6763 #if defined(MBEDTLS_SHA224_C)
6764 case MBEDTLS_SSL_HASH_SHA224:
6765 return( MBEDTLS_MD_SHA224 );
6766 #endif
6767 #if defined(MBEDTLS_SHA256_C)
6768 case MBEDTLS_SSL_HASH_SHA256:
6769 return( MBEDTLS_MD_SHA256 );
6770 #endif
6771 #if defined(MBEDTLS_SHA384_C)
6772 case MBEDTLS_SSL_HASH_SHA384:
6773 return( MBEDTLS_MD_SHA384 );
6774 #endif
6775 #if defined(MBEDTLS_SHA512_C)
6776 case MBEDTLS_SSL_HASH_SHA512:
6777 return( MBEDTLS_MD_SHA512 );
6778 #endif
6779 default:
6780 return( MBEDTLS_MD_NONE );
6781 }
6782 }
6783
6784 /*
6785 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
6786 */
mbedtls_ssl_hash_from_md_alg(int md)6787 unsigned char mbedtls_ssl_hash_from_md_alg( int md )
6788 {
6789 switch( md )
6790 {
6791 #if defined(MBEDTLS_MD5_C)
6792 case MBEDTLS_MD_MD5:
6793 return( MBEDTLS_SSL_HASH_MD5 );
6794 #endif
6795 #if defined(MBEDTLS_SHA1_C)
6796 case MBEDTLS_MD_SHA1:
6797 return( MBEDTLS_SSL_HASH_SHA1 );
6798 #endif
6799 #if defined(MBEDTLS_SHA224_C)
6800 case MBEDTLS_MD_SHA224:
6801 return( MBEDTLS_SSL_HASH_SHA224 );
6802 #endif
6803 #if defined(MBEDTLS_SHA256_C)
6804 case MBEDTLS_MD_SHA256:
6805 return( MBEDTLS_SSL_HASH_SHA256 );
6806 #endif
6807 #if defined(MBEDTLS_SHA384_C)
6808 case MBEDTLS_MD_SHA384:
6809 return( MBEDTLS_SSL_HASH_SHA384 );
6810 #endif
6811 #if defined(MBEDTLS_SHA512_C)
6812 case MBEDTLS_MD_SHA512:
6813 return( MBEDTLS_SSL_HASH_SHA512 );
6814 #endif
6815 default:
6816 return( MBEDTLS_SSL_HASH_NONE );
6817 }
6818 }
6819
6820 #if defined(MBEDTLS_ECP_C)
6821 /*
6822 * Check if a curve proposed by the peer is in our list.
6823 * Return 0 if we're willing to use it, -1 otherwise.
6824 */
mbedtls_ssl_check_curve(const mbedtls_ssl_context * ssl,mbedtls_ecp_group_id grp_id)6825 int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
6826 {
6827 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
6828
6829 if( group_list == NULL )
6830 return( -1 );
6831 uint16_t tls_id = mbedtls_ecp_curve_info_from_grp_id(grp_id)->tls_id;
6832
6833 for( ; *group_list != 0; group_list++ )
6834 {
6835 if( *group_list == tls_id )
6836 return( 0 );
6837 }
6838
6839 return( -1 );
6840 }
6841 #endif /* MBEDTLS_ECP_C */
6842
6843 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6844 /*
6845 * Check if a hash proposed by the peer is in our list.
6846 * Return 0 if we're willing to use it, -1 otherwise.
6847 */
mbedtls_ssl_check_sig_hash(const mbedtls_ssl_context * ssl,mbedtls_md_type_t md)6848 int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
6849 mbedtls_md_type_t md )
6850 {
6851 const int *cur;
6852
6853 if( ssl->conf->sig_hashes == NULL )
6854 return( -1 );
6855
6856 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
6857 if( *cur == (int) md )
6858 return( 0 );
6859
6860 return( -1 );
6861 }
6862 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6863
6864 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt * cert,const mbedtls_ssl_ciphersuite_t * ciphersuite,int cert_endpoint,uint32_t * flags)6865 int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
6866 const mbedtls_ssl_ciphersuite_t *ciphersuite,
6867 int cert_endpoint,
6868 uint32_t *flags )
6869 {
6870 int ret = 0;
6871 int usage = 0;
6872 const char *ext_oid;
6873 size_t ext_len;
6874
6875 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
6876 {
6877 /* Server part of the key exchange */
6878 switch( ciphersuite->key_exchange )
6879 {
6880 case MBEDTLS_KEY_EXCHANGE_RSA:
6881 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
6882 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
6883 break;
6884
6885 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
6886 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
6887 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
6888 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
6889 break;
6890
6891 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
6892 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
6893 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
6894 break;
6895
6896 /* Don't use default: we want warnings when adding new values */
6897 case MBEDTLS_KEY_EXCHANGE_NONE:
6898 case MBEDTLS_KEY_EXCHANGE_PSK:
6899 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
6900 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
6901 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
6902 usage = 0;
6903 }
6904 }
6905 else
6906 {
6907 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
6908 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
6909 }
6910
6911 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
6912 {
6913 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
6914 ret = -1;
6915 }
6916
6917 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
6918 {
6919 ext_oid = MBEDTLS_OID_SERVER_AUTH;
6920 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
6921 }
6922 else
6923 {
6924 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
6925 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
6926 }
6927
6928 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
6929 {
6930 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
6931 ret = -1;
6932 }
6933
6934 return( ret );
6935 }
6936 #endif /* MBEDTLS_X509_CRT_PARSE_C */
6937
mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context * ssl,int md)6938 int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
6939 {
6940 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6941 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
6942 return( -1 );
6943
6944 switch( md )
6945 {
6946 #if defined(MBEDTLS_SHA384_C)
6947 case MBEDTLS_SSL_HASH_SHA384:
6948 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
6949 break;
6950 #endif
6951 #if defined(MBEDTLS_SHA256_C)
6952 case MBEDTLS_SSL_HASH_SHA256:
6953 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
6954 break;
6955 #endif
6956 default:
6957 return( -1 );
6958 }
6959
6960 return 0;
6961 #else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
6962 (void) ssl;
6963 (void) md;
6964
6965 return( -1 );
6966 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6967 }
6968
6969 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6970
6971 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hashlen,unsigned char * data,size_t data_len,mbedtls_md_type_t md_alg)6972 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
6973 unsigned char *hash, size_t *hashlen,
6974 unsigned char *data, size_t data_len,
6975 mbedtls_md_type_t md_alg )
6976 {
6977 psa_status_t status;
6978 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
6979 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg );
6980
6981 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
6982
6983 if( ( status = psa_hash_setup( &hash_operation,
6984 hash_alg ) ) != PSA_SUCCESS )
6985 {
6986 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
6987 goto exit;
6988 }
6989
6990 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
6991 64 ) ) != PSA_SUCCESS )
6992 {
6993 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
6994 goto exit;
6995 }
6996
6997 if( ( status = psa_hash_update( &hash_operation,
6998 data, data_len ) ) != PSA_SUCCESS )
6999 {
7000 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7001 goto exit;
7002 }
7003
7004 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
7005 hashlen ) ) != PSA_SUCCESS )
7006 {
7007 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
7008 goto exit;
7009 }
7010
7011 exit:
7012 if( status != PSA_SUCCESS )
7013 {
7014 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7015 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7016 switch( status )
7017 {
7018 case PSA_ERROR_NOT_SUPPORTED:
7019 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
7020 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
7021 case PSA_ERROR_BUFFER_TOO_SMALL:
7022 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7023 case PSA_ERROR_INSUFFICIENT_MEMORY:
7024 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7025 default:
7026 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
7027 }
7028 }
7029 return( 0 );
7030 }
7031
7032 #else
7033
mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context * ssl,unsigned char * hash,size_t * hashlen,unsigned char * data,size_t data_len,mbedtls_md_type_t md_alg)7034 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7035 unsigned char *hash, size_t *hashlen,
7036 unsigned char *data, size_t data_len,
7037 mbedtls_md_type_t md_alg )
7038 {
7039 int ret = 0;
7040 mbedtls_md_context_t ctx;
7041 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
7042 *hashlen = mbedtls_md_get_size( md_info );
7043
7044 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
7045
7046 mbedtls_md_init( &ctx );
7047
7048 /*
7049 * digitally-signed struct {
7050 * opaque client_random[32];
7051 * opaque server_random[32];
7052 * ServerDHParams params;
7053 * };
7054 */
7055 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7056 {
7057 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7058 goto exit;
7059 }
7060 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7061 {
7062 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7063 goto exit;
7064 }
7065 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7066 {
7067 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7068 goto exit;
7069 }
7070 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7071 {
7072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7073 goto exit;
7074 }
7075 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
7076 {
7077 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7078 goto exit;
7079 }
7080
7081 exit:
7082 mbedtls_md_free( &ctx );
7083
7084 if( ret != 0 )
7085 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7086 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7087
7088 return( ret );
7089 }
7090 #endif /* MBEDTLS_USE_PSA_CRYPTO */
7091
7092 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
7093
7094 #if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context * ssl,const mbedtls_md_type_t md,unsigned char * dst,size_t dst_len,size_t * olen)7095 int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
7096 const mbedtls_md_type_t md,
7097 unsigned char *dst,
7098 size_t dst_len,
7099 size_t *olen )
7100 {
7101 ((void) ssl);
7102 ((void) md);
7103 ((void) dst);
7104 ((void) dst_len);
7105 *olen = 0;
7106 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE);
7107 }
7108 #else /* MBEDTLS_USE_PSA_CRYPTO */
7109
7110 #if defined(MBEDTLS_SHA384_C)
ssl_get_handshake_transcript_sha384(mbedtls_ssl_context * ssl,unsigned char * dst,size_t dst_len,size_t * olen)7111 static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
7112 unsigned char *dst,
7113 size_t dst_len,
7114 size_t *olen )
7115 {
7116 int ret;
7117 mbedtls_sha512_context sha512;
7118
7119 if( dst_len < 48 )
7120 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7121
7122 mbedtls_sha512_init( &sha512 );
7123 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
7124
7125 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
7126 {
7127 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
7128 goto exit;
7129 }
7130
7131 *olen = 48;
7132
7133 exit:
7134
7135 mbedtls_sha512_free( &sha512 );
7136 return( ret );
7137 }
7138 #endif /* MBEDTLS_SHA384_C */
7139
7140 #if defined(MBEDTLS_SHA256_C)
ssl_get_handshake_transcript_sha256(mbedtls_ssl_context * ssl,unsigned char * dst,size_t dst_len,size_t * olen)7141 static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
7142 unsigned char *dst,
7143 size_t dst_len,
7144 size_t *olen )
7145 {
7146 int ret;
7147 mbedtls_sha256_context sha256;
7148
7149 if( dst_len < 32 )
7150 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7151
7152 mbedtls_sha256_init( &sha256 );
7153 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
7154
7155 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
7156 {
7157 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
7158 goto exit;
7159 }
7160
7161 *olen = 32;
7162
7163 exit:
7164
7165 mbedtls_sha256_free( &sha256 );
7166 return( ret );
7167 }
7168 #endif /* MBEDTLS_SHA256_C */
7169
mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context * ssl,const mbedtls_md_type_t md,unsigned char * dst,size_t dst_len,size_t * olen)7170 int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
7171 const mbedtls_md_type_t md,
7172 unsigned char *dst,
7173 size_t dst_len,
7174 size_t *olen )
7175 {
7176 switch( md )
7177 {
7178
7179 #if defined(MBEDTLS_SHA384_C)
7180 case MBEDTLS_MD_SHA384:
7181 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
7182 #endif /* MBEDTLS_SHA384_C */
7183
7184 #if defined(MBEDTLS_SHA256_C)
7185 case MBEDTLS_MD_SHA256:
7186 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
7187 #endif /* MBEDTLS_SHA256_C */
7188
7189 default:
7190 break;
7191 }
7192 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7193 }
7194 #endif /* !MBEDTLS_USE_PSA_CRYPTO */
7195
7196 #endif /* MBEDTLS_SSL_TLS_C */
7197