Merge pull request #6065 from mpg/explore2
Driver-only hashes: RSA 1.5 and PK + strategy doc
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2610359..bb86788 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -131,7 +131,10 @@
set(target "${CMAKE_CURRENT_SOURCE_DIR}/${base_name}")
endif()
- if (NOT EXISTS ${link})
+ # Linking to non-existent file is not desirable. At best you will have a
+ # dangling link, but when building in tree, this can create a symbolic link
+ # to itself.
+ if (EXISTS ${target} AND NOT EXISTS ${link})
if (CMAKE_HOST_UNIX)
set(command ln -s ${target} ${link})
else()
@@ -348,7 +351,7 @@
write_basic_package_version_file(
"cmake/MbedTLSConfigVersion.cmake"
COMPATIBILITY SameMajorVersion
- VERSION 3.2.0)
+ VERSION 3.2.1)
install(
FILES "${CMAKE_CURRENT_BINARY_DIR}/cmake/MbedTLSConfig.cmake"
diff --git a/ChangeLog b/ChangeLog
index 6b1bb21..6dfb23f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
Mbed TLS ChangeLog (Sorted per branch, date)
+= Mbed TLS 3.2.1 branch released 2022-07-12
+
+Bugfix
+ * Re-add missing generated file library/ssl_debug_helpers_generated.c
+
= Mbed TLS 3.2.0 branch released 2022-07-11
Default behavior changes
diff --git a/ChangeLog.d/bn_mul-fix-x86-pic-compilation-for-gcc-4.txt b/ChangeLog.d/bn_mul-fix-x86-pic-compilation-for-gcc-4.txt
new file mode 100644
index 0000000..1d59c22
--- /dev/null
+++ b/ChangeLog.d/bn_mul-fix-x86-pic-compilation-for-gcc-4.txt
@@ -0,0 +1,4 @@
+Bugfix
+ * Fix a long-standing build failure when building x86 PIC code with old
+ gcc (4.x). The code will be slower, but will compile. We do however
+ recommend upgrading to a more recent compiler instead. Fixes #1910.
diff --git a/ChangeLog.d/fix-aes-shallow-copying.txt b/ChangeLog.d/fix-aes-shallow-copying.txt
new file mode 100644
index 0000000..0c119d6
--- /dev/null
+++ b/ChangeLog.d/fix-aes-shallow-copying.txt
@@ -0,0 +1,2 @@
+Bugfix
+ * Refactor mbedtls_aes_context to support shallow-copying. Fixes #2147.
diff --git a/ChangeLog.d/fix_cmake_gen_files b/ChangeLog.d/fix_cmake_gen_files
new file mode 100644
index 0000000..3b2c099
--- /dev/null
+++ b/ChangeLog.d/fix_cmake_gen_files
@@ -0,0 +1,3 @@
+Bugfix
+ * Fix an issue in releases with GEN_FILES turned off whereby missing
+ generated files could be turned into symlinks to themselves.
diff --git a/doxygen/input/doc_mainpage.h b/doxygen/input/doc_mainpage.h
index 282e9bf..c05042b 100644
--- a/doxygen/input/doc_mainpage.h
+++ b/doxygen/input/doc_mainpage.h
@@ -22,7 +22,7 @@
*/
/**
- * @mainpage mbed TLS v3.2.0 source code documentation
+ * @mainpage mbed TLS v3.2.1 source code documentation
*
* This documentation describes the internal structure of mbed TLS. It was
* automatically generated from specially formatted comment blocks in
diff --git a/doxygen/mbedtls.doxyfile b/doxygen/mbedtls.doxyfile
index 653babc..f722d28 100644
--- a/doxygen/mbedtls.doxyfile
+++ b/doxygen/mbedtls.doxyfile
@@ -1,4 +1,4 @@
-PROJECT_NAME = "mbed TLS v3.2.0"
+PROJECT_NAME = "mbed TLS v3.2.1"
OUTPUT_DIRECTORY = ../apidoc/
FULL_PATH_NAMES = NO
OPTIMIZE_OUTPUT_FOR_C = YES
diff --git a/include/mbedtls/aes.h b/include/mbedtls/aes.h
index 144bd89..c359011 100644
--- a/include/mbedtls/aes.h
+++ b/include/mbedtls/aes.h
@@ -80,7 +80,8 @@
typedef struct mbedtls_aes_context
{
int MBEDTLS_PRIVATE(nr); /*!< The number of rounds. */
- uint32_t *MBEDTLS_PRIVATE(rk); /*!< AES round keys. */
+ size_t MBEDTLS_PRIVATE(rk_offset); /*!< The offset in array elements to AES
+ round keys in the buffer. */
uint32_t MBEDTLS_PRIVATE(buf)[68]; /*!< Unaligned data buffer. This buffer can
hold 32 extra Bytes, which can be used for
one of the following purposes:
diff --git a/include/mbedtls/build_info.h b/include/mbedtls/build_info.h
index 75545f2..234debd 100644
--- a/include/mbedtls/build_info.h
+++ b/include/mbedtls/build_info.h
@@ -38,16 +38,16 @@
*/
#define MBEDTLS_VERSION_MAJOR 3
#define MBEDTLS_VERSION_MINOR 2
-#define MBEDTLS_VERSION_PATCH 0
+#define MBEDTLS_VERSION_PATCH 1
/**
* The single version number has the following structure:
* MMNNPP00
* Major version | Minor version | Patch version
*/
-#define MBEDTLS_VERSION_NUMBER 0x03020000
-#define MBEDTLS_VERSION_STRING "3.2.0"
-#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 3.2.0"
+#define MBEDTLS_VERSION_NUMBER 0x03020100
+#define MBEDTLS_VERSION_STRING "3.2.1"
+#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 3.2.1"
#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
#define _CRT_SECURE_NO_DEPRECATE 1
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index badd14c..55fca55 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -850,6 +850,11 @@
#error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites"
#endif
+#if defined(MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH) && \
+ MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH >= 256
+#error "MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH must be less than 256"
+#endif
+
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
!defined(MBEDTLS_X509_CRT_PARSE_C)
#error "MBEDTLS_SSL_SERVER_NAME_INDICATION defined, but not all prerequisites"
diff --git a/include/mbedtls/mbedtls_config.h b/include/mbedtls/mbedtls_config.h
index 31523db..e0e0453 100644
--- a/include/mbedtls/mbedtls_config.h
+++ b/include/mbedtls/mbedtls_config.h
@@ -1542,6 +1542,15 @@
//#define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
/**
+ * \def MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH
+ *
+ * Size in bytes of a ticket nonce. This is not used in TLS 1.2.
+ *
+ * This must be less than 256.
+ */
+#define MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH 32
+
+/**
* \def MBEDTLS_SSL_PROTO_DTLS
*
* Enable support for DTLS (all available versions).
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index b3b5d47..5099cfb 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -98,6 +98,8 @@
/* Error space gap */
/** Processing of the Certificate handshake message failed. */
#define MBEDTLS_ERR_SSL_BAD_CERTIFICATE -0x7A00
+/** Received NewSessionTicket Post Handshake Message */
+#define MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET -0x7B00
/* Error space gap */
/* Error space gap */
/* Error space gap */
@@ -170,6 +172,15 @@
#define MBEDTLS_ERR_SSL_BAD_CONFIG -0x5E80
/*
+ * Constants from RFC 8446 for TLS 1.3 PSK modes
+ *
+ * Those are used in the Pre-Shared Key Exchange Modes extension.
+ * See Section 4.2.9 in RFC 8446.
+ */
+#define MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE 0 /* Pure PSK-based exchange */
+#define MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE 1 /* PSK+ECDHE-based exchange */
+
+/*
* TLS 1.3 NamedGroup values
*
* From RF 8446
@@ -239,12 +250,14 @@
( MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL | \
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL ) /*!< All ephemeral TLS 1.3 key exchanges */
+#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE ( 0 )
+
/*
* Various constants
*/
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
-/* These are the high an low bytes of ProtocolVersion as defined by:
+/* These are the high and low bytes of ProtocolVersion as defined by:
* - RFC 5246: ProtocolVersion version = { 3, 3 }; // TLS v1.2
* - RFC 8446: see section 4.2.1
*/
@@ -324,6 +337,13 @@
#define MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT 1
#define MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER 0
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
+#if defined(MBEDTLS_SHA384_C)
+#define MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN 48
+#elif defined(MBEDTLS_SHA256_C)
+#define MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN 32
+#endif /* MBEDTLS_SHA256_C */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */
/*
* Default range for DTLS retransmission timer value, in milliseconds.
* RFC 6347 4.2.4.1 says from 1 second to 60 seconds.
@@ -640,7 +660,7 @@
MBEDTLS_SSL_FLUSH_BUFFERS,
MBEDTLS_SSL_HANDSHAKE_WRAPUP,
MBEDTLS_SSL_HANDSHAKE_OVER,
- MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET,
+ MBEDTLS_SSL_NEW_SESSION_TICKET,
MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT,
MBEDTLS_SSL_HELLO_RETRY_REQUEST,
MBEDTLS_SSL_ENCRYPTED_EXTENSIONS,
@@ -649,6 +669,7 @@
MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO,
MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO,
MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST,
+ MBEDTLS_SSL_NEW_SESSION_TICKET_FLUSH,
}
mbedtls_ssl_states;
@@ -1162,6 +1183,19 @@
uint32_t MBEDTLS_PRIVATE(ticket_lifetime); /*!< ticket lifetime hint */
#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
+ uint8_t MBEDTLS_PRIVATE(endpoint); /*!< 0: client, 1: server */
+ uint8_t MBEDTLS_PRIVATE(ticket_flags); /*!< Ticket flags */
+ uint32_t MBEDTLS_PRIVATE(ticket_age_add); /*!< Randomly generated value used to obscure the age of the ticket */
+ uint8_t MBEDTLS_PRIVATE(resumption_key_len); /*!< resumption_key length */
+ unsigned char MBEDTLS_PRIVATE(resumption_key)[MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN];
+
+#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_CLI_C)
+ mbedtls_time_t MBEDTLS_PRIVATE(ticket_received); /*!< time ticket was received */
+#endif /* MBEDTLS_HAVE_TIME && MBEDTLS_SSL_CLI_C */
+
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */
+
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
int MBEDTLS_PRIVATE(encrypt_then_mac); /*!< flag for EtM activation */
#endif
diff --git a/include/psa/crypto_values.h b/include/psa/crypto_values.h
index b3526ae..b5f6501 100644
--- a/include/psa/crypto_values.h
+++ b/include/psa/crypto_values.h
@@ -1400,9 +1400,11 @@
* This is the signature scheme defined by RFC 8017
* (PKCS#1: RSA Cryptography Specifications) under the name
* RSASSA-PSS, with the message generation function MGF1, and with
- * a salt length equal to the length of the hash. The specified
- * hash algorithm is used to hash the input message, to create the
- * salted hash, and for the mask generation.
+ * a salt length equal to the length of the hash, or the largest
+ * possible salt length for the algorithm and key size if that is
+ * smaller than the hash length. The specified hash algorithm is
+ * used to hash the input message, to create the salted hash, and
+ * for the mask generation.
*
* \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that
* #PSA_ALG_IS_HASH(\p hash_alg) is true).
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index be6aecf..ed58a9e 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -275,7 +275,7 @@
if(USE_SHARED_MBEDTLS_LIBRARY)
set(CMAKE_LIBRARY_PATH ${CMAKE_CURRENT_BINARY_DIR})
add_library(${mbedcrypto_target} SHARED ${src_crypto})
- set_target_properties(${mbedcrypto_target} PROPERTIES VERSION 3.2.0 SOVERSION 12)
+ set_target_properties(${mbedcrypto_target} PROPERTIES VERSION 3.2.1 SOVERSION 12)
target_link_libraries(${mbedcrypto_target} PUBLIC ${libs})
if(TARGET everest)
@@ -283,11 +283,11 @@
endif()
add_library(${mbedx509_target} SHARED ${src_x509})
- set_target_properties(${mbedx509_target} PROPERTIES VERSION 3.2.0 SOVERSION 4)
+ set_target_properties(${mbedx509_target} PROPERTIES VERSION 3.2.1 SOVERSION 4)
target_link_libraries(${mbedx509_target} PUBLIC ${libs} ${mbedcrypto_target})
add_library(${mbedtls_target} SHARED ${src_tls})
- set_target_properties(${mbedtls_target} PROPERTIES VERSION 3.2.0 SOVERSION 18)
+ set_target_properties(${mbedtls_target} PROPERTIES VERSION 3.2.1 SOVERSION 18)
target_link_libraries(${mbedtls_target} PUBLIC ${libs} ${mbedx509_target})
endif(USE_SHARED_MBEDTLS_LIBRARY)
diff --git a/library/aes.c b/library/aes.c
index bf5d432..ca94e0a 100644
--- a/library/aes.c
+++ b/library/aes.c
@@ -550,19 +550,19 @@
}
#endif
+ ctx->rk_offset = 0;
#if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
if( aes_padlock_ace == -1 )
aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
if( aes_padlock_ace )
- ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
- else
+ ctx->rk_offset = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ) - ctx->buf;
#endif
- ctx->rk = RK = ctx->buf;
+ RK = ctx->buf + ctx->rk_offset;
#if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
- return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) );
+ return( mbedtls_aesni_setkey_enc( (unsigned char *) RK, key, keybits ) );
#endif
for( i = 0; i < ( keybits >> 5 ); i++ )
@@ -654,15 +654,15 @@
mbedtls_aes_init( &cty );
+ ctx->rk_offset = 0;
#if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
if( aes_padlock_ace == -1 )
aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
if( aes_padlock_ace )
- ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
- else
+ ctx->rk_offset = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ) - ctx->buf;
#endif
- ctx->rk = RK = ctx->buf;
+ RK = ctx->buf + ctx->rk_offset;
/* Also checks keybits */
if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 )
@@ -673,13 +673,13 @@
#if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
{
- mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk,
- (const unsigned char *) cty.rk, ctx->nr );
+ mbedtls_aesni_inverse_key( (unsigned char *) RK,
+ (const unsigned char *) ( cty.buf + cty.rk_offset ), ctx->nr );
goto exit;
}
#endif
- SK = cty.rk + cty.nr * 4;
+ SK = cty.buf + cty.rk_offset + cty.nr * 4;
*RK++ = *SK++;
*RK++ = *SK++;
@@ -843,7 +843,7 @@
unsigned char output[16] )
{
int i;
- uint32_t *RK = ctx->rk;
+ uint32_t *RK = ctx->buf + ctx->rk_offset;
struct
{
uint32_t X[4];
@@ -907,7 +907,7 @@
unsigned char output[16] )
{
int i;
- uint32_t *RK = ctx->rk;
+ uint32_t *RK = ctx->buf + ctx->rk_offset;
struct
{
uint32_t X[4];
@@ -971,7 +971,6 @@
unsigned char output[16] )
{
AES_VALIDATE_RET( ctx != NULL );
- AES_VALIDATE_RET( ctx->rk != NULL );
AES_VALIDATE_RET( input != NULL );
AES_VALIDATE_RET( output != NULL );
AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
diff --git a/library/aesni.c b/library/aesni.c
index be226c9..87d818a 100644
--- a/library/aesni.c
+++ b/library/aesni.c
@@ -127,7 +127,7 @@
"3: \n\t"
"movdqu %%xmm0, (%4) \n\t" // export output
:
- : "r" (ctx->nr), "r" (ctx->rk), "r" (mode), "r" (input), "r" (output)
+ : "r" (ctx->nr), "r" (ctx->buf + ctx->rk_offset), "r" (mode), "r" (input), "r" (output)
: "memory", "cc", "xmm0", "xmm1" );
diff --git a/library/bn_mul.h b/library/bn_mul.h
index 962d7a9..831e1d7 100644
--- a/library/bn_mul.h
+++ b/library/bn_mul.h
@@ -91,12 +91,28 @@
( !defined(__ARMCC_VERSION) || __ARMCC_VERSION >= 6000000 )
/*
+ * GCC < 5.0 treated the x86 ebx (which is used for the GOT) as a
+ * fixed reserved register when building as PIC, leading to errors
+ * like: bn_mul.h:46:13: error: PIC register clobbered by 'ebx' in 'asm'
+ *
+ * This is fixed by an improved register allocator in GCC 5+. From the
+ * release notes:
+ * Register allocation improvements: Reuse of the PIC hard register,
+ * instead of using a fixed register, was implemented on x86/x86-64
+ * targets. This improves generated PIC code performance as more hard
+ * registers can be used.
+ */
+#if defined(__GNUC__) && __GNUC__ < 5 && defined(__PIC__)
+#define MULADDC_CANNOT_USE_EBX
+#endif
+
+/*
* Disable use of the i386 assembly code below if option -O0, to disable all
* compiler optimisations, is passed, detected with __OPTIMIZE__
* This is done as the number of registers used in the assembly code doesn't
* work with the -O0 option.
*/
-#if defined(__i386__) && defined(__OPTIMIZE__)
+#if defined(__i386__) && defined(__OPTIMIZE__) && !defined(MULADDC_CANNOT_USE_EBX)
#define MULADDC_X1_INIT \
{ mbedtls_mpi_uint t; \
diff --git a/library/padlock.c b/library/padlock.c
index b8ba105..a128775 100644
--- a/library/padlock.c
+++ b/library/padlock.c
@@ -82,7 +82,11 @@
uint32_t *ctrl;
unsigned char buf[256];
- rk = ctx->rk;
+ rk = ctx->buf + ctx->rk_offset;
+
+ if( ( (long) rk & 15 ) != 0 )
+ return( MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED );
+
blk = MBEDTLS_PADLOCK_ALIGN16( buf );
memcpy( blk, input, 16 );
@@ -125,11 +129,13 @@
uint32_t *ctrl;
unsigned char buf[256];
+ rk = ctx->buf + ctx->rk_offset;
+
if( ( (long) input & 15 ) != 0 ||
- ( (long) output & 15 ) != 0 )
+ ( (long) output & 15 ) != 0 ||
+ ( (long) rk & 15 ) != 0 )
return( MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED );
- rk = ctx->rk;
iw = MBEDTLS_PADLOCK_ALIGN16( buf );
memcpy( iw, iv, 16 );
diff --git a/library/ssl_client.c b/library/ssl_client.c
index 20f1aff..e7453d5 100644
--- a/library/ssl_client.c
+++ b/library/ssl_client.c
@@ -432,7 +432,8 @@
static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
unsigned char *buf,
unsigned char *end,
- size_t *out_len )
+ size_t *out_len,
+ size_t *binders_len )
{
int ret;
mbedtls_ssl_handshake_params *handshake = ssl->handshake;
@@ -443,6 +444,7 @@
int tls12_uses_ec = 0;
*out_len = 0;
+ *binders_len = 0;
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
unsigned char propose_tls12 =
@@ -641,6 +643,21 @@
}
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ /* The "pre_shared_key" extension (RFC 8446 Section 4.2.11)
+ * MUST be the last extension in the ClientHello.
+ */
+ if( propose_tls13 && mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) )
+ {
+ ret = mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(
+ ssl, p, end, &output_len, binders_len );
+ if( ret != 0 )
+ return( ret );
+ p += output_len;
+ }
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
/* Write the length of the list of extensions. */
extensions_len = p - p_extensions_len - 2;
@@ -837,7 +854,7 @@
{
int ret = 0;
unsigned char *buf;
- size_t buf_len, msg_len;
+ size_t buf_len, msg_len, binders_len;
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
@@ -849,7 +866,8 @@
MBEDTLS_SSL_PROC_CHK( ssl_write_client_hello_body( ssl, buf,
buf + buf_len,
- &msg_len ) );
+ &msg_len,
+ &binders_len ) );
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS)
if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
@@ -883,8 +901,22 @@
else
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */
{
- mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
- buf, msg_len );
+
+ mbedtls_ssl_add_hs_hdr_to_checksum( ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
+ msg_len );
+ ssl->handshake->update_checksum( ssl, buf, msg_len - binders_len );
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
+ defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ if( binders_len > 0 )
+ {
+ MBEDTLS_SSL_PROC_CHK(
+ mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
+ ssl, buf + msg_len - binders_len, buf + msg_len ) );
+ ssl->handshake->update_checksum( ssl, buf + msg_len - binders_len,
+ binders_len );
+ }
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg( ssl,
buf_len,
msg_len ) );
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index 4b6e03a..88ba65d 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -612,14 +612,19 @@
* Handshake specific crypto variables
*/
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
- int tls13_kex_modes; /*!< key exchange modes for TLS 1.3 */
+ uint8_t key_exchange_mode; /*!< Selected key exchange mode */
/** Number of HelloRetryRequest messages received/sent from/to the server. */
int hello_retry_request_count;
+
#if defined(MBEDTLS_SSL_SRV_C)
/** selected_group of key_share extension in HelloRetryRequest message. */
uint16_t hrr_selected_group;
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ uint8_t tls13_kex_modes; /*!< Key exchange modes supported by the client */
+#endif
#endif /* MBEDTLS_SSL_SRV_C */
+
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
@@ -676,6 +681,7 @@
unsigned char *psk; /*!< PSK from the callback */
size_t psk_len; /*!< Length of PSK from callback */
#endif /* MBEDTLS_USE_PSA_CRYPTO */
+ uint16_t selected_identity;
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
@@ -1345,6 +1351,10 @@
unsigned char const *msg,
size_t msg_len );
+void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
+ unsigned hs_type,
+ size_t total_hs_len );
+
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
#if !defined(MBEDTLS_USE_PSA_CRYPTO)
MBEDTLS_CHECK_RETURN_CRITICAL
@@ -1770,6 +1780,7 @@
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL ) );
}
+#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
/**
* Given a list of key exchange modes, check if at least one of them is
* supported.
@@ -1816,6 +1827,30 @@
return( ! mbedtls_ssl_tls13_check_kex_modes( ssl,
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL ) );
}
+#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
+/*
+ * Helper functions to check the selected key exchange mode.
+ */
+static inline int mbedtls_ssl_tls13_key_exchange_mode_check(
+ mbedtls_ssl_context *ssl, int kex_mask )
+{
+ return( ( ssl->handshake->key_exchange_mode & kex_mask ) != 0 );
+}
+
+static inline int mbedtls_ssl_tls13_key_exchange_mode_with_psk(
+ mbedtls_ssl_context *ssl )
+{
+ return( mbedtls_ssl_tls13_key_exchange_mode_check( ssl,
+ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL ) );
+}
+
+static inline int mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(
+ mbedtls_ssl_context *ssl )
+{
+ return( mbedtls_ssl_tls13_key_exchange_mode_check( ssl,
+ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL ) );
+}
/*
* Fetch TLS 1.3 handshake message header
@@ -2420,4 +2455,49 @@
unsigned char *obuf, size_t buf_len, size_t *olen );
#endif
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+/* Check if we have any PSK to offer, returns 0 if PSK is available.
+ * Assign the psk and ticket if pointers are present.
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+int mbedtls_ssl_get_psk_to_offer(
+ const mbedtls_ssl_context *ssl,
+ int *psk_type,
+ const unsigned char **psk, size_t *psk_len,
+ const unsigned char **psk_identity, size_t *psk_identity_len );
+
+/**
+ * \brief Given an SSL context and its associated configuration, write the TLS
+ * 1.3 specific Pre-Shared key extension.
+ *
+ * \param[in] ssl SSL context
+ * \param[in] buf Base address of the buffer where to write the extension
+ * \param[in] end End address of the buffer where to write the extension
+ * \param[out] out_len Length in bytes of the Pre-Shared key extension: data
+ * written into the buffer \p buf by this function plus
+ * the length of the binders to be written.
+ * \param[out] binders_len Length of the binders to be written at the end of
+ * the extension.
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+int mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(
+ mbedtls_ssl_context *ssl,
+ unsigned char *buf, unsigned char *end,
+ size_t *out_len, size_t *binders_len );
+
+/**
+ * \brief Given an SSL context and its associated configuration, write the TLS
+ * 1.3 specific Pre-Shared key extension binders at the end of the
+ * ClientHello.
+ *
+ * \param[in] ssl SSL context
+ * \param[in] buf Base address of the buffer where to write the binders
+ * \param[in] end End address of the buffer where to write the binders
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+int mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
+ mbedtls_ssl_context *ssl,
+ unsigned char *buf, unsigned char *end );
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
#endif /* ssl_misc.h */
diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index fb0b709..dbef29b 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -5288,6 +5288,50 @@
}
#endif /* MBEDTLS_SSL_RENEGOTIATION */
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_check_new_session_ticket( mbedtls_ssl_context *ssl )
+{
+
+ if( ( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) ) ||
+ ( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET ) )
+ {
+ return( 0 );
+ }
+
+ ssl->keep_current_message = 1;
+
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "NewSessionTicket received" ) );
+ mbedtls_ssl_handshake_set_state( ssl,
+ MBEDTLS_SSL_NEW_SESSION_TICKET );
+
+ return( MBEDTLS_ERR_SSL_WANT_READ );
+}
+#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_handle_hs_message_post_handshake( mbedtls_ssl_context *ssl )
+{
+
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "received post-handshake message" ) );
+
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ {
+ int ret = ssl_tls13_check_new_session_ticket( ssl );
+ if( ret != 0 )
+ return( ret );
+ }
+#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
+
+ /* Fail in all other cases. */
+ return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+}
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
/* This function is called from mbedtls_ssl_read() when a handshake message is
* received after the initial handshake. In this context, handshake messages
* may only be sent for the purpose of initiating renegotiations.
@@ -5298,7 +5342,7 @@
* TLS 1.3 in the future without bloating the logic of mbedtls_ssl_read().
*/
MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_handle_hs_message_post_handshake( mbedtls_ssl_context *ssl )
+static int ssl_tls12_handle_hs_message_post_handshake( mbedtls_ssl_context *ssl )
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
@@ -5380,18 +5424,39 @@
MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
-#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
if( ( ret = mbedtls_ssl_send_alert_message( ssl,
MBEDTLS_SSL_ALERT_LEVEL_WARNING,
MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
{
return( ret );
}
-#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
}
return( 0 );
}
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_handle_hs_message_post_handshake( mbedtls_ssl_context *ssl )
+{
+ /* Check protocol version and dispatch accordingly. */
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
+ {
+ return( ssl_tls13_handle_hs_message_post_handshake( ssl ) );
+ }
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+ if( ssl->tls_version <= MBEDTLS_SSL_VERSION_TLS1_2 )
+ {
+ return( ssl_tls12_handle_hs_message_post_handshake( ssl ) );
+ }
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
+
+ /* Should never happen */
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+}
/*
* Receive application data decrypted from the SSL layer
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index a055a45..76b31ef 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -440,11 +440,12 @@
static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
#endif /* MBEDTLS_SHA384_C */
-static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
+static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
unsigned char *buf,
size_t buf_len );
+
MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_session_load_tls12( mbedtls_ssl_session *session,
+static int ssl_tls12_session_load( mbedtls_ssl_session *session,
const unsigned char *buf,
size_t len );
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
@@ -532,9 +533,9 @@
}
}
-static void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
- unsigned hs_type,
- size_t total_hs_len )
+void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
+ unsigned hs_type,
+ size_t total_hs_len )
{
unsigned char hs_hdr[4];
@@ -1710,7 +1711,12 @@
else
alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ psa_set_key_usage_flags( &key_attributes,
+ PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_EXPORT );
+#else
psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
+#endif
psa_set_key_algorithm( &key_attributes, alg );
psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
@@ -1885,6 +1891,193 @@
}
#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+/* Serialization of TLS 1.3 sessions:
+ *
+ * struct {
+ * uint64 ticket_received;
+ * uint32 ticket_lifetime;
+ * opaque ticket<0..2^16>;
+ * } ClientOnlyData;
+ *
+ * struct {
+ * uint8 endpoint;
+ * uint8 ciphersuite[2];
+ * uint32 ticket_age_add;
+ * uint8 ticket_flags;
+ * opaque resumption_key<0..255>;
+ * select ( endpoint ) {
+ * case client: ClientOnlyData;
+ * case server: uint64 start_time;
+ * };
+ * } serialized_session_tls13;
+ *
+ */
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+static size_t ssl_tls13_session_save( const mbedtls_ssl_session *session,
+ unsigned char *buf,
+ size_t buf_len )
+{
+ unsigned char *p = buf;
+ size_t needed = 1 /* endpoint */
+ + 2 /* ciphersuite */
+ + 4 /* ticket_age_add */
+ + 2 /* resumption_key length */
+ + session->resumption_key_len; /* resumption_key */
+
+#if defined(MBEDTLS_HAVE_TIME)
+ needed += 8; /* start_time or ticket_received */
+#endif
+
+#if defined(MBEDTLS_SSL_CLI_C)
+ if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ {
+ needed += 4 /* ticket_lifetime */
+ + 2 /* ticket_len */
+ + session->ticket_len; /* ticket */
+ }
+#endif /* MBEDTLS_SSL_CLI_C */
+
+ if( needed > buf_len )
+ return( needed );
+
+ p[0] = session->endpoint;
+ MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 1 );
+ MBEDTLS_PUT_UINT32_BE( session->ticket_age_add, p, 3 );
+ p[7] = session->ticket_flags;
+
+ /* save resumption_key */
+ p[8] = session->resumption_key_len;
+ p += 9;
+ memcpy( p, session->resumption_key, session->resumption_key_len );
+ p += session->resumption_key_len;
+
+#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
+ if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
+ {
+ MBEDTLS_PUT_UINT64_BE( (uint64_t) session->start, p, 0 );
+ p += 8;
+ }
+#endif /* MBEDTLS_HAVE_TIME */
+
+#if defined(MBEDTLS_SSL_CLI_C)
+ if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ {
+#if defined(MBEDTLS_HAVE_TIME)
+ MBEDTLS_PUT_UINT64_BE( (uint64_t) session->ticket_received, p, 0 );
+ p += 8;
+#endif
+ MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
+ p += 4;
+
+ MBEDTLS_PUT_UINT16_BE( session->ticket_len, p, 0 );
+ p += 2;
+ if( session->ticket_len > 0 )
+ {
+ memcpy( p, session->ticket, session->ticket_len );
+ p += session->ticket_len;
+ }
+ }
+#endif /* MBEDTLS_SSL_CLI_C */
+ return( needed );
+}
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_session_load( mbedtls_ssl_session *session,
+ const unsigned char *buf,
+ size_t len )
+{
+ const unsigned char *p = buf;
+ const unsigned char *end = buf + len;
+
+ if( end - p < 9 )
+ return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+ session->endpoint = p[0];
+ session->ciphersuite = MBEDTLS_GET_UINT16_BE( p, 1 );
+ session->ticket_age_add = MBEDTLS_GET_UINT32_BE( p, 3 );
+ session->ticket_flags = p[7];
+
+ /* load resumption_key */
+ session->resumption_key_len = p[8];
+ p += 9;
+
+ if( end - p < session->resumption_key_len )
+ return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+
+ if( sizeof( session->resumption_key ) < session->resumption_key_len )
+ return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+ memcpy( session->resumption_key, p, session->resumption_key_len );
+ p += session->resumption_key_len;
+
+#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
+ if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
+ {
+ if( end - p < 8 )
+ return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+ session->start = MBEDTLS_GET_UINT64_BE( p, 0 );
+ p += 8;
+ }
+#endif /* MBEDTLS_HAVE_TIME */
+
+#if defined(MBEDTLS_SSL_CLI_C)
+ if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ {
+#if defined(MBEDTLS_HAVE_TIME)
+ if( end - p < 8 )
+ return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+ session->ticket_received = MBEDTLS_GET_UINT64_BE( p, 0 );
+ p += 8;
+#endif
+ if( end - p < 4 )
+ return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+ session->ticket_lifetime = MBEDTLS_GET_UINT32_BE( p, 0 );
+ p += 4;
+
+ if( end - p < 2 )
+ return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+ session->ticket_len = MBEDTLS_GET_UINT16_BE( p, 0 );
+ p += 2;
+
+ if( end - p < ( long int )session->ticket_len )
+ return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+ if( session->ticket_len > 0 )
+ {
+ session->ticket = mbedtls_calloc( 1, session->ticket_len );
+ if( session->ticket == NULL )
+ return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+ memcpy( session->ticket, p, session->ticket_len );
+ p += session->ticket_len;
+ }
+ }
+#endif /* MBEDTLS_SSL_CLI_C */
+
+ return( 0 );
+
+}
+#else /* MBEDTLS_SSL_SESSION_TICKETS */
+static size_t ssl_tls13_session_save( const mbedtls_ssl_session *session,
+ unsigned char *buf,
+ size_t buf_len )
+{
+ ((void) session);
+ ((void) buf);
+ ((void) buf_len);
+ return( 0 );
+}
+
+static int ssl_tls13_session_load( const mbedtls_ssl_session *session,
+ unsigned char *buf,
+ size_t buf_len )
+{
+ ((void) session);
+ ((void) buf);
+ ((void) buf_len);
+ return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+}
+#endif /* !MBEDTLS_SSL_SESSION_TICKETS */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
size_t taglen,
psa_algorithm_t *alg,
@@ -2811,13 +3004,16 @@
{
unsigned char *p = buf;
size_t used = 0;
+ size_t remaining_len;
+
+ if( session == NULL )
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
if( !omit_header )
{
/*
* Add Mbed TLS version identifier
*/
-
used += sizeof( ssl_serialized_session_header );
if( used <= buf_len )
@@ -2838,17 +3034,21 @@
}
/* Forward to version-specific serialization routine. */
+ remaining_len = (buf_len >= used) ? buf_len - used : 0;
switch( session->tls_version )
{
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
case MBEDTLS_SSL_VERSION_TLS1_2:
- {
- size_t remaining_len = used <= buf_len ? buf_len - used : 0;
- used += ssl_session_save_tls12( session, p, remaining_len );
+ used += ssl_tls12_session_save( session, p, remaining_len );
break;
- }
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ case MBEDTLS_SSL_VERSION_TLS1_3:
+ used += ssl_tls13_session_save( session, p, remaining_len );
+ break;
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
default:
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
}
@@ -2885,6 +3085,11 @@
{
const unsigned char *p = buf;
const unsigned char * const end = buf + len;
+ size_t remaining_len;
+
+
+ if( session == NULL )
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
if( !omit_header )
{
@@ -2911,16 +3116,19 @@
session->tls_version = 0x0300 | *p++;
/* Dispatch according to TLS version. */
+ remaining_len = ( end - p );
switch( session->tls_version )
{
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
case MBEDTLS_SSL_VERSION_TLS1_2:
- {
- size_t remaining_len = ( end - p );
- return( ssl_session_load_tls12( session, p, remaining_len ) );
- }
+ return( ssl_tls12_session_load( session, p, remaining_len ) );
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ case MBEDTLS_SSL_VERSION_TLS1_3:
+ return( ssl_tls13_session_load( session, p, remaining_len ) );
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
default:
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
@@ -7803,7 +8011,7 @@
* } serialized_session_tls12;
*
*/
-static size_t ssl_session_save_tls12( const mbedtls_ssl_session *session,
+static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
unsigned char *buf,
size_t buf_len )
{
@@ -7955,7 +8163,7 @@
}
MBEDTLS_CHECK_RETURN_CRITICAL
-static int ssl_session_load_tls12( mbedtls_ssl_session *session,
+static int ssl_tls12_session_load( mbedtls_ssl_session *session,
const unsigned char *buf,
size_t len )
{
diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c
index 7fa6443..2405208 100644
--- a/library/ssl_tls12_client.c
+++ b/library/ssl_tls12_client.c
@@ -3627,7 +3627,7 @@
if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
ssl->handshake->new_session_ticket != 0 )
{
- ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
+ ssl->state = MBEDTLS_SSL_NEW_SESSION_TICKET;
}
#endif
@@ -3704,7 +3704,7 @@
* Finished
*/
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
- case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
+ case MBEDTLS_SSL_NEW_SESSION_TICKET:
ret = ssl_parse_new_session_ticket( ssl );
break;
#endif
diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index 2b68306..91c2058 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -595,6 +595,289 @@
return( 0 );
}
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+/*
+ * ssl_tls13_write_psk_key_exchange_modes_ext() structure:
+ *
+ * enum { psk_ke( 0 ), psk_dhe_ke( 1 ), ( 255 ) } PskKeyExchangeMode;
+ *
+ * struct {
+ * PskKeyExchangeMode ke_modes<1..255>;
+ * } PskKeyExchangeModes;
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_write_psk_key_exchange_modes_ext( mbedtls_ssl_context *ssl,
+ unsigned char *buf,
+ unsigned char *end,
+ size_t *out_len )
+{
+ unsigned char *p = buf;
+ int ke_modes_len = 0;
+
+ ((void) ke_modes_len );
+ *out_len = 0;
+
+ /* Skip writing extension if no PSK key exchange mode
+ * is enabled in the config.
+ */
+ if( !mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip psk_key_exchange_modes extension" ) );
+ return( 0 );
+ }
+
+ /* Require 7 bytes of data, otherwise fail,
+ * even if extension might be shorter.
+ */
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 );
+ MBEDTLS_SSL_DEBUG_MSG(
+ 3, ( "client hello, adding psk_key_exchange_modes extension" ) );
+
+ MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES, p, 0 );
+
+ /* Skip extension length (2 bytes) and
+ * ke_modes length (1 byte) for now.
+ */
+ p += 5;
+
+ if( mbedtls_ssl_conf_tls13_psk_enabled( ssl ) )
+ {
+ *p++ = MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE;
+ ke_modes_len++;
+
+ MBEDTLS_SSL_DEBUG_MSG( 4, ( "Adding pure PSK key exchange mode" ) );
+ }
+
+ if( mbedtls_ssl_conf_tls13_psk_ephemeral_enabled( ssl ) )
+ {
+ *p++ = MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE;
+ ke_modes_len++;
+
+ MBEDTLS_SSL_DEBUG_MSG( 4, ( "Adding PSK-ECDHE key exchange mode" ) );
+ }
+
+ /* Now write the extension and ke_modes length */
+ MBEDTLS_PUT_UINT16_BE( ke_modes_len + 1, buf, 2 );
+ buf[4] = ke_modes_len;
+
+ *out_len = p - buf;
+ ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES;
+ return ( 0 );
+}
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
+/*
+ * mbedtls_ssl_tls13_write_pre_shared_key_ext() structure:
+ *
+ * struct {
+ * opaque identity<1..2^16-1>;
+ * uint32 obfuscated_ticket_age;
+ * } PskIdentity;
+ *
+ * opaque PskBinderEntry<32..255>;
+ *
+ * struct {
+ * PskIdentity identities<7..2^16-1>;
+ * PskBinderEntry binders<33..2^16-1>;
+ * } OfferedPsks;
+ *
+ * struct {
+ * select (Handshake.msg_type) {
+ * case client_hello: OfferedPsks;
+ * ...
+ * };
+ * } PreSharedKeyExtension;
+ *
+ */
+
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+
+int mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(
+ mbedtls_ssl_context *ssl,
+ unsigned char *buf, unsigned char *end,
+ size_t *out_len, size_t *binders_len )
+{
+ unsigned char *p = buf;
+ const unsigned char *psk;
+ size_t psk_len;
+ const unsigned char *psk_identity;
+ size_t psk_identity_len;
+ int psk_type;
+ const mbedtls_ssl_ciphersuite_t *ciphersuite_info = NULL;
+ const int *ciphersuites;
+ psa_algorithm_t psa_hash_alg;
+ int hash_len = 0;
+ size_t identities_len, l_binders_len;
+ uint32_t obfuscated_ticket_age = 0;
+
+ *out_len = 0;
+ *binders_len = 0;
+
+ /* Check if we have any PSKs to offer. If so, return the first.
+ *
+ * NOTE: Ultimately, we want to be able to offer multiple PSKs,
+ * in which case we want to iterate over them here.
+ *
+ * As it stands, however, we only ever offer one, chosen
+ * by the following heuristic:
+ * - If a ticket has been configured, offer the corresponding PSK.
+ * - If no ticket has been configured by an external PSK has been
+ * configured, offer that.
+ * - Otherwise, skip the PSK extension.
+ */
+
+ if( mbedtls_ssl_get_psk_to_offer( ssl, &psk_type, &psk, &psk_len,
+ &psk_identity, &psk_identity_len ) != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip pre_shared_key extensions" ) );
+ return( 0 );
+ }
+
+ if( psk_type == MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL )
+ {
+ /*
+ * Ciphersuite list
+ */
+ ciphersuites = ssl->conf->ciphersuite_list;
+ for( int i = 0; ciphersuites[i] != 0; i++ )
+ {
+ ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(
+ ciphersuites[i] );
+
+ if( mbedtls_ssl_validate_ciphersuite(
+ ssl, ciphersuite_info,
+ MBEDTLS_SSL_VERSION_TLS1_3,
+ MBEDTLS_SSL_VERSION_TLS1_3 ) != 0 )
+ continue;
+
+ /* In this implementation we only add one pre-shared-key
+ * extension.
+ */
+ ssl->session_negotiate->ciphersuite = ciphersuites[i];
+ break;
+ }
+ }
+
+ ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(
+ ssl->session_negotiate->ciphersuite );
+ /* No suitable ciphersuite for the PSK */
+ if( ciphersuite_info == NULL )
+ return( 0 );
+
+ psa_hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
+ hash_len = PSA_HASH_LENGTH( psa_hash_alg );
+ if( hash_len == -1 )
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+
+ /* Check if we have space to write the extension, binder included.
+ * - extension_type (2 bytes)
+ * - extension_data_len (2 bytes)
+ * - identities_len (2 bytes)
+ * - identity_len (2 bytes)
+ * - identity (psk_identity_len bytes)
+ * - obfuscated_ticket_age (4 bytes)
+ * - binders_len (2 bytes)
+ * - binder_len (1 byte)
+ * - binder (hash_len bytes)
+ */
+
+ identities_len = 6 + psk_identity_len;
+ l_binders_len = 1 + hash_len;
+
+ MBEDTLS_SSL_DEBUG_MSG( 3,
+ ( "client hello, adding pre_shared_key extension, "
+ "omitting PSK binder list" ) );
+
+ /* Extension header */
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, 8 );
+ MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_PRE_SHARED_KEY, p, 0 );
+ MBEDTLS_PUT_UINT16_BE( 2 + identities_len + 2 + l_binders_len , p, 2 );
+
+ MBEDTLS_PUT_UINT16_BE( identities_len, p, 4 );
+ MBEDTLS_PUT_UINT16_BE( psk_identity_len, p, 6 );
+ p += 8;
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, psk_identity_len );
+ memcpy( p, psk_identity, psk_identity_len );
+ p += psk_identity_len;
+
+ /* add obfuscated ticket age */
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
+ MBEDTLS_PUT_UINT32_BE( obfuscated_ticket_age, p, 0 );
+ p += 4;
+
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 + l_binders_len );
+ *out_len = ( p - buf ) + l_binders_len + 2;
+ *binders_len = l_binders_len + 2;
+
+ ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_PRE_SHARED_KEY;
+
+ return( 0 );
+}
+
+int mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
+ mbedtls_ssl_context *ssl,
+ unsigned char *buf, unsigned char *end )
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ unsigned char *p = buf;
+ const unsigned char *psk_identity;
+ size_t psk_identity_len;
+ const mbedtls_ssl_ciphersuite_t *ciphersuite_info = NULL;
+ psa_algorithm_t psa_hash_alg;
+ int hash_len = 0;
+ const unsigned char *psk = NULL;
+ size_t psk_len = 0;
+ int psk_type;
+ unsigned char transcript[MBEDTLS_MD_MAX_SIZE];
+ size_t transcript_len;
+
+ if( mbedtls_ssl_get_psk_to_offer( ssl, &psk_type, &psk, &psk_len,
+ &psk_identity, &psk_identity_len ) != 0 )
+ {
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+ }
+
+ ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(
+ ssl->session_negotiate->ciphersuite );
+ if( ciphersuite_info == NULL )
+ return( 0 );
+
+ psa_hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
+ hash_len = PSA_HASH_LENGTH( psa_hash_alg );
+ if( ( hash_len == -1 ) || ( ( end - buf ) != 3 + hash_len ) )
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding PSK binder list" ) );
+
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, 3 + hash_len );
+ /* 2 bytes length field for array of psk binders */
+ MBEDTLS_PUT_UINT16_BE( hash_len + 1, p, 0 );
+ p += 2;
+
+ /* 1 bytes length field for next psk binder */
+ *p++ = MBEDTLS_BYTE_0( hash_len );
+
+ /* Get current state of handshake transcript. */
+ ret = mbedtls_ssl_get_handshake_transcript( ssl, ciphersuite_info->mac,
+ transcript, sizeof( transcript ),
+ &transcript_len );
+ if( ret != 0 )
+ return( ret );
+
+ ret = mbedtls_ssl_tls13_create_psk_binder( ssl,
+ mbedtls_psa_translate_md( ciphersuite_info->mac ),
+ psk, psk_len, psk_type,
+ transcript, p );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_create_psk_binder", ret );
+ return( ret );
+ }
+
+ return( 0 );
+}
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
int mbedtls_ssl_tls13_write_client_hello_exts( mbedtls_ssl_context *ssl,
unsigned char *buf,
unsigned char *end,
@@ -631,6 +914,22 @@
p += ext_len;
}
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ /* For PSK-based key exchange we need the pre_shared_key extension
+ * and the psk_key_exchange_modes extension.
+ *
+ * The pre_shared_key extension MUST be the last extension in the
+ * ClientHello. Servers MUST check that it is the last extension and
+ * otherwise fail the handshake with an "illegal_parameter" alert.
+ *
+ * Add the psk_key_exchange_modes extension.
+ */
+ ret = ssl_tls13_write_psk_key_exchange_modes_ext( ssl, p, end, &ext_len );
+ if( ret != 0 )
+ return( ret );
+ p += ext_len;
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
*out_len = p - buf;
return( 0 );
@@ -811,6 +1110,7 @@
MBEDTLS_SSL_PROC_CHK_NEG( ssl_tls13_is_supported_versions_ext_present(
ssl, buf, end ) );
+
if( ret == 0 )
{
MBEDTLS_SSL_PROC_CHK_NEG(
@@ -844,6 +1144,11 @@
return( SSL_SERVER_HELLO_TLS1_2 );
}
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+ ssl->session_negotiate->endpoint = ssl->conf->endpoint;
+ ssl->session_negotiate->tls_version = ssl->tls_version;
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
+
handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
ret = ssl_server_hello_is_hrr( ssl, buf, end );
@@ -929,6 +1234,92 @@
return( 0 );
}
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+/*
+ * struct {
+ * opaque identity<1..2^16-1>;
+ * uint32 obfuscated_ticket_age;
+ * } PskIdentity;
+ *
+ * opaque PskBinderEntry<32..255>;
+ *
+ * struct {
+ *
+ * select (Handshake.msg_type) {
+ * ...
+ * case server_hello: uint16 selected_identity;
+ * };
+ *
+ * } PreSharedKeyExtension;
+ *
+ */
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_parse_server_pre_shared_key_ext( mbedtls_ssl_context *ssl,
+ const unsigned char *buf,
+ const unsigned char *end )
+{
+ int ret = 0;
+ size_t selected_identity;
+
+ const unsigned char *psk;
+ size_t psk_len;
+ const unsigned char *psk_identity;
+ size_t psk_identity_len;
+
+
+ /* Check which PSK we've offered.
+ *
+ * NOTE: Ultimately, we want to offer multiple PSKs, and in this
+ * case, we need to iterate over them here.
+ */
+ if( mbedtls_ssl_get_psk_to_offer( ssl, NULL, &psk, &psk_len,
+ &psk_identity, &psk_identity_len ) != 0 )
+ {
+ /* If we haven't offered a PSK, the server must not send
+ * a PSK identity extension. */
+ return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ }
+
+ MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 2 );
+ selected_identity = MBEDTLS_GET_UINT16_BE( buf, 0 );
+
+ /* We have offered only one PSK, so the only valid choice
+ * for the server is PSK index 0.
+ *
+ * This will change once we support multiple PSKs. */
+ if( selected_identity > 0 )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server's chosen PSK identity out of range" ) );
+
+ if( ( ret = mbedtls_ssl_send_alert_message( ssl,
+ MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+ MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ) ) != 0 )
+ {
+ return( ret );
+ }
+
+ return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+ }
+
+ /* Set the chosen PSK
+ *
+ * TODO: We don't have to do this in case we offered 0-RTT and the
+ * server accepted it, because in this case we've already
+ * set the handshake PSK. */
+ ret = mbedtls_ssl_set_hs_psk( ssl, psk, psk_len );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_set_hs_psk", ret );
+ return( ret );
+ }
+
+ ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_PRE_SHARED_KEY;
+ return( 0 );
+}
+
+#endif
+
/* Parse ServerHello message and configure context
*
* struct {
@@ -1139,12 +1530,24 @@
goto cleanup;
break;
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
- MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension." ) );
- MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key:Not supported yet" ) );
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension" ) );
+ if( is_hrr )
+ {
+ fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
+ goto cleanup;
+ }
- fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
- goto cleanup;
+ if( ( ret = ssl_tls13_parse_server_pre_shared_key_ext(
+ ssl, p, extension_data_end ) ) != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET(
+ 1, ( "ssl_tls13_parse_server_pre_shared_key_ext" ), ret );
+ return( ret );
+ }
+ break;
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
case MBEDTLS_TLS_EXT_KEY_SHARE:
MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key_shares extension" ) );
@@ -1218,17 +1621,17 @@
{
/* Only the pre_shared_key extension was received */
case MBEDTLS_SSL_EXT_PRE_SHARED_KEY:
- handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
+ handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
break;
/* Only the key_share extension was received */
case MBEDTLS_SSL_EXT_KEY_SHARE:
- handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
+ handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
break;
/* Both the pre_shared_key and key_share extensions were received */
case ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ):
- handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
+ handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
break;
/* Neither pre_shared_key nor key_share extension was received */
@@ -1477,7 +1880,7 @@
buf, buf_len );
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
- if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
+ if( mbedtls_ssl_tls13_key_exchange_mode_with_psk( ssl ) )
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
else
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
@@ -1512,12 +1915,6 @@
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
- {
- MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= skip parse certificate request" ) );
- return( SSL_CERTIFICATE_REQUEST_SKIP );
- }
-
if( ( ret = mbedtls_ssl_read_record( ssl, 0 ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
@@ -1876,6 +2273,243 @@
return( 0 );
}
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_parse_new_session_ticket_exts( mbedtls_ssl_context *ssl,
+ const unsigned char *buf,
+ const unsigned char *end )
+{
+ const unsigned char *p = buf;
+
+ ((void) ssl);
+
+ while( p < end )
+ {
+ unsigned int extension_type;
+ size_t extension_data_len;
+
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 4 );
+ extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
+ extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
+ p += 4;
+
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extension_data_len );
+
+ switch( extension_type )
+ {
+ case MBEDTLS_TLS_EXT_EARLY_DATA:
+ MBEDTLS_SSL_DEBUG_MSG( 4, ( "early_data extension received" ) );
+ break;
+
+ default:
+ break;
+ }
+ p += extension_data_len;
+ }
+
+ return( 0 );
+}
+
+/*
+ * From RFC8446, page 74
+ *
+ * struct {
+ * uint32 ticket_lifetime;
+ * uint32 ticket_age_add;
+ * opaque ticket_nonce<0..255>;
+ * opaque ticket<1..2^16-1>;
+ * Extension extensions<0..2^16-2>;
+ * } NewSessionTicket;
+ *
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_parse_new_session_ticket( mbedtls_ssl_context *ssl,
+ unsigned char *buf,
+ unsigned char *end,
+ unsigned char **ticket_nonce,
+ size_t *ticket_nonce_len )
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ unsigned char *p = buf;
+ mbedtls_ssl_session *session = ssl->session;
+ size_t ticket_len;
+ unsigned char *ticket;
+ size_t extensions_len;
+
+ *ticket_nonce = NULL;
+ *ticket_nonce_len = 0;
+ /*
+ * ticket_lifetime 4 bytes
+ * ticket_age_add 4 bytes
+ * ticket_nonce_len 1 byte
+ */
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 9 );
+
+ session->ticket_lifetime = MBEDTLS_GET_UINT32_BE( p, 0 );
+ MBEDTLS_SSL_DEBUG_MSG( 3,
+ ( "ticket_lifetime: %u",
+ ( unsigned int )session->ticket_lifetime ) );
+
+ session->ticket_age_add = MBEDTLS_GET_UINT32_BE( p, 4 );
+ MBEDTLS_SSL_DEBUG_MSG( 3,
+ ( "ticket_age_add: %u",
+ ( unsigned int )session->ticket_age_add ) );
+
+ *ticket_nonce_len = p[8];
+ p += 9;
+
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, *ticket_nonce_len );
+ *ticket_nonce = p;
+ MBEDTLS_SSL_DEBUG_BUF( 3, "ticket_nonce:", *ticket_nonce, *ticket_nonce_len );
+ p += *ticket_nonce_len;
+
+ /* Ticket */
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
+ ticket_len = MBEDTLS_GET_UINT16_BE( p, 0 );
+ p += 2;
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, ticket_len );
+ MBEDTLS_SSL_DEBUG_BUF( 3, "received ticket", p, ticket_len ) ;
+
+ /* Check if we previously received a ticket already. */
+ if( session->ticket != NULL || session->ticket_len > 0 )
+ {
+ mbedtls_free( session->ticket );
+ session->ticket = NULL;
+ session->ticket_len = 0;
+ }
+
+ if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
+ return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+ }
+ memcpy( ticket, p, ticket_len );
+ p += ticket_len;
+ session->ticket = ticket;
+ session->ticket_len = ticket_len;
+
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
+ extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
+ p += 2;
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
+
+ MBEDTLS_SSL_DEBUG_BUF( 3, "ticket extension", p, extensions_len );
+
+ ret = ssl_tls13_parse_new_session_ticket_exts( ssl, p, p + extensions_len );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1,
+ "ssl_tls13_parse_new_session_ticket_exts",
+ ret );
+ return( ret );
+ }
+
+ return( 0 );
+}
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_postprocess_new_session_ticket( mbedtls_ssl_context *ssl,
+ unsigned char *ticket_nonce,
+ size_t ticket_nonce_len )
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ mbedtls_ssl_session *session = ssl->session;
+ const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
+ psa_algorithm_t psa_hash_alg;
+ int hash_length;
+
+#if defined(MBEDTLS_HAVE_TIME)
+ /* Store ticket creation time */
+ session->ticket_received = mbedtls_time( NULL );
+#endif
+
+ ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( session->ciphersuite );
+ if( ciphersuite_info == NULL )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+ }
+
+ psa_hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
+ hash_length = PSA_HASH_LENGTH( psa_hash_alg );
+ if( hash_length == -1 ||
+ ( size_t )hash_length > sizeof( session->resumption_key ) )
+ {
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+ }
+
+
+ MBEDTLS_SSL_DEBUG_BUF( 3, "resumption_master_secret",
+ session->app_secrets.resumption_master_secret,
+ hash_length );
+
+ /* Compute resumption key
+ *
+ * HKDF-Expand-Label( resumption_master_secret,
+ * "resumption", ticket_nonce, Hash.length )
+ */
+ ret = mbedtls_ssl_tls13_hkdf_expand_label(
+ psa_hash_alg,
+ session->app_secrets.resumption_master_secret,
+ hash_length,
+ MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( resumption ),
+ ticket_nonce,
+ ticket_nonce_len,
+ session->resumption_key,
+ hash_length );
+
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 2,
+ "Creating the ticket-resumed PSK failed",
+ ret );
+ return( ret );
+ }
+
+ session->resumption_key_len = hash_length;
+
+ MBEDTLS_SSL_DEBUG_BUF( 3, "Ticket-resumed PSK",
+ session->resumption_key,
+ session->resumption_key_len );
+
+ return( 0 );
+}
+
+/*
+ * Handler for MBEDTLS_SSL_NEW_SESSION_TICKET
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_process_new_session_ticket( mbedtls_ssl_context *ssl )
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ unsigned char *buf;
+ size_t buf_len;
+ unsigned char *ticket_nonce;
+ size_t ticket_nonce_len;
+
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
+
+ MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg(
+ ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
+ &buf, &buf_len ) );
+
+ MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_new_session_ticket(
+ ssl, buf, buf + buf_len,
+ &ticket_nonce, &ticket_nonce_len ) );
+
+ MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_new_session_ticket(
+ ssl, ticket_nonce, ticket_nonce_len ) );
+
+ mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
+
+cleanup:
+
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
+ return( ret );
+}
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
+
int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl )
{
int ret = 0;
@@ -1956,6 +2590,15 @@
break;
#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+ case MBEDTLS_SSL_NEW_SESSION_TICKET:
+ ret = ssl_tls13_process_new_session_ticket( ssl );
+ if( ret != 0 )
+ break;
+ ret = MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET;
+ break;
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
+
default:
MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index 93604e7..d1e2e49 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -1505,4 +1505,41 @@
}
#endif /* MBEDTLS_ECDH_C */
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+/* Check if we have any PSK to offer, returns 0 if PSK is available.
+ * Assign the psk and ticket if pointers are present.
+ */
+int mbedtls_ssl_get_psk_to_offer(
+ const mbedtls_ssl_context *ssl,
+ int *psk_type,
+ const unsigned char **psk, size_t *psk_len,
+ const unsigned char **psk_identity, size_t *psk_identity_len )
+{
+ int ptrs_present = 0;
+
+ if( psk_type != NULL && psk != NULL && psk_len != NULL &&
+ psk_identity != NULL && psk_identity_len != NULL )
+ {
+ ptrs_present = 1;
+ }
+
+ /* Check if an external PSK has been configured. */
+ if( ssl->conf->psk != NULL )
+ {
+ if( ptrs_present )
+ {
+ *psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
+ *psk = ssl->conf->psk;
+ *psk_len = ssl->conf->psk_len;
+ *psk_identity = ssl->conf->psk_identity;
+ *psk_identity_len = ssl->conf->psk_identity_len;
+ }
+
+ return( 0 );
+ }
+
+ return( 1 );
+}
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
#endif /* MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_PROTO_TLS1_3 */
diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index a56fbee..583b8aa 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -1237,7 +1237,7 @@
* client_handshake_traffic_secret and server_handshake_traffic_secret
* are derived in the handshake secret derivation stage.
*/
- if( mbedtls_ssl_tls13_ephemeral_enabled( ssl ) )
+ if( mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral( ssl ) )
{
if( mbedtls_ssl_tls13_named_group_is_ecdhe( handshake->offered_group_id ) )
{
diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c
index 7d99433..701d044 100644
--- a/library/ssl_tls13_server.c
+++ b/library/ssl_tls13_server.c
@@ -24,6 +24,7 @@
#include "mbedtls/debug.h"
#include "mbedtls/error.h"
#include "mbedtls/platform.h"
+#include "mbedtls/constant_time.h"
#include "ssl_misc.h"
#include "ssl_tls13_keys.h"
@@ -45,6 +46,376 @@
#include "ssl_tls13_keys.h"
#include "ssl_debug_helpers.h"
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+/* From RFC 8446:
+ *
+ * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
+ * struct {
+ * PskKeyExchangeMode ke_modes<1..255>;
+ * } PskKeyExchangeModes;
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_parse_key_exchange_modes_ext( mbedtls_ssl_context *ssl,
+ const unsigned char *buf,
+ const unsigned char *end )
+{
+ const unsigned char *p = buf;
+ size_t ke_modes_len;
+ int ke_modes = 0;
+
+ /* Read ke_modes length (1 Byte) */
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
+ ke_modes_len = *p++;
+ /* Currently, there are only two PSK modes, so even without looking
+ * at the content, something's wrong if the list has more than 2 items. */
+ if( ke_modes_len > 2 )
+ {
+ MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
+ MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+ return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ }
+
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, ke_modes_len );
+
+ while( ke_modes_len-- != 0 )
+ {
+ switch( *p++ )
+ {
+ case MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE:
+ ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "Found PSK KEX MODE" ) );
+ break;
+ case MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE:
+ ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "Found PSK_EPHEMERAL KEX MODE" ) );
+ break;
+ default:
+ MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
+ MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+ return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+ }
+ }
+
+ ssl->handshake->tls13_kex_modes = ke_modes;
+ return( 0 );
+}
+
+#define SSL_TLS1_3_OFFERED_PSK_NOT_MATCH 0
+#define SSL_TLS1_3_OFFERED_PSK_MATCH 1
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_offered_psks_check_identity_match(
+ mbedtls_ssl_context *ssl,
+ const unsigned char *identity,
+ size_t identity_len )
+{
+ /* Check identity with external configured function */
+ if( ssl->conf->f_psk != NULL )
+ {
+ if( ssl->conf->f_psk(
+ ssl->conf->p_psk, ssl, identity, identity_len ) == 0 )
+ {
+ return( SSL_TLS1_3_OFFERED_PSK_MATCH );
+ }
+ return( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH );
+ }
+
+ MBEDTLS_SSL_DEBUG_BUF( 5, "identity", identity, identity_len );
+ /* Check identity with pre-configured psk */
+ if( ssl->conf->psk_identity != NULL &&
+ identity_len == ssl->conf->psk_identity_len &&
+ mbedtls_ct_memcmp( ssl->conf->psk_identity,
+ identity, identity_len ) == 0 )
+ {
+ mbedtls_ssl_set_hs_psk( ssl, ssl->conf->psk, ssl->conf->psk_len );
+ return( SSL_TLS1_3_OFFERED_PSK_MATCH );
+ }
+
+ return( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH );
+}
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_get_psk( mbedtls_ssl_context *ssl,
+ unsigned char **psk,
+ size_t *psk_len )
+{
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+ psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
+ psa_status_t status;
+
+ *psk_len = 0;
+ *psk = NULL;
+
+ status = psa_get_key_attributes( ssl->handshake->psk_opaque, &key_attributes );
+ if( status != PSA_SUCCESS)
+ {
+ return( psa_ssl_status_to_mbedtls( status ) );
+ }
+
+ *psk_len = PSA_BITS_TO_BYTES( psa_get_key_bits( &key_attributes ) );
+ *psk = mbedtls_calloc( 1, *psk_len );
+ if( *psk == NULL )
+ {
+ return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+ }
+
+ status = psa_export_key( ssl->handshake->psk_opaque,
+ (uint8_t *)*psk, *psk_len, psk_len );
+ if( status != PSA_SUCCESS)
+ {
+ mbedtls_free( (void *)*psk );
+ return( psa_ssl_status_to_mbedtls( status ) );
+ }
+#else
+ *psk = ssl->handshake->psk;
+ *psk_len = ssl->handshake->psk_len;
+#endif /* !MBEDTLS_USE_PSA_CRYPTO */
+ return( 0 );
+}
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_offered_psks_check_binder_match( mbedtls_ssl_context *ssl,
+ const unsigned char *binder,
+ size_t binder_len )
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ int psk_type;
+
+ mbedtls_md_type_t md_alg;
+ psa_algorithm_t psa_md_alg;
+ unsigned char transcript[PSA_HASH_MAX_SIZE];
+ size_t transcript_len;
+ unsigned char *psk;
+ size_t psk_len;
+ unsigned char server_computed_binder[PSA_HASH_MAX_SIZE];
+
+ psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
+ switch( binder_len )
+ {
+ case 32:
+ md_alg = MBEDTLS_MD_SHA256;
+ break;
+ case 48:
+ md_alg = MBEDTLS_MD_SHA384;
+ break;
+ default:
+ return( MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
+ }
+ psa_md_alg = mbedtls_psa_translate_md( md_alg );
+ /* Get current state of handshake transcript. */
+ ret = mbedtls_ssl_get_handshake_transcript( ssl, md_alg,
+ transcript, sizeof( transcript ),
+ &transcript_len );
+ if( ret != 0 )
+ return( ret );
+
+ ret = ssl_tls13_get_psk( ssl, &psk, &psk_len );
+ if( ret != 0 )
+ return( ret );
+
+ ret = mbedtls_ssl_tls13_create_psk_binder( ssl, psa_md_alg,
+ psk, psk_len, psk_type,
+ transcript,
+ server_computed_binder );
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+ mbedtls_free( (void*)psk );
+#endif
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 1, ( "PSK binder calculation failed." ) );
+ return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ }
+
+ MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder ( computed ): ",
+ server_computed_binder, transcript_len );
+ MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder ( received ): ", binder, binder_len );
+
+ if( mbedtls_ct_memcmp( server_computed_binder, binder, binder_len ) == 0 )
+ {
+ return( SSL_TLS1_3_OFFERED_PSK_MATCH );
+ }
+
+ mbedtls_platform_zeroize( server_computed_binder,
+ sizeof( server_computed_binder ) );
+ return( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH );
+}
+
+/* Parser for pre_shared_key extension in client hello
+ * struct {
+ * opaque identity<1..2^16-1>;
+ * uint32 obfuscated_ticket_age;
+ * } PskIdentity;
+ *
+ * opaque PskBinderEntry<32..255>;
+ *
+ * struct {
+ * PskIdentity identities<7..2^16-1>;
+ * PskBinderEntry binders<33..2^16-1>;
+ * } OfferedPsks;
+ *
+ * struct {
+ * select (Handshake.msg_type) {
+ * case client_hello: OfferedPsks;
+ * ....
+ * };
+ * } PreSharedKeyExtension;
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_parse_pre_shared_key_ext( mbedtls_ssl_context *ssl,
+ const unsigned char *buf,
+ const unsigned char *end )
+{
+ const unsigned char *identities = buf;
+ const unsigned char *p_identity_len;
+ size_t identities_len;
+ const unsigned char *identities_end;
+ const unsigned char *binders;
+ const unsigned char *p_binder_len;
+ size_t binders_len;
+ const unsigned char *binders_end;
+ int matched_identity = -1;
+ int identity_id = -1;
+
+ MBEDTLS_SSL_DEBUG_BUF( 3, "pre_shared_key extension", buf, end - buf );
+
+ /* identities_len 2 bytes
+ * identities_data >= 7 bytes
+ */
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( identities, end, 7 + 2 );
+ identities_len = MBEDTLS_GET_UINT16_BE( identities, 0 );
+ p_identity_len = identities + 2;
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p_identity_len, end, identities_len );
+ identities_end = p_identity_len + identities_len;
+
+ /* binders_len 2 bytes
+ * binders >= 33 bytes
+ */
+ binders = identities_end;
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( binders, end, 33 + 2 );
+ binders_len = MBEDTLS_GET_UINT16_BE( binders, 0 );
+ p_binder_len = binders + 2;
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p_binder_len, end, binders_len );
+ binders_end = p_binder_len + binders_len;
+
+ ssl->handshake->update_checksum( ssl, buf, identities_end - buf );
+
+ while( p_identity_len < identities_end && p_binder_len < binders_end )
+ {
+ const unsigned char *identity;
+ size_t identity_len;
+ const unsigned char *binder;
+ size_t binder_len;
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p_identity_len, identities_end, 2 + 1 + 4 );
+ identity_len = MBEDTLS_GET_UINT16_BE( p_identity_len, 0 );
+ identity = p_identity_len + 2;
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( identity, identities_end, identity_len + 4 );
+ p_identity_len += identity_len + 6;
+
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( p_binder_len, binders_end, 1 + 32 );
+ binder_len = *p_binder_len;
+ binder = p_binder_len + 1;
+ MBEDTLS_SSL_CHK_BUF_READ_PTR( binder, binders_end, binder_len );
+ p_binder_len += binder_len + 1;
+
+
+ identity_id++;
+ if( matched_identity != -1 )
+ continue;
+
+ ret = ssl_tls13_offered_psks_check_identity_match(
+ ssl, identity, identity_len );
+ if( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH == ret )
+ continue;
+
+ ret = ssl_tls13_offered_psks_check_binder_match(
+ ssl, binder, binder_len );
+ if( ret != SSL_TLS1_3_OFFERED_PSK_MATCH )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1,
+ "ssl_tls13_offered_psks_check_binder_match" , ret );
+ MBEDTLS_SSL_PEND_FATAL_ALERT(
+ MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
+ MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ return( ret );
+ }
+ if( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH == ret )
+ continue;
+
+ matched_identity = identity_id;
+ }
+
+ if( p_identity_len != identities_end || p_binder_len != binders_end )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key extesion decode error" ) );
+ MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
+ MBEDTLS_ERR_SSL_DECODE_ERROR );
+ return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+ }
+
+ /* Update the handshake transcript with the binder list. */
+ ssl->handshake->update_checksum( ssl,
+ identities_end,
+ (size_t)( binders_end - identities_end ) );
+ if( matched_identity == -1 )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "No matched pre shared key found" ) );
+ return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
+ }
+
+ ssl->handshake->selected_identity = (uint16_t)matched_identity;
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "Pre shared key found" ) );
+
+ return( 0 );
+}
+
+/*
+ * struct {
+ * select ( Handshake.msg_type ) {
+ * ....
+ * case server_hello:
+ * uint16 selected_identity;
+ * }
+ * } PreSharedKeyExtension;
+ */
+static int ssl_tls13_write_server_pre_shared_key_ext( mbedtls_ssl_context *ssl,
+ unsigned char *buf,
+ unsigned char *end,
+ size_t *olen )
+{
+ unsigned char *p = (unsigned char*)buf;
+
+ *olen = 0;
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+ if( mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
+#else
+ if( ssl->handshake->psk == NULL )
+#endif
+ {
+ /* We shouldn't have called this extension writer unless we've
+ * chosen to use a PSK. */
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+ }
+
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding pre_shared_key extension" ) );
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
+
+ MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_PRE_SHARED_KEY, p, 0 );
+ MBEDTLS_PUT_UINT16_BE( 2, p, 2 );
+
+ MBEDTLS_PUT_UINT16_BE( ssl->handshake->selected_identity, p, 4 );
+
+ *olen = 6;
+
+ MBEDTLS_SSL_DEBUG_MSG( 4, ( "sent selected_identity: %u",
+ ssl->handshake->selected_identity ) );
+
+ return( 0 );
+}
+
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
/* From RFC 8446:
* struct {
* ProtocolVersion versions<2..254>;
@@ -328,24 +699,121 @@
static int ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(
mbedtls_ssl_context *ssl )
{
- return( ssl_tls13_client_hello_has_exts( ssl,
- MBEDTLS_SSL_EXT_SUPPORTED_GROUPS |
- MBEDTLS_SSL_EXT_KEY_SHARE |
- MBEDTLS_SSL_EXT_SIG_ALG ) );
+ return( ssl_tls13_client_hello_has_exts(
+ ssl,
+ MBEDTLS_SSL_EXT_SUPPORTED_GROUPS |
+ MBEDTLS_SSL_EXT_KEY_SHARE |
+ MBEDTLS_SSL_EXT_SIG_ALG ) );
}
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_client_hello_has_exts_for_psk_key_exchange(
+ mbedtls_ssl_context *ssl )
+{
+ return( ssl_tls13_client_hello_has_exts(
+ ssl,
+ MBEDTLS_SSL_EXT_PRE_SHARED_KEY |
+ MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES ) );
+}
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(
+ mbedtls_ssl_context *ssl )
+{
+ return( ssl_tls13_client_hello_has_exts(
+ ssl,
+ MBEDTLS_SSL_EXT_SUPPORTED_GROUPS |
+ MBEDTLS_SSL_EXT_KEY_SHARE |
+ MBEDTLS_SSL_EXT_PRE_SHARED_KEY |
+ MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES ) );
+}
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_tls13_check_ephemeral_key_exchange( mbedtls_ssl_context *ssl )
{
- if( !mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) )
- return( 0 );
+ return( mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) &&
+ ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange( ssl ) );
+}
- if( !ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange( ssl ) )
- return( 0 );
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_check_psk_key_exchange( mbedtls_ssl_context *ssl )
+{
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ return( mbedtls_ssl_conf_tls13_psk_enabled( ssl ) &&
+ mbedtls_ssl_tls13_psk_enabled( ssl ) &&
+ ssl_tls13_client_hello_has_exts_for_psk_key_exchange( ssl ) );
+#else
+ ((void) ssl);
+ return( 0 );
+#endif
+}
- ssl->handshake->tls13_kex_modes =
- MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
- return( 1 );
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_check_psk_ephemeral_key_exchange( mbedtls_ssl_context *ssl )
+{
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ return( mbedtls_ssl_conf_tls13_psk_ephemeral_enabled( ssl ) &&
+ mbedtls_ssl_tls13_psk_ephemeral_enabled( ssl ) &&
+ ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange( ssl ) );
+#else
+ ((void) ssl);
+ return( 0 );
+#endif
+}
+
+static int ssl_tls13_determine_key_exchange_mode( mbedtls_ssl_context *ssl )
+{
+ /*
+ * Determine the key exchange algorithm to use.
+ * There are three types of key exchanges supported in TLS 1.3:
+ * - (EC)DH with ECDSA,
+ * - (EC)DH with PSK,
+ * - plain PSK.
+ *
+ * The PSK-based key exchanges may additionally be used with 0-RTT.
+ *
+ * Our built-in order of preference is
+ * 1 ) (EC)DHE-PSK Mode ( psk_ephemeral )
+ * 2 ) Certificate Mode ( ephemeral )
+ * 3 ) Plain PSK Mode ( psk )
+ */
+
+ ssl->handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE;
+
+ if( ssl_tls13_check_psk_ephemeral_key_exchange( ssl ) )
+ {
+ ssl->handshake->key_exchange_mode =
+ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "key exchange mode: psk_ephemeral" ) );
+ }
+ else
+ if( ssl_tls13_check_ephemeral_key_exchange( ssl ) )
+ {
+ ssl->handshake->key_exchange_mode =
+ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "key exchange mode: ephemeral" ) );
+ }
+ else
+ if( ssl_tls13_check_psk_key_exchange( ssl ) )
+ {
+ ssl->handshake->key_exchange_mode =
+ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "key exchange mode: psk" ) );
+ }
+ else
+ {
+ MBEDTLS_SSL_DEBUG_MSG(
+ 1,
+ ( "ClientHello message misses mandatory extensions." ) );
+ MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION ,
+ MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+ return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+ }
+
+ return( 0 );
+
}
#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
@@ -486,6 +954,10 @@
int hrr_required = 0;
const mbedtls_ssl_ciphersuite_t* ciphersuite_info;
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ const unsigned char *pre_shared_key_ext_start = NULL;
+ const unsigned char *pre_shared_key_ext_end = NULL;
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
@@ -531,6 +1003,12 @@
*/
ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+ /* Store minor version for later use with ticket serialization. */
+ ssl->session_negotiate->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
+ ssl->session_negotiate->endpoint = ssl->conf->endpoint;
+#endif
+
/* ...
* Random random;
* ...
@@ -662,6 +1140,23 @@
size_t extension_data_len;
const unsigned char *extension_data_end;
+ /* RFC 8446, page 57
+ *
+ * The "pre_shared_key" extension MUST be the last extension in the
+ * ClientHello (this facilitates implementation as described below).
+ * Servers MUST check that it is the last extension and otherwise fail
+ * the handshake with an "illegal_parameter" alert.
+ */
+ if( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_PRE_SHARED_KEY )
+ {
+ MBEDTLS_SSL_DEBUG_MSG(
+ 3, ( "pre_shared_key is not last extension." ) );
+ MBEDTLS_SSL_PEND_FATAL_ALERT(
+ MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
+ MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ }
+
MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
@@ -754,6 +1249,44 @@
ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_VERSIONS;
break;
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "found psk key exchange modes extension" ) );
+
+ ret = ssl_tls13_parse_key_exchange_modes_ext(
+ ssl, p, extension_data_end );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET(
+ 1, "ssl_tls13_parse_key_exchange_modes_ext", ret );
+ return( ret );
+ }
+
+ ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES;
+ break;
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
+ case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension" ) );
+ if( ( ssl->handshake->extensions_present &
+ MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES ) == 0 )
+ {
+ MBEDTLS_SSL_PEND_FATAL_ALERT(
+ MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
+ MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+ }
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ /* Delay processing of the PSK identity once we have
+ * found out which algorithms to use. We keep a pointer
+ * to the buffer and the size for later processing.
+ */
+ pre_shared_key_ext_start = p;
+ pre_shared_key_ext_end = extension_data_end;
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+ ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_PRE_SHARED_KEY;
+ break;
+
#if defined(MBEDTLS_SSL_ALPN)
case MBEDTLS_TLS_EXT_ALPN:
MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
@@ -795,17 +1328,49 @@
p += extension_data_len;
}
+#if defined(MBEDTLS_DEBUG_C)
+ /* List all the extensions we have received */
+ ssl_tls13_debug_print_client_hello_exts( ssl );
+#endif /* MBEDTLS_DEBUG_C */
+
+ mbedtls_ssl_add_hs_hdr_to_checksum( ssl,
+ MBEDTLS_SSL_HS_CLIENT_HELLO,
+ p - buf );
+
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
/* Update checksum with either
* - The entire content of the CH message, if no PSK extension is present
* - The content up to but excluding the PSK extension, if present.
*/
- mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
- buf, p - buf );
+ /* If we've settled on a PSK-based exchange, parse PSK identity ext */
+ if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) &&
+ ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_PRE_SHARED_KEY ) )
+ {
+ ssl->handshake->update_checksum( ssl, buf,
+ pre_shared_key_ext_start - buf );
+ ret = ssl_tls13_parse_pre_shared_key_ext( ssl,
+ pre_shared_key_ext_start,
+ pre_shared_key_ext_end );
+ if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY)
+ {
+ ssl->handshake->extensions_present &= ~MBEDTLS_SSL_EXT_PRE_SHARED_KEY;
+ }
+ else if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_tls13_parse_pre_shared_key_ext" ),
+ ret );
+ return( ret );
+ }
+ }
+ else
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+ {
+ ssl->handshake->update_checksum( ssl, buf, p - buf );
+ }
- /* List all the extensions we have received */
-#if defined(MBEDTLS_DEBUG_C)
- ssl_tls13_debug_print_client_hello_exts( ssl );
-#endif /* MBEDTLS_DEBUG_C */
+ ret = ssl_tls13_determine_key_exchange_mode( ssl );
+ if( ret < 0 )
+ return( ret );
return( hrr_required ? SSL_CLIENT_HELLO_HRR_REQUIRED : SSL_CLIENT_HELLO_OK );
}
@@ -818,19 +1383,6 @@
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
/*
- * Here we only support the ephemeral or (EC)DHE key echange mode
- */
- if( !ssl_tls13_check_ephemeral_key_exchange( ssl ) )
- {
- MBEDTLS_SSL_DEBUG_MSG(
- 1,
- ( "ClientHello message misses mandatory extensions." ) );
- MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION ,
- MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
- return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
- }
-
- /*
* Server certificate selection
*/
if( ssl->conf->f_cert_cb && ( ret = ssl->conf->f_cert_cb( ssl ) ) != 0 )
@@ -1096,7 +1648,7 @@
* of the HRR is then to transmit a cookie to force the client to demonstrate
* reachability at their apparent network address (primarily useful for DTLS).
*/
- if( ! mbedtls_ssl_tls13_some_ephemeral_enabled( ssl ) )
+ if( ! mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral( ssl ) )
return( 0 );
/* We should only send the key_share extension if the client's initial
@@ -1261,6 +1813,20 @@
p += output_len;
}
+#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+ if( mbedtls_ssl_tls13_key_exchange_mode_with_psk( ssl ) )
+ {
+ ret = ssl_tls13_write_server_pre_shared_key_ext( ssl, p, end, &output_len );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_server_pre_shared_key_ext",
+ ret );
+ return( ret );
+ }
+ p += output_len;
+ }
+#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
+
MBEDTLS_PUT_UINT16_BE( p - p_extensions_len - 2, p_extensions_len, 0 );
MBEDTLS_SSL_DEBUG_BUF( 4, "server hello extensions",
@@ -1484,7 +2050,7 @@
ssl, buf_len, msg_len ) );
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
- if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
+ if( mbedtls_ssl_tls13_key_exchange_mode_with_psk( ssl ) )
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
else
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
@@ -1736,11 +2302,274 @@
MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
mbedtls_ssl_tls13_handshake_wrapup( ssl );
+
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+ mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_NEW_SESSION_TICKET );
+#else
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
+#endif
return( 0 );
}
/*
+ * Handler for MBEDTLS_SSL_NEW_SESSION_TICKET
+ */
+#define SSL_NEW_SESSION_TICKET_SKIP 0
+#define SSL_NEW_SESSION_TICKET_WRITE 1
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_write_new_session_ticket_coordinate( mbedtls_ssl_context *ssl )
+{
+ /* Check whether the use of session tickets is enabled */
+ if( ssl->conf->f_ticket_write == NULL )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "new session ticket is not enabled" ) );
+ return( SSL_NEW_SESSION_TICKET_SKIP );
+ }
+
+ return( SSL_NEW_SESSION_TICKET_WRITE );
+}
+
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_prepare_new_session_ticket( mbedtls_ssl_context *ssl,
+ unsigned char *ticket_nonce,
+ size_t ticket_nonce_size )
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ mbedtls_ssl_session *session = ssl->session;
+ mbedtls_ssl_ciphersuite_t *ciphersuite_info;
+ psa_algorithm_t psa_hash_alg;
+ int hash_length;
+
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> prepare NewSessionTicket msg" ) );
+
+#if defined(MBEDTLS_HAVE_TIME)
+ session->start = mbedtls_time( NULL );
+#endif
+
+ /* Generate ticket_age_add */
+ if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
+ (unsigned char *) &session->ticket_age_add,
+ sizeof( session->ticket_age_add ) ) != 0 ) )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "generate_ticket_age_add", ret );
+ return( ret );
+ }
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket_age_add: %u",
+ (unsigned int)session->ticket_age_add ) );
+
+ /* Generate ticket_nonce */
+ ret = ssl->conf->f_rng( ssl->conf->p_rng, ticket_nonce, ticket_nonce_size );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "generate_ticket_nonce", ret );
+ return( ret );
+ }
+ MBEDTLS_SSL_DEBUG_BUF( 3, "ticket_nonce:",
+ ticket_nonce, ticket_nonce_size );
+
+ ciphersuite_info =
+ (mbedtls_ssl_ciphersuite_t *) ssl->handshake->ciphersuite_info;
+ psa_hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
+ hash_length = PSA_HASH_LENGTH( psa_hash_alg );
+ if( hash_length == -1 ||
+ (size_t)hash_length > sizeof( session->resumption_key ) )
+ {
+ return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+ }
+
+ /* In this code the psk key length equals the length of the hash */
+ session->resumption_key_len = hash_length;
+ session->ciphersuite = ciphersuite_info->id;
+
+ /* Compute resumption key
+ *
+ * HKDF-Expand-Label( resumption_master_secret,
+ * "resumption", ticket_nonce, Hash.length )
+ */
+ ret = mbedtls_ssl_tls13_hkdf_expand_label(
+ psa_hash_alg,
+ session->app_secrets.resumption_master_secret,
+ hash_length,
+ MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( resumption ),
+ ticket_nonce,
+ ticket_nonce_size,
+ session->resumption_key,
+ hash_length );
+
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 2,
+ "Creating the ticket-resumed PSK failed",
+ ret );
+ return ( ret );
+ }
+ MBEDTLS_SSL_DEBUG_BUF( 3, "Ticket-resumed PSK",
+ session->resumption_key,
+ session->resumption_key_len );
+
+ MBEDTLS_SSL_DEBUG_BUF( 3, "resumption_master_secret",
+ session->app_secrets.resumption_master_secret,
+ hash_length );
+
+ return( 0 );
+}
+
+/* This function creates a NewSessionTicket message in the following format:
+ *
+ * struct {
+ * uint32 ticket_lifetime;
+ * uint32 ticket_age_add;
+ * opaque ticket_nonce<0..255>;
+ * opaque ticket<1..2^16-1>;
+ * Extension extensions<0..2^16-2>;
+ * } NewSessionTicket;
+ *
+ * The ticket inside the NewSessionTicket message is an encrypted container
+ * carrying the necessary information so that the server is later able to
+ * re-start the communication.
+ *
+ * The following fields are placed inside the ticket by the
+ * f_ticket_write() function:
+ *
+ * - creation time (start)
+ * - flags (flags)
+ * - age add (ticket_age_add)
+ * - key (key)
+ * - key length (key_len)
+ * - ciphersuite (ciphersuite)
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+static int ssl_tls13_write_new_session_ticket_body( mbedtls_ssl_context *ssl,
+ unsigned char *buf,
+ unsigned char *end,
+ size_t *out_len,
+ unsigned char *ticket_nonce,
+ size_t ticket_nonce_size )
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ unsigned char *p = buf;
+ mbedtls_ssl_session *session = ssl->session;
+ size_t ticket_len;
+ uint32_t ticket_lifetime;
+
+ *out_len = 0;
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write NewSessionTicket msg" ) );
+
+ /*
+ * ticket_lifetime 4 bytes
+ * ticket_age_add 4 bytes
+ * ticket_nonce 1 + ticket_nonce_size bytes
+ * ticket >=2 bytes
+ */
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 + 4 + 1 + ticket_nonce_size + 2 );
+
+ /* Generate ticket and ticket_lifetime */
+ ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
+ session,
+ p + 9 + ticket_nonce_size + 2,
+ end,
+ &ticket_len,
+ &ticket_lifetime);
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1, "write_ticket", ret );
+ return( ret );
+ }
+ /* RFC 8446 4.6.1
+ * ticket_lifetime: Indicates the lifetime in seconds as a 32-bit
+ * unsigned integer in network byte order from the time of ticket
+ * issuance. Servers MUST NOT use any value greater than
+ * 604800 seconds (7 days). The value of zero indicates that the
+ * ticket should be discarded immediately. Clients MUST NOT cache
+ * tickets for longer than 7 days, regardless of the ticket_lifetime,
+ * and MAY delete tickets earlier based on local policy. A server
+ * MAY treat a ticket as valid for a shorter period of time than what
+ * is stated in the ticket_lifetime.
+ */
+ ticket_lifetime %= 604800;
+ MBEDTLS_PUT_UINT32_BE( ticket_lifetime, p, 0 );
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket_lifetime: %u",
+ ( unsigned int )ticket_lifetime ) );
+
+ /* Write ticket_age_add */
+ MBEDTLS_PUT_UINT32_BE( session->ticket_age_add, p, 4 );
+ MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket_age_add: %u",
+ ( unsigned int )session->ticket_age_add ) );
+
+ /* Write ticket_nonce */
+ p[8] = ( unsigned char )ticket_nonce_size;
+ if( ticket_nonce_size > 0 )
+ {
+ memcpy( p + 9, ticket_nonce, ticket_nonce_size );
+ }
+ p += 9 + ticket_nonce_size;
+
+ /* Write ticket */
+ MBEDTLS_PUT_UINT16_BE( ticket_len, p, 0 );
+ p += 2;
+ MBEDTLS_SSL_DEBUG_BUF( 4, "ticket", p, ticket_len);
+ p += ticket_len;
+
+ /* Ticket Extensions
+ *
+ * Note: We currently don't have any extensions.
+ * Set length to zero.
+ */
+ MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
+ MBEDTLS_PUT_UINT16_BE( 0, p, 0 );
+ p += 2;
+
+ *out_len = p - buf;
+ MBEDTLS_SSL_DEBUG_BUF( 4, "ticket", buf, *out_len );
+ MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
+
+ return( 0 );
+}
+
+/*
+ * Handler for MBEDTLS_SSL_NEW_SESSION_TICKET
+ */
+static int ssl_tls13_write_new_session_ticket( mbedtls_ssl_context *ssl )
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+
+ MBEDTLS_SSL_PROC_CHK_NEG( ssl_tls13_write_new_session_ticket_coordinate( ssl ) );
+
+ if( ret == SSL_NEW_SESSION_TICKET_WRITE )
+ {
+ unsigned char ticket_nonce[MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH];
+ unsigned char *buf;
+ size_t buf_len, msg_len;
+
+ MBEDTLS_SSL_PROC_CHK( ssl_tls13_prepare_new_session_ticket(
+ ssl, ticket_nonce, sizeof( ticket_nonce ) ) );
+
+ MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_start_handshake_msg( ssl,
+ MBEDTLS_SSL_HS_NEW_SESSION_TICKET, &buf, &buf_len ) );
+
+ MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_new_session_ticket_body(
+ ssl, buf, buf + buf_len, &msg_len,
+ ticket_nonce, sizeof( ticket_nonce ) ) );
+
+ MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg(
+ ssl, buf_len, msg_len ) );
+
+ mbedtls_ssl_handshake_set_state( ssl,
+ MBEDTLS_SSL_NEW_SESSION_TICKET_FLUSH );
+ }
+ else
+ {
+ mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
+ }
+
+cleanup:
+
+ return( ret );
+}
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
+
+/*
* TLS 1.3 State Machine -- server side
*/
int mbedtls_ssl_tls13_handshake_server_step( mbedtls_ssl_context *ssl )
@@ -1860,6 +2689,27 @@
}
break;
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+ case MBEDTLS_SSL_NEW_SESSION_TICKET:
+ ret = ssl_tls13_write_new_session_ticket( ssl );
+ if( ret != 0 )
+ {
+ MBEDTLS_SSL_DEBUG_RET( 1,
+ "ssl_tls13_write_new_session_ticket ",
+ ret );
+ }
+ break;
+ case MBEDTLS_SSL_NEW_SESSION_TICKET_FLUSH:
+ /* This state is necessary to do the flush of the New Session
+ * Ticket message written in MBEDTLS_SSL_NEW_SESSION_TICKET
+ * as part of ssl_prepare_handshake_step.
+ */
+ ret = 0;
+ mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
+ break;
+
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
+
default:
MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index d6724df..e8b8b1e 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -2645,8 +2645,6 @@
/*
* 7. Read the HTTP response
*/
- mbedtls_printf( " < Read from server:" );
- fflush( stdout );
/*
* TLS and DTLS need different reading styles (stream vs datagram)
@@ -2694,6 +2692,18 @@
ret = 0;
goto reconnect;
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+ case MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET:
+ /* We were waiting for application data but got
+ * a NewSessionTicket instead. */
+ mbedtls_printf( " got new session ticket.\n" );
+ continue;
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
+
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
default:
mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n",
(unsigned int) -ret );
@@ -2703,8 +2713,8 @@
len = ret;
buf[len] = '\0';
- mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf );
-
+ mbedtls_printf( " < Read from server: %d bytes read\n\n%s", len, (char *) buf );
+ fflush( stdout );
/* End of message should be detected according to the syntax of the
* application protocol (eg HTTP), just use a dummy test here. */
if( ret > 0 && buf[len-1] == '\n' )
@@ -2767,7 +2777,7 @@
len = ret;
buf[len] = '\0';
- mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf );
+ mbedtls_printf( " < Read from server: %d bytes read\n\n%s", len, (char *) buf );
ret = 0;
}
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 8e432bd..67b6ca2 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -676,9 +676,9 @@
int force_srtp_profile; /* SRTP protection profile to use or all */
int support_mki; /* The dtls mki mki support */
const char *key1_opaque_alg1; /* Allowed opaque key 1 alg 1 */
- const char *key1_opaque_alg2; /* Allowed Opaque key 1 alg 2 */
+ const char *key1_opaque_alg2; /* Allowed opaque key 1 alg 2 */
const char *key2_opaque_alg1; /* Allowed opaque key 2 alg 1 */
- const char *key2_opaque_alg2; /* Allowed Opaque key 2 alg 2 */
+ const char *key2_opaque_alg2; /* Allowed opaque key 2 alg 2 */
} opt;
#include "ssl_test_common_source.c"
diff --git a/scripts/assemble_changelog.py b/scripts/assemble_changelog.py
index 7b036aa..f3aca70 100755
--- a/scripts/assemble_changelog.py
+++ b/scripts/assemble_changelog.py
@@ -122,7 +122,7 @@
class TextChangelogFormat(ChangelogFormat):
"""The traditional Mbed TLS changelog format."""
- _unreleased_version_text = '= mbed TLS x.x.x branch released xxxx-xx-xx'
+ _unreleased_version_text = '= Mbed TLS x.x.x branch released xxxx-xx-xx'
@classmethod
def is_released_version(cls, title):
# Look for an incomplete release date
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 80b7806..7a2b58e 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -878,7 +878,9 @@
CLI_EXIT=$?
kill $DOG_PID >/dev/null 2>&1
- wait $DOG_PID
+ # For Ubuntu 22.04, `Terminated` message is outputed by wait command.
+ # To remove it from stdout, redirect stdout/stderr to CLI_OUT
+ wait $DOG_PID >> $CLI_OUT 2>&1
echo "EXIT: $CLI_EXIT" >> $CLI_OUT
@@ -2229,41 +2231,92 @@
# ssl_client2/ssl_server2 example programs works.
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "TLS 1.3: key exchange mode parameter passing: PSK only" \
"$P_SRV tls13_kex_modes=psk debug_level=4" \
"$P_CLI tls13_kex_modes=psk debug_level=4" \
0
+
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "TLS 1.3: key exchange mode parameter passing: PSK-ephemeral only" \
"$P_SRV tls13_kex_modes=psk_ephemeral" \
"$P_CLI tls13_kex_modes=psk_ephemeral" \
0
+
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "TLS 1.3: key exchange mode parameter passing: Pure-ephemeral only" \
"$P_SRV tls13_kex_modes=ephemeral" \
"$P_CLI tls13_kex_modes=ephemeral" \
0
+
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "TLS 1.3: key exchange mode parameter passing: All ephemeral" \
"$P_SRV tls13_kex_modes=ephemeral_all" \
"$P_CLI tls13_kex_modes=ephemeral_all" \
0
+
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "TLS 1.3: key exchange mode parameter passing: All PSK" \
"$P_SRV tls13_kex_modes=psk_all" \
"$P_CLI tls13_kex_modes=psk_all" \
0
+
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "TLS 1.3: key exchange mode parameter passing: All" \
"$P_SRV tls13_kex_modes=all" \
"$P_CLI tls13_kex_modes=all" \
0
+requires_openssl_tls1_3
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+requires_config_enabled MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_config_enabled MBEDTLS_DEBUG_C
+run_test "TLS 1.3: PSK: basic check, O->m" \
+ "$P_SRV force_version=tls13 tls13_kex_modes=psk debug_level=5 psk=6162636465666768696a6b6c6d6e6f70" \
+ "$O_NEXT_CLI -tls1_3 -psk 1234 -psk 6162636465666768696a6b6c6d6e6f70 -allow_no_dhe_kex" \
+ 1 \
+ -s "found psk key exchange modes extension" \
+ -s "found pre_shared_key extension" \
+ -s "Found PSK_EPHEMERAL KEX MODE" \
+ -s "Found PSK KEX MODE" \
+ -s "Pre shared key found"
+
+requires_gnutls_tls1_3
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+requires_config_enabled MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_config_enabled MBEDTLS_DEBUG_C
+run_test "TLS 1.3: PSK: basic check, G->m" \
+ "$P_SRV force_version=tls13 tls13_kex_modes=psk debug_level=5 psk=6162636465666768696a6b6c6d6e6f70" \
+ "$G_NEXT_CLI --priority NORMAL:-VERS-ALL:+KX-ALL:+PSK:+DHE-PSK:+VERS-TLS1.3 \
+ --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70 \
+ localhost" \
+ 1 \
+ -s "found psk key exchange modes extension" \
+ -s "found pre_shared_key extension" \
+ -s "Found PSK_EPHEMERAL KEX MODE" \
+ -s "Found PSK KEX MODE" \
+ -s "Pre shared key found"
+
# Tests for datagram packing
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS: multiple records in same datagram, client and server" \
@@ -11938,6 +11991,52 @@
-s "parse ServerName extension" \
-s "HTTP/1.0 200 OK"
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_config_enabled MBEDTLS_SSL_CLI_C
+run_test "TLS 1.3, default suite, PSK" \
+ "$P_SRV nbio=2 debug_level=5 force_version=tls13 psk=010203 psk_identity=0a0b0c tls13_kex_modes=psk" \
+ "$P_CLI nbio=2 debug_level=5 force_version=tls13 psk=010203 psk_identity=0a0b0c tls13_kex_modes=psk" \
+ 1 \
+ -c "=> write client hello" \
+ -c "client hello, adding pre_shared_key extension, omitting PSK binder list" \
+ -c "client hello, adding psk_key_exchange_modes extension" \
+ -c "client hello, adding PSK binder list" \
+ -c "<= write client hello"
+
+requires_openssl_tls1_3
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+requires_config_enabled MBEDTLS_DEBUG_C
+requires_config_enabled MBEDTLS_SSL_CLI_C
+run_test "TLS 1.3, default suite, PSK - openssl" \
+ "$O_NEXT_SRV -msg -debug -tls1_3 -psk_identity 0a0b0c -psk 010203 -allow_no_dhe_kex -nocert" \
+ "$P_CLI debug_level=4 psk=010203 psk_identity=0a0b0c tls13_kex_modes=psk" \
+ 1 \
+ -c "=> write client hello" \
+ -c "client hello, adding pre_shared_key extension, omitting PSK binder list" \
+ -c "client hello, adding psk_key_exchange_modes extension" \
+ -c "client hello, adding PSK binder list" \
+ -c "<= write client hello"
+
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_gnutls_tls1_3
+requires_gnutls_next_no_ticket
+requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+requires_config_enabled MBEDTLS_DEBUG_C
+requires_config_enabled MBEDTLS_SSL_CLI_C
+run_test "TLS 1.3, default suite, PSK - gnutls" \
+ "$G_NEXT_SRV -d 4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+PSK:+CIPHER-ALL:%NO_TICKETS --pskhint=0a0b0c" \
+ "$P_CLI debug_level=4 psk=010203 psk_identity=0a0b0c tls13_kex_modes=psk" \
+ 1 \
+ -c "=> write client hello" \
+ -c "client hello, adding pre_shared_key extension, omitting PSK binder list" \
+ -c "client hello, adding psk_key_exchange_modes extension" \
+ -c "client hello, adding PSK binder list" \
+ -s "Parsing extension 'PSK Key Exchange Modes/45'" \
+ -s "Parsing extension 'Pre Shared Key/41'" \
+ -c "<= write client hello"
+
for i in opt-testcases/*.sh
do
TEST_SUITE_NAME=${i##*/}
@@ -12552,6 +12651,81 @@
1 \
-c "select_sig_alg_for_certificate_verify:no suitable signature algorithm found"
+requires_openssl_tls1_3
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_DEBUG_C
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+run_test "TLS 1.3: NewSessionTicket: Basic check, m->O" \
+ "$O_NEXT_SRV -msg -tls1_3 -no_resume_ephemeral -no_cache " \
+ "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
+ 0 \
+ -c "Protocol is TLSv1.3" \
+ -c "MBEDTLS_SSL_NEW_SESSION_TICKET" \
+ -c "got new session ticket." \
+ -c "Saving session for reuse... ok" \
+ -c "HTTP/1.0 200 ok"
+
+requires_gnutls_tls1_3
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+requires_config_enabled MBEDTLS_DEBUG_C
+requires_config_enabled MBEDTLS_SSL_CLI_C
+run_test "TLS 1.3: NewSessionTicket: Basic check, m->G" \
+ "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:+PSK --disable-client-cert" \
+ "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
+ 0 \
+ -c "Protocol is TLSv1.3" \
+ -c "MBEDTLS_SSL_NEW_SESSION_TICKET" \
+ -c "got new session ticket." \
+ -c "Saving session for reuse... ok" \
+ -c "HTTP/1.0 200 OK"
+
+requires_openssl_tls1_3
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_config_enabled MBEDTLS_DEBUG_C
+run_test "TLS 1.3: NewSessionTicket: Basic check, O->m" \
+ "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=1" \
+ "$O_NEXT_CLI -msg -debug -tls1_3 -no_middlebox" \
+ 0 \
+ -s "=> write NewSessionTicket msg" \
+ -s "server state: MBEDTLS_SSL_NEW_SESSION_TICKET" \
+ -s "server state: MBEDTLS_SSL_NEW_SESSION_TICKET_FLUSH"
+
+requires_gnutls_tls1_3
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_config_enabled MBEDTLS_DEBUG_C
+run_test "TLS 1.3: NewSessionTicket: Basic check, G->m" \
+ "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=1" \
+ "$G_NEXT_CLI localhost -d 4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:%DISABLE_TLS13_COMPAT_MODE -V" \
+ 0 \
+ -s "=> write NewSessionTicket msg" \
+ -s "server state: MBEDTLS_SSL_NEW_SESSION_TICKET" \
+ -s "server state: MBEDTLS_SSL_NEW_SESSION_TICKET_FLUSH" \
+ -c "NEW SESSION TICKET (4) was received"
+
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_DEBUG_C
+run_test "TLS 1.3: NewSessionTicket: Basic check, m->m" \
+ "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=1" \
+ "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
+ 0 \
+ -c "Protocol is TLSv1.3" \
+ -c "MBEDTLS_SSL_NEW_SESSION_TICKET" \
+ -c "got new session ticket." \
+ -c "Saving session for reuse... ok" \
+ -c "HTTP/1.0 200 OK" \
+ -s "=> write NewSessionTicket msg" \
+ -s "server state: MBEDTLS_SSL_NEW_SESSION_TICKET" \
+ -s "server state: MBEDTLS_SSL_NEW_SESSION_TICKET_FLUSH"
+
# Test heap memory usage after handshake
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_MEMORY_DEBUG
diff --git a/tests/suites/host_test.function b/tests/suites/host_test.function
index b9ea3d6..bb06822 100644
--- a/tests/suites/host_test.function
+++ b/tests/suites/host_test.function
@@ -590,6 +590,7 @@
*/
test_files = &argv[ arg_index ];
testfile_count = argc - arg_index;
+ break;
}
arg_index++;
diff --git a/tests/suites/test_suite_aes.ecb.data b/tests/suites/test_suite_aes.ecb.data
index 6349034..b468ac3 100644
--- a/tests/suites/test_suite_aes.ecb.data
+++ b/tests/suites/test_suite_aes.ecb.data
@@ -228,3 +228,6 @@
AES-256-ECB Decrypt NIST KAT #12
aes_decrypt_ecb:"0000000000000000000000000000000000000000000000000000000000000000":"9b80eefb7ebe2d2b16247aa0efc72f5d":"e0000000000000000000000000000000":0
+
+AES-256-ECB Copy Context NIST KAT #1
+aes_ecb_copy_context:"c1cc358b449909a19436cfbb3f852ef8bcb5ed12ac7058325f56e6099aab1a1c":"00000000000000000000000000000000"
diff --git a/tests/suites/test_suite_aes.function b/tests/suites/test_suite_aes.function
index 52af8e0..5ab265a 100644
--- a/tests/suites/test_suite_aes.function
+++ b/tests/suites/test_suite_aes.function
@@ -460,6 +460,36 @@
}
/* END_CASE */
+/* BEGIN_CASE */
+void aes_ecb_copy_context( data_t * key_str, data_t * src_str )
+{
+ unsigned char output1[16], output2[16], plain[16];
+ mbedtls_aes_context ctx1, ctx2, ctx3;
+
+ // Set key and encrypt with original context
+ mbedtls_aes_init( &ctx1 );
+ TEST_ASSERT( mbedtls_aes_setkey_enc( &ctx1, key_str->x,
+ key_str->len * 8 ) == 0 );
+ TEST_ASSERT( mbedtls_aes_crypt_ecb( &ctx1, MBEDTLS_AES_ENCRYPT,
+ src_str->x, output1 ) == 0 );
+
+ ctx2 = ctx1;
+ TEST_ASSERT( mbedtls_aes_setkey_dec( &ctx1, key_str->x,
+ key_str->len * 8 ) == 0 );
+ ctx3 = ctx1;
+ memset( &ctx1, 0, sizeof( ctx1 ) );
+
+ // Encrypt and decrypt with copied context
+ TEST_ASSERT( mbedtls_aes_crypt_ecb( &ctx2, MBEDTLS_AES_ENCRYPT,
+ src_str->x, output2 ) == 0 );
+ TEST_ASSERT( mbedtls_aes_crypt_ecb( &ctx3, MBEDTLS_AES_DECRYPT,
+ output1, plain ) == 0 );
+
+ TEST_ASSERT( mbedtls_test_hexcmp( output1, output2, 16, 16 ) == 0 );
+ TEST_ASSERT( mbedtls_test_hexcmp( src_str->x, plain, src_str->len, 16 ) == 0 );
+}
+/* END_CASE */
+
/* BEGIN_CASE depends_on:MBEDTLS_SELF_TEST */
void aes_selftest( )
{
diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data
index 19a1ae6..d7b2fdf 100644
--- a/tests/suites/test_suite_ssl.data
+++ b/tests/suites/test_suite_ssl.data
@@ -223,7 +223,7 @@
Negative test moving servers ssl to state: NEW_SESSION_TICKET
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:0
+move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_NEW_SESSION_TICKET:0
TLS 1.3:Test moving clients handshake to state: ENCRYPTED_EXTENSIONS
depends_on:MBEDTLS_SSL_PROTO_TLS1_3:!MBEDTLS_SSL_PROTO_TLS1_2
@@ -796,19 +796,51 @@
SSL session serialization: Wrong major version
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_session_serialize_version_check:1:0:0:0
+ssl_session_serialize_version_check:1:0:0:0:0:MBEDTLS_SSL_VERSION_TLS1_2
SSL session serialization: Wrong minor version
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_session_serialize_version_check:0:1:0:0
+ssl_session_serialize_version_check:0:1:0:0:0:MBEDTLS_SSL_VERSION_TLS1_2
SSL session serialization: Wrong patch version
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_session_serialize_version_check:0:0:1:0
+ssl_session_serialize_version_check:0:0:1:0:0:MBEDTLS_SSL_VERSION_TLS1_2
SSL session serialization: Wrong config
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_session_serialize_version_check:0:0:0:1
+ssl_session_serialize_version_check:0:0:0:1:0:MBEDTLS_SSL_VERSION_TLS1_2
+
+TLS 1.3: CLI: session serialization: Wrong major version
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C
+ssl_session_serialize_version_check:1:0:0:0:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: session serialization: Wrong minor version
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C
+ssl_session_serialize_version_check:0:1:0:0:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: session serialization: Wrong patch version
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C
+ssl_session_serialize_version_check:0:0:1:0:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: session serialization: Wrong config
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C
+ssl_session_serialize_version_check:0:0:0:1:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: SRV: session serialization: Wrong major version
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_SRV_C
+ssl_session_serialize_version_check:1:0:0:0:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: SRV: session serialization: Wrong minor version
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_SRV_C
+ssl_session_serialize_version_check:0:1:0:0:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: SRV: session serialization: Wrong patch version
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_SRV_C
+ssl_session_serialize_version_check:0:0:1:0:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: SRV: session serialization: Wrong config
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_SRV_C
+ssl_session_serialize_version_check:0:0:0:1:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3
Record crypt, AES-128-CBC, 1.2, SHA-384
depends_on:MBEDTLS_CIPHER_MODE_CBC:MBEDTLS_AES_C:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SHA384_C
@@ -3169,99 +3201,163 @@
Session serialization, save-load: no ticket, no cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_load:0:""
+ssl_serialize_session_save_load:0:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save-load: small ticket, no cert
depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_load:42:""
+ssl_serialize_session_save_load:42:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save-load: large ticket, no cert
depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_load:1023:""
+ssl_serialize_session_save_load:1023:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save-load: no ticket, cert
depends_on:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_load:0:"data_files/server5.crt"
+ssl_serialize_session_save_load:0:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save-load: small ticket, cert
depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_load:42:"data_files/server5.crt"
+ssl_serialize_session_save_load:42:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save-load: large ticket, cert
depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_load:1023:"data_files/server5.crt"
+ssl_serialize_session_save_load:1023:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
+
+TLS 1.3: CLI: Session serialization, save-load: no ticket
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_save_load:0:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: Session serialization, save-load: small ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_save_load:42:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: Session serialization, save-load: large ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_save_load:1023:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: SRV: Session serialization, save-load: large ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_save_load:1023:"":MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3
Session serialization, load-save: no ticket, no cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_load_save:0:""
+ssl_serialize_session_load_save:0:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load-save: small ticket, no cert
depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_load_save:42:""
+ssl_serialize_session_load_save:42:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load-save: large ticket, no cert
depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_load_save:1023:""
+ssl_serialize_session_load_save:1023:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load-save: no ticket, cert
depends_on:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_load_save:0:"data_files/server5.crt"
+ssl_serialize_session_load_save:0:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load-save: small ticket, cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO
-ssl_serialize_session_load_save:42:"data_files/server5.crt"
+ssl_serialize_session_load_save:42:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load-save: large ticket, cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO
-ssl_serialize_session_load_save:1023:"data_files/server5.crt"
+ssl_serialize_session_load_save:1023:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
+
+TLS 1.3: CLI: Session serialization, load-save: no ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_load_save:0:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: Session serialization, load-save: small ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_load_save:42:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: Session serialization, load-save: large ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_load_save:1023:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: SRV: Session serialization, load-save
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_load_save:0:"":MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3
Session serialization, save buffer size: no ticket, no cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_buf_size:0:""
+ssl_serialize_session_save_buf_size:0:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save buffer size: small ticket, no cert
depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_buf_size:42:""
+ssl_serialize_session_save_buf_size:42:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save buffer size: large ticket, no cert
depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_buf_size:1023:""
+ssl_serialize_session_save_buf_size:1023:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save buffer size: no ticket, cert
depends_on:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_save_buf_size:0:"data_files/server5.crt"
+ssl_serialize_session_save_buf_size:0:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save buffer size: small ticket, cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO
-ssl_serialize_session_save_buf_size:42:"data_files/server5.crt"
+ssl_serialize_session_save_buf_size:42:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, save buffer size: large ticket, cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO
-ssl_serialize_session_save_buf_size:1023:"data_files/server5.crt"
+ssl_serialize_session_save_buf_size:1023:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
+
+TLS 1.3: CLI: Session serialization, save buffer size: no ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_save_buf_size:0:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: Session serialization, save buffer size: small ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_save_buf_size:42:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: Session serialization, save buffer size: large ticket
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_save_buf_size:1023:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: SRV: Session serialization, save buffer size
+depends_on:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_PROTO_TLS1_3
+ssl_serialize_session_save_buf_size:0:"":MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3
Session serialization, load buffer size: no ticket, no cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2
-ssl_serialize_session_load_buf_size:0:""
+ssl_serialize_session_load_buf_size:0:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load buffer size: small ticket, no cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C
-ssl_serialize_session_load_buf_size:42:""
+ssl_serialize_session_load_buf_size:42:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load buffer size: large ticket, no cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C
-ssl_serialize_session_load_buf_size:1023:""
+ssl_serialize_session_load_buf_size:1023:"":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load buffer size: no ticket, cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO
-ssl_serialize_session_load_buf_size:0:"data_files/server5.crt"
+ssl_serialize_session_load_buf_size:0:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load buffer size: small ticket, cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO
-ssl_serialize_session_load_buf_size:42:"data_files/server5.crt"
+ssl_serialize_session_load_buf_size:42:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
Session serialization, load buffer size: large ticket, cert
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_X509_USE_C:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_FS_IO
-ssl_serialize_session_load_buf_size:1023:"data_files/server5.crt"
+ssl_serialize_session_load_buf_size:1023:"data_files/server5.crt":0:MBEDTLS_SSL_VERSION_TLS1_2
+
+TLS 1.3: CLI: Session serialization, load buffer size: no ticket
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C
+ssl_serialize_session_load_buf_size:0:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: Session serialization, load buffer size: small ticket
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C
+ssl_serialize_session_load_buf_size:42:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: CLI: Session serialization, load buffer size: large ticket
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C
+ssl_serialize_session_load_buf_size:1023:"":MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3
+
+TLS 1.3: SRV: Session serialization, load buffer size
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_SRV_C
+ssl_serialize_session_load_buf_size:0:"":MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3
Constant-flow HMAC: MD5
depends_on:MBEDTLS_MD5_C
diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
index 47d8f2e..60f6e0d 100644
--- a/tests/suites/test_suite_ssl.function
+++ b/tests/suites/test_suite_ssl.function
@@ -1724,7 +1724,7 @@
* Populate a session structure for serialization tests.
* Choose dummy values, mostly non-0 to distinguish from the init default.
*/
-static int ssl_populate_session_tls12( mbedtls_ssl_session *session,
+static int ssl_tls12_populate_session( mbedtls_ssl_session *session,
int ticket_len,
const char *crt_file )
{
@@ -1805,6 +1805,52 @@
return( 0 );
}
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+static int ssl_tls13_populate_session( mbedtls_ssl_session *session,
+ int ticket_len,
+ int endpoint_type )
+{
+ ((void) ticket_len);
+ session->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
+ session->endpoint = endpoint_type == MBEDTLS_SSL_IS_CLIENT ?
+ MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER;
+ session->ciphersuite = 0xabcd;
+ session->ticket_age_add = 0x87654321;
+ session->ticket_flags = 0x7;
+
+ session->resumption_key_len = 32;
+ memset( session->resumption_key, 0x99, sizeof( session->resumption_key ) );
+
+#if defined(MBEDTLS_HAVE_TIME)
+ if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
+ {
+ session->start = mbedtls_time( NULL ) - 42;
+ }
+#endif
+
+#if defined(MBEDTLS_SSL_CLI_C)
+ if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ {
+#if defined(MBEDTLS_HAVE_TIME)
+ session->ticket_received = mbedtls_time( NULL ) - 40;
+#endif
+ session->ticket_lifetime = 0xfedcba98;
+
+ session->ticket_len = ticket_len;
+ if( ticket_len != 0 )
+ {
+ session->ticket = mbedtls_calloc( 1, ticket_len );
+ if( session->ticket == NULL )
+ return( -1 );
+ memset( session->ticket, 33, ticket_len );
+ }
+ }
+#endif /* MBEDTLS_SSL_CLI_C */
+
+ return( 0 );
+}
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
/*
* Perform data exchanging between \p ssl_1 and \p ssl_2 and check if the
* message was sent in the correct number of fragments.
@@ -4624,7 +4670,8 @@
/* END_CASE */
/* BEGIN_CASE */
-void ssl_serialize_session_save_load( int ticket_len, char *crt_file )
+void ssl_serialize_session_save_load( int ticket_len, char *crt_file,
+ int endpoint_type, int tls_version )
{
mbedtls_ssl_session original, restored;
unsigned char *buf = NULL;
@@ -4638,7 +4685,20 @@
mbedtls_ssl_session_init( &restored );
/* Prepare a dummy session to work on */
- TEST_ASSERT( ssl_populate_session_tls12( &original, ticket_len, crt_file ) == 0 );
+ ((void) endpoint_type);
+ ((void) tls_version);
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
+ {
+ TEST_ASSERT( ssl_tls13_populate_session(
+ &original, 0, endpoint_type ) == 0 );
+ }
+ else
+#endif
+ {
+ TEST_ASSERT( ssl_tls12_populate_session(
+ &original, ticket_len, crt_file ) == 0 );
+ }
/* Serialize it */
TEST_ASSERT( mbedtls_ssl_session_save( &original, NULL, 0, &len )
@@ -4658,61 +4718,109 @@
#endif
TEST_ASSERT( original.tls_version == restored.tls_version );
TEST_ASSERT( original.ciphersuite == restored.ciphersuite );
- TEST_ASSERT( original.compression == restored.compression );
- TEST_ASSERT( original.id_len == restored.id_len );
- TEST_ASSERT( memcmp( original.id,
- restored.id, sizeof( original.id ) ) == 0 );
- TEST_ASSERT( memcmp( original.master,
- restored.master, sizeof( original.master ) ) == 0 );
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+ if( tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
+ {
+ TEST_ASSERT( original.compression == restored.compression );
+ TEST_ASSERT( original.id_len == restored.id_len );
+ TEST_ASSERT( memcmp( original.id,
+ restored.id, sizeof( original.id ) ) == 0 );
+ TEST_ASSERT( memcmp( original.master,
+ restored.master, sizeof( original.master ) ) == 0 );
#if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
- TEST_ASSERT( ( original.peer_cert == NULL ) ==
- ( restored.peer_cert == NULL ) );
- if( original.peer_cert != NULL )
- {
- TEST_ASSERT( original.peer_cert->raw.len ==
- restored.peer_cert->raw.len );
- TEST_ASSERT( memcmp( original.peer_cert->raw.p,
- restored.peer_cert->raw.p,
- original.peer_cert->raw.len ) == 0 );
- }
+ TEST_ASSERT( ( original.peer_cert == NULL ) ==
+ ( restored.peer_cert == NULL ) );
+ if( original.peer_cert != NULL )
+ {
+ TEST_ASSERT( original.peer_cert->raw.len ==
+ restored.peer_cert->raw.len );
+ TEST_ASSERT( memcmp( original.peer_cert->raw.p,
+ restored.peer_cert->raw.p,
+ original.peer_cert->raw.len ) == 0 );
+ }
#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
- TEST_ASSERT( original.peer_cert_digest_type ==
- restored.peer_cert_digest_type );
- TEST_ASSERT( original.peer_cert_digest_len ==
- restored.peer_cert_digest_len );
- TEST_ASSERT( ( original.peer_cert_digest == NULL ) ==
- ( restored.peer_cert_digest == NULL ) );
- if( original.peer_cert_digest != NULL )
- {
- TEST_ASSERT( memcmp( original.peer_cert_digest,
- restored.peer_cert_digest,
- original.peer_cert_digest_len ) == 0 );
- }
+ TEST_ASSERT( original.peer_cert_digest_type ==
+ restored.peer_cert_digest_type );
+ TEST_ASSERT( original.peer_cert_digest_len ==
+ restored.peer_cert_digest_len );
+ TEST_ASSERT( ( original.peer_cert_digest == NULL ) ==
+ ( restored.peer_cert_digest == NULL ) );
+ if( original.peer_cert_digest != NULL )
+ {
+ TEST_ASSERT( memcmp( original.peer_cert_digest,
+ restored.peer_cert_digest,
+ original.peer_cert_digest_len ) == 0 );
+ }
#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
#endif /* MBEDTLS_X509_CRT_PARSE_C */
- TEST_ASSERT( original.verify_result == restored.verify_result );
-
-#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
- TEST_ASSERT( original.ticket_len == restored.ticket_len );
- if( original.ticket_len != 0 )
- {
- TEST_ASSERT( original.ticket != NULL );
- TEST_ASSERT( restored.ticket != NULL );
- TEST_ASSERT( memcmp( original.ticket,
- restored.ticket, original.ticket_len ) == 0 );
- }
- TEST_ASSERT( original.ticket_lifetime == restored.ticket_lifetime );
-#endif
+ TEST_ASSERT( original.verify_result == restored.verify_result );
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
- TEST_ASSERT( original.mfl_code == restored.mfl_code );
+ TEST_ASSERT( original.mfl_code == restored.mfl_code );
#endif
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
- TEST_ASSERT( original.encrypt_then_mac == restored.encrypt_then_mac );
+ TEST_ASSERT( original.encrypt_then_mac == restored.encrypt_then_mac );
#endif
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
+ TEST_ASSERT( original.ticket_len == restored.ticket_len );
+ if( original.ticket_len != 0 )
+ {
+ TEST_ASSERT( original.ticket != NULL );
+ TEST_ASSERT( restored.ticket != NULL );
+ TEST_ASSERT( memcmp( original.ticket,
+ restored.ticket, original.ticket_len ) == 0 );
+ }
+ TEST_ASSERT( original.ticket_lifetime == restored.ticket_lifetime );
+#endif
+ }
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
+ {
+ TEST_ASSERT( original.endpoint == restored.endpoint );
+ TEST_ASSERT( original.ciphersuite == restored.ciphersuite );
+ TEST_ASSERT( original.ticket_age_add == restored.ticket_age_add );
+ TEST_ASSERT( original.ticket_flags == restored.ticket_flags );
+ TEST_ASSERT( original.resumption_key_len == restored.resumption_key_len );
+ if( original.resumption_key_len != 0 )
+ {
+ TEST_ASSERT( original.resumption_key != NULL );
+ TEST_ASSERT( restored.resumption_key != NULL );
+ TEST_ASSERT( memcmp( original.resumption_key,
+ restored.resumption_key,
+ original.resumption_key_len ) == 0 );
+ }
+#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
+ if( endpoint_type == MBEDTLS_SSL_IS_CLIENT)
+ {
+ TEST_ASSERT( original.start == restored.start );
+ }
+#endif
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
+ if( endpoint_type == MBEDTLS_SSL_IS_CLIENT)
+ {
+#if defined(MBEDTLS_HAVE_TIME)
+ TEST_ASSERT( original.ticket_received == restored.ticket_received );
+#endif
+ TEST_ASSERT( original.ticket_lifetime == restored.ticket_lifetime );
+ TEST_ASSERT( original.ticket_len == restored.ticket_len );
+ if( original.ticket_len != 0 )
+ {
+ TEST_ASSERT( original.ticket != NULL );
+ TEST_ASSERT( restored.ticket != NULL );
+ TEST_ASSERT( memcmp( original.ticket,
+ restored.ticket,
+ original.ticket_len ) == 0 );
+ }
+
+ }
+#endif
+ }
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
exit:
mbedtls_ssl_session_free( &original );
@@ -4722,7 +4830,8 @@
/* END_CASE */
/* BEGIN_CASE */
-void ssl_serialize_session_load_save( int ticket_len, char *crt_file )
+void ssl_serialize_session_load_save( int ticket_len, char *crt_file,
+ int endpoint_type, int tls_version )
{
mbedtls_ssl_session session;
unsigned char *buf1 = NULL, *buf2 = NULL;
@@ -4735,7 +4844,20 @@
mbedtls_ssl_session_init( &session );
/* Prepare a dummy session to work on */
- TEST_ASSERT( ssl_populate_session_tls12( &session, ticket_len, crt_file ) == 0 );
+ ((void) endpoint_type);
+ ((void) tls_version);
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if(tls_version == MBEDTLS_SSL_VERSION_TLS1_3)
+ {
+ TEST_ASSERT( ssl_tls13_populate_session(
+ &session, 0, endpoint_type ) == 0 );
+ }
+ else
+#endif
+ {
+ TEST_ASSERT( ssl_tls12_populate_session(
+ &session, ticket_len, crt_file ) == 0 );
+ }
/* Get desired buffer size for serializing */
TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &len0 )
@@ -4772,7 +4894,8 @@
/* END_CASE */
/* BEGIN_CASE */
-void ssl_serialize_session_save_buf_size( int ticket_len, char *crt_file )
+void ssl_serialize_session_save_buf_size( int ticket_len, char *crt_file,
+ int endpoint_type, int tls_version )
{
mbedtls_ssl_session session;
unsigned char *buf = NULL;
@@ -4785,7 +4908,20 @@
mbedtls_ssl_session_init( &session );
/* Prepare dummy session and get serialized size */
- TEST_ASSERT( ssl_populate_session_tls12( &session, ticket_len, crt_file ) == 0 );
+ ((void) endpoint_type);
+ ((void) tls_version);
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if(tls_version == MBEDTLS_SSL_VERSION_TLS1_3)
+ {
+ TEST_ASSERT( ssl_tls13_populate_session(
+ &session, 0, endpoint_type ) == 0 );
+ }
+ else
+#endif
+ {
+ TEST_ASSERT( ssl_tls12_populate_session(
+ &session, ticket_len, crt_file ) == 0 );
+ }
TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &good_len )
== MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
@@ -4808,7 +4944,8 @@
/* END_CASE */
/* BEGIN_CASE */
-void ssl_serialize_session_load_buf_size( int ticket_len, char *crt_file )
+void ssl_serialize_session_load_buf_size( int ticket_len, char *crt_file,
+ int endpoint_type, int tls_version )
{
mbedtls_ssl_session session;
unsigned char *good_buf = NULL, *bad_buf = NULL;
@@ -4821,7 +4958,20 @@
mbedtls_ssl_session_init( &session );
/* Prepare serialized session data */
- TEST_ASSERT( ssl_populate_session_tls12( &session, ticket_len, crt_file ) == 0 );
+ ((void) endpoint_type);
+ ((void) tls_version);
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if(tls_version == MBEDTLS_SSL_VERSION_TLS1_3)
+ {
+ TEST_ASSERT( ssl_tls13_populate_session(
+ &session, 0, endpoint_type ) == 0 );
+ }
+ else
+#endif
+ {
+ TEST_ASSERT( ssl_tls12_populate_session(
+ &session, ticket_len, crt_file ) == 0 );
+ }
TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &good_len )
== MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
TEST_ASSERT( ( good_buf = mbedtls_calloc( 1, good_len ) ) != NULL );
@@ -4853,7 +5003,9 @@
void ssl_session_serialize_version_check( int corrupt_major,
int corrupt_minor,
int corrupt_patch,
- int corrupt_config )
+ int corrupt_config,
+ int endpoint_type,
+ int tls_version )
{
unsigned char serialized_session[ 2048 ];
size_t serialized_session_len;
@@ -4866,7 +5018,18 @@
corrupt_config == 1 };
mbedtls_ssl_session_init( &session );
- TEST_ASSERT( ssl_populate_session_tls12( &session, 0, NULL ) == 0 );
+ ((void) endpoint_type);
+ ((void) tls_version);
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if(tls_version == MBEDTLS_SSL_VERSION_TLS1_3)
+ {
+ TEST_ASSERT( ssl_tls13_populate_session(
+ &session, 0, endpoint_type ) == 0 );
+ }
+ else
+#endif
+ TEST_ASSERT( ssl_tls12_populate_session( &session, 0, NULL ) == 0 );
+
/* Infer length of serialized session. */
TEST_ASSERT( mbedtls_ssl_session_save( &session,
diff --git a/tests/suites/test_suite_version.data b/tests/suites/test_suite_version.data
index e4ffded..f131029 100644
--- a/tests/suites/test_suite_version.data
+++ b/tests/suites/test_suite_version.data
@@ -1,8 +1,8 @@
Check compile time library version
-check_compiletime_version:"3.2.0"
+check_compiletime_version:"3.2.1"
Check runtime library version
-check_runtime_version:"3.2.0"
+check_runtime_version:"3.2.1"
Check for MBEDTLS_VERSION_C
check_feature:"MBEDTLS_VERSION_C":0